last executing test programs: 6.930056985s ago: executing program 3 (id=1792): r0 = open$dir(0x0, 0x0, 0x20) syz_create_resource$binfmt(&(0x7f00000000c0)='./file0\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_GET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)={0x2c, r2, 0x1, 0x0, 0x80000004, {0x1b}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}}, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) r4 = accept4(r3, 0x0, 0x0, 0x80000) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000300)=0x0) r6 = geteuid() fstat(r1, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r4, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f00000026c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee00}}, './file0\x00'}) r15 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r15, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_generic(r15, 0x0, 0x0) r16 = syz_io_uring_setup(0x88c, 0x0, &(0x7f0000000100), 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000002700)={{0x1, 0x1, 0x18, r0, {0x0, 0x24}}, './file0\x00'}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000002840)={0x0, 0x0}) sendmmsg$unix(r4, &(0x7f000000ab80)=[{{&(0x7f0000000440)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000240)=[{&(0x7f00000004c0)="99a9967735ff000b4085f3a8e484688cf7e2def4d5b50ef10e6b1cc9329146147a078e4fa3f0828aa68d971f5c0fad7a09d43981a660526634bc646d1945e32813f9644b92f19737bb68c78d52facf24e509cf867bdc326b8b964cc1f26ded8715cae6d91b1b9fe4b3668a9798ee6639c86001765a0feef7460521e710a013c5c95dc3ed57fc0194315cf7e4842247d8d3a3c3c83baad9ca6f090a8f90d88c", 0x9f}, {&(0x7f0000000580)="c95db6d3c8acbdfa1db8adfae43664f34f6cd587c2b44867612b0b2a76c6341e66e22c81b437127fe66aaef1b7a3f1f00879dd3847e59cfb3d53cc8380f1d7cb003f37dbd2eb6106cd432b39867c127770135995ad34b1b0d00519", 0x5b}], 0x2, &(0x7f0000004940)=[@cred={{0x18, 0x1, 0x2, {r5, r6, r8}}}, @rights={{0x10, 0x1, 0x1, [r0]}}, @cred={{0x18, 0x1, 0x2, {r11, r13, 0xee01}}}, @rights={{0x30, 0x1, 0x1, [r1, r15, r0, r4, r3, r16, r17, r0, r4]}}, @rights={{0x24, 0x1, 0x1, [r0, r1, r4, r1, r4, r1]}}, @cred={{0x18}}, @rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x18, 0x1, 0x2, {r18}}}, @rights={{0x28, 0x1, 0x1, [r1, 0xffffffffffffffff, r0, r3, r1, r4, r1]}}], 0xfc, 0x20000000}}, {{&(0x7f0000004a40)=@abs={0x0, 0x0, 0x4e23}, 0x6e, &(0x7f0000004cc0)=[{&(0x7f0000004ac0)="c164b1266594b4445f8f9c9ee6de6aae91016e6db0911626704b07fb6cb059cf6d50dfed7642437e1ec907710b6e8a894d076cf8987d1ea1e15f3b0531c84ce0243b0a939d17c57f84e3f98db6fd212cd3e6b975401cafc45012951ed7ba7ce13b95646309f6c6b024a556cb850b1bab01b046057be9a4a256bc04d5d0b46f1c134e5e31026d40d5446d384db34f95ef07d93295142d4f22ef10129845ae4d6fd94b41a245c9ed71cd7218f2fa3ff5e80e94adb9c220d93a5918a5fce548b534a286a648bed59832cc434aa861f314c35f00cdcc8f246580105195098d14e5969379b5d27a022193756de933507518", 0xef}, {&(0x7f0000004bc0)="ebbe63a79877eada344ae5ca5eb45a99bf5b7025f40d872d4435cab2fbfc8d8e7e1caec0732cc6653df6b5322d82d825d4e05ddc3fd8bf401425cfabcabd09c65920b48c6ff5b2bc53a8f70ec522ee001c06b5feb7ba516b999160b2e6253b1271efba55407c1201d1204cc055737f167af6256f85527966374eb4f2d2bbc65c341d0703f456473ef9fe06c82bb2a3e8779d8bd3b7b362712b48833522b27b26be53ab82f54e51042079a52a64ad0e10e14b739a93a2712f4c5402db6716114e1a1dbaf8edd2072b1e763210614b0ab582216da72d2ecddfcb59106e97", 0xdd}], 0x2, &(0x7f0000005200)=[@rights={{0x10, 0x1, 0x1, [r3]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, r15]}}, @cred={{0x18, 0x1, 0x2, {0x0, 0x0, r8}}}, @cred={{0x18, 0x1, 0x2, {r18, 0x0, r10}}}, @cred={{0x18, 0x1, 0x2, {0x0, 0x0, r10}}}], 0x70, 0x80}}, {{0x0, 0x0, &(0x7f00000051c0)=[{&(0x7f0000004d80)="0ba54aaa5f4a82131f4eaf046d905278ba10e0101baa7598139d765d10cf1647ed86b95c6b71027a314b92d676c7563793c8852268225ee3b4064e230e7fbca3", 0x40}, {&(0x7f0000004dc0)="241381a911785ef7a4814dbc62fb51bafe0a124a84ebd2b49c0d808aaacdad0152d9564326a71c0b44fd5606c9fa0cbae315e067ad3a192a18ac76e67859384e350a3f0674fccb40a131864b340d7b8af0c2c368fc98bbc7c1765459059653e5a68c5aafbfcc52a213c37c777496f0c6b614d95f97c7a6aca663635744fbbbf5d1b83ea13191d62047b9a561142af1c853afda1a0efa35913871262dd316011f90165c567eb0a330e5f6bb1e2f360809e797", 0xb2}, {&(0x7f0000004e80)="0549a555ea2d3a460c49cfe207c6145636b2a53150c8cbcb0664c6fe36cf3f34d073f7a71332b34079d716950ed264c604ac2fd60ff7f5525a5e7574b2abed147c026cdf96cc3ad64e0ebeaa92ed75d84aec540215e03a8200e193b92808d8f04f", 0x61}, {&(0x7f0000004f00)="6dad005f4b73ef46d1c2c6acf5161a37d2303206d18c01add5cfa4942bc795b06f610315d9dc582d7da882d9dc866d2df4138df8c67456082ef7110e9f1b4173b293d155e9909cf897eff235db6414d72f0dd3a8d5e6c0fc146e93937d5d00622a859d519a65d756fad10366289aa4d61c02714fefeafd46675fc9547f39c8b1a9e01e2fe55893b281515a30d9d662315dd337d970fdb7e10d08e55f78627298990b5240295df87cc71d6dac051f9823169aae406a6400ecefc4ea01432df63365cc15d1d5f66c07a15bef407c231abf1f8baff50499c87ede0555c3c21ff0eff8b1a0803e9335f9e24c4af9c31cb96b9604b3afc5d23945e728e31358", 0xfd}, {&(0x7f0000005000)="11d72045274a8cf303aa1bf83fff76ca8ebf26bb6f2b830af0475bd9496c732b06e8771f8c8be86c1ed84ad6e0be9d0c78c69897de5ffec050dc8c37e02baa7bacb0b73a6e78996a8ad708896c97bfc3c16ef6", 0x53}, {&(0x7f0000005080)="8ea70ae174dd0890002258bab8a055d739995357953baf89a2fdb9314f985e5549ec37627f3d8052b3504c037aca873e2007866ed3c51fbfdafa37f4142caa6f485576ea4ef2eba097d885b6d8cd2d56a4433bbcc8b2b21a763614107fe830f0130d5526b43452b1c5fc876edea9fc5f35b82b91f57bd86475b0d9c6e040c29e491be2bc69ea750d5b8be64c5ec5f72429dfda35840666f204e6ab16e1d688487accf1", 0xa3}, {&(0x7f0000005140)="426872a498d14bc0f995b5410bfb7e19c6fedee11bdda327aaee49c2c243dfec6b36a789fd4200a09286c192dd540e5f8578438323fc3ad17e01ff9b170becc6d84c9d33d8b29ce6a59c0a90aec6b4d6", 0x50}], 0x7, &(0x7f00000052c0)=ANY=[@ANYBLOB="100000000100000001000000", @ANYRES32=r4, @ANYBLOB="340000000100000001000000", @ANYRES32=r1, @ANYRES32, @ANYRES32=r12, @ANYRES32=r0, @ANYRES32, @ANYRES32, @ANYRES32=r12, @ANYRES32, @ANYRES32=r0, @ANYRES32=r3, @ANYBLOB="18000000eea003ff700100c2", @ANYRES32=0x0, @ANYRES32=r13, @ANYRES32=r10, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=r6, @ANYRES32, @ANYBLOB="180000000100000002000000", @ANYRES32, @ANYRES32=r9, @ANYRES32], 0x8c, 0xc6a7767250463d89}}, {{&(0x7f0000005380)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000005a00)=[{&(0x7f0000004900)="e90aa023f3fc84d6f1a24aee72c1b94628b95722d1819ef9b584ed86a510470aff", 0x21}, {&(0x7f0000005440)="36d30a4ac16f97f47e705e950d308346d5e578c3450cb4012c0beaba0434909a4e14a5239f35e0abc7b5bb2ed8e358b0c47036eb532667f341f4b0734616df0f9fae70e788fa478e19689f937c6534d714f71df00d155ab2ae36fb72d527bd6d0a0a8e7171176732d8a7879df8696b11dc1374722f29633adfd51c397ec3845c1452159a05c1df81ed5f96b2471855365005844c5cf76e21eeed37aba00b6196a41c3ba5d7494b6ab7784b7ac63dff", 0xaf}, {&(0x7f0000005500)="ec370fc42f567e2fb525304f1aeb72caf69c294e14b1daaed379a6191cd42a6474defac19302269a58f81450b42dc6138bd32f6beb99ba33ee611cb39fcd94b5cbc616888caa59434f233a4b812a765b4127260c08fcef9dfd080d4508c30ef31a34be78f25e", 0x66}, {&(0x7f0000005580)="ba59fbb02baaafe1ba0223530301c3885d9b65671d28575fa3dfe69dc0f030d5e485d85c1f961dcfe49f407920a51044f683f99481ca51108b359041566e72f67d6272ed17d50cb4ec8407bbf7caa31b7027763ddcfe02ff540ac768339f1494c95ed0a8246ff9394336de2f9b22a06a18a1574e224d12a920ce8686216b4b89492123a5de7597173a70567a1326e4ebfaf25e3da543d5cab4c2ee3f36886afba7894c33c6103f9ef1716a", 0xab}, {&(0x7f0000005640)="b14786a4a6b8561f35477001dd49f6993cb3835b39d1510db6c7d697d9a485bbb774657bc8d9f3c54340e6d5d75f2006498ef5b98e47c3b92b320933da2a66511eed26faa29a50e540068d3c3bcfabe2a26bca87ad96ba9b064740bd30f0c602ab28c741c765dd83c6c44a73d96b242a09e472683b895b1aad2d51452ad50f81aa76fd9eddfb2da0351685688dc71e31ec1a44c535a9ca54d59bd1facc85bfc6cc0804ade6b9c2fd4ed0f9f93908e703b55d1fa5b7118bf1a3259f89ea7330e85a436dadb6816c95a6e58c699ed2708fd313b12f8167eed0befa321a1615a0890bdf05ae56fab9d59287254fca08", 0xee}, {&(0x7f0000005740)="56c121afcc48afd2473ccc2a2017de0f07f410f55e0fd984b2ce1bd4a5a8a40aeac6", 0x22}, {&(0x7f0000005780)="cda8", 0x2}, {&(0x7f00000057c0)="32e05e365630effb9cb16f2257910224ce06fb9272f3631471dc5f7d1000e8172f2141179951c45432b989d929a66341cd6231a99507431e76158d0c1bdbdd2fdb50edaa59b61b12e4a482c1", 0x4c}, {&(0x7f0000005840)="4202503316605aa33c18f6f42bf10e99f3b55f732657186b012508091d11e57344dad1d42e53d0ceb14820077189e15d3c917189b7bc2ef52789cef9b8bd6f0a5949ec2b0ff7728761ff5e116471de08d21d4c3d09ab8c13f9840cd53ae35046058627ab6360be3fc84509d51889658a84cde2bf7780d4c997aac402323fe0492fc25c6c83127f8842789c6ed0c68a7f0c2c0ac2d3cb65927d375f8cca4aaf265104345ebf2b73d965c5b819ce0912c8e8ad4a70c8490f238c1d984a50df52559ed3b801c982df79101e418fe5b96fcb737a491a21765eed5572af81a352dab5ab056e58", 0xe4}, {&(0x7f0000005940)="f94ea166809a19c898d4ac96311f5add8de8c42e6bad42624cde0c254786e70d39774cb6f68f77e7e67c1ca6d6eeced4c01e05f1eaba6f31f56fca1580796fe50d258f6dcbc24943eea71f0437264d41f7c854e370edb2906e9978611c6c5928f97cd5208994be05afc78a3ab22dbb1f39c828643c942a35287cac887067138ffe7b340e68efe711a18b305c372c0dd7bbdea641", 0x94}], 0xa, &(0x7f0000005a80)=[@rights={{0x10, 0x1, 0x1, [r3]}}], 0x10, 0x4000}}, {{&(0x7f0000005ac0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000005d40)=[{0x0}], 0x1, &(0x7f0000006340)=[@cred={{0x18, 0x1, 0x2, {0x0, 0x0, r14}}}, @rights={{0x10, 0x1, 0x1, [r16]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18, 0x1, 0x2, {0x0, 0x0, r8}}}, @cred={{0x18, 0x1, 0x2, {r5, r13, r8}}}, @rights={{0x24, 0x1, 0x1, [r4, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x9c, 0x20000001}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f000000aa40)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18, 0x1, 0x2, {0x0, r7}}}, @cred={{0x18, 0x1, 0x2, {r11, r9}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [r0, r3]}}, @rights={{0x10, 0x1, 0x1, [r15]}}, @rights={{0x10, 0x1, 0x1, [r1]}}], 0x94, 0x4000}}, {{0x0, 0x0, &(0x7f000000ab40)=[{&(0x7f000000ab00)}], 0x1, 0x0, 0x0, 0x810}}], 0x7, 0x80cc) 6.845216244s ago: executing program 3 (id=1793): openat$binder_debug(0xffffff9c, &(0x7f00000021c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') fsopen(&(0x7f0000000100)='udf\x00', 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe80"], 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 6.685114679s ago: executing program 0 (id=1795): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x84, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x58, 0xe, {{{}, {}, @broadcast, @device_b, @from_mac=@device_b}, 0x0, @random=0x8, 0x1, @void, @val={0x1, 0x6, [{0x24}, {0x36}, {0x1, 0x1}, {0x9}, {0x4}, {0x3}]}, @val={0x3, 0x1, 0x30}, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x2, 0x0, 0x7, 0x0, {0x6, 0x2, 0x0, 0xbc}, 0x400, 0x3, 0x9}}, @void, @val={0x71, 0x7, {0x1, 0x0, 0x1, 0xffffffffffffffff, 0x0, 0x1, 0x48}}, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x2}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x84}}, 0x0) 6.468267347s ago: executing program 0 (id=1796): syz_usb_connect$cdc_ecm(0x2, 0x62, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000020000102505a1a440000800010109025000010106500009040000ff02020000052406000005240002000d240f010000000000000000000c240703000003000300050009058103200000000a0905820220000000000905030208"], 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0x400, 0x0, 0xe, 0x515f315b, 0x17, "78e114100985a39874342a70e113343972d03e"}) write$UHID_INPUT(r1, &(0x7f0000001040)={0xd, {"a2e3ad21ed6b0af99cfbf4c007f70eb4d04fe7ff7fc6e5539b0872fc8b546a1b4d09940f08900c878f0e1ac6e7049b4cb4956c409b3c2a0867f3988f7ef319520100ffe8d178708c523c921b1b0f5a0a169b50d336cd3b78130daa61d8f809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1010}}, 0x1b7) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000040)={0x44, 0x0, 0x9218}) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029f0003010070000904000000010100000a24010000000201020d2406000003080000000000000c24020201010608000010000c2402000000030000000000092406200601000000092403000000000500092406050001"], 0x0) 5.596639662s ago: executing program 4 (id=1801): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x800020, 0x0, 0xffffffffffffffc0, 0x9, 0x8, 0x0, 0x3}, 0x0) pipe2$watch_queue(0x0, 0x80) r2 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r2, 0x2285, 0x0) writev(r2, &(0x7f0000000400)=[{&(0x7f0000000340)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000780)="aa1d484e243103000000f7c08bfcd111fbdf23ea32db0e8f21d5bc27bd8063067a0689fff2a41cfbf0e9d85e447511703d", 0x31}], 0x2) 4.863038311s ago: executing program 3 (id=1803): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18020000ff03000020000000ff0f000061200000000000009500"], &(0x7f00000005c0)='GPL\x00', 0x8, 0xd1, &(0x7f0000000600)=""/209, 0x41000, 0x60, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x30, @void, @value}, 0x94) 4.44315429s ago: executing program 0 (id=1804): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000480)={0x53, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b02, 0x0) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="120141014813442007040075ee699cc8db2d2d3ba7ab010203010902240001000010000904b8070296d1ca000905060200020d0006090582020002000110"], 0x0) syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000e40)={0x34, &(0x7f0000000c00)={0x40, 0x15, 0x5, "55246924a6"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000100)={'macvtap0\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4c, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0x7, 0x0, 0xff, 0x0, 0x79, 0x1, 0x1]}}) read$char_usb(r1, 0x0, 0x0) r5 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x3, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x401, 0x7, 0x7}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x40, 0x2c, 0xd2b, 0x803, 0x25dfdbfb, {0x0, 0x0, 0x0, r10, {0x6}, {}, {0x7, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x4, 0xc}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2404c044}, 0x24044094) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0x4, 0xf}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x4, 0xfff2}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) fcntl$getown(r9, 0x9) syz_usb_disconnect(r0) 4.126490387s ago: executing program 1 (id=1805): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000040)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4, 0x8, @empty}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 4.035884604s ago: executing program 3 (id=1806): r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x8102, 0x0) read$FUSE(r0, &(0x7f0000002600)={0x2020}, 0x2020) writev(r0, &(0x7f0000000d00)=[{&(0x7f0000000cc0)='T01\n', 0x4}], 0x1) writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="62e52fe7ffd936d58cf326", 0xb}], 0x1) (fail_nth: 1) 3.910878461s ago: executing program 1 (id=1807): r0 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040), 0x30cc1, 0x0) read$FUSE(r0, &(0x7f0000002600)={0x2020}, 0x2020) syz_emit_ethernet(0xbe, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000b000000000001190780000030000000000000017c1009c90780100000001000000717c72635f3b384bdfc23b7cdbd1617d39980ae0343d91a3756391fe0a9a66d40544e1ea6f9127227abd605d0838dbc96ba13dd069ce9c0099890915a06c22e110516ac8db72cf46be8a2cd2288112c641ae96fd6321aabb617c72097b8d57a7c7bce1276d915e2d6d05e53c86a47b318a3ac04c5dd388537719eecd7b1f5591c287cd8bdc5cb100705e00320d6f5d1d141daaf563135c5ca5041ea888952ab2bc51bfb044"], 0x0) r1 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000000000040f30455070000000000010902240001000040b109040000010301010009210101000122050009058103ff"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x9}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x58}}, 0x20000000) syz_emit_ethernet(0x56, &(0x7f0000000100)={@empty, @multicast, @void, {@canfd={0xd, {{0x3, 0x1, 0x1}, 0x36, 0x1, 0x0, 0x0, "81ee5ed1124325b57cc3aebc754451c4afe000309bcc01bca79fb41d1e21dac5bc9e36e85a6ebfe344574793c7071435ee432b10dea073a7f878ecab07336299"}}}}, 0x0) writev(r0, &(0x7f0000000d00)=[{&(0x7f0000000cc0)='T01\n', 0x4}], 0x1) writev(r0, &(0x7f0000000380)=[{&(0x7f0000000000)="62e52fe7ffd936d58cf326", 0xb}], 0x1) 3.291531002s ago: executing program 2 (id=1809): openat$binder_debug(0xffffff9c, &(0x7f00000021c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') fsopen(&(0x7f0000000100)='udf\x00', 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe80"], 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.291002005s ago: executing program 3 (id=1810): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x172f, 0x34, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x4, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x2, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000080)={0x18, &(0x7f0000000000)={0x0, 0xa, 0x7, {0x7, 0x0, "ffffffffea"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x50}, {0x6}]}, 0x10) r3 = socket$inet6(0xa, 0x3, 0xff) setsockopt$inet6_IPV6_RTHDR(r3, 0x29, 0x39, &(0x7f0000002e40)=ANY=[@ANYBLOB="00020201"], 0x18) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) r4 = dup(r3) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x35c, 0xffffffff, 0x1cc, 0x0, 0x1cc, 0xfeffffff, 0xffffffff, 0x294, 0x294, 0x294, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa4, 0xcc}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x5, 0x3b}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @ipv4={'\x00', '\xff\xff', @multicast2}, [0x0, 0xffffff00, 0x1000001ff], [0x0, 0xff000000], 'sit0\x00', 'veth0_to_batadv\x00', {}, {}, 0x3b, 0x0, 0x4, 0x2}, 0x0, 0xdc, 0x100, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x0, 0x51b2, 0x200000}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @REJECT={0x24}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24, '\x00', 0x0, 0xfffffffb}}}}, 0x3b8) write$FUSE_INIT(r4, &(0x7f0000000180)={0x50, 0x0, 0x0, {0x7, 0x29, 0x3ff, 0x40100, 0x0, 0x9, 0x8, 0x80, 0x0, 0x0, 0x4, 0x2}}, 0x50) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x400, 0x0, 0x25, 0x148, 0x264, 0x60, 0x36c, 0x2a8, 0x2a8, 0x36c, 0x2a8, 0x3, 0x0, {[{{@ip={@empty, @multicast1, 0xff000000, 0xff, 'batadv0\x00', 'pimreg\x00', {}, {0xff}, 0xff, 0xe7ece83c2ebb921c, 0x4a}, 0x0, 0x21c, 0x264, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'geneve0\x00', {0x0, 0x0, 0x0, 0x0, 0x0, 0x10f42ba1, 0x7, 0x80}, {0x8000}}}, @common=@inet=@policy={{0x154}, {[{@ipv6=@dev={0xfe, 0x80, '\x00', 0x19}, [0x0, 0x0, 0xff000000, 0xff], @ipv4=@multicast1, [0xffffffff, 0x0, 0x0, 0xff000000], 0x4d2, 0x0, 0x16, 0x0, 0x19, 0x1b}, {@ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, [0xff000000, 0xffffff00, 0x0, 0xff000000], @ipv4=@local, [0xff, 0xff000000, 0xff, 0xff000000], 0x4d5, 0x34ff, 0xbb, 0x1, 0x10, 0x1}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0x1fffffe00, 0xffffffff, 0xffffff00, 0xff], @ipv4=@broadcast, [0x7f8000ff, 0xffffffff, 0xff], 0x4d3, 0x3503, 0x79, 0x1, 0x4, 0x9}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xff000000, 0xffffff00, 0xff, 0xff], @ipv4=@private=0xa010102, [0xff0000ff, 0xff, 0xffffff00, 0xffffffff], 0x4d2, 0x3500, 0x2, 0x0, 0xd, 0x5}], 0x1, 0x1}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz0\x00'}}}, {{@uncond, 0x0, 0xe8, 0x108, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x6]}}}, @common=@unspec=@statistic={{0x38}, {0x0, 0x0, 0x0, 0x0, 0x0, {0x8000000}}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0xc8, 0x70, 0x94}, {0x24}}}}, 0x45c) 3.282452902s ago: executing