last executing test programs: 5m13.451918756s ago: executing program 0 (id=1138): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000200)={0x0, 0xffffffffffffffff, &(0x7f00000002c0), &(0x7f00000002c0), 0xd9, r0}, 0x38) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x279, 0x80000) mincore(&(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f00000002c0)=""/41) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x14, 0x4, 0x8, 0x8, 0x504, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0xc0585605, &(0x7f0000000000)={0x0, 0x0, {0x6ef0, 0x10002, 0x3011, 0x1, 0x7, 0x2, 0x1, 0x1}}) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0xd0}, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) openat$uinput(0xffffff9c, &(0x7f00000001c0), 0x802, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000100)=0xffffffffffffffff) syz_emit_ethernet(0x8a, &(0x7f00000006c0)={@local, @link_local, @void, {@ipv4={0x800, @tipc={{0x7, 0x4, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @broadcast, {[@noop, @ra={0x94, 0x4}]}}, @name_distributor={{0x60, 0x0, 0x0, 0x0, 0x0, 0xa, 0xb, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x3, 0x3}, [{0x80000}, {}]}}}}}, 0x0) ioctl$VIDIOC_QUERYBUF_DMABUF(r2, 0xc04c5609, &(0x7f0000000140)={0x3ff, 0x4, 0x4, 0x2, 0x5, {r3, r4/1000+10000}, {0x5, 0x8, 0x7, 0x0, 0x9, 0x3, "387619d6"}, 0x8, 0x4, {}, 0x1, 0x0, r5}) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @last={{0x9}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_USERDATA={0x23, 0x7, 0x1, 0x0, "dbaebba9ffbf265781949468b4fdbe742d1c981d88f55fac6cb28abf2fce9a"}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x1}]}], {0x14}}, 0xb4}, 0x1, 0x0, 0x0, 0x50}, 0x0) 5m13.362747427s ago: executing program 0 (id=1139): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f00000004c0)={0x18, 0x0, {0x1, @random="dffcc2101e34", 'vcan0\x00'}}, 0x1e) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x1, 0x0, 'queue0\x00'}) write$sndseq(r1, &(0x7f0000000280)=[{0x84, 0x74, 0x0, 0x0, @time={0x5, 0x1}, {0xfd, 0xfb}, {0x6, 0x3d}, @raw32={[0x2, 0x7c, 0x8000000]}}, {0x2, 0x4, 0x5, 0x83, @time={0x1, 0x1}, {0xa}, {0x0, 0x8}, @note={0x81, 0x0, 0x0, 0x8}}, {0x6, 0x3, 0x9, 0x3, @tick=0x2001, {0x10, 0x5}, {0xd, 0x2}, @result={0x8, 0x2}}], 0x54) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xa8c01) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000100)="64738c0b4aa5f981785254a9eb", 0x0}, 0x20) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x6ee80, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000440)='loginuid\x00') pwritev(r4, &(0x7f00000001c0)=[{&(0x7f0000000000)='0', 0x1}, {&(0x7f0000000040)="03073a", 0x3}], 0x2, 0x0, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f00000003c0)={0xa, 0x0, [{0x942, 0x0, 0x7}, {0xc0011132, 0x0, 0x8}, {0x902, 0x0, 0xffffffffffffffff}, {0xabd, 0x0, 0x5}, {0x20, 0x0, 0xfffffffffffffffe}, {0x483, 0x0, 0x400}, {0xa6f, 0x0, 0x1}, {0xba0, 0x0, 0xff}, {0x2eb, 0x0, 0x4}, {0x488, 0x0, 0x8}]}) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r5, 0xca, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x1f, 0x0, 0x0, r3, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) write$sndseq(r2, &(0x7f0000000080)=[{0x1e, 0x0, 0x8, 0xfd, @time={0x6, 0x9}, {}, {}, @result}], 0x1c) sendmsg$inet(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000800)=[{0x0}, {&(0x7f0000000500)="e7", 0x1}], 0x2}, 0x400c8c0) 5m13.015286972s ago: executing program 0 (id=1140): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x42, 0x3}}}, 0x10) bind$tipc(r0, &(0x7f0000000040)=@name={0x1e, 0x2, 0xc5d116e9899720b9, {{0x42}}}, 0x10) r1 = syz_open_dev$vcsu(&(0x7f0000000280), 0x6, 0x18000) bind$tipc(r1, &(0x7f00000002c0)=@id={0x1e, 0x3, 0x0, {0x4e21, 0x4}}, 0x10) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x136) mkdir(&(0x7f0000000080)='./file1\x00', 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) socket(0x80000000000000a, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CREATE_PIT2(r7, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0xfffffffffffffe1b}], 0x0, 0x4498bda7e2139f37, 0x0, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_PIT(r7, 0x8048ae66, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000140)={{0x1, 0x1, 0x18, r5, {0x100000000}}, './file0\x00'}) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000000)={0x1, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x2, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0xfffffffffffffffe, 0x6, 0x0, 0x200004, 0x0, 0x2, 0xfffffffffffffffc, 0x1], 0x80a0000}) ioctl$KVM_RUN(r8, 0xae80, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x1) ioctl$KVM_HAS_DEVICE_ATTR_vm(r2, 0x4018aee3, &(0x7f0000000240)=@attr_other={0x0, 0xfc1, 0x1, &(0x7f00000001c0)=0x6}) 5m11.80777396s ago: executing program 0 (id=1146): renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x2) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xb, &(0x7f0000000040)=0x10001, 0x3c) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x2, 0x1) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000280)={0x3, 0x0, 0x9, 0x3}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x28, 0x12, 0xa01, 0x70bd27, 0xfffffffd, {0x80}, [@typed={0x14, 0xa8, 0x0, 0x0, @ipv6=@remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000050}, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000040), 0x6, 0x2) ioctl$vim2m_VIDIOC_PREPARE_BUF(r5, 0xc0405602, &(0x7f0000000480)=@multiplanar_userptr={0x0, 0x1, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "023d2134"}, 0x0, 0x100c, {0x0}}) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x9, 0x2641) ioctl$LOOP_SET_FD(r6, 0x4c00, r3) dup2(r3, r1) ioctl$sock_qrtr_SIOCGIFADDR(r3, 0x8915, &(0x7f00000000c0)={'vlan0\x00'}) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r7, 0x84, 0x8e, &(0x7f0000000000)="8a00000000000000", 0x8) 5m11.391957028s ago: executing program 0 (id=1148): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x10) read$FUSE(r1, &(0x7f0000000e40)={0x2020}, 0x2020) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000040)={0xd005, r0}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) ioctl$TUNGETVNETLE(r2, 0x80086601, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002e80)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="1709001000000000000001000000050007000000000008000900e400000014001f00fc0100000000000000000000000000000600020000000000000000010106001d00018000000000000000000000000000000000008dee07d330b3d162ad15d1f4e06d23f3406bba36b9d6f4a1eeea1c5770b592307d9262bbfd237752d5fe714d3f30285785edd588ad5b5a71d1d48f8f85745b97a7b057ba76d2441f8ec8c0c75d24f91731e42d0d35e56bc96b31fa8661b1a00306021edf2b7f8fa816435d21188d95f38639b49317a98194f543aa7abfd0ce545a6ce02319ab9a9c97bd7bc7ef10da2be6a4f1744973f5f10eb8aabe639f9487c07ded005f68d432defcec2b93acc141f768860a1c51763ec4b2559b53d6e050487e35476a3fc3e91ab0e536c03f5f1e504607f6ee6d8410f3b61bfe10033375e3efb5c08f01fc6a"], 0x5c}, 0x1, 0x0, 0x0, 0x44}, 0x0) write$UHID_INPUT(r1, &(0x7f0000000280)={0x8, {"703f04b8c68d35bf3ae9a32a51816360fbfa52a675251e81365834919e1c29930ad8efc0d386bc01606cd065f066708f993b62563d04752a9f8ed1444ae917a8586d403b195513e0aa0038cc22111d1b8e23985afd5453d769c678563fda24d05b7f944a2dbb7f33c6b6886006c4ff5dfcbcf6fb0673dc596723db97b1c26ed1ee2dbcbbbf8ef98e87c784ff17b4b2d26687e0ce490ebb444225c5eb193e4a6b8a63865eb2601a3fb9e1227bbd1bbadd6c6ce29a787623adbd5fb818e6cc9729b6fb3384e2c8f6ee732ea3c422585eb5dec0f5614bf85e53ced8e49ce125a47715f49ce8ec82ecb64b9af8668b2b79938d1548e298f008191c9e8ac6ee97f8478fdc3867206b2b9bfd060df10f4653af27cdc8de31172cae34549ee80c0ad79784d0c205207bee408bc4e736cc6cd5e6baddeb83c4afac1d18133cc616b8abfef3c0a4dbc3ca0fb22d7fd204bc4e88e6d32b3b688d03ba5f538eac229a84522bfd90d049cb4b704dd0f6afc6716a1972fe20083de94ad0fc3fee6f2498421e31392437d5a3b10e540fad549aca368b97b2c6c9fe389c9d00e800c11da44fcdb61b485c899ad5a2668ad66502af9b1227eb5d3bc9f5f6a63248b68eb8b0b8e90e44ded13c28e84aaa63e74776c61b03f7c0dc261965de8325a8040bb47e39d67f66ed2c10dfca9305ddf9a5415c8541943a82c8f379fde9a022d0e8975e74603a2e3e3390b27446850d483f8afb826635d27a6b1fdcab4dfde2393b9cd15e42efd7063374119d6cc92f8a644b4c2f1b28ce09117e1d13c53d8cdc2d0200d81ba865bd594c415f68046585d6b59285ba2f23dd8e0528963213edff7e82e429fcf926d8e301f5c2c2f548f6b9fea3fee44d264f37456fe9cda6a505884ee29bfe234aeee0dcc4a64c316910545f8b09d2b86d9b7b74da19dbaee2e0f19f84e2dfe404f302e3544b7c480021cde32fc26b5bd9b4a259deeead0c2d022ca5dcd36c6da680a86985742a6ce8d117957caf16e5ca3adad7b00442b1cd3f7ef83835ecf1257d97e6a75e6c0bec2d042268300b3c0746bc761e9b0fd52aa2e5bf7fa7f1ccf7c1e07b54943ca282454ca5b31851cda710d8ab07d62204e4c660255792ac1c3006fe4de7d399c02c85fe5ef4301321b0cc677f6c6ff03ba214274670f1a7301d6af1fd010aca10d88542b82d796ba8beae9ff13c497984a3ef4bc54c8bcd4a0b5b44af715331301afbf08dc937d924c7eeb615192270f74ae7dfc5097b95691de95557c15e2a586a8d3b55bab881b8013571a48b70c36444a6d66a183707c57811773e3ee9cb092db4e4aded0dc8b30f3f5b8fe60fabcfd7ad44686881ee68ecaafe6ea44e3c7d03dcc99d10f6456b8dafbd91b456716a5a58f6afd79be14f0902107d88bf59515f22d9492fc4cc9fb8ef7bd082455e550bae4ba87235e7278563d0574cc1019aab90a5945b92cedd2a338bd572fac6855911fdfd5e9c2796ac784c0194518086eb2b3c27405a8a6df9571f632b6bf841c5383a7c97caaf790edddc47490074cd34475583ccb285e1b2e65e6bfaeaaaece1c01ca12d8eb499e6f13e526683ce86cde27a4647b2c0a0c4767a215abf5114695697c1ec0b27b02afb62c7b285eba081af322cf524a463722f67726b869bb634988f3c2dd560e7765a82b304f37529e91b5b68f0d3662aa207179fd471fdb908ab37c8d7e907ee8bf2405152a904f3c590ace7664cce14b824f06d5871f4e1828b2bac390e1990596e8b81370087da7aaeb882b9a9544eea8476eb97646d3b3151c15e2b0ea8d093bad2d01cfe8d5f76d9927a6add91c1dc28bcaf45f9ce2f9dd8368167c7ff755dd29c104a9d66af5670a67aad7481f1d0864ffd06d6034ec56a24745d2d4cb0ea903dc7c19876e56fc95aa2ada307b7c0cb54fbe359d59f6f1a06d52bbe7f7ca39361b200378c2d322e66cfba7e5c5baabf9c45298988b24c2d07d1d9f4cff1a6c3c362f5f4807e9a67b48cf2002cd77d927acf37a3c08eb5a8f5a31d9c55c1ce642c687c3596733b7751bdb6987e1e95164cbffc7d78181835e0a7f4bd1d7186e7b789f206a117b4f8390000b10dcedd42085a73c3a04edaa555b563fbb6ecfe0d7bb1cc82ca5f6ebee1e664bac71ac5cb1316f2fb64cc815019d1b9c06fcd6061c3b5d4626e9af015ffae6bf4c1b70fef4ab9dfc7cd650dbb41fafb58467e6bdb9661fe8177d10b66764678ad338d251b645067bb07c1074d207e158ec38bf4e104d8bc5f2762719fb4533829cd049f6660bf0c20ed8294ba71cdd894cb8d1a9122a0bce5f3813015af6168fa9ba9af2e69d4acc6bde53e2f2bc46ce11408d4f7c03197aa0f74de8955482b6461c848c526efcded3645b6d4e44c57a17a3bb55ad9c4cfac71f5d50a2cc255a27e07a72cd027532722773458197e4b6a326410d468b342cb0345fa927c2859b55ee2e801091249431a0a6d4cba250b276237c93f09bbdf5f6321fd0cd14bda075f281b6680e7376739fef8fefb0ebcc5a13d75487e170a67244ee7dcb909a420eb12d478019726d21c764627ded79772e24daa50409d62e3ba93f5baa2a747c96dfea25c49eed3f363fa5d3712af54913d8dfcb19c9c50ee968270c0cfd9286addae106acc9c3d299a59b432fddf62e1f960bf71367dbe9a80645b2634dcaa6a55a8b5d740679a8a14905a669617296770f97c4b3eb37113751456e5aad838edd3e58f23f4c6089af8d4de02fdb27678144b58858ce88743d3a50e117791f05e0347000056bc1da44ce110dce05780d51f219b08ded05fdf5454a59a28d4fda8c6dc24ac19923ccb7e50730264561c29a604a5ac63fe06cac1b47222d8ac2538ffe0c9440e415ea0ed19caf3b0eee72fc92e8d47cffc1dcddb747649bbb1a73ae43753c2077b9482803d84c783aec7c29271fa8c02f39ec7e9d16f8027de88a541bf8fb2aab460023295384b7006a3fdb66c0b1e0d15719d52d2b93e1d776a1cac03580fc88f98b5ba17d38a91889a97373e10d320a1feabc48a6fb3e169d32498084f0a2a16448bff8e1f9c202f35f0e9c1844b393fe9115c20f6d0ad0fc45df59514e19ca66f79d57d617763c067fc79c7c794fcb0252ffd6974925536dc437db3b2b945990874c6675f80de4f25bcec73cc28a912a210267cf6bf3e48511c7fce4f04dd8b961cc59384d15f94b511b19ad4e4deb13c4c3f5ddac94b90ba7ef1eecacc9b30ec3c0f7888566f2f4ea074b43ba308ddedcf96c324f7b606916537705b5d6f22243f450fcd8fc7071cd99ff40bbc764a4698c87bd000efdd6325a47a73039e4b37b8d2571d2aa63306eadc0bff996d8a13c42430a20a964a0e0326d1d28b06457daa9c4bd0b44cd93d0c59224bd727d2f6bd04a2f38d9335a985aa0cb6116a46731b210ab24d8a79dcb671435990a78dfaff1ff548c24468f9a3ef8c1ecd3a0c324c0bb957098001a002eaf247b17dec9405fc453d30508c2a44aa8932933039dac089b29c7172b717d5a43d25e936043489d9218d935d88ba7b65a14b0d90439db6a180e38dd668b0c115fc1a8eb84f9f0c301c782ea9988289f740bec8abe64b34201e5fd77cc108cfca4a7457b52374bfe11e8900e7608ea7da7abd9160258239b0a69f044e37dbb087d279392ece017894ebaaf563c4afe2b6c3a1254eb315c5e93b7e34570c06092a4a26d702a416f96d447af5d6cc6b06cba54f0ddacc2b01ddef2352f87e79d731b419a1882313591f12948b66f4142143ade45352bc5577fa8869773b5bf83bf7a498b904090e5dec918ad92c131e1e7601f50344078f2c945840b9c8e765af0ffbaa2be2aba9841ec4f87581ea1d4d0543020f4015a24f1ccfcfcfb9ea236182ba5c52352fe59e4bf8657edb46dbb0def4474fff7b903417f8beaec39379a33de9ed844c7a55f9d69851909c9bc5a6572addb73427c8748a9193dcef1094fb51bed5ba79d016499e94b1b50e580585837c03baf0bd973a26419e67500d1c7a1ba7a367a30236a8b6a665de4da0535a7fd6d756c5c4ebc70c18bc0a8919d6607c8aa87fd68bff5422c304cac4118af8f7f417c207eee12571f69bea25256cdfba064958ebc89bc1c401e6da588ae4b1478c1289c3ac635868eca25c9382cdb3164f695a9d99551df3ca8959549e819db56aa736053cc1e0b40abb310d32fefa29759a638d58ccb45c3662d703d7ea8c81e287b171605645cfef79454ebef7776f511a29e237d2a6f1105c63046270cd6e39cbc799a84a07a8fd45f0f7b7fd4df33885efdcf97aaf295fba0216bc36692f5bb627907ec660b32da2d1923c9db0989edb5ba3c92dc4b9c8c2e36819553f84835205f453919ffb3b06246c252eaac2a8653abe2547715cb3d5fcf00a89821b66b434ab41b8d82999333c46fd626957996590a564d11be3844766a20ba3cea13a53536622c02073829b808bcce154426c4bcce57cadc343fbf6834ab3cd465a7897a97e6d024c6864063511343a6b83c0c64057c525f74413e1062042658477b774b80eb35e3e5971ffe0665ba7abe7dc41aadb1b352e252f0091fd7938c9a07983752fb859a9a480895b557dae1c419a830fd484b97558647bdf3963e03b2453a46ce638aecd2e5b8797bffd9d677206f2d0d0a705379833d7710316d5734ee93bcaf76c260f076a1983e97c6b4664da8799d33a03e525aba223bcb089a3f39bae1b7145184a9389977bce8c7bd8fae1d68735d9f1dc9761b9e16a48d60d9f0af865b64e595e691a61988f6aaec66b08eb00ae003a8e707a2acfd70ca4ba93345199b86ed85cad766136763707f48d76f5cc247c6b5eb52437a9d8915264d146263c8a7db7d304e2624690672de8edfee03babb416b9f3cd4253d6648fb9425b178c05428d3210001e6b1ff7a3e20f1f374b430d0781025d3bc3f2f1539fa0ff9f4998bc40a724c01925b76959f3cfead16f3dcb7a1eab8a5ae1e5392ef6a8532347bc38dd2262fac00e620716f68a8eae42053b55a298b7b5dc35409a53d21a3cf70d9287ba425364e4a40111ffe9e84cc922c321824569411c5bd408ec28eb8bf8f92a80d2d59ef1f1e1b327f8f40dc5905244ec0a5af0ed9cdd3e5ae911c5a96f2f80e09ad9dc51b1996796c94524f9d55e30fe82be241c7854c5d3dd2221307c7e7560edbc124cbc0c74bc3d596e8ff463e53392246f5ac94f81b58c78df7ce91fb51b6699bb48a4cf073c140c3781e561d1ee1387d9de53501ae9484fa2328b7c648d4052270a895139cde653a7ebbcf0d65e71b65766c176c3c6451c62739d6d032e7b039edec790d346950beccc84c6457f84a21b4463d884b0b36c66934fdc4018e282b1c06c161fa4b2b76f937b0de23021364300e151c78b8eaeff47bcf56479ae1397981b37ddec822f14c4181243c1ade942e5625dddcbb2796d5e7c817c6cc503cec5969a0af04987acfb607db39fd837507e2a55c1ee4c4c997aabc801111a65e287ac997aa6ccef04967a1635b779ceb04e55c76edbe4b280eef042923f06ecd7a706f4c00c37b7aabb04b6815b86995f35086c9617b0d80789003a7b30c71cbceb2955cba4716d4e66b2c31091b2c8539db3eda614db1e059c3733ba30582de9716dbdfee155513ba0e18bb6f3fdbb7cf7e195f5f3601aa441a32bc9320ce8188eddf97db753bc122e9819d862e39f3b48b759e23817db322957027d1983660561d5cb056c9eb24ca13f04f3f90bb0c50496d0a5d9e70dcefb98be9a14402154ae20d9f5a99baee5", 0x1000}}, 0x1006) 5m11.139265679s ago: executing program 0 (id=1151): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='io\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newaddr={0x20, 0x14, 0x503, 0x800000, 0x25dfdbfb, {0x2, 0x20, 0x56, 0xff}, [@IFA_LOCAL={0x8, 0x2, @loopback}]}, 0x20}, 0x1, 0x0, 0x0, 0xc090}, 0x48006) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0xa, &(0x7f0000000040)=0x6, 0x4) setsockopt$SO_BINDTODEVICE_wg(r6, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) listen(r6, 0x2) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x62, 0xa1, 0xb, 0x40, 0xc45, 0x1010, 0xe6fc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x32, 0x0, 0x1, 0x97, 0x40, 0xa4, 0x0, [], [{{0x9, 0x5, 0x82, 0x3, 0x3ff, 0x0, 0x7e}}]}}]}}]}}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000002140)=""/4096, 0x1000}], 0x1, 0x141, 0x0) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x3, 0x0, &(0x7f0000001100)) 5m10.224356115s ago: executing program 32 (id=1151): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='io\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) getpid() r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv4_newaddr={0x20, 0x14, 0x503, 0x800000, 0x25dfdbfb, {0x2, 0x20, 0x56, 0xff}, [@IFA_LOCAL={0x8, 0x2, @loopback}]}, 0x20}, 0x1, 0x0, 0x0, 0xc090}, 0x48006) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0xa, &(0x7f0000000040)=0x6, 0x4) setsockopt$SO_BINDTODEVICE_wg(r6, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) listen(r6, 0x2) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x62, 0xa1, 0xb, 0x40, 0xc45, 0x1010, 0xe6fc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x32, 0x0, 0x1, 0x97, 0x40, 0xa4, 0x0, [], [{{0x9, 0x5, 0x82, 0x3, 0x3ff, 0x0, 0x7e}}]}}]}}]}}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) preadv(r0, &(0x7f00000000c0)=[{&(0x7f0000002140)=""/4096, 0x1000}], 0x1, 0x141, 0x0) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x3, 0x0, &(0x7f0000001100)) 9.60132215s ago: executing program 5 (id=2456): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000000301010400000000000000000a0000002400018014000180080001"], 0x38}}, 0x0) 9.360062366s ago: executing program 5 (id=2458): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000140)={0x2, 'hsr0\x00', 0x4}, 0x44) 9.227364937s ago: executing program 5 (id=2459): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380000006800010000000000000000000006000b00080000050000000000100000000000000000c3ad5ee93354add035857593000908000500aa7654e08741e66a54", @ANYRES32=r2, @ANYBLOB], 0x38}}, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r3, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = open(0x0, 0x80ff, 0x88) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000000000)=0x0) timer_settime(r7, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$char_usb(r4, 0x0, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) set_mempolicy(0x3, &(0x7f0000000100)=0x3, 0x9) r9 = socket$kcm(0x2, 0x200000000000001, 0x106) r10 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0185647, &(0x7f00000001c0)={0x990000, 0x4, 0x400, r5, 0x0, &(0x7f0000000180)={0x990966, 0x800, '\x00', @value64=0x5}}) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x50, 0x9d, 0x10, 0x40, 0x61d, 0xc170, 0xb188, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xd4, 0x0, 0x0, 0x4b, 0x72, 0x86}}]}}]}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@newqdisc={0x43c, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x410, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0xfffffffc, 0x0, 0x7, 0xd59, 0x0, 0x93b5ec6, 0x6, 0x9f38, 0x6, 0x1000, 0x7, 0x4, 0x7, 0x2, 0x400, 0x9, 0x4, 0x4, 0xff, 0x7, 0x9, 0x4e7d565b, 0x5, 0x8, 0x5, 0xba4, 0x3ec800, 0x5, 0x63, 0xf8000000, 0xea, 0x0, 0x1, 0x6, 0x7, 0x7, 0x1, 0x5, 0x9, 0x7ff, 0xfad, 0x4, 0x8, 0xc, 0x2, 0x2, 0x2, 0x9, 0x6, 0x8000, 0xe, 0xfffffffb, 0xfffffff8, 0x7, 0x2f, 0x8, 0xc5906a9, 0x7, 0x9, 0x8, 0x7, 0x2, 0x0, 0x10, 0x9, 0xf, 0x4, 0xad, 0x2, 0xff, 0x3, 0x6, 0x6, 0x6, 0x2, 0x7, 0x5, 0x25, 0x0, 0x80, 0x8, 0xcc4, 0x5, 0x5, 0x5, 0x6, 0x1, 0x4, 0x4, 0x400, 0x5, 0x1932, 0x9, 0x16, 0x9, 0x3000000, 0x6, 0x1800, 0xffff, 0x86, 0x1, 0x38d0a22e, 0x53, 0x2, 0x4, 0x4, 0x2, 0x5, 0x3, 0x1, 0x19, 0x4, 0x80, 0x5ef, 0x1ff, 0x4, 0x0, 0x4, 0x8, 0x2bd7, 0x1f, 0xffffffff, 0x5, 0x10, 0x1, 0x80, 0x3, 0xf692, 0x4, 0x7, 0x1ff, 0x3, 0x7, 0x6, 0x3, 0xff, 0x1, 0x80, 0x1000, 0x0, 0x8, 0xf5ba, 0x5, 0x9, 0x6, 0x5, 0xe17, 0x2, 0x4, 0x8, 0xff, 0x9, 0x8c, 0x3, 0x3, 0x8001, 0x2, 0x6, 0x1, 0x2, 0x7, 0x40, 0xb, 0x0, 0xd, 0x0, 0x6, 0x3, 0x7ff, 0x0, 0x400, 0x400, 0xc4, 0x0, 0xfff, 0x5, 0x0, 0x2, 0x196, 0xa, 0x9, 0x6, 0x9, 0x8, 0x6, 0x1ff, 0x1a8, 0x0, 0xfffffff7, 0x7, 0xffffffff, 0x9, 0x7, 0x7, 0x6, 0xf4, 0x2de622c9, 0x100, 0x2, 0x5, 0x7, 0x3, 0x8, 0x4, 0xfffffff8, 0x7, 0x2, 0x1, 0x1, 0xea5, 0x3, 0x3, 0x2000, 0x1, 0x9e, 0x0, 0x1, 0x9c0, 0x4, 0x1, 0x200, 0x80000001, 0x7f, 0x2, 0x27b, 0x80000001, 0x0, 0x4, 0x0, 0x3, 0x7, 0x7, 0x9, 0x6, 0x7, 0xcc, 0x1ff, 0x5, 0xa, 0x8, 0x7, 0x8, 0xbae9, 0x5, 0xfffffff8, 0x0, 0x51, 0x2, 0xf0, 0x9, 0x2, 0x7d, 0x2, 0x7, 0x1000, 0x9]}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$nl_route_sched(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=@newqdisc={0x48, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffe0, 0xa}, {0x1, 0x10}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x9}, @TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x80015}, 0x4000) sendmsg$inet(r9, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x34004000) setsockopt$packet_tx_ring(r8, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc, 0x2000000}, 0x1c) write$char_usb(r3, 0x0, 0x0) syz_usb_disconnect(r0) 7.36727615s ago: executing program 4 (id=2468): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) bpf$MAP_CREATE(0x0, 0x0, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) signalfd(0xffffffffffffffff, &(0x7f0000000180)={[0x1, 0xd8e]}, 0x8) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x2, 0xffffffff, 0x0, 0xb49, 0x9, 0x8}, 0x0) r2 = socket(0x27, 0x1, 0x2000005) setsockopt$sock_int(r2, 0x1, 0xb, &(0x7f0000000000)=0x2, 0x4) bind$inet(r2, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r2, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000015c0)=""/127, 0x7f}}], 0x1, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) r3 = socket$inet6(0xa, 0x6, 0x6) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000000)={0x500, 0x0, 0x0}, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x0, 0x1000, 0x0, {0x0, 0x1}, {0x48, 0x2}, @period={0x0, 0x0, 0x4, 0x0, 0x0, {0x0, 0x0, 0x4}, 0x0, 0x0}}) r5 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) write$char_usb(r5, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCSCLOCKID(r5, 0x400445a0, &(0x7f0000000340)=0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x4}, 0x0, 0x0, 0x1}, {{@in=@multicast1, 0x0, 0x6c}, 0x0, @in6=@loopback, 0xffffffff, 0x0, 0x0, 0x4}}, 