last executing test programs: 1m40.882202955s ago: executing program 1 (id=1933): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x35, 0x0, 0x1, 0xffffffff}]}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_mreqsrc(r0, 0x0, 0x53, 0x0, 0x0) 1m40.872434304s ago: executing program 1 (id=1934): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="0203f30216000000000000002000000002001b0008000000e9000000000000000300060000000000020000000000000000000000000000000200400000000000000003fcff000020030005000000000002000000041414aa00000000000000000a00080008"], 0xb0}, 0x1, 0x7}, 0x0) 1m40.70165222s ago: executing program 1 (id=1936): sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x3c, 0x0, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x6}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x4}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000001800010000000000000000000220000000000006000000000c00090008000000", @ANYRES32, @ANYBLOB="08000400", @ANYRES32, @ANYBLOB="080005"], 0x38}}, 0x0) 1m40.638205716s ago: executing program 1 (id=1937): write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r0, 0xc05064a7, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/fscaps', 0x82002, 0x105) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x2000, 0x41000, 0x4, 0x9, 0x3, 0xe1, 0x40, 0x2c, 0x0, 0x5a, 0x19, 0x87}, {0x2, 0x54000, 0xe, 0x0, 0xc0, 0x5, 0x7d, 0x8, 0x58, 0x7, 0x3, 0x6}, {0xdddd1000, 0xffffffff, 0xe, 0x16, 0x3, 0x7, 0xfe, 0x89, 0x80, 0xab, 0x85, 0x81}, {0x6000, 0x40000, 0x3, 0x5d, 0x4, 0x43, 0x9, 0xfa, 0x80, 0x7, 0xe}, {0x58000, 0xf000, 0xb, 0x2, 0x3, 0x7, 0xab, 0x7f, 0x5, 0x83, 0xf7, 0x5}, {0x41000, 0x58000, 0x10, 0xa0, 0xb1, 0x8, 0x1, 0x2, 0x80, 0x7, 0x2, 0xfd}, {0x3000, 0x2, 0x4, 0x5, 0x7, 0x2, 0xb, 0x0, 0x5, 0x8, 0xff, 0x70}, {0xd000, 0x1000, 0xd, 0x5, 0xf, 0x7, 0x1, 0x18, 0x8, 0x3, 0xda, 0x9}, {0x100000, 0xc}, {0x2000, 0x86}, 0xc0000031, 0x0, 0x8000000, 0x42024, 0xb, 0x1, 0x3000, [0x6840000000000000, 0x3, 0xef6, 0xff]}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f000080e000/0x18000)=nil, &(0x7f0000001b00)=[@textreal={0x8, 0x0}], 0x1, 0xe, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r4, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x2000005}}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000130001000400"/20, @ANYRES32=0x0, @ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r7, @ANYBLOB="1400350064756d6d7930"], 0x3c}, 0x1, 0x0, 0x0, 0x8004010}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x128c002, &(0x7f0000000640)={{'fd', 0x3d, r8}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x3c, 0x0, 0x0) r9 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x88901) move_mount(r9, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r10 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r10, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) open_tree(r9, &(0x7f0000000640)='\x00', 0x89901) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$vsock_stream(0x28, 0x1, 0x0) 1m40.378713086s ago: executing program 1 (id=1939): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000068a000000000000040000001801000020696c2500000000002020207b1ad8ff00200000bfa1000000000000070100000400ffffb702000008000000b703000002000000850000002e00000095"], &(0x7f0000000000)='syzkaller\x00', 0x8}, 0x94) 1m40.004361801s ago: executing program 1 (id=1940): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000003000000000000000000000009400020008eaff0095"], &(0x7f00000002c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x6400, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 1m39.552587456s ago: executing program 32 (id=1940): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000003000000000000000000000009400020008eaff0095"], &(0x7f00000002c0)='GPL\x00', 0xf, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x6400, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 10.287624934s ago: executing program 3 (id=2484): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x11, 0xffffffffffffffff, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x0) r1 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000700)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[], 0x20) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000080)=ANY=[@ANYBLOB="400a00001e3421455c0000"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000400)={0x40, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000900)={0x34, &(0x7f0000000100)=ANY=[@ANYBLOB='@\a\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000300)={0xa000201c}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) sendfile(r2, r4, 0x0, 0x20000023896) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000200)={0x300, 0xfffffffc, 0x100, 0x8000, 0x0, "7a58beca3900000000000000000000000200"}) 8.457628749s ago: executing program 5 (id=2491): syz_open_dev$sg(&(0x7f00000000c0), 0x1000, 0x20802) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) unshare(0x2c020400) r5 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000000)={0x7c, 0x3000, 0x0, r5}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f00000003c0)={0x5, 0x3000, 0x0, r5, 0x4}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r7 = socket$inet6(0xa, 0x3, 0xf) setsockopt$inet6_IPV6_RTHDR(r7, 0x29, 0x39, &(0x7f0000000400)=ANY=[@ANYBLOB="8f506370d700de40390d6ff5d310592b608bdc93e7f6e8aee03f6ac56a5c3c5c61a090821c6eaae97aa7dcbd18fa42cdf88f55c8eb28e9e8e0a073216bfc555b6ca900ba70d948c8f5afb0fcfd8d043483c8295ef23e7ad2d5bc1436a86f403b62500f32d3f03c3be33d816c519e446ff0519d2fcccde9b66fb5dd1df6fc6acfe08b04bd88e36ccf17c0"], 0x18) connect$inet6(r7, &(0x7f0000000140)={0xa, 0xdffd, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4}, 0x1c) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000180)={0x80, 0x4000, 0x0, r5, 0x9}) writev(r7, &(0x7f00000000c0), 0x1e) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/ip6_tables_targets\x00') preadv(r0, &(0x7f00000000c0), 0x0, 0x10000009, 0xffffffff) ioctl$FBIO_WAITFORVSYNC(r6, 0x40044620, 0x0) socket(0xa, 0x1, 0x1) connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) r8 = socket$netlink(0x10, 0x3, 0x4) writev(r8, &(0x7f0000000300)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c561e117436c379000000000000000058000b4824ca945f6400d40f6a0325010ebc000000000000008000f0fffeffd809005300fff5dd00000010000100070c060000000000224e0000", 0x58}], 0x1) writev(r2, &(0x7f0000000740)=[{&(0x7f00000000c0)}, {&(0x7f0000000100)="cf427be31d5ef51baee7e4d063", 0xd}, {&(0x7f00000004c0)="345acd8641de70014a7459ddaa402173bc04790b472eaa5d3fc72dcae8a775067b4e962f6b391da4b8f7a29eb07ec6b5f86577b75b6091fb6789b5b7b3e725f684ac6a21171d73ec4b3580d5b6560931a10420b5d90327fffbe9b5cd104872c60fd4e0418305373abf3cbc78c4c4c4f01de6d1fd427145ace41d76a62f0776d0ee0db123ab974dd0d1a40f2bcfaf00e73281c737010cd2c86a96cc51d9d85772c9faecc4c5bc494d3266dcb3c4728ca2ae79f7520ad35535eefc9e3aef866542d139", 0xc2}, {&(0x7f0000000640)="a681d84766dab50a0742c00d8b9cb9117e483562118bc8fe034944a6bb235587209b83d74a37494e830d726c536f01fa68693eadc2ee39b1b9b8f234364ed8c3214a5477cabc55edea28d70a3c91bc57dffcebbf4b0452fade2a3cf8ee3e66b8bfadb540e7afe7a3de72dc6bf9befe98ac95782ec7eae2016456edbeb05656239460efa2167ed4831e7496084bd3da10b41270f7f2786046d52848ef500992f1a61030d6320479f2f3500f2b17aa67e827e19f7a9158ea7ce95154c3f0ee9f8a1efcc5f6aa5447bd6432f749a035b7438a2f29621ca576819a8fccaf67103095e3f4f5af3f", 0xe5}], 0x4) futex(&(0x7f0000000000), 0x5, 0x1, 0x0, &(0x7f0000000140), 0xc6fffffd) 7.095317169s ago: executing program 5 (id=2494): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc010000000000000000000000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000800090000000000000001000000ffffffff0000000000000000030000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r3, @ANYRES16=r0], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 6.990923109s ago: executing program 5 (id=2495): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001f00), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="3400000043450ee418e523f67d0f2a5260397c6f5caff674ce1aea4bf458b2181e65606434a49c568073cf6da0854879e0c7739db6602f39213a5e7c740c066df9cdb3d5843041660ca71a94de752054c0b188afc7f272f1a8bdeb39f16238b45772f70b16853c205ced1c04915f9c7f052e8db391bf3fd1163d70325f11cd97955e0b3b46b6dab0a4ea8edab1f6ce908b586ca43d5cfd3ddc90c583c133be69e5734b523ad4fa4c9db89d0051fe24f38d09a344c924478c0a98b870334afab5e246043b25102edbccf16b1e87e471a01874c90aaead031dbd25be4d5e0b28375eeb4f0277df42", @ANYRES16=r2, @ANYBLOB="010029bd7000fddbdf2501000000040001801c0002800c00018008000100060000000c0001800800010007000000"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[], 0x88}}, 0x1000) r3 = socket(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x40040c0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001800dd8d0000000000000000020000000000000600000000060015000100000018001680140001"], 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x200000a0) sendmmsg(r3, &(0x7f0000000000), 0x400000000000235, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x7ff, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000040)={0x0, 0x0, r4}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0xe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) socket$netlink(0x10, 0x3, 0x9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) memfd_create(&(0x7f0000000580)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc5\x1d\xe7jDf\x87@\x8fg\x15RJw\x82\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7g\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05', 0x0) r5 = userfaultfd(0x80c00) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x110}) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f00000001c0)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000080)={{&(0x7f00003fe000/0x4000)=nil, 0x4000}}) signalfd4(r0, &(0x7f0000000100)={[0x6]}, 0x8, 0x0) timer_create(0x3, &(0x7f00000000c0)={0x0, 0x3e, 0x2, @thr={0x0, 0x0}}, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) unshare(0x66000080) r6 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc010203010902"], 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'netdevsim0\x00'}) 6.722812442s ago: executing program 4 (id=2496): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}], 0x1, 0x40800) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00011500000000000000001c"], 0x30}, 0x1, 0x0, 0x0, 0x400c090}, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x2, 0x3ff, 0x1, 0x800, 0x80, 0x100, 0x1, 0x7, 0x1ff, 0x3ff, 0xfffffffe, 0x2, 0x5, 0x0, 0x400, 0x9, 0xfffff001, 0x8, 0x329, 0x16349f1b, 0x5, 0x9, 0x7, 0xe, 0xd7, 0x1ffe00, 0x8, 0x0, 0x3, 0x5, 0x199, 0x80000001, 0x0, 0x4, 0x9fe, 0x0, 0x8, 0x1, 0xff, 0x4, 0xa, 0xd, 0x1, 0x80, 0x4, 0x667171d9, 0x2, 0x80f3, 0x80000001, 0x9, 0x1ff, 0x854, 0x3874, 0x10001, 0x8, 0xc8c, 0x5, 0xc, 0x6, 0x401, 0x3, 0xff, 0xd, 0x609d, 0x6, 0xd, 0x0, 0x3, 0x62, 0x8, 0x9, 0x80000000, 0x5, 0x10001, 0x9, 0xce, 0x3, 0x2, 0x2621, 0x5, 0x8, 0x10001, 0x10000, 0x7, 0x80000000, 0x3, 0x4, 0xffff, 0x1c, 0xfff, 0x7, 0x5, 0x3, 0x6, 0x98e, 0xb9, 0x1a6b, 0x9, 0x9, 0x3f06, 0x0, 0x3, 0x8, 0xff, 0x5, 0xfff, 0x3ff, 0xb, 0xfffffff7, 0x1, 0x80, 0x1, 0x3, 0x101, 0xb65, 0x4a56, 0xe9, 0xfffff204, 0x40, 0xc52a, 0xffff, 0x8, 0x7, 0x2, 0x6, 0x5, 0x5, 0x81, 0x8bc, 0x2, 0x7, 0x1, 0x4, 0x3, 0x77, 0x0, 0x900000, 0x1000, 0x6, 0x33ae, 0x9, 0x6, 0x4, 0x6, 0x7, 0x144c, 0x2, 0x800, 0x4, 0x3, 0x6, 0x0, 0xfff, 0x6, 0x7, 0x366, 0x7fffffff, 0x9, 0x7, 0x8, 0xffffffff, 0x81, 0x5, 0x6, 0x8, 0x4, 0x8, 0x0, 0x29, 0x6, 0x0, 0x7d8eaac5, 0xfff, 0x4, 0x7, 0x7, 0x2, 0xb1, 0x9, 0x13, 0x2, 0xfff, 0x9, 0xde0e, 0xfffffffb, 0x4, 0x7, 0x4, 0x80, 0x2, 0x9, 0xe4, 0x10001, 0x1000, 0x400, 0x8, 0xc50a00, 0x7fffffff, 0xf, 0x6, 0x6, 0x14ba18dc, 0x0, 0x9, 0x0, 0xf, 0x6, 0x0, 0x6, 0x2, 0x13, 0x7, 0x5, 0x4, 0x6, 0x1, 0x2377989c, 0x7fffffff, 0x4, 0x2, 0x9, 0xcb8, 0x80, 0x2, 0x1ff, 0x2, 0x8000, 0x73ea2fe8, 0x7, 0x6, 0x1, 0x0, 0x1, 0x6, 0x5, 0xbcf, 0x2, 0x4, 0x0, 0x8, 0x9e1, 0xc, 0x5, 0x58c1, 0x33, 0x2, 0x9, 0x5, 0x37, 0x80000001, 0x9, 0x7, 0x8, 0x1, 0xfffffff0, 0xffffffff]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) getsockname$inet(0xffffffffffffffff, 0x0, &(0x7f0000002280)) 6.460759258s ago: executing program 4 (id=2498): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000040)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c000000009700000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac141411e0000001000000002c000000000000000000000007000000011c13"], 0x50}, 0x0) 6.367702507s ago: executing program 4 (id=2499): write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe(&(0x7f0000000140)) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2cf6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0}}]}}, 0x0) socket$pppoe(0x18, 0x1, 0x0) syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f00004d4000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000890000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc0}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES8=r3], 0x50) io_uring_enter(r4, 0x2219, 0x2d93, 0x51, 0x0, 0x0) 6.206480502s ago: executing program 3 (id=2501): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4dd086d0492082a6d0000000109021b0001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x84, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000500)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x338) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {}, {0x8, 0x6}}, [@filter_kind_options=@f_flow={{0x9}, {0x58, 0x2, [@TCA_FLOW_ACT={0x54, 0x9, 0x0, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x4000000, 0x20000001, 0x4, 0x2}, 0x1, r4}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0x88}}, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0xc0b45545, &(0x7f00000000c0)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r6, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x1fc}, 0x1c) listen(r6, 0x80000003) socket$netlink(0x10, 0x3, 0x4) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xc, &(0x7f0000000080)=0x1, 0x65) socketpair(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r8, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r9, &(0x7f0000000500)='tasks\x00', 0x2, 0x0) 4.778727434s ago: executing program 5 (id=2511): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000010000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}, 0x1, 0x0, 0x80ffffff}, 0x4000) 4.741685166s ago: executing program 5 (id=2512): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r4 = dup(r3) write$binfmt_aout(r4, 0x0, 0xffffffdb) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="380000005400e50100000000fdffffff07000000", @ANYRES32=r7, @ANYBLOB="20000100", @ANYRES32, @ANYBLOB="010101007f02"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="48000000100001040000000000070000000000009176820e4f71e3289d94c40b4dc1c763ba61b0ac49503deec0f0adce697ff4ec2f108c8e4c480f66d2a4c7413977cd3cd2a695183cc29e616e811a4f772a9cf806d91a4d2ea2391e7bd0579359be0d73f457f2e64313e33b3e12852ce284fa09217cc1dd597568f5725eb279eb9c04f62b8dfb2dc1d0a8e89c1f2cb4805f876cc00fa79854f676b74bce6c2fed94a8bbc80ad8ac8b4757ec68", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) syz_usb_connect(0x0, 0x181, &(0x7f0000000080)=ANY=[], 0x0) 4.736073165s ago: executing program 0 (id=2513): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='blkio.bfq.sectors\x00', 0x275a, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x20, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x2}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x7}}}}]}]}, 0x70}}, 0x20040000) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 4.531230343s ago: executing program 0 (id=2514): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x1fc, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@empty, 0x0, 0x3, 0x0, 0x0, 0xa, 0x0, 0x20, 0x8}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}, 0x0, 0x0, 0x0, 0x0, 0x1}, [@tmpl={0x144, 0x5, [{{@in6=@private2, 0x0, 0x2b}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xc}, 0x0, 0x0, 0x0, 0xff}, {{@in=@broadcast, 0x0, 0x32}, 0x0, @in6=@private0={0xfc, 0x0, '\x00', 0x1}}, {{@in6=@mcast2, 0x30000000, 0x3c}, 0x2, @in=@remote, 0x0, 0x1, 0x3}, {{@in6=@mcast2, 0x0, 0x2b}, 0x2, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x6c}, 0x0, @in=@broadcast, 0x0, 0x1}]}]}, 0x1fc}}, 0x0) 4.458744202s ago: executing program 0 (id=2515): r0 = socket(0x10, 0x80002, 0x0) (async) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0xc369d000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000580)=""/4096, 0x1000) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) sendmmsg$alg(r0, &(0x7f00000000c0), 0x492492492492627, 0x0) 4.412159459s ago: executing program 3 (id=2516): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000040)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c000000000030000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac141411e0000001000000002c000000000000000000000007000000011c13"], 0x50}, 0x0) 4.358381985s ago: executing program 3 (id=2517): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r7, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r4], 0x3c}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r8], 0x5c}}, 0x40) 4.306613982s ago: executing program 4 (id=2518): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x11, 0xffffffffffffffff, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x0) r1 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000700)=ANY=[@ANYBLOB='\x000\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32=0xffffffffffffffff, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[], 0x20) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000080)=ANY=[@ANYBLOB="400a00001e3421455c0000"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000340)=ANY=[@ANYRES32=r1, @ANYRES16, @ANYBLOB="6aa94bc97fdbde13cf09fc771576c237c5579f99b9058a11e238a79f56a3f07f27023301df41c21c13326284fc261fd4c8c79405", @ANYRESOCT=r2, @ANYRES16=r1, @ANYRES8], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000140)=0x14) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000400)={0x40, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000900)={0x34, &(0x7f0000000100)=ANY=[@ANYBLOB='@\a\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000300)={0xa000201c}) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) sendfile(r3, r5, 0x0, 0x20000023896) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000200)={0x0, 0xfffffffc, 0x100, 0x8000, 0x0, "7a58beca3900000000000000000000000200"}) 4.030004384s ago: executing program 3 (id=2519): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x11, 0xffffffffffffffff, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x0) r1 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000680)={0x34, &(0x7f0000000700)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000c015}, 0x2404c8c0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='&'], 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[], 0x20) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000080)=ANY=[@ANYBLOB="400a00001e3421455c0000"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000300)={0x34, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000400)={0x40, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000900)={0x34, &(0x7f0000000100)=ANY=[@ANYBLOB='@\a\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000300)={0xa000201c}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) sendfile(r2, r4, 0x0, 0x20000023896) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000200)={0x600, 0xfffffffc, 0x100, 0x8000, 0x0, "7a58beca3900000000000000000000000200"}) 3.834538007s ago: executing program 0 (id=2520): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}], 0x1, 0x40800) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00011500000000000000001c"], 0x30}, 0x1, 0x0, 0x0, 0x400c090}, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x2, 0x3ff, 0x1, 