program 4 (id=1811): r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r0, 0xc0cc5640, 0x0) 3.201240221s ago: executing program 4 (id=1812): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0cc5605, &(0x7f0000000200)={0x1, @pix_mp={0x0, 0x0, 0x59555956, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {0x0, 0xc0}]}}) 3.079189063s ago: executing program 4 (id=1813): openat$binder_debug(0xffffff9c, &(0x7f00000021c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') fsopen(&(0x7f0000000100)='udf\x00', 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe80"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="010000000000000000000900000030000380"], 0x44}}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 2.349983304s ago: executing program 2 (id=1814): r0 = socket(0x10, 0x803, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = syz_open_dev$sndmidi(&(0x7f0000000000), 0x6, 0x208100) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r5, 0x40045731, &(0x7f00000000c0)=0x9) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffff, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x6}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0xcc, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xe, 0x7}, {}, {0x7}}, [@filter_kind_options=@f_u32={{0x8}, {0xa0, 0x2, [@TCA_U32_SEL={0x94, 0x5, {0x7, 0xef, 0x8, 0x8, 0x5, 0x9, 0x7, 0x0, [{0x1000, 0x4, 0x401, 0x6}, {0x8, 0x7, 0x1009, 0x5}, {0xfffffff9, 0x43, 0x7ffd, 0x5}, {0x7fde, 0x40, 0x51, 0x3ff}, {0x5, 0xb, 0x1, 0x42}, {0x6, 0x4, 0x8, 0x8}, {0x8001, 0x0, 0x0, 0x8001}, {0x1, 0x1800000, 0xa525}]}}, @TCA_U32_LINK={0x8}]}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x80}, 0x40) openat$ttyS3(0xffffff9c, &(0x7f0000000180), 0x200400, 0x0) 2.058875391s ago: executing program 2 (id=1815): pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000040)={0x0, 0x8}, 0x2) r1 = openat$ttynull(0xffffff9c, &(0x7f0000000080), 0x608000, 0x0) r2 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x50, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x4a02, &(0x7f00000000c0)={0x0, 0x9430, 0x1, 0x0, 0x35a}, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r2, r4, &(0x7f0000000240)=@IORING_OP_MSG_RING={0x28, 0x20, 0x0, 0xffffffffffffffff, 0x1, &(0x7f00000001c0)="12384087c5e9493150fca8020345c63d0a4763eefd1c2f84ba7ca613c328e73825bf51f83edeb2ca90019bfe25883af73b404949008592ed6b82a1155f966789512608c773f865d216d6aff1ca82102e84991426678702deb2dbefd09acb799ea2", 0x61, 0x1, 0x0, {0x0, r5}}) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r0, 0xc0189374, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r0, {0x6}}, './file0\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r6) r7 = socket$l2tp(0x2, 0x2, 0x73) connect$qrtr(r6, &(0x7f0000000300)={0x2a, 0xffffffff, 0xfffffffe}, 0xc) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000340)={@empty, 0xf7f, 0x1, 0xff, 0x5, 0x5, 0x9}, 0x20) ioctl$TIOCGETD(r0, 0x5424, &(0x7f0000000380)) setsockopt$inet_udp_encap(r6, 0x11, 0x64, &(0x7f00000003c0)=0x2, 0x4) fcntl$setlease(r7, 0x400, 0x1) syz_emit_ethernet(0x116, &(0x7f0000000400)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x6daca90f339e3146}, @multicast, @val={@val={0x88a8, 0x4, 0x1, 0x3}, {0x8100, 0x4, 0x1, 0x2}}, {@llc={0x4, {@snap={0x156, 0x1, '0-', "71c53d", 0x6007, "f84a128eab4e8e0cca0bdc44b8858641b67f9225a08b5d05d98383cf9431a7c14870716db69815035acd5e7f8f44fae9b6dc358db7077caa6a440c2f7c1c67286cb273b0ad5372920c15047878878b333098fd707c4758eed7578c852f0dce16460df246c263136addd27a3a516671b076a4d18d27749e4b7471ea8a34f2443c9efaf7e3eee5264330d2307de67f7701c482fd28d91bf76b8fa686be7dd91e82bda1917395f8f304dd58bae7e5fb7db5c048ff50cb6475291dd467c95bfaf47e459da35d206738ab76c9bb8a788ee5db6c4cc0b7ab6a49b0c38cbdb5165865e45418861b5fe413d41846e3f3bc585f07d3d19b51bb6c52"}}}}}, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r8, 0x5411, &(0x7f0000000540)) r9 = openat$adsp1(0xffffff9c, &(0x7f0000000580), 0x402af7b6717f8640, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000880)={r6, 0xe0, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, &(0x7f0000000600)=[0x0, 0x0], &(0x7f0000000640)=[0x0], 0x0, 0xcd, &(0x7f0000000680)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000006c0), &(0x7f0000000700), 0x8, 0x8c, 0x8, 0x8, &(0x7f0000000740)}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r6, 0x89f2, &(0x7f0000000940)={'syztnl2\x00', &(0x7f00000008c0)={'erspan0\x00', r10, 0xf, 0x80, 0x5, 0x0, {{0xa, 0x4, 0x0, 0x5, 0x28, 0x68, 0x0, 0x2c, 0x4, 0x0, @empty, @dev={0xac, 0x14, 0x14, 0xe}, {[@timestamp_addr={0x44, 0xc, 0xd5, 0x1, 0x9, [{@private=0xa010101, 0x9}]}, @rr={0x7, 0x7, 0xc9, [@initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$AUTOFS_IOC_READY(r11, 0x9360, 0xa4f3) setsockopt$inet6_IPV6_RTHDR(r8, 0x29, 0x39, &(0x7f0000000980)={0x73, 0x8, 0x0, 0x6, 0x0, [@private0, @dev={0xfe, 0x80, '\x00', 0x1b}, @empty, @rand_addr=' \x01\x00']}, 0x48) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000a00)={0x7, 0xb9, 0xc01}) syz_io_uring_submit(r3, r4, &(0x7f0000000a80)=@IORING_OP_OPENAT={0x12, 0x18, 0x0, r6, 0x0, &(0x7f0000000a40)='./file0\x00', 0x40, 0x20641, 0x12345, {0x0, r5}}) ioctl$VIDIOC_S_FREQUENCY(r0, 0x402c5639, &(0x7f0000000ac0)={0x8, 0x4, 0x7}) fcntl$F_GET_RW_HINT(r9, 0x40b, &(0x7f0000000b00)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000b80)={0x4, &(0x7f0000000b40)=[{0x2bf4, 0xe9, 0x10}, {0x8, 0x9, 0x3}, {0x41f1, 0xda, 0xd6, 0x80}, {0x8, 0x3, 0x5, 0x10001}]}) ioctl$BTRFS_IOC_SYNC(0xffffffffffffffff, 0x9408, 0x0) 1.920309274s ago: executing program 1 (id=1816): sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000cc0)=ANY=[], 0x34}}, 0x44000) socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$FS_IOC_GETFSSYSFSPATH(r0, 0x80811501, &(0x7f0000000bc0)={0x80}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0205649, &(0x7f00000000c0)={0x980000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x9a0902, 0x0, '\x00', @p_u32=&(0x7f0000000200)=0xd0}}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x7, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f00000001c0)=0x100, 0x4) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_TX_RING(r2, 0x11b, 0x3, &(0x7f0000000440)=0x400, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000200)={'batadv_slave_1\x00'}) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r2, &(0x7f0000000240)={0x2c, 0x1, r3, 0x4000000, r4}, 0x10) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000df000000bfa300000000000007030000f0ffffff720af0fff8ffffff71a4f0ff000000005d040200000000001d400500000000004704000001ed00006203000000ffffff9c440284000000007a0a00fe00ffffffc3030000f1000000b5200000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a1074649c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c0dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6acdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fed000000007baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca485683252b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a0032f37ff559be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee07751532d5e7d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e2fa3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef907000000f01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e015cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb581012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a0000000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x39, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x8, &(0x7f0000000180), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1, @void, @value}, 0x94) 1.900361586s ago: executing program 2 (id=1817): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x1e3003, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000300)={0x2004}) epoll_pwait2(r1, &(0x7f00000002c0)=[{}], 0xfc, 0x0, 0x0, 0x0) 1.824534042s ago: executing program 4 (id=1818): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac9", 0x3}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000000000000000000000000000000000000300", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 1.793814146s ago: executing program 2 (id=1819): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000200)=0x100000001, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r1 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffd000/0x1000)=nil, 0xc00}, 0x1}) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x4, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc0f8565c, &(0x7f00000000c0)={0x4, 0x6, 0x2, {0x1, @pix_mp={0x3, 0x1, 0x50424752, 0x8, 0x5, [{0x800, 0x6}, {0xcc4, 0x100006}, {0x6, 0xff}, {0x20400000, 0xfffffff0}, {0x3, 0x4}, {0x3, 0x7}, {0x39cd, 0x9}, {0x6}], 0x2, 0x6, 0x2, 0x0, 0x3}}, 0xfffffdff}) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x1, 0x0, 0x0, 0x0, &(0x7f0000000380)=""/54}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000340)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="64000000020601020000000000000000000000001c00078008001240000600000800084000000037080013400000000010000300686173683a69702c6d616300050005000a00000005000400000000000900020073797a31000000000500010007000000"], 0x64}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 1.279029351s ago: executing program 0 (id=1820): r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000027c00000400fc800c0001800600060008"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000700)={r2, 0x0, 0xe, 0x0, &(0x7f0000000340)="75ba32df6e7ba598b6c136465be1", 0x0, 0x0, 0x0, 0x69b0d712, 0x0, &(0x7f0000000680)="f0", 0x0}, 0x50) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0185648, &(0x7f0000000080)={0x0, 0x7, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000300)={0x9a0906, 0x5, '\x00', @value64=0x8}}) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, &(0x7f0000000040)={0x7, 0x10, {0xffffffffffffffff}, {0xee00}, 0x8, 0x5}) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x0, 0xc8, 0x8, 0x1c4, 0x5803, 0x288, 0x2e8, 0x2e8, 0x288, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0x194, 0x1c4, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x1c8, 'kmp\x00', "cacaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x2, 0x2}}, @common=@frag={{0x30}, {[0x1, 0xe5f], 0x3, 0x6, 0x3}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x4, 0x1}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', [0xff, 0xffffffff], [0xff000000, 0x0, 0xff, 0xffffff00], 'geneve1\x00', 'veth1\x00', {0xff}, {}, 0x11, 0x3, 0x0, 0x40}, 0x0, 0xa4, 0xc4}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x3ac) r5 = syz_open_procfs(r3, &(0x7f00000000c0)='loginuid\x00') exit(0x1ff) r6 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f00000001c0)={0x7, 0x8, 0x0, "b75c89e7a20c8eac82ad0416bb1844038d2cd97c945462f31638b5394c00", 0x32315258}) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$VIDIOC_ENUMAUDOUT(r5, 0xc0345642, &(0x7f0000000100)={0x200, "59006de0ec27d21b4579041a23080ac8f17d458ef5a6c687e86d6fe76ccf5708", 0x1, 0x1}) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x3c1, 0x3, 0x328, 0x260, 0xc8, 0x8, 0x10c, 0x5803, 0x260, 0x2e8, 0x2e8, 0x260, 0x2e8, 0x3, 0x0, {[{{@ipv6={@local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff], [], 'netdevsim0\x00', 'geneve1\x00', {}, {0xff}, 0x0, 0x0, 0x0, 0x64}, 0x0, 0xa4, 0x10c, 0x0, {0x0, 0x2000000000000}}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0xa, 0x4, 0x5, 0xf, 'syz0\x00', 'syz1\x00', {0x5}}}}, {{@uncond, 0x0, 0xec, 0x154, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x1}}, @common=@hl={{0x24}, {0x0, 0x6}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x9fe8f89697c8679c, 0x1f, 0x0, 0x3, 'pptp\x00', 'syz1\x00', {0xfffff345}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x384) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') 1.274130513s ago: executing program 4 (id=1821): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000004c0)=0x27) r3 = syz_open_dev$media(&(0x7f0000000000), 0xe, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) ioctl$MEDIA_IOC_G_TOPOLOGY(r3, 0xc0487c04, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x66667a4, 0x0, &(0x7f0000000fc0)}) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000080)={r2, 0xfffffffb}, &(0x7f00000000c0)=0x8) syz_open_dev$usbmon(&(0x7f0000000700), 0xeba, 0x101283) mmap$usbmon(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x22053, 0xffffffffffffffff, 0x6) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0xfffffffffffffcf8, 0x0, 0x1, [{0x0, 0x0}]}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000500)={&(0x7f0000000040)=[0x0, 0x0], &(0x7f00000003c0), &(0x7f0000000400)=[0x0], &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0], 0x2, 0x0, 0x1, 0x4}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f0000001740)="c230d571efd0c4f5238ca23adabdaef06dd961fa1c868098e48c429fcfb855cb7f6ef7279b47a5ecb1ba1bba81d1411d0ff44a2244c066c512b0e0fb0861d936c5029757eb41cca15558212a8c6f2f37a3e7d213b33942bf5b14ceb66d7f4ea89d4ddbe56fb220f48d0596a40ab20e0429589bdcc49001736145acdb4ea1167e0519ff1cc95bcb772a119d349de1678ce85ed33c57ad859e0be0ee8c815090fe210b66446075d70f4fb15c4b449de7880d86c54d7b80881aec6239edeef8bcbdaceb3c741b8aa7c05427b2413bc035fca96ccc4fefe540c26fb515b8f551a57ecbb63a98ebec65689acf2eb741c0a91db479fb2f86e4461850a045e73743a7e28572ac7070e3f51f1722362254157d8ad1d163d29aaa336ec12be025661cbad978703e04bc4d49dbe9178ccdf2e0c84a0a97f71b1aee4bac50e1c14612a7d9e431ff27a10edf2f8c190b45f4ea0410e0ce57af8b4a99468b582bc538f6d1d89bd65503f32a74ec633be6009ebe38bbb42fa26f9761ae1caa5772d98536068148bbbfe547be9fe01bcbda5a9514aecc211201dcf3a25149f42b1f9f447efec47bcd57c1df979fe3ea2d068d95b4180674344a4162230195b7e92f807a693a1ea505cab388aaa4ea1a83ab03b1ee4f744e39b86814bd1def14f58c8df2dcf6ce7a079d79a9720c77aa3bb1bd62fbb35c7e7426f7376d25929028f26ff988c41fba725b91b7140fc946952b90d87a0332c7543cf4d2ca3e0c628737927125b9ca58ed6a80fd151f27aec8bac8a9ba87b15421fe60a399d3d673de28a57d7e0df916cb25fd36922ea82429033f660a0d35a585fcd2fe3a85f8885e5009d49d1e92d311a4c89e5c0f8f6a18fb669ff6a4c24575374f207aab0cd0f07e85d05614043b2326ca0bdf079acd65732c5b567823913d06e22a082565f2cbacd663f6ede49223a959c7356ff39e4c4c492bb3ae3568629f6a7418da5e3efffcbdfb1403c0a4c1102fb11444f522bd7fd48b2d783f47fea1a77818ab174b602f87515204ce796838d431708894192592c02ad34483b6d8dad9d057f8ab838a293d3eb28cb17e8ada6a58ac4535e141853db3966f4c2d4137a90c389c2ab6a8cf187fd137c0dfb291b0105d72ff618a3978cd315bb674c5bab96fe255e29764de72befa5f067d0b5b964b90fe3b70430de0e63d282aad90c754831bd947f8c56eea76a9b2f0ba17316d43e230a40faa95725ee91aa864a474766349907d5095f820cdbbb07e3ab6b33b0c6dc386f6e77c4c78b01e5e0fd21a41e5f92bb3ebae27ba3f032f5c559165a7f00938b27efe10a0c06706ceb3ead235a3617cfb4cca118440fd8b4a0bbd669394e8043e9a25009a7c34d0b7ef4731a7905f30ef4d9597050b91afc1fb07e3e86617f8c6e326bbc49bff1f26e07a442c7783b97cbf38c4d63e2898c0510d99ba716f3be2d88918bef256b900e5c8cc3c8e5941fd1e10c200a7eeb41551f7f4bf53b122b6ad61ab8006cf4586f9971ba56d2d4c86f4ed172b55c4ffd5bd113e642c7c5a001d4922406e7157de7aa303930471228f6462b20669ab5ce39d09217f6892e41fdc245647657adc7a45f60b043881ef932b473d069817b37295ce24728b83713f460a5da1da546d059f391657d4e04337641f8df9cb85aa342a34cf51d413a250dceeee8dc54c38d5e1526363e27602c010ce07e53ddffadadf57b37192b2f0e6134731b17ae5c0d1bf420d860e40f5d52e19aad0f090390cdb16113d8797fafe54c1c1f35b83b540ff01ea0df18b7ceb9290fc1eba89e4b2498ad40c62e77758c80c82f08aed5e0023f1780ed24bce7ae1d44714d3f5175dc2f5f77d51d24f64ba9de54d2e202dfc13f29f6cd8fec96e17dce8fdd30b9dbeee326c4d15f5c166ac87ad42ff9948b5ad98eb0fbb2427dd8b478760f3fa22d569540e5b404aa603d0ea9f669dd8f78924d4b32eb705bc9ac8ab3cd5189c3abb2dd6a71b62aa81501d65bf0a37f3cd273850879454e16608a3247d1c9c3a5beb10fbcf62e7d31cb47b72007437f3b058c4f189526cad5a9b154bd96537783cf3ec13bfa646131a126ba64066ce58875e7e54cd16ba2230407c0b67fe6d2b64fb88727e1af4d1c6ecbcab6522810eef48def558f637b24be5ac7c7c01f68bdf0ad165a9db17293dfae9a330bd85c157979c1bc0776ddee2c323d990c3ed163769be89840df7d789689fe16ec348a4ad07a4f49d88dc81c29df951a2f0dfdde22804f7db0584d1c5ac94d2a184fcf2317e39325fe4d1cf72819e705eec6b975999c347525c7ff6060067a30579b7acfb089e35919db58147c41493eb465452ee4981199407dfdabc69fc742c43a55d223453487b1449af31763d359114cf37c98a3976b4b410aee18452c665eb8df319d68e138ed4d30a6280162d78691f93d64d62e670f2e451cc37bf6c923edf13f281eaf718f72835a64659a8add97d82ca1d2ca2c659992b61764bdaad4253da3103349fca53fa38092b0b49a430a82b431a7dad472c0ada0328d49b09414d2e60c05d35c98c5119ea4ec9f1896e9c809b36ef4f8c522a5dc5f50a558b0ba9aee8f6accb0f924dedacb78249b25f5481b0881db6312520d680175ebb44fe73941de22aee05cd9000bc583d91f05c0ee1a47b080d3ec1cc48283b8d2160e8d9c9987c8a3c5624a74d71e8d4aeb7d86fcf09bdfe96b2e37005e60162f9e11966824e013c20856d05a848d346e471ff4f431c1167c096910a0b15ddfdeb7791ae17ed772224856fd8388c6dcbd92758e6afc9822b9d6fce1e7a0e336bb5931642161dfb22151427f7a1ec94e3fc42abdb19ce1f5891137aa2aa85c4ab18b3e5cd4baa036db4371a3aff34059bc9f64a7caec642ff0401b22616ec849d0bbedb245884080b0700b3d965751873ad0041b98a224cd41cdc0f9f6b2b55f40a5758c623de198abd6547745a9e41017253f8370da970692ae6046413d96862e76c336e44ca8e7e75ad68d86cbb2c93dabc3a8a529fef47d4ca1cf7cefba6fc6e4e761d65794096c885aba0ae0b4c151ee54efe113256060f494efc31b610ca4372007d1cd6aeb29c1e8e6532a2e05205eac0f649ab53f91826093ecb55dda6e8696ef181c15643c6a467617d8cb44e5bd8e32807b0b0bf74810466df38f310d052de04e1b867b7bc3a2450653f22c756fce86830609f14b71cf302b40be8080f40e708fe4e2168d4a65c2ad320c3f93d2d821c96d5e479226847c91c8386cb00b5833e958554568dd8d5bc899702b21675dd6ffba6e6ef7bf9e505a69c358506ecdf54ab0c0d44ec14054446b185fda2e3d5da91410abc5016ff72d6d1ea1cafb5a7d36811dd0f337de03c6e3ee4b20718155fb25e473cc5a1b742db948fc79d1c0a69ea13fd2510601b36e21cc59785dceaf6b99c6890231bb00965a416a1a02a8efce607df2116a2963ca8e9385a7ca2c7822da5f364e3c13f65e549009b97035d55142bd641fee5b70afb24926e9744774f96fcca64828871af8ab81ad6af44b2acc0843bec16992952d7c80ca2c8a9c2ae0e9fb6fe699faa2a3766a11ca86f636ab7329cbf9a24229c4a8752cd7a0f8f2a250fb5e2fe65b1683fb11eae71cedb9a090ef809ff91417f55894f5ff2589b330818b0f2c55cf750cabd03b7462cb7f48df6c9fb04a3f186f13a8032c7b1c7f923cb649f5866b6afc90a5d9eb187b0208594afbff36b50ffa6db6cb312fa315699aa10e211e5a4f728f3dcf070e33c6ee3bb6a4e3c797b1cb8f4083dc8ded5948c37e71901200086623711cfefdda30ed5d32725f56a900aa8a6a688f598619ca6577009081a07aa15114c20c7af100b4cbc2368114c99ac2012dcdb58d18db0f50472aa0b1bdd8506a12000bd0d62ddc8d79293e92e281fbad6cd39bbfd43c3df168b4a3664955a08e8925014c927de84bc51531cf804dccc17b9a7076866ac150a2cb4e6a463eef1272e3b36e80010ec7b527c8665c72ef5f4ff7a8754f6e34bbacd6c8a04f821b8499a1fb2d15d7deb70cf6c2ceaad5c8fed8459b42e95e8542c0a8018f7a5a592da438f72aebac54745333845b59189d08d049acb34a347f5690ed1283b356c822da76c699638c7dbee019ebae6a22e8f2aa6f2654e533814c9aae648217e21b9ee790f29a73381a1997cd42d07644638e735b4b3c4b83550e090783bf4dd66dc92c3563d9c6bcaae8466a487e85675e9fac45438dc0ec26a94f9e80ac98f7441b0d979f8623b78c4f229830b2752bfa2cb39a6dda8041c793167b6ae9a378dc3d0776d634afa29cabe38a1eccda03e4341420ff2dc4b5484772135145c5dea26cdb350aa64be7bd7eb4b2a9a9dae5e128396c580ae38970db6e0d504f71451e610caaebe3901b76786a7e305b356cfe9c5eb63c9757f6b1ca26e390cd714e4c3310a2cc917984c1bf0eca5a43a94f02de4a7bd9e02d9e0d5fc27319ef61dd03bef3c7669a6cead55ed730d6369bb8af6d18d99c504c940df8be0c6fbb1366deb92e2ec1f1d42e02eddc5ae8939a8705c392040c1f0a0574d0638d43be3b62e519685e73b63e43ec9009f83e38cf384424845d5506ff20575bf6677892be07e69c5eb3538754af27dd4e3366185e6476949eda258cef7c7b0ac0c2ba30badb4f7b49b288380b7daefa0575d213fa5df346a596c06c5e7a0803bc840bbf377b64f906109bf03e89811a7e03381ae097efc03a90b223815b37f4a9657467823b500338354d3e28b016fa04aca032c17cf27b44986ac01fde0cef3d1dd489b0d5fb87c15002cf05403286ef68b3111b4e0fb7cd8119530c4ae5647a5d249072885185b1fdea69f13c65c2779ae97662512c53a69c3cb5f891a68235afd115b8a73d490f13f6b2382b5b0aff80db1a80ec65a70ec961ab406960c395edda62fdf3a4a9fc993ef7cb6e89c813f7e8acc6d87bb5630511bdfaadaa8d8d2c8be18f976b1e9b5ae6b8837cef3765e205e2b5a70a90fb850838bad5fbb28ba2b58e0a6a036e25916498b5099612d803a320752e69c2d694eed3cb507ba7f189352fea58171f7c0970972909524e7df4f29126960b014e49ae6cdc6522d0a8febfc11234a2ed67da16e5db1daa6a9cda17e9838c6803ad961fcd7ff0532d656f8643abadb9f9f21add0a72bc89f0694bdaae9d951a0fa8b08dc7845d87b49a30ae78efbdaaeaecc837654ab9c9aa2724070f7663b08ae209f8cde37207c3cfd7da6abb70b238fe928fdcc17f1a00f0760b0682b7438bff3bbb5eb8e9e581ee805e4c58dd1f7649db6aeb3002187f8de02183a200d1ff15d6896c85c8be5c4b2dd75a79da876f7cc99f7e98d00c81be535327aa3ef483e837bb335c81759d43d59d2959846038bfcd76ec56cdc3c81d64465005003d957221a07eae29d9f9a02bb1de936a47c2214a4b2d17a7f075903fc1f4682e8cab7cd1007fc7705548a5f697b0a90d3259b491c1030c044271041f170e3598c941c78d56f66256286b2d470ad2c4c307b1b625ce1b3b1efa68a337837091aef45f90c2873b748ac03674750b1229f29e202044a0cc410577f5c7c25b9f00cf7de57baefbc8b082ae630f9b8b894ac676e8c03f38218dfa6c1c70600aabe7adfc06c16962afaade5e571ed4ffbbec7e3f04ec020ac09efb60d4ea9191698a6884dd07632e6736257692dcb270a40bf38683fcf0408aa8eb8b35e7349449bba62e3dfbb98f98103f5242218f791bded77803a7eef9e35ea79c651e1ee02e05bf3b6ef22178b745c78169b5e7d", 