0xe4) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c) r6 = socket$key(0xf, 0x3, 0x2) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0xae03, 0xbe) sendmsg$key(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYRES64=r6, @ANYRES8=r4, @ANYRESOCT=0x0, @ANYRES64=r3], 0x10}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 6.920278038s ago: executing program 4 (id=2470): unshare(0x22020600) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) connect$inet(r1, &(0x7f0000000280)={0x2, 0x4, @multicast1}, 0x10) sendmmsg$inet(r1, &(0x7f0000004540)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x7e1f, 0x0}, 0xee0000b0}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001100)="15b26f226e2966667482d50903b0a8d92ccd9e69d5cc4cb3d467a670b237a9225fb56c0f7ea725dee27c4bb43bb50c6748c83b71d59f0537405dfab648c096607340fac939a2efd31cbe2f8ca29c409e87ea0974b7bceff9afef5d07d691575f5115f2f961ad488e3386036913e98181a6034febaab853a3e928b9035b0e3a8e1cb393c70f6d0448970e0af2476f8b923ee09c19deca55d58f70e8eeff55dda6381cb96afe97196c0af0a8fd450a1447a1a521e2c211fb84cbcf4aebd31298972ec6bea1764fbde5500fa30c5f2459cff4d7f123ab94cfd5762d586ec7a28abc2f8c9e608f8f964b96ecb0883d60d444f317834a3d734cb304051a60d1a084a84da8f9a23a1b9d4951c0a81985c63ae193f40e9deb358b2f08553324fd6086be9e70e5061568abefebcda50e70f4dab2e4dc0cf6d85aced044d7005326922886194895267165f7f592036ebe11dcf1cad98f5cda766eaea90fb4cb5e793525126c7594f8599055192d63a81d3cd26aadd50983f1c3f1d4655c1b5f59e80f733e3abc4792b760729fd26298ef15141cf76cc4", 0xc3}, {&(0x7f0000000d80)="7d68e6de85f9b0cbc9d710267f321ec64eab043ecad9af7e01e9463218ec45924a99867163e468d36a682fadd749caa325e685d75559a87139e02fae7271be8f55671cfd32a09896278d1941370174720838039d0989bc3394b8a4c4f4a30f0496be313d6d60fe47966c634a3ee1f659e8ef310647725bda0130d5de5028220a4cf5fc808a75694738ee26cb21302b4bba4265b845a5d5dce706d9820c6936b122f9658446d74a9016b94424971dd443a6907eb5c73b6b200e92b23f2c36a214729b0bc231511e4c", 0xc8}, {&(0x7f0000000380)="73fd71361e8d6c80ae1bc9953e2a4aeac7a314273066fc7f65a51969b46df1774bb0be94ccd4824f2d57ad2cd37242b1258402395481f9f07e067652e52aa8ccefcd0962ba0c48757b68d493f3ad702e65d4daa7dfc1605a173185472ae12470eea64c70ef4e64793b8a830447de0f423bef3964934eef4243cac42939ba6fa68d821b9373b5f3e2c26e7ca75ed8fb3203aef3a6637cecdd0251532b99537e02f604058f50e66c8a657d59beeed127695475f082d3d2b9790181fc987ad000ac00887d1506be89f388ecb405660b4ea196ee8f5a92b12ec43bbf49567db613d478ebe2358364f7600bf4f80ef4b2756fb13416c4fa22880cc96a03f07888575aedb001d5a74bb2f906797912b5ac080a0a3d361425f1a92ab03bbe65d5dcb235f43b5ad1162a16ebdc647baac013bf076945126cdd5a080853976a97ad55184601102fbb8df86b21aa8162858d74465c5fb7dc766602a3567f6eaf441f85ec50ca7fb3a4fdb450d1420531da25d01a412958a5e3895c59542238cf8e188e7fb5641eb24a5f1819bf8d2e9dd6c1d0e93564d723e311db9cd268bb1e477036e822b135cdbaf40f812aa7db01d22c829ab01ae24997dae96ddeed49e62d285701d5419e3f94a8b95790cf5a296ed15bffae1f71470c6a6eda872528844a2df42590d898630263cab5cccec57b7cea365ad8c91bfbe7cb419635ce6bf340a56115c0ad922b6fade9538e543bc5def2a85d35ab16d20c219c4733837be2c14ba4d3d32c3a6882ce6857626f55109b4cdcb634425d710bf3108f9b31b4af0cc17a58e49e871a56126dd8bed08e038ba64008587237b3442d28032e52fc9fae1a5784ba59d0edfa03d38352724903ed6f6970b3f4dfa6e40bf933b6765c6ee648174765f1e8ec71b80cac86abd065a3005b40a43a665707cc590997c5048183006a9dd8026d39def05950183b3d4f12f4e1644ef78cddac7c5569985c2c232bb350f28857675339e53f63a868704d2e0b38993dc57a02d3e297fc9a5b9384622841018c303a05bac25d509df5a2d0e3232927283fcc3ec67e4fa7b71d22f115cf693851dcceab4bce38cbfbb32829e211cdcb6a359e14fe416663541050d340aef2555dbd292bd9cbab8fcf20378149cc994569c2bc95fb33fd2d9321b8ac8e5160b02e202492f470eb719a8f2ac3a4be37ea0918b54b14789b7aa228d47f7b13fd9af608740c5a8fe02109a7cc0e555b22628ef790e513ecadfd338d30aed8ca219e64ee4fb0bd0e21e5101bf2072ffa071eb1aa0454caccc015ff1e166813f819a142b56a22e4ff387bb319288a0ef747c6fc8fdee3a0e193b0d086eb816e97e0322fcdaa30da61cd26ac9d8d0748fccd911ce0fd4adc953e9486e137fe66bc8aedfd5b78c562ebfc578ac9f96a453311766564541e16955e30b95914e9411a0b4cd95e0d8732d5ff7a4f921ef41d986a195334266585353b16b9449955523913a30c087532bcb899f733af3abea59baea174cf04359547a633b5f8a582ae3ef12a1d0125bef8c6e8c9fb589d3597c5ab3879491b0c5e3607203f06836a6805d3f7979c4325f9fecb2aceddedb272237132460cda812ef7d613a585898d59f92ef68ec95f12b47b440f6d899ecbfab48055e0c1605ba4cd9dbc17c4cbfec8a953ebbd38c45a6737a57ee58e21a20e530171137968ae4f0d0366cdb0b9d6a4667b011fcd7cd9e77364e5221989d8f0d80793260e748e3bd394849c090c744f6044328304cd6f02e941c5405647daffc1fd2f2864b37f92bbf4931c8e4a7c6bafd0ea79d39d330e70e6776bf6a926de227e5a43653bba04883e98d67bb64aa86e8bf271ba87604bc598e47f2992c7618ad25068860a481554b53352c7339de7e79c3bd1aed5bef8f398432858c888a5d8651969ea40eb3d486e9fe61d49b20500fdfd1548f567da970103d36730657c35d03d2c36b142665f62203b1fb12d616478cfef6f38b34cda87a634dd06d359f33e98b94a5e5b46b2a8d73126352d1d5b65af75055455cc903e384c41876fbdff935d047284d9d203b147a6ba0e9cb50beef7798886c33d2f2f0c0d9abe0e32c7c809f8b0b28fc59471987353c862a311776b8275bf319d5cb9a59f8f103b6e567ef5dd8859973cc3fe41e356bf5bd3186240e49286977eca36a8ad44185973b276cd7958b73e14a221b7fd567818bebf54ad27ee95161bd2aeeb356482ff467500a7d36f0464f58a591ec6b728f984ec78d0abe14c6d3411ac3ffc4c3179d1f95d029f26cceb545723519d3d4209a2b1243e78767273c13dc2bd320512674b6f1a50313bae7b9d16aebb476dbc829e8fd8dd46a1696efaff5795cf75de57c90f05ed9ef4a5cdfbf20d3d9ed95fb4114b1d5c9ade0856212e7ba330ce5bccf2c993dff89112b28bd3b17d3fcfacef7590f62bf948977dd79e2d8025946c80bf263e34035409b5ba1443d4929727180761bd56d258c3670a0aa4de21111fc3172367582de2d164ff3a18d0696b8dd8e5c1423b2ea1e2c0cfe141e4cf04f8cdaed48976b94c40d6a581300458661bbdbfeeb4969af6319eb1798843d0872f68f0c6537bbc9c7dd1e9b0564bf442d8d25f8aa884aba1df074d374f99750d9227bb821ba0355f60de2829a5c8cd47c89d29a2e3d7d53d59db5c3ace8f484664202c210c68a3b33076fb00d59938e84fbad6d6618c0bb89cf94035fa2de4da351e0d71df416450ea7ec3af33aa5c0313c63e654bd79c73b39dc1933636956761058d76648746daca469f8fce62c17a8160cdefc6a927eef9ec4a8dd684e46f35282546ce2362ab8afedd39bf699fd7c2cde538f52ea43c08558f42ba77b2986b800c45fa76a130b30919b3e1d504573e3c1e7dd2dc5d81379df53d736511f1da4ad8791e46adb27bb5c38129e89edda0aed99dcc03fe400f7d05d48e3e9e17744e8487f8ac464c86f7332211fb9799e9d27a6832d5f17ccd1a2da255f6da047e4728dd80860c04391bca4b7833f0346866401ec20033bcf6dfa85fd1520de5a03b4f9f6f5d2f8d7b6e7d7df1cbe5c05e23e080cf335639c94c48aaeb0bfebbe79530d67d35fb101c91839954c0e50dd4b90a86428b22b0be1e906fee30f68d7ce4bf9c68eafe695f07f5e4e4d473d77104b7b1b5dcfeb84e8c83624c0068d4e1cccfe740f8e5d5699603f8481ef2a1f2d4b8fd2314c5cb1985fe34cf8ede7d2e8bddea269422490903489c7f5951114d7ccb29a19455a987d538955712a460243105b25ccb6e6f34c370a6bbb234bee150dbcea5188e45305253f1014f7c0b5d60d517d2d05707f5ca9249a921d6c5307caf41deca0509b49102d801320db65c00f6e1c05fb8c2e1cc554673bf6168dd64086b19af28eec508fd0c304837e802173ac9947c4d73929c61d9632ab929a25f2a04350954612c2de705c1c25215284fe933fc8ccfd30ab3fc9ff5e04dd68d4720d95a29d6da176ac9d332c9ce77358f3c262777ea828fe6473638bc77be2aa586a3733e275744bc42c3742c1ad8f89d25c31958902f2f498c58fc85e9b78fb7a331734cb081cfa9ccfd262df927c0ff46983f8765af4add3532de2b91f2436df028", 0x9fd}], 0x3}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)="a6", 0x1}], 0x300}}], 0x3, 0x0) 6.711828454s ago: executing program 2 (id=2472): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$kvm(0x0, &(0x7f0000000040), 0xc0083, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x0, 0x11, r1, 0x0) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x2) openat$full(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$kcm(0xa, 0x2, 0x88) sendmsg$kcm(r4, &(0x7f0000000340)={&(0x7f00000002c0)=@in6={0xa, 0x4e22, 0x3, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x9}}, 0xfffffffc}, 0x80, 0x0, 0x0, 0x0, 0x54}, 0x640ce0c0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) mknod$loop(&(0x7f0000000100)='./file0\x00', 0x8, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000024000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000000)="66b9800100400f326635010000000f3064660f38828e4258660f086766c744240012e93bf96766c7442402010000006766c744240600000000670f011c2466b9800000c00f326635002000000f300f01df66b80500000066b900200000a90a000f01c40f019f09000f01c2", 0x6b}], 0x1, 0x3b, 0x0, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000300), 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(r5, 0x801c581f, 0x0) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000300)={[0x7, 0x800, 0x100, 0x0, 0x5700000000000000, 0x401, 0x6, 0xfffffffffffffff7, 0xe, 0x13f, 0x100000001, 0xba25, 0xfff, 0x3, 0xfffffffffffffe00, 0x1], 0x4, 0x1c2080}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_GET_NESTED_STATE(r6, 0xc080aebe, &(0x7f00000006c0)={{0x0, 0x0, 0x80}}) write(r4, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x101201, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(r8, 0x4020aeb2, &(0x7f0000000800)={0x1, 0x0, @ioapic={0x8000000, 0xe0000, 0x9, 0x3, 0x0, [{0x2, 0x3, 0xd, '\x00', 0x7}, {0xd, 0x7, 0x96, '\x00', 0x3}, {0xfe, 0xf2, 0x3, '\x00', 0xaf}, {0x17, 0xf8, 0x4, '\x00', 0xf4}, {0x6, 0xd, 0x4, '\x00', 0x9}, {0x5b, 0xc, 0xb, '\x00', 0x8}, {0xb0, 0x1, 0x6, '\x00', 0xc9}, {0x7, 0x1, 0x93, '\x00', 0xfd}, {0xfd, 0x5, 0x5}, {0x75, 0x81, 0xd, '\x00', 0x7}, {0x0, 0x6, 0xb, '\x00', 0x4}, {0x0, 0x0, 0x0, '\x00', 0x9}, {0x2, 0x26, 0x7b, '\x00', 0xb}, {0xb, 0xe, 0x3}, {0x5, 0x10, 0x22, '\x00', 0xc}, {0xe, 0x1, 0x8, '\x00', 0x82}, {0x5, 0x2, 0xa6, '\x00', 0x9}, {0xf, 0xd, 0x9, '\x00', 0x68}, {0x8, 0x45, 0xf2, '\x00', 0x1}, {0x5, 0x8, 0x1, '\x00', 0x3}, {0x3, 0x7, 0x0, '\x00', 0xf}, {0x2, 0xa1, 0x4}, {0xf9, 0x70, 0xe, '\x00', 0x1c}, {0x72, 0x1, 0xff, '\x00', 0x10}]}}) syz_clone(0x6102400, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x5, 0x0) 6.711440184s ago: executing program 4 (id=2473): socketpair$unix(0x1, 0x3, 0x0, 0x0) open(0x0, 0x0, 0x0) (async) open(0x0, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) (async) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000340)=ANY=[@ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRESHEX=r0, @ANYRESOCT=r0], 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) (async) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000240)={&(0x7f0000000280)=[{0xc, 0x0, 0x0, 0x0}, {0x6, 0x2000, 0x0, 0x0}], 0x2}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a0102000000eeffffffff000000000900030086797a3100000000140004800800024068029f8408000140000000000900010073797a300000000060000000060a010400000000000000000100000608000b40000000000900010073797a300000000038000480340001800a0001006c696d6974000000240002800c000240000000008000000108000440000000010c0001400000000000000008140000001100010000000000000000000000000a"], 0xe8}}, 0x24044810) syz_emit_ethernet(0x287, &(0x7f00000009c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd64d33554025106c5fc01000000000000000000000000000100000000000000000000ffffac1414bb21004840670000007307000000000000c910fe80000000000000000000000000004204010400010005020008c91000000000000000000000ffffac141431040105050200010401080502000800000000290c040603200700fe80000000000000000000000000000afe80000000000000000000000000002200000000000000000000000000000000fe80000000000000000000000000001cfe8000000000000000000000000000aa000000000000000000000000000000003c000378660000002b0c040609400000fe8000000000000000000000000000bb00000000000000000000000000000000fe88000000000000000000000000010100000000000000000000ffff64010102fe880000000000000000000000000001fe800000000000000000000000000014321201080000000020010000000000000000000000000001ff01000000000000000000000000000120010000000000000000000000000000fc0000000000000000000000000000002001000000000000000000000000000200000000000000000000ffffac1e0001fe8000000000000000000000000000bbfc020000000000000000000000000000fc0000000000000000000000000000000001000000000000c20400000009040100040109000000003b0a000600000000fe800000000000000000000000000016fe8000000000000000000000000000aafe8000000000000000000000000000aa20010000000000000000000000000001fe8000000000000000000000000000aa0000000000000000000000000000000100004e2100004e2200000003000000000006d4d72d882ad27b6cd1d64a1a3cfe1a9b1df71bc807c5ec4e1f2c03f5e1795b05a7adc8de6d0ad499df2ccaefb5d1718e3ee8251beeb48dafa479fede5f893d19861c0be113d323b37332d43be836ae93b53a6d3eedc2c4c45f8a359f7547f690dfeb2e124c40b081cf91ff71f65df07b46e088f66a1c7a"], 0x0) (async) syz_emit_ethernet(0x287, &(0x7f00000009c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd64d33554025106c5fc01000000000000000000000000000100000000000000000000ffffac1414bb21004840670000007307000000000000c910fe80000000000000000000000000004204010400010005020008c91000000000000000000000ffffac141431040105050200010401080502000800000000290c040603200700fe80000000000000000000000000000afe80000000000000000000000000002200000000000000000000000000000000fe80000000000000000000000000001cfe8000000000000000000000000000aa000000000000000000000000000000003c000378660000002b0c040609400000fe8000000000000000000000000000bb00000000000000000000000000000000fe88000000000000000000000000010100000000000000000000ffff64010102fe880000000000000000000000000001fe800000000000000000000000000014321201080000000020010000000000000000000000000001ff01000000000000000000000000000120010000000000000000000000000000fc0000000000000000000000000000002001000000000000000000000000000200000000000000000000ffffac1e0001fe8000000000000000000000000000bbfc020000000000000000000000000000fc0000000000000000000000000000000001000000000000c20400000009040100040109000000003b0a000600000000fe800000000000000000000000000016fe8000000000000000000000000000aafe8000000000000000000000000000aa20010000000000000000000000000001fe8000000000000000000000000000aa0000000000000000000000000000000100004e2100004e2200000003000000000006d4d72d882ad27b6cd1d64a1a3cfe1a9b1df71bc807c5ec4e1f2c03f5e1795b05a7adc8de6d0ad499df2ccaefb5d1718e3ee8251beeb48dafa479fede5f893d19861c0be113d323b37332d43be836ae93b53a6d3eedc2c4c45f8a359f7547f690dfeb2e124c40b081cf91ff71f65df07b46e088f66a1c7a"], 0x0) sched_setattr(0x0, 0x0, 0x0) (async) sched_setattr(0x0, 0x0, 0x0) syz_emit_vhci(0x0, 0x7) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) keyctl$read(0x1f, 0x0, 0x0, 0x0) socket$pppoe(0x18, 0x1, 0x0) (async) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x807, @empty, 'vlan1\x00'}}, 0x1e) sendmmsg(r3, &(0x7f0000001340)=[{{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000500)="ab", 0x5ea}], 0x1}}], 0x484, 0x24048084) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_clone(0x11894000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x11894000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r0, 0xc0884123, &(0x7f0000000000)) ioctl$BTRFS_IOC_BALANCE(r0, 0x5000940c, 0x0) 5.45558694s ago: executing program 2 (id=2475): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r4, 0x4068aea3, &(0x7f00000001c0)={0xbe, 0x0, 0x1}) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000100)) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x4, 0x4, 0x4, 0x10000, 0x808, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x50) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000001ac0)=@urb_type_bulk={0x3, {0x1, 0x1}, 0x413a, 0x40, 0x0, 0x0, 0x6, 0x75, 0x6, 0x8, 0x79, 0x0}) close_range(r0, 0xffffffffffffffff, 0x0) 5.072622406s ago: executing program 2 (id=2477): r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000000)=0x4174, 0x4) sendmmsg$inet(r1, &(0x7f0000001240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0x1}], 0x1}}, {{&(0x7f0000000c40)={0x2, 0x4e20, @empty}, 0x10, &(0x7f0000000d80)=[{&(0x7f0000000c80)="ae058e2944c767afe913fe93866258931d0c6fb08a039def84b96e70f1d310b7bcd286021b871c7fc398b959d1574297926d4f0dc5cf196830e9099271f7712b56327bb6e8b8fdeccb77afeee6ee1b2aab4dd3bb438e60b8d83c5c30f7cc9940bce025fddddf00bc18ffd190959ab4a5245e20a80925c462da15e03c938029c7283c4da611ec581aa846b0135fb09e4a7783b64cb08f158d165bbc7e52eb47bf230398ae6e0debebe2cbd9a28193a3bedff007e683fb82cf583de9b5ae331fd73f47e5a3b65c8732a280168f8c3975088459a3251b6515faec1c737d2c5a64a50a8abac1d6351c04a365d2", 0xeb}, {&(0x7f0000001180)="b893de2feed42a6423d36ca67c6b9828a7de32e60aaa56b14aa72d80748190083043fb20dd815d7798610cd14de7012e1e9a7c0c217af444d138a37042f0751815375e67ae63aa019346baf24827c4f6cd47301fdf50a8a552d6fce967197c56cfbbb5e0191eb341bb961fd5fb0c90f091b596a6c5d790da88de694c8edfd81fc8b9605d8e263eec48921d35846cf2f1c0a7de25e8d9329a90ef9794b763c3c63474a0061f29e60e6e99b90b9469f8fa37b2", 0xb2}, {&(0x7f0000000ec0)="81c3600606c38b9749f0d8d5d7579ac45cc98e9df61032776468030cea9482cb07df668988fff93a97c24bac65f2fa94faef95cbaf564e40150fd40e1be37830fcb493740de6568c740a03d6eae1f4792fb85e6d6b3f3767416935a5b5fe1843438b934bd62e674f271e937e039295e2ef1ecc8204d872675ae9d86616a211f5a9ba2aa9d6e79b1c667c705be3dfb0e31acf471edc08f744c3a063f7ec7df2de54d9d0b3555c906a61d69e84b454ecc54206a3c993d31102eeaa75427dc144095ee51bf1a5aa1e69826fe984aec1055650da2eca0d98d7bd80b3e8d7848be75faaad5a6b0c2bd78e55c4348853142e33aea84b03c0d8a026285a34", 0xfb}, {&(0x7f0000000fc0)="1bbc07e2e4fb391069f97b581325e20036053f0f2318df4220bc8f168a1892b77c98a13cc94ab6f5e2c20cff1ca93148b42ad42ca3c8649edf35cd18eb12d5a240a1a6e747b073f506619fc6ae1e869f9ac5e08bc9208b68a3d5df6052c3f9ed79a2e73ca44a503619dae8d40df384a605ffc63f0e63a313171dfe5a3e6abd4a7839984ca5ff2485ef01f3935ee0eb6f4637", 0x92}], 0x4}}, {{0x0, 0x0, &(0x7f0000001100)=[{&(0x7f0000001080)="f7d61b6cc609b9fda41ffcd9fb03897e7cb79b5f961bf4504af713479293f6dbb83d9e9fc567d57e7cfd77f7066ab08d8301bbe37f4b94ac666d7edac83298c82035eb3a4a0aab40a126fe73ff524c927cb872f47edb54fb21", 0x59}], 0x1, &(0x7f0000000e00)=[@ip_tos_int={{0x10, 0x0, 0x1, 0x1}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0x7}}, @ip_tos_int={{0x10, 0x0, 0x1, 0x8}}, @ip_ttl={{0x10, 0x0, 0x2, 0xf}}], 0x40}}], 0x3, 0x4000800) recvfrom(r1, &(0x7f0000000300)=""/140, 0x8c, 0x40002141, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, 0x0) fchdir(0xffffffffffffffff) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r2, 0xfe, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000dc0)={0x0, 0x4000, 0x0, 0x865d, 0xfd, "ffff00"}) r4 = syz_open_pts(r3, 0x0) io_setup(0x5, &(0x7f0000000140)=0x0) r6 = eventfd(0x6) io_submit(r5, 0x1, &(0x7f00000006c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x4, r4, &(0x7f00000003c0)='z', 0x1, 0xcead, 0x0, 0x5, r6}]) close_range(r3, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f0000001440)=[{{&(0x7f0000000240)=@nl, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000400)=""/110, 0x6e}, {&(0x7f0000000480)=""/171, 0xab}, {&(0x7f00000005c0)=""/128, 0x80}, {&(0x7f0000000700)=""/166, 0xa6}, {&(0x7f00000007c0)=""/215, 0xd7}, {&(0x7f0000000640)=""/119, 0x77}, {&(0x7f0000001700)=""/4096, 0x1000}], 0x7, &(0x7f00000008c0)=""/160, 0xa0}, 0xffffffff}, {{&(0x7f0000000980)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000540)=""/2, 0x2}, {&(0x7f0000004280)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/106, 0x6a}, {&(0x7f0000000bc0)=""/118, 0x76}], 0x4, &(0x7f00000012c0)=""/199, 0xc7}, 0x6}, {{&(0x7f0000000ac0)=@sco, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000b40)=""/40, 0x28}], 0x1, &(0x7f00000014c0)=""/100, 0x64}, 0x2}], 0x3, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000000c0)) ioctl$FAT_IOCTL_GET_VOLUME_ID(r8, 0x80047213, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$BTRFS_IOC_SEND(r7, 0x40449426, &(0x7f00000001c0)={{r9}, 0xa, &(0x7f0000000000)=[0x1, 0x9, 0x6, 0x4, 0x0, 0x434, 0x8, 0x1, 0x7ff, 0x2], 0xffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, 0x0, 0x0) 4.874304268s ago: executing program 5 (id=2479): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r3, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017000000000008001d00040000000c002200060000000000000008000400810000000500240001000000050016000100000005002c0002"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) r5 = socket$l2tp(0x2, 0x2, 0x73) getpeername$l2tp(r5, 0x0, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_DISCONNECT_CLAIM(r6, 0x8108551b, &(0x7f0000000000)={0x0, 0x0, "ec9fe44d4dbe56a60274fcffffffffffffff14e315eeb406bfdd73835e57efa94b1a0275781c647aa7e3470c6028643b17832b10b386a6f73791011c26a9aa141f406e312295ee620a9a46577b9249b738fe7750bec83bf6ed5b67213fa7d6c0823fd154ed29ede1ff379742c3f0b46caa357d70ee438f901d7645c3f87e4b21482b76f2ad8eaac090272081f98fd2e3e5a63e008104df635e731a5bfcd942f4529517454618de595cd179445b4bdbf698b9986356f0ebf7d25a57774ef474f86a3ad24ae9f0bf94b99e6b87de5f79d383d05bb32701daed400785a49788f08caecc9e0c48a3740bbe6e1c1fd4f6cfdfe756bc00d08e36655c00"}) ioctl$USBDEVFS_CONTROL(r6, 0xc0185500, 0x0) r7 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r7, &(0x7f00000022c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_NOTIFY_RESEND(r7, &(0x7f00000076c0)={0x14}, 0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x22004091}, 0x23a174b6e44ed11) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'macvlan0\x00'}) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$inet6(r9, &(0x7f0000000500)={&(0x7f0000000080)={0xa, 0xce27, 0x81, @dev={0xfe, 0x80, '\x00', 0x23}, 0x8}, 0x1c, &(0x7f00000001c0)=[{&(0x7f00000000c0)="06", 0x1}], 0x1}, 0x80001) connect$inet6(r9, &(0x7f0000000180)={0xa, 0x4e22, 0x6, @private1, 0xd1}, 0x1c) shutdown(r9, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r9, 0x84, 0x7c, &(0x7f00000004c0)={0x0, 0x5, 0x3ca}, 0x8) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="3000800000040101000000000000000000000003050001000100000008000440000000020a0002000000000902000000528547a54f145f3674a967736d1f27d30d769f4e68803a3208c7fb9b243c390d676d5a01276d3ae4f8ef350f487069edc002b0ec356de09cb86875e829869b4ab2bf10e1d6aa98394c35589e3f5798e84e4e6cf041b5d3ac7723b4b1970b5cc7e30f50d95c5747e45a079704d77de10994edcde37774d52aad8d7bfbed784077010d53796a87fa690b490ef6975432178c53d4178944eda44f089bad12a6f6fb6353b34d8be966857a31ddf4"], 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x20004040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="440000001000010400"/18, @ANYRESHEX=r8, @ANYRESHEX=r2], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000880)=ANY=[], 0x0, 0x0, 0x22, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x25}, 0x94) r11 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r11, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r11, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x10022, 