0x800, 0x80, 0x100, 0x1, 0x7, 0x1ff, 0x3ff, 0xfffffffe, 0x2, 0x5, 0x0, 0x400, 0x9, 0xfffff001, 0x8, 0x329, 0x16349f1b, 0x5, 0x9, 0x7, 0xe, 0xd7, 0x1ffe00, 0x8, 0x0, 0x3, 0x5, 0x199, 0x80000001, 0x0, 0x4, 0x9fe, 0x0, 0x8, 0x1, 0xff, 0x4, 0xa, 0xd, 0x1, 0x80, 0x4, 0x667171d9, 0x2, 0x80f3, 0x80000001, 0x9, 0x1ff, 0x854, 0x3874, 0x10001, 0x8, 0xc8c, 0x5, 0xc, 0x6, 0x401, 0x3, 0xff, 0xd, 0x609d, 0x6, 0xd, 0x0, 0x3, 0x62, 0x8, 0x9, 0x80000000, 0x5, 0x10001, 0x9, 0xce, 0x3, 0x2, 0x2621, 0x5, 0x8, 0x10001, 0x10000, 0x7, 0x80000000, 0x3, 0x4, 0xffff, 0x1c, 0xfff, 0x7, 0x5, 0x3, 0x6, 0x98e, 0xb9, 0x1a6b, 0x9, 0x9, 0x3f06, 0x0, 0x3, 0x8, 0xff, 0x5, 0xfff, 0x3ff, 0xb, 0xfffffff7, 0x1, 0x80, 0x1, 0x3, 0x101, 0xb65, 0x4a56, 0xe9, 0xfffff204, 0x40, 0xc52a, 0xffff, 0x8, 0x7, 0x2, 0x6, 0x5, 0x5, 0x81, 0x8bc, 0x2, 0x7, 0x1, 0x4, 0x3, 0x77, 0x0, 0x900000, 0x1000, 0x6, 0x33ae, 0x9, 0x6, 0x4, 0x6, 0x7, 0x144c, 0x2, 0x800, 0x4, 0x3, 0x6, 0x0, 0xfff, 0x6, 0x7, 0x366, 0x7fffffff, 0x9, 0x7, 0x8, 0xffffffff, 0x81, 0x5, 0x6, 0x8, 0x4, 0x8, 0x0, 0x29, 0x6, 0x0, 0x7d8eaac5, 0xfff, 0x4, 0x7, 0x7, 0x2, 0xb1, 0x9, 0x13, 0x2, 0xfff, 0x9, 0xde0e, 0xfffffffb, 0x4, 0x7, 0x4, 0x80, 0x2, 0x9, 0xe4, 0x10001, 0x1000, 0x400, 0x8, 0xc50a00, 0x7fffffff, 0xf, 0x6, 0x6, 0x14ba18dc, 0x0, 0x9, 0x0, 0xf, 0x6, 0x0, 0x6, 0x2, 0x13, 0x7, 0x5, 0x4, 0x6, 0x1, 0x2377989c, 0x7fffffff, 0x4, 0x2, 0x9, 0xcb8, 0x80, 0x2, 0x1ff, 0x2, 0x8000, 0x73ea2fe8, 0x7, 0x6, 0x1, 0x0, 0x1, 0x6, 0x5, 0xbcf, 0x2, 0x4, 0x0, 0x8, 0x9e1, 0xc, 0x5, 0x58c1, 0x33, 0x2, 0x9, 0x5, 0x37, 0x80000001, 0x9, 0x7, 0x8, 0x1, 0xfffffff0, 0xffffffff]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) getsockname$inet(0xffffffffffffffff, 0x0, &(0x7f0000002280)) 3.71899769s ago: executing program 0 (id=2521): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x800452d2, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000e40), 0x0, 0x400c800) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3ff, 0x1, 0xfffffff8, 0x0, 0x7, 0x7f, 0x8, 0x5, 0x1}}}}]}, 0x58}}, 0x44884) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=@newtfilter={0x104, 0x2c, 0xd27, 0x70bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r3, {0x6}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0xd4, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0xc}}, @TCA_BASIC_CLASSID={0x8, 0x1, {0xf, 0xc}}, @TCA_BASIC_EMATCHES={0x4}, @TCA_BASIC_EMATCHES={0xbc, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0xb0, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0xfffffffffffffc3e, 0x3, 0x0, 0x0, {{0x8000, 0x7, 0x8}, {{0x1, 0x0, 0x1}, {0x3, 0x0, 0x1}}}}, @TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x3, 0x0, 0x7}}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x401, 0x3, 0x8001}, {0x4, 0x4, 0x9, 0x81}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x1577, 0x1, 0xfffc}, {0x4e3b238, 0x7, 0xf566, 0x4, 0x5, 0x1, 0x1}}}, @TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x4, 0x7, 0x1}, {{0x2, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x1}}}}, @TCF_EM_IPSET={0x10, 0x3, 0x0, 0x0, {{0x6, 0x8, 0x7fff}, {0x4, 0x5, 0x1}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x4, 0x1, 0x7}, {0xe1d, 0xd, 0x0, 0x1, 0x9, 0x1, 0x2}}}, @TCF_EM_NBYTE={0x1c, 0x3, 0x0, 0x0, {{0x6, 0x2, 0xa}, {0x5, 0x9, 0x1, "abc00e12181f79fbda"}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8a}}]}]}}]}, 0x104}}, 0x2000c800) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r4, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x8c, 0x0, 0x8, 0x301, 0x0, 0x0, {0x7, 0x0, 0xa}, [@CTA_TIMEOUT_DATA={0x1c, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_CLOSE_WAIT={0x8, 0x5, 0x1, 0x0, 0xb}, @CTA_TIMEOUT_TCP_SYN_SENT={0x8, 0x1, 0x1, 0x0, 0x3}, @CTA_TIMEOUT_TCP_RETRANS={0x8, 0xa, 0x1, 0x0, 0x8}]}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x984}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xd6e}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x612}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x1}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x4}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6}]}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x20008044) 3.612935907s ago: executing program 0 (id=2522): socket$kcm(0x10, 0x2, 0x0) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='ns\x00') fchdir(r0) creat(&(0x7f0000000300)='./bus\x00', 0x0) r1 = getpid() syz_pidfd_open(r1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x4000)=nil, 0x0, 0x12) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x7, &(0x7f000022c000/0x3000)=nil) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = syz_open_dev$vim2m(&(0x7f0000000680), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r3, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f0000000080)={0x6c0, 0x1, 0x1, 0x0, 0x5e}) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) r4 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r4, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) fgetxattr(r5, &(0x7f0000000080)=@known='system.posix_acl_default\x00', &(0x7f0000000740)=""/4096, 0x1000) syz_usb_connect(0x0, 0x3b, &(0x7f0000000080)=ANY=[@ANYBLOB="120100001b3ebd40d80483009c0001020301090229000100000000090400000002020100050200000005"], 0x0) syz_io_uring_setup(0x5432, &(0x7f00000000c0)={0x0, 0x8618, 0x4, 0x0, 0x3c7, 0x0, r0}, &(0x7f0000000140), &(0x7f0000000180), &(0x7f00000001c0)) 3.298647124s ago: executing program 2 (id=2524): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) (async) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x4004) mremap(&(0x7f0000000000/0x9000)=nil, 0x600000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) (async) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) (async) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f00000000c0)="170000000200010400ffbe8c5ee17688a20032e80101000a000002a257fc5ad90200bb6a880000d6c8db000000df018002000000fc0607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dfc060115003901000000000000eaffff00000000000062068f5ee50ce5af9b1c5683ffffff02ff030000ba000840024f0298e9e90539062a80e605007f71174aa951f3c63e5a1b47b63a6323ded2231454668492f9c681a6a9fc", 0xb8) (async) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb08004500007804ffe0ebfa638c3000000000060190780a070103ac1414aa0304907864010101450000000000000000110000e000000100000000"], 0x0) (async) r1 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f0000000200)='./file0\x00', 0x86041, &(0x7f0000000240)={{}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, 0xee00}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x100000001}}, {@allow_other}, {@default_permissions}, {@max_read={'max_read', 0x3d, 0xe7f}}, {@default_permissions}, {@allow_other}, {@default_permissions}, {@default_permissions}], [{@subj_type={'subj_type', 0x3d, '%'}}, {@euid_gt={'euid>', 0xee01}}]}}, 0x1, 0x0, &(0x7f0000000380)="946a373664a895766e52647d4fed0ea453ec1b3e912b229baa33ca83e4df74c9de08dea7d0c823e686f13c929e037b97005a7c378ad38ef6ee7281da8cd9acc5f748ff0a73f96eeada3384bc989352cc83d052ee026387b0d58307dd6d4db64faf027f6d9e7b87e06cb5a1c988e5bbff03362c302289f52972926cb8d82cbe7240708afe1fe482ee5131e97aa5c3") mkdirat(r1, &(0x7f0000000440)='./file0\x00', 0x1c) (async) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000280)={0x4000, 0x2}, 0x10) (async) sendmsg$nl_generic(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a"], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x33) ioctl$KVM_GET_PIT2(r3, 0x8070ae9f, &(0x7f0000000480)) 3.169183592s ago: executing program 2 (id=2525): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000001fd8)=ANY=[@ANYBLOB="8500000003000000180a00000000000000000000000000009500000d00000000"], &(0x7f0000000180)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x40) 3.103107322s ago: executing program 2 (id=2526): r0 = syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000018105704da07000000000001500024000100000000090300f0ff092100000001222200096a09030000aa00"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022220000009523b31ce93ee907000000002990370900be0083000000000b09307a15b3"], 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000049e9b31c073f000200000b09007a15b3"], 0x0}, 0x0) r1 = socket(0x1d, 0x2, 0x6) r2 = epoll_create1(0x80000) r3 = epoll_create1(0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000280), 0xe4600) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x121c02, 0x0) ioctl$PPPIOCSACTIVE(r5, 0x40107446, &(0x7f0000000000)={0xfffffedb, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="24000000250009011fbd7008f9ffffff020000000800030047000000c71da41fc5c6b5665263c39752a1c14308006900fbae84b3682ebdcb2c6659093bed17b1af1b7869c90fce3b8ee1ae14b095", @ANYRES32, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x1000c957}, 0x0) r8 = syz_open_dev$dvb_demux(&(0x7f00000002c0), 0x81, 0x100) ioctl$EXT4_IOC_GROUP_ADD(r8, 0x40286608, &(0x7f0000000040)={0xd, 0xbaa, 0x20000000837, 0x6, 0xfffffff0, 0x9}) ioctl$TIOCSSOFTCAR(r6, 0x541a, &(0x7f00000000c0)=0x100) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f0000000040)={0xa0000007}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x10000000}) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f0000000140)={0x0, 0x4, 0x7, 0x3, @vifc_lcl_ifindex, @rand_addr=0x64010101}, 0x10) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r3, &(0x7f0000000080)={0x40000006}) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_int(r10, 0x6, 0xc, &(0x7f0000000180), &(0x7f0000000200)=0x4) close_range(r9, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000380)={0x1d, r11, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) sendto$packet(r1, 0x0, 0x206c, 0x4004000, 0x0, 0x0) r12 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000003c0), 0x547102, 0x0) read$char_usb(r12, &(0x7f0000001b40)=""/3, 0x3) 2.45907008s ago: executing program 2 (id=2527): setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000480)=@security={'security\x00', 0xe, 0x4, 0x360, 0xffffffff, 0x1f8, 0x128, 0x0, 0xffffffff, 0xffffffff, 0x2c8, 0x2c8, 0x2c8, 0xffffffff, 0x4, 0x0, {[{{@ip={@multicast1, @remote, 0xffffffff, 0x0, 'batadv_slave_1\x00', 'pimreg1\x00', {}, {}, 0x21, 0x1, 0x3}, 0x0, 0xc8, 0x128, 0x0, {}, [@common=@inet=@udplite={{0x30}, {[0x4e22, 0x4e22], [0x4e24, 0x4e22]}}, @common=@icmp={{0x28}, {0x10, "3983", 0x1}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @empty, 0x5, 0x3, [0x19, 0xe, 0x1b, 0x4, 0x28, 0x31, 0x38, 0x29, 0x2e, 0x28, 0x7, 0xa, 0x1b, 0x3b, 0x8, 0x1f], 0x1, 0x66f, 0x20000000000}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast, 0x5, 0x6, [0x14, 0x1b, 0x10, 0x30, 0x36, 0x35, 0x24, 0x3e, 0x2b, 0x15, 0x29, 0x24, 0x40, 0x25, 0x1c, 0x3b], 0x0, 0x6, 0x8000000000000001}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x22}, 0xffffffff, 0xffffff00, 'pim6reg0\x00', 'team_slave_1\x00', {}, {0xff}, 0x84, 0x1}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x7, 0xd, [0x38, 0xa, 0xe, 0xe, 0x38, 0xe, 0x2e, 0x2, 0x1b, 0x26, 0x36, 0x2c, 0x1b, 0x0, 0x2e, 0x38], 0x1, 0x6, 0x3}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3c0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c0200001900010000000000fbdbdf25e0000001000000000000000000000000ac1414bb0000000000000000000000000000000bffff00000a00800000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000008401050064010100000000000000000000000000000000003c00000000000000ffffffff000000000000000000000000ff34000000000000000000000000000000000000ac1414aa000000000000000000000000000000003c00000000000000fe800000000000000000000000000000010000000000000000080000000800000000000000000000000000000000000000000001000000003200000000000000e00000010000000000000000000000000335000003000000000000000000000000000000ff0100000000000000000000000000010000000033"], 0x23c}}, 0x0) 2.414865818s ago: executing program 2 (id=2528): write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe(&(0x7f0000000140)) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2cf6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0}}]}}, 0x0) socket$pppoe(0x18, 0x1, 0x0) syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[], 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f00004d4000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000890000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r4 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc0}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES8=r3], 0x50) io_uring_enter(r4, 0x2219, 0x2d93, 0x51, 0x0, 0x0) 1.665106904s ago: executing program 5 (id=2529): r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r0, 0xc1105511, 0x0) sendmsg$NL80211_CMD_PROBE_MESH_LINK(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000040)=ANY=[@ANYBLOB="a0060000", @ANYRES16=0x0, @ANYBLOB="010026"], 0x6a0}, 0x1, 0x0, 0x0, 0x50}, 0x4041) r1 = gettid() ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000200)=0x0) fcntl$setownex(r0, 0xf, &(0x7f00000001c0)={0x2, r2}) rt_tgsigqueueinfo(r1, r1, 0xf, &(0x7f0000000000)={0x2b, 0x46, 0x80000001}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)=ANY=[@ANYRES64=r3], 0xa8}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x37, [0xfffffff8, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x4, 0x25cd, 0x1, 0xb4, 0xa, 0xa2b9, 0x6, 0x7, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x1, 0x8, 0xd, 0x4, 0x12a3, 0x6, 0xdd9, 0x2, 0x6, 0x7, 0x81, 0x8a, 0x79, 0x2, 0x10000, 0x0, 0x91, 0x4, 0x4, 0x16, 0x8, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x9, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xc66, 0xa8a9, 0x20000073, 0x8e, 0xd50, 0x7, 0x5, 0x2, 0x809, 0x4, 0xa7, 0x1003, 0x0, 0x200b398, 0x400080, 0x1, 0x6, 0x1c, 0x7, 0x1, 0x0, 0x3, 0x8, 0xffffff7f, 0x400, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x42, 0xf9, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0xae, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x1, 0x1cb, 0x1, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x95, 0x7fffffff, 0x4, 0xfffffff9, 0x1, 0x1000, 0x7, 0x5], [0x2, 0xfffffffe, 0xffff, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x8d3, 0xfffffffe, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x8000003, 0x5, 0x9, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x3e53, 0x5, 0xd3, 0x8, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x7f, 0x9d2a, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x8, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xff, 0x1005, 0x1, 0x7, 0x1f, 0x9, 0x81, 0xe, 0x9d86, 0xd, 0xfffffff7, 0x8, 0x140f2, 0x5396, 0x3, 0x6, 0x1, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x5, 0xf, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0xf1de, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x5336, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff5, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x6, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x6, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x7, 0x4, 0x5, 0x4, 0x8], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r9 = dup(r8) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) r11 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x2, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000180), 0x0, 0x0) 254.823942ms ago: executing program 4 (id=2530): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r0, 0x6, 0x9, &(0x7f0000000440)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x4b8, @loopback, 0xd}, 0x1c) 251.635076ms ago: executing program 4 (id=2531): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}], 0x1, 0x40800) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00011500000000000000001c"], 0x30}, 0x1, 0x0, 0x0, 0x400c090}, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) getsockname$inet(0xffffffffffffffff, 0x0, &(0x7f0000002280)) 184.591215ms ago: executing program 2 (id=2532): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x13c}}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000ffffdd867d01ff020000000000000000000000000001"], 0xfdef) 0s ago: executing program 3 (id=2533): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r1, 0x4048587b, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) socket$rds(0x15, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuset.effective_cpus\x00', 0x275a, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="58000000100003"], 0x58}, 0x1, 0x0, 0x0, 0x4004}, 0x4804) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) socket(0x2a, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="4400000010000104fcfffffffcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0136030000000000140012800b0001006d616373656300000400028008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n'], 0x44}, 0x1, 0x0, 0x0, 0x20049848}, 0x20000044) kernel console output (not intermixed with test programs): 81 [ 432.974678][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 82 [ 432.982542][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 1 [ 432.990490][ T5905] usb 5-1: Using ep0 maxpacket: 16 [ 432.992412][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 2 [ 433.003890][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 85 [ 433.005184][ T5905] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 433.011886][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 5 [ 433.054883][ T5905] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 433.065838][ T5905] usb 5-1: New USB device found, idVendor=5543, idProduct=0047, bcdDevice= 0.00 [ 433.076039][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.096581][ T50] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 433.097820][ T5905] usb 5-1: config 0 descriptor?? [ 433.113673][ T5906] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 433.128950][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 83 [ 433.162365][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 84 [ 433.176759][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 3 [ 433.187609][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 4 [ 433.205029][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 86 [ 433.213065][ T50] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 6 [ 433.234697][ T50] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 433.261311][ T50] usb 6-1: USB disconnect, device number 8 [ 433.287415][ T5906] usb 1-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 433.296970][ T5906] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 433.311438][ T50] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 433.354942][ T50] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 433.372928][ T50] keyspan 6-1:0.11: device disconnected [ 433.381390][ T5906] usb 1-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice= 0.9c [ 433.408968][ T5906] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.431895][ T5906] usb 1-1: Product: syz [ 433.436789][ T5906] usb 1-1: Manufacturer: syz [ 433.441473][ T5906] usb 1-1: SerialNumber: syz [ 433.448743][ T5906] usb 1-1: config 0 descriptor?? [ 433.457802][ T5906] ims_pcu 1-1:0.0: Missing CDC union descriptor [ 433.464343][ T5906] ims_pcu 1-1:0.0: probe with driver ims_pcu failed with error -22 [ 433.559987][ T5905] usbhid 5-1:0.0: can't add hid device: -71 [ 433.576923][ T5905] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 433.595122][ T5905] usb 5-1: USB disconnect, device number 89 [ 433.864260][ T50] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 434.035394][ T50] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 434.046028][ T50] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 434.055140][ T50] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 434.068139][ T50] usb 3-1: config 0 descriptor?? [ 434.076805][ T50] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 434.273677][ T5905] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 434.286817][T12621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.296740][T12621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.377388][ T5906] usb 3-1: USB disconnect, device number 98 [ 434.413751][ T50] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 434.436724][ T5905] usb 6-1: config 0 has no interfaces? [ 434.445534][ T5905] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 434.460054][ T5905] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.469526][ T5905] usb 6-1: Product: syz [ 434.474068][ T5905] usb 6-1: Manufacturer: syz [ 434.478787][ T5905] usb 6-1: SerialNumber: syz [ 434.490547][ T5905] usb 6-1: config 0 descriptor?? [ 434.566993][ T50] usb 5-1: config 2 has an invalid interface number: 108 but max is 0 [ 434.583688][ T50] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 434.606936][ T50] usb 5-1: config 2 has no interface number 0 [ 434.618471][ T50] usb 5-1: too many endpoints for config 2 interface 108 altsetting 111: 119, using maximum allowed: 30 [ 434.630220][ T50] usb 5-1: config 2 interface 108 altsetting 111 has 0 endpoint descriptors, different from the interface descriptor's value: 119 [ 434.645444][ T50] usb 5-1: config 2 interface 108 has no altsetting 0 [ 434.660723][ T50] usb 5-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 434.674878][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.683472][ T50] usb 5-1: Product: syz [ 434.687960][ T50] usb 5-1: Manufacturer: syz [ 434.692775][ T50] usb 5-1: SerialNumber: syz [ 434.732859][ T5898] usb 6-1: USB disconnect, device number 9 [ 435.043726][ T5832] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 435.197000][ T5832] usb 4-1: config 0 has no interfaces? [ 435.202786][ T5832] usb 4-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 435.211976][ T5832] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 435.233502][ T5832] usb 4-1: config 0 descriptor?? [ 435.446664][T12647] netlink: 76 bytes leftover after parsing attributes in process `syz.5.2053'. [ 435.622661][ T5905] usb 4-1: USB disconnect, device number 86 [ 435.677361][ T50] usb 5-1: USB disconnect, device number 90 [ 435.880786][T12653] netlink: 'syz.5.2055': attribute type 27 has an invalid length. [ 435.890169][T12653] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2055'. [ 435.899318][T12653] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 435.946548][T12655] netlink: 'syz.4.2056': attribute type 8 has an invalid length. [ 435.977258][T12655] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2056'. [ 436.032369][ T50] usb 1-1: USB disconnect, device number 78 [ 437.034858][T12687] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2068'. [ 437.044398][T12687] netlink: 'syz.4.2068': attribute type 3 has an invalid length. [ 437.052420][T12687] netlink: 'syz.4.2068': attribute type 7 has an invalid length. [ 437.066670][T12689] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2069'. [ 437.079591][T12687] netlink: 'syz.4.2068': attribute type 8 has an invalid length. [ 437.087833][T12689] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2069'. [ 437.097116][T12687] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2068'. [ 437.151943][T12685] trusted_key: encrypted_key: insufficient parameters specified [ 437.182051][T12692] FAULT_INJECTION: forcing a failure. [ 437.182051][T12692] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 437.196040][T12692] CPU: 0 UID: 0 PID: 12692 Comm: syz.5.2070 Tainted: G L syzkaller #0 PREEMPT(full) [ 437.196058][T12692] Tainted: [L]=SOFTLOCKUP [ 437.196062][T12692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 437.196069][T12692] Call Trace: [ 437.196075][T12692] [ 437.196080][T12692] dump_stack_lvl+0xe8/0x150 [ 437.196100][T12692] should_fail_ex+0x412/0x560 [ 437.196118][T12692] prepare_alloc_pages+0x22a/0x650 [ 437.196134][T12692] __alloc_frozen_pages_noprof+0x12f/0x380 [ 437.196147][T12692] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 437.196160][T12692] ? __pfx_policy_nodemask+0x10/0x10 [ 437.196176][T12692] alloc_pages_mpol+0x232/0x4a0 [ 437.196189][T12692] alloc_pages_noprof+0xa8/0x1a0 [ 437.196201][T12692] skb_copy_ubufs+0x6ab/0x1a40 [ 437.196220][T12692] ? skb_clone+0x246/0x3a0 [ 437.196229][T12692] ? dev_queue_xmit_nit+0x27d/0xad0 [ 437.196245][T12692] dev_queue_xmit_nit+0xa4e/0xad0 [ 437.196259][T12692] ? dev_queue_xmit_nit+0x2d/0xad0 [ 437.196277][T12692] dev_hard_start_xmit+0x1c1/0x830 [ 437.196295][T12692] __dev_queue_xmit+0x14d9/0x3950 [ 437.196310][T12692] ? __dev_queue_xmit+0x2b6/0x3950 [ 437.196324][T12692] ? __lock_acquire+0x6b5/0x2cf0 [ 437.196339][T12692] ? __pfx___dev_queue_xmit+0x10/0x10 [ 437.196351][T12692] ? nf_hook+0xa1/0x3a0 [ 437.196365][T12692] ? iptable_mangle_hook+0x189/0x4c0 [ 437.196390][T12692] ? ip_finish_output2+0xa1e/0x1070 [ 437.196403][T12692] ? ip_finish_output2+0x3c2/0x1070 [ 437.196413][T12692] ip_finish_output2+0xc68/0x1070 [ 437.196424][T12692] ? ip_finish_output2+0x3c2/0x1070 [ 437.196439][T12692] ip_output+0x29f/0x450 [ 437.196453][T12692] ? ip_output+0x5b/0x450 [ 437.196469][T12692] ip_send_skb+0x45/0xc0 [ 437.196479][T12692] udp_send_skb+0x7e4/0xf70 [ 437.196497][T12692] udp_sendmsg+0x6e4/0x21a0 [ 437.196507][T12692] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 437.196525][T12692] ? __lock_acquire+0x6b5/0x2cf0 [ 437.196539][T12692] ? __pfx_udp_sendmsg+0x10/0x10 [ 437.196560][T12692] ? aa_sk_perm+0x6d5/0x900 [ 437.196576][T12692] ? __pfx_aa_sk_perm+0x10/0x10 [ 437.196587][T12692] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 437.196603][T12692] ? __fget_files+0x3a0/0x420 [ 437.196621][T12692] ? sock_rps_record_flow+0x19/0x350 [ 437.196631][T12692] ? __pfx_inet_sendmsg+0x10/0x10 [ 437.196642][T12692] ? inet_sendmsg+0x29c/0x370 [ 437.196651][T12692] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 437.196667][T12692] ? __pfx_inet_sendmsg+0x10/0x10 [ 437.196677][T12692] __sys_sendto+0x5de/0x710 [ 437.196693][T12692] ? __pfx___sys_sendto+0x10/0x10 [ 437.196705][T12692] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 437.196725][T12692] ? __fget_files+0x3a0/0x420 [ 437.196743][T12692] ? ksys_write+0x242/0x270 [ 437.196759][T12692] ? __pfx_ksys_write+0x10/0x10 [ 437.196775][T12692] __x64_sys_sendto+0xde/0x100 [ 437.196789][T12692] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.196801][T12692] do_syscall_64+0x15f/0xf80 [ 437.196813][T12692] ? trace_irq_disable+0x3b/0x140 [ 437.196825][T12692] ? clear_bhb_loop+0x40/0x90 [ 437.196837][T12692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.196847][T12692] RIP: 0033:0x7f60e859c819 [ 437.196858][T12692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.196867][T12692] RSP: 002b:00007f60e9503028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 437.196880][T12692] RAX: ffffffffffffffda RBX: 00007f60e8815fa0 RCX: 00007f60e859c819 [ 437.196888][T12692] RDX: 000000000000fdbe RSI: 0000200000000100 RDI: 0000000000000004 [ 437.196894][T12692] RBP: 00007f60e9503090 R08: 0000000000000000 R09: 0000000011000a00 [ 437.196901][T12692] R10: 0000000004004084 R11: 0000000000000246 R12: 0000000000000002 [ 437.196907][T12692] R13: 00007f60e8816038 R14: 00007f60e8815fa0 R15: 00007f60e893fa48 [ 437.196924][T12692] [ 437.663441][T12694] vivid-007: kernel_thread() failed [ 438.223692][ T9] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 438.247583][T12714] netlink: 27 bytes leftover after parsing attributes in process `syz.0.2078'. [ 438.293686][ T5876] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 438.345993][T12716] netlink: 'syz.3.2079': attribute type 10 has an invalid length. [ 438.416800][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 438.433685][ T9] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 438.452907][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.457538][ T5876] usb 5-1: config 0 has no interfaces? [ 438.470067][ T5876] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 438.474530][ T9] usb 6-1: config 0 descriptor?? [ 438.479668][ T5876] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.510061][ T5876] usb 5-1: config 0 descriptor?? [ 438.510739][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 438.630002][T12668] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2057'. [ 438.640018][T12727] macsec3: entered promiscuous mode [ 438.683717][ T5832] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 438.745041][T12729] loop3: detected capacity change from 0 to 7 [ 438.756647][T12729] Dev loop3: unable to read RDB block 7 [ 438.766851][T12729] loop3: AHDI p3 p4 [ 438.771123][T12729] loop3: partition table partially beyond EOD, truncated [ 438.783443][T12729] loop3: p3 start 1702000233 is beyond EOD, truncated [ 438.835291][ T5832] usb 1-1: config 6 has an invalid interface number: 14 but max is 0 [ 438.855597][ T5832] usb 1-1: config 6 has no interface number 0 [ 438.859470][ T5906] usb 5-1: USB disconnect, device number 91 [ 438.874535][ T5832] usb 1-1: config 6 interface 14 altsetting 218 endpoint 0x3 has invalid maxpacket 20366, setting to 1024 [ 438.894963][ T5832] usb 1-1: config 6 interface 14 altsetting 218 bulk endpoint 0x3 has invalid maxpacket 1024 [ 438.912773][ T5832] usb 1-1: config 6 interface 14 has no altsetting 0 [ 438.922755][ T5832] usb 1-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6f.50 [ 438.926359][T12735] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2086'. [ 438.940900][ T5832] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.940924][ T5832] usb 1-1: Product: syz [ 438.940939][ T5832] usb 1-1: Manufacturer: syz [ 438.940955][ T5832] usb 1-1: SerialNumber: syz [ 438.975237][T12723] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 439.111016][T12738] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2087'. [ 439.120498][T12738] netlink: 'syz.3.2087': attribute type 7 has an invalid length. [ 439.128615][ T9] pwc: recv_control_msg error -32 req 02 val 2c00 [ 439.146822][T12738] netlink: 'syz.3.2087': attribute type 8 has an invalid length. [ 439.154781][ T9] pwc: recv_control_msg error -32 req 04 val 1000 [ 439.162947][T12738] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2087'. [ 439.175830][ T9] pwc: recv_control_msg error -32 req 04 val 1300 [ 439.183344][ T9] pwc: recv_control_msg error -32 req 04 val 1400 [ 439.187141][T12723] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.190679][ T9] pwc: recv_control_msg error -32 req 02 val 2000 [ 439.213177][T12723] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.223290][ T9] pwc: recv_control_msg error -32 req 02 val 2100 [ 439.240712][ T9] pwc: recv_control_msg error -32 req 04 val 1500 [ 439.249212][ T9] pwc: recv_control_msg error -32 req 02 val 2500 [ 439.256572][ T9] pwc: recv_control_msg error -32 req 02 val 2400 [ 439.263895][ T9] pwc: recv_control_msg error -32 req 02 val 2600 [ 439.271189][ T9] pwc: recv_control_msg error -32 req 02 val 2900 [ 439.280168][ T9] pwc: recv_control_msg error -32 req 02 val 2800 [ 439.288269][ T9] pwc: recv_control_msg error -32 req 04 val 1100 [ 439.297923][ T9] pwc: recv_control_msg error -32 req 04 val 1200 [ 439.313939][ T9] pwc: Registered as video103. [ 439.326185][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input59 [ 439.513362][ T5832] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 439.524184][ T5832] command write [95] error -71 [ 439.528998][ T5832] videodev: could not get a free minor [ 439.534872][ T5832] gspca_main: video_register_device err -23 [ 439.540872][ T5832] jl2005bcd 1-1:6.14: probe with driver jl2005bcd failed with error -23 [ 439.555240][ T5832] usb 1-1: USB disconnect, device number 79 [ 439.938369][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.947770][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.993790][ T5832] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 440.091998][ T5876] usb 6-1: USB disconnect, device number 10 [ 440.161507][ T5832] usb 4-1: config 0 has no interfaces? [ 440.178748][ T5832] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 440.198384][ T5832] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.211095][ T5832] usb 4-1: Product: syz [ 440.221533][ T5832] usb 4-1: Manufacturer: syz [ 440.230223][ T5832] usb 4-1: SerialNumber: syz [ 440.246402][ T5832] usb 4-1: config 0 descriptor?? [ 440.389474][ T5146] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 440.404315][ T5146] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 440.413249][ T5146] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 440.422318][ T5146] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 440.434430][ T5146] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 440.482479][ T9] usb 4-1: USB disconnect, device number 87 [ 440.614118][ T5876] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 440.664117][T12856] chnl_net:caif_netlink_parms(): no params data found [ 440.745749][T12856] bridge0: port 1(bridge_slave_0) entered blocking state [ 440.753006][T12856] bridge0: port 1(bridge_slave_0) entered disabled state [ 440.760647][T12856] bridge_slave_0: entered allmulticast mode [ 440.766575][ T5876] usb 6-1: Using ep0 maxpacket: 16 [ 440.773215][ T5876] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 440.776524][T12856] bridge_slave_0: entered promiscuous mode [ 440.790703][ T5876] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 440.804290][ T5876] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 440.805755][T12856] bridge0: port 2(bridge_slave_1) entered blocking state [ 440.813362][ T5876] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.813387][ T5876] usb 6-1: Product: syz [ 440.813403][ T5876] usb 6-1: Manufacturer: syz [ 440.813420][ T5876] usb 6-1: SerialNumber: syz [ 440.845545][T12856] bridge0: port 2(bridge_slave_1) entered disabled state [ 440.847974][ T5876] usb 6-1: config 0 descriptor?? [ 440.860198][T12856] bridge_slave_1: entered allmulticast mode [ 440.863079][ T5876] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 440.875538][ T5876] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 440.877447][T12856] bridge_slave_1: entered promiscuous mode [ 440.918901][T12856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 440.933064][T12856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 440.974522][T12856] team0: Port device team_slave_0 added [ 440.983117][T12856] team0: Port device team_slave_1 added [ 441.017167][T12856] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 441.024530][T12856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 441.050855][T12856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 441.068489][T12856] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 441.075851][T12856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 441.102610][T12856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 441.183347][T12856] hsr_slave_0: entered promiscuous mode [ 441.190468][T12856] hsr_slave_1: entered promiscuous mode [ 441.197745][T12856] debugfs: 'hsr0' already exists in 'hsr' [ 441.203560][T12856] Cannot create hsr debugfs directory [ 441.495962][ T5876] em28xx 6-1:0.0: chip ID is em28174 [ 441.532846][T12856] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.584747][T12872] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2096'. [ 441.794922][T12856] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.864032][ T5905] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 442.025806][ T5905] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 442.036102][ T5905] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 442.045436][ T5905] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.058472][ T5905] usb 4-1: config 0 descriptor?? [ 442.070104][ T5905] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 442.214114][ T5876] usb 6-1: USB disconnect, device number 11 [ 442.232240][ T5876] em28xx 6-1:0.0: Disconnecting em28xx [ 442.292137][T12873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 442.311928][T12873] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 442.326721][ T5876] em28xx 6-1:0.0: Freeing device [ 442.494399][ T5146] Bluetooth: hci2: command tx timeout [ 442.509263][ T5876] usb 4-1: USB disconnect, device number 88 [ 442.888857][T12856] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.411975][T12856] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 443.653684][ T5905] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 443.851027][ T5905] usb 5-1: config 0 has no interfaces? [ 443.877639][ T5905] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 443.905691][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 443.927548][ T5905] usb 5-1: config 0 descriptor?? [ 444.121070][T12897] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2106'. [ 444.207952][T12899] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2107'. [ 444.219664][T12856] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 444.236531][T12856] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 444.244955][T12856] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 444.256501][T12856] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 444.265672][T12856] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 444.277544][ T5876] usb 5-1: USB disconnect, device number 92 [ 444.277670][T12856] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 444.295485][T12856] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 444.305836][T12856] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 444.378652][T12856] 8021q: adding VLAN 0 to HW filter on device bond0 [ 444.394995][T12856] 8021q: adding VLAN 0 to HW filter on device team0 [ 444.406449][ T1161] bridge0: port 1(bridge_slave_0) entered blocking state [ 444.415206][ T1161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 444.445820][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 444.452963][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 444.463708][ T5905] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 444.503157][T12856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 444.545537][T12856] veth0_vlan: entered promiscuous mode [ 444.557490][T12856] veth1_vlan: entered promiscuous mode [ 444.573728][ T5146] Bluetooth: hci2: command tx timeout [ 444.591058][T12856] veth0_macvtap: entered promiscuous mode [ 444.605637][T12856] veth1_macvtap: entered promiscuous mode [ 444.622807][T12856] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 444.636528][T12856] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 444.637446][ T5905] usb 4-1: Using ep0 maxpacket: 32 [ 444.654935][ T5905] usb 4-1: config 239 has an invalid descriptor of length 0, skipping remainder of the config [ 444.672592][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.684236][ T5905] usb 4-1: config 239 has 1 interface, different from the descriptor's value: 3 [ 444.693552][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.706600][ T5905] usb 4-1: New USB device found, idVendor=0582, idProduct=003b, bcdDevice= 0.40 [ 444.715954][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.725221][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.733262][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.742521][ T5905] usb 4-1: Product: syz [ 444.749468][ T5905] usb 4-1: Manufacturer: syz [ 444.754541][ T5905] usb 4-1: SerialNumber: syz [ 444.961401][ T1151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 444.979647][ T1151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.010109][ T743] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.018708][ T743] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.047330][ T5905] usb 4-1: unit 2 not found! [ 445.127626][ T5905] usb 4-1: USB disconnect, device number 89 [ 445.186592][ T6346] udevd[6346]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:239.