0x1000}, {&(0x7f0000000100)="9aa3a3eb1196bed27f1ede188c878b70f1fbad7330845cac2257d922c21418bc34d27f6638983fca6a7cb3abbd95d57a3ae3ddeccda8bd8f7c6ce1", 0x3b}, {&(0x7f0000000140)="17838f6eed33c161bfff868f07ec07780013e95ee46a4f9997bb6c6fbf1d8576dd8a8ce70591169a034d6c93e3b771621b824f3ec69dea18d2173d620f477936dc3b3bcd5bf8294c6d66aed4b3d27850f15a2da147edffcb821d127d17bf6a3a65991a7fe21ae63d56c24cec792f9838d51068de7b569d98f1e16a00b05991a8127254371a53ec86920ffcf9dc6d3b1f717cc8e789df5ce23fcb0bf4b0db1af5fba6ddf2cd08b8641173a4052b82c95fbc31263774f633da2cd44398af56c5b48fb2525853a6d1ca8c96e371f49d76b894", 0xd1}, {&(0x7f0000000300)="000b82daf349b743d1bb8e332534e6e9c8476b19115d743d3d0f543cb808057255fa196d6156233fba0c7e522e1c7dc5dfb55a92149accfd4326a299211a5de691083aac435c9e2092c30af0aea58f0c73891c211316c3c672bb3ccbf9c55443b41699121209a2f7f24c327bf3eea8eb87e3ad1bd8173e4ea301b85d8f68cf584531678f72d0ed61a8247f", 0x8b}], 0x4) 1.050064817s ago: executing program 2 (id=1822): openat$binder_debug(0xffffff9c, &(0x7f00000021c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') getsockopt$IP_SET_OP_GET_BYINDEX(0xffffffffffffffff, 0x1, 0x53, 0x0, 0x0) fsopen(&(0x7f0000000100)='udf\x00', 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe80"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="010000000000000000000900000030000380"], 0x44}}, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa}, 0x20) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 887.468199ms ago: executing program 3 (id=1823): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r3 = fanotify_init(0x200, 0x0) fanotify_mark(r3, 0x209, 0x40000032, r2, 0x0) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f00000001c0)=0x2) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) close(r1) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$BTRFS_IOC_INO_PATHS(r1, 0xc0389423, &(0x7f0000000240)={0x5, 0x28, [0x1, 0x1, 0x4, 0xfffffffffffffffb], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/address_bits', 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000080)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x4000000, @ipv4={'\x00', '\xff\xff', @remote}, 0x401}, 0x1c) ioctl$int_in(r6, 0x5452, &(0x7f0000000c00)=0xf6c) sendmmsg$inet6(r6, 0x0, 0x0, 0x20008001) sendmmsg$inet6(r5, &(0x7f0000001800)=[{{&(0x7f0000000000)={0xa, 0x4e21, 0x1, @local, 0x1}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000000040)="a4e819c9", 0x4}], 0x1}}], 0x1, 0x0) shutdown(r5, 0x1) setsockopt(r5, 0x84, 0x83, 0x0, 0x0) getdents(r4, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x4780, 0x4) write(0xffffffffffffffff, &(0x7f0000000640)="68a0b32fafd3b845da570480e0465913a86dde57923b10e6", 0x18) 450.748289ms ago: executing program 1 (id=1824): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newsa={0x158, 0x10, 0x1, 0x0, 0x0, {{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x1900}, {@in, 0x0, 0x32}, @in6=@loopback, {}, {}, {0x0, 0xfffffffd}, 0x70bd25, 0x0, 0xa, 0x0, 0x0, 0xaf}, [@replay_esn_val={0x1c}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}, 0x0, 0x8}}]}, 0x158}}, 0x0) 334.296512ms ago: executing program 0 (id=1825): syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r0, 0xffffffffffffffff, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="500000001000010027bd7004fbdbdfa500000000", @ANYRES32=r2, @ANYBLOB="104e0600016a010030001280cb480100627269646765001800"/39], 0x50}, 0x1, 0x0, 0x0, 0x400c080}, 0x2) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') read$FUSE(r4, &(0x7f0000000400)={0x2020}, 0x2020) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x2, &(0x7f0000000100)=@raw=[@map_idx={0x18, 0x0, 0x5, 0x0, 0x3}], &(0x7f0000000240)='GPL\x00', 0x0, 0x1000, &(0x7f00000006c0)=""/4096, 0x0, 0xa, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f00000003c0)={0x8, 0x5}, 0x8, 0x10, &(0x7f0000000440)={0x4, 0xd, 0x2, 0x7}, 0x10, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000480)=[{0x1, 0x4, 0x4, 0x1}, {0x2, 0x4, 0x4, 0x1}], 0x10, 0x5, @void, @value}, 0x94) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) futex(&(0x7f0000002480), 0xc, 0x2, &(0x7f00000024c0)={0x77359400}, &(0x7f0000002500)=0x1, 0x2) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000002440)={0x18, r6, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000040) (async, rerun: 64) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000140)=@ethtool_ringparam={0x1}}) (async) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000040)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="0205fc090400000027bd70000700000002000100000004d400810000000000a0e639218ae9546f828ddfd342363f74407f367787a9001c0f8fc944aa7a225b09482d080519882d157ffd7f0659add4"], 0x20}, 0x1, 0x400000000000000}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMKSA(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="e1522abd08000300"/18, @ANYRES32=r10, @ANYBLOB="14005500fc07c5fbeb098bb1ca1b432fa307a8470a00340002020202020200000a000600ffffffffffff0000"], 0x48}}, 0x0) 208.822689ms ago: executing program 1 (id=1826): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) sendto(r0, &(0x7f0000000540), 0x0, 0x8004, 0x0, 0x0) sendto$inet(r0, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x6e, 0x0, 0x0) 82.515304ms ago: executing program 0 (id=1827): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r2 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n [ 410.326347][T10528] dump_stack_lvl+0x189/0x250 [ 410.326385][T10528] ? __pfx____ratelimit+0x10/0x10 [ 410.326419][T10528] ? __pfx_dump_stack_lvl+0x10/0x10 [ 410.326452][T10528] ? __pfx__printk+0x10/0x10 [ 410.326479][T10528] ? __pfx___might_resched+0x10/0x10 [ 410.326516][T10528] ? fs_reclaim_acquire+0x7d/0x100 [ 410.326546][T10528] should_fail_ex+0x414/0x560 [ 410.326579][T10528] should_failslab+0xa8/0x100 [ 410.326604][T10528] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 410.326626][T10528] ? __alloc_skb+0x112/0x2d0 [ 410.326655][T10528] __alloc_skb+0x112/0x2d0 [ 410.326684][T10528] alloc_skb_with_frags+0xca/0x890 [ 410.326726][T10528] sock_alloc_send_pskb+0x857/0x990 [ 410.326778][T10528] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 410.326821][T10528] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 410.326856][T10528] unix_dgram_sendmsg+0x4f6/0x1870 [ 410.326904][T10528] ? aa_sk_perm+0x81e/0x950 [ 410.326936][T10528] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 410.326968][T10528] ? __asan_memset+0x22/0x50 [ 410.326998][T10528] ? __import_iovec+0x5d4/0x7f0 [ 410.327017][T10528] ? aa_sock_msg_perm+0x94/0x160 [ 410.327046][T10528] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 410.327075][T10528] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 410.327108][T10528] __sock_sendmsg+0x21c/0x270 [ 410.327145][T10528] ____sys_sendmsg+0x52d/0x830 [ 410.327189][T10528] ? __pfx_____sys_sendmsg+0x10/0x10 [ 410.327235][T10528] ___sys_sendmsg+0x21f/0x2a0 [ 410.327265][T10528] ? __pfx____sys_sendmsg+0x10/0x10 [ 410.327331][T10528] ? __fget_files+0x2a/0x420 [ 410.327354][T10528] ? __fget_files+0x3a0/0x420 [ 410.327402][T10528] __sys_sendmmsg+0x28e/0x430 [ 410.327433][T10528] ? __pfx___sys_sendmmsg+0x10/0x10 [ 410.327468][T10528] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 410.327520][T10528] ? ksys_write+0x22a/0x250 [ 410.327551][T10528] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 410.327583][T10528] __do_fast_syscall_32+0xb6/0x2b0 [ 410.327605][T10528] ? lockdep_hardirqs_on+0x9c/0x150 [ 410.327640][T10528] do_fast_syscall_32+0x34/0x80 [ 410.327661][T10528] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 410.327686][T10528] RIP: 0023:0xf707e539 [ 410.327704][T10528] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 410.327723][T10528] RSP: 002b:00000000f506e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 410.327744][T10528] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001600 [ 410.327759][T10528] RDX: 0000000000000001 RSI: 0000000000040840 RDI: 0000000000000000 [ 410.327771][T10528] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 410.327783][T10528] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 410.327815][T10528] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 410.327846][T10528] [ 410.649713][T10529] sch_tbf: burst 59 is lower than device ip6tnl0 mtu (1452) ! [ 410.882114][T10531] binder: 10530:10531 ioctl c0306201 0 returned -14 [ 410.890495][T10531] binder: 10530:10531 ioctl 5601 0 returned -22 [ 411.157797][ T3406] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 411.319997][ T3406] usb 1-1: Using ep0 maxpacket: 16 [ 411.353073][ T3406] usb 1-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 411.377234][ T5923] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 411.614441][ T3406] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.627695][ T3406] usb 1-1: config 0 descriptor?? [ 411.640861][ T3406] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 411.757304][ T5923] usb 2-1: Using ep0 maxpacket: 16 [ 411.772768][ T5923] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 411.795403][ T5923] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 411.814698][ T5923] usb 2-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 411.824873][ T5923] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.845542][T10535] netlink: 'syz.0.1446': attribute type 1 has an invalid length. [ 411.858953][ T5923] usb 2-1: config 0 descriptor?? [ 412.199489][T10555] Invalid logical block size (-1048577) [ 412.303802][ T5923] gt683r_led 0003:1770:FF00.000F: ignoring exceeding usage max [ 412.348078][ T5923] gt683r_led 0003:1770:FF00.000F: hidraw0: USB HID v0.00 Device [HID 1770:ff00] on usb-dummy_hcd.1-1/input0 [ 412.415116][ T44] usb 4-1: USB disconnect, device number 44 [ 412.428186][ T44] usblp0: removed [ 412.501912][T10544] FAULT_INJECTION: forcing a failure. [ 412.501912][T10544] name failslab, interval 1, probability 0, space 0, times 0 [ 412.577825][T10544] CPU: 0 UID: 0 PID: 10544 Comm: syz.1.1450 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 412.577858][T10544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 412.577872][T10544] Call Trace: [ 412.577881][T10544] [ 412.577891][T10544] dump_stack_lvl+0x189/0x250 [ 412.577930][T10544] ? __pfx____ratelimit+0x10/0x10 [ 412.577964][T10544] ? __pfx_dump_stack_lvl+0x10/0x10 [ 412.578003][T10544] ? __pfx__printk+0x10/0x10 [ 412.578034][T10544] ? __pfx___might_resched+0x10/0x10 [ 412.578067][T10544] ? fs_reclaim_acquire+0x7d/0x100 [ 412.578099][T10544] should_fail_ex+0x414/0x560 [ 412.578133][T10544] should_failslab+0xa8/0x100 [ 412.578159][T10544] kmem_cache_alloc_noprof+0x73/0x3c0 [ 412.578202][T10544] ? __kernfs_new_node+0xd7/0x7e0 [ 412.578236][T10544] __kernfs_new_node+0xd7/0x7e0 [ 412.578263][T10544] ? __lock_acquire+0xab9/0xd20 [ 412.578302][T10544] ? __pfx___kernfs_new_node+0x10/0x10 [ 412.578331][T10544] ? kernfs_root+0x1c/0x230 [ 412.578364][T10544] ? kernfs_root+0x1c/0x230 [ 412.578389][T10544] ? kernfs_root+0x1c/0x230 [ 412.578412][T10544] ? kernfs_root+0x1c/0x230 [ 412.578443][T10544] kernfs_new_node+0x102/0x210 [ 412.578477][T10544] __kernfs_create_file+0x4b/0x2e0 [ 412.578515][T10544] sysfs_add_file_mode_ns+0x238/0x300 [ 412.578546][T10544] sysfs_merge_group+0x177/0x310 [ 412.578578][T10544] ? __pfx_sysfs_merge_group+0x10/0x10 [ 412.578614][T10544] ? __pfx_device_add_attrs+0x10/0x10 [ 412.578646][T10544] dpm_sysfs_add+0xd2/0x270 [ 412.578675][T10544] device_add+0x4d8/0xb50 [ 412.578703][T10544] input_register_device+0x9ca/0x10b0 [ 412.578738][T10544] uinput_create_device+0x422/0x670 [ 412.578779][T10544] uinput_ioctl_handler+0x3f0/0x1570 [ 412.578814][T10544] ? __pfx_uinput_ioctl_handler+0x10/0x10 [ 412.578863][T10544] ? __fget_files+0x2a/0x420 [ 412.578898][T10544] __ia32_compat_sys_ioctl+0x543/0x840 [ 412.578938][T10544] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 412.578973][T10544] ? __fget_files+0x3a0/0x420 [ 412.579005][T10544] ? fput+0xa0/0xd0 [ 412.579034][T10544] ? ksys_write+0x22a/0x250 [ 412.579062][T10544] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 412.579099][T10544] ? lockdep_hardirqs_on+0x9c/0x150 [ 412.579135][T10544] __do_fast_syscall_32+0xb6/0x2b0 [ 412.579165][T10544] do_fast_syscall_32+0x34/0x80 [ 412.579193][T10544] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 412.579220][T10544] RIP: 0023:0xf7f33539 [ 412.579239][T10544] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 412.579259][T10544] RSP: 002b:00000000f505655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 412.579282][T10544] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000005501 [ 412.579297][T10544] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 412.579309][T10544] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 412.579322][T10544] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 412.579335][T10544] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 412.579367][T10544] [ 412.894731][ C0] hrtimer: interrupt took 307588298 ns [ 413.014361][ T44] usb 2-1: USB disconnect, device number 35 [ 413.044685][ T3406] gt683r_led 0003:1770:FF00.000F: failed to send set report request: -19 [ 413.075185][T10560] fido_id[10560]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 413.501820][ T44] usb 1-1: USB disconnect, device number 35 [ 413.786264][T10580] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1460'. [ 413.898823][ T5946] usb 4-1: new full-speed USB device number 45 using dummy_hcd [ 414.038044][ T5946] usb 4-1: device descriptor read/64, error -71 [ 414.286653][ T5946] usb 4-1: new full-speed USB device number 46 using dummy_hcd [ 414.438623][ T5946] usb 4-1: device descriptor read/64, error -71 [ 414.504400][T10592] random: crng reseeded on system resumption [ 414.560257][ T5946] usb usb4-port1: attempt power cycle [ 414.626832][T10592] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1466'. [ 414.730795][T10592] vlan4: entered promiscuous mode [ 415.222540][T10592] ip6gretap0: entered promiscuous mode [ 415.228259][ T5946] usb 4-1: new full-speed USB device number 47 using dummy_hcd [ 415.269882][ T5946] usb 4-1: device descriptor read/8, error -71 [ 415.541574][T10602] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1469'. [ 415.554990][ T5946] usb 4-1: new full-speed USB device number 48 using dummy_hcd [ 415.607983][ T5946] usb 4-1: device descriptor read/8, error -71 [ 415.620761][ T5895] usb 3-1: new full-speed USB device number 41 using dummy_hcd [ 415.728491][T10608] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 415.740838][T10608] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 415.746018][ T5946] usb usb4-port1: unable to enumerate USB device [ 415.789153][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 415.807583][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 415.827314][ T5895] usb 3-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 415.846783][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 415.875956][ T5895] usb 3-1: config 0 descriptor?? [ 416.049387][T10619] netlink: 'syz.1.1476': attribute type 11 has an invalid length. [ 416.108046][ T5946] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 416.197235][ T44] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 416.281427][ T5946] usb 1-1: config 0 has an invalid interface number: 130 but max is 0 [ 416.290527][ T5946] usb 1-1: config 0 has no interface number 0 [ 416.296980][ T5946] usb 1-1: config 0 interface 130 altsetting 3 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 416.324665][ T5895] hid-generic 0003:04F3:0754.0010: failed to start in urb: -90 [ 416.337554][ T5946] usb 1-1: config 0 interface 130 altsetting 3 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 416.368638][ T5946] usb 1-1: config 0 interface 130 altsetting 3 endpoint 0xC has invalid wMaxPacketSize 0 [ 416.381111][ T5895] hid-generic 0003:04F3:0754.0010: hidraw0: USB HID v1.01 Device [HID 04f3:0754] on usb-dummy_hcd.2-1/input0 [ 416.392991][ T5946] usb 1-1: config 0 interface 130 has no altsetting 0 [ 416.396063][ T44] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 416.413001][ T5946] usb 1-1: New USB device found, idVendor=07fa, idProduct=0846, bcdDevice=bc.83 [ 416.423595][ T44] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 416.434905][ T44] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 416.444789][ T44] usb 5-1: config 1 has no interface number 0 [ 416.447230][ T5946] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.453725][ T44] usb 5-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 416.476967][ T44] usb 5-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 416.477321][ T5946] usb 1-1: Product: syz [ 416.494865][ T5946] usb 1-1: Manufacturer: syz [ 416.504382][ T5946] usb 1-1: SerialNumber: syz [ 416.514045][ T44] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 416.515041][ T5946] usb 1-1: config 0 descriptor?? [ 416.541680][ T44] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 416.556903][ T5895] usb 3-1: USB disconnect, device number 41 [ 416.559502][ T44] usb 5-1: Product: syz [ 416.571563][T10613] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 416.580197][ T44] usb 5-1: Manufacturer: syz [ 416.589098][ T44] usb 5-1: SerialNumber: syz [ 416.594455][T10613] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 416.826253][T10613] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.841117][T10613] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.855226][T10631] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.873531][T10613] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 416.886851][T10631] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.911974][T10613] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 