0x0) r12 = socket(0x10, 0x4, 0x40) sendmmsg(r12, &(0x7f0000000980)=[{{&(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @local}, 0x0, 0x1, 0x3, 0x1}}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000300)="ece89fb007f7073293db878f562bf9e2edc8ff19e05f259013ae623d4e87114de0dc6c56c45276d7cb87680dcc22fcf74a888c59b4dcd95bb4ccb347137751ab1aa49c852611c261b333f4108fafacce7346731184644c692ef1a2f1e08a1e19c88ebe8f79b19277634fac62659264206def79dc11e4bda9232d6d9108e2533e41f65627f95efa5da38306efeb12064c873e30c097beddd53e8968d7696ae4ce73a953d5906742372eec6e713fb9e04eae18db325de547d89b26fcf80849c6a81ba12b1db47da981a5dee01ba8f5518a55325d8e6dc6ad768f55806b3ee80a60", 0xe0}, {&(0x7f0000000400)="c0c652460fdc0b7e36623a1f9210b6f6d9400e4b90380419c352e7e0b8d7fc3699a50b35cf25513b7adc0c0b83aa864583d8cf61fa85b6ad1300254a24d238880e1ce6b9f3d0cee0124234d1b363dbe68d02e3b9eb77a3d395b2e7ba770fdc4bda46d761c6783b6d69bba210c7de77893cdaacca692cb6b6973c1b21504724363305d2f656", 0x85}, {&(0x7f0000000240)="4a27fec1ddf30f1e2e447dab8ed41b3dc5826fe3627f964dfff476b092677dd1826c6537a8312f85f46f603850ea535266e0158e224791162468dc67d7bdcb51126f4b4f47b551c73b3c651d9ccdbf199c1d73d429aadac53e083f32b8a4df9169e93ef19ebece6d38", 0x69}, {&(0x7f00000004c0)="aa6a6efba0851445e93c36d24f9a7beaa0a8c09c36bfff455ba4cc4db7ded534a5bebbb38852a54774e82956ce0c0f301272ec4f13d820922a3a2f3d719f16d028f25300027e8d4e76e76fe115975a6c429a4df6c0316bcfbf58406b85fd53c837b844ff77fed4bd39066b296eb39aa5033e30edf82c117ee956e3883e78e212add39fe6c2ac3182fdaf7e289034e1df5d45b4460cc336fd0e19463d17922a6209054876b8d2394ca2b95f65e381bb5576153c2909e77e672e", 0xb9}, {&(0x7f0000000140)}, {&(0x7f0000000580)="d1645f1bc5e4fabe10514cceb4ab0631c1eb84de64e1158ce30268bba29a88b54695c960bd319c8d6518d674e141edcedc80eb79227f2f8194421924b7d722c6e856e512709a4c3d7d339514f5679667b75d2d705ee6b38b60cd276cf66a0e78502829119805a0a3cdb905f7a2dd1f210d62922c2df24133f4f58cc35cb4b353e7cb386fe5575c9fc8aecb654cf2ee49987606d36ea9f7cf18a4a845fe4edc45d0fc981ab834a93ccbcca8de0032d74463a442367a62b21d66cdf0fc44697cff2ade0758f33fe00dca56e68d7d", 0xcd}, {&(0x7f0000000680)="b237fe0f1ac2ceb8b52d84f401006095db6514f2c846320d5bd047a25459fd4b1d33d8e55ab9eda3ecb07da0ec68c73aa6cc1ae8d2dbf1a2f5760b37e636d93c944a9fcd8480870b85efc9d60b8e58d09beea13a76a1fd37dd2a279feea76c7e0c2cce33abe5305e6a5828f4a325be985db09b293fa4ef12e413d86723ac4dd25950d4b795ddff83e5af631a0865c7cfb8a1b180d73efb42aea85e3d915e46754f0ef47a240751f0eb830acc33", 0xad}], 0x7, &(0x7f0000000c40)=ANY=[@ANYBLOB="1000000019010000be0d000065f300004c0000000801000009000000867d389dba4ca8f303e40274f3bd3db854da7b9498c9c6e579bc34517833ef976f99f596df080bea2260f5becd07f9924ef747cb5178ac129dcb576bcc5f0000980000000d010000eda3d86606000000ff1198501d2f9d9c650a995acdd875b20ab3fab102cdb310b32852adc682d678d85d598daaddf31ba70ea0026d3ee4fd07e1ffedf08b4c5a93755e19ece968ea858f31b20a09356df167406f372ee0a3e74739d7fb46f77164847bb6ab0a6cb651a945991fb9d94c1a96db1fcf88117445eb7d1e7c0024b88dd824e1130f72edc43326225641d01ec869fe7a1f36b86c999c909b10d4327e17c50f00ec000000000000000600000045166301d81a138c0b196fb1abc094b609c1f7eb0e20ad20bca954442bf8cdf95876c2872a252cdc3cf29e1b64240b1382d39a739f34220305207342e8277f1e0a58d293e81a0bb10d30dde5e0c1d0e5a2101aef0f8b5439f11b01a89c673cd3b501156e7c4f8ee70700fcee1f1253fb7ea460784a0cb0aec76b2820036ad216ed66dc90dd77f9a8096868c1d8e29ab4e6df2bca70906b3f5d367dcf759111e60096116bc40cf23a0f77f477cdf060108a9f2d4c463cf146c10db7c771d9d7c1bf0bcb24e87704475dea67378d296ff2c7d54b9c42d36b2e7a4733"], 0x1e0}}], 0x1, 0x0) 4.743401613s ago: executing program 2 (id=2480): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000540), 0x1, 0x0) sendfile(r2, r1, 0x0, 0x80009) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_MATCH_INFO={0x14, 0x3, "f4f03b0200000000000001116b61979e"}, @NFTA_MATCH_NAME={0x9, 0x1, 'l2tp\x00'}, @NFTA_MATCH_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x2000, 0xfd, @mcast2, 0x9}, 0x1c) sendmmsg$inet(r6, &(0x7f0000001040)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000800)="11ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dea658eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff690894405a0b6abc3c4d0f6a16c0a95c0508bd7eeffcd1da0b17f7701448658864b429e9472edfeffbf34d6e7c78f4aa73c0", 0x2de}, {&(0x7f0000000bc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0769421fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a6e453a8a28cd5c4b733fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33e47a0e416573cfdcfb44ed9dd4ce41af4de9c471c49f12f090934c3b32f2f4777c65b1574826727f5f62", 0x1e9}, {&(0x7f0000000240)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859207067c10aa7352abbdf98e9bf033a3184a11e84639d3b9164d9c5d729f3dd409d39ff041e657c8df70e1607d58c863d5f323f6d5cf367cd939f790732e8d2310e876fcb299cd44b72bda697035b7b475bc35afbb483db39ac864dbee0c9760c22a1d32d83588afd7c994652413b22db76874ca052ef2013317eb7fcc5677e9d", 0xa0}, {&(0x7f0000000200)="f610e61fc81cc3edc86f0500194d27a5a42cf1880b0dfd1ecda0fd0ed9", 0x1d}, {&(0x7f00000010c0)="e0", 0x1}], 0x5, 0x0, 0x0, 0x900}}], 0x2, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_CPUID(r5, 0x4008ae8a, &(0x7f00000001c0)=ANY=[@ANYBLOB="0109077c6a1122486b0000b8321c96afcfcbaeda45"]) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x8) 4.621190212s ago: executing program 2 (id=2481): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380000006800010000000000000000000006000b00080000050000000000100000000000000000c3ad5ee93354add035857593000908000500aa7654e08741e66a54", @ANYRES32=r2, @ANYBLOB], 0x38}}, 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r3, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = open(0x0, 0x80ff, 0x88) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000000000)=0x0) timer_settime(r7, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) write$char_usb(r4, 0x0, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) set_mempolicy(0x3, &(0x7f0000000100)=0x3, 0x9) r9 = socket$kcm(0x2, 0x200000000000001, 0x106) r10 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) ioctl$VIDIOC_G_EXT_CTRLS(r5, 0xc0185647, &(0x7f00000001c0)={0x990000, 0x4, 0x400, r5, 0x0, &(0x7f0000000180)={0x990966, 0x800, '\x00', @value64=0x5}}) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x50, 0x9d, 0x10, 0x40, 0x61d, 0xc170, 0xb188, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xd4, 0x0, 0x0, 0x4b, 0x72, 0x86}}]}}]}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@newqdisc={0x43c, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r12, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x410, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0xfffffffc, 0x0, 0x7, 0xd59, 0x0, 0x93b5ec6, 0x6, 0x9f38, 0x6, 0x1000, 0x7, 0x4, 0x7, 0x2, 0x400, 0x9, 0x4, 0x4, 0xff, 0x7, 0x9, 0x4e7d565b, 0x5, 0x8, 0x5, 0xba4, 0x3ec800, 0x5, 0x63, 0xf8000000, 0xea, 0x0, 0x1, 0x6, 0x7, 0x7, 0x1, 0x5, 0x9, 0x7ff, 0xfad, 0x4, 0x8, 0xc, 0x2, 0x2, 0x2, 0x9, 0x6, 0x8000, 0xe, 0xfffffffb, 0xfffffff8, 0x7, 0x2f, 0x8, 0xc5906a9, 0x7, 0x9, 0x8, 0x7, 0x2, 0x0, 0x10, 0x9, 0xf, 0x4, 0xad, 0x2, 0xff, 0x3, 0x6, 0x6, 0x6, 0x2, 0x7, 0x5, 0x25, 0x0, 0x80, 0x8, 0xcc4, 0x5, 0x5, 0x5, 0x6, 0x1, 0x4, 0x4, 0x400, 0x5, 0x1932, 0x9, 0x16, 0x9, 0x3000000, 0x6, 0x1800, 0xffff, 0x86, 0x1, 0x38d0a22e, 0x53, 0x2, 0x4, 0x4, 0x2, 0x5, 0x3, 0x1, 0x19, 0x4, 0x80, 0x5ef, 0x1ff, 0x4, 0x0, 0x4, 0x8, 0x2bd7, 0x1f, 0xffffffff, 0x5, 0x10, 0x1, 0x80, 0x3, 0xf692, 0x4, 0x7, 0x1ff, 0x3, 0x7, 0x6, 0x3, 0xff, 0x1, 0x80, 0x1000, 0x0, 0x8, 0xf5ba, 0x5, 0x9, 0x6, 0x5, 0xe17, 0x2, 0x4, 0x8, 0xff, 0x9, 0x8c, 0x3, 0x3, 0x8001, 0x2, 0x6, 0x1, 0x2, 0x7, 0x40, 0xb, 0x0, 0xd, 0x0, 0x6, 0x3, 0x7ff, 0x0, 0x400, 0x400, 0xc4, 0x0, 0xfff, 0x5, 0x0, 0x2, 0x196, 0xa, 0x9, 0x6, 0x9, 0x8, 0x6, 0x1ff, 0x1a8, 0x0, 0xfffffff7, 0x7, 0xffffffff, 0x9, 0x7, 0x7, 0x6, 0xf4, 0x2de622c9, 0x100, 0x2, 0x5, 0x7, 0x3, 0x8, 0x4, 0xfffffff8, 0x7, 0x2, 0x1, 0x1, 0xea5, 0x3, 0x3, 0x2000, 0x1, 0x9e, 0x0, 0x1, 0x9c0, 0x4, 0x1, 0x200, 0x80000001, 0x7f, 0x2, 0x27b, 0x80000001, 0x0, 0x4, 0x0, 0x3, 0x7, 0x7, 0x9, 0x6, 0x7, 0xcc, 0x1ff, 0x5, 0xa, 0x8, 0x7, 0x8, 0xbae9, 0x5, 0xfffffff8, 0x0, 0x51, 0x2, 0xf0, 0x9, 0x2, 0x7d, 0x2, 0x7, 0x1000, 0x9]}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendmsg$inet(r9, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x34004000) setsockopt$packet_tx_ring(r8, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x808000, 0x4, 0x20300, 0xfc, 0x2000000}, 0x1c) write$char_usb(r3, 0x0, 0x0) syz_usb_disconnect(r0) 4.420059869s ago: executing program 1 (id=2482): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x400, 0x0, 0x379}, 0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r5, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r4, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$F2FS_IOC_GET_FEATURES(r1, 0x4004af07, &(0x7f0000002000)) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="2c0000000104010400000000000000000700000606000100014f15a054f41e96d69d438482456d00000008000440000001010800034000000fff"], 0x2c}}, 0x4) r6 = openat$rdma_cm(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r7, &(0x7f0000000380)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000580)=[{0x4, 0x0, [0x0, 0x4, 0x1, 0x3, 0x6c, 0x5, 0xffffffe6, 0x1, 0x4, 0x400, 0x7, 0x80000000, 0x2, 0x2, 0x6, 0xd4a8]}, {0x18, 0x0, [0x39a8, 0x7ff, 0x2, 0x7fff, 0xffff, 0x1, 0x3, 0x0, 0x400, 0x3, 0x0, 0x6, 0x5, 0x1, 0x5]}, {0x20, 0x0, [0x3ff, 0x5, 0x8, 0x2, 0xc72, 0xb7, 0x8, 0x1, 0x4f1, 0x5, 0x9, 0x6, 0x6, 0x0, 0xfffffff9, 0x6]}], r8, 0x1, 0x1, 0xd8}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000340)={0x5, 0x10, 0xfa00, {&(0x7f00000003c0), r8, 0x1}}, 0x18) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'macvtap0\x00'}) 3.7025365s ago: executing program 5 (id=2486): sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x3fe3aa0262d8c583, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_INGRESS={0x8}, @TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x44}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) openat$binder_debug(0xffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xfffffffc}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004106cd40cd060f011bd50000000109022400010000800009040bfd0233776100020004814006090587030821"], 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r7, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0xfffe, 0x7, @mcast2}, {0xa, 0x0, 0xb, @loopback}, r8}}, 0x48) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x3}, @TCA_CAKE_WASH={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x48801}, 0x0) r10 = syz_open_dev$sndctrl(&(0x7f00000000c0), 0x2, 0x8100) r11 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x13, r11, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r10, 0xc0485510, 0x0) 3.672377377s ago: executing program 4 (id=2487): ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000000000)=@x86={0xc, 0x8, 0x4, 0x0, 0xffff, 0x8, 0x38, 0x81, 0x2, 0x5, 0x9, 0xff, 0x0, 0x9, 0x8b0, 0x8, 0x6, 0x6, 0x1, '\x00', 0x43, 0x1}) (async) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000000000)=@x86={0xc, 0x8, 0x4, 0x0, 0xffff, 0x8, 0x38, 0x81, 0x2, 0x5, 0x9, 0xff, 0x0, 0x9, 0x8b0, 0x8, 0x6, 0x6, 0x1, '\x00', 0x43, 0x1}) syz_emit_ethernet(0x11, &(0x7f0000000200)={@multicast, @random="0000dcf6177a", @void, {@mpls_uc={0x8864, {[], @llc={@llc={0xaa, 0xdc, 'T'}}}}}}, 0x0) ioctl$VIDIOC_G_CROP(0xffffffffffffffff, 0xc014563b, &(0x7f0000000000)={0x9, {0xd0ce, 0x4, 0x5, 0xe}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') read$FUSE(r2, &(0x7f0000002680)={0x2020}, 0x2020) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d491c4afc4de9986a1174a8d879779de39a87eb27a18c886a3b5ee4bb8c3105b417027e35a14de505ab52456717c0fad1d757fa4aabce5f7a4b", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d491c4afc4de9986a1174a8d879779de39a87eb27a18c886a3b5ee4bb8c3105b417027e35a14de505ab52456717c0fad1d757fa4aabce5f7a4b", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) (async) r6 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(r2, &(0x7f0000000340)=ANY=[@ANYRESOCT=0x0, @ANYRESDEC=r6, @ANYBLOB="2b434e6ebb4ff147f3d16c113b77eff3b04af4ca42fdc6287f7747bec89e3c94ea8116b0e88828a0b08d988df01f2bdae037ac384a2a0c23f02d0ced264ea58c0e4601c7e9606e7b692eff7e06cd2aa21239284440f485f982ac2c9e4d6f2024b4188e14ed9d"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r6, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) (async) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read(r4, 0x0, 0x0) r7 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0xa, r7, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='ed:cb2e') (async) keyctl$restrict_keyring(0xa, r7, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='ed:cb2e') openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) (async) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x185802, 0x0) sendfile(r8, r8, 0x0, 0x200000) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0x9}}, './file0\x00'}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x4, 0x10000, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) 3.484256985s ago: executing program 3 (id=2488): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x109301) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r4, 0x4068aea3, &(0x7f00000001c0)={0xbe, 0x0, 0x1}) ioctl$KVM_GET_MSRS_cpu(r4, 0xc008ae88, &(0x7f0000000100)) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x4, 0x4, 0x4, 0x10000, 0x808, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x50) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000001ac0)=@urb_type_bulk={0x3, {0x1, 0x1}, 0x413a, 0x40, 0x0, 0x0, 0x6, 0x75, 0x6, 0x8, 0x79, 0x0}) close_range(r0, 0xffffffffffffffff, 0x0) 3.3640582s ago: executing program 4 (id=2489): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000080)="0f01390ff2f63e0fa10f01c966b80a00000066ba000000000f300f79d80f232d0f01c966b9024d564b0f32350280660f38dfec", 0x33}], 0x1, 0x1, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in=@loopback, @in=@local, 0x0, 0x4, 0xfffe, 0x0, 0x2}, {0x2, 0x3, 0x0, 0x0, 0x0, 0x10, 0x3}, {}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x20000000, 0xff}, 0x2, @in=@remote, 0x3507, 0x4, 0x0, 0xb7}}, 0xe4) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000003c0007010000000000000000030000000400fc800c000180"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x0) 3.363725358s ago: executing program 1 (id=2490): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000080)="0f01390ff2f63e0fa10f01c966b80a00000066ba000000000f300f79d80f232d0f01c966b9024d564b0f32350280660f38dfec", 0x33}], 0x1, 0x1, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in=@loopback, @in=@local, 0x0, 0x4, 0xfffe, 0x0, 0x2}, {0x2, 0x3, 0x0, 0x0, 0x0, 0x10, 0x3}, {}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x20000000, 0xff}, 0x2, @in=@remote, 0x3507, 0x4, 0x0, 0xb7}}, 0xe4) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000003c0007010000000000000000030000000400fc800c000180"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x0) (fail_nth: 3) 3.258228979s ago: executing program 4 (id=2491): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x1c0}, 0x1, 0x0, 0x0, 0x240080d4}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getdents64(0xffffffffffffffff, &(0x7f00000001c0)=""/23, 0x17) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000140)=0xfffffffb, 0x4) r2 = syz_clone3(&(0x7f0000000400)={0x60000000, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280), {0x29}, &(0x7f00000002c0)=""/120, 0x78, &(0x7f0000000340)=""/59, &(0x7f0000000380)=[0x0, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x7}, 0x58) sched_setattr(r2, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xfffffffc, 0x800001, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x80001000}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r4) r5 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4d8, 0xdd, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r4, 0x81, 0x1, &(0x7f0000000040)='P') r6 = socket$pptp(0x18, 0x1, 0x2) ioctl$PPPIOCGCHAN(r6, 0x80047437, &(0x7f0000000500)) sendmsg$kcm(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) r7 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x22c01) ioctl$SCSI_IOCTL_SEND_COMMAND(r7, 0x1, &(0x7f00000000c0)=ANY=[@ANYRES64=r7]) r8 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FBIOPUT_VSCREENINFO(r8, 0x4601, &(0x7f0000000040)={0x191, 0x140, 0xa0, 0x3f, 0x32, 0x1, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0xfffffffd, 0x0, 0x8, 0x4, 0x0, 0x0, 0xa}) 3.25777684s ago: executing program 1 (id=2492): syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b1"], 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f00000002c0)=[0x2a, 0x98]) 3.16839963s ago: executing program 3 (id=2493): unshare(0x2040400) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000180)={0x38, r0, 0x1, 0x70bd26, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x9, 0x74}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}]]}, 0x38}}, 0x20000000) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) cachestat(r4, &(0x7f0000000300)={0x0, 0x82e}, &(0x7f0000000340), 0x0) fchdir(r5) syz_io_uring_setup(0x59ba, &(0x7f0000000180)={0x0, 0x57c9, 0x2000, 0x2, 0x71, 0x0, r5}, &(0x7f0000000240), &(0x7f0000000280)) r6 = dup(r3) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x2, 0x5, 0x0) unshare(0x4000000) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x25dfdbfc, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x200000000000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@empty, 0x2, 0x2b}, 0xa, @in6=@local, 0x0, 0x4}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$inet(r7, &(0x7f00000004c0)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}, 0x300, &(0x7f0000000000)=[{&(0x7f0000000140)="9f", 0x1}], 0x1}, 0x3e8) r9 = syz_io_uring_setup(0x1143, &(0x7f00000000c0)={0x0, 0x8d2d8, 0x0, 0xfffffdff, 0x3c}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r12, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) read$FUSE(r12, &(0x7f0000009140)={0x2020}, 0x2020) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x5, r6, 0x0, 0x0, 0x0, 0x80000}) io_uring_enter(r9, 0x47f5, 0x0, 0x0, 0x0, 0x0) 2.479565974s ago: executing program 1 (id=2494): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a00)=@newtfilter={0x2e0, 0x2c, 0xd27, 0x30bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x3}, {}, {0xfff1, 0xc}}, [@filter_kind_options=@f_matchall={{0xd}, {0x2ac, 0x2, [@TCA_MATCHALL_ACT={0x2a8, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x3f}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x40, 0x6, 0x1, 0xea, 0x100004}, 0x1}}, @TCA_IFE_SMAC={0xa, 0x4, @remote}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}, @m_tunnel_key={0x128, 0xc, 0x0, 0x0, {{0xf}, {0x50, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e20}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @local}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @multicast2}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @empty}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e23}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x80000001, 0x5, 0x0, 0x7fffffff, 0x3}, 0x2}}, @TCA_TUNNEL_KEY_NO_CSUM={0x5}]}, {0xaa, 0x6, "702d7b7ca2605b80fb0bfc581434a99b0850c1e175b9e72d4819877b7effa9a22735ec0257f9035602a8c82a11dcd81f6da90792c83eb930b4651b0842fd8b24ec959c6de4ea9a6fdfff65cf7fc47d67a92fccbcf4fd60e2271bae67b9018d70f2d67b7fcbbfc60cf21233bfcc9ab73d6b2b4e85bed55d04fedeb2f8b470d29a44a7f85406cacfcdfea3e574aeb330772672c017d8cb90971aa75861a28f23ee6cdfb876faaa"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x6}}}}, @m_skbedit={0x128, 0x2, 0x0, 0x0, {{0xc}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x8, 0x8, 0x10000000, 0x7ff, 0x9}}, @TCA_SKBEDIT_MARK={0x3f, 0x5, 0x3350}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x10001}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x1}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x1}]}, {0xffffff10, 0x6, "04f1182a84f597cf3b9523440c209d73ff6282fffbe76149d4d47c7f085e00962e0197abc32c39d6c30a5d1b7be4d09795bce6d91a10a26c1a35fc59fbfe2ffe96ec7f206d912712c74135715760f3e6da7c1f87b9a4359bd92c4a106b30e29df4501a7971e68cd5c207fb9a850306331fd3a39ad27e6cd6fef98261cf73c07d26dbc5dd8b3fbb5128be3f63dc090fdb8d78e151445e7a7a17bfe450e03190ce0b6a62bfcdbecf9681515413ed98ca95e4a57d3350cf749b2317a1938d"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}]}}]}, 0x2e0}, 0x1, 0x0, 0x0, 0x4040011}, 0x0) 1.920501168s ago: executing program 1 (id=2495): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_SYNC(0xffffffffffffffff, 0x9408, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r4, 0x4138ae84, &(0x7f0000000240)={{0xddddc000, 0xf000, 0x10, 0xb0, 0x0, 0x2, 0x82, 0x7f, 0x1, 0x7, 0x4, 0xe8}, {0x8000000, 0x0, 0xf, 0x8, 0x0, 0x0, 0x3, 0x7f, 0x2f, 0xb6, 0x0, 0x5}, {0x8080000, 0x0, 0x3, 0x7, 0xb, 0x9, 0xa6, 0x40, 0x0, 0x1, 0x5, 0x4}, {0x1, 0xf000, 0x9, 0x0, 0x81, 0x7, 0x6, 0x3, 0x5, 0x2, 0x5, 0x40}, {0x10000, 0xf000, 0x0, 0x4, 0x4c, 0x81, 0x10, 0xe, 0xc, 0xbb, 0x6, 0xf}, {0xdddd1000, 0x4000, 0xa, 0x4, 0xb7, 0x40, 0x2, 0x8, 0x6, 0x4, 0x81, 0x8}, {0x10000, 0xd000, 0x0, 0x2, 0x1, 0x5, 0x1, 0x9, 0x5, 0x81, 0x1, 0xf}, {0xeeee8000, 0x6000, 0x8, 0x5, 0x5, 0xc, 0x16, 0xbf, 0x5, 0x1, 0xe, 0x7f}, {0x2000, 0x7}, {0x1000, 0x2}, 0x8, 0x0, 0x2000, 0x200, 0x4, 0x8000, 0x1000, [0x0, 0x7fff, 0x5e]}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000080)={0x4, 0xbde, 0x0, &(0x7f0000000180)="a1984ec3aec3fc2e025f90eda6dbc903939aac644fd36f1e65174cae030c42cbacc392851a695f247112e91f059460a2c031929dc0515ac7cd20775ff9da9c2b6cb48968dcd6d8d982c492932c572f084d3af58650d207eec0794b3e47c5678c36b9", 0x0, 0x62}) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@x86={0x7, 0x8, 0xc5, 0x0, 0x6, 0x9, 0x4, 0x6, 0x1, 0xf8, 0x0, 0x1, 0x0, 0x3, 0x6, 0x6, 0x9, 0x4, 0xfe, '\x00', 0x4, 0x4}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_getmulticast={0x14, 0x3a, 0x200, 0x70bd2a, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x8004042) 1.854956115s ago: executing program 3 (id=2496): r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x4e20, 