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 445.359024][T12918] dummy0: entered allmulticast mode [ 445.632837][ T29] kauditd_printk_skb: 140 callbacks suppressed [ 445.632848][ T29] audit: type=1326 audit(1776292501.556:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 445.732204][ T29] audit: type=1326 audit(1776292501.596:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 445.866538][ T29] audit: type=1326 audit(1776292501.616:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 445.970730][ T29] audit: type=1326 audit(1776292501.616:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 446.062619][ T29] audit: type=1326 audit(1776292501.616:413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 446.161467][ T29] audit: type=1326 audit(1776292501.616:414): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 446.267859][ T29] audit: type=1326 audit(1776292501.616:415): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 446.345298][ T29] audit: type=1326 audit(1776292501.616:416): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 446.369152][ T29] audit: type=1326 audit(1776292501.616:417): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 446.412554][ T29] audit: type=1326 audit(1776292501.626:418): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12921 comm="syz.0.2110" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f872bf9c819 code=0x7ffc0000 [ 446.653985][ T5146] Bluetooth: hci2: command tx timeout [ 447.463063][T12947] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2118'. [ 447.595799][ T5876] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 447.723811][ T5905] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 447.758217][ T5876] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 447.774133][ T5876] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.782223][ T5876] usb 6-1: Product: syz [ 447.790847][ T5876] usb 6-1: Manufacturer: syz [ 447.796005][ T5876] usb 6-1: SerialNumber: syz [ 447.803384][ T5876] usb 6-1: config 0 descriptor?? [ 447.842927][T12960] netlink: 'syz.3.2124': attribute type 2 has an invalid length. [ 447.851121][T12960] netlink: 'syz.3.2124': attribute type 11 has an invalid length. [ 447.861168][T12960] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2124'. [ 447.885101][ T5905] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 447.896965][ T5905] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 447.906329][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.919603][ T5905] usb 5-1: config 0 descriptor?? [ 447.923811][ T5832] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 447.950696][ T5905] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 448.109859][T12965] loop2: detected capacity change from 0 to 7 [ 448.120669][ T5832] usb 3-1: config 0 has no interfaces? [ 448.133297][T12965] Dev loop2: unable to read RDB block 7 [ 448.139000][ T5832] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 448.148312][T12965] loop2: unable to read partition table [ 448.155457][T12965] loop2: partition table beyond EOD, truncated [ 448.161740][ T5832] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.167355][T12949] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 448.185323][T12965] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 448.187667][T12949] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 448.201609][ T5832] usb 3-1: config 0 descriptor?? [ 448.225932][ T5876] usb 6-1: Firmware version (0.0) predates our first public release. [ 448.249483][ T5876] usb 6-1: Please update to version 0.2 or newer [ 448.296332][T12968] netlink: 'syz.0.2126': attribute type 61 has an invalid length. [ 448.427785][T12943] IPVS: set_ctl: invalid protocol: 51 172.30.1.6:20003 [ 448.541256][ T5832] usb 5-1: USB disconnect, device number 93 [ 448.734044][ T5146] Bluetooth: hci2: command tx timeout [ 448.747349][ T5876] usb 6-1: USB disconnect, device number 12 [ 448.810396][ T5907] usb 3-1: USB disconnect, device number 99 [ 449.073245][T12993] binder: 12992:12993 ioctl c0044dff 200000000140 returned -22 [ 449.469562][T13008] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2139'. [ 450.261342][T13043] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2151'. [ 450.324110][ T5905] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 450.486276][ T5905] usb 1-1: Using ep0 maxpacket: 16 [ 450.511076][ T5905] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 227, changing to 11 [ 450.560588][ T5905] usb 1-1: New USB device found, idVendor=060b, idProduct=0001, bcdDevice= 0.00 [ 450.606475][ T5905] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.650879][ T5905] usb 1-1: config 0 descriptor?? [ 450.693839][ T5832] usb 4-1: new full-speed USB device number 90 using dummy_hcd [ 450.854918][ T5832] usb 4-1: too many configurations: 121, using maximum allowed: 8 [ 450.876219][ T5832] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 450.894862][T13034] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2149'. [ 450.910046][ T5832] usb 4-1: can't read configurations, error -61 [ 450.926519][T13034] bond0: ARP target 128.0.0.0 is already present [ 450.943056][T13034] bond0: option arp_ip_target: invalid value (128) [ 451.053794][ T5832] usb 4-1: new full-speed USB device number 91 using dummy_hcd [ 451.164061][ T5905] hid (null): unknown global tag 0xf5 [ 451.182382][ T5905] hid (null): report_id 1370199724 is invalid [ 451.200727][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.208206][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.216091][ T5832] usb 4-1: too many configurations: 121, using maximum allowed: 8 [ 451.217401][ T5832] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 451.230777][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.241561][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.257549][ T5832] usb 4-1: can't read configurations, error -61 [ 451.259672][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.264862][ T5832] usb usb4-port1: attempt power cycle [ 451.272444][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.283840][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.290909][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.298074][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.306326][ T5905] macally 0003:060B:0001.0013: unknown main item tag 0x0 [ 451.314516][ T5905] macally 0003:060B:0001.0013: reserved main item tag 0xe [ 451.321663][ T5905] macally 0003:060B:0001.0013: unexpected long global item [ 451.336240][ T5905] macally 0003:060B:0001.0013: probe with driver macally failed with error -22 [ 451.446842][ T5905] usb 1-1: USB disconnect, device number 80 [ 451.625820][ T5832] usb 4-1: new full-speed USB device number 92 using dummy_hcd [ 451.644042][ T5876] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 451.654799][ T5832] usb 4-1: too many configurations: 121, using maximum allowed: 8 [ 451.665581][ T5832] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 451.673346][ T5832] usb 4-1: can't read configurations, error -61 [ 451.803776][ T5832] usb 4-1: new full-speed USB device number 93 using dummy_hcd [ 451.816884][ T5876] usb 5-1: config 0 has an invalid interface number: 11 but max is 0 [ 451.835738][ T5876] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 451.853507][ T5832] usb 4-1: too many configurations: 121, using maximum allowed: 8 [ 451.865800][ T5876] usb 5-1: config 0 has no interface number 0 [ 451.875717][ T5832] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 451.885577][ T5876] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 451.894759][ T5832] usb 4-1: can't read configurations, error -61 [ 451.903271][T13071] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 451.912513][ T5832] usb usb4-port1: unable to enumerate USB device [ 451.919238][ T5876] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.979946][ T5876] usb 5-1: config 0 descriptor?? [ 451.996656][ T5876] keyspan 5-1:0.11: Keyspan 2 port adapter converter detected [ 452.011539][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 87 [ 452.024205][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 7 [ 452.037708][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 81 [ 452.046590][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 82 [ 452.055028][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 1 [ 452.062854][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 2 [ 452.074076][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 85 [ 452.081864][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 5 [ 452.091389][ T5876] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 452.109539][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 83 [ 452.117644][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 84 [ 452.125952][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 3 [ 452.133957][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 4 [ 452.141781][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 86 [ 452.151141][ T5876] keyspan 5-1:0.11: found no endpoint descriptor for endpoint 6 [ 452.183804][ T5876] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 452.269565][ T5905] usb 5-1: USB disconnect, device number 94 [ 452.289368][ T5905] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 452.306799][ T5905] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 452.317133][ T5905] keyspan 5-1:0.11: device disconnected [ 452.593691][ T5907] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 452.766964][ T5907] usb 1-1: config 0 has no interfaces? [ 452.776011][ T5907] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 452.795115][ T5907] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.816300][ T5907] usb 1-1: config 0 descriptor?? [ 452.942516][T13083] netlink: 27 bytes leftover after parsing attributes in process `syz.5.2167'. [ 453.246498][ T50] usb 1-1: USB disconnect, device number 81 [ 453.335788][T13097] bond3: (slave bond_slave_1): Device is not our slave [ 453.356102][T13097] bond3: option active_slave: invalid value (bond_slave_1) [ 453.376902][T13097] bond3 (unregistering): Released all slaves [ 453.883699][ T50] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 454.040483][ T50] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 454.053963][T13122] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2180'. [ 454.073682][ T50] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.102207][ T50] usb 4-1: Product: syz [ 454.117874][ T50] usb 4-1: Manufacturer: syz [ 454.131978][ T50] usb 4-1: SerialNumber: syz [ 454.158561][T13126] netlink: 56 bytes leftover after parsing attributes in process `syz.5.2182'. [ 454.190394][T13126] batadv0: entered promiscuous mode [ 454.197527][T13126] macsec1: entered allmulticast mode [ 454.203069][T13126] batadv0: entered allmulticast mode [ 454.213431][T13126] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 454.229455][T13126] batadv0: left allmulticast mode [ 454.234864][T13126] batadv0: left promiscuous mode [ 454.584313][T13144] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 454.654970][ T5905] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 454.824116][ T5905] usb 6-1: Using ep0 maxpacket: 32 [ 454.837920][ T5905] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 454.865118][ T5905] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 454.892348][ T5905] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 454.923326][ T5905] usb 6-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 454.943447][ T5905] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.971741][ T5905] usb 6-1: config 0 descriptor?? [ 455.171587][ T50] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 455.179203][ T50] cdc_ncm 4-1:1.0: dwNtbInMaxSize=60 is too small. Using 2048 [ 455.187431][ T50] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 455.200584][T13140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.223845][T13140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.450698][ T50] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 455.451457][T13140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.519174][T13140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.528932][ T50] usb 4-1: USB disconnect, device number 94 [ 455.548989][T13150] netlink: 'syz.0.2189': attribute type 8 has an invalid length. [ 455.569019][ T50] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 455.583809][T13150] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2189'. [ 455.611307][T13140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.635435][T13140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.669413][T13140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.682819][T13150] bond0: entered promiscuous mode [ 455.707362][T13150] bond_slave_0: entered promiscuous mode [ 455.715294][T13140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.729569][T13150] bond_slave_1: entered promiscuous mode [ 455.761869][ T5905] kye 0003:0458:5016.0014: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 455.774128][T13150] gretap0: entered promiscuous mode [ 455.792300][T13150] bond0: left promiscuous mode [ 455.807091][T13150] bond_slave_0: left promiscuous mode [ 455.823159][T13150] bond_slave_1: left promiscuous mode [ 455.829003][ T5905] kye 0003:0458:5016.0014: hidraw0: USB HID v0.00 Device [HID 0458:5016] on usb-dummy_hcd.5-1/input0 [ 455.867455][ T5905] kye 0003:0458:5016.0014: tablet-enabling feature report not found [ 455.893368][ T5905] kye 0003:0458:5016.0014: tablet enabling failed [ 455.967568][ T5905] usb 6-1: USB disconnect, device number 13 [ 456.052054][T13150] gretap0: left promiscuous mode [ 456.603766][ T5906] usb 1-1: new full-speed USB device number 82 using dummy_hcd [ 456.777282][ T5906] usb 1-1: config 8 has an invalid interface number: 177 but max is 0 [ 456.788318][T13182] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2197'. [ 456.797753][ T5906] usb 1-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 456.833945][ T5906] usb 1-1: config 8 has no interface number 0 [ 456.854650][ T5906] usb 1-1: config 8 interface 177 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 456.868482][ T5906] usb 1-1: config 8 interface 177 has no altsetting 0 [ 456.895927][ T5906] usb 1-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 456.926071][ T5906] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.960538][ T5906] ir_toy 1-1:8.177: required endpoints not found [ 457.178550][T13162] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2193'. [ 457.327616][T13193] loop2: detected capacity change from 0 to 7 [ 457.357076][T13193] Dev loop2: unable to read RDB block 7 [ 457.373449][T13193] loop2: unable to read partition table [ 457.392446][T13193] loop2: partition table beyond EOD, truncated [ 457.419453][T13193] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 457.913870][T13203] bond3: (slave bond_slave_1): Device is not our slave [ 457.923851][T13203] bond3: option active_slave: invalid value (bond_slave_1) [ 458.050210][T13203] bond3 (unregistering): Released all slaves [ 458.099358][T13213] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2202'. [ 459.163792][ T5906] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 459.344033][ T5906] usb 6-1: Using ep0 maxpacket: 32 [ 459.362443][ T5906] usb 6-1: config 0 has no interfaces? [ 459.401060][ T5906] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 459.419274][ T50] usb 1-1: USB disconnect, device number 82 [ 459.421894][ T5906] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.435679][ T5879] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 459.475752][ T5906] usb 6-1: Product: syz [ 459.496704][ T5906] usb 6-1: Manufacturer: syz [ 459.511904][ T5906] usb 6-1: SerialNumber: syz [ 459.525511][ T5906] usb 6-1: config 0 descriptor?? [ 459.615654][ T5879] usb 5-1: config 0 has no interfaces? [ 459.629124][ T5879] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 459.661347][ T5879] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.685600][ T5879] usb 5-1: Product: syz [ 459.700224][ T5879] usb 5-1: Manufacturer: syz [ 459.716462][ T5879] usb 5-1: SerialNumber: syz [ 459.746261][ T5879] usb 5-1: config 0 descriptor?? [ 460.080347][T13255] netlink: 'syz.0.2216': attribute type 8 has an invalid length. [ 460.097391][T13255] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2216'. [ 460.174054][T13233] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 460.221907][T13233] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 460.237909][ T50] usb 5-1: USB disconnect, device number 95 [ 460.308632][T13255] bond0: entered promiscuous mode [ 460.325416][T13255] bond_slave_0: entered promiscuous mode [ 460.347647][T13255] bond_slave_1: entered promiscuous mode [ 460.361005][T13255] gretap0: entered promiscuous mode [ 460.369195][T13255] bond0: left promiscuous mode [ 460.377179][T13255] bond_slave_0: left promiscuous mode [ 460.382864][T13255] bond_slave_1: left promiscuous mode [ 460.390146][T13255] gretap0: left promiscuous mode [ 461.073749][T13274] program syz.4.2224 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 461.151636][ T29] kauditd_printk_skb: 74 callbacks suppressed [ 461.151694][ T29] audit: type=1326 audit(1776292517.076:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13257 comm="syz.3.2218" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa642d9c819 code=0x0 [ 461.307808][T13285] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2227'. [ 461.317313][T13285] netlink: 'syz.0.2227': attribute type 7 has an invalid length. [ 461.325399][T13285] netlink: 'syz.0.2227': attribute type 8 has an invalid length. [ 461.334568][T13285] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2227'. [ 461.360836][T13285] erspan0: entered promiscuous mode [ 461.368177][T13285] gretap0: entered promiscuous mode [ 461.379438][T13285] erspan0: left promiscuous mode [ 461.390732][T13285] gretap0: left promiscuous mode [ 461.418654][T13289] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2222'. [ 461.923787][ T5905] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 462.008533][ T50] usb 6-1: USB disconnect, device number 14 [ 462.085407][ T5905] usb 1-1: Using ep0 maxpacket: 32 [ 462.108022][ T5905] usb 1-1: config 0 has no interfaces? [ 462.131665][ T5905] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 462.161266][ T5905] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.182598][ T5905] usb 1-1: Product: syz [ 462.187508][ T5905] usb 1-1: Manufacturer: syz [ 462.192205][ T5905] usb 1-1: SerialNumber: syz [ 462.209739][ T5905] usb 1-1: config 0 descriptor?? [ 462.242062][T13309] input: syz0 as /devices/virtual/input/input60 [ 462.296834][T13311] netlink: 'syz.2.2232': attribute type 8 has an invalid length. [ 462.317934][T13311] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2232'. [ 462.394160][ T5879] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 462.544197][ T5879] usb 4-1: device descriptor read/64, error -71 [ 462.783946][ T5879] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 462.807702][T13331] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2242'. [ 462.923930][ T5879] usb 4-1: device descriptor read/64, error -71 [ 463.036380][ T5879] usb usb4-port1: attempt power cycle [ 463.053794][ T5906] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 463.183980][ T5906] usb 3-1: device descriptor read/64, error -71 [ 463.375299][ T5879] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 463.395728][ T5879] usb 4-1: device descriptor read/8, error -71 [ 463.433661][ T5906] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 463.482049][T13338] netlink: 7 bytes leftover after parsing attributes in process `syz.4.2243'. [ 463.593892][ T5906] usb 3-1: device descriptor read/64, error -71 [ 463.611630][T13341] netlink: 'syz.4.2243': attribute type 10 has an invalid length. [ 463.638539][T13341] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2243'. [ 463.655399][ T5879] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 463.686642][ T5879] usb 4-1: device descriptor read/8, error -71 [ 463.689194][T13345] fuse: Bad value for 'fd' [ 463.723996][ T5906] usb usb3-port1: attempt power cycle [ 463.795087][ T5879] usb usb4-port1: unable to enumerate USB device [ 463.953786][ T50] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 464.073766][ T5906] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 464.094375][ T5906] usb 3-1: device descriptor read/8, error -71 [ 464.103679][ T50] usb 6-1: Using ep0 maxpacket: 32 [ 464.110479][ T50] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 464.121475][ T50] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 464.136680][ T50] usb 6-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 464.146491][ T50] usb 6-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 464.155533][ T50] usb 6-1: Product: syz [ 464.159998][ T50] usb 6-1: Manufacturer: syz [ 464.164846][ T50] usb 6-1: SerialNumber: syz [ 464.182362][ T50] input: appletouch as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input61 [ 464.353704][ T5906] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 464.383296][T13345] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 464.399675][T13345] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 464.411579][ T5906] usb 3-1: device descriptor read/8, error -71 [ 464.538861][ T5906] usb usb3-port1: unable to enumerate USB device [ 464.689519][T13365] input: syz0 as /devices/virtual/input/input62 [ 464.781928][T13367] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2253'. [ 464.947551][ T50] usb 6-1: USB disconnect, device number 15 [ 464.970107][ T50] appletouch 6-1:1.0: input: appletouch disconnected [ 465.222788][T13378] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2258'. [ 465.277943][T13378] 8021q: adding VLAN 0 to HW filter on device bond5 [ 465.286050][T13382] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2258'. [ 465.307101][ T12] bond0: (slave bond_slave_0): interface is now down [ 465.317563][T13382] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.327122][ T12] bond0: (slave bond_slave_1): interface is now down [ 465.340678][T13378] netlink: 'syz.3.2258': attribute type 4 has an invalid length. [ 465.359689][T13382] bond5: (slave bond0): making interface the new active one [ 465.383712][ T12] bond0: (slave bond_slave_0): interface is now down [ 465.399597][T13382] bond5: (slave bond0): Enslaving as an active interface with an up link [ 465.406370][ T12] bond0: (slave bond_slave_1): interface is now down [ 465.431067][T13378] .