416.983092][ T5946] HFC-S_USB 1-1:0.130: probe with driver HFC-S_USB failed with error -5 [ 417.040150][ T5946] usb 1-1: USB disconnect, device number 36 [ 417.110627][ T44] cdc_mbim 5-1:1.1: probe with driver cdc_mbim failed with error -71 [ 417.124356][ T44] usb 5-1: USB disconnect, device number 30 [ 418.027376][ T44] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 418.027688][ T5946] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 418.209688][ T44] usb 4-1: Using ep0 maxpacket: 16 [ 418.218908][ T44] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 418.231365][ T44] usb 4-1: config 0 has no interface number 0 [ 418.246608][ T44] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 418.267529][ T5946] usb 3-1: Using ep0 maxpacket: 16 [ 418.276862][ T44] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 418.283941][ T5946] usb 3-1: config 0 has an invalid interface number: 216 but max is 0 [ 418.303478][ T5946] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 418.316026][ T5946] usb 3-1: config 0 has no interface number 1 [ 418.320445][ T44] usb 4-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 418.323698][ T5946] usb 3-1: config 0 interface 216 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 418.341167][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 418.361660][ T5946] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 198, using maximum allowed: 30 [ 418.370446][ T44] usb 4-1: config 0 descriptor?? [ 418.373712][ T5946] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 198 [ 418.421278][ T5946] usb 3-1: New USB device found, idVendor=07af, idProduct=0004, bcdDevice= 1.01 [ 418.431932][ T5946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.443305][ T5946] usb 3-1: Product: syz [ 418.448994][ T5946] usb 3-1: Manufacturer: syz [ 418.464258][ T5946] usb 3-1: SerialNumber: syz [ 418.852669][ T5946] usb 3-1: config 0 descriptor?? [ 419.075369][ T5946] usb-storage 3-1:0.216: USB Mass Storage device detected [ 419.099639][ T5946] usb-storage 3-1:0.216: Quirks match for vid 07af pid 0004: 4 [ 419.539817][ T44] input: HID 28bd:0071 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.1/0003:28BD:0071.0011/input/input37 [ 419.622066][T10669] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1490'. [ 419.648881][ T5946] usb-storage 3-1:0.0: USB Mass Storage device detected [ 420.337842][ T5946] usb-storage 3-1:0.0: Quirks match for vid 07af pid 0004: 4 [ 420.411976][ T44] input: HID 28bd:0071 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.1/0003:28BD:0071.0011/input/input38 [ 420.486940][ T5946] usb 3-1: USB disconnect, device number 42 [ 420.580164][ T44] uclogic 0003:28BD:0071.0011: input,hidraw0: USB HID v0.02 Keypad [HID 28bd:0071] on usb-dummy_hcd.3-1/input1 [ 420.640776][ T44] usb 4-1: USB disconnect, device number 49 [ 420.795587][T10674] fido_id[10674]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 420.879844][ T3406] usb 1-1: new low-speed USB device number 37 using dummy_hcd [ 421.062781][ T3406] usb 1-1: unable to get BOS descriptor or descriptor too short [ 421.080556][ T3406] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 421.106371][ T3406] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 421.144097][ T3406] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 421.167043][ T3406] usb 1-1: config 1 interface 0 altsetting 0 has an invalid endpoint descriptor of length 5, skipping [ 421.184104][ T3406] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 421.205525][ T3406] usb 1-1: string descriptor 0 read error: -22 [ 421.212529][ T3406] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 421.222422][ T3406] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.245348][T10673] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 421.269961][ T3406] usb 1-1: 0:2 : does not exist [ 421.477277][ T5946] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 421.590424][ T5895] usb 1-1: USB disconnect, device number 37 [ 421.647682][ T5946] usb 2-1: Using ep0 maxpacket: 8 [ 421.658932][ T5946] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 421.668377][ T5946] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.676497][ T5946] usb 2-1: Product: syz [ 421.746605][ T5946] usb 2-1: Manufacturer: syz [ 421.756438][ T5946] usb 2-1: SerialNumber: syz [ 421.772497][ T5946] usb 2-1: config 0 descriptor?? [ 421.850285][ T5946] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 421.863663][ T5946] usb 2-1: setting power ON [ 421.890985][ T5946] dvb-usb: bulk message failed: -22 (2/0) [ 421.908215][ T5946] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 421.924804][ T5946] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 421.943185][ T5946] usb 2-1: media controller created [ 421.996268][ T5946] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 422.006833][T10683] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.065018][T10683] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.090205][T10683] dvb-usb: bulk message failed: -22 (3/0) [ 422.102492][T10683] cxusb: i2c wr: len=94 is too big! [ 422.102492][T10683] [ 422.132285][T10683] tipc: Enabling of bearer rejected, failed to enable media [ 422.168161][ T5946] usb 2-1: selecting invalid altsetting 6 [ 422.174307][ T5946] usb 2-1: digital interface selection failed (-22) [ 422.186802][ T5946] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 422.199292][ T5946] usb 2-1: setting power OFF [ 422.204017][ T5946] dvb-usb: bulk message failed: -22 (2/0) [ 422.255616][ T5946] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 422.278559][ T5946] (NULL device *): no alternate interface [ 422.412219][ T5946] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 422.461759][T10696] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1499'. [ 422.481205][ T5946] usb 2-1: USB disconnect, device number 36 [ 422.577294][ T44] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 422.778174][ T44] usb 3-1: Using ep0 maxpacket: 32 [ 422.785769][ T44] usb 3-1: config 0 has an invalid interface number: 146 but max is 0 [ 422.795214][ T44] usb 3-1: config 0 has no interface number 0 [ 422.807250][ T44] usb 3-1: config 0 interface 146 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 422.832793][ T44] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x83 has invalid maxpacket 33307, setting to 1024 [ 422.874354][ T44] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 1024 [ 422.905586][ T44] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x9 has invalid maxpacket 19604, setting to 1024 [ 422.917904][ T44] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 1024 [ 422.928239][ T3406] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 422.937620][ T44] usb 3-1: config 0 interface 146 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 422.948031][ T44] usb 3-1: config 0 interface 146 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 422.970940][ T44] usb 3-1: New USB device found, idVendor=05da, idProduct=009a, bcdDevice=62.95 [ 422.985571][ T44] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.001586][ T44] usb 3-1: Product: syz [ 423.006712][ T44] usb 3-1: Manufacturer: syz [ 423.013556][ T44] usb 3-1: SerialNumber: syz [ 423.034493][ T44] usb 3-1: config 0 descriptor?? [ 423.046312][T10692] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 423.054638][T10692] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 423.074856][ T44] microtek usb (rev 0.4.3): can only deal with one output endpoints. Bailing out. [ 423.100545][ T3406] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 423.129408][ T3406] usb 4-1: config 0 has no interface number 0 [ 423.135753][ T3406] usb 4-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 423.150215][ T3406] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.184383][ T3406] usb 4-1: config 0 descriptor?? [ 423.217100][ T3406] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 423.303735][ T5935] udevd[5935]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 423.321056][ T3406] snd-usb-audio 4-1:0.1: probe with driver snd-usb-audio failed with error -2 [ 423.418009][T10692] vivid-000: disconnect [ 423.423634][ T3406] usb 4-1: USB disconnect, device number 50 [ 423.707450][ T44] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 423.869759][ T44] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 423.885075][ T44] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 423.905359][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 423.921664][ T44] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 423.932467][ T44] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 423.973332][ T44] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 423.987997][ T44] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 424.013066][ T44] usb 2-1: Product: syz [ 424.021952][ T44] usb 2-1: Manufacturer: syz [ 424.032313][ T44] usb 2-1: SerialNumber: syz [ 424.056027][ T44] usb 2-1: config 0 descriptor?? [ 424.075550][ T44] garmin_gps 2-1:0.0: Garmin GPS usb/tty converter detected [ 424.094295][ T44] garmin_gps ttyUSB0: failed to submit interrupt urb: -90 [ 424.112435][ T44] garmin_gps ttyUSB0: probe with driver garmin_gps failed with error -90 [ 424.290658][ T44] usb 2-1: USB disconnect, device number 37 [ 424.321410][ T44] garmin_gps 2-1:0.0: device disconnected [ 424.422859][ T30] audit: type=1326 audit(1749951009.072:5223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 424.468867][ T30] audit: type=1326 audit(1749951009.102:5224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 424.576889][ T30] audit: type=1326 audit(1749951009.102:5225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 424.630559][ T30] audit: type=1326 audit(1749951009.102:5226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 424.687239][ T30] audit: type=1326 audit(1749951009.102:5227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 424.750358][ T30] audit: type=1326 audit(1749951009.102:5228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 424.796626][ T30] audit: type=1326 audit(1749951009.102:5229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 424.870870][ T30] audit: type=1326 audit(1749951009.102:5230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 424.947356][ T30] audit: type=1326 audit(1749951009.102:5231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 425.003072][ T30] audit: type=1326 audit(1749951009.102:5232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10693 comm="syz.0.1500" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 425.357945][T10692] vivid-000: reconnect [ 425.374435][ T5946] usb 3-1: USB disconnect, device number 43 [ 425.594416][T10732] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1513'. [ 428.240414][ T5902] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 428.376656][T10751] syz.4.1519 (10751) used greatest stack depth: 20088 bytes left [ 428.407444][ T5902] usb 1-1: Using ep0 maxpacket: 16 [ 428.431017][ T5902] usb 1-1: config index 0 descriptor too short (expected 16456, got 72) [ 428.457303][ T5902] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 428.475820][ T5902] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 428.486131][T10755] loop2: detected capacity change from 0 to 7 [ 428.510026][ T5902] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 428.519480][ T5935] Dev loop2: unable to read RDB block 7 [ 428.520045][ T5902] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 428.534778][ T5935] loop2: unable to read partition table [ 428.542406][ T5935] loop2: partition table beyond EOD, truncated [ 428.570345][T10755] Dev loop2: unable to read RDB block 7 [ 428.583023][T10755] loop2: unable to read partition table [ 428.596794][T10755] loop2: partition table beyond EOD, truncated [ 428.608842][T10755] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 428.631297][ T5902] usb 1-1: config 0 has no interface number 0 [ 428.706852][ T5902] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 428.826003][ T5902] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 428.853058][ T5902] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 428.873853][ T5902] usb 1-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 428.931051][ T5902] usb 1-1: config 0 interface 125 has no altsetting 0 [ 428.956242][ T5902] usb 1-1: config 0 interface 125 has no altsetting 2 [ 428.972855][ T5902] usb 1-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 429.019229][ T5902] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.056034][ T5902] usb 1-1: Product: syz [ 429.073545][ T5902] usb 1-1: Manufacturer: syz [ 429.091325][ T5902] usb 1-1: SerialNumber: syz [ 429.105752][ T5902] usb 1-1: config 0 descriptor?? [ 429.137670][ T5902] usb 1-1: selecting invalid altsetting 2 [ 429.230568][T10768] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1525'. [ 429.435710][ T30] kauditd_printk_skb: 806 callbacks suppressed [ 429.435732][ T30] audit: type=1326 audit(1749951014.082:6039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 429.512811][ T30] audit: type=1326 audit(1749951014.082:6040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 429.686048][ T30] audit: type=1326 audit(1749951014.082:6041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 429.724054][ T30] audit: type=1326 audit(1749951014.262:6042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 429.787291][ T30] audit: type=1326 audit(1749951014.262:6043): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 429.812262][ T30] audit: type=1326 audit(1749951014.332:6044): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 429.829913][ T44] hid-generic 00A0:0008:0003.0012: unknown main item tag 0x0 [ 429.853528][ T44] hid-generic 00A0:0008:0003.0012: unknown main item tag 0x3 [ 429.879135][ T44] hid-generic 00A0:0008:0003.0012: unknown main item tag 0x0 [ 429.886993][ T44] hid-generic 00A0:0008:0003.0012: unknown main item tag 0x0 [ 429.897118][ T44] hid-generic 00A0:0008:0003.0012: unknown main item tag 0x0 [ 429.907116][ T30] audit: type=1326 audit(1749951014.332:6045): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 429.968320][ T5946] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 430.008683][ T30] audit: type=1326 audit(1749951014.362:6046): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=393 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 430.030960][ T44] hid-generic 00A0:0008:0003.0012: collection stack underflow [ 430.030994][ T44] hid-generic 00A0:0008:0003.0012: item 0 0 0 12 parsing failed [ 430.031768][ T44] hid-generic 00A0:0008:0003.0012: probe with driver hid-generic failed with error -22 [ 430.068839][ T30] audit: type=1326 audit(1749951014.362:6047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 430.093870][ T30] audit: type=1326 audit(1749951014.362:6048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10743 comm="syz.0.1516" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 430.250507][ T5902] get_1284_register timeout [ 430.255964][ T5902] uss720 1-1:0.125: probe with driver uss720 failed with error -5 [ 430.264054][ C0] usb 1-1: async_complete: urb error -104 [ 430.264223][ C0] usb 1-1: async_complete: urb error -104 [ 430.264369][ C0] usb 1-1: async_complete: urb error -104 [ 430.308981][ T5946] usb 2-1: Using ep0 maxpacket: 16 [ 430.323827][ T5946] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 430.360460][ T5946] usb 2-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.00 [ 430.382171][ T5946] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 430.410910][ T5946] usb 2-1: config 0 descriptor?? [ 430.842644][T10776] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.854443][T10776] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 431.003881][ T44] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 431.011987][ T5884] usb 1-1: USB disconnect, device number 38 [ 431.065940][ T5946] kye 0003:0458:5013.0013: tablet report size too small, or kye_tablet_rdesc unexpectedly large [ 431.122961][ T5946] kye 0003:0458:5013.0013: item fetching failed at offset 2/5 [ 431.136002][ T5946] kye 0003:0458:5013.0013: parse failed [ 431.157575][ T5946] kye 0003:0458:5013.0013: probe with driver kye failed with error -22 [ 431.201637][ T44] usb 4-1: Using ep0 maxpacket: 8 [ 431.211388][ T44] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 431.224811][ T44] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 431.234236][ T44] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 5140, setting to 64 [ 431.251166][ T44] usb 4-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 431.262590][ T44] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.292418][ T44] hub 4-1:1.0: bad descriptor, ignoring hub [ 431.300109][ T44] hub 4-1:1.0: probe with driver hub failed with error -5 [ 431.312876][ T44] cdc_wdm 4-1:1.0: skipping garbage [ 431.330743][ T44] cdc_wdm 4-1:1.0: skipping garbage [ 431.336519][ T44] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 431.427288][ T5946] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 431.477536][ T5884] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 431.557631][ T5946] usb 3-1: device descriptor read/64, error -71 [ 431.649293][ T5884] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 431.657891][ T5884] usb 1-1: config 0 has no interface number 0 [ 431.664063][ T5884] usb 1-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 431.673665][ T5884] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.684915][ T5884] usb 1-1: config 0 descriptor?? [ 431.698825][ T5884] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 431.748328][ T5884] snd-usb-audio 1-1:0.1: probe with driver snd-usb-audio failed with error -2 [ 431.751442][ T5935] udevd[5935]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 431.797904][ T5946] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 431.900898][ T44] usb 1-1: USB disconnect, device number 39 [ 431.937598][ T5946] usb 3-1: device descriptor read/64, error -71 [ 432.048932][ T5946] usb usb3-port1: attempt power cycle [ 432.387589][ T5946] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 432.530566][ T5946] usb 3-1: device descriptor read/8, error -71 [ 432.741518][ T44] usb 2-1: USB disconnect, device number 38 [ 433.097365][ T5946] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 433.169137][ T5946] usb 3-1: device descriptor read/8, error -71 [ 433.294900][ T5946] usb usb3-port1: unable to enumerate USB device [ 433.537571][ T5902] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 433.657973][ T5946] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 433.710091][ T5902] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 433.721761][ T5902] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 433.739984][ T5902] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 433.796198][ T5902] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 433.815867][ T5946] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 433.843815][ T5946] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 433.856967][ T5902] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.872202][ T5946] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64 [ 433.885624][ T5902] usb 1-1: config 0 descriptor?? [ 433.897541][ T44] usb 