0x0, @remote, 0x3}, 0x80, 0x0}, 0x8000) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000000fc0)="4da77f758d4b9117c6cc7ff6752545e024f482e87e928fc5dde412d10eeabaa238301544cecdfd131658114003a5d049e82c2d51ad86a92ba9766caea976660401e270c4601c3a032711", 0x4a}, {&(0x7f00000046c0)="ed570924a04076e7a05c9a1df4a4a8d74d272701a3ba496b677d44c4c2d3edff29d6fd12b7bc1c6f6468bd8eafdb74f63756a83a66caed8d0c2d56439cad4bbd4100e0b6df3d3c157810df6b90da489a81c7bc48c00c9995b65c79006b47cac6171712d78259c1d5a4335555c631923a26cb9786fdacabd665d94e7687cec1b23cf08b5de17045201e7fae08db9c47cfa19a8ffef7762daf9ca316925775225ed050a32ac01458e3865d17d1cd62841819316e98ca36c8651a8ef808cf1bc7188969bcd205f004c58159bc941c6399a88bc124c8a0a47dc4e3546429ec3c363375811e7653317492a4486debfcab21d7af4fa39528e49a6b2885edd369dc1c6ec7b8c2311c393c725856147b06ce109172c480cc4ea6e3c30198ac84e75318f2f6a4ddad661ea76b41c1b614d2353ecd1e005772fff23095f20d54046cd7c0f938fa1c9d5c27adda5ef552a1d6fc1f271da3816f7b82540b12923b2d38f906912a8031e24fe6c1f9e6692b074128a3cd03faafeed41e5615bdb86ce3aa1e000c18010e95934b1c8a1dd14922773e8951889f9be3291b6842845ac06a28e233a394a57e6ce572b8810e98f7a7256ca494de41fe6c72099d38a6f4964f32ca61880c695d757d3346a0dc8e7c92e555e5c12b8cb9be8d9289fee2f17ef988d3e7acc8eeae5e7cde98153c409c48504eccd618b2676930711159b631c76b69c792a44a3696979495f06ddaffb7f60af1af0ab2df1ff3653a902201ffa93f77202b4637abfe654ab42abfadac65a09c45afde7aaec8623f9424885ec7c5fd4adf111192a5d36bb73e79cdc2a6a25e3a29d665beae71db419984f05bce4b0576d44e0c7f26c722aff26af467acaf2fd2e0d153b95281d59c985229772a2deeda2e27cda3010c66abf08dbb7d7b461bbe1f143762c03b755f81d829b77314e6cfc2fcca5269567b206530e15263c55045707db56b51ed3f797e086fde879863eff033bcacf01880c634df426cfb495c81c4048754a3f05b212909ac7a2a050461a60821b2b7e99a2ed2b2a87e90fa5995cfa3884758eca6d4aa8e35b952d3f4be73ad9c27bcdd287e895597b6ce0294ceede0abd6b8cf60cd5dfb0afcd2088611d10a39736eb224e369ff117bbd94c5a311c9b7075b739f0ac7780d1412d552dcd278245f98251b93b326c8d1ccb3c2a96bb7c161363bfc4f52aaa252af790c3a57979d1d81df8e147e0bdd46704a51d48765c1d1fff316c892b66b8d13319783ead3c7f89600e8f4440393eb2e3fff2319fc45cefb740c59db8680c9d17fb2f37f194d317e5e989d0c5c361f0915ebe2efea196dd3d8d2fd747043738d91fe4a4c02a7369c333c253a78eed8098fda8b92bd37b65bdfec9f1c499cfbd8dff47a81d01d88633984a63eb4277dc34d7c42eaf891c14d9a12b6971436023ffb223cc973382ec5c4d1188d2b9ccdb1faf96062088bdd25284f311bc2fb8b4d1e355e2f76ec15342d4d9413fed8987965eddcf69335c62d2d3fb66d68e203f9b71c998abd92a5b5b9f07da2ddb44eb05b25a1a8a991d7c602558ca40cddfa98371c893b1002f7f8cdcf913fc085a20aa584fee9614a7d3d7444c8a4a00cdcefb0c172ffcd9c6cd0653ecaf3526318f3b3cddc32c84d76c0f93f7d18cc625bb02b89df352a8eeba1662b4bd2a948266b2fb9dccae4d8fca25a9f3121fcb8056a0f8cbf31fc694035f588c46769d8ef23bd63de1c9fbbfab871d0d47764ef1805f86a09b35f6038c3c28bdd2dd8c61742f49e138fb833dec4d899057f676b9b91aa1d3f3eb54afa17c9ba78e678679ac88f4192ba7edf891b043d5020fd09246615e9e9941fb47cf6a6ee83115e2ef7d5aa9ffa63b7cb90068f4f769dbf78039e7dc794e41845ecafc75c126816e673fd53", 0x54b}], 0x2}, 0x400c000) sendmsg$sock(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0xb000000) 1.654879262s ago: executing program 3 (id=2497): openat$tcp_mem(0xffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) socket$can_raw(0x1d, 0x3, 0x1) r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7f, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x3, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000100)=r2, 0x4) write$UHID_CREATE2(r1, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x11, r1, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0cc5605, &(0x7f00000000c0)={0x1, @pix={0x0, 0x0, 0x35315258, 0x0, 0x0, 0x0, 0x7, 0x400}}) 1.536539574s ago: executing program 3 (id=2498): socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r0, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000027c0)=[{{&(0x7f0000000400)=@in={0x2, 0x0, @loopback}, 0x80, &(0x7f00000005c0)=[{&(0x7f00000004c0)=""/158, 0x9e}, {&(0x7f00000001c0)=""/18, 0x12}, {&(0x7f0000000580)=""/50, 0x32}], 0x3}, 0xfbcf}, {{&(0x7f0000000680)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @private}}, 0x80, &(0x7f0000000740)=[{&(0x7f00000007c0)=""/221, 0xdd}, {&(0x7f0000000700)=""/16, 0x10}, {&(0x7f00000008c0)=""/93, 0x5d}, {&(0x7f0000000940)=""/232, 0xe8}, {&(0x7f0000000a40)=""/137, 0x89}, {&(0x7f0000000b00)=""/178, 0xb2}, {&(0x7f0000000bc0)=""/245, 0xf5}, {&(0x7f0000000cc0)=""/157, 0x9d}], 0x8, &(0x7f0000000d80)=""/140, 0x8c}, 0x5}, {{&(0x7f0000000e40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002280)=[{&(0x7f0000000ec0)=""/30, 0xfffffffffffffedc}, {&(0x7f0000000f00)=""/94, 0x5e}, {&(0x7f0000000f80)=""/235, 0xeb}, {&(0x7f0000001080)=""/4096, 0x1000}, {&(0x7f0000002080)=""/8, 0x8}, {&(0x7f00000020c0)=""/62, 0x3e}, {&(0x7f0000002100)=""/203, 0xcb}, {&(0x7f0000002200)=""/83, 0x53}], 0x8, &(0x7f00000022c0)=""/54, 0x36}, 0x1}, {{&(0x7f0000002300)=@generic, 0x80, &(0x7f00000026c0)=[{&(0x7f0000002380)=""/194, 0xc2}, {&(0x7f0000002480)=""/120, 0x78}, {&(0x7f0000002500)=""/219, 0x82}, {&(0x7f0000002600)=""/113, 0x71}, {&(0x7f0000002680)}], 0x5, &(0x7f0000002700)=""/166, 0xa6}, 0x6}], 0x4, 0x23, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x446982, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x8010) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000600)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000000c0)="b9da06ce171c2e7cc2a25d589ccd75d0275367048f46e1d1833f0b225d71e6aeeafac6b1195e3a2a07b7e7608b3a26", 0x2f) r3 = accept4(r2, 0x0, 0x0, 0x80000) sendmsg$alg(r3, 0x0, 0x0) recvmsg$can_raw(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000140)=""/103, 0x67}], 0x1}, 0x40010022) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs$pagemap(0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r4, 0x8923, &(0x7f0000000040)={'dummy0\x00', 0x12f}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) openat$vmci(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, &(0x7f0000000380)={0x60, 0x0, &(0x7f000040e000/0x1000)=nil, &(0x7f0000c68000/0x3000)=nil, 0xfffffffffffffff7, 0x0, 0x0, 0x7f, 0x0, 0x40, 0x0, 0x70}) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) syz_emit_ethernet(0x12, &(0x7f0000000240)=ANY=[@ANYBLOB="0000bcb8b58b965377a33c90674bb21eb9bae7aec9322e820e07420fdfb42a1e3f46e730bc30f2cbc5ef557040271b2fc710ae88b32ae289dc5cab091998ff249eea4decf5e0ed54e8cc5e05c4afb135cf04aac7626b70adc631d65e02ab57e38dcfcb767e5b3cd6af26f3cf97a123bb9f14a5021e27f5138ef88a5187e1055cde36b0d373c85870aa1dbc8d87756b54acd9cb3e76dfd72f91519399a82b04a80a72c94b53089d7e1d44d744c25e942ee56629ac17dafe38b8049060124af17674ff8ffb14786b3493d80fba2c927b55ba3fb8a21ae410b644e1de7ff96340f62ebeba716e05515338e213bcc13aef2320f7a23faa52f7ba4bb65c2824b74e32861f7aeefe1ed47a13a793fd26d14c1d93008f7e13dc9a893cb5"], 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x5}}}]}, 0x48}}, 0x0) 1.529416787s ago: executing program 1 (id=2499): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000)=0x3, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x80) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000cc0)={'sit0\x00', 0x0}) socket$netlink(0x10, 0x3, 0x4) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, 0x0) write$binfmt_elf32(r3, 0x0, 0x4cd) setxattr$incfs_id(&(0x7f0000000200)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000440), 0x0, 0x0, 0x2) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000100)=0xfffffffe) r4 = socket$inet6(0xa, 0x805, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, 0x0) r5 = socket$tipc(0x1e, 0x4, 0x0) connect$tipc(r5, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x5}}, 0x10) sendmmsg$inet(r5, &(0x7f0000006740)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000004c0)="80349c0d9e8fcc9f44658138dc4a3c4ad42f918348474a5bc38ff0e0571fc22c8eb5cb22fdf30c6d1a4c1ccb5e5b35fed7db48c1a8a7132adc5623d146ddfe2254dd2579b4284b53d1cea6206864473d31bdb00c9d1462458b678827e80c94d88099e7471a58b1463086f9cdd1ccc19fa2fc4a9dd5a56fe782d15e66648c7630f1aaa7e9820460c46e292dbb8fa6f6701048ff17f40e2ab1ee0750ed038f18b81b2ba014bf866062c9a6f88b5d07e13b7eddd968ba9c7a53609c7b61471a51fd85bceebc0a92b2cd7c45a7f4571e693abebc3c5ff16c81106db988096bba7772e6acc5956344eaa64fea7c6319a37312ad57490dd2ebcb9bdf2815aae851bbd55317b4fcdaa8b06d30ed3db8a117424fed41f68979ac996e7fcd4549daf29bff6a2643e184580eb0b0bf81046975ea8d5e06e7124790dfca059217a34f4120feb2bb", 0x14d}, {&(0x7f0000000280)="5b4ea80f20d7212327afde5e7a457cde2dff9073f71979", 0x17}, {&(0x7f00000002c0)="851d8a90d516f218f839a7c48edfe734b2490c90a2fbf5be3383f1c9f5be8e55148723ac0258ef4f8af1f5e0b0a86885f018523d60072c7d9c1568700b3abe208fbd5dad2daf18b5150a530d816bf4cc6e43da4f2793611b38009e8c0970268cf5836926fd1223f4f8bec6a4a68b2aaff7af151a661793a04cd9b936da8f53eae22356781c580df817f3168269eaeeae014fa9b1878bd89e2acb4853ffd7b9a06d7f5ff090c605f5d343e6d93c80d747365d21acea325c44fbb87f6271a2d9333e9b9dd1d36dfea61641d34fd54cd2970ac14acdadd04357bdd44bc926d0adef887b2e25c2f435ce79bac1d1f473c3a49a12aa5c5cfa4bfa4fd2470308ed259e62c218aee67006a3ca187c9aa13a806d99b2275341fd6022940537b1cb1fd2389f417ea92c6e77a09a9d09a98c4e2f0912d36b47588ff991aa98c3c650055bacb669aaf68dd4f8a7b43569c9af62e7cee6ba05278fe8642feafa5c436cb13fa45b3cdf750f8956c493acf7c561b12259331a363c74fb5f2947652ced415b0986b673680e8ad7bad823ff84c30681cbe45114510d9aa6f423f212bcdf1c244178ae31474d9f176707e9c481057f72d489372f7daeba51e3ea86895c8eed109566ad19f3957d0df21a671fce2d674c207d8643c85a018834f4e8e3992e6991d815", 0x1e0}, {&(0x7f0000001440)="f0e266805aba28ca0c0d67b3479e1c7cb90d64b8ba8093c11696a92981d4fdd1f40043ce52efdea3f8d7b9ba23840df17c5a35207d6fc677263be310a063adb7b1528b8a04ec5b50d2cfa0df73c57f16a94941e8fb22f429a1f34b5b01514fefc4bd79a2cb936cf2eae82bd7b628431ae2d7b61059b35abc6ee24fd40e3c1bd6106af177bc4670395df7238a420fecf1e6ed3fe8906c3a2843215618fcb72ae77c6d36feefb4d45157e5d35fb4bf297d15ca042520f08e85ad2d7c5045fc7c4a2a8b6e149fc755d70437b3835083ee9fc662afbf840ab97f0adcdde20099bb22e909b937696e9d950ca0a361dfa8f5453454696927ae5a2401340264bdcdcd86941c18b536bdccb964461679d1b62855dadee9b66e5d494183283808c706247cdf83b45c44178775fc957483923b717724549dbe2f9a092fa07e93a7772d16bfbff9a0dd14d48d30b1e4f8206f92cf2fe08a7702f73404b79e77dec1b694e8a7c588a7bb2d770122291b10b456c4419dda49da0433a0aa5f0be221d29b45082b4f9521c2a1fbae507aa2652123619b78f340f01523bf9e6089e8e8186af2b85476d7059226f07467a6e036bf8808f2e9070b2a94ac1c64ec066def276c362a1d4a830edf754783f0a1e52e1adc4f6ca2d7200fd73b9cda79ccfcf57a27f60e184ebe12c4daeb214c2057b69719db280e0dcc2d10b085c7ab8e2394bae44893e3f335a3121bae3a33c32b004ab7bca48726029b77a6c784d2af3789fd520e37009d103c0a63598fa5857ee1b86a38a9feaf1d1f512d1884861c13d647d26888430e2f15e78cdd6a4c875e52de709dfdc4af4775ce03d7c8c3ff2b9fbae82dbabf11460bd1bc1ffe10c5062a265fd211a2b52a41613cc03917b8d34591885396369d1d172df31244a236c49d4457a936848684b59e326872d58c5db20684d1194ccb7ecbf5017f0f702f29c75cdeea09619db8bf00b41b1a165af13b3810d7f7b6a681aef628190f4fd53244a650b0500df500946792d003f2d2f0ba3c57f8257c0cc897cb1dabd63870ef86378a14e7f5068ea6a2311414656d766fb24e43c2a57b44cb1dc584d71e91628348790dc6a9adf85bc403a934e7603f7b45473407cf1395163b3efc9e880963bbd98140adfd624ccfc1141cd899826261e152265b9307695488c0cbad9027bf74b6f0c7adbc9878983d96e6026c818ac30fac3e2392e1c8fdab8ccf902d0915a471701083949efafc7a2e05608139fd0ef22d834ff02569878579c43635ad2d56d7cdfacaba8a3adc47c7fd42e521ca6b14726e68f67e2662c972bf9824ba847e22985400fad74280c22a0636aee80eeb7ef0c691cee94573ec78b53d43316ba691fd5274d1ff8085e297d2781a31f704dfeb58db9fa216c3356341207e953712de9ef27018bdfdddba8abc0c5f205908f12a42685ecc0c20cd92a57bba45a435f7bb412ccab1a6d877392971de8b808af07ea32b102dbcd7d00c869ad5cd8f5a5895b3d6dfef226d51d819756a85ffdde3d08f59fbbb7510a9ac3568f8f039fa7abc7b34685f3579050e88773cb4bb7958ff83aba1f23c8ab4ecd019c59781d47bcc50c64a957c3fa37311a240649313f77fa81020a5da0560d3bdabe6001ab6792ad782fe0e44bbb59efd4a524984742940563dd9e9a0226925324ac94373a9dcb16f32183ef3f465a13b83974f593e664f53131241e2133ce22917fbb412354a51026847f92aa7afadb1cdf51677fc2fe5938812ef17ae79f4db75afdfce3c5b8822dd612457b5f59dd616acdc473e97afb83f3c9789f3df399a2c3c89e8b5e6db33a306168b0cd4e8acbbd6ac81dd46cfb2f7d24b609d009049784611d027daa0cfb12111c1236aa010796cc687cbb151ba30e3a786ee8bfdae51e65a0c3667f7b8856089621742bdc19ad66f60eb48bd7f20b0ac2a523e89e6a7089e3704f266c52c58994e018e5d20b77a0413c71cafd420d9e0abb77e9f1199aca31f6d94372ca5736c749c197cac572e4962fc089f866a896763cd7b804c8e7211bd3a64f1ed12d65182deb850279ecb530683551bd50214e03b9f813431688dadf4caaf77d2e8b20d3e5c424243ab50f9c20462cea0f38eb080b02074e3e77a236d4ec929b04d134dcc5f767736c096794be3aec9f1195b87862128b436fbd0305a6ad6ebb0b2167e184c1de57048144b7567a6ad6c028c4b8a78858925f0ed415313da984484f753d14234d30964aa3d15af13337b6e5338d4f787abc18e0ea4d9656aa3c1d3eee0854078470a0e724062fd61a95f17516ca92faae8397ce07ba558a689ea49d25685a28c68fbc533892827829692d65a15711f0d14f7f685095f6c5dd085b30ffc4dfd9097157c1fab80023d24912861e87d1e484fe5a4476743dcb983d3eecabfe168db03f888432d8b1639e89c8f0513dc36ca8969ec364d28814fa6e21f979020df1292d772cd20c0eb4a5888f38d8d129e30ffee29ab6baf3b2f3a509e02d26b354f1ebe3531fe97968f1f678937b36f3684a8c100030a2328941dfc09574f7cebc26337cd4b2a6fc0b92affc3f3f892542e46fd6cfc2780c0b8a916b3fbb7f33a2537571b06643d82f86e2156740e024b360f48b844797971383610dc93abedc9945ec26d6a56e2701522e3fd6b77d4647a137346985af549d8944c652ddd797e1856a30f296258eb275981bc9432f38532d6e141d603b002c75247b3e71b39dbc01e8e64bc0cd510bd1700685a95ead8fb3fe8fbd72be2e8f9f5a9f1b2c400bfdc0aeabb14a7538c9a38a4839bf41120f2c2aa00277a327d7dff15f52854146a94ea41e4f14a15443124c6bcff43489e7e242c8315ed8d542377fefb6002292c1adc571c730d67b8dab5a4da06659fe7b69bac3147ef39fc877c323edbb9912886ab468c530a8d7844692010ea93effd20f4ccc47b3ff51f378c12b1d03155d49772f14d65bf2ce38f589ca4647b6713ae081fd13e74b307aba8bc34a4406d78c26ccfdf328f5c273b294f6c6419cc157eca59939ec4c0b95cc6d5f97c83c3f14aeb5b88910ec29cf64496d9b1b855fe073d4791507c7533846cdd7810667427583b3a8b7febb2c43643c09bebbb12c08781ac9d0995723fb47febef49e0d6631f054e5b3b3a284391590cfb5d5cf4aaa71586cb37b9fffa15848176da20969e88ed87dd8a4fa2b5140fd56f0a9973217f8ce0c6ee50b67214b6d7d6b84d41d83694a14b2e96f0cb79b49f5fe4dd21727c00819e83b6ea203bada46e9ae8ce7bebaf24f05fd20672e4230b3851b8f05bb2f0977dda7c8cdd1f2689b7a10a72018ff76699e53b2a3f77bf7fa03fe3cf85d4859c9db915fa5c1ddff79e77d0b1b6316d3e50d0d60a42271332f3e81376f120836cd3ea55b7f1453833a7bce0058f79b698a4bd0e857ae35b8ac8f20ed8f238475757af11ce7b450cf89191a4f27a365f594ef68efe6ea1a5c3518712b1aa37a1f47e05f85debfa461f5346d985a71e49ef17f4eb068862977d56671d445176934be6b5318300d7debf3ad8d7da0c014b25af2d8fa52753974116a8cea6c974692f5de03b526a075cc3bc8a4375333f0ef09dd3c361738a151f326ba3253c171f8f7876107eeac122a65124e59dfe7c66bb9546d6428559df314063ac08c03d96b04b6a91508371fa18348c65238546f3d489c7efc1bd01e6e389fbeaa8f125bc7b7c8673904eb676bbdfa3680fea612ba20fab20cdd411c2bafe0417b76852de9e863f09d291bf59510ead793cfd9d6710c0de77cefb5b65481d3aabde2683457b13e3b32ebc06f60d5afa47e36f652a95bd16dcf55dd3e1b05d0df9b8a183553097c2aa95aa175eda6792f58a74170781260e6120981549b3836d13ef037178dd8ddcb5a5624f3790f9d92b0f8f3cd11bddf478cd79456db871f32dd6e24948dd762ba2c22a94300f527c1df5ff05aef5ae4893ff88adc8f7af779d03fcb4ecabfa32460315f27505681242064541657acbb29f531043ce1d04ad189045140232f24f46d0580ada560c61fa4a90aec4743a9a0d466493476923cdff87a21127bac3da7d61d674d8bc9bd63cc3df85c707a912773e090256d5a0bdc5da8ceae2ca25c596410982b63055e6d292a31776cefe58457cb6b5cb92a2c69ed5eeed35e4ea3d6b54ee22e41dea28adac6e1eeadf604f0ef3a67c86974c3ecacdb7f502c74ed31138123dcb80282dbfb0ea0fc2a6016dccecbcbe4952c27b09e7abf784db6b7cc55366d048f16f6473a268b90a1c9b9c612f88bed9008308b11e47d79329cbefc3f313863eff4a16e6a70c41a296d3042a1164d0578297642ec82da1f92dfaa6a67ff9cfcd1b3e88fc442246a303a0e539ce65ad6fcb6d8657937cd88d4c30fd369f2bef0308f5db8824919139b25f82f56e24ef4cf1feda07c3bef9dd215575ed774dc05603f4664332c7b002c48d873bf1ebec930a273efc78dafe153f7eba9161002ca9a8fa855bc357f3a67810fc081b9ae9b4f69401ef93d039c7c1398fa8c9eeb1ce001e08e9231ce2c2beacdafe2955d4056e18d4d09ed22a996666d4df5ca91c37663bb54eb42fe39712736fa0e64ad4f8ca843fe52702c9ae48e60a3f5eac160f58ff3cb80684120845b9e34bc1aecb19662b1a429926ae351d004eca1d367fcb34facbeb2184716c5140a7e420c7f4379b0c43ce872b62723a587d9ad528c2aabf158cefa2df3422203b5cc73e9443825089527700b69a2331e0558a9b1e9d3e69a59896e6cf4df46b41a8cbb0e598a874fc23b16a6eda6eafde02451f0255ff9e6d1bd007c86dee8b6ae875752415b8057b916a3fe7b35cfcf7d38a50e461f1fc1d6a4541ba4079e1f21d0ea2a5ce4aad561215a1d75a2599c757cd6025753fc0578e4b7f4195ad025c46d50c5c351af1ce1e8f8c35439c8598293cd59d2e90a1445497b0249a314379dd13e95f00f2d8240190da9e12adbdd809b1a96900054db156d2893f7998aca02c86f61478a9b21e9e11a6f4b9f7f382243739e492e9048ed9c7b0b8118d966c0f41709abd171873c498a3168639bb2451e0f65e93755fc9cbf3b996ed0873a8256a579372146c3a1e749a9a640f8e9c01af2d0fdd34f2b5fcf4e0bac0b7becd41851359f89dc17156b6ddbd6377c05a059cde362397f28ae2cbbdac107142b40913aaf059d897039ce3fda8c29ae93210676e44f131f78e78d68d858bb7fde230a2f0fd542c5e8374fdc11a488da9de28bc3992a8d74089de36a732110c841bbdc5f24f71663d9a5f5209791fb7027749be23cdb3380f581151563d3707290cd31b28c13139b8e041cd72af3ad9b0fd0b3f131608a8ec5d80c4e7cd458abebae0244c921ef69a4ea0e9a2c2073bd13b49f574a7e278c7ba08c22d89b678a3cd814e8d0dea0101d95f789ada5178f46a4c6beb8dd12352cec179c886ae98ac2bc4382acb565df99eaff3f6824536ef7de884176ea3ca14a9f225f8ada2aac871e7c35df92943600cf7961b8eefdeb70d985fbc93252c978c5c773b4f2ab4b7683e2563d36ebfa4355969f6201e4bcac04ede3c6c9a18ed23f23ec331cbe2d645fa4ffcb2c742ba4905788c27a9bc97536dcbc08d3cbdd2f7195acc0f0eb3cf52aad9a1d23a1dd3633a49a482a1c1eb8761dcc7474f0fd4596a661b7668ab22ebecbfe33886b9b4a0c250380a9a34fefd9724ff89b32e5622258287b3281bcccd0bade4e260b6fefe73219c41f2de521587404ac1d2de4e2999202b3870099718115552aac2d446e649", 0x1000}, {&(0x7f0000000080)="253c10cd0a56ebbb9e8b465670109c340c95f1d27d36cbeb7fa948545e9b18da346b70b5dc78a12ad1a30e4f7038336f1af1d61b0409988f1755e9b3ba9919b2a4952ceda920f5f0e22dd247d4a74f2d1c854bc64f09f979aa3e9f5c25ff8ec189e5d809483583f648cd8870691200e428d5dcae697fa5a1e48df472ebb098aeb32e4049eba9f92be1ef1b6609f2b91c449dca240f", 0x95}, {&(0x7f00000024c0)="2ba671ae8107530b978dd82841597ed8f4275ed9e6b9f7b73ee6324ddf688ad9d88125b82afd2e28aef7183086ce0dd4ee880fc56a2ca8b52ef8f5b5f3e475f49b0bcd201fe612703d680fdd1151dd32535b04d4697d472c7750d6c4c197162e9f872253b611b1ca20e79dcf40d1faf58a453f8db9a03fdd351b54ad4e77fa0fda7990bb281079ae7ba3994aef7380e1d6342305e2d12c57379fd12e784f48e4e832171df4576c8724e3bfd70ebc92fc11914cd4", 0xb4}, {&(0x7f00000025c0)="96cb9dfd0c61d5ed863c5a35109d427201da53416c37631f95451a170fdb734214157996b04630903a7ad20aca669b5120871c47c6ef4e5975222b9676223895144ae5c2898ba0e94642e43e374bf9515c7e840e62021f25181401bda4c4d2d77867390c0a05af019adabfe896d7824f0dcb1724c64da40478808059ea83fa60145e108809ca25edf6ab820f23a5ce2b1779aa8c037a26d99df56f39ff5beca1c1e0cbfd69e415971a02f5115f6da0ba6da9be9772efa870aa6b62774ce009e7bcca4b4a7a910aab97e7f3da899eaaf573ac8a926a7be9b5875b3bb707ae9124ead39e70948bcf654b6b4342043f756323494e4ec559866c5a480c3b156c0427f1cc1d373b77424ea38e3697e36dcefd261575e5516bfcedc7baa8cbebed0ce49dd27e6291dd6f968eaf37f13313ba0bd22b6a63496be04a42df10fef87386434103b5ef819a969e8792a7765dc52c310fbe89851eaf8b2eabcf27bd487f817d48a54b0c7e8b151f0941a6f4adcf6a4486f96f8d18a2928829db333ec08bffe029f4840fdc0433d75157e80b33c3041f193e5c3fb1b7c13d1d7d7a8fe3122ddef181a6534232731c8f91dae42d9a66b9c2e0c6de6da74c24752b53d344b3c9a48ed62705c3e93f7e346c0379a6ec672b3a73dcfc159a79a77bd7b9edd013e3e9832d4dca6f9f973d63d5d235c7e22822e012e4181e102e68b03bdec323db739968061a7ba6fcf9589bd2975520fe9f1b44e52489bf5f5b0125b14bc894f4ff1ad2ba817dad6ab1654a2cacce1cc5160ea4bf3d7011cbf16ad0389b6511448c4186da0a7a55be54031a6d2773ac33aab5d533e7bb213309193f2ca3970e8fffc2fdacbc96e6f49c116b0505385a8bf282589be6b844e2aaaa652459b5d021127f59009020d34932cd03fbe5fea45bdc1f68463c4afe2b5ea8f97dee5e2e6b58196aff00e5ca51a0087f02bcb1dbdd638a5c7590095561578c30904f7ea80072de21fcedd0e41da8e7fe3514eaabc603d770a6fbed5367edb7feb5c5edfda04c7b8a4bfce5c73b876f52fde7dc929f3ffa632eb9514596793533d20fd191b484e902ab104dfc34a8486ba64d3e31c495e043279d8d6b4e6ca3c3fd4ae43529e55be690309e1bc90af2e9188cd5673eea73c75d4decf8972039c086e4b47caee900e1422fd2fbe0303dd5147a9fa487a7b08ad529d0d3db2bae4b26a83de0b15b9b82f26b23336481aca875c48605dc8d25d872920d01e2e163cc13d1f026666f8f54d6fe7895b47939599d168dc98a2de4aac463d98cb39375ac13fadd722b9f1e221d35bde594c9e53aa0f34b235a9d68d8f4841f9455804cd8a7bf05315c5bab2fa8820e956a8161cdd685fc4e1344f9d89189057376a5d1c23273d475aaa72ccbf4b5d8f2863f3f0fe7c0f8b001c065bae68aad9d8878a5edcd8dcbeec07d317c0a81fc84b8b208c60db73c6cf86d46cac98a7df449581d74be7991f1fa6924b76a2d6077aacca10fc777f0d09c5420cfc38c4638957086c9a2065ce94a286da01527bd8b8fd5830f93bcab97a4d0ca13c55b4ee32a49e078b4d79e7b17200fb6a550cfcccd33c681e37bc83c7fcda081a67c2a828e65a75df33e587a05f75fe05aef4078b3482c9078e2edb63c74134f92461044871e4a71f40228d156cbb3beb53eb898e0b6ade2d486a7111ce074510ad957f0eeae0812dd3802db231d9a15948a6b133167eb51dde0199023dfb3471661c7f13f14e786278c551d60929ef969b15d4ea544a9cda830183052ca1072083fb304502f38bcfd46ef64091a2a64bacc55ff3e91f8a7a97f69a9524bdaa60c14d75ddb44e399158c603cded78f42b79a6e9b9c30575289a92558f4d1d9cbb35780c86462cb56d5b474901c17df6ccba95481c004c384b17f99fb29458c9c59666c5305c508561e654d5f1b8ed375231358828b73b487c5f3096211f863375333bb1d3970f7c4cbc7b0f122dbb330b24498f38d804ec0e9c8a5976578bfbc2e46e8d898ec08b3742d5f9ba03d56567f6541f075c4f45eec94a6af78065689e8851294c48f02d48b1266586db86266bd2d0cbb729b567ed7643edf6849f50ca7a28b4ef59433ff22ce0680ffb3348a458ff77b6a796e849cb456df4b443d625d423d10e21bf0bcc785a243cf70ed2ea7c52548cd366ad9af486a4a0171f21ee9d961aa808a69a066aeb0c605fe7a83291ba942df3d11ba1e12da7381d7af20ccbd0de5416ef389c65d1fd0ff209dce808c490707a371b317ce65765082d1c5f67846ddfa65f291117d6e5a795ac2961d56eb24060d8b160d5bd146cd61589c00a108a1dba9e8730157e403cc35b0cd64b3aa66eada80be3bbb974d4642aa76bdf87c2d63134af1c646b1f0bfd218d4e4ebd277ad1cfc9b6f20c4036c6a511cb1ce486c3a563ca9368b10bed088bcfcdab752e0c78a10e550544ee6250d3908e3e7b09b2119f94abc2fdf43d7c82a4ffce81a3f962124ace1108443f41202c6d055d37e99b4eb6287c485acabff03f3a115db1ec790fdc5436e97bf2443c2f707ffb513f6d6494812b2238d679c8787a854ec92126bdc4681803ed4a5b84590e4f00ce956c6c3394773303b0620d118d2290cb229ea3b9bb9de8d719a0f92a50d34909a363f5f6ff906326f917be78c914c78846ef30c9b107b26c0a55401ceabf5b3c669eaa7a1a36d97b01d5da410366e3da5d232fb711d26afd9d4a5016425e47c0ec9b6305673af4cb46526af752011793c322797fb706042da364b6e723b513fd73db6721b00bd80e0923fe075300951d4dfefdd029c3fed21b734bf102f96d58b50bf4edcad014670c2d93eeb4d7bda3d1b70d9e21262c644bb96855895e4c0b32c9ed599d940ac24814b69812c124648428e13d7f72d74feb30288eb78b4a99fadc96589d8a9c7047787aa802514ba28af4d5520ac50928cd75ca92e2934a2e126456bfe1587003e87d9428b1fdb6b7662c44a5fee9d537b7f43822e5b103aeece1aa603215c215de2873e3a6b327c5ed0a0190fb7645034e1839ad165f3f7f80fd793734ac1412bbe20d82aea543792047ba5c5b37ee11988cd7e71cd43547e13c6bbc1ce3cf6aff9727381f06feb83b23b694724d9259d3736eba6ee66ee73a224b8a978debbbc35f8e28cc8267646e5c8cd8076d2044d41eadce01738ab2c7dc763de5a8042b957680223c4d9fdbf65d17e8998444e8db36c50fbe3c9a83e506661a029c4538617d46b6a43675c6dcf283a45b99e44188fd2681a50747e819e7f37496207ec448670fe62a3cb94712abeafb5dd2690ec12b18f8d67d5b0db41a897124f8b94695501aba517447338034bf14d0f99cbf5518aa013e1f35a052b4d27d1247349ff7a83362444372f017fcbdfe972b91c46a0a57f4639204673341ae92bc2dbf2b8d1680b432552850964eb1e14f38995e7e404b1bd1bf63d8d58c7b4ec38e3b9e73959e6509ad9f67d684f62759f5cae90bf8c1781b5800922c312aa634e5748b6181fc37df267eb5c66afc0c9249f9f601136c78d817beddf308c6970ee0e8221abe6fa124f55de7e5e78398004095a175f58cc270840e8c6759627f139e4f9b3b362e2700c5d06da66e862d1016c9f89d18646a6bb823f992342433b03397ed7586f489824a1495d707c81d3885029a47845802ef97856e530789a5cb7239752c6509cdd094212cb4b1b8baa7416cf5000db59418ad7f7a0d7d8e4cb8ebbbe4c40ba0ccc25283b9c933e251fff9871fc01026fafd8eed7ddcbe454b79339be93cd4b25a55af449f5c0893a957c5468c9147a973478c834ac4ecfea339cf3", 