`: renamed from bond0 (while UP) [ 465.446563][ T1151] .`: (slave bond_slave_0): interface is now down [ 465.467635][ T1151] .`: (slave bond_slave_1): interface is now down [ 465.612700][ T5905] usb 1-1: USB disconnect, device number 83 [ 465.697193][T11664] bond5: (slave .`): link status definitely down, disabling slave [ 465.758093][T11664] bond5: now running without any active interface! [ 465.854927][T13396] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 465.867872][T13399] fuse: Bad value for 'fd' [ 465.983222][T13403] loop6: detected capacity change from 0 to 8 [ 466.049397][T13403] Dev loop6: unable to read RDB block 8 [ 466.066936][T13403] loop6: unable to read partition table [ 466.083897][T13403] loop6: partition table beyond EOD, truncated [ 466.097135][T13403] loop_reread_partitions: partition scan of loop6 (N*ho?XDbp0O{>.J) failed (rc=-5) [ 466.133862][ T5906] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 466.200692][ T5195] Dev loop6: unable to read RDB block 8 [ 466.206827][ T5195] loop6: unable to read partition table [ 466.217094][ T5195] loop6: partition table beyond EOD, truncated [ 466.305720][T13394] ..0: renamed from hsr0 (while UP) [ 466.335788][ T5906] usb 4-1: Using ep0 maxpacket: 32 [ 466.357990][ T5906] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 466.425808][ T5906] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 466.439611][T13394] ..0: entered allmulticast mode [ 466.450720][T13394] hsr_slave_0: entered allmulticast mode [ 466.501309][ T5906] usb 4-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 466.537159][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 466.572531][ T5906] usb 4-1: Product: syz [ 466.582999][ T5906] usb 4-1: Manufacturer: syz [ 466.602865][ T5906] usb 4-1: SerialNumber: syz [ 466.647243][ T5906] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input63 [ 466.802062][T13394] hsr_slave_1: entered allmulticast mode [ 466.925617][T13399] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.942537][T13399] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 466.951157][T13394] A link change request failed with some changes committed already. Interface ..0 may have been left with an inconsistent configuration, please check. [ 466.998762][T13419] __nla_validate_parse: 4 callbacks suppressed [ 466.998780][T13419] netlink: 512 bytes leftover after parsing attributes in process `syz.5.2271'. [ 467.149647][T13421] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2270'. [ 467.536074][ T5879] usb 4-1: USB disconnect, device number 99 [ 467.588016][ T5879] appletouch 4-1:1.0: input: appletouch disconnected [ 467.791504][T13438] FAULT_INJECTION: forcing a failure. [ 467.791504][T13438] name failslab, interval 1, probability 0, space 0, times 0 [ 467.820882][T13438] CPU: 1 UID: 0 PID: 13438 Comm: syz.5.2275 Tainted: G L syzkaller #0 PREEMPT(full) [ 467.820912][T13438] Tainted: [L]=SOFTLOCKUP [ 467.820919][T13438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 467.820929][T13438] Call Trace: [ 467.820936][T13438] [ 467.820944][T13438] dump_stack_lvl+0xe8/0x150 [ 467.820976][T13438] should_fail_ex+0x412/0x560 [ 467.821006][T13438] should_failslab+0xa8/0x100 [ 467.821027][T13438] __kmalloc_noprof+0xe8/0x760 [ 467.821052][T13438] ? tomoyo_encode+0x28b/0x550 [ 467.821077][T13438] tomoyo_encode+0x28b/0x550 [ 467.821103][T13438] tomoyo_realpath_from_path+0x58d/0x5d0 [ 467.821135][T13438] ? tomoyo_path_number_perm+0x219/0x630 [ 467.821148][T13438] tomoyo_path_number_perm+0x246/0x630 [ 467.821161][T13438] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 467.821173][T13438] ? __lock_acquire+0x6b5/0x2cf0 [ 467.821194][T13438] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 467.821217][T13438] ? __fget_files+0x2a/0x420 [ 467.821232][T13438] ? __fget_files+0x2a/0x420 [ 467.821244][T13438] ? __fget_files+0x3a0/0x420 [ 467.821255][T13438] ? __fget_files+0x2a/0x420 [ 467.821275][T13438] security_file_ioctl+0xc3/0x2a0 [ 467.821288][T13438] __se_sys_ioctl+0x47/0x170 [ 467.821297][T13438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.821323][T13438] do_syscall_64+0x15f/0xf80 [ 467.821336][T13438] ? trace_irq_disable+0x3b/0x140 [ 467.821347][T13438] ? clear_bhb_loop+0x40/0x90 [ 467.821360][T13438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.821371][T13438] RIP: 0033:0x7f60e859c819 [ 467.821382][T13438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 467.821391][T13438] RSP: 002b:00007f60e9503028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 467.821404][T13438] RAX: ffffffffffffffda RBX: 00007f60e8815fa0 RCX: 00007f60e859c819 [ 467.821412][T13438] RDX: 0000200000000280 RSI: 00000000c0306201 RDI: 0000000000000003 [ 467.821419][T13438] RBP: 00007f60e9503090 R08: 0000000000000000 R09: 0000000000000000 [ 467.821429][T13438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 467.821435][T13438] R13: 00007f60e8816038 R14: 00007f60e8815fa0 R15: 00007f60e893fa48 [ 467.821451][T13438] [ 467.821471][T13438] ERROR: Out of memory at tomoyo_realpath_from_path. [ 468.234903][T13440] netlink: 27 bytes leftover after parsing attributes in process `syz.4.2276'. [ 468.452002][T13451] loop3: detected capacity change from 0 to 7 [ 468.463053][T13451] Dev loop3: unable to read RDB block 7 [ 468.472457][T13451] loop3: AHDI p3 p4 [ 468.477612][T13451] loop3: partition table partially beyond EOD, truncated [ 468.485549][T13451] loop3: p3 start 1702000233 is beyond EOD, truncated [ 468.517129][ T9] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 468.543711][ T50] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 468.593432][T13431] input: syz1 as /devices/virtual/input/input64 [ 468.611833][T13455] netlink: 'syz.0.2283': attribute type 8 has an invalid length. [ 468.621664][T13455] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2283'. [ 468.636516][T13455] bond0: entered promiscuous mode [ 468.641623][T13455] bond_slave_0: entered promiscuous mode [ 468.647630][T13455] bond_slave_1: entered promiscuous mode [ 468.654842][T13455] gretap0: entered promiscuous mode [ 468.665874][T13455] bond0: left promiscuous mode [ 468.670725][T13455] bond_slave_0: left promiscuous mode [ 468.678526][T13455] bond_slave_1: left promiscuous mode [ 468.685045][T13455] gretap0: left promiscuous mode [ 468.700999][ T50] usb 6-1: config 0 has an invalid interface number: 64 but max is 0 [ 468.703014][ T9] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 468.709924][ T50] usb 6-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 468.721193][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 468.733406][ T50] usb 6-1: config 0 has no interface number 0 [ 468.748459][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 468.748488][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 468.758304][ T9] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 468.782372][ T9] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 468.784726][ T50] usb 6-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 468.795493][ T9] usb 4-1: Manufacturer: syz [ 468.807462][ T9] usb 4-1: config 0 descriptor?? [ 468.813870][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.837214][ T5906] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 468.843538][ T50] usb 6-1: Product: syz [ 468.856888][ T50] usb 6-1: Manufacturer: syz [ 468.862611][ T50] usb 6-1: SerialNumber: syz [ 468.870449][ T50] usb 6-1: config 0 descriptor?? [ 468.882475][T13457] fuse: Bad value for 'fd' [ 468.889821][ T50] uvcvideo 6-1:0.64: probe with driver uvcvideo failed with error -22 [ 468.974060][ T5906] usb 5-1: device descriptor read/64, error -71 [ 469.163883][ T5876] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 469.233728][ T5906] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 469.245584][ T9] hid_parser_main: 85 callbacks suppressed [ 469.245615][ T9] appleir 0003:05AC:8243.0015: unknown main item tag 0x0 [ 469.264270][ T9] appleir 0003:05AC:8243.0015: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 469.324170][ T5876] usb 1-1: Using ep0 maxpacket: 32 [ 469.343771][ T5876] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 469.364099][ T5906] usb 5-1: device descriptor read/64, error -71 [ 469.386580][ T5876] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 469.420765][ T5876] usb 1-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 469.430494][ T5876] usb 1-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 469.448238][ T5876] usb 1-1: Product: syz [ 469.457173][ T5876] usb 1-1: Manufacturer: syz [ 469.473940][ T5906] usb usb5-port1: attempt power cycle [ 469.485863][ T5876] usb 1-1: SerialNumber: syz [ 469.510802][ T5876] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input65 [ 469.711606][T13457] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.721341][T13457] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.843764][ T5906] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 469.872178][ T5906] usb 5-1: device descriptor read/8, error -71 [ 470.113725][ T5906] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 470.144167][ T5906] usb 5-1: device descriptor read/8, error -71 [ 470.261190][ T5905] usb 1-1: USB disconnect, device number 84 [ 470.268994][ T5906] usb usb5-port1: unable to enumerate USB device [ 470.297891][ T5905] appletouch 1-1:1.0: input: appletouch disconnected [ 470.655513][ T5905] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 470.815372][ T5905] usb 1-1: config 0 has no interfaces? [ 470.820961][ T5905] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 470.830495][ T5905] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.841638][ T5905] usb 1-1: config 0 descriptor?? [ 471.053768][T13466] fuse: Bad value for 'fd' [ 471.080356][ T5907] usb 1-1: USB disconnect, device number 85 [ 471.381584][ T5907] usb 6-1: USB disconnect, device number 16 [ 471.450851][T13479] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2288'. [ 471.644477][ T5906] usb 4-1: reset high-speed USB device number 100 using dummy_hcd [ 471.660787][ T5906] usb 4-1: device reset changed ep0 maxpacket size! [ 471.676892][ T9] usb 4-1: USB disconnect, device number 100 [ 471.753902][ T5907] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 471.834364][ T9] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 471.914469][T13489] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2293'. [ 471.929240][ T5907] usb 6-1: config 251 has an invalid interface number: 254 but max is 0 [ 471.944055][ T5907] usb 6-1: config 251 has no interface number 0 [ 471.954704][ T5907] usb 6-1: config 251 interface 254 has no altsetting 0 [ 471.964816][ T5907] usb 6-1: New USB device found, idVendor=05ac, idProduct=0290, bcdDevice=e1.c1 [ 471.974815][ T5907] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.982850][ T5907] usb 6-1: Product: syz [ 471.987808][ T5907] usb 6-1: Manufacturer: syz [ 471.992936][ T5907] usb 6-1: SerialNumber: syz [ 472.014539][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 472.199913][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 472.219258][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 472.229730][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 472.243410][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.257272][ T9] usb 4-1: config 0 descriptor?? [ 472.285198][ T9] hub 4-1:0.0: USB hub found [ 472.306311][T13503] netlink: 212356 bytes leftover after parsing attributes in process `syz.4.2298'. [ 472.473755][ T5906] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 472.583676][ T5879] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 472.635942][ T5906] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 472.646364][ T5906] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 472.657792][ T5906] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 472.672812][ T5906] usb 1-1: config 0 descriptor?? [ 472.685058][ T5906] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 472.713712][ T5879] usb 3-1: device descriptor read/64, error -71 [ 472.824120][ T5907] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:251.254/input/input66 [ 472.839949][ T5146] Bluetooth: hci0: unexpected event 0x2f length: 509 > 260 [ 472.866043][ T5907] usb 6-1: USB disconnect, device number 17 [ 472.883187][T13501] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 472.899498][T13507] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.899806][T13501] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 472.953674][ T5879] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 473.093739][ T5879] usb 3-1: device descriptor read/64, error -71 [ 473.215535][ T5879] usb usb3-port1: attempt power cycle [ 473.348231][T13514] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2303'. [ 473.357568][T13514] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2303'. [ 473.563814][ T5879] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 473.594353][ T5879] usb 3-1: device descriptor read/8, error -71 [ 473.608104][ T5832] usb 1-1: USB disconnect, device number 86 [ 473.813763][ T50] usb 5-1: new full-speed USB device number 100 using dummy_hcd [ 473.835710][ T5879] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 473.882161][ T5879] usb 3-1: device descriptor read/8, error -71 [ 473.970128][ T50] usb 5-1: config 0 has an invalid interface number: 255 but max is 0 [ 473.986954][ T50] usb 5-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 474.005168][ T5879] usb usb3-port1: unable to enumerate USB device [ 474.016896][ T50] usb 5-1: config 0 has no interface number 0 [ 474.031939][ T50] usb 5-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 474.051944][ T50] usb 5-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 474.065973][ T50] usb 5-1: config 0 interface 255 has no altsetting 0 [ 474.075384][ T50] usb 5-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 474.085743][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.095081][ T50] usb 5-1: Product: syz [ 474.099360][ T50] usb 5-1: Manufacturer: syz [ 474.104579][ T50] usb 5-1: SerialNumber: syz [ 474.117198][ T50] usb 5-1: config 0 descriptor?? [ 474.590386][ T50] streamzap 5-1:0.255: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 474.620554][ T50] usb 5-1: USB disconnect, device number 100 [ 475.677819][ T9] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 475.691772][ T9] usbhid 4-1:0.0: can't add hid device: -71 [ 475.698499][ T9] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 475.726882][ T9] usb 4-1: USB disconnect, device number 101 [ 475.971377][T13547] fuse: Bad value for 'fd' [ 476.256263][ T5876] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 476.420630][ T5876] usb 4-1: Using ep0 maxpacket: 32 [ 476.435708][ T5876] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 476.446658][ T5876] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 476.462861][ T5876] usb 4-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 476.472421][ T5876] usb 4-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 476.480866][ T5876] usb 4-1: Product: syz [ 476.485094][ T5876] usb 4-1: Manufacturer: syz [ 476.489702][ T5876] usb 4-1: SerialNumber: syz [ 476.521401][ T5876] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input67 [ 476.717790][T13547] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.746169][T13547] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.314882][ T5907] usb 4-1: USB disconnect, device number 102 [ 477.383803][ T5907] appletouch 4-1:1.0: input: appletouch disconnected [ 477.470186][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x0 Unhandled WRMSR(0x1d9) = 0x1 [ 477.483059][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.502538][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.512665][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.523303][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.533399][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.546132][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.556439][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.566492][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.576619][T13552] kvm_intel: kvm [13551]: vcpu0, guest rIP: 0x9148 Unhandled WRMSR(0x1d9) = 0x1 [ 477.677451][T13548] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2312'. [ 477.737351][T13556] netlink: 27 bytes leftover after parsing attributes in process `syz.5.2316'. [ 478.195126][ T50] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 478.359952][ T50] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 478.371265][ T50] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 478.392089][ T50] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 478.430808][ T50] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 478.471822][ T50] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.517993][ T50] usb 6-1: config 0 descriptor?? [ 478.951730][ T50] usbhid 6-1:0.0: can't add hid device: -71 [ 478.963144][ T50] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 478.980630][ T50] usb 6-1: USB disconnect, device number 18 [ 479.014728][ T5907] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 479.075473][ T5876] usb 5-1: new full-speed USB device number 101 using dummy_hcd [ 479.175904][ T5907] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 479.186417][ T5907] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 