4-1: USB disconnect, device number 51 [ 434.210950][ T5946] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 434.235582][ T5946] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.317258][ T5946] usb 5-1: Product: syz [ 434.344653][ T5946] usb 5-1: Manufacturer: syz [ 434.400328][T10813] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1537'. [ 434.458534][ T5902] plantronics 0003:047F:FFFF.0014: No inputs registered, leaving [ 434.685752][T10820] FAULT_INJECTION: forcing a failure. [ 434.685752][T10820] name failslab, interval 1, probability 0, space 0, times 0 [ 434.716498][ T5946] usb 5-1: SerialNumber: syz [ 434.716570][T10820] CPU: 1 UID: 0 PID: 10820 Comm: syz.2.1541 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 434.716603][T10820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 434.716616][T10820] Call Trace: [ 434.716629][T10820] [ 434.716639][T10820] dump_stack_lvl+0x189/0x250 [ 434.716685][T10820] ? __pfx____ratelimit+0x10/0x10 [ 434.716723][T10820] ? __pfx_dump_stack_lvl+0x10/0x10 [ 434.716761][T10820] ? __pfx__printk+0x10/0x10 [ 434.716795][T10820] ? __pfx___might_resched+0x10/0x10 [ 434.716838][T10820] should_fail_ex+0x414/0x560 [ 434.716875][T10820] should_failslab+0xa8/0x100 [ 434.716903][T10820] __kmalloc_node_noprof+0xd1/0x4e0 [ 434.716926][T10820] ? alloc_slab_obj_exts+0x39/0xa0 [ 434.716969][T10820] alloc_slab_obj_exts+0x39/0xa0 [ 434.717016][T10820] __memcg_slab_post_alloc_hook+0x31e/0x7f0 [ 434.717076][T10820] kmem_cache_alloc_node_noprof+0x2bd/0x3c0 [ 434.717100][T10820] ? __alloc_skb+0x112/0x2d0 [ 434.717137][T10820] __alloc_skb+0x112/0x2d0 [ 434.717170][T10820] alloc_skb_with_frags+0xca/0x890 [ 434.717217][T10820] sock_alloc_send_pskb+0x857/0x990 [ 434.717272][T10820] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 434.717320][T10820] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 434.717358][T10820] unix_dgram_sendmsg+0x4f6/0x1870 [ 434.717413][T10820] ? aa_sk_perm+0x81e/0x950 [ 434.717448][T10820] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 434.717484][T10820] ? __asan_memset+0x22/0x50 [ 434.717517][T10820] ? __import_iovec+0x5d4/0x7f0 [ 434.717538][T10820] ? aa_sock_msg_perm+0x94/0x160 [ 434.717570][T10820] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 434.717604][T10820] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 434.717639][T10820] __sock_sendmsg+0x21c/0x270 [ 434.717681][T10820] ____sys_sendmsg+0x52d/0x830 [ 434.717719][T10820] ? __pfx_____sys_sendmsg+0x10/0x10 [ 434.717770][T10820] ___sys_sendmsg+0x21f/0x2a0 [ 434.717802][T10820] ? __pfx____sys_sendmsg+0x10/0x10 [ 434.717875][T10820] ? __fget_files+0x2a/0x420 [ 434.717901][T10820] ? __fget_files+0x3a0/0x420 [ 434.717940][T10820] __sys_sendmmsg+0x28e/0x430 [ 434.717977][T10820] ? __pfx___sys_sendmmsg+0x10/0x10 [ 434.718028][T10820] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 434.718101][T10820] ? ksys_write+0x22a/0x250 [ 434.718139][T10820] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 434.718176][T10820] __do_fast_syscall_32+0xb6/0x2b0 [ 434.718201][T10820] ? lockdep_hardirqs_on+0x9c/0x150 [ 434.718240][T10820] do_fast_syscall_32+0x34/0x80 [ 434.718263][T10820] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 434.718292][T10820] RIP: 0023:0xf710e539 [ 434.718314][T10820] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 434.718335][T10820] RSP: 002b:00000000f50fe55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 434.718361][T10820] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001600 [ 434.718378][T10820] RDX: 0000000000000001 RSI: 0000000000040840 RDI: 0000000000000000 [ 434.718392][T10820] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 434.718407][T10820] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 434.718420][T10820] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 434.718455][T10820] [ 435.161058][ T5902] plantronics 0003:047F:FFFF.0014: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 435.344152][T10824] loop2: detected capacity change from 0 to 7 [ 435.361450][T10824] Dev loop2: unable to read RDB block 7 [ 435.368752][ T5946] usb 5-1: config 0 descriptor?? [ 435.375265][T10815] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 435.382890][T10815] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 435.437487][T10824] loop2: unable to read partition table [ 435.460507][ T5946] usb 5-1: ucan: probing device on interface #0 [ 435.652916][T10824] loop2: partition table beyond EOD, truncated [ 435.688634][ T5946] usb 5-1: ucan: could not read protocol version, ret=-71 [ 435.695951][ T5946] usb 5-1: ucan: probe failed; try to update the device firmware [ 435.724367][ T5946] usb 5-1: USB disconnect, device number 31 [ 435.732212][T10824] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 436.016731][T10829] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.047676][T10829] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.143526][T10829] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 436.153750][T10829] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 436.287320][ T44] usb 4-1: new full-speed USB device number 52 using dummy_hcd [ 436.431245][ T44] usb 4-1: device descriptor read/64, error -71 [ 436.468556][T10844] netlink: 'syz.2.1549': attribute type 3 has an invalid length. [ 436.687527][ T44] usb 4-1: new full-speed USB device number 53 using dummy_hcd [ 436.928915][ T44] usb 4-1: device descriptor read/64, error -71 [ 437.047659][ T44] usb usb4-port1: attempt power cycle [ 437.172058][ T5902] usb 3-1: new full-speed USB device number 48 using dummy_hcd [ 437.229051][ T3406] usb 1-1: USB disconnect, device number 40 [ 437.396821][ T5902] usb 3-1: config 0 has an invalid interface number: 176 but max is 2 [ 437.487613][ T44] usb 4-1: new full-speed USB device number 54 using dummy_hcd [ 437.495996][ T5884] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 437.530780][ T5902] usb 3-1: config 0 has an invalid interface number: 11 but max is 2 [ 437.543516][ T44] usb 4-1: device descriptor read/8, error -71 [ 437.562442][ T5902] usb 3-1: config 0 has no interface number 0 [ 437.583295][ T5902] usb 3-1: config 0 has no interface number 1 [ 437.624978][ T5902] usb 3-1: config 0 interface 11 has no altsetting 0 [ 437.642990][ T5902] usb 3-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 437.663245][ T5884] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 437.681394][ T5902] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 437.709506][ T5884] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 437.792220][ T5884] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 437.802003][ T44] usb 4-1: new full-speed USB device number 55 using dummy_hcd [ 437.803130][ T5902] usb 3-1: config 0 descriptor?? [ 437.825418][ T5884] usb 5-1: config 1 has no interface number 0 [ 437.838535][ T5884] usb 5-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 437.850185][ T5884] usb 5-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 437.864037][ T44] usb 4-1: device descriptor read/8, error -71 [ 437.895870][ T5884] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 438.107339][ T44] usb usb4-port1: unable to enumerate USB device [ 438.164536][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.217576][ T5884] usb 5-1: Product: syz [ 438.226113][ T5884] usb 5-1: Manufacturer: syz [ 438.235891][ T5884] usb 5-1: SerialNumber: syz [ 438.351422][ T5902] usb 3-1: Could not set interface, error -71 [ 438.421086][ T5902] usb 3-1: USB disconnect, device number 48 [ 438.438082][ T3406] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 438.632012][ T5884] cdc_mbim 5-1:1.1: probe with driver cdc_mbim failed with error -71 [ 438.674447][ T3406] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 438.683819][ T3406] usb 1-1: config 0 has no interface number 0 [ 438.698611][ T5884] usb 5-1: USB disconnect, device number 32 [ 438.707305][ T3406] usb 1-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 438.736642][ T3406] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.755925][ T3406] usb 1-1: config 0 descriptor?? [ 438.787091][ T3406] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 438.846560][ T3406] snd-usb-audio 1-1:0.1: probe with driver snd-usb-audio failed with error -2 [ 438.999124][ T3406] usb 1-1: USB disconnect, device number 41 [ 439.598782][T10880] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1558'. [ 439.797567][ T5902] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 439.960914][ T5902] usb 5-1: Using ep0 maxpacket: 8 [ 439.975676][ T5902] usb 5-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 439.992909][ T5902] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.001489][ T5902] usb 5-1: Product: syz [ 440.014282][ T5902] usb 5-1: Manufacturer: syz [ 440.048862][ T5902] usb 5-1: SerialNumber: syz [ 440.069361][ T5902] usb 5-1: config 0 descriptor?? [ 440.102587][ T5902] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 440.120085][ T5902] usb 5-1: setting power ON [ 440.131168][ T5902] dvb-usb: bulk message failed: -22 (2/0) [ 440.365609][T10878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 440.381677][ T5902] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 440.472961][ T5902] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 440.491933][T10878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 440.541815][ T5902] usb 5-1: media controller created [ 440.544516][T10878] dvb-usb: bulk message failed: -22 (3/0) [ 440.557257][ T3406] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 440.585261][T10878] cxusb: i2c wr: len=94 is too big! [ 440.585261][T10878] [ 440.642894][ T5902] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 440.704666][T10878] tipc: Enabling of bearer rejected, failed to enable media [ 440.744371][ T3406] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 440.770819][ T5902] usb 5-1: selecting invalid altsetting 6 [ 440.777250][ T5902] usb 5-1: digital interface selection failed (-22) [ 440.784198][ T5902] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 440.795183][ T5902] usb 5-1: setting power OFF [ 440.801350][ T5902] dvb-usb: bulk message failed: -22 (2/0) [ 440.807243][ T3406] usb 3-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 440.807297][ T3406] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 440.807323][ T3406] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.836138][ T5902] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 440.857329][ T5895] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 440.893987][ T5902] (NULL device *): no alternate interface [ 440.909631][T10891] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 440.958369][ T3406] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 441.027396][ T5895] usb 1-1: Using ep0 maxpacket: 16 [ 442.685118][ T5902] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 442.936603][ T5902] usb 5-1: USB disconnect, device number 33 [ 443.400103][ T5895] usb 1-1: unable to get BOS descriptor or descriptor too short [ 443.429261][ T5895] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 443.436973][ T5895] usb 1-1: can't read configurations, error -71 [ 443.705870][ T5884] usb 3-1: USB disconnect, device number 49 [ 443.799005][T10917] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1569'. [ 443.808210][T10917] hsr_slave_1: Device is already in use. [ 444.360135][T10929] xt_CT: No such helper "snmp" [ 444.531981][T10936] FAULT_INJECTION: forcing a failure. [ 444.531981][T10936] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 444.674203][T10936] CPU: 0 UID: 0 PID: 10936 Comm: syz.2.1576 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 444.674238][T10936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 444.674251][T10936] Call Trace: [ 444.674260][T10936] [ 444.674269][T10936] dump_stack_lvl+0x189/0x250 [ 444.674310][T10936] ? __pfx____ratelimit+0x10/0x10 [ 444.674344][T10936] ? __pfx_dump_stack_lvl+0x10/0x10 [ 444.674378][T10936] ? __pfx__printk+0x10/0x10 [ 444.674403][T10936] ? __might_fault+0xb0/0x130 [ 444.674436][T10936] should_fail_ex+0x414/0x560 [ 444.674471][T10936] _copy_from_user+0x2d/0xb0 [ 444.674494][T10936] get_compat_msghdr+0xad/0x4a0 [ 444.674530][T10936] ? __pfx_get_compat_msghdr+0x10/0x10 [ 444.674562][T10936] ? rcu_is_watching+0x15/0xb0 [ 444.674595][T10936] ? ___sys_sendmsg+0x22f/0x2a0 [ 444.674630][T10936] ___sys_sendmsg+0x193/0x2a0 [ 444.674662][T10936] ? __pfx____sys_sendmsg+0x10/0x10 [ 444.674691][T10936] ? do_user_addr_fault+0xbc1/0x1390 [ 444.674773][T10936] __sys_sendmmsg+0x28e/0x430 [ 444.674807][T10936] ? __pfx___sys_sendmmsg+0x10/0x10 [ 444.674846][T10936] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 444.674900][T10936] ? ksys_write+0x22a/0x250 [ 444.674950][T10936] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 444.674984][T10936] __do_fast_syscall_32+0xb6/0x2b0 [ 444.675007][T10936] ? lockdep_hardirqs_on+0x9c/0x150 [ 444.675044][T10936] do_fast_syscall_32+0x34/0x80 [ 444.675075][T10936] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 444.675103][T10936] RIP: 0023:0xf710e539 [ 444.675122][T10936] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 444.675142][T10936] RSP: 002b:00000000f50fe55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 444.675165][T10936] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080003b80 [ 444.675181][T10936] RDX: 0000000004000070 RSI: 0000000000008000 RDI: 0000000000000000 [ 444.675195][T10936] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 444.675208][T10936] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 444.675220][T10936] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 444.675251][T10936] [ 445.107377][ T5884] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 445.211094][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 445.217623][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 445.277255][ T5884] usb 4-1: Using ep0 maxpacket: 16 [ 445.288050][ T5884] usb 4-1: config 0 has an invalid interface number: 214 but max is 0 [ 445.289193][ T30] kauditd_printk_skb: 45 callbacks suppressed [ 445.289213][ T30] audit: type=1326 audit(1749951029.932:6094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 445.307369][ T5884] usb 4-1: config 0 has no interface number 0 [ 445.411973][ T30] audit: type=1326 audit(1749951029.932:6095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 445.416679][ T5884] usb 4-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 1023, setting to 64 [ 445.506334][ T30] audit: type=1326 audit(1749951029.932:6096): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 445.510850][ T5884] usb 4-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 445.581825][ T30] audit: type=1326 audit(1749951029.932:6097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 445.587194][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.659151][T10957] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1582'. [ 445.677517][ T5884] usb 4-1: Product: syz [ 445.683931][ T5884] usb 4-1: Manufacturer: syz [ 445.689927][ T5884] usb 4-1: SerialNumber: syz [ 445.704600][ T5884] usb 4-1: config 0 descriptor?? [ 445.730893][ T30] audit: type=1326 audit(1749951029.932:6098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 445.867626][ T30] audit: type=1326 audit(1749951029.932:6099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 447.296789][ T30] audit: type=1326 audit(1749951029.932:6100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 447.512246][ T30] audit: type=1326 audit(1749951029.932:6101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 447.588361][ T30] audit: type=1326 audit(1749951029.932:6102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 447.632165][ T30] audit: type=1326 audit(1749951029.932:6103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10930 comm="syz.0.1575" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 447.835487][T10941] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1577'. [ 448.387266][ T977] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 448.576888][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 448.592936][ T977] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 448.604077][ T977] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 448.621419][ T977] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 448.631251][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.655260][ T977] usb 3-1: config 0 descriptor?? [ 448.983600][ T5884] usbtouchscreen 4-1:0.214: probe with driver usbtouchscreen failed with error -71 [ 449.033827][ T5884] usb 4-1: USB disconnect, device number 56 [ 449.352761][T10974] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1583'. [ 449.374297][ T977] plantronics 0003:047F:FFFF.0015: No inputs registered, leaving [ 449.398818][ T977] plantronics 0003:047F:FFFF.0015: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 449.423674][T10990] netlink: 'syz.4.1587': attribute type 10 has an invalid length. [ 449.463255][T10990] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1587'. [ 449.977805][T11003] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1592'. [ 450.947378][ T5895] usb 3-1: reset high-speed USB device number 50 using dummy_hcd [ 451.006515][T11018] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1597'. [ 452.138747][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 452.138767][ T30] audit: type=1326 audit(1749951036.792:6161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f33539 code=0x7ffc0000 [ 452.195560][T11039] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1604'. [ 452.220096][ T30] audit: type=1326 audit(1749951036.792:6162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f33539 code=0x7ffc0000 [ 452.274602][ T30] audit: type=1326 audit(1749951036.822:6163): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f33558 code=0x7ffc0000 [ 452.334413][ T30] audit: type=1326 audit(1749951036.822:6164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f33558 code=0x7ffc0000 [ 452.387764][ T30] audit: type=1326 audit(1749951036.822:6165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f33558 code=0x7ffc0000 [ 452.415092][T11041] netlink: 'syz.2.1605': attribute type 10 has an invalid length. [ 452.424794][T11041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1605'. [ 452.456499][ T30] audit: type=1326 audit(1749951036.822:6166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f33558 code=0x7ffc0000 [ 452.502928][ T30] audit: type=1326 audit(1749951036.822:6167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f33558 code=0x7ffc0000 [ 452.570539][ T30] audit: type=1326 audit(1749951036.822:6168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f33558 code=0x7ffc0000 [ 452.622122][ T30] audit: type=1326 audit(1749951036.822:6169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f33558 code=0x7ffc0000 [ 452.760752][ T5902] usb 3-1: USB disconnect, device number 50 [ 452.907587][ T30] audit: type=1326 audit(1749951036.822:6170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11008 comm="syz.1.1594" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f33558 code=0x7ffc0000 [ 454.386367][T11060] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1609'. [ 455.002527][T11076] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1613'. [ 