0xa9b}], 0x7}}], 0x4000000000001f4, 0x81) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, &(0x7f0000000180), 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="3400000013000500000000000000000007000000", @ANYRES32=r8, @ANYBLOB="200000000000000014001a80100004800c000980"], 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0xd, 0x19}, {0x8}, {0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x4) 476.029367ms ago: executing program 3 (id=2500): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_SUBMITURB(r0, 0x802c550a, &(0x7f0000000200)=@urb_type_iso={0x0, {0x1, 0x1}, 0x3f000000, 0xa2, 0x0, 0x0, 0x7172, 0x401, 0x0, 0x0, 0xfffffffe, 0x0}) 453.957078ms ago: executing program 2 (id=2501): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x400, 0x0, 0x379}, &(0x7f0000000040)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, 0x0, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r4, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$F2FS_IOC_GET_FEATURES(r1, 0x4004af07, &(0x7f0000002000)) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB="2c0000000104010400000000000000000700000606000100014f15a054f41e96d69d438482456d00000008000440000001010800034000000fff"], 0x2c}}, 0x4) r6 = openat$rdma_cm(0xffffff9c, &(0x7f0000000140), 0x2, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r7, &(0x7f0000000380)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f0000000580)=[{0x4, 0x0, [0x0, 0x4, 0x1, 0x3, 0x6c, 0x5, 0xffffffe6, 0x1, 0x4, 0x400, 0x7, 0x80000000, 0x2, 0x2, 0x6, 0xd4a8]}, {0x18, 0x0, [0x39a8, 0x7ff, 0x2, 0x7fff, 0xffff, 0x1, 0x3, 0x0, 0x400, 0x3, 0x0, 0x6, 0x5, 0x1, 0x5]}, {0x20, 0x0, [0x3ff, 0x5, 0x8, 0x2, 0xc72, 0xb7, 0x8, 0x1, 0x4f1, 0x5, 0x9, 0x6, 0x6, 0x0, 0xfffffff9, 0x6]}], r8, 0x1, 0x1, 0xd8}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r6, &(0x7f0000000340)={0x5, 0x10, 0xfa00, {&(0x7f00000003c0), r8, 0x1}}, 0x18) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'macvtap0\x00'}) 0s ago: executing program 5 (id=2502): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000080)="0f01390ff2f63e0fa10f01c966b80a00000066ba000000000f300f79d80f232d0f01c966b9024d564b0f32350280660f38dfec", 0x33}], 0x1, 0x1, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000080)={{{@in=@loopback, @in=@local, 0x0, 0x4, 0xfffe, 0x0, 0x2, 0x20}, {0x2, 0x3, 0x0, 0x0, 0x6, 0x10, 0x3}, {}, 0x0, 0x0, 0x1, 0x1, 0x1}, {{@in=@local, 0x20000000, 0xff}, 0x2, @in=@remote, 0x3507, 0x4, 0x0, 0xb7}}, 0xe4) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="340000003c0007010000000000000000030000000400fc800c000180"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0x0) kernel console output (not intermixed with test programs): B disconnect, device number 77 [ 548.361012][ T5888] em28xx 5-1:0.0: Disconnecting em28xx [ 548.457272][ T5924] em28xx 5-1:0.0: Registering input extension [ 548.470675][ T5888] em28xx 5-1:0.0: Closing input extension [ 548.489910][ T5888] em28xx 5-1:0.0: Freeing device [ 548.578026][ T24] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 548.601097][ T5926] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 548.628527][ T5926] usb 4-1: device descriptor read/8, error -71 [ 548.755462][ T24] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 548.784224][ T24] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 548.846594][ T24] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 548.859547][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 548.879502][ T24] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 548.897630][ T5926] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 548.922269][ T24] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 548.946567][ T5926] usb 4-1: device descriptor read/8, error -71 [ 548.974064][ T24] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 548.990665][ T24] usb 6-1: Product: syz [ 548.995080][ T24] usb 6-1: Manufacturer: syz [ 549.018714][ T24] cdc_wdm 6-1:1.0: skipping garbage [ 549.025704][T13119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.040564][ T24] cdc_wdm 6-1:1.0: skipping garbage [ 549.051986][ T24] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 549.061716][T13119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.079914][ T24] cdc_wdm 6-1:1.0: Unknown control protocol [ 549.087999][ T5926] usb usb4-port1: unable to enumerate USB device [ 549.132330][T13119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.153993][T13119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.351815][ T5917] usb 3-1: USB disconnect, device number 89 [ 549.430462][T13128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 549.439699][T13128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 549.537884][T13130] usb usb8: usbfs: process 13130 (syz.2.2116) did not claim interface 0 before use [ 549.673248][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 549.678893][ T5917] usb 6-1: USB disconnect, device number 32 [ 549.679882][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 549.691833][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 549.702058][T13133] cdc_wdm 6-1:1.0: Tx URB error: -19 [ 550.632531][ T5888] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 550.871383][ T5888] usb 3-1: Using ep0 maxpacket: 8 [ 550.907396][ T5888] usb 3-1: config 8 has an invalid interface number: 205 but max is 3 [ 550.946074][ T5888] usb 3-1: config 8 has an invalid interface number: 253 but max is 3 [ 550.962290][ T5888] usb 3-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 550.983491][ T5888] usb 3-1: config 8 has an invalid interface number: 222 but max is 3 [ 551.015051][ T5888] usb 3-1: config 8 has an invalid interface number: 68 but max is 3 [ 551.053090][ T5888] usb 3-1: config 8 has 5 interfaces, different from the descriptor's value: 4 [ 551.081206][ T5888] usb 3-1: config 8 has no interface number 0 [ 551.115828][ T5888] usb 3-1: config 8 has no interface number 2 [ 551.165706][ T5888] usb 3-1: config 8 has no interface number 3 [ 551.200462][ T5888] usb 3-1: config 8 has no interface number 4 [ 551.398219][ T5888] usb 3-1: config 8 interface 205 altsetting 5 bulk endpoint 0x3 has invalid maxpacket 16 [ 551.489527][ T5888] usb 3-1: config 8 interface 205 altsetting 5 endpoint 0x88 has an invalid bInterval 64, changing to 10 [ 551.647506][ T5888] usb 3-1: config 8 interface 205 altsetting 5 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 551.695601][ T5888] usb 3-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0xE, skipping [ 551.766718][ T5888] usb 3-1: config 8 interface 253 altsetting 9 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 551.820291][ T5888] usb 3-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x8, skipping [ 551.851128][ T5888] usb 3-1: config 8 interface 253 altsetting 9 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 551.878559][ T5888] usb 3-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 551.885400][T13169] netlink: 'syz.4.2122': attribute type 1 has an invalid length. [ 551.893517][ T5888] usb 3-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 551.908667][ T5888] usb 3-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 551.914138][T13169] netlink: 'syz.4.2122': attribute type 2 has an invalid length. [ 551.926416][ T5888] usb 3-1: config 8 interface 1 altsetting 8 has a duplicate endpoint with address 0x3, skipping [ 551.964180][ T5888] usb 3-1: config 8 interface 1 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 552.029859][ T5888] usb 3-1: too many endpoints for config 8 interface 222 altsetting 178: 201, using maximum allowed: 30 [ 552.049225][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xE, skipping [ 552.060756][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x6, skipping [ 552.098286][T13174] netlink: 6068 bytes leftover after parsing attributes in process `syz.4.2125'. [ 552.107584][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x1, skipping [ 552.129921][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x1, skipping [ 552.160501][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has an endpoint descriptor with address 0x99, changing to 0x89 [ 552.200053][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x89, skipping [ 552.242925][ T5888] usb 3-1: config 8 interface 222 altsetting 178 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 552.275576][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xA, skipping [ 552.298808][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xB, skipping [ 552.318763][ T5888] usb 3-1: config 8 interface 222 altsetting 178 has 8 endpoint descriptors, different from the interface descriptor's value: 201 [ 552.381586][ T5888] usb 3-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0xB, skipping [ 552.590777][ T5888] usb 3-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0xB, skipping [ 552.640952][ T5888] usb 3-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x1, skipping [ 552.703243][ T5888] usb 3-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x7, skipping [ 552.742060][ T5888] usb 3-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x9, skipping [ 552.769014][ T5888] usb 3-1: config 8 interface 68 altsetting 16 bulk endpoint 0x2 has invalid maxpacket 64 [ 552.791979][ T5888] usb 3-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x5, skipping [ 552.825034][ T5888] usb 3-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x1, skipping [ 552.854498][ T5888] usb 3-1: config 8 interface 68 altsetting 16 has an invalid descriptor for endpoint zero, skipping [ 552.887269][ T5888] usb 3-1: config 8 interface 205 has no altsetting 0 [ 552.911671][ T5888] usb 3-1: config 8 interface 253 has no altsetting 0 [ 552.927861][ T5888] usb 3-1: config 8 interface 1 has no altsetting 0 [ 552.957241][ T5888] usb 3-1: config 8 interface 222 has no altsetting 0 [ 553.000737][ T5888] usb 3-1: config 8 interface 68 has no altsetting 0 [ 553.095646][ T5888] usb 3-1: string descriptor 0 read error: -71 [ 553.155650][ T5888] usb 3-1: Dual-Role OTG device on HNP port [ 553.176045][ T5888] usb 3-1: can't set HNP mode: -71 [ 553.648045][ T5888] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 553.688713][T13201] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2130'. [ 553.807769][ T5888] usb 3-1: Using ep0 maxpacket: 32 [ 553.816474][ T5888] usb 3-1: unable to get BOS descriptor set [ 553.846648][ T5888] usb 3-1: config 1 has an invalid descriptor of length 64, skipping remainder of the config [ 553.882139][ T5888] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 553.915305][ T5888] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 553.976646][ T5888] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 554.007894][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.048025][ T5888] usb 3-1: Product: ê«£é’㉣豲谳ᅒä¼á±°ì¹Šé±«è‚°à¥§ã·€í‡¾ëª¶ãŠâ¸Œë¾é¾³äˆŠáŽŸÓ”ꬑꅋಛࣉ怛皢旭옸ꥌ㋙à¯à«å—»ì§‚埩ï»í™‰ë¸²ìžï°…ë´ì†¨á‡“쩷苜ঊ纰㧗⹃㪲縷축㚜옶ﵦæ ç—’㔇辨늭äŒã¬»å‹±ä©Ÿî§·î¸©á’˜æ´‰ì¼â¤¨í”§ë…°îµšâ¦·âµ—䋠죱뒵蜭噦䉂ꕌཛྷ౭î©åŽ’è€ [ 554.154064][ T5888] usb 3-1: Manufacturer: ç¨î—¾ëƒŒå™¸ïšÎŸä“瑉죎鷼硬᪤ấ껜é“楹ꗷïœî£‚岗ᡈ蜓ㄈ꾅貣è´ç„¡×‡ç¾Ÿã¿±ë•€é””饥푸少ᴀ拷䕎ì’îªæ»‘췌㸣൜﷠ꃯ簌뭰￢â¸ê©»ê·¹í”ꂖ飤䳲ᵿⳔíŠï§ƒê©ªâŸ¥æ“榎⫻êŸí˜ Ð§îŠªä¶£îž¨â³¹ÅŒä¸¨á¼ˆî´¾ï°ì¾Ù¦ [ 554.211091][ T5888] usb 3-1: SerialNumber: syz [ 554.431375][ T5888] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 554.448027][ T5888] cdc_ncm 3-1:1.0: bind() failure [ 554.462117][ T5888] usb 3-1: USB disconnect, device number 91 [ 554.677574][ T5924] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 554.807756][ T5924] usb 4-1: device descriptor read/64, error -71 [ 555.062392][ T5924] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 555.387564][ T5924] usb 4-1: device descriptor read/64, error -71 [ 555.497979][ T5924] usb usb4-port1: attempt power cycle [ 555.832927][T13228] binder: 13225:13228 ioctl c018620c 800000c0 returned -22 [ 555.840350][ T5924] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 555.900017][ T5924] usb 4-1: device descriptor read/8, error -71 [ 556.255789][T13235] team_slave_0: tun_chr_ioctl cmd 1074812118 [ 556.382162][ T5924] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 556.481246][ T5924] usb 4-1: device descriptor read/8, error -71 [ 556.697943][ T5924] usb usb4-port1: unable to enumerate USB device [ 556.811567][ T5917] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 557.078326][ T5957] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 557.279398][ T5917] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 557.296007][ T5917] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 557.312114][ T5917] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 557.324830][ T5917] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 557.346740][ T5917] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 557.398184][ T5917] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 557.407398][ T5917] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 557.427557][ T5917] usb 6-1: Product: syz [ 557.438489][ T5917] usb 6-1: Manufacturer: syz [ 557.463695][ T5917] cdc_wdm 6-1:1.0: skipping garbage [ 557.479471][ T5917] cdc_wdm 6-1:1.0: skipping garbage [ 557.484993][ T5957] usb 5-1: too many endpoints for config 4 interface 0 altsetting 0: 79, using maximum allowed: 30 [ 557.496667][ T5917] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 557.523081][ T5957] usb 5-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0x32, changing to 0x2 [ 557.550862][ T5957] usb 5-1: config 4 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 91 [ 557.560957][ T5917] cdc_wdm 6-1:1.0: Unknown control protocol [ 557.590281][ T5957] usb 5-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 79 [ 557.617601][ T5957] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 557.645940][T13246] team0: Port device team_slave_0 removed [ 557.647890][ T5957] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 557.692539][T13234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 557.702707][T13234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 557.728761][T13241] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 557.845823][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 557.852475][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 557.861329][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 557.867956][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 557.875274][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 557.881901][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 557.889450][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 557.896075][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 557.903729][ T9] usb 6-1: USB disconnect, device number 33 [ 557.909800][ C0] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 557.909825][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 557.909842][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 558.065491][T13239] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2141'. [ 558.422179][T13264] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 558.461264][T13264] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 558.680873][T13270] bridge0: port 3(macvtap0) entered blocking state [ 558.695274][T13270] bridge0: port 3(macvtap0) entered disabled state [ 558.705432][T13270] macvtap0: entered allmulticast mode [ 558.725575][T13270] veth0_macvtap: entered allmulticast mode [ 558.737548][T13270] macvtap0: left allmulticast mode [ 558.756832][T13270] veth0_macvtap: left allmulticast mode [ 558.808034][ T5957] ath6kl: Failed to submit usb control message: -110 [ 558.827406][ T5957] ath6kl: unable to send the bmi data to the device: -110 [ 558.838425][ T5957] ath6kl: Unable to send get target info: -110 [ 558.865802][ T5957] ath6kl: Failed to init ath6kl core: -110 [ 558.873376][ T5957] ath6kl_usb 5-1:4.0: probe with driver ath6kl_usb failed with error -110 [ 558.907576][ T9] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 559.057683][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 559.072165][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 559.086687][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 559.113312][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.153698][ T9] usb 3-1: config 0 descriptor?? [ 559.183324][ T9] hub 3-1:0.0: bad descriptor, ignoring hub [ 559.196111][ T9] hub 3-1:0.0: probe with driver hub failed with error -5 [ 559.214000][ T9] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 559.314605][T13285] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2155'. [ 559.805983][ T9] usb 5-1: USB disconnect, device number 78 [ 561.490169][T13316] futex_wake_op: syz.1.2162 tries to shift op by -33; fix this program [ 561.744706][ T9] usb 3-1: USB disconnect, device number 92 [ 562.136591][T13338] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2170'. [ 562.423405][T13345] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2174'. [ 562.623700][ T5924] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 562.672652][T13348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.683711][T13348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.975480][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.985424][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.989699][T13354] usb usb8: usbfs: process 13354 (syz.3.2178) did not claim interface 0 before use [ 563.207654][T13358] netlink: 'syz.3.2179': attribute type 2 has an invalid length. [ 563.333381][T13365] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 563.387709][ T9] usb 3-1: new full-speed USB device number 93 using dummy_hcd [ 563.540998][T13372] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 563.550350][ T9] usb 3-1: config 1 interface 0 altsetting 128 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 563.562052][T13373] (unnamed net_device) (uninitialized): option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 563.574052][ T9] usb 3-1: config 1 interface 0 has no altsetting 0 [ 563.597662][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c215, bcdDevice= 0.40 [ 563.606733][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.622695][ T9] usb 3-1: Product: 㖄㟙齌櫻ì³ç½—竗갛ꬡä®â„¨î’·ä†ˆêœ†ëšŸÎ”ᮒ왤鶻炙ٮïªê›·á“Žï傱㰽䩽羚齓㔱얉ᒄéˆï“¼ì²±ìµ°â¶µÍ ì¿·î¨•í„í£è¨¾å±íˆ›ã“뼚ᫎʺ᱾⯠ɨ嚂ç«é¯®ë²†î™¼ë™¯é«¿ì’“Ｕ逶íŠâ‰ƒé£ í€¬çƒ äµ€ì††é˜·ê˜®áªâ°¨ç¢›æµ‚é„ã°§ä›â˜¨é£ˆäˆ¯ë¹Î“鉠⡔⠰픎ê¡ë²‡ìꟆê¤ê¯¬çŸ»é¦™ä‰ªëƒ¥éˆ«ë´±è®“罥嬮녰æ™ç‹Ÿî±Šîª‡ [ 563.685776][ T9] usb 3-1: Manufacturer: ç»ëŒ¼è¨¥æ´£î€Šî£Œã›…ᓮ鬗ë¡æª¬ç¬§ïª­ê²±î¸Ÿì¶’公稞å嬠欢梃â»êº§å‘‰å‚˜á°ƒì±‚Ḕ桶楿㗙툘ãµá³¸ä¬ï›‚ﱎ欟袩횭厒蜄ï¼èˆ¨î³¦ï™»ïµ®î¨»á˜‰â•ˆì‡›ï¾ºïŸ—噦æ‡å­¼æ‹‘裑똆 [ 563.716845][ T9] usb 3-1: SerialNumber: 伃룮篳闱샱ï塞伾î¹ì§²è¥žâ‹íƒ’᫢᱙ῷৡë’ꊳë…䨱꧳⪲娡ꑜꯚꮺ䌆é’泯⅒ᷬ诵៧㣫䒰䢦绋朅๢莮見브뉒멃嵽夌삔΂儎΂踎ä¸è€£ì¹ï¢ìžÂîŽè³ê®½ã‹œÍ˜ë”˜í™‡èª‡ïê³é¿½è¥—á­¶ [ 563.808122][ T5957] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 563.836890][ T9] usb 3-1: rejected 1 configuration due to insufficient available bus power [ 563.868091][T13389] netlink: 'syz.1.2190': attribute type 6 has an invalid length. [ 563.960968][T13391] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2192'. [ 564.140864][ T5957] usb 5-1: Using ep0 maxpacket: 32 [ 564.147834][ T9] usb 3-1: no configuration chosen from 1 choice [ 564.175085][ T5957] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 564.188703][ T5957] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 564.200566][ T5957] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 564.213549][ T5957] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.370629][ T5957] usb 5-1: config 0 descriptor?? [ 564.819488][ T5957] usbhid 5-1:0.0: can't add hid device: -71 [ 564.826495][ T5957] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 564.846890][ T5957] usb 5-1: USB disconnect, device number 79 [ 564.999267][T13395] tun0: tun_chr_ioctl cmd 1074025675 [ 565.004609][T13395] tun0: persist enabled [ 565.011293][T13395] tun0: tun_chr_ioctl cmd 1074025675 [ 565.016607][T13395] tun0: persist disabled [ 565.145938][T13403] syz_tun: entered allmulticast mode [ 565.195749][T13405] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 565.437655][ T5957] usb 4-1: new high-speed USB device number 101 using dummy_hcd [ 565.857758][ T9] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 565.956304][ T5957] usb 4-1: unable to get BOS descriptor or descriptor too short [ 565.975233][ T5957] usb 4-1: config 1 interface 1 has no altsetting 0 [ 565.990534][ T5957] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 