479.196562][ T5907] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 479.205917][ T5907] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 479.217815][ T5907] usb 1-1: Manufacturer: syz [ 479.225406][ T5907] usb 1-1: config 0 descriptor?? [ 479.244974][ T5876] usb 5-1: config 8 has an invalid interface number: 177 but max is 0 [ 479.253395][ T5876] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 479.265270][ T5876] usb 5-1: config 8 has no interface number 0 [ 479.271414][ T5876] usb 5-1: config 8 interface 177 altsetting 9 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 479.284872][ T5876] usb 5-1: config 8 interface 177 has no altsetting 0 [ 479.291686][ T5876] usb 5-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 479.302047][ T5876] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.320374][ T5876] ir_toy 5-1:8.177: required endpoints not found [ 479.404446][ T9] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 479.433403][T13573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 479.445644][T13573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 479.456529][T13573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 479.465877][T13573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 479.553162][T13583] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2325'. [ 479.573230][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 479.573517][T13583] netlink: 'syz.5.2325': attribute type 7 has an invalid length. [ 479.594920][ T9] usb 3-1: no configurations [ 479.599859][ T9] usb 3-1: can't read configurations, error -22 [ 479.607562][T13574] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2321'. [ 479.613740][T13583] netlink: 'syz.5.2325': attribute type 8 has an invalid length. [ 479.637888][T13583] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2325'. [ 479.646930][ T5876] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 479.673022][T13583] erspan0: entered promiscuous mode [ 479.674209][ T6009] usb 1-1: USB disconnect, device number 87 [ 479.680741][T13583] gretap0: entered promiscuous mode [ 479.695483][T13583] erspan0: left promiscuous mode [ 479.713543][T13583] gretap0: left promiscuous mode [ 479.743733][ T9] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 479.809570][T13585] netlink: 'syz.5.2326': attribute type 8 has an invalid length. [ 479.819004][T13585] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2326'. [ 479.823645][ T5876] usb 4-1: Using ep0 maxpacket: 16 [ 479.835324][T13585] bond0: entered promiscuous mode [ 479.835535][ T5876] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 479.840452][T13585] bond_slave_0: entered promiscuous mode [ 479.851571][ T5876] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 479.858075][T13585] bond_slave_1: entered promiscuous mode [ 479.870564][ T5876] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 479.870592][ T5876] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.873384][ T5876] usb 4-1: config 0 descriptor?? [ 479.881128][T13585] gretap0: entered promiscuous mode [ 479.906867][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 479.917947][T13585] bond0: left promiscuous mode [ 479.922895][T13585] bond_slave_0: left promiscuous mode [ 479.923080][ T9] usb 3-1: no configurations [ 479.933498][ T9] usb 3-1: can't read configurations, error -22 [ 479.941726][ T9] usb usb3-port1: attempt power cycle [ 479.947486][T13585] bond_slave_1: left promiscuous mode [ 479.955808][T13585] gretap0: left promiscuous mode [ 480.293750][ T9] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 480.345958][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 480.398222][ T9] usb 3-1: no configurations [ 480.412566][ T9] usb 3-1: can't read configurations, error -22 [ 480.564244][ T9] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 480.615243][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 480.682440][ T9] usb 3-1: no configurations [ 480.709572][ T9] usb 3-1: can't read configurations, error -22 [ 480.739457][ T9] usb usb3-port1: unable to enumerate USB device [ 480.893046][T13598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.931204][T13598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 481.146315][T13602] netlink: 76 bytes leftover after parsing attributes in process `syz.5.2331'. [ 481.513883][ T9] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 481.676808][ T9] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 481.703423][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 481.740098][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 481.767520][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 481.798949][ T9] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 481.818502][ T9] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 481.838840][ T9] usb 6-1: Manufacturer: syz [ 481.859043][ T9] usb 6-1: config 0 descriptor?? [ 482.018799][ T50] usb 5-1: USB disconnect, device number 101 [ 482.481545][ T5876] usbhid 4-1:0.0: can't add hid device: -71 [ 482.504048][ T5876] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 482.524696][ T50] usb 5-1: new full-speed USB device number 102 using dummy_hcd [ 482.554892][ T5876] usb 4-1: USB disconnect, device number 103 [ 482.601185][T13630] netlink: 'syz.3.2341': attribute type 8 has an invalid length. [ 482.609633][T13631] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 482.635246][T13630] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2341'. [ 482.644595][T13631] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 482.655384][T13634] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2342'. [ 482.721013][ T50] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 576, setting to 64 [ 482.769023][ T50] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 482.790659][ T50] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.815548][ T50] usb 5-1: Product: syz [ 482.825963][ T50] usb 5-1: Manufacturer: syz [ 482.842104][ T50] usb 5-1: SerialNumber: syz [ 482.871244][T13621] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 483.087033][T13621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.096096][T13621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 483.110911][ T50] usblp 5-1:1.0: usblp0: USB Bidirectional printer dev 102 if 0 alt 0 proto 2 vid 0x0525 pid 0xA4A8 [ 483.152825][ T50] usb 5-1: USB disconnect, device number 102 [ 483.199459][ T50] usblp0: removed [ 483.413796][ T6009] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 483.511521][T13655] binder: 13654:13655 unknown command 0 [ 483.517626][T13655] binder: 13654:13655 ioctl c0306201 200000000280 returned -22 [ 483.644000][T13657] kvm: emulating exchange as write [ 483.933065][T13667] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2355'. [ 483.974838][T13667] macsec1: entered allmulticast mode [ 483.985153][T13667] batadv0: entered allmulticast mode [ 483.998244][T13667] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 484.049322][T13667] batadv0: left allmulticast mode [ 484.171312][ T6009] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 484.180924][ T6009] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.201267][ T6009] usb 3-1: Product: syz [ 484.206807][ T6009] usb 3-1: Manufacturer: syz [ 484.221511][ T6009] usb 3-1: SerialNumber: syz [ 484.230444][ T6009] usb 3-1: config 0 descriptor?? [ 484.339805][ T9] usbhid 6-1:0.0: can't add hid device: -71 [ 484.359945][ T9] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 484.377098][T13670] syz_tun: entered promiscuous mode [ 484.385564][T13670] macsec1: entered promiscuous mode [ 484.400168][T13670] syz_tun: left promiscuous mode [ 484.414561][ T6009] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 112 [ 484.435985][ T9] usb 6-1: USB disconnect, device number 19 [ 484.735641][T13678] netlink: 'syz.4.2359': attribute type 1 has an invalid length. [ 484.789880][T13681] input: syz0 as /devices/virtual/input/input68 [ 484.857464][ T50] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 484.893515][T13678] 8021q: adding VLAN 0 to HW filter on device bond3 [ 484.923525][T13687] netlink: 512 bytes leftover after parsing attributes in process `syz.3.2362'. [ 484.969014][T13683] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2359'. [ 485.051687][T13685] vlan3: entered allmulticast mode [ 485.065728][ T50] usb 1-1: config 0 has no interfaces? [ 485.074004][T13685] bond3: entered allmulticast mode [ 485.088601][ T50] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 485.111451][ T50] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.120403][ T50] usb 1-1: Product: syz [ 485.132367][ T50] usb 1-1: Manufacturer: syz [ 485.151941][ T50] usb 1-1: SerialNumber: syz [ 485.172581][ T50] usb 1-1: config 0 descriptor?? [ 485.561738][T13705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 485.581458][T13705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 485.582589][T13665] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.648407][T13665] netdevsim netdevsim0 netdevsim0: left allmulticast mode [ 485.665065][T13665] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 485.690821][T13708] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2368'. [ 485.700317][T13708] netlink: 'syz.5.2368': attribute type 7 has an invalid length. [ 485.709158][T13708] netlink: 'syz.5.2368': attribute type 8 has an invalid length. [ 485.724363][T13708] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2368'. [ 485.738782][ T5907] usb 1-1: USB disconnect, device number 88 [ 485.742288][T13708] erspan0: entered promiscuous mode [ 485.751536][T13708] gretap0: entered promiscuous mode [ 485.771809][T13708] erspan0: left promiscuous mode [ 485.782842][T13708] gretap0: left promiscuous mode [ 485.794136][ T9] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 485.922774][T13712] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 486.122058][ T6009] (null): failure reading functionality [ 486.128895][ T6009] i2c i2c-1: failure reading functionality [ 486.151173][ T6009] i2c i2c-1: connected i2c-tiny-usb device [ 486.151715][T13718] overlayfs: missing 'lowerdir' [ 486.244533][ T6009] usb 3-1: USB disconnect, device number 112 [ 486.953696][ T6009] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 487.105403][ T6009] usb 6-1: device descriptor read/64, error -71 [ 487.148805][T13742] netlink: 512 bytes leftover after parsing attributes in process `syz.4.2380'. [ 487.285993][T13751] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2383'. [ 487.297010][T13751] netlink: 'syz.3.2383': attribute type 7 has an invalid length. [ 487.307514][T13751] netlink: 'syz.3.2383': attribute type 8 has an invalid length. [ 487.320424][T13751] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2383'. [ 487.337567][T13751] erspan0: entered promiscuous mode [ 487.350607][T13751] erspan0: left promiscuous mode [ 487.363873][ T6009] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 487.503683][ T6009] usb 6-1: device descriptor read/64, error -71 [ 487.629649][ T6009] usb usb6-port1: attempt power cycle [ 487.784331][ T5876] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 487.883685][ T9] usb 4-1: device descriptor read/64, error -71 [ 487.983680][ T6009] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 488.003843][ T5876] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 488.026250][ T5876] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.043494][ T5876] usb 5-1: Product: syz [ 488.054679][ T5876] usb 5-1: Manufacturer: syz [ 488.065524][ T6009] usb 6-1: device descriptor read/8, error -71 [ 488.071770][ T5876] usb 5-1: SerialNumber: syz [ 488.081520][ T5876] usb 5-1: config 0 descriptor?? [ 488.163724][ T9] usb 4-1: new high-speed USB device number 105 using dummy_hcd [ 488.181298][ T5876] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 103 [ 488.323857][ T6009] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 488.343750][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 488.355326][ T6009] usb 6-1: device descriptor read/8, error -71 [ 488.363448][ T9] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 488.377945][ T9] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 488.391791][ T9] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 120, changing to 10 [ 488.405572][ T9] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 8348, setting to 1024 [ 488.417402][ T9] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 488.434909][ T9] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 488.444228][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.452245][ T9] usb 4-1: Product: syz [ 488.457007][ T9] usb 4-1: Manufacturer: syz [ 488.461637][ T9] usb 4-1: SerialNumber: syz [ 488.467444][ T6009] usb usb6-port1: unable to enumerate USB device [ 488.489666][ C0] imon 4-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 488.507776][ T9] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input69 [ 488.704757][ T9] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 488.723400][ T9] (id 0x00) [ 488.806029][ T9] rc_core: IR keymap rc-imon-pad not found [ 488.817190][T13758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.831470][ T9] Registered IR keymap rc-empty [ 488.851458][T13758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.860884][ T9] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 488.877484][ T9] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 488.893162][T13758] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2384'. [ 488.916375][T13762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.937368][T13762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.940279][T13779] syz_tun: entered promiscuous mode [ 488.957373][T13779] macsec1: entered promiscuous mode [ 488.967808][T13779] syz_tun: left promiscuous mode [ 489.270532][ T9] imon:send_packet: packet tx failed (-71) [ 489.314676][ T9] imon 4-1:155.0: remote input dev register failed [ 489.321533][ T9] imon 4-1:155.0: imon_init_intf0: rc device setup failed [ 489.347257][T13787] input: syz0 as /devices/virtual/input/input71 [ 489.442128][ T9] imon 4-1:155.0: unable to initialize intf0, err 0 [ 489.449315][ T9] imon:imon_probe: failed to initialize context! [ 489.457715][ T9] imon 4-1:155.0: unable to register, err -19 [ 489.467715][ T9] usb 4-1: USB disconnect, device number 105 [ 489.764705][T13799] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2395'. [ 489.872496][T13802] netlink: 'syz.3.2397': attribute type 8 has an invalid length. [ 489.890386][T13802] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2397'. [ 489.983673][ T5906] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 490.037733][T13804] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2398'. [ 490.168904][ T5906] usb 6-1: config 0 has no interfaces? [ 490.183560][ T5906] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 490.223960][ T5906] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 490.278028][ T5906] usb 6-1: config 0 descriptor?? [ 490.577341][ T5898] usb 6-1: USB disconnect, device number 24 [ 490.654476][ T5876] i2c i2c-1: failure reading functionality [ 490.713944][ T5876] i2c i2c-1: connected i2c-tiny-usb device [ 490.760515][ T5876] usb 5-1: USB disconnect, device number 103 [ 490.836987][T13815] FAULT_INJECTION: forcing a failure. [ 490.836987][T13815] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 490.881792][T13815] CPU: 1 UID: 0 PID: 13815 Comm: syz.4.2402 Tainted: G L syzkaller #0 PREEMPT(full) [ 490.881822][T13815] Tainted: [L]=SOFTLOCKUP [ 490.881829][T13815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 490.881840][T13815] Call Trace: [ 490.881847][T13815] [ 490.881855][T13815] dump_stack_lvl+0xe8/0x150 [ 490.881883][T13815] should_fail_ex+0x412/0x560 [ 490.881911][T13815] _copy_from_user+0x2d/0xb0 [ 490.881930][T13815] __sys_connect+0x156/0x450 [ 490.881956][T13815] ? __pfx___sys_connect+0x10/0x10 [ 490.881988][T13815] ? __pfx_ksys_write+0x10/0x10 [ 490.882017][T13815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.882037][T13815] __x64_sys_connect+0x7a/0x90 [ 490.882061][T13815] do_syscall_64+0x15f/0xf80 [ 490.882082][T13815] ? trace_irq_disable+0x3b/0x140 [ 490.882105][T13815] ? clear_bhb_loop+0x40/0x90 [ 490.882127][T13815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.882144][T13815] RIP: 0033:0x7f985d59c819 [ 490.882159][T13815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 490.882174][T13815] RSP: 002b:00007f985e4f0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 490.882193][T13815] RAX: ffffffffffffffda RBX: 00007f985d815fa0 RCX: 00007f985d59c819 [ 490.882206][T13815] RDX: 000000000000001c RSI: 0000200000000180 RDI: 0000000000000003 [ 490.882217][T13815] RBP: 00007f985e4f0090 R08: 0000000000000000 R09: 0000000000000000 [ 490.882229][T13815] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 490.882239][T13815] R13: 00007f985d816038 R14: 00007f985d815fa0 R15: 00007f985d93fa48 [ 490.882267][T13815] [ 491.669386][T13833] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2409'. [ 491.814233][ T5876] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 491.973702][ T5876] usb 4-1: Using ep0 maxpacket: 8 [ 491.990704][ T5876] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 492.012727][ T5876] usb 4-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 492.032364][ T5876] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 492.063060][ T5876] usb 4-1: config 0 descriptor?? [ 492.094673][ T5876] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 492.509544][T13852] loop3: detected capacity change from 0 to 7 [ 492.523171][T13852] Dev loop3: unable to read RDB block 7 [ 492.529616][T13852] loop3: AHDI p3 p4 [ 492.535708][T13852] loop3: partition table partially beyond EOD, truncated [ 492.543326][T13852] loop3: p3 start 1702000233 is beyond EOD, truncated [ 492.575866][T13854] raw_sendmsg: syz.5.2417 forgot to set AF_INET. Fix it! [ 492.709089][T13830] netlink: 'syz.3.2408': attribute type 13 has an invalid length. [ 492.845794][ T5876] gspca_vc032x: reg_r err -71 [ 492.852862][ T5876] vc032x 4-1:0.0: probe with driver vc032x failed with error -71 [ 492.878702][ T5876] usb 4-1: USB disconnect, device number 106 [ 493.053306][T13864] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2420'. [ 493.420711][T13868] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2421'. [ 493.514237][T13872] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.537418][T13872] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.743880][ T5898] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 493.945109][ T5898] usb 1-1: Using ep0 maxpacket: 16 [ 493.980197][ T5898] usb 1-1: unable to get BOS descriptor or descriptor too short [ 494.011121][ T5898] usb 1-1: config 13 has an invalid interface number: 50 but max is 0 [ 494.042142][ T5898] usb 1-1: config 13 has an invalid descriptor of length 0, skipping remainder of the config [ 494.089923][ T5898] usb 1-1: config 13 has no interface number 0 [ 494.146276][ T5898] usb 1-1: config 13 interface 50 altsetting 167 bulk endpoint 0x88 has invalid maxpacket 16 [ 494.176489][ T5876] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 494.263475][ T5898] usb 1-1: config 13 interface 50 altsetting 167 bulk endpoint 0x7 has invalid maxpacket 26 [ 494.352116][ T5898] usb 1-1: config 13 interface 50 has no altsetting 0 [ 494.395896][ T5898] usb 1-1: New USB device found, idVendor=1aca, idProduct=b28e, bcdDevice=92.32 [ 494.417750][ T5876] usb 5-1: Using ep0 maxpacket: 16 [ 494.443920][ T5876] usb 5-1: too many configurations: 112, using maximum allowed: 8 [ 494.456252][ T5898] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.491589][ T5898] usb 1-1: Product: syz [ 494.512210][ T5876] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 494.529458][ T5898] usb 1-1: Manufacturer: syz [ 494.547898][ T5898] usb 