455.395261][T11086] random: crng reseeded on system resumption [ 455.547482][T11086] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1617'. [ 455.700760][T11086] vlan3: entered promiscuous mode [ 456.548251][ T5902] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 456.705421][T11109] netlink: 5120 bytes leftover after parsing attributes in process `syz.0.1624'. [ 456.798296][ T5902] usb 2-1: Using ep0 maxpacket: 8 [ 456.823518][ T5902] usb 2-1: unable to get BOS descriptor or descriptor too short [ 456.900761][ T5902] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 456.945665][ T5902] usb 2-1: config 7 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 457.040701][ T5902] usb 2-1: New USB device found, idVendor=0489, idProduct=e0b5, bcdDevice=ae.2a [ 457.066009][ T5902] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.098841][ T5902] usb 2-1: Product: syz [ 457.121732][T11116] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1627'. [ 457.124650][ T5902] usb 2-1: Manufacturer: syz [ 457.155955][ T5902] usb 2-1: SerialNumber: syz [ 457.161138][ T30] kauditd_printk_skb: 867 callbacks suppressed [ 457.161156][ T30] audit: type=1326 audit(1749951041.752:7038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.245842][T11093] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1620'. [ 457.249202][ T30] audit: type=1326 audit(1749951041.812:7039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.346672][ T30] audit: type=1326 audit(1749951041.812:7040): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.477238][ T30] audit: type=1326 audit(1749951041.812:7041): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.568345][ T30] audit: type=1326 audit(1749951041.812:7042): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.653343][ T30] audit: type=1326 audit(1749951041.812:7043): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.711931][ T30] audit: type=1326 audit(1749951041.812:7044): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.762039][ T30] audit: type=1326 audit(1749951041.812:7045): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.819772][ T30] audit: type=1326 audit(1749951041.812:7046): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 457.908552][ T30] audit: type=1326 audit(1749951041.812:7047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11092 comm="syz.3.1620" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7f61558 code=0x7ffc0000 [ 458.711702][ T5902] usb 2-1: USB disconnect, device number 39 [ 459.245848][T11144] fuse: Unknown parameter '°¦ïÉmode' [ 460.596795][ T5884] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 460.682047][T11167] xt_bpf: check failed: parse error [ 461.046494][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 461.073200][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 461.096601][ T5884] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 461.397223][ T5884] usb 5-1: New USB device found, idVendor=0079, idProduct=0011, bcdDevice= 0.00 [ 461.426804][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.470738][ T5884] usb 5-1: config 0 descriptor?? [ 461.743731][T11172] kvm: kvm [11171]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0xc2) = 0x8000 [ 461.901457][ T5884] dragonrise 0003:0079:0011.0016: unknown main item tag 0x1 [ 461.913955][ T5884] dragonrise 0003:0079:0011.0016: unbalanced collection at end of report description [ 461.937911][ T5884] dragonrise 0003:0079:0011.0016: parse failed [ 461.975933][ T5884] dragonrise 0003:0079:0011.0016: probe with driver dragonrise failed with error -22 [ 462.088040][ T5884] usb 5-1: USB disconnect, device number 34 [ 462.304075][T11177] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1646'. [ 462.348088][T11179] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1647'. [ 462.369467][T11179] openvswitch: netlink: Missing key (keys=40, expected=80) [ 462.541461][T11180] xt_CT: You must specify a L4 protocol and not use inversions on it [ 462.822958][T11188] loop2: detected capacity change from 0 to 7 [ 462.839479][ T9253] Dev loop2: unable to read RDB block 7 [ 462.845282][ T9253] loop2: unable to read partition table [ 462.860899][ T9253] loop2: partition table beyond EOD, truncated [ 462.879922][T11188] Dev loop2: unable to read RDB block 7 [ 462.886481][T11188] loop2: unable to read partition table [ 462.901796][T11188] loop2: partition table beyond EOD, truncated [ 462.910422][T11188] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 463.144163][T11200] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1656'. [ 463.178360][T11200] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1656'. [ 463.327715][ T5884] usb 5-1: new full-speed USB device number 35 using dummy_hcd [ 463.389011][T11207] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1658'. [ 463.450877][T11207] vlan2: entered allmulticast mode [ 463.456283][T11207] bridge_slave_0: entered allmulticast mode [ 463.511482][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 463.519842][T11210] kvm: kvm [11209]: vcpu0, guest rIP: 0x1a3 Unhandled WRMSR(0xc2) = 0x8000 [ 463.544684][ T5884] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 463.579016][ T5884] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 463.593243][ T5884] usb 5-1: New USB device found, idVendor=0755, idProduct=2626, bcdDevice= 0.00 [ 463.626141][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.689410][ T5884] usb 5-1: config 0 descriptor?? [ 463.697226][T11196] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 464.069508][ T5884] usbhid 5-1:0.0: can't add hid device: -71 [ 464.087783][ T5884] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 464.119389][ T5884] usb 5-1: USB disconnect, device number 35 [ 464.263819][T11227] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1666'. [ 464.877342][ T5884] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 465.008045][ T5902] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 465.047541][ T5884] usb 3-1: Using ep0 maxpacket: 16 [ 465.072616][ T5884] usb 3-1: config index 0 descriptor too short (expected 16456, got 72) [ 465.091056][ T5884] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 465.126526][ T5884] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 465.156833][T11254] FAULT_INJECTION: forcing a failure. [ 465.156833][T11254] name failslab, interval 1, probability 0, space 0, times 0 [ 465.195544][ T5884] usb 3-1: config 0 has an invalid interface number: 125 but max is 1 [ 465.214515][ T5902] usb 1-1: Using ep0 maxpacket: 8 [ 465.217347][ T5884] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 465.226814][ T5902] usb 1-1: config 162 has an invalid interface number: 197 but max is 1 [ 465.237955][ T5902] usb 1-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 465.254384][ T5902] usb 1-1: config 162 has 1 interface, different from the descriptor's value: 2 [ 465.263942][ T5902] usb 1-1: config 162 has no interface number 0 [ 465.270821][ T5902] usb 1-1: config 162 interface 197 altsetting 49 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 465.274026][T11254] CPU: 1 UID: 0 PID: 11254 Comm: syz.4.1675 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 465.274061][T11254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 465.274077][T11254] Call Trace: [ 465.274087][T11254] [ 465.274098][T11254] dump_stack_lvl+0x189/0x250 [ 465.274143][T11254] ? __pfx____ratelimit+0x10/0x10 [ 465.274180][T11254] ? __pfx_dump_stack_lvl+0x10/0x10 [ 465.274218][T11254] ? __pfx__printk+0x10/0x10 [ 465.274253][T11254] ? __pfx___might_resched+0x10/0x10 [ 465.274290][T11254] ? fs_reclaim_acquire+0x7d/0x100 [ 465.274324][T11254] should_fail_ex+0x414/0x560 [ 465.274361][T11254] should_failslab+0xa8/0x100 [ 465.274389][T11254] __kmalloc_noprof+0xcb/0x4f0 [ 465.274412][T11254] ? kfree+0x4d/0x440 [ 465.274443][T11254] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 465.274486][T11254] tomoyo_realpath_from_path+0xe3/0x5d0 [ 465.274524][T11254] ? tomoyo_domain+0xd9/0x130 [ 465.274575][T11254] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 465.274603][T11254] tomoyo_path_number_perm+0x1e8/0x5a0 [ 465.274631][T11254] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 465.274660][T11254] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 465.274690][T11254] ? __pfx_raw_ioctl+0x10/0x10 [ 465.274718][T11254] ? page_table_check_set+0x18d/0x730 [ 465.274755][T11254] ? __lock_acquire+0xab9/0xd20 [ 465.274815][T11254] ? __fget_files+0x2a/0x420 [ 465.274848][T11254] ? __fget_files+0x3a0/0x420 [ 465.274872][T11254] ? __fget_files+0x2a/0x420 [ 465.274905][T11254] security_file_ioctl_compat+0xcb/0x2d0 [ 465.274935][T11254] __ia32_compat_sys_ioctl+0x128/0x840 [ 465.274977][T11254] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 465.275013][T11254] ? count_memcg_event_mm+0x21/0x260 [ 465.275069][T11254] ? rcu_is_watching+0x15/0xb0 [ 465.275112][T11254] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 465.275152][T11254] ? lockdep_hardirqs_on+0x9c/0x150 [ 465.275192][T11254] __do_fast_syscall_32+0xb6/0x2b0 [ 465.275216][T11254] ? lockdep_hardirqs_on+0x9c/0x150 [ 465.275258][T11254] do_fast_syscall_32+0x34/0x80 [ 465.275280][T11254] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 465.275309][T11254] RIP: 0023:0xf708e539 [ 465.275330][T11254] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 465.275352][T11254] RSP: 002b:00000000f507c484 EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 465.275376][T11254] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080085502 [ 465.275393][T11254] RDX: 00000000f507d510 RSI: 00000000f73f2ff4 RDI: 00000000f507c4e8 [ 465.275410][T11254] RBP: 00000000f73f2ff4 R08: 0000000000000000 R09: 0000000000000000 [ 465.275425][T11254] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 465.275438][T11254] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 465.275473][T11254] [ 465.275483][T11254] ERROR: Out of memory at tomoyo_realpath_from_path. [ 465.285086][ T5902] usb 1-1: config 162 interface 197 has no altsetting 0 [ 465.308953][ T5884] usb 3-1: config 0 has no interface number 0 [ 465.342669][ T5902] usb 1-1: New USB device found, idVendor=0c10, idProduct=0000, bcdDevice=95.a7 [ 465.348410][ T5884] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 465.351440][T11256] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1676'. [ 465.353891][ T5884] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 465.367204][ T5902] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.372874][ T5884] usb 3-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 465.386320][ T5902] usb 1-1: Product: syz [ 465.386344][ T5902] usb 1-1: Manufacturer: syz [ 465.386362][ T5902] usb 1-1: SerialNumber: syz [ 465.661606][ T3406] usb 5-1: new low-speed USB device number 36 using dummy_hcd [ 465.678037][ T5884] usb 3-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 465.695316][ T5884] usb 3-1: config 0 interface 125 has no altsetting 0 [ 465.703417][ T5884] usb 3-1: config 0 interface 125 has no altsetting 2 [ 465.713580][ T5884] usb 3-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 465.723286][T11239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 465.724420][ T5884] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.758220][T11239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 465.768158][ T5884] usb 3-1: Product: syz [ 465.812299][ T5884] usb 3-1: Manufacturer: syz [ 465.816995][ T5884] usb 3-1: SerialNumber: syz [ 465.843479][ T3406] usb 5-1: unable to get BOS descriptor or descriptor too short [ 465.871055][ T3406] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 465.880651][ T5884] usb 3-1: config 0 descriptor?? [ 465.888679][ T3406] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 465.918150][ T3406] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 465.931792][ T5884] usb 3-1: selecting invalid altsetting 2 [ 465.941488][ T3406] usb 5-1: config 1 interface 0 altsetting 0 has an invalid endpoint descriptor of length 5, skipping [ 465.963645][ T3406] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 466.006689][ T3406] usb 5-1: string descriptor 0 read error: -22 [ 466.022909][ T3406] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 466.032526][ T3406] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 466.049774][T11254] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 466.091345][ T3406] usb 5-1: 0:2 : does not exist [ 466.106673][ T30] kauditd_printk_skb: 295 callbacks suppressed [ 466.106691][ T30] audit: type=1326 audit(1749951050.752:7343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.185748][ T30] audit: type=1326 audit(1749951050.752:7344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.241420][ T30] audit: type=1326 audit(1749951050.752:7345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=136 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.263448][ T5902] usb 5-1: USB disconnect, device number 36 [ 466.275174][ T30] audit: type=1326 audit(1749951050.752:7346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.303750][ T30] audit: type=1326 audit(1749951050.752:7347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=309 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.336356][ T30] audit: type=1326 audit(1749951050.822:7348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.374481][ T30] audit: type=1326 audit(1749951050.822:7349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.407620][ T30] audit: type=1326 audit(1749951050.862:7350): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.435540][ T30] audit: type=1326 audit(1749951050.862:7351): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.463467][ T30] audit: type=1326 audit(1749951050.862:7352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11232 comm="syz.2.1668" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 466.538150][ T5902] hid-generic 00A0:0008:0003.0017: unknown main item tag 0x0 [ 466.552488][ T5902] hid-generic 00A0:0008:0003.0017: unknown main item tag 0x3 [ 466.566041][ T5902] hid-generic 00A0:0008:0003.0017: unknown main item tag 0x0 [ 466.578802][ T5902] hid-generic 00A0:0008:0003.0017: unknown main item tag 0x0 [ 466.586622][ T5902] hid-generic 00A0:0008:0003.0017: unknown main item tag 0x0 [ 466.594872][ T5902] hid-generic 00A0:0008:0003.0017: collection stack underflow [ 466.619297][ T5902] hid-generic 00A0:0008:0003.0017: item 0 0 0 12 parsing failed [ 466.634819][ T5902] hid-generic 00A0:0008:0003.0017: probe with driver hid-generic failed with error -22 [ 466.928182][T11277] netlink: 'syz.3.1683': attribute type 10 has an invalid length. [ 466.947399][T11277] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1683'. [ 466.967434][ T5884] get_1284_register timeout [ 466.974325][ T5884] uss720 3-1:0.125: probe with driver uss720 failed with error -5 [ 466.982588][ C1] usb 3-1: async_complete: urb error -104 [ 466.982747][ C1] usb 3-1: async_complete: urb error -104 [ 466.982893][ C1] usb 3-1: async_complete: urb error -104 [ 467.566801][T11295] netlink: 'syz.4.1689': attribute type 10 has an invalid length. [ 467.575571][T11295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1689'. [ 467.585109][T11295] openvswitch: netlink: Flow key attr not present in new flow. [ 467.627658][ T5895] usb 3-1: USB disconnect, device number 51 [ 467.707103][ T5902] usb 1-1: USB disconnect, device number 44 [ 467.740338][T11297] loop2: detected capacity change from 0 to 7 [ 467.755830][ T9253] Dev loop2: unable to read RDB block 7 [ 467.765904][ T9253] loop2: unable to read partition table [ 467.772672][ T9253] loop2: partition table beyond EOD, truncated [ 467.784191][T11297] Dev loop2: unable to read RDB block 7 [ 467.793807][T11297] loop2: unable to read partition table [ 467.805069][T11297] loop2: partition table beyond EOD, truncated [ 467.812766][T11297] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 467.920343][ T5884] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 468.112959][ T5884] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 468.123586][ T5884] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 468.142233][ T5884] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 468.210072][ T5884] usb 4-1: config 1 has no interface number 0 [ 468.231150][ T5884] usb 4-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 468.268734][ T5884] usb 4-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 468.324782][ T5884] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 468.363046][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.398771][ T5884] usb 4-1: Product: syz [ 468.408849][ T5884] usb 4-1: Manufacturer: syz [ 468.429466][ T5884] usb 4-1: SerialNumber: syz [ 468.797488][T11294] binfmt_misc: register: failed to install interpreter file ./file0 [ 469.063291][ T5884] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 469.198207][ T5884] usb 4-1: USB disconnect, device number 57 [ 469.472237][T11319] netlink: 'syz.4.1698': attribute type 3 has an invalid length. [ 469.808794][ T5884] usb 1-1: new low-speed USB device number 45 using dummy_hcd [ 469.886004][T11323] netlink: 'syz.1.1700': attribute type 10 has an invalid length. [ 469.904687][T11323] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1700'. [ 469.915083][T11331] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1703'. [ 469.954151][T11333] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1702'. [ 470.094237][ T5884] usb 1-1: config 1 interface 0 altsetting 3 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 470.116770][ T5884] usb 1-1: config 1 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 470.195071][ T5884] usb 1-1: config 1 interface 0 has no altsetting 0 [ 470.212737][T11335] tipc: Enabling of bearer rejected, failed to enable media [ 470.230450][T11337] netlink: 208 bytes leftover after parsing attributes in process `syz.2.1705'. [ 470.280486][ T5884] usb 1-1: string descriptor 0 read error: -22 [ 470.287082][ T5884] usb 1-1: New USB device found, idVendor=05ac, idProduct=025a, bcdDevice= 0.40 [ 470.309128][ T5884] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.420383][T11321] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 470.475611][ T5884] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input48 [ 470.681689][ T5190] bcm5974 1-1:1.0: could not read from device [ 470.805039][ T5884] usb 1-1: USB disconnect, device number 45 [ 470.814832][ T5935] bcm5974 1-1:1.0: could not read from device [ 470.847649][ T5190] bcm5974 1-1:1.0: could not read from device [ 470.855912][ T5190] bcm5974 1-1:1.0: could not read from device [ 470.876924][ T5935] udevd[5935]: Error opening device "/dev/input/event4": No such device [ 470.905932][ T5935] udevd[5935]: Unable to EVIOCGABS device "/dev/input/event4" [ 470.933478][ T5935] udevd[5935]: Unable to EVIOCGABS device "/dev/input/event4" [ 470.948958][ T5935] udevd[5935]: Unable to EVIOCGABS device "/dev/input/event4" [ 470.957876][ T5935] udevd[5935]: Unable to EVIOCGABS device "/dev/input/event4" [ 471.067484][ T5895] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 471.267205][ T5895] usb 3-1: Using ep0 maxpacket: 16 [ 471.285041][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 471.309852][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 471.353494][ T5895] usb 3-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 471.397210][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.420689][ T5895] usb 3-1: config 0 descriptor?? [ 471.467735][ T5902] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 471.775595][ T5902] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 471.788879][ T5902] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 471.799678][ T5902] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 471.803729][T11365] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1716'. [ 471.818361][ T5902] usb 2-1: config 1 has no interface number 0 [ 471.818429][ T5902] usb 2-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 471.818471][ T5902] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 471.821349][ T5902] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 471.832715][T11365] openvswitch: netlink: Unknown nsh attribute 0 [ 471.839539][ T5902] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 471.902251][T11365] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 471.916351][ T5895] gt683r_led 0003:1770:FF00.0018: ignoring exceeding usage max [ 471.962758][ T5895] gt683r_led 0003:1770:FF00.0018: hidraw0: USB HID v0.00 Device [HID 1770:ff00] on usb-dummy_hcd.2-1/input0 [ 471.993093][ T5902] usb 2-1: Product: syz [ 472.004834][ T5902] usb 2-1: Manufacturer: syz [ 472.022520][ T5902] usb 2-1: SerialNumber: syz [ 472.105988][T11346] FAULT_INJECTION: forcing a failure. [ 472.105988][T11346] name failslab, interval 1, probability 0, space 0, times 0 [ 472.200280][T11346] CPU: 1 UID: 0 PID: 11346 Comm: syz.2.1708 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 472.200311][T11346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 472.200325][T11346] Call Trace: [ 472.200334][T11346] [ 472.200343][T11346] dump_stack_lvl+0x189/0x250 [ 472.200383][T11346] ? __pfx____ratelimit+0x10/0x10 [ 472.200417][T11346] ? __pfx_dump_stack_lvl+0x10/0x10 [ 472.200449][T11346] ? __pfx__printk+0x10/0x10 [ 472.200472][T11346] ? __pfx___might_resched+0x10/0x10 [ 472.200496][T11346] ? fs_reclaim_acquire+0x7d/0x100 [ 472.200522][T11346] should_fail_ex+0x414/0x560 [ 472.200556][T11346] should_failslab+0xa8/0x100 [ 472.200580][T11346] kmem_cache_alloc_noprof+0x73/0x3c0 [ 472.200611][T11346] ? __kernfs_new_node+0xd7/0x7e0 [ 472.200634][T11346] __kernfs_new_node+0xd7/0x7e0 [ 472.200662][T11346] ? __lock_acquire+0xab9/0xd20 [ 472.200703][T11346] ? __pfx___kernfs_new_node+0x10/0x10 [ 472.200736][T11346] ? kernfs_root+0x1c/0x230 [ 472.200766][T11346] ? kernfs_root+0x1c/0x230 [ 472.200788][T11346] ? kernfs_root+0x1c/0x230 [ 472.200804][T11346] ? kernfs_root+0x1c/0x230 [ 472.200831][T11346] kernfs_new_node+0x102/0x210 [ 472.200865][T11346] __kernfs_create_file+0x4b/0x2e0 [ 472.200899][T11346] sysfs_add_file_mode_ns+0x238/0x300 [ 472.200924][T11346] sysfs_merge_group+0x177/0x310 [ 472.200945][T11346] ? __pfx_sysfs_merge_group+0x10/0x10 [ 472.200968][T11346] ? __pfx_device_add_attrs+0x10/0x10 [ 472.200999][T11346] dpm_sysfs_add+0xd2/0x270 [ 472.201027][T11346] device_add+0x4d8/0xb50 [ 472.201053][T11346] input_register_device+0x9ca/0x10b0 [ 472.201078][T11346] uinput_create_device+0x422/0x670 [ 472.201107][T11346] uinput_ioctl_handler+0x3f0/0x1570 [ 472.201139][T11346] ? __pfx_uinput_ioctl_handler+0x10/0x10 [ 472.201185][T11346] ? __fget_files+0x2a/0x420 [ 472.201215][T11346] __ia32_compat_sys_ioctl+0x543/0x840 [ 472.201242][T11346] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 472.201267][T11346] ? __fget_files+0x3a0/0x420 [ 472.201299][T11346] ? fput+0xa0/0xd0 [ 472.201326][T11346] ? ksys_write+0x22a/0x250 [ 472.201353][T11346] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 472.201379][T11346] ? lockdep_hardirqs_on+0x9c/0x150 [ 472.201404][T11346] __do_fast_syscall_32+0xb6/0x2b0 [ 472.201422][T11346] ? lockdep_hardirqs_on+0x9c/0x150 [ 472.201460][T11346] do_fast_syscall_32+0x34/0x80 [ 472.201479][T11346] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 472.201503][T11346] RIP: 0023:0xf710e539 [ 472.201518][T11346] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 472.201531][T11346] RSP: 002b:00000000f50fe55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 472.201547][T11346] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000005501 [ 472.201558][T11346] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 472.201568][T11346] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 472.201580][T11346] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 472.201593][T11346] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 472.201622][T11346] [ 472.517567][ C1] vkms_vblank_simulate: vblank timer overrun [ 472.589822][ T977] usb 3-1: USB disconnect, device number 52 [ 472.591051][T11354] binfmt_misc: register: failed to install interpreter file ./file0 [ 472.651998][ T10] gt683r_led 0003:1770:FF00.0018: failed to send set report request: -19 [ 472.712094][ T5902] cdc_mbim 2-1:1.1: probe with driver cdc_mbim failed with error -71 [ 472.888546][ T5895] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 472.903156][ T5902] usb 2-1: USB disconnect, device number 40 [ 472.959633][T11375] random: crng reseeded on system resumption [ 472.976759][T11375] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1719'. [ 473.005094][T11375] vlan1: entered promiscuous mode [ 473.010404][T11375] ip6gretap0: entered promiscuous mode [ 473.069903][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 473.092090][ T5895] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 473.132753][ T5895] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 473.186051][ T5895] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 473.207361][ T5895] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 473.226587][ T5895] usb 5-1: config 0 descriptor?? [ 473.243662][T11383] netlink: 'syz.2.1722': attribute type 11 has an invalid length. [ 473.330046][T11386] vlan1: entered allmulticast mode [ 473.689876][T11371] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.718007][T11371] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.758895][ T5895] plantronics 0003:047F:FFFF.0019: No inputs registered, leaving [ 473.773014][ T977] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 473.815632][ T5895] plantronics 0003:047F:FFFF.0019: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 473.967260][ T977] usb 2-1: Using ep0 maxpacket: 32 [ 474.009832][ T977] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 474.026303][ T977] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 474.053282][ T977] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 474.072787][ T977] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 474.082071][ T977] usb 2-1: Product: syz [ 474.087382][ T977] usb 2-1: Manufacturer: syz [ 474.116423][ T3406] usb 5-1: USB disconnect, device number 37 [ 474.133228][ T977] hub 2-1:4.0: USB hub found [ 474.303490][T11396] fido_id[11396]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 474.344324][ T977] hub 2-1:4.0: 2 ports detected [ 474.545043][T11391] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1725'. [ 474.556925][ T977] hub 2-1:4.0: hub_hub_status failed (err = -71) [ 474.583803][ T977] hub 2-1:4.0: config failed, can't get hub status (err -71) [ 474.677361][ T977] usb 2-1: USB disconnect, device number 41 [ 474.895820][T11411] netlink: 'syz.4.1729': attribute type 13 has an invalid length. [ 474.960893][T11411] gretap0: refused to change device tx_queue_len [ 474.968156][T11411] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 475.795978][ T5884] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 475.981015][ T5884] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 475.990446][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 476.048771][ T5884] usb 4-1: Product: syz [ 476.060706][ T5884] usb 4-1: Manufacturer: syz [ 476.066019][ T5884] usb 4-1: SerialNumber: syz [ 476.084526][ T5884] usb 4-1: config 0 descriptor?? [ 476.200580][T11424] netlink: 'syz.0.1734': attribute type 13 has an invalid length. [ 476.314581][T11428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.331662][T11428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.996053][T11424] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.012155][T11424] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.043138][T11424] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.069673][T11424] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 477.197470][ T5884] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 477.220376][ T5884] usb 4-1: setting power ON [ 477.224935][ T5884] dvb-usb: bulk message failed: -22 (2/0) [ 477.263969][ T5884] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 477.331086][ T5884] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) error while loading driver (-19) [ 477.371894][ T5884] dvb_usb_cxusb 4-1:0.0: probe with driver dvb_usb_cxusb failed with error -22 [ 477.419025][ T5884] usb 4-1: USB disconnect, device number 58 [ 477.565766][T11438] netlink: 5128 bytes leftover after parsing attributes in process `syz.0.1739'. [ 477.603291][T11440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 477.643816][T11438] netlink: 5128 bytes leftover after parsing attributes in process `syz.0.1739'. [ 477.669414][T11440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 477.711666][T11438] netlink: 584 bytes leftover after parsing attributes in process `syz.0.1739'. [ 477.827405][ T3406] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 477.917959][ T977] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 478.097811][ T977] usb 3-1: Using ep0 maxpacket: 32 [ 478.122168][ T977] usb 3-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 478.135287][ T977] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.165293][ T977] usb 3-1: config 0 descriptor?? [ 478.188409][ T977] gspca_main: sq930x-2.14.0 probing 041e:403c [ 478.536342][T11451] binder: 11439:11451 ioctl c0306201 80000180 returned -11 [ 478.575541][T11453] fuse: Unknown parameter '0x0000000000000004' [ 478.698429][ T977] gspca_sq930x: reg_r 001f failed -110 [ 478.704140][ T977] sq930x 3-1:0.0: probe with driver sq930x failed with error -110 [ 478.758075][T11458] FAULT_INJECTION: forcing a failure. [ 478.758075][T11458] name failslab, interval 1, probability 0, space 0, times 0 [ 478.771208][T11458] CPU: 1 UID: 0 PID: 11458 Comm: syz.4.1744 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 478.771234][T11458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 478.771247][T11458] Call Trace: [ 478.771255][T11458] [ 478.771263][T11458] dump_stack_lvl+0x189/0x250 [ 478.771298][T11458] ? __pfx____ratelimit+0x10/0x10 [ 478.771327][T11458] ? __pfx_dump_stack_lvl+0x10/0x10 [ 478.771355][T11458] ? __pfx__printk+0x10/0x10 [ 478.771378][T11458] ? __lock_acquire+0xab9/0xd20 [ 478.771421][T11458] should_fail_ex+0x414/0x560 [ 478.771450][T11458] should_failslab+0xa8/0x100 [ 478.771472][T11458] __kmalloc_cache_noprof+0x70/0x3d0 [ 478.771490][T11458] ? tipc_nametbl_lookup_group+0x793/0xc20 [ 478.771518][T11458] tipc_nametbl_lookup_group+0x793/0xc20 [ 478.771547][T11458] ? tipc_nametbl_lookup_group+0xac/0xc20 [ 478.771572][T11458] __tipc_sendmsg+0xe84/0x2960 [ 478.771618][T11458] ? __pfx___tipc_sendmsg+0x10/0x10 [ 478.771642][T11458] ? __page_table_check_zero+0x406/0x530 [ 478.771660][T11458] ? __page_table_check_zero+0xba/0x530 [ 478.771684][T11458] ? post_alloc_hook+0x253/0x2a0 [ 478.771702][T11458] ? aa_label_sk_perm+0x413/0x560 [ 478.771731][T11458] ? get_page_from_freelist+0x21e4/0x22c0 [ 478.771755][T11458] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 478.771803][T11458] ? __lock_acquire+0xab9/0xd20 [ 478.771843][T11458] ? __local_bh_enable_ip+0x12d/0x1c0 [ 478.771872][T11458] ? lockdep_hardirqs_on+0x9c/0x150 [ 478.771900][T11458] ? __local_bh_enable_ip+0x12d/0x1c0 [ 478.771928][T11458] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 478.771991][T11458] tipc_sendmsg+0x55/0x70 [ 478.772019][T11458] ? __pfx_tipc_sendmsg+0x10/0x10 [ 478.772045][T11458] __sock_sendmsg+0x21c/0x270 [ 478.772079][T11458] ____sys_sendmsg+0x505/0x830 [ 478.772108][T11458] ? __pfx_____sys_sendmsg+0x10/0x10 [ 478.772148][T11458] ___sys_sendmsg+0x21f/0x2a0 [ 478.772173][T11458] ? __pfx____sys_sendmsg+0x10/0x10 [ 478.772233][T11458] ? __fget_files+0x2a/0x420 [ 478.772252][T11458] ? __fget_files+0x3a0/0x420 [ 478.772283][T11458] __sys_sendmsg+0x164/0x220 [ 478.772308][T11458] ? __pfx___sys_sendmsg+0x10/0x10 [ 478.772349][T11458] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 478.772383][T11458] ? lockdep_hardirqs_on+0x9c/0x150 [ 478.772424][T11458] __do_fast_syscall_32+0xb6/0x2b0 [ 478.772445][T11458] ? lockdep_hardirqs_on+0x9c/0x150 [ 478.772480][T11458] do_fast_syscall_32+0x34/0x80 [ 478.772500][T11458] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 478.772527][T11458] RIP: 0023:0xf708e539 [ 478.772546][T11458] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 478.772564][T11458] RSP: 002b:00000000f507e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 478.772585][T11458] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000540 [ 478.772600][T11458] RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000000 [ 478.772610][T11458] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 478.772621][T11458] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 478.772633][T11458] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 478.772661][T11458] [ 479.091797][ C1] vkms_vblank_simulate: vblank timer overrun [ 479.387442][ T977] usb 2-1: new full-speed USB device number 42 using dummy_hcd [ 479.460726][ T3406] usb 3-1: USB disconnect, device number 53 [ 479.961252][ T977] usb 2-1: unable to get BOS descriptor or descriptor too short [ 480.135043][ T977] usb 2-1: not running at top speed; connect to a high speed hub [ 480.147942][ T977] usb 2-1: config 128 has an invalid interface number: 127 but max is 3 [ 480.156496][ T977] usb 2-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 480.167565][ T977] usb 2-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 480.176689][ T977] usb 2-1: config 128 has no interface number 0 [ 480.183183][ T977] usb 2-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid maxpacket 3876, setting to 64 [ 480.194750][ T977] usb 2-1: config 128 interface 127 has no altsetting 0 [ 480.208887][ T977] usb 2-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 480.224032][ T977] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.232728][ T977] usb 2-1: Product: syz [ 480.237003][ T977] usb 2-1: Manufacturer: syz [ 480.246444][ T977] usb 2-1: SerialNumber: syz [ 480.256274][T11460] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 480.281984][T11484] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1751'. [ 480.535465][ T977] usb 2-1: USB disconnect, device number 42 [ 480.938571][ T5935] udevd[5935]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 481.413902][T11496] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1756'. [ 481.604639][T11498] fuse: Unknown parameter '0x0000000000000004' [ 481.675639][T11503] vlan3: entered allmulticast mode [ 481.685326][T11503] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 481.987376][ T977] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 482.017617][T11517] netlink: 'syz.2.1765': attribute type 10 has an invalid length. [ 482.026573][T11517] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1765'. [ 482.169884][ T977] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 482.201564][ T977] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 482.212407][ T977] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 482.228659][ T977] usb 2-1: config 1 has no interface number 0 [ 482.241881][ T977] usb 2-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30 [ 482.263160][ T977] usb 2-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32 [ 482.279949][ T3406] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 482.295299][ T977] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 482.309769][ T977] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.324733][ T977] usb 2-1: Product: syz [ 482.333271][ T977] usb 2-1: Manufacturer: syz [ 482.342205][ T977] usb 2-1: SerialNumber: syz [ 482.439553][ T3406] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 482.454598][ T3406] usb 1-1: config 0 has no interface number 0 [ 482.463222][ T3406] usb 1-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 482.512579][ T3406] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.538411][ T3406] usb 1-1: config 0 descriptor?? [ 482.698518][ T3406] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 482.981070][T11534] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1770'. [ 483.039097][ T3406] snd-usb-audio 1-1:0.1: probe with driver snd-usb-audio failed with error -2 [ 483.084988][ T9253] udevd[9253]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 483.164109][ T977] cdc_mbim 2-1:1.1: probe with driver cdc_mbim failed with error -71 [ 483.829600][ T977] usb 2-1: USB disconnect, device number 43 [ 484.090323][ T5923] usb 1-1: USB disconnect, device number 47 [ 484.215293][T11547] fuse: Unknown parameter '0x0000000000000004' [ 484.224955][T11549] Cannot find del_set index 3 as target [ 484.318510][T11550] xt_CT: You must specify a L4 protocol and not use inversions on it [ 484.687986][ T977] usb 2-1: new full-speed USB device number 44 using dummy_hcd [ 484.808429][T11562] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1782'. [ 484.886248][ T977] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 484.903097][ T977] usb 2-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice= 0.5a [ 484.919254][ T977] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 484.938483][ T977] usb 2-1: config 0 descriptor?? [ 484.963422][ T977] pegasus_notetaker 2-1:0.0: Invalid number of endpoints [ 484.971092][ T5902] usb 5-1: new low-speed USB device number 38 using dummy_hcd [ 485.036885][ T977] pegasus_notetaker 2-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 485.077490][ T3406] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 485.143289][ T5902] usb 5-1: unable to get BOS descriptor or descriptor too short [ 485.354394][ T5902] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 485.364797][ T5902] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 485.392188][ T5902] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 485.435896][ T5902] usb 5-1: config 1 interface 0 altsetting 0 has an invalid endpoint descriptor of length 5, skipping [ 485.436107][ T3406] usb 3-1: Using ep0 maxpacket: 8 [ 485.458229][ T5902] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 485.484342][ T3406] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 485.491225][ T5902] usb 5-1: string descriptor 0 read error: -22 [ 485.519286][ T5902] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 485.534232][ T3406] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 485.543804][ T5902] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.564703][ T3406] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 485.579490][T11560] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 485.603859][ T3406] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 485.609989][ T5902] usb 