566.004878][ T5957] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.033498][ T5957] usb 4-1: Product: syz [ 566.039197][ T5957] usb 4-1: Manufacturer: syz [ 566.045134][ T5957] usb 4-1: SerialNumber: syz [ 566.089276][ T9] usb 6-1: config 0 has no interfaces? [ 566.122505][ T9] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 566.131973][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.147112][ T9] usb 6-1: Product: syz [ 566.169828][ T9] usb 6-1: Manufacturer: syz [ 566.183287][ T9] usb 6-1: SerialNumber: syz [ 566.188860][ T5924] usb 3-1: USB disconnect, device number 93 [ 566.251992][ T9] usb 6-1: config 0 descriptor?? [ 566.273723][T13407] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 566.309859][T13407] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 566.372300][ T5957] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 566.385885][ T5957] usb 4-1: found format II with max.bitrate = 2418, frame size=7 [ 566.394568][ T5957] usb 4-1: 2:1 : no or invalid class specific endpoint descriptor [ 566.404367][ T5957] usb 4-1: found format II with max.bitrate = 2418, frame size=7 [ 566.443442][T13423] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2204'. [ 566.492477][T13423] FAULT_INJECTION: forcing a failure. [ 566.492477][T13423] name failslab, interval 1, probability 0, space 0, times 0 [ 566.507678][T13423] CPU: 1 UID: 0 PID: 13423 Comm: syz.4.2204 Not tainted syzkaller #0 PREEMPT(full) [ 566.507702][T13423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 566.507713][T13423] Call Trace: [ 566.507721][T13423] [ 566.507729][T13423] dump_stack_lvl+0x189/0x250 [ 566.507762][T13423] ? __pfx____ratelimit+0x10/0x10 [ 566.507783][T13423] ? __pfx_dump_stack_lvl+0x10/0x10 [ 566.507803][T13423] ? __pfx__printk+0x10/0x10 [ 566.507825][T13423] ? __pfx___might_resched+0x10/0x10 [ 566.507843][T13423] should_fail_ex+0x414/0x560 [ 566.507872][T13423] should_failslab+0xa8/0x100 [ 566.507898][T13423] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 566.507922][T13423] ? __alloc_skb+0x112/0x2d0 [ 566.507946][T13423] __alloc_skb+0x112/0x2d0 [ 566.507968][T13423] netlink_sendmsg+0x5c6/0xb30 [ 566.507997][T13423] ? __pfx_netlink_sendmsg+0x10/0x10 [ 566.508018][T13423] ? __import_iovec+0x5d4/0x7f0 [ 566.508035][T13423] ? aa_sock_msg_perm+0xf1/0x1d0 [ 566.508054][T13423] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 566.508074][T13423] ? __pfx_netlink_sendmsg+0x10/0x10 [ 566.508093][T13423] __sock_sendmsg+0x21c/0x270 [ 566.508113][T13423] ____sys_sendmsg+0x505/0x830 [ 566.508140][T13423] ? __pfx_____sys_sendmsg+0x10/0x10 [ 566.508176][T13423] ___sys_sendmsg+0x21f/0x2a0 [ 566.508198][T13423] ? __pfx____sys_sendmsg+0x10/0x10 [ 566.508252][T13423] ? __fget_files+0x2a/0x420 [ 566.508266][T13423] ? __fget_files+0x3a0/0x420 [ 566.508289][T13423] __sys_sendmsg+0x164/0x220 [ 566.508312][T13423] ? __pfx___sys_sendmsg+0x10/0x10 [ 566.508348][T13423] ? lockdep_hardirqs_on+0x9c/0x150 [ 566.508369][T13423] __do_fast_syscall_32+0xb6/0x2b0 [ 566.508389][T13423] ? lockdep_hardirqs_on+0x9c/0x150 [ 566.508411][T13423] do_fast_syscall_32+0x34/0x80 [ 566.508430][T13423] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 566.508451][T13423] RIP: 0023:0xf7f78539 [ 566.508466][T13423] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 566.508480][T13423] RSP: 002b:00000000f546655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 566.508499][T13423] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 566.508511][T13423] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 566.508521][T13423] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 566.508531][T13423] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 566.508540][T13423] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 566.508562][T13423] [ 566.514067][ T5957] usb 4-1: USB disconnect, device number 101 [ 566.853341][T13413] syz_tun: left allmulticast mode [ 566.861797][T13413] netlink: 4112 bytes leftover after parsing attributes in process `syz.5.2200'. [ 566.877257][T13413] netlink: 65 bytes leftover after parsing attributes in process `syz.5.2200'. [ 566.889005][T13413] tipc: Enabling of bearer rejected, failed to enable media [ 567.365986][T13435] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2206'. [ 567.890131][T13442] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.923502][T13443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 567.983372][T13442] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 567.994168][T13443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.031891][T13443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.058716][T13443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.107646][ T5924] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 568.281371][ T5924] usb 5-1: config 0 has an invalid interface number: 106 but max is 0 [ 568.293910][ T5924] usb 5-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 568.327679][ T5924] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 568.341863][T13446] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2210'. [ 568.354403][ T5917] usb 6-1: USB disconnect, device number 35 [ 568.392746][ T5924] usb 5-1: config 0 has no interface number 0 [ 568.405815][ T5924] usb 5-1: config 0 interface 106 altsetting 0 endpoint 0x1 has invalid maxpacket 65365, setting to 64 [ 568.444973][ T5924] usb 5-1: config 0 interface 106 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 568.465510][ T5924] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 568.475130][ T5924] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.489007][ T5924] usb 5-1: config 0 descriptor?? [ 568.513169][T13454] FAULT_INJECTION: forcing a failure. [ 568.513169][T13454] name failslab, interval 1, probability 0, space 0, times 0 [ 568.515010][ T5924] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 568.541109][T13454] CPU: 1 UID: 0 PID: 13454 Comm: syz.3.2214 Not tainted syzkaller #0 PREEMPT(full) [ 568.541135][T13454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 568.541146][T13454] Call Trace: [ 568.541155][T13454] [ 568.541164][T13454] dump_stack_lvl+0x189/0x250 [ 568.541191][T13454] ? __pfx____ratelimit+0x10/0x10 [ 568.541211][T13454] ? __pfx_dump_stack_lvl+0x10/0x10 [ 568.541232][T13454] ? __pfx__printk+0x10/0x10 [ 568.541262][T13454] ? __pfx___might_resched+0x10/0x10 [ 568.541284][T13454] should_fail_ex+0x414/0x560 [ 568.541313][T13454] should_failslab+0xa8/0x100 [ 568.541341][T13454] __kmalloc_noprof+0xcb/0x4f0 [ 568.541363][T13454] ? sock_kmalloc+0xd6/0x160 [ 568.541390][T13454] sock_kmalloc+0xd6/0x160 [ 568.541414][T13454] af_alg_alloc_areq+0x8d/0x260 [ 568.541440][T13454] skcipher_recvmsg+0x359/0x11d0 [ 568.541483][T13454] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 568.541509][T13454] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 568.541528][T13454] ? security_socket_recvmsg+0x7e/0x2e0 [ 568.541547][T13454] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 568.541570][T13454] sock_recvmsg+0x22c/0x270 [ 568.541592][T13454] __sys_recvfrom+0x1f6/0x340 [ 568.541615][T13454] ? __pfx___sys_recvfrom+0x10/0x10 [ 568.541650][T13454] ? __might_fault+0xb0/0x130 [ 568.541695][T13454] __ia32_compat_sys_socketcall+0x852/0x9c0 [ 568.541718][T13454] ? __fget_files+0x3a0/0x420 [ 568.541739][T13454] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 568.541762][T13454] ? fput+0xa0/0xd0 [ 568.541781][T13454] ? ksys_write+0x22a/0x250 [ 568.541813][T13454] ? lockdep_hardirqs_on+0x9c/0x150 [ 568.541835][T13454] __do_fast_syscall_32+0xb6/0x2b0 [ 568.541857][T13454] ? lockdep_hardirqs_on+0x9c/0x150 [ 568.541879][T13454] do_fast_syscall_32+0x34/0x80 [ 568.541899][T13454] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 568.541920][T13454] RIP: 0023:0xf7f23539 [ 568.541935][T13454] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 568.541954][T13454] RSP: 002b:00000000f5415440 EFLAGS: 00000206 ORIG_RAX: 0000000000000066 [ 568.541973][T13454] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000f541545c [ 568.541985][T13454] RDX: 0000000000000000 RSI: 00000000f5415560 RDI: 00000000f73b5ff4 [ 568.541996][T13454] RBP: 00000000f5415560 R08: 0000000000000000 R09: 0000000000000000 [ 568.542007][T13454] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 568.542018][T13454] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 568.542045][T13454] [ 568.821610][ T12] usb 5-1: Failed to submit usb control message: -71 [ 568.824310][ T5926] usb 5-1: USB disconnect, device number 80 [ 568.847250][ T12] usb 5-1: unable to send the bmi data to the device: -71 [ 568.857268][ T12] usb 5-1: unable to get target info from device [ 568.866110][ T12] usb 5-1: could not get target info (-71) [ 568.875286][ T12] usb 5-1: could not probe fw (-71) [ 569.027961][ T5917] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 569.137780][ T5924] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 569.180039][ T5917] usb 6-1: Using ep0 maxpacket: 8 [ 569.187230][ T5917] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 569.196593][ T5917] usb 6-1: config 179 has no interface number 0 [ 569.203685][ T5917] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 569.215302][ T5917] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 569.226803][ T5917] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 569.238550][ T5917] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 569.250444][ T5917] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 569.264284][ T5917] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 569.273427][ T5917] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.284330][T13456] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 569.303605][ T5924] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 569.320190][ T5924] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 569.331545][ T5924] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 569.341658][ T5924] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 569.357495][ T5924] usb 4-1: config 1 interface 1 has no altsetting 0 [ 569.381181][ T5924] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 569.406299][ T5924] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 569.439049][ T5924] usb 4-1: Product: syz [ 569.443647][ T5924] usb 4-1: Manufacturer: syz [ 569.455956][ T5924] usb 4-1: SerialNumber: syz [ 569.514902][T13456] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2213'. [ 569.525054][T13456] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2213'. [ 569.556679][ T5917] input: Generic X-Box pad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input46 [ 569.718567][ T5924] usb 4-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0 [ 569.726023][ T5924] usb 4-1: MIDIStreaming interface descriptor not found [ 569.743859][T13473] hsr0: entered promiscuous mode [ 569.752299][T13473] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2219'. [ 569.812871][T13473] hsr_slave_0: left promiscuous mode [ 569.871697][T13473] 0·: left promiscuous mode [ 569.905034][T13473] hsr0 (unregistering): left promiscuous mode [ 569.944730][T13456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 569.958725][T13456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 570.039263][ T5924] usb 4-1: USB disconnect, device number 102 [ 570.118684][ T5926] usb 6-1: USB disconnect, device number 36 [ 570.124704][ C1] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 570.124760][ C1] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 570.737994][ T5926] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 570.831499][T13495] usb usb8: usbfs: process 13495 (syz.3.2225) did not claim interface 0 before use [ 570.902644][T13493] syz_tun: entered allmulticast mode [ 571.111296][ T5926] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 571.134735][ T5924] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 571.157610][ T5926] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 571.185096][ T5926] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 571.245413][ T5924] hid-generic 0000:0000:0000.0011: hidraw0: HID v0.00 Device [syz1] on syz0 [ 571.357522][ T5926] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 571.420411][ T5926] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 571.502201][ T5926] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 571.623015][ T5926] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 571.635463][T13500] fido_id[13500]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 571.651723][ T5926] usb 3-1: Product: syz [ 571.671472][ T5926] usb 3-1: Manufacturer: syz [ 571.717508][ T5926] cdc_wdm 3-1:1.0: skipping garbage [ 571.797833][ T5926] cdc_wdm 3-1:1.0: skipping garbage [ 571.808158][T13489] syz_tun: left allmulticast mode [ 571.887854][ T5926] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 571.924041][T13487] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.939053][ T5926] cdc_wdm 3-1:1.0: Unknown control protocol [ 571.947640][T13487] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 572.201990][ T9] usb 3-1: USB disconnect, device number 94 [ 572.508016][ T5926] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 572.609579][T13514] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2229'. [ 572.672603][ T5926] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 572.691623][ T5926] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 572.716189][ T5926] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 572.735624][ T5926] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 572.759431][ T5926] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 572.787266][ T5926] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 572.797020][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 572.806093][ T5926] usb 4-1: Product: syz [ 572.810957][ T5926] usb 4-1: Manufacturer: syz [ 572.829885][ T5926] cdc_wdm 4-1:1.0: skipping garbage [ 572.837255][ T5926] cdc_wdm 4-1:1.0: skipping garbage [ 572.846469][ T5926] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 572.853623][ T5926] cdc_wdm 4-1:1.0: Unknown control protocol [ 573.007660][ T5910] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 573.139000][T13526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 573.155540][T13526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 573.284288][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.290936][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.297669][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.304289][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.310598][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.317216][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.323514][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.330116][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.336372][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.342971][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.349277][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.355884][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.362781][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.369373][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.375617][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.382193][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.388457][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.395036][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.401309][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 573.407914][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 573.410779][ T9] usb 4-1: USB disconnect, device number 103 [ 573.413984][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 573.844199][T13543] netlink: 'syz.1.2233': attribute type 16 has an invalid length. [ 574.050393][ T5926] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 574.115387][T13548] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 574.136383][T13548] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 574.217315][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 574.217331][ T30] audit: type=1400 audit(1759231261.030:696): apparmor="DENIED" operation="stack_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=3AAE86AD47AA0D9495E6D80F7BDE2D18FFB36CF152AED2D408FB58E305FC8E2F2F7D91F81B621CC4214D4A27E1614FBEE0BEAC8F4A045070B770212D46D4A2DF096B791F2A4BA218E12CB76AA24945B70A7C9DD5EDEAC52B5A876F73CFBE66371A72F11F3D9544D6B59B4A5541DCEF5CBF11FFFF37DFD147CCA3E5098A207BE806EA7167101F8C1B5C8FE41E170FD0C775DBC5BE0B6D3AB625AB702E5B1DC15F9C4B3D09BE812F340E681E0694F5BADF640DA3FDFC2F929B4C2BEB9A592C577287B6021BFEEC24146C7F95608BB60A736207A09D9F47E89C4044EADDE57CDEFD15F25B822D2EAF2205DF0D6B71B63EE0B63CB598F26509AF36983578F6F4198A0843CC1B1BD780015007AB9709CC6211E3B5C685B972B5C5E95F054A7A9FE149282F679C8466B9734E3850EC98419DD0C887715902F9E7802842085BC606F30C2654869E9E3701FD0FC69137FE165592689465EEBD5CAFAD7C29DE2ADADEC42A818D8EE389CA1FE33A1EF23617C89116A3A458B56612E4C36C43A9150D5331ADBB0BEB01A062B1F1349FC2ECEA76CB7C40CDFE378185F3099B1D71414D0FDA5A47F8593260CC0BD723A4CCA81435F04 [ 574.223657][ T5926] usb 5-1: Using ep0 maxpacket: 32 [ 574.352262][ T5910] usb 6-1: new full-speed USB device number 38 using dummy_hcd [ 574.445460][ T5926] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 574.461177][ T5926] usb 5-1: config 0 has no interface number 0 [ 574.472156][ T5926] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 574.484142][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.499212][ T5926] usb 5-1: Product: syz [ 574.505807][ T5926] usb 5-1: Manufacturer: syz [ 574.514940][ T5926] usb 5-1: SerialNumber: syz [ 574.528330][ T5926] usb 5-1: config 0 descriptor?? [ 574.539240][ T5910] usb 6-1: config 0 has an invalid interface number: 107 but max is 0 [ 574.547743][ T5910] usb 6-1: config 0 has no interface number 0 [ 574.555135][ T5926] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 574.565428][ T5910] usb 6-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 574.592204][ T5910] usb 6-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 574.619454][ T5910] usb 6-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 574.628819][ T5910] usb 6-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 574.645105][ T5910] usb 6-1: Product: syz [ 574.652615][ T5910] usb 6-1: Manufacturer: syz [ 574.716479][ T5910] usb 6-1: SerialNumber: syz [ 574.743045][ T5926] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 574.766925][ T5910] usb 6-1: config 0 descriptor?? [ 574.791644][ T5910] keyspan 6-1:0.107: Keyspan 4 port adapter converter detected [ 574.805728][ T5926] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 574.818230][ T5910] keyspan 6-1:0.107: found no endpoint descriptor for endpoint 81 [ 574.854046][ T5910] keyspan 6-1:0.107: found no endpoint descriptor for endpoint 1 [ 574.867279][ T5910] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 574.887300][ T5910] keyspan 6-1:0.107: found no endpoint descriptor for endpoint 2 [ 574.941101][ T5910] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 574.956343][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 9 [ 575.009830][ T5910] keyspan 6-1:0.107: found no endpoint descriptor for endpoint 4 [ 575.068113][ T5910] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB4 [ 575.120762][ T5910] keyspan 6-1:0.107: found no endpoint descriptor for endpoint 6 [ 575.180070][ T5910] usb 6-1: Keyspan 4 port adapter converter now attached to ttyUSB5 [ 575.213257][ T5910] usb 6-1: USB disconnect, device number 38 [ 575.245842][ T5910] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 575.328116][ T5910] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 575.344909][ T5910] keyspan_4 ttyUSB4: Keyspan 4 port adapter converter now disconnected from ttyUSB4 [ 575.360255][ T5910] keyspan_4 ttyUSB5: Keyspan 4 port adapter converter now disconnected from ttyUSB5 [ 575.376078][ T5910] keyspan 6-1:0.107: device disconnected [ 575.833844][T13571] netlink: 'syz.3.2237': attribute type 10 has an invalid length. [ 575.854653][T13571] team0: Port device dummy0 added [ 576.013636][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 576.014077][ T5924] usb 5-1: USB disconnect, device number 81 [ 576.108021][ T5924] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 576.145038][ T5924] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 576.167019][ T5924] quatech2 5-1:0.51: device disconnected [ 576.747541][ T5924] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 576.924890][ T5924] usb 3-1: Using ep0 maxpacket: 32 [ 576.928279][ T5924] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 576.928297][ T5924] usb 3-1: config 0 has no interface number 0 [ 576.928321][ T5924] usb 3-1: config 0 interface 184 has no altsetting 0 [ 576.930130][ T5924] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 576.930146][ T5924] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.930157][ T5924] usb 3-1: Product: syz [ 576.930166][ T5924] usb 3-1: Manufacturer: syz [ 576.930174][ T5924] usb 3-1: SerialNumber: syz [ 576.932503][ T5924] usb 3-1: config 0 descriptor?? [ 576.936187][ T5924] smsc75xx v1.0.0 [ 576.970901][T13587] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2245'. [ 576.980843][T13587] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2245'. [ 576.982035][T13587] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2245'. [ 576.982056][T13587] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2245'. [ 577.668799][ T5924] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 577.688105][ T5924] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 577.714889][ T5924] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 577.750174][ T5924] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 577.913411][T13605] usb usb8: usbfs: process 13605 (syz.5.2253) did not claim interface 0 before use [ 578.221478][T13622] netlink: 2048 bytes leftover after parsing attributes in process `syz.4.2259'. [ 578.231409][T13622] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2259'. [ 578.517332][T13629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 