1-1: SerialNumber: syz [ 494.562450][ T5876] usb 5-1: New USB device strings: Mfr=144, Product=246, SerialNumber=0 [ 494.597898][T13870] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 494.611845][ T5876] usb 5-1: Product: syz [ 494.630840][ T5876] usb 5-1: Manufacturer: syz [ 494.693771][ T5876] r8152-cfgselector 5-1: Unknown version 0x0000 [ 494.725883][ T5876] r8152-cfgselector 5-1: config 0 descriptor?? [ 494.769803][ T5876] cdc_acm 5-1:0.0: Zero length descriptor references [ 494.796552][ T5876] cdc_acm 5-1:0.0: probe with driver cdc_acm failed with error -22 [ 494.798583][T13891] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2426'. [ 495.074171][ T5906] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 495.121789][T13892] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.133119][T13892] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.195579][T13894] input: syz0 as /devices/virtual/input/input72 [ 495.219170][ T5906] usb 4-1: device descriptor read/64, error -71 [ 495.473829][ T5906] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 495.644529][ T5906] usb 4-1: device descriptor read/64, error -71 [ 495.766416][ T5906] usb usb4-port1: attempt power cycle [ 495.918342][ T5898] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 495.939522][ T5898] usb 1-1: MIDIStreaming interface descriptor not found [ 496.025783][T13909] overlayfs: missing 'lowerdir' [ 496.052772][ T5898] usb 1-1: USB disconnect, device number 89 [ 496.069328][T13908] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 496.113773][ T5906] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 496.154356][ T5906] usb 4-1: device descriptor read/8, error -71 [ 496.219756][ T6016] udevd[6016]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:13.50/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 496.404337][ T5906] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 496.435554][ T5906] usb 4-1: device descriptor read/8, error -71 [ 496.554744][ T5906] usb usb4-port1: unable to enumerate USB device [ 496.930684][ T5879] r8152-cfgselector 5-1: USB disconnect, device number 104 [ 497.124080][ T5898] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 497.153969][ T5876] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 497.285080][ T5898] usb 6-1: Using ep0 maxpacket: 8 [ 497.291686][ T5898] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 497.302384][ T5898] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 497.311522][ T5898] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.320898][ T5876] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 497.334728][ T5898] usb 6-1: config 0 descriptor?? [ 497.339735][ T5876] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 497.349780][ T5876] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 497.363005][ T5876] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 497.374934][ T5898] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 497.384209][ T5876] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.394682][ T5876] usb 1-1: config 0 descriptor?? [ 497.464049][ T6009] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 497.561874][T13934] macsec1: entered promiscuous mode [ 497.567256][T13934] syz_tun: entered promiscuous mode [ 497.578290][T13934] syz_tun: left promiscuous mode [ 497.616580][ T6009] usb 5-1: unable to get BOS descriptor or descriptor too short [ 497.628713][ T6009] usb 5-1: language id specifier not provided by device, defaulting to English [ 497.639851][ T6009] usb 5-1: New USB device found, idVendor=1235, idProduct=8201, bcdDevice= 0.40 [ 497.650005][ T6009] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.658104][ T6009] usb 5-1: Product: syz [ 497.662519][ T6009] usb 5-1: Manufacturer: 롚婾ä᤼⁴䬋ᶔ쓹龯긳탲ӻ⧋㉔렐뵉唅㢯ୢ⫵꫌끮䆱퉥 [ 497.691587][ T6009] usb 5-1: SerialNumber: syz [ 497.706034][T13936] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2442'. [ 497.726605][T13936] macsec1: entered allmulticast mode [ 497.731962][T13936] batadv0: entered allmulticast mode [ 497.740332][T13936] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 497.750586][T13936] batadv0: left allmulticast mode [ 497.806478][ T5876] usbhid 1-1:0.0: can't add hid device: -71 [ 497.823442][ T5876] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 497.839579][ T5876] usb 1-1: USB disconnect, device number 90 [ 497.936972][ T6009] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 497.949001][ T6009] usb 5-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 497.997859][T13915] netlink: 'syz.5.2432': attribute type 13 has an invalid length. [ 498.019956][ T6009] usb 5-1: USB disconnect, device number 105 [ 498.141563][T13938] 8021q: VLANs not supported on ip6gre0 [ 498.170096][ T5898] gspca_vc032x: reg_r err -71 [ 498.181932][ T5898] vc032x 6-1:0.0: probe with driver vc032x failed with error -71 [ 498.205067][ T5898] usb 6-1: USB disconnect, device number 25 [ 498.383174][T13949] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2447'. [ 498.427492][T13949] macsec3: entered allmulticast mode [ 498.442127][T13949] batadv0: entered allmulticast mode [ 498.460686][T13949] 8021q: adding VLAN 0 to HW filter on device macsec3 [ 498.481827][T13949] batadv0: left allmulticast mode [ 498.532034][T13954] binder: 13953:13954 unknown command 0 [ 498.537836][T13954] binder: 13953:13954 ioctl c0306201 200000000280 returned -22 [ 498.573726][ T6009] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 498.733807][ T6009] usb 3-1: Using ep0 maxpacket: 8 [ 498.809008][T13964] FAULT_INJECTION: forcing a failure. [ 498.809008][T13964] name failslab, interval 1, probability 0, space 0, times 0 [ 498.822503][T13964] CPU: 1 UID: 0 PID: 13964 Comm: syz.5.2454 Tainted: G L syzkaller #0 PREEMPT(full) [ 498.822532][T13964] Tainted: [L]=SOFTLOCKUP [ 498.822539][T13964] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 498.822551][T13964] Call Trace: [ 498.822558][T13964] [ 498.822566][T13964] dump_stack_lvl+0xe8/0x150 [ 498.822599][T13964] should_fail_ex+0x412/0x560 [ 498.822628][T13964] should_failslab+0xa8/0x100 [ 498.822651][T13964] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 498.822677][T13964] ? ip6_default_advmss+0x80/0x3b0 [ 498.822696][T13964] ? __alloc_skb+0x1d0/0x7d0 [ 498.822725][T13964] __alloc_skb+0x1d0/0x7d0 [ 498.822754][T13964] tcp_stream_alloc_skb+0x3f/0x580 [ 498.822774][T13964] ? __asan_memset+0x22/0x50 [ 498.822801][T13964] tcp_connect+0x1567/0x5440 [ 498.822852][T13964] ? ktime_get_with_offset+0x93/0x2d0 [ 498.822882][T13964] ? __pfx_tcp_connect+0x10/0x10 [ 498.822901][T13964] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 498.822923][T13964] ? lockdep_hardirqs_on+0x7a/0x110 [ 498.822945][T13964] ? ktime_get_with_offset+0x93/0x2d0 [ 498.822964][T13964] ? seqcount_lockdep_reader_access+0xea/0x100 [ 498.822992][T13964] ? __asan_memset+0x22/0x50 [ 498.823021][T13964] ? __pfx_tcp_fastopen_defer_connect+0x10/0x10 [ 498.823054][T13964] ? inet6_hash_connect+0xeb/0x170 [ 498.823078][T13964] tcp_v6_connect+0x128d/0x1b10 [ 498.823105][T13964] ? do_raw_spin_lock+0x31/0x2f0 [ 498.823131][T13964] ? __pfx_tcp_v6_connect+0x10/0x10 [ 498.823151][T13964] ? mptcp_connect+0x4c3/0x830 [ 498.823174][T13964] ? __local_bh_enable_ip+0xd0/0x130 [ 498.823203][T13964] mptcp_connect+0x56b/0x830 [ 498.823228][T13964] __inet_stream_connect+0x25a/0xdd0 [ 498.823253][T13964] ? do_raw_spin_lock+0x12b/0x2f0 [ 498.823271][T13964] ? lock_sock_nested+0x6a/0x100 [ 498.823293][T13964] ? __pfx___inet_stream_connect+0x10/0x10 [ 498.823325][T13964] ? inet_stream_connect+0x51/0xa0 [ 498.823345][T13964] ? __local_bh_enable_ip+0xd0/0x130 [ 498.823373][T13964] inet_stream_connect+0x66/0xa0 [ 498.823395][T13964] __sys_connect+0x312/0x450 [ 498.823422][T13964] ? __pfx___sys_connect+0x10/0x10 [ 498.823458][T13964] ? __pfx_ksys_write+0x10/0x10 [ 498.823489][T13964] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.823509][T13964] __x64_sys_connect+0x7a/0x90 [ 498.823534][T13964] do_syscall_64+0x15f/0xf80 [ 498.823559][T13964] ? trace_irq_disable+0x3b/0x140 [ 498.823578][T13964] ? clear_bhb_loop+0x40/0x90 [ 498.823600][T13964] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.823616][T13964] RIP: 0033:0x7f60e859c819 [ 498.823634][T13964] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 498.823649][T13964] RSP: 002b:00007f60e9503028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 498.823668][T13964] RAX: ffffffffffffffda RBX: 00007f60e8815fa0 RCX: 00007f60e859c819 [ 498.823681][T13964] RDX: 000000000000001c RSI: 0000200000000180 RDI: 0000000000000003 [ 498.823692][T13964] RBP: 00007f60e9503090 R08: 0000000000000000 R09: 0000000000000000 [ 498.823704][T13964] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.823714][T13964] R13: 00007f60e8816038 R14: 00007f60e8815fa0 R15: 00007f60e893fa48 [ 498.823742][T13964] [ 499.161173][ T6009] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 499.171299][ T6009] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.200955][ T6009] usb 3-1: Product: syz [ 499.205331][ T6009] usb 3-1: Manufacturer: syz [ 499.211042][ T6009] usb 3-1: SerialNumber: syz [ 499.221902][ T6009] usb 3-1: config 0 descriptor?? [ 499.423660][ T5898] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 499.478546][ T6009] usb 3-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 499.487200][ T9] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 499.512430][T13977] loop3: detected capacity change from 0 to 7 [ 499.520057][T13977] Dev loop3: unable to read RDB block 7 [ 499.526248][T13977] loop3: AHDI p3 p4 [ 499.530285][T13977] loop3: partition table partially beyond EOD, truncated [ 499.538521][T13977] loop3: p3 start 1702000233 is beyond EOD, truncated [ 499.586332][ T5898] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.601379][ T5898] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 499.612484][ T5898] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 499.628342][ T5898] usb 4-1: Manufacturer: syz [ 499.635635][ T5898] usb 4-1: config 0 descriptor?? [ 499.645892][ T9] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 499.658298][ T9] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 499.667863][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.684031][ T5906] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 499.693029][ T9] usb 6-1: config 0 descriptor?? [ 499.720148][ T9] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 499.846725][T13966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.863378][T13966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.873204][T13984] input: syz0 as /devices/virtual/input/input73 [ 499.875335][ T5906] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 499.892242][T13966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.900538][ T5906] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 499.912400][T13966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.920683][ T5906] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 499.947552][T13969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.973664][ T5906] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 499.982257][T13969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.998225][ T5906] usb 5-1: SerialNumber: syz [ 500.098708][ T5876] usb 4-1: USB disconnect, device number 111 [ 500.158970][ T5832] usb 6-1: USB disconnect, device number 26 [ 500.230686][ T5906] usb 5-1: 0:2 : does not exist [ 500.265039][ T5906] usb 5-1: USB disconnect, device number 106 [ 500.291518][ T5831] udevd[5831]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 500.314094][ T10] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 500.473736][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 500.480379][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 500.490845][ T10] usb 1-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 500.500031][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 500.510530][ T10] usb 1-1: config 0 descriptor?? [ 500.519405][ T10] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 500.593424][ T6009] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 500.680687][T13989] netlink: 'syz.3.2465': attribute type 21 has an invalid length. [ 500.689253][T13989] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2465'. [ 500.953680][ T5898] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 501.133748][ T5898] usb 4-1: Using ep0 maxpacket: 8 [ 501.164013][ T5898] usb 4-1: config 0 has an invalid interface number: 31 but max is 0 [ 501.196346][ T5898] usb 4-1: config 0 has no interface number 0 [ 501.201928][T13987] netlink: 'syz.0.2464': attribute type 13 has an invalid length. [ 501.277612][ T5898] usb 4-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 501.295594][ T5898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.312570][ T5898] usb 4-1: Product: syz [ 501.385411][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.392815][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.403737][ T5832] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 501.425576][ T10] gspca_vc032x: reg_r err -71 [ 501.442175][ T10] vc032x 1-1:0.0: probe with driver vc032x failed with error -71 [ 501.461763][ T10] usb 1-1: USB disconnect, device number 91 [ 501.485719][ T5898] usb 4-1: Manufacturer: syz [ 501.511889][ T5898] usb 4-1: SerialNumber: syz [ 501.544008][ T5898] usb 4-1: config 0 descriptor?? [ 501.676001][ T5832] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 501.689316][ T5832] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 501.699249][ T5832] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 501.711098][ T5832] usb 6-1: Product: syz [ 501.715760][ T5832] usb 6-1: Manufacturer: syz [ 501.720524][ T5832] usb 6-1: SerialNumber: syz [ 502.349524][T13998] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2468'. [ 502.358932][T13998] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2468'. [ 502.769957][T14025] loop2: detected capacity change from 0 to 7 [ 502.777287][T14025] Dev loop2: unable to read RDB block 7 [ 502.786393][T14025] loop2: unable to read partition table [ 502.795166][T13998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 502.811287][ T5832] cdc_ncm 6-1:1.0: bind() failure [ 502.813531][T13998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 502.825409][T14025] loop2: partition table beyond EOD, truncated [ 502.845746][T14025] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 502.856574][ T5832] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 502.872226][ T5832] cdc_ncm 6-1:1.1: bind() failure [ 502.920302][ T5832] usb 6-1: USB disconnect, device number 27 [ 503.443924][ T5879] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 503.566269][ T5906] usb 3-1: USB disconnect, device number 113 [ 503.605746][ T5879] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 503.634255][ T5879] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 503.654375][ T5879] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.687933][ T5879] usb 1-1: config 0 descriptor?? [ 503.721665][ T5879] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 503.743818][ T5898] uvcvideo 4-1:0.31: Found UVC 0.04 device syz (046d:08c3) [ 503.768909][ T5898] uvcvideo 4-1:0.31: Entity type for entity Output 32774 was not initialized! [ 503.789210][ T5898] uvcvideo 4-1:0.31: Failed to create links for entity 5 [ 503.796419][ T5898] uvcvideo 4-1:0.31: Failed to register entities (-22). [ 503.803801][ T5876] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 503.819740][ T5898] usb 4-1: USB disconnect, device number 112 [ 503.878744][T14046] syzkaller0: entered promiscuous mode [ 503.887104][T14046] syzkaller0: entered allmulticast mode [ 503.936655][T14036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.954195][ T5876] usb 6-1: Using ep0 maxpacket: 8 [ 503.964250][ T5876] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 503.970601][T14036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.983538][ T5876] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 503.997099][ T5876] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.009734][ T5876] usb 6-1: config 0 descriptor?? [ 504.027202][ T5876] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 504.195881][ T5879] usb 1-1: USB disconnect, device number 92 [ 504.268095][T14058] netlink: 512 bytes leftover after parsing attributes in process `syz.4.2487'. [ 504.313835][ T5898] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 504.424429][ T5832] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 504.480326][ T5898] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 504.505004][ T5898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.522613][T14062] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2488'. [ 504.531601][ T5898] usb 4-1: Product: syz [ 504.531622][ T5898] usb 4-1: Manufacturer: syz [ 504.531638][ T5898] usb 4-1: SerialNumber: syz [ 504.578908][T14062] bond0 (unregistering): left promiscuous mode [ 504.589192][T14062] bond_slave_0: left promiscuous mode [ 504.594628][ T5832] usb 3-1: Using ep0 maxpacket: 32 [ 504.600158][T14062] bond_slave_1: left promiscuous mode [ 504.651164][ T5832] usb 3-1: unable to get BOS descriptor or descriptor too short [ 504.678864][ T5832] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 504.689589][ T5832] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 504.700031][ T5832] usb 3-1: config 1 has no interface number 0 [ 504.706498][T14062] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 504.706583][ T5832] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 504.729437][ T5832] usb 3-1: New USB device found, idVendor=2b53, idProduct=0024, bcdDevice= 0.40 [ 504.739111][ T5832] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.748872][ T5832] usb 3-1: Product: syz [ 504.757402][ T5832] usb 3-1: Manufacturer: syz [ 504.763009][ T5832] usb 3-1: SerialNumber: syz [ 504.798522][T14062] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 504.816271][T14062] bond0 (unregistering): Released all slaves [ 504.896618][ T5876] gspca_vc032x: reg_r err -71 [ 504.913354][ T5876] vc032x 6-1:0.0: probe with driver vc032x failed with error -71 [ 504.962690][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 504.983168][ T5876] usb 6-1: USB disconnect, device number 28 [ 505.028845][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 505.384925][ T5832] usb 3-1: USB disconnect, device number 114 [ 506.111449][T14072] netlink: 'syz.0.2490': attribute type 13 has an invalid length. [ 506.156074][T14083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.176637][T14083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.187269][T14083] netlink: 'syz.4.2493': attribute type 1 has an invalid length. [ 506.322935][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 506.393694][ T5832] usb 5-1: new full-speed USB device number 107 using dummy_hcd [ 506.511331][T14086] futex_wake_op: syz.5.2491 tries to shift op by -1; fix this program [ 507.330817][T14084] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 507.422043][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001030. ret = -EPROTO [ 507.495307][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 507.528441][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 507.547112][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 507.568064][ T5898] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 507.591481][ T5898] usb 4-1: USB disconnect, device number 113 [ 508.227206][ T6009] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 508.293667][ T5898] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 508.395699][ T6009] usb 6-1: config 0 has no interfaces? [ 508.407185][ T6009] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 508.422900][ T6009] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.431168][ T6009] usb 6-1: Product: syz [ 508.435719][ T6009] usb 6-1: Manufacturer: syz [ 508.441246][ T6009] usb 6-1: SerialNumber: syz [ 508.444632][ T5898] usb 4-1: Using ep0 maxpacket: 8 [ 508.452727][ T6009] usb 6-1: config 0 descriptor?? [ 508.460061][ T5898] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 508.483685][ T5898] usb 4-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 508.492986][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.510606][ T5898] usb 4-1: config 0 descriptor?? [ 508.524251][ T5898] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 508.574245][ T5832] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 508.589599][T14127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.604242][T14127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.680172][ T10] usb 6-1: USB disconnect, device number 29 [ 508.745768][ T5832] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 508.756022][ T5832] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 508.765240][ T5832] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 508.778902][ T5832] usb 5-1: config 0 descriptor?? [ 508.789122][ T5832] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 508.833684][ T6009] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 508.991487][T14104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 509.000752][T14104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 509.174508][ T5876] usb 5-1: USB disconnect, device number 108 [ 509.199799][ T6009] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 509.222953][ T6009] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 509.248220][ T5898] gspca_vc032x: reg_r err -71 [ 509.249110][ T6009] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.258711][ T5898] vc032x 4-1:0.0: probe with driver vc032x failed with error -71 [ 509.278838][ T5898] usb 4-1: USB disconnect, device number 114 [ 509.318942][ T6009] usb 3-1: config 0 descriptor?? [ 509.342376][ T6009] pwc: Askey VC010 type 2 USB webcam detected. [ 509.511277][T14134] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2513'. [ 509.524564][T14134] netlink: 'syz.0.2513': attribute type 7 has an invalid length. [ 509.530948][T14136] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2512'. [ 509.532451][T14134] netlink: 'syz.0.2513': attribute type 8 has an invalid length. [ 509.559614][T14134] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2513'. [ 509.574984][T14134] erspan0: entered promiscuous mode [ 509.581556][T14134] gretap0: entered promiscuous mode [ 509.588531][T14134] erspan0: left promiscuous mode [ 509.594805][T14134] gretap0: left promiscuous mode [ 509.728010][T14141] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2515'. [ 509.772373][ T6009] pwc: recv_control_msg error -32 req 02 val 2b00 [ 509.784051][ T9] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 509.816410][ T6009] pwc: recv_control_msg error -32 req 02 val 2700 [ 509.934277][ T9] usb 6-1: device descriptor read/64, error -71 [ 509.970134][T14146] netlink: 'syz.3.2517': attribute type 1 has an invalid length. [ 510.021832][T14150] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2517'. [ 510.089857][T14150] 8021q: adding VLAN 0 to HW filter on device bond0 [ 510.201274][ T9] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 510.364754][ T9] usb 6-1: device descriptor read/64, error -71 [ 510.371127][ T5906] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 510.496455][ T9] usb usb6-port1: attempt power cycle [ 510.527737][T14160] lo: Caught tx_queue_len zero misconfig [ 510.552289][ T5906] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 510.552525][ T5898] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 510.572637][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.588983][ T5906] usb 5-1: Product: syz [ 510.594237][ T5906] usb 5-1: Manufacturer: syz [ 510.598893][ T5906] usb 5-1: SerialNumber: syz [ 510.640075][ T6009] pwc: recv_control_msg error -71 req 04 val 1000 [ 510.656737][ T6009] pwc: recv_control_msg error -71 req 04 val 1300 [ 510.664015][ T6009] pwc: recv_control_msg error -71 req 04 val 1400 [ 510.671097][ T6009] pwc: recv_control_msg error -71 req 02 val 2000 [ 510.678625][ T6009] pwc: recv_control_msg error -71 req 02 val 2100 [ 510.687348][ T6009] pwc: recv_control_msg error -71 req 04 val 1500 [ 510.695184][ T6009] pwc: recv_control_msg error -71 req 02 val 2500 [ 510.702112][ T6009] pwc: recv_control_msg error -71 req 02 val 2400 [ 510.711382][ T6009] pwc: recv_control_msg error -71 req 02 val 2600 [ 510.720619][ T6009] pwc: recv_control_msg error -71 req 02 val 2900 [ 510.730870][ T5898] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 510.746987][ T5898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.755370][ T5898] usb 4-1: Product: syz [ 510.759744][ T5898] usb 4-1: Manufacturer: syz [ 510.759808][ T6009] pwc: recv_control_msg error -71 req 02 val 2800 [ 510.764441][ T5898] usb 4-1: SerialNumber: syz [ 510.785308][ T6009] pwc: recv_control_msg error -71 req 04 val 1100 [ 510.794955][ T6009] pwc: recv_control_msg error -71 req 04 val 1200 [ 510.806758][ T6009] pwc: Registered as video103. [ 510.820897][ T6009] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input74 [ 510.843786][ T9] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 510.864407][ T9] usb 6-1: device descriptor read/8, error -71 [ 510.902047][ T6009] usb 3-1: USB disconnect, device number 115 [ 511.020122][ T5906] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 511.034098][ T5906] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 511.103799][ T9] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 511.114715][ T5907] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 511.136306][ T9] usb 6-1: device descriptor read/8, error -71 [ 511.166816][T14175] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2526'. [ 511.189153][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 511.201450][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 511.244810][ T9] usb usb6-port1: unable to enumerate USB device [ 511.265598][ T5907] usb 1-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 511.274457][ T5907] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 511.286976][ T5907] usb 1-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice= 0.9c [ 511.297205][ T5907] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.305747][ T5907] usb 1-1: Product: syz [ 511.310503][ T5907] usb 1-1: Manufacturer: syz [ 511.315175][ T5907] usb 1-1: SerialNumber: syz [ 511.322605][ T5907] usb 1-1: config 0 descriptor?? [ 511.332532][ T5907] ims_pcu 1-1:0.0: Missing CDC union descriptor [ 511.338974][ T5907] ims_pcu 1-1:0.0: probe with driver ims_pcu failed with error -22 [ 512.133709][ T5907] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 512.261274][ T5906] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 512.305535][ T5907] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 512.315938][ T5907] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 512.325224][ T5907] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.337656][ T5907] usb 3-1: config 0 descriptor?? [ 512.350318][ T5907] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 512.423317][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 512.569055][T14179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.581946][T14179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.760270][ T5876] usb 3-1: USB disconnect, device number 116 [ 512.933751][ T50] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 513.093784][ T50] usb 6-1: Using ep0 maxpacket: 32 [ 513.101108][ T50] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 513.109321][ T50] usb 6-1: config 0 has no interface number 0 [ 513.118203][ T50] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 513.127549][ T50] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.136075][ T50] usb 6-1: Product: syz [ 513.140293][ T50] usb 6-1: Manufacturer: syz [ 513.144982][ T50] usb 6-1: SerialNumber: syz [ 513.153428][ T50] usb 6-1: config 0 descriptor?? [ 513.162986][ T50] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 513.346590][ T5906] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001030. ret = -EPROTO [ 513.360425][ T5906] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 513.377261][ T5906] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 513.390238][ T5906] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 513.390370][ T50] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 513.411228][ T5906] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 513.423353][ T50] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 513.427028][ T5906] usb 5-1: USB disconnect, device number 109 [ 513.517331][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001030. ret = -EPROTO [ 513.544441][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 513.557343][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 513.567880][ T5898] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 513.584138][ C1] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 513.584569][ T5907] usb 6-1: USB disconnect, device number 34 [ 513.622272][ T5907] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 513.655104][ T5907] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 513.680068][ T5907] quatech2 6-1:0.51: device disconnected [ 513.866577][ T5898] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 513.887465][ T5898] usb 4-1: USB disconnect, device number 115 [ 514.012269][T14187] syzkaller0: entered promiscuous mode [ 514.018985][T14187] syzkaller0: entered allmulticast mode [ 514.184474][ T30] INFO: task kworker/u8:12:3487 blocked for more than 143 seconds. [ 514.199712][ T5898] usb 1-1: USB disconnect, device number 93 [ 514.209486][ T30] Tainted: G L syzkaller #0 [ 514.226210][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 514.245771][T14189] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2533'. [ 514.248491][ T30] task:kworker/u8:12 state:D stack:21208 pid:3487 tgid:3487 ppid:2 task_flags:0x4208160 flags:0x00080000 [ 514.277537][ T30] Workqueue: netns cleanup_net [ 514.282326][ T30] Call Trace: [ 514.286425][ T30] [ 514.289433][ T30] __schedule+0x17b4/0x5680 [ 514.294075][ T30] ? __pfx___schedule+0x10/0x10 [ 514.298957][ T30] ? schedule+0x90/0x360 [ 514.303214][ T30] schedule+0x164/0x360 [ 514.308285][ T30] afs_cell_purge+0x40d/0x580 [ 514.313126][ T30] ? __pfx_afs_cell_purge+0x10/0x10 [ 514.319219][ T30] ? __pfx_var_wake_function+0x10/0x10 [ 514.325224][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 514.331620][ T30] ? __timer_delete_sync+0x4a4/0x520 [ 514.343190][ T30] afs_net_exit+0x50/0x100 [ 514.347741][ T30] ops_undo_list+0x49f/0x940 [ 514.352376][ T30] ? __pfx_ops_undo_list+0x10/0x10 [ 514.357893][ T30] ? idr_destroy+0x218/0x290 [ 514.362514][ T30] ? do_raw_spin_unlock+0xf5/0x210 [ 514.372317][ T30] cleanup_net+0x56b/0x800 [ 514.376831][ T30] ? __pfx_cleanup_net+0x10/0x10 [ 514.381791][ T30] ? process_scheduled_works+0xa70/0x1860 [ 514.387685][ T30] ? process_scheduled_works+0xa70/0x1860 [ 514.393520][ T30] process_scheduled_works+0xb5d/0x1860 [ 514.399724][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 514.405920][ T30] ? assign_work+0x3d5/0x5e0 [ 514.410523][ T30] worker_thread+0xa53/0xfc0 [ 514.415380][ T30] kthread+0x388/0x470 [ 514.419567][ T30] ? __pfx_worker_thread+0x10/0x10 [ 514.424848][ T30] ? __pfx_kthread+0x10/0x10 [ 514.429485][ T30] ret_from_fork+0x514/0xb70 [ 514.434299][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 514.439472][ T30] ? __switch_to+0xc79/0x1410 [ 514.445848][ T30] ? __pfx_kthread+0x10/0x10 [ 514.450456][ T30] ret_from_fork_asm+0x1a/0x30 [ 514.455366][ T30] [ 514.458521][ T30] [ 514.458521][ T30] Showing all locks held in the system: [ 514.466316][ T30] 1 lock held by khungtaskd/30: [ 514.471200][ T30] #0: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 514.482019][ T30] 3 locks held by kworker/u8:12/3487: [ 514.487622][ T30] #0: ffff88801be9e940 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 514.498612][ T30] #1: ffffc9000e49fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 514.509240][ T30] #2: ffffffff8fdc01c8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 [ 514.519109][ T30] 2 locks held by getty/5583: [ 514.524167][ T30] #0: ffff8880332400a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 514.551775][ T30] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 514.562845][ T30] 4 locks held by syz-executor/5840: [ 514.569975][ T30] 3 locks held by kworker/u8:3/11664: [ 514.575572][ T30] #0: ffff88801ae94140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 514.587643][ T30] #1: ffffc90002f37c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 514.598755][ T30] #2: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 514.607919][ T30] 3 locks held by syz.0.2522/14165: [ 514.613120][ T30] 4 locks held by syz.5.2529/14180: [ 514.618397][ T30] #0: ffff88804284e840 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 514.628782][ T30] #1: ffffffff8fe3be28 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 [ 514.639990][ T30] #2: ffff88807a7b34d0 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nft_rcv_nl_event+0x13d/0xdb0 [ 514.650584][ T30] #3: ffffffff8e963328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 514.661762][ T30] 2 locks held by syz.4.2531/14186: [ 514.667341][ T30] #0: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 514.676589][ T30] #1: ffffffff8e963328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 514.688113][ T30] 1 lock held by syz.3.2533/14189: [ 514.693242][ T30] #0: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 514.702351][ T30] 2 locks held by syz.3.2533/14190: [ 514.708479][ T30] #0: ffffffff903255b0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 514.718055][ T30] #1: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 514.727377][ T30] [ 514.729799][ T30] ============================================= [ 514.729799][ T30] [ 514.741226][ T30] NMI backtrace for cpu 1 [ 514.741239][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 514.741253][ T30] Tainted: [L]=SOFTLOCKUP [ 514.741257][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 514.741264][ T30] Call Trace: [ 514.741269][ T30] [ 514.741274][ T30] dump_stack_lvl+0xe8/0x150 [ 514.741293][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 514.741309][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 514.741325][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 514.741341][ T30] sys_info+0x135/0x170 [ 514.741354][ T30] watchdog+0xfaa/0x1000 [ 514.741367][ T30] ? watchdog+0x209/0x1000 [ 514.741380][ T30] kthread+0x388/0x470 [ 514.741391][ T30] ? __pfx_watchdog+0x10/0x10 [ 514.741400][ T30] ? __pfx_kthread+0x10/0x10 [ 514.741410][ T30] ret_from_fork+0x514/0xb70 [ 514.741426][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 514.741439][ T30] ? __switch_to+0xc79/0x1410 [ 514.741451][ T30] ? __pfx_kthread+0x10/0x10 [ 514.741462][ T30] ret_from_fork_asm+0x1a/0x30 [ 514.741483][ T30] [ 514.741487][ T30] Sending NMI from CPU 1 to CPUs 0: [ 514.857577][ C0] NMI backtrace for cpu 0 [ 514.857596][ C0] CPU: 0 UID: 0 PID: 14191 Comm: syz.2.2532 Tainted: G L syzkaller #0 PREEMPT(full) [ 514.857618][ C0] Tainted: [L]=SOFTLOCKUP [ 514.857624][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 514.857634][ C0] RIP: 0010:page_table_check_set+0x2b4/0x610 [ 514.857665][ C0] Code: be 04 00 00 00 e8 0c c0 f3 ff 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 0f 85 51 01 00 00 44 8b 3b <31> ff 44 89 fe e8 82 f4 87 ff 45 85 ff 0f 85 4e 02 00 00 48 8d 7b [ 514.857680][ C0] RSP: 0000:ffffc9000750f858 EFLAGS: 00000246 [ 514.857695][ C0] RAX: 0000000000000000 RBX: ffff88801e58a8c8 RCX: dffffc0000000000 [ 514.857707][ C0] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88801e58a8c8 [ 514.857717][ C0] RBP: ffff88801e58a880 R08: ffff88801e58a8cb R09: 1ffff11003cb1519 [ 514.857729][ C0] R10: dffffc0000000000 R11: ffffed1003cb151a R12: 0000000000000001 [ 514.857740][ C0] R13: 0000000000074ee8 R14: 0000000000000001 R15: 0000000000000000 [ 514.857751][ C0] FS: 0000555594356500(0000) GS:ffff888125245000(0000) knlGS:0000000000000000 [ 514.857764][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 514.857775][ C0] CR2: 000000110c2d6022 CR3: 0000000042028000 CR4: 00000000003526f0 [ 514.857790][ C0] Call Trace: [ 514.857796][ C0] [ 514.857803][ C0] ? page_table_check_set+0x148/0x610 [ 514.857828][ C0] set_pte_range+0x84b/0x8a0 [ 514.857852][ C0] filemap_map_pages+0xfe0/0x2100 [ 514.857876][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 514.857895][ C0] ? filemap_map_pages+0x1e6/0x2100 [ 514.857918][ C0] ? __pfx_filemap_map_pages+0x10/0x10 [ 514.857936][ C0] ? __pte_offset_map+0x29/0x240 [ 514.857955][ C0] ? __pte_offset_map+0x29/0x240 [ 514.857973][ C0] ? __pfx_filemap_map_pages+0x10/0x10 [ 514.857989][ C0] do_pte_missing+0x211a/0x3490 [ 514.858011][ C0] ? do_pte_missing+0x130a/0x3490 [ 514.858036][ C0] ? handle_mm_fault+0xee/0x3310 [ 514.858057][ C0] handle_mm_fault+0x1bec/0x3310 [ 514.858082][ C0] ? handle_mm_fault+0xee/0x3310 [ 514.858104][ C0] ? __pfx_handle_mm_fault+0x10/0x10 [ 514.858121][ C0] ? lock_vma_under_rcu+0x45a/0x500 [ 514.858142][ C0] ? __pfx_do_futex+0x10/0x10 [ 514.858173][ C0] do_user_addr_fault+0xa73/0x1340 [ 514.858198][ C0] ? rcu_is_watching+0x15/0xb0 [ 514.858219][ C0] ? trace_page_fault_user+0x84/0x1e0 [ 514.858241][ C0] exc_page_fault+0x6a/0xc0 [ 514.858259][ C0] asm_exc_page_fault+0x26/0x30 [ 514.858275][ C0] RIP: 0033:0x7fb46a671116 [ 514.858288][ C0] Code: ff 48 83 e8 01 48 89 de bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 d9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 20 fe ff ff e9 d4 fd ff ff 0f 1f 80 [ 514.858302][ C0] RSP: 002b:00007fb46ab3fa90 EFLAGS: 00010202 [ 514.858315][ C0] RAX: 000000110c2d4000 RBX: ffffffff846000ae RCX: 0000000000000005 [ 514.858326][ C0] RDX: 00000000000000ae RSI: 0000000000000002 RDI: 0000000000000020 [ 514.858335][ C0] RBP: 0000000000000000 R08: 00007fb46aa00000 R09: 00007fb46aa02000 [ 514.858346][ C0] R10: 00000000846000b2 R11: 0000000000000000 R12: 00007fb46aa16038 [ 514.858357][ C0] R13: 000000000000002f R14: ffffffff8460017e R15: 00007fb46b545720 [ 514.858368][ C0] ? security_file_alloc+0x1e/0x310 [ 514.858386][ C0] ? security_file_permission+0x1be/0x260 [ 514.858407][ C0] [ 515.208245][T14190] macsec3: entered allmulticast mode [ 515.214161][T14190] batadv0: entered allmulticast mode [ 515.220391][T14190] 8021q: adding VLAN 0 to HW filter on device macsec3 [ 515.227285][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 515.234135][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 515.244812][ T30] Tainted: [L]=SOFTLOCKUP [ 515.249116][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 515.259155][ T30] Call Trace: [ 515.262420][ T30] [ 515.265335][ T30] vpanic+0x56c/0xa60 [ 515.269307][ T30] ? __pfx___schedule+0x10/0x10 [ 515.274141][ T30] ? __pfx_vpanic+0x10/0x10 [ 515.278630][ T30] ? __pfx_console_unlock+0x10/0x10 [ 515.283838][ T30] panic+0xc5/0xd0 [ 515.287569][ T30] ? __pfx_panic+0x10/0x10 [ 515.291979][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 515.297346][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 515.303494][ T30] watchdog+0xff4/0x1000 [ 515.307726][ T30] ? watchdog+0x209/0x1000 [ 515.312132][ T30] kthread+0x388/0x470 [ 515.316189][ T30] ? __pfx_watchdog+0x10/0x10 [ 515.320866][ T30] ? __pfx_kthread+0x10/0x10 [ 515.325542][ T30] ret_from_fork+0x514/0xb70 [ 515.330124][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 515.335223][ T30] ? __switch_to+0xc79/0x1410 [ 515.339897][ T30] ? __pfx_kthread+0x10/0x10 [ 515.344478][ T30] ret_from_fork_asm+0x1a/0x30 [ 515.349246][ T30] [ 515.352576][ T30] Kernel Offset: disabled [ 515.356896][ T30] Rebooting in 86400 seconds..