5-1: 0:2 : does not exist [ 485.657715][ T3406] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 486.270653][ T3406] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.351615][ T5884] usb 5-1: USB disconnect, device number 38 [ 486.505178][ T3406] usb 3-1: GET_CAPABILITIES returned 0 [ 486.513703][ T3406] usbtmc 3-1:16.0: can't read capabilities [ 486.680344][T11583] ptrace attach of "./syz-executor exec"[5852] was attempted by "./syz-executor exec"[11583] [ 486.783679][ T5884] usb 3-1: USB disconnect, device number 54 [ 488.022137][ T3406] usb 1-1: new full-speed USB device number 48 using dummy_hcd [ 488.066968][ T977] usb 2-1: USB disconnect, device number 44 [ 488.239363][ T3406] usb 1-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 488.273317][ T3406] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 488.294048][ T3406] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 488.332574][ T3406] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 488.371357][ T3406] usb 1-1: New USB device strings: Mfr=8, Product=0, SerialNumber=1 [ 488.407966][ T3406] usb 1-1: Manufacturer: syz [ 488.417274][ T3406] usb 1-1: SerialNumber: syz [ 488.552592][T11613] xt_hashlimit: size too large, truncated to 1048576 [ 488.559850][T11613] xt_hashlimit: overflow, try lower: 9223336852482686975/36028797018968064 [ 488.713287][T11607] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.760887][T11607] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.812539][ T3406] cdc_acm 1-1:1.0: Control and data interfaces are not separated! [ 488.848037][T11621] sg_write: data in/out 209152/1 bytes for SCSI command 0xf2-- guessing data in; [ 488.848037][T11621] program syz.4.1801 not setting count and/or reply_len properly [ 488.879052][ T3406] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 488.924774][ T3406] usb 1-1: USB disconnect, device number 48 [ 489.312944][T11626] FAULT_INJECTION: forcing a failure. [ 489.312944][T11626] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 489.359449][T11626] CPU: 0 UID: 0 PID: 11626 Comm: syz.2.1802 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 489.359480][T11626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 489.359493][T11626] Call Trace: [ 489.359512][T11626] [ 489.359522][T11626] dump_stack_lvl+0x189/0x250 [ 489.359561][T11626] ? __pfx____ratelimit+0x10/0x10 [ 489.359595][T11626] ? __pfx_dump_stack_lvl+0x10/0x10 [ 489.359629][T11626] ? __pfx__printk+0x10/0x10 [ 489.359654][T11626] ? __might_fault+0xb0/0x130 [ 489.359687][T11626] should_fail_ex+0x414/0x560 [ 489.359724][T11626] _copy_from_user+0x2d/0xb0 [ 489.359748][T11626] sg_write+0x9b3/0xea0 [ 489.359792][T11626] ? __pfx_sg_write+0x10/0x10 [ 489.359865][T11626] ? bpf_lsm_file_permission+0x9/0x20 [ 489.359896][T11626] ? security_file_permission+0x75/0x290 [ 489.359922][T11626] ? rw_verify_area+0x258/0x650 [ 489.359960][T11626] vfs_writev+0x4b6/0x960 [ 489.359990][T11626] ? __pfx_sg_write+0x10/0x10 [ 489.360026][T11626] ? __pfx_vfs_writev+0x10/0x10 [ 489.360069][T11626] ? __fget_files+0x2a/0x420 [ 489.360098][T11626] ? __fget_files+0x3a0/0x420 [ 489.360123][T11626] ? __fget_files+0x2a/0x420 [ 489.360147][T11626] do_writev+0x14d/0x2d0 [ 489.360167][T11626] ? __pfx_do_writev+0x10/0x10 [ 489.360187][T11626] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 489.360211][T11626] ? lockdep_hardirqs_on+0x9c/0x150 [ 489.360236][T11626] __do_fast_syscall_32+0xb6/0x2b0 [ 489.360252][T11626] ? lockdep_hardirqs_on+0x9c/0x150 [ 489.360279][T11626] do_fast_syscall_32+0x34/0x80 [ 489.360293][T11626] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 489.360312][T11626] RIP: 0023:0xf710e539 [ 489.360326][T11626] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 489.360340][T11626] RSP: 002b:00000000f50bc55c EFLAGS: 00000206 ORIG_RAX: 0000000000000092 [ 489.360356][T11626] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000400 [ 489.360367][T11626] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 489.360376][T11626] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 489.360384][T11626] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 489.360394][T11626] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 489.360415][T11626] [ 490.127332][ T5902] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 490.269712][T11634] FAULT_INJECTION: forcing a failure. [ 490.269712][T11634] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 490.287590][ T5902] usb 1-1: Using ep0 maxpacket: 8 [ 490.308531][ T5902] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 490.327440][T11634] CPU: 1 UID: 0 PID: 11634 Comm: syz.3.1806 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 490.327472][T11634] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 490.327484][T11634] Call Trace: [ 490.327493][T11634] [ 490.327501][T11634] dump_stack_lvl+0x189/0x250 [ 490.327539][T11634] ? __pfx____ratelimit+0x10/0x10 [ 490.327572][T11634] ? __pfx_dump_stack_lvl+0x10/0x10 [ 490.327605][T11634] ? __pfx__printk+0x10/0x10 [ 490.327629][T11634] ? __might_fault+0xb0/0x130 [ 490.327661][T11634] should_fail_ex+0x414/0x560 [ 490.327693][T11634] _copy_from_user+0x2d/0xb0 [ 490.327717][T11634] ocfs2_control_write+0x1e0/0xb90 [ 490.327756][T11634] ? __pfx_ocfs2_control_write+0x10/0x10 [ 490.327792][T11634] ? __asan_memset+0x22/0x50 [ 490.327819][T11634] ? end_current_label_crit_section+0x152/0x180 [ 490.327857][T11634] ? bpf_lsm_file_permission+0x9/0x20 [ 490.327888][T11634] ? security_file_permission+0x75/0x290 [ 490.327912][T11634] ? rw_verify_area+0x258/0x650 [ 490.327949][T11634] vfs_writev+0x4b6/0x960 [ 490.327977][T11634] ? __pfx_ocfs2_control_write+0x10/0x10 [ 490.328014][T11634] ? __pfx_vfs_writev+0x10/0x10 [ 490.328056][T11634] ? __fget_files+0x2a/0x420 [ 490.328084][T11634] ? __fget_files+0x3a0/0x420 [ 490.328106][T11634] ? __fget_files+0x2a/0x420 [ 490.328146][T11634] do_writev+0x14d/0x2d0 [ 490.328174][T11634] ? __pfx_do_writev+0x10/0x10 [ 490.328201][T11634] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 490.328236][T11634] ? lockdep_hardirqs_on+0x9c/0x150 [ 490.328270][T11634] __do_fast_syscall_32+0xb6/0x2b0 [ 490.328291][T11634] ? lockdep_hardirqs_on+0x9c/0x150 [ 490.328327][T11634] do_fast_syscall_32+0x34/0x80 [ 490.328347][T11634] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 490.328374][T11634] RIP: 0023:0xf7f61539 [ 490.328392][T11634] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 490.328410][T11634] RSP: 002b:00000000f508655c EFLAGS: 00000206 ORIG_RAX: 0000000000000092 [ 490.328432][T11634] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000380 [ 490.328447][T11634] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 490.328459][T11634] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 490.328471][T11634] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 490.328483][T11634] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 490.328514][T11634] [ 490.348072][ T5902] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 490.895294][ T5902] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 490.906999][ T5902] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 490.937427][ T3406] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 490.953894][ T5902] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 490.983987][ T5902] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 491.058322][ T5902] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.123067][ T3406] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 491.154861][ T3406] usb 2-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 491.170237][ T3406] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.222486][ T3406] usb 2-1: config 0 descriptor?? [ 491.600526][T11630] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.613890][ T5902] usb 1-1: GET_CAPABILITIES returned 0 [ 491.625924][T11630] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.643488][ T5902] usbtmc 1-1:16.0: can't read capabilities [ 491.657562][ T10] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 491.659982][ T3406] usbhid 2-1:0.0: can't add hid device: -71 [ 491.698990][T11630] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.704179][ T3406] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 491.718048][T11630] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.744914][ T3406] usb 2-1: USB disconnect, device number 45 [ 491.822094][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 491.857594][ T10] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 491.883391][ T5902] usb 1-1: USB disconnect, device number 49 [ 491.899950][ T10] usb 4-1: New USB device found, idVendor=172f, idProduct=0034, bcdDevice= 0.00 [ 491.925963][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.957764][ T10] usb 4-1: config 0 descriptor?? [ 492.407825][ T10] waltop 0003:172F:0034.001A: item fetching failed at offset 5/7 [ 492.422276][ T10] waltop 0003:172F:0034.001A: probe with driver waltop failed with error -22 [ 492.557453][T11664] loop2: detected capacity change from 0 to 7 [ 492.574102][T11664] Dev loop2: unable to read RDB block 7 [ 492.580862][T11664] loop2: unable to read partition table [ 492.592785][T11664] loop2: partition table beyond EOD, truncated [ 492.599967][ T10] usb 4-1: USB disconnect, device number 59 [ 492.615521][T11664] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 492.935201][T11669] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1820'. [ 492.944791][T11669] openvswitch: netlink: Missing key (keys=40, expected=80) [ 493.083109][T11671] xt_CT: You must specify a L4 protocol and not use inversions on it [ 493.791196][T11682] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1824'. [ 493.921429][T11685] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1825'. [ 494.168033][T11691] [ 494.170413][T11691] ====================================================== [ 494.177436][T11691] WARNING: possible circular locking dependency detected [ 494.184466][T11691] 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 Not tainted [ 494.191582][T11691] ------------------------------------------------------ [ 494.198608][T11691] syz.0.1827/11691 is trying to acquire lock: [ 494.204686][T11691] ffffffff8f87a3e8 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 [ 494.215249][T11691] [ 494.215249][T11691] but task is already holding lock: [ 494.222631][T11691] ffff8881437c27c8 (&q->q_usage_counter(io)#24){++++}-{0:0}, at: loop_set_status+0x227/0xaf0 [ 494.232856][T11691] [ 494.232856][T11691] which lock already depends on the new lock. [ 494.232856][T11691] [ 494.243265][T11691] [ 494.243265][T11691] the existing dependency chain (in reverse order) is: [ 494.252290][T11691] [ 494.252290][T11691] -> #2 (&q->q_usage_counter(io)#24){++++}-{0:0}: [ 494.260953][T11691] lock_acquire+0x120/0x360 [ 494.265997][T11691] blk_alloc_queue+0x538/0x620 [ 494.271298][T11691] __blk_mq_alloc_disk+0x162/0x340 [ 494.276948][T11691] loop_add+0x41b/0xad0 [ 494.281633][T11691] loop_init+0x173/0x230 [ 494.286407][T11691] do_one_initcall+0x233/0x820 [ 494.291701][T11691] do_initcall_level+0x137/0x1f0 [ 494.297184][T11691] do_initcalls+0x69/0xd0 [ 494.302049][T11691] kernel_init_freeable+0x3d9/0x570 [ 494.307778][T11691] kernel_init+0x1d/0x1d0 [ 494.312638][T11691] ret_from_fork+0x3fc/0x770 [ 494.317770][T11691] ret_from_fork_asm+0x1a/0x30 [ 494.323095][T11691] [ 494.323095][T11691] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 494.330321][T11691] lock_acquire+0x120/0x360 [ 494.335363][T11691] fs_reclaim_acquire+0x72/0x100 [ 494.340833][T11691] kmem_cache_alloc_node_noprof+0x47/0x3c0 [ 494.347174][T11691] __alloc_skb+0x112/0x2d0 [ 494.352123][T11691] alloc_uevent_skb+0x7d/0x230 [ 494.357416][T11691] kobject_uevent_net_broadcast+0x2fa/0x560 [ 494.363841][T11691] kobject_uevent_env+0x55b/0x8c0 [ 494.369396][T11691] kobject_synth_uevent+0x527/0xb00 [ 494.375129][T11691] bus_uevent_store+0x115/0x170 [ 494.380508][T11691] kernfs_fop_write_iter+0x378/0x4f0 [ 494.386330][T11691] vfs_write+0x548/0xa90 [ 494.391111][T11691] ksys_write+0x145/0x250 [ 494.395963][T11691] do_syscall_64+0xfa/0x3b0 [ 494.401005][T11691] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.407429][T11691] [ 494.407429][T11691] -> #0 (uevent_sock_mutex){+.+.}-{4:4}: [ 494.415254][T11691] validate_chain+0xb9b/0x2140 [ 494.420546][T11691] __lock_acquire+0xab9/0xd20 [ 494.425762][T11691] lock_acquire+0x120/0x360 [ 494.430801][T11691] __mutex_lock+0x182/0xe80 [ 494.435832][T11691] kobject_uevent_net_broadcast+0x27e/0x560 [ 494.442343][T11691] kobject_uevent_env+0x55b/0x8c0 [ 494.447899][T11691] loop_set_status+0x4d3/0xaf0 [ 494.453196][T11691] lo_compat_ioctl+0x273/0x330 [ 494.458501][T11691] compat_blkdev_ioctl+0x5d1/0x780 [ 494.464158][T11691] __ia32_compat_sys_ioctl+0x543/0x840 [ 494.470164][T11691] __do_fast_syscall_32+0xb6/0x2b0 [ 494.475806][T11691] do_fast_syscall_32+0x34/0x80 [ 494.481185][T11691] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 494.488050][T11691] [ 494.488050][T11691] other info that might help us debug this: [ 494.488050][T11691] [ 494.498284][T11691] Chain exists of: [ 494.498284][T11691] uevent_sock_mutex --> fs_reclaim --> &q->q_usage_counter(io)#24 [ 494.498284][T11691] [ 494.512042][T11691] Possible unsafe locking scenario: [ 494.512042][T11691] [ 494.519514][T11691] CPU0 CPU1 [ 494.524904][T11691] ---- ---- [ 494.530279][T11691] lock(&q->q_usage_counter(io)#24); [ 494.535767][T11691] lock(fs_reclaim); [ 494.542285][T11691] lock(&q->q_usage_counter(io)#24); [ 494.550203][T11691] lock(uevent_sock_mutex); [ 494.554815][T11691] [ 494.554815][T11691] *** DEADLOCK *** [ 494.554815][T11691] [ 494.563062][T11691] 3 locks held by syz.0.1827/11691: [ 494.568263][T11691] #0: ffff888143b0f400 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_set_status+0x2c/0xaf0 [ 494.577685][T11691] #1: ffff8881437c27c8 (&q->q_usage_counter(io)#24){++++}-{0:0}, at: loop_set_status+0x227/0xaf0 [ 494.588365][T11691] #2: ffff8881437c2800 (&q->q_usage_counter(queue)#20){+.+.}-{0:0}, at: loop_set_status+0x227/0xaf0 [ 494.599300][T11691] [ 494.599300][T11691] stack backtrace: [ 494.605203][T11691] CPU: 1 UID: 0 PID: 11691 Comm: syz.0.1827 Not tainted 6.16.0-rc1-syzkaller-00203-g4774cfe3543a #0 PREEMPT(full) [ 494.605222][T11691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 494.605232][T11691] Call Trace: [ 494.605240][T11691] [ 494.605246][T11691] dump_stack_lvl+0x189/0x250 [ 494.605275][T11691] ? __pfx_dump_stack_lvl+0x10/0x10 [ 494.605299][T11691] ? __pfx__printk+0x10/0x10 [ 494.605316][T11691] ? print_lock_name+0xde/0x100 [ 494.605332][T11691] print_circular_bug+0x2ee/0x310 [ 494.605349][T11691] check_noncircular+0x134/0x160 [ 494.605366][T11691] validate_chain+0xb9b/0x2140 [ 494.605388][T11691] __lock_acquire+0xab9/0xd20 [ 494.605412][T11691] ? kobject_uevent_net_broadcast+0x27e/0x560 [ 494.605430][T11691] lock_acquire+0x120/0x360 [ 494.605450][T11691] ? kobject_uevent_net_broadcast+0x27e/0x560 [ 494.605473][T11691] __mutex_lock+0x182/0xe80 [ 494.605486][T11691] ? kobject_uevent_net_broadcast+0x27e/0x560 [ 494.605505][T11691] ? vsnprintf+0xe11/0xf00 [ 494.605524][T11691] ? kobject_uevent_net_broadcast+0x27e/0x560 [ 494.605543][T11691] ? __pfx___mutex_lock+0x10/0x10 [ 494.605555][T11691] ? add_uevent_var+0x278/0x450 [ 494.605574][T11691] ? kobject_uevent_env+0x50a/0x8c0 [ 494.605590][T11691] ? __pfx_add_uevent_var+0x10/0x10 [ 494.605608][T11691] kobject_uevent_net_broadcast+0x27e/0x560 [ 494.605647][T11691] kobject_uevent_env+0x55b/0x8c0 [ 494.605667][T11691] loop_set_status+0x4d3/0xaf0 [ 494.605695][T11691] lo_compat_ioctl+0x273/0x330 [ 494.605728][T11691] ? __pfx_lo_compat_ioctl+0x10/0x10 [ 494.605752][T11691] ? kasan_quarantine_put+0xdd/0x220 [ 494.605777][T11691] ? blkdev_common_ioctl+0xfc3/0x2450 [ 494.605802][T11691] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 494.605821][T11691] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 494.605843][T11691] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 494.605862][T11691] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 494.605879][T11691] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 494.605898][T11691] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 494.605928][T11691] ? __pfx_lo_compat_ioctl+0x10/0x10 [ 494.605948][T11691] compat_blkdev_ioctl+0x5d1/0x780 [ 494.605976][T11691] ? __fget_files+0x2a/0x420 [ 494.605995][T11691] ? __pfx_compat_blkdev_ioctl+0x10/0x10 [ 494.606018][T11691] ? __fget_files+0x2a/0x420 [ 494.606036][T11691] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 494.606061][T11691] __ia32_compat_sys_ioctl+0x543/0x840 [ 494.606087][T11691] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 494.606114][T11691] ? __se_sys_futex_time32+0x360/0x3e0 [ 494.606138][T11691] ? rcu_is_watching+0x15/0xb0 [ 494.606164][T11691] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 494.606190][T11691] ? lockdep_hardirqs_on+0x9c/0x150 [ 494.606214][T11691] __do_fast_syscall_32+0xb6/0x2b0 [ 494.606229][T11691] ? lockdep_hardirqs_on+0x9c/0x150 [ 494.606254][T11691] do_fast_syscall_32+0x34/0x80 [ 494.606268][T11691] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 494.606289][T11691] RIP: 0023:0xf707e539 [ 494.606302][T11691] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 494.606316][T11691] RSP: 002b:00000000f506e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 494.606332][T11691] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000004c02 [ 494.606343][T11691] RDX: 00000000800001c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 494.606353][T11691] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 494.606362][T11691] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 494.606371][T11691] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 494.606387][T11691] [ 495.004496][ T5884] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 495.257300][ T5884] usb 5-1: Using ep0 maxpacket: 8 [ 495.263643][ T5884] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 495.271156][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 495.282674][ T5884] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 495.294479][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 495.305585][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 495.319790][ T5884] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 495.327284][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 495.338574][ T5884] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 495.350273][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 495.361358][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 495.373749][ T5884] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 495.381399][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 495.393009][ T5884] usb 5-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 495.404806][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 495.415906][ T5884] usb 5-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 495.429866][ T5884] usb 5-1: string descriptor 0 read error: -22 [ 495.436102][ T5884] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 495.445245][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.459340][ T5884] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 495.664244][ T10] usb 5-1: USB disconnect, device number 39