578.526755][T13629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 578.557869][ T5926] usb 5-1: new low-speed USB device number 82 using dummy_hcd [ 578.752183][ T5926] usb 5-1: unable to get BOS descriptor or descriptor too short [ 578.781488][ T5917] usb 3-1: USB disconnect, device number 95 [ 578.789467][ T5926] usb 5-1: config 2 has an invalid interface number: 178 but max is 0 [ 578.837799][ T5926] usb 5-1: config 2 contains an unexpected descriptor of type 0x2, skipping [ 578.873575][ T5926] usb 5-1: config 2 has no interface number 0 [ 578.891338][ T5926] usb 5-1: config 2 interface 178 altsetting 243 endpoint 0xC has invalid maxpacket 32, setting to 8 [ 578.932416][ T5926] usb 5-1: config 2 interface 178 altsetting 243 has a duplicate endpoint with address 0xC, skipping [ 578.993555][ T5926] usb 5-1: config 2 interface 178 has no altsetting 0 [ 579.007848][ T5926] usb 5-1: string descriptor 0 read error: -22 [ 579.014859][ T5926] usb 5-1: New USB device found, idVendor=06be, idProduct=d001, bcdDevice=51.19 [ 579.025259][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.045342][ T5926] gspca_main: nw80x-2.14.0 probing 06be:d001 [ 579.119362][T13644] random: crng reseeded on system resumption [ 579.607637][ T5926] gspca_nw80x: reg_w err -110 [ 579.612662][ T5926] nw80x 5-1:2.178: probe with driver nw80x failed with error -110 [ 580.000581][T13652] usb usb8: usbfs: process 13652 (syz.5.2267) did not claim interface 0 before use [ 581.406787][T13671] loop5: detected capacity change from 0 to 2159 [ 581.560003][T11987] Buffer I/O error on dev loop5, logical block 269, async page read [ 581.852844][T13686] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 581.863076][T13686] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 582.028680][ T5957] usb 5-1: USB disconnect, device number 82 [ 582.037647][T11987] Buffer I/O error on dev loop5, logical block 269, async page read [ 582.205212][T13689] usb usb8: usbfs: process 13689 (syz.4.2280) did not claim interface 0 before use [ 582.227955][ T5924] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 582.418097][ T5924] usb 6-1: Using ep0 maxpacket: 8 [ 582.435925][ T5924] usb 6-1: config 8 has an invalid interface number: 205 but max is 3 [ 582.484466][ T5924] usb 6-1: config 8 has an invalid interface number: 253 but max is 3 [ 582.493212][ T5924] usb 6-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 582.508685][ T5924] usb 6-1: config 8 has an invalid interface number: 222 but max is 3 [ 582.517846][ T5924] usb 6-1: config 8 has an invalid interface number: 68 but max is 3 [ 582.526102][ T5924] usb 6-1: config 8 has 5 interfaces, different from the descriptor's value: 4 [ 582.539345][ T5924] usb 6-1: config 8 has no interface number 0 [ 582.545611][ T5924] usb 6-1: config 8 has no interface number 2 [ 582.553580][ T5924] usb 6-1: config 8 has no interface number 3 [ 582.561510][ T5924] usb 6-1: config 8 has no interface number 4 [ 582.571067][ T5924] usb 6-1: config 8 interface 205 altsetting 5 bulk endpoint 0x3 has invalid maxpacket 16 [ 582.585654][ T5924] usb 6-1: config 8 interface 205 altsetting 5 endpoint 0x88 has an invalid bInterval 64, changing to 10 [ 582.605300][ T5924] usb 6-1: config 8 interface 205 altsetting 5 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 582.626258][ T5924] usb 6-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0xE, skipping [ 582.660093][ T5924] usb 6-1: config 8 interface 253 altsetting 9 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 582.676347][ T5924] usb 6-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x8, skipping [ 582.689046][ T5924] usb 6-1: config 8 interface 253 altsetting 9 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 582.704779][ T5924] usb 6-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 582.723984][ T5924] usb 6-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 582.740378][ T5924] usb 6-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 582.753325][ T5924] usb 6-1: config 8 interface 1 altsetting 8 has a duplicate endpoint with address 0x3, skipping [ 582.764772][ T5924] usb 6-1: config 8 interface 1 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 582.780801][ T5924] usb 6-1: too many endpoints for config 8 interface 222 altsetting 178: 201, using maximum allowed: 30 [ 582.792282][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xE, skipping [ 582.912852][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x6, skipping [ 582.924377][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x1, skipping [ 582.940387][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x1, skipping [ 583.002527][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has an endpoint descriptor with address 0x99, changing to 0x89 [ 583.020761][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x89, skipping [ 583.036857][ T5924] usb 6-1: config 8 interface 222 altsetting 178 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 583.056120][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xA, skipping [ 583.075086][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xB, skipping [ 583.105798][ T5924] usb 6-1: config 8 interface 222 altsetting 178 has 8 endpoint descriptors, different from the interface descriptor's value: 201 [ 583.134457][ T5924] usb 6-1: config 8 interface 205 has no altsetting 0 [ 583.154002][ T5924] usb 6-1: config 8 interface 253 has no altsetting 0 [ 583.171407][ T5924] usb 6-1: config 8 interface 1 has no altsetting 0 [ 583.188936][ T5924] usb 6-1: config 8 interface 222 has no altsetting 0 [ 583.206574][ T5924] usb 6-1: config 8 interface 68 has no altsetting 0 [ 583.261934][ T5924] usb 6-1: Dual-Role OTG device on HNP port [ 583.284986][ T5924] usb 6-1: New USB device found, idVendor=9986, idProduct=7523, bcdDevice=d9.a5 [ 583.339752][ T5924] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.375275][ T5924] usb 6-1: Product: syz [ 583.414773][ T5924] usb 6-1: Manufacturer: syz [ 583.425928][ T5924] usb 6-1: SerialNumber: syz [ 583.495181][T13683] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 583.758840][ T5924] ch341 6-1:8.205: ch341-uart converter detected [ 583.848595][ T5924] usb 6-1: failed to receive control message: -71 [ 583.866015][ T5924] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 583.885423][ T5924] ch341 6-1:8.253: ch341-uart converter detected [ 583.899860][ T5924] usb 6-1: failed to receive control message: -71 [ 583.906917][ T5924] ch341-uart ttyUSB1: probe with driver ch341-uart failed with error -71 [ 583.936621][ T5924] ch341 6-1:8.1: ch341-uart converter detected [ 583.949797][ T5924] usb 6-1: failed to receive control message: -71 [ 583.956456][ T5924] ch341-uart ttyUSB2: probe with driver ch341-uart failed with error -71 [ 583.985082][ T5924] hub 6-1:8.222: Invalid hub with more than one config or interface [ 584.020176][ T5924] hub 6-1:8.222: probe with driver hub failed with error -22 [ 584.057223][ T5924] ch341 6-1:8.222: ch341-uart converter detected [ 584.073322][ T5924] usb 6-1: failed to receive control message: -71 [ 584.087247][ T5924] ch341-uart ttyUSB3: probe with driver ch341-uart failed with error -71 [ 584.106053][ T5924] ch341 6-1:8.68: ch341-uart converter detected [ 584.180165][ T5924] usb 6-1: failed to receive control message: -71 [ 584.202090][ T5924] ch341-uart ttyUSB4: probe with driver ch341-uart failed with error -71 [ 584.275687][ T5924] usb 6-1: USB disconnect, device number 39 [ 584.343149][ T5924] ch341 6-1:8.205: device disconnected [ 584.409536][ T5924] ch341 6-1:8.253: device disconnected [ 584.443266][ T5924] ch341 6-1:8.1: device disconnected [ 584.469753][ T5924] ch341 6-1:8.222: device disconnected [ 584.497007][ T5924] ch341 6-1:8.68: device disconnected [ 584.670744][T13727] usb usb8: usbfs: process 13727 (syz.5.2292) did not claim interface 0 before use [ 584.977781][ T9] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 585.254807][ T9] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 585.265846][ T9] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 585.290740][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 585.310906][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 585.326419][ T9] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 585.342767][ T9] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 585.355400][ T9] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 585.384371][ T9] usb 5-1: Product: syz [ 585.413558][ T9] usb 5-1: Manufacturer: syz [ 585.531328][ T9] cdc_wdm 5-1:1.0: skipping garbage [ 585.537192][ T9] cdc_wdm 5-1:1.0: skipping garbage [ 585.550550][ T9] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 585.557097][ T9] cdc_wdm 5-1:1.0: Unknown control protocol [ 585.779339][T13742] 8021q: adding VLAN 0 to HW filter on device bond6 [ 585.858069][T13748] netlink: 'syz.2.2296': attribute type 10 has an invalid length. [ 585.907199][T13748] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 585.955472][T13748] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 585.968311][T13749] wg1: entered promiscuous mode [ 585.975943][T13749] wg1: entered allmulticast mode [ 586.104870][T13753] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 586.131799][T13753] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 586.268935][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 586.275554][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 586.277765][ T5926] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 586.283056][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 586.295826][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 586.303911][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 586.310607][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 586.317122][ T9] usb 5-1: USB disconnect, device number 83 [ 586.323175][ C0] cdc_wdm 5-1:1.0: nonzero urb status received: -71 [ 586.323196][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes [ 586.323206][ C0] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 586.367814][T13757] cdc_wdm 5-1:1.0: Tx URB error: -19 [ 586.508730][ T5926] usb 3-1: Using ep0 maxpacket: 32 [ 586.525150][ T5926] usb 3-1: config 0 has an invalid interface number: 217 but max is 0 [ 586.534781][ T5926] usb 3-1: config 0 has no interface number 0 [ 586.571614][ T5926] usb 3-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice= 0.02 [ 586.581971][ T5926] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.596123][ T5926] usb 3-1: Product: syz [ 586.601738][ T5926] usb 3-1: Manufacturer: syz [ 586.606552][ T5926] usb 3-1: SerialNumber: syz [ 586.627302][ T5926] usb 3-1: config 0 descriptor?? [ 586.644032][ T5926] ftdi_sio 3-1:0.217: FTDI USB Serial Device converter detected [ 586.656087][ T5926] usb 3-1: Detected SIO [ 586.663358][ T5926] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 587.146465][T13762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 587.174897][T13762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 587.414535][T13769] usb usb8: usbfs: process 13769 (syz.3.2305) did not claim interface 0 before use [ 588.506177][T13796] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2312'. [ 588.554987][ T5924] usb 3-1: USB disconnect, device number 97 [ 588.572009][ T5924] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 588.591983][T13800] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2312'. [ 588.606771][T13800] netlink: 34 bytes leftover after parsing attributes in process `syz.5.2312'. [ 588.692417][ T5924] ftdi_sio 3-1:0.217: device disconnected [ 588.928513][T13804] usb usb8: usbfs: process 13804 (syz.3.2316) did not claim interface 0 before use [ 589.237598][ T5924] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 589.388944][ T5924] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 589.410178][ T5924] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 589.442157][ T5924] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 589.458194][ T5924] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 589.471547][ T5924] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 589.489537][ T5924] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 589.503450][ T5924] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 589.516047][ T5924] usb 3-1: Product: syz [ 589.525187][ T5924] usb 3-1: Manufacturer: syz [ 589.550183][ T5924] cdc_wdm 3-1:1.0: skipping garbage [ 589.555425][ T5924] cdc_wdm 3-1:1.0: skipping garbage [ 589.571095][ T5924] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 589.577093][ T5924] cdc_wdm 3-1:1.0: Unknown control protocol [ 589.907784][ T5926] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 589.938380][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 589.945021][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 589.952236][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 589.958860][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 589.967146][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 589.973958][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 589.980880][ T5924] usb 3-1: USB disconnect, device number 98 [ 589.987119][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 589.987135][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 589.987145][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 590.073488][ T5926] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 590.082557][ T5926] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 590.093467][ T5926] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 590.102889][ T5926] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 590.114374][ T5926] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 590.135033][ T5926] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 590.144450][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 590.157499][ T5926] usb 4-1: Product: syz [ 590.161761][ T5926] usb 4-1: Manufacturer: syz [ 590.177988][ T5926] cdc_wdm 4-1:1.0: skipping garbage [ 590.184175][ T5926] cdc_wdm 4-1:1.0: skipping garbage [ 590.196243][ T5926] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 590.203398][ T5926] cdc_wdm 4-1:1.0: Unknown control protocol [ 590.552498][T13822] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 590.579056][T13822] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 590.604659][T13822] lo: Caught tx_queue_len zero misconfig [ 590.689709][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 590.691043][ T5924] usb 4-1: USB disconnect, device number 104 [ 590.696345][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 590.696364][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 590.723083][T13822] cdc_wdm 4-1:1.0: Tx URB error: -19 [ 590.819606][T13829] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2323'. [ 590.971301][T13834] FAULT_INJECTION: forcing a failure. [ 590.971301][T13834] name failslab, interval 1, probability 0, space 0, times 0 [ 590.984139][T13834] CPU: 0 UID: 0 PID: 13834 Comm: syz.4.2325 Not tainted syzkaller #0 PREEMPT(full) [ 590.984167][T13834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 590.984178][T13834] Call Trace: [ 590.984186][T13834] [ 590.984195][T13834] dump_stack_lvl+0x189/0x250 [ 590.984220][T13834] ? __pfx____ratelimit+0x10/0x10 [ 590.984240][T13834] ? __pfx_dump_stack_lvl+0x10/0x10 [ 590.984261][T13834] ? __pfx__printk+0x10/0x10 [ 590.984281][T13834] ? __pfx___might_resched+0x10/0x10 [ 590.984303][T13834] should_fail_ex+0x414/0x560 [ 590.984332][T13834] should_failslab+0xa8/0x100 [ 590.984359][T13834] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 590.984383][T13834] ? __alloc_skb+0x112/0x2d0 [ 590.984406][T13834] __alloc_skb+0x112/0x2d0 [ 590.984430][T13834] netlink_sendmsg+0x5c6/0xb30 [ 590.984459][T13834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 590.984481][T13834] ? __import_iovec+0x5d4/0x7f0 [ 590.984500][T13834] ? aa_sock_msg_perm+0xf1/0x1d0 [ 590.984518][T13834] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 590.984538][T13834] ? __pfx_netlink_sendmsg+0x10/0x10 [ 590.984558][T13834] __sock_sendmsg+0x21c/0x270 [ 590.984579][T13834] ____sys_sendmsg+0x505/0x830 [ 590.984606][T13834] ? __pfx_____sys_sendmsg+0x10/0x10 [ 590.984641][T13834] ___sys_sendmsg+0x21f/0x2a0 [ 590.984665][T13834] ? __pfx____sys_sendmsg+0x10/0x10 [ 590.984720][T13834] ? __fget_files+0x2a/0x420 [ 590.984734][T13834] ? __fget_files+0x3a0/0x420 [ 590.984760][T13834] __sys_sendmsg+0x164/0x220 [ 590.984783][T13834] ? __pfx___sys_sendmsg+0x10/0x10 [ 590.984820][T13834] ? lockdep_hardirqs_on+0x9c/0x150 [ 590.984842][T13834] __do_fast_syscall_32+0xb6/0x2b0 [ 590.984862][T13834] ? lockdep_hardirqs_on+0x9c/0x150 [ 590.984884][T13834] do_fast_syscall_32+0x34/0x80 [ 590.984904][T13834] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 590.984924][T13834] RIP: 0023:0xf7f78539 [ 590.984939][T13834] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 590.984954][T13834] RSP: 002b:00000000f546655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 590.984971][T13834] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 590.984983][T13834] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 590.984999][T13834] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 590.985009][T13834] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 590.985019][T13834] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 590.985045][T13834] [ 591.525707][T13842] netlink: 72 bytes leftover after parsing attributes in process `syz.5.2328'. [ 591.637310][T13848] netlink: 'syz.4.2326': attribute type 10 has an invalid length. [ 591.843217][T13848] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 591.892231][T13854] wg1: entered promiscuous mode [ 591.897342][T13854] wg1: entered allmulticast mode [ 591.948433][ T5924] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 592.119312][T13864] gretap1: entered promiscuous mode [ 592.220140][ T5924] usb 6-1: Using ep0 maxpacket: 32 [ 592.250094][ T5924] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 592.267516][ T5926] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 592.279084][ T5924] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 592.291709][ T5924] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 592.310458][ T5924] usb 6-1: Product: syz [ 592.320391][ T5924] usb 6-1: Manufacturer: syz [ 592.329930][ T5924] usb 6-1: SerialNumber: syz [ 592.368107][ T5924] usb 6-1: config 0 descriptor?? [ 592.386253][T13853] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 592.397343][ T5924] hub 6-1:0.0: bad descriptor, ignoring hub [ 592.405644][ T5924] hub 6-1:0.0: probe with driver hub failed with error -5 [ 592.827700][ T5926] usb 5-1: Using ep0 maxpacket: 32 [ 592.864097][ T5926] usb 5-1: config 0 has an invalid interface number: 217 but max is 0 [ 592.872647][ T5926] usb 5-1: config 0 has no interface number 0 [ 592.895093][ T5926] usb 5-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice= 0.02 [ 592.916375][ T5926] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.928198][ T5926] usb 5-1: Product: syz [ 592.932357][ T5926] usb 5-1: Manufacturer: syz [ 592.972105][ T5926] usb 5-1: SerialNumber: syz [ 592.993205][ T5926] usb 5-1: config 0 descriptor?? [ 593.014606][ T5926] ftdi_sio 5-1:0.217: FTDI USB Serial Device converter detected [ 593.028658][ T5926] usb 5-1: Detected SIO [ 593.064162][ T5926] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 593.742353][T13866] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2332'. [ 593.827588][T13866] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 594.162787][T13889] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 594.187992][T13889] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 594.326080][T13891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 594.351537][T13891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 594.547918][ T5926] usb 5-1: USB disconnect, device number 84 [ 594.557203][ T5926] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 594.592989][ T5926] ftdi_sio 5-1:0.217: device disconnected [ 594.871972][T13898] hsr0: entered promiscuous mode [ 594.898927][T13898] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2341'. [ 594.975365][T13898] hsr_slave_0: left promiscuous mode [ 594.989267][T13898] hsr_slave_1: left promiscuous mode [ 595.025714][T13898] hsr0 (unregistering): left promiscuous mode [ 595.368403][ T5957] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 595.547596][ T5957] usb 5-1: Using ep0 maxpacket: 8 [ 595.557219][ T5957] usb 5-1: config 8 has an invalid interface number: 205 but max is 3 [ 595.581166][ T5957] usb 5-1: config 8 has an invalid interface number: 253 but max is 3 [ 595.630490][ T5957] usb 5-1: config 8 contains an unexpected descriptor of type 0x1, skipping [ 595.650829][ T5957] usb 5-1: config 8 has an invalid interface number: 222 but max is 3 [ 595.665930][ T5957] usb 5-1: config 8 has an invalid interface number: 68 but max is 3 [ 595.686558][ T5957] usb 5-1: config 8 has 5 interfaces, different from the descriptor's value: 4 [ 595.706574][ T5957] usb 5-1: config 8 has no interface number 0 [ 595.722863][ T5957] usb 5-1: config 8 has no interface number 2 [ 595.734533][ T5957] usb 5-1: config 8 has no interface number 3 [ 595.747037][ T5957] usb 5-1: config 8 has no interface number 4 [ 595.764610][ T5957] usb 5-1: config 8 interface 205 altsetting 5 bulk endpoint 0x3 has invalid maxpacket 16 [ 595.798054][ T5957] usb 5-1: config 8 interface 205 altsetting 5 endpoint 0x88 has an invalid bInterval 64, changing to 10 [ 595.830483][ T5957] usb 5-1: config 8 interface 205 altsetting 5 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 595.854519][ T5957] usb 5-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0xE, skipping [ 595.878846][ T5957] usb 5-1: config 8 interface 253 altsetting 9 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 595.921477][ T5957] usb 5-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x8, skipping [ 595.964300][ T5957] usb 5-1: config 8 interface 253 altsetting 9 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 596.004122][ T5957] usb 5-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x5, skipping [ 596.045507][ T5957] usb 5-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 596.076696][ T5957] usb 5-1: config 8 interface 253 altsetting 9 has a duplicate endpoint with address 0x6, skipping [ 596.099717][ T5957] usb 5-1: config 8 interface 1 altsetting 8 has a duplicate endpoint with address 0x3, skipping [ 596.125865][ T5957] usb 5-1: config 8 interface 1 altsetting 8 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 596.153860][ T5957] usb 5-1: too many endpoints for config 8 interface 222 altsetting 178: 201, using maximum allowed: 30 [ 596.178720][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xE, skipping [ 596.201440][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x6, skipping [ 596.220165][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x1, skipping [ 596.234455][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x1, skipping [ 596.245539][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has an endpoint descriptor with address 0x99, changing to 0x89 [ 596.259016][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0x89, skipping [ 596.270074][ T5957] usb 5-1: config 8 interface 222 altsetting 178 endpoint 0xC has invalid maxpacket 1023, setting to 64 [ 596.281362][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xA, skipping [ 596.292406][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has a duplicate endpoint with address 0xB, skipping [ 596.303324][ T5957] usb 5-1: config 8 interface 222 altsetting 178 has 8 endpoint descriptors, different from the interface descriptor's value: 201 [ 596.316924][ T5957] usb 5-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0xB, skipping [ 596.328006][ T5957] usb 5-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0xB, skipping [ 596.339103][ T5957] usb 5-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x1, skipping [ 596.349942][ T5957] usb 5-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x7, skipping [ 596.360814][ T5957] usb 5-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x9, skipping [ 596.371899][ T5957] usb 5-1: config 8 interface 68 altsetting 16 bulk endpoint 0x2 has invalid maxpacket 64 [ 596.382045][ T5957] usb 5-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x5, skipping [ 596.392822][ T5957] usb 5-1: config 8 interface 68 altsetting 16 has a duplicate endpoint with address 0x1, skipping [ 596.403643][ T5957] usb 5-1: config 8 interface 205 has no altsetting 0 [ 596.410520][ T5957] usb 5-1: config 8 interface 253 has no altsetting 0 [ 596.417314][ T5957] usb 5-1: config 8 interface 1 has no altsetting 0 [ 596.424010][ T5957] usb 5-1: config 8 interface 222 has no altsetting 0 [ 596.430847][ T5957] usb 5-1: config 8 interface 68 has no altsetting 0 [ 596.441765][ T5957] usb 5-1: Dual-Role OTG device on HNP port [ 596.447988][ T5957] usb 5-1: New USB device found, idVendor=9986, idProduct=7523, bcdDevice=d9.a5 [ 596.457026][ T5957] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.465072][ T5957] usb 5-1: Product: syz [ 596.469324][ T5957] usb 5-1: Manufacturer: syz [ 596.473924][ T5957] usb 5-1: SerialNumber: syz [ 596.482982][T13904] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 596.714665][ T5957] ch341 5-1:8.205: ch341-uart converter detected [ 596.722521][ T5957] usb 5-1: failed to receive control message: -71 [ 596.729213][ T5957] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 596.744892][ T5957] ch341 5-1:8.253: ch341-uart converter detected [ 596.752643][ T5957] usb 5-1: failed to receive control message: -71 [ 596.760292][ T5957] ch341-uart ttyUSB1: probe with driver ch341-uart failed with error -71 [ 596.774052][ T5957] ch341 5-1:8.1: ch341-uart converter detected [ 596.781941][ T5957] usb 5-1: failed to receive control message: -71 [ 596.789453][ T5957] ch341-uart ttyUSB2: probe with driver ch341-uart failed with error -71 [ 596.803710][ T5957] hub 5-1:8.222: Invalid hub with more than one config or interface [ 596.812417][ T5957] hub 5-1:8.222: probe with driver hub failed with error -22 [ 596.820770][ T5957] ch341 5-1:8.222: ch341-uart converter detected [ 596.828845][ T5957] usb 5-1: failed to receive control message: -71 [ 596.835312][ T5957] ch341-uart ttyUSB3: probe with driver ch341-uart failed with error -71 [ 596.846538][ T5957] ch341 5-1:8.68: ch341-uart converter detected [ 596.854159][ T5957] usb 5-1: failed to receive control message: -71 [ 596.860829][ T5957] ch341-uart ttyUSB4: probe with driver ch341-uart failed with error -71 [ 596.873809][ T5957] usb 5-1: USB disconnect, device number 85 [ 596.910916][ T5957] ch341 5-1:8.205: device disconnected [ 596.950001][ T5957] ch341 5-1:8.253: device disconnected [ 596.958589][ T5957] ch341 5-1:8.1: device disconnected [ 596.965716][ T5957] ch341 5-1:8.222: device disconnected [ 596.974112][ T5957] ch341 5-1:8.68: device disconnected [ 597.050943][ T5910] usb 6-1: USB disconnect, device number 41 [ 597.456599][T13918] cgroup: fork rejected by pids controller in /syz3 [ 597.657581][ T5888] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 597.823684][ T5888] usb 5-1: Using ep0 maxpacket: 32 [ 597.881851][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 597.893744][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 597.905840][ T5888] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 598.065400][ T5888] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.094692][ T5888] usb 5-1: config 0 descriptor?? [ 598.309808][ T5888] koneplus 0003:1E7D:2D51.0012: collection stack underflow [ 598.329189][ T5888] koneplus 0003:1E7D:2D51.0012: item 0 0 0 12 parsing failed [ 598.349835][ T5888] koneplus 0003:1E7D:2D51.0012: parse failed [ 598.396283][ T5888] koneplus 0003:1E7D:2D51.0012: probe with driver koneplus failed with error -22 [ 599.152184][ T5160] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 599.162307][ T5160] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 599.178224][ T5160] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 599.192171][ T5160] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 599.202237][ T5160] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 599.252109][ T5838] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 599.262492][ T5838] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 599.274740][ T5838] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 599.294484][ T5838] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 599.302579][ T5838] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 599.333117][ T5910] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 599.487665][ T5910] usb 6-1: device descriptor read/64, error -71 [ 599.723385][T14051] chnl_net:caif_netlink_parms(): no params data found [ 599.769258][ T5910] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 599.813480][T14060] FAULT_INJECTION: forcing a failure. [ 599.813480][T14060] name failslab, interval 1, probability 0, space 0, times 0 [ 599.826159][T14060] CPU: 0 UID: 0 PID: 14060 Comm: syz.1.2362 Not tainted syzkaller #0 PREEMPT(full) [ 599.826173][T14060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 599.826180][T14060] Call Trace: [ 599.826185][T14060] [ 599.826190][T14060] dump_stack_lvl+0x189/0x250 [ 599.826208][T14060] ? __pfx____ratelimit+0x10/0x10 [ 599.826220][T14060] ? __pfx_dump_stack_lvl+0x10/0x10 [ 599.826232][T14060] ? __pfx__printk+0x10/0x10 [ 599.826243][T14060] ? migrate_enable+0x29c/0x3c0 [ 599.826258][T14060] should_fail_ex+0x414/0x560 [ 599.826281][T14060] should_failslab+0xa8/0x100 [ 599.826298][T14060] kmem_cache_alloc_noprof+0x73/0x3c0 [ 599.826312][T14060] ? skb_clone+0x212/0x3a0 [ 599.826325][T14060] ? run_filter+0x23/0x270 [ 599.826341][T14060] skb_clone+0x212/0x3a0 [ 599.826354][T14060] ? packet_rcv+0x567/0x1590 [ 599.826368][T14060] packet_rcv+0x6d6/0x1590 [ 599.826385][T14060] ? __pfx_packet_rcv+0x10/0x10 [ 599.826398][T14060] dev_queue_xmit_nit+0x3f4/0xcc0 [ 599.826412][T14060] ? dev_queue_xmit_nit+0x2d/0xcc0 [ 599.826428][T14060] dev_hard_start_xmit+0x1be/0x830 [ 599.826450][T14060] __dev_queue_xmit+0x1b8d/0x3b50 [ 599.826469][T14060] ? __dev_queue_xmit+0x27b/0x3b50 [ 599.826490][T14060] ? __pfx___dev_queue_xmit+0x10/0x10 [ 599.826510][T14060] ? __copy_skb_header+0xa7/0x550 [ 599.826523][T14060] ? __asan_memcpy+0x40/0x70 [ 599.826543][T14060] ? skb_clone+0x246/0x3a0 [ 599.826558][T14060] __netlink_deliver_tap+0x5ad/0x850 [ 599.826576][T14060] ? netlink_deliver_tap+0x2e/0x1b0 [ 599.826588][T14060] netlink_deliver_tap+0x19c/0x1b0 [ 599.826599][T14060] netlink_unicast+0x7fa/0x9e0 [ 599.826613][T14060] ? __pfx_netlink_unicast+0x10/0x10 [ 599.826623][T14060] ? netlink_sendmsg+0x642/0xb30 [ 599.826633][T14060] ? skb_put+0x11b/0x210 [ 599.826647][T14060] netlink_sendmsg+0x805/0xb30 [ 599.826662][T14060] ? __pfx_netlink_sendmsg+0x10/0x10 [ 599.826674][T14060] ? __import_iovec+0x5d4/0x7f0 [ 599.826686][T14060] ? aa_sock_msg_perm+0xf1/0x1d0 [ 599.826697][T14060] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 599.826708][T14060] ? __pfx_netlink_sendmsg+0x10/0x10 [ 599.826720][T14060] __sock_sendmsg+0x21c/0x270 [ 599.826731][T14060] ____sys_sendmsg+0x505/0x830 [ 599.826747][T14060] ? __pfx_____sys_sendmsg+0x10/0x10 [ 599.826767][T14060] ___sys_sendmsg+0x21f/0x2a0 [ 599.826781][T14060] ? __pfx____sys_sendmsg+0x10/0x10 [ 599.826811][T14060] ? __fget_files+0x2a/0x420 [ 599.826820][T14060] ? __fget_files+0x3a0/0x420 [ 599.826833][T14060] __sys_sendmsg+0x164/0x220 [ 599.826847][T14060] ? __pfx___sys_sendmsg+0x10/0x10 [ 599.826867][T14060] ? lockdep_hardirqs_on+0x9c/0x150 [ 599.826879][T14060] __do_fast_syscall_32+0xb6/0x2b0 [ 599.826891][T14060] ? lockdep_hardirqs_on+0x9c/0x150 [ 599.826903][T14060] do_fast_syscall_32+0x34/0x80 [ 599.826914][T14060] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 599.826926][T14060] RIP: 0023:0xf703e539 [ 599.826936][T14060] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 599.826944][T14060] RSP: 002b:00000000f542e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 599.826955][T14060] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000280 [ 599.826962][T14060] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 599.826967][T14060] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 599.826973][T14060] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 599.826979][T14060] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 599.826993][T14060] [ 600.172110][ C0] vkms_vblank_simulate: vblank timer overrun [ 600.200725][ T5910] usb 6-1: device descriptor read/64, error -71 [ 600.320484][ T5910] usb usb6-port1: attempt power cycle [ 600.335184][T14051] bridge0: port 1(bridge_slave_0) entered blocking state [ 600.342870][T14051] bridge0: port 1(bridge_slave_0) entered disabled state [ 600.350162][T14051] bridge_slave_0: entered allmulticast mode [ 600.358474][T14051] bridge_slave_0: entered promiscuous mode [ 600.366203][T14051] bridge0: port 2(bridge_slave_1) entered blocking state [ 600.373633][T14051] bridge0: port 2(bridge_slave_1) entered disabled state [ 600.380889][T14051] bridge_slave_1: entered allmulticast mode [ 600.388191][T14051] bridge_slave_1: entered promiscuous mode [ 600.425873][ T5888] usb 5-1: USB disconnect, device number 86 [ 600.469324][T14051] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 600.481092][T14051] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 600.535198][T14065] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 600.575048][T14051] team0: Port device team_slave_0 added [ 600.576204][T14065] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 600.584445][T14051] team0: Port device team_slave_1 added [ 600.655460][T14051] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 600.663131][T14051] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 600.689069][ C0] vkms_vblank_simulate: vblank timer overrun [ 600.697617][ T5910] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 600.697679][T14051] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 600.725092][T14051] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 600.732474][T14051] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 600.758466][ C0] vkms_vblank_simulate: vblank timer overrun [ 600.778113][ T5910] usb 6-1: device descriptor read/8, error -71 [ 600.781575][T14065] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 600.793235][T14065] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 600.795076][T14051] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 600.875475][T14069] bridge2: entered promiscuous mode [ 600.881137][T14069] bridge2: entered allmulticast mode [ 600.894960][T14069] team0: Port device bridge2 added [ 600.933552][T14051] hsr_slave_0: entered promiscuous mode [ 600.954427][T14051] hsr_slave_1: entered promiscuous mode [ 600.962047][T14051] debugfs: 'hsr0' already exists in 'hsr' [ 600.968146][T14051] Cannot create hsr debugfs directory [ 600.977760][T14071] netlink: 35468 bytes leftover after parsing attributes in process `syz.4.2367'. [ 601.026439][T14071] ip6gretap1: entered allmulticast mode [ 601.033064][ T5910] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 601.063729][ T5910] usb 6-1: device descriptor read/8, error -71 [ 601.178333][ T5910] usb usb6-port1: unable to enumerate USB device [ 601.367882][ T5160] Bluetooth: hci2: command tx timeout [ 601.446740][T14079] input: syz1 as /devices/virtual/input/input47 [ 601.460828][T14079] input: failed to attach handler leds to device input47, error: -6 [ 601.600635][T14051] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.764737][T14051] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.930556][T14051] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.270782][T14051] bond0: (slave netdevsim0): Releasing backup interface [ 602.408138][ T5910] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 602.587649][ T5910] usb 3-1: Using ep0 maxpacket: 8 [ 602.600599][ T5910] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 602.610287][ T5910] usb 3-1: config 0 has no interface number 0 [ 602.617139][ T5910] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 602.631474][ T5910] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 602.647822][ T5910] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 602.669045][ T5910] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 602.694170][ T5910] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 602.712303][ T5910] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 602.741230][ T5910] usb 3-1: config 0 descriptor?? [ 602.776826][T14051] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 602.786991][ T5910] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 602.833958][T14051] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 602.876212][T14051] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 602.882713][T14099] usb usb8: usbfs: process 14099 (syz.1.2375) did not claim interface 0 before use [ 602.936357][T14051] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 603.193083][T14090] ldusb 3-1:0.55: Write buffer overflow, 448 bytes dropped [ 603.290234][ T5926] usb 3-1: USB disconnect, device number 99 [ 603.316367][ T5926] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 603.359974][ T5910] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 603.487554][ T5160] Bluetooth: hci2: command tx timeout [ 603.577746][T14051] 8021q: adding VLAN 0 to HW filter on device bond0 [ 603.647852][ T5910] usb 5-1: Using ep0 maxpacket: 8 [ 603.656091][T14051] 8021q: adding VLAN 0 to HW filter on device team0 [ 603.658475][ T5910] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 603.670225][ T1156] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.681006][ T1156] bridge0: port 1(bridge_slave_0) entered forwarding state [ 603.703019][ T3529] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.710184][ T3529] bridge0: port 2(bridge_slave_1) entered forwarding state [ 603.857589][ T5910] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 603.868996][ T5910] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 603.975537][ T5910] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 604.021307][T14122] usb usb8: usbfs: process 14122 (syz.5.2379) did not claim interface 0 before use [ 604.049117][T14051] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 604.055692][ T5910] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 604.089620][ T5910] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.204706][T14051] veth0_vlan: entered promiscuous mode [ 604.224239][T14051] veth1_vlan: entered promiscuous mode [ 604.245417][T14130] fuse: Bad value for 'fd' [ 604.282176][T14051] veth0_macvtap: entered promiscuous mode [ 604.294469][T14051] veth1_macvtap: entered promiscuous mode [ 604.326033][T14051] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 604.357194][T14051] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 604.374915][ T1156] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.417022][T14134] FAULT_INJECTION: forcing a failure. [ 604.417022][T14134] name failslab, interval 1, probability 0, space 0, times 0 [ 604.434029][T14134] CPU: 0 UID: 0 PID: 14134 Comm: syz.2.2383 Not tainted syzkaller #0 PREEMPT(full) [ 604.434053][T14134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 604.434065][T14134] Call Trace: [ 604.434072][T14134] [ 604.434081][T14134] dump_stack_lvl+0x189/0x250 [ 604.434102][T14134] ? __pfx____ratelimit+0x10/0x10 [ 604.434114][T14134] ? __pfx_dump_stack_lvl+0x10/0x10 [ 604.434126][T14134] ? __pfx__printk+0x10/0x10 [ 604.434138][T14134] ? __pfx___might_resched+0x10/0x10 [ 604.434150][T14134] should_fail_ex+0x414/0x560 [ 604.434168][T14134] should_failslab+0xa8/0x100 [ 604.434185][T14134] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 604.434200][T14134] ? __alloc_skb+0x112/0x2d0 [ 604.434211][T14134] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 604.434228][T14134] __alloc_skb+0x112/0x2d0 [ 604.434241][T14134] pfkey_sendmsg+0x1dd/0x1090 [ 604.434257][T14134] ? __pfx___might_resched+0x10/0x10 [ 604.434269][T14134] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 604.434284][T14134] ? aa_sk_perm+0x81e/0x950 [ 604.434301][T14134] ? __pfx_aa_sk_perm+0x10/0x10 [ 604.434315][T14134] ? tomoyo_socket_sendmsg_permission+0x1e1/0x300 [ 604.434327][T14134] ? __asan_memset+0x22/0x50 [ 604.434338][T14134] ? __import_iovec+0x5d4/0x7f0 [ 604.434350][T14134] ? aa_sock_msg_perm+0xf1/0x1d0 [ 604.434360][T14134] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 604.434371][T14134] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 604.434383][T14134] __sock_sendmsg+0x21c/0x270 [ 604.434394][T14134] ____sys_sendmsg+0x505/0x830 [ 604.434410][T14134] ? __pfx_____sys_sendmsg+0x10/0x10 [ 604.434435][T14134] ___sys_sendmsg+0x21f/0x2a0 [ 604.434449][T14134] ? __pfx____sys_sendmsg+0x10/0x10 [ 604.434479][T14134] ? __fget_files+0x2a/0x420 [ 604.434488][T14134] ? __fget_files+0x3a0/0x420 [ 604.434502][T14134] __sys_sendmsg+0x164/0x220 [ 604.434515][T14134] ? __pfx___sys_sendmsg+0x10/0x10 [ 604.434536][T14134] ? lockdep_hardirqs_on+0x9c/0x150 [ 604.434549][T14134] __do_fast_syscall_32+0xb6/0x2b0 [ 604.434561][T14134] ? lockdep_hardirqs_on+0x9c/0x150 [ 604.434573][T14134] do_fast_syscall_32+0x34/0x80 [ 604.434584][T14134] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 604.434601][T14134] RIP: 0023:0xf7f61539 [ 604.434611][T14134] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 604.434620][T14134] RSP: 002b:00000000f545655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 604.434630][T14134] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000805f5000 [ 604.434638][T14134] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 604.434643][T14134] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 604.434649][T14134] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 604.434654][T14134] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 604.434668][T14134] [ 604.717537][ C0] vkms_vblank_simulate: vblank timer overrun [ 604.727769][ T5910] usb 5-1: GET_CAPABILITIES returned 0 [ 604.732980][ T7609] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.733289][ T5910] usbtmc 5-1:16.0: can't read capabilities [ 604.742252][ T7609] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.756529][ T7609] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.323712][ T5888] usb 5-1: USB disconnect, device number 87 [ 605.768458][ T5160] Bluetooth: hci2: command 0x0419 tx timeout [ 605.776313][T14118] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 606.263512][T14118] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 606.276344][T14118] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 606.424810][ T7609] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 606.443653][ T7609] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 606.525261][ T3529] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 606.536007][ T3529] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 606.595608][T14146] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2388'. [ 606.674115][T14146] bridge2: port 1(veth5) entered blocking state [ 606.680643][ T5910] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 606.701135][T14146] bridge2: port 1(veth5) entered disabled state [ 606.718820][ T5926] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 606.734673][T14146] veth5: entered allmulticast mode [ 606.757005][T14152] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2388'. [ 606.762741][T14146] veth5: entered promiscuous mode [ 606.766771][T14152] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2388'. [ 606.852145][T14149] bridge2: port 2(veth0_to_bond) entered blocking state [ 606.863296][T14149] bridge2: port 2(veth0_to_bond) entered disabled state [ 606.864532][ T5910] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 606.880963][T14149] veth0_to_bond: entered allmulticast mode [ 606.900584][ T5910] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 606.911030][ T5926] usb 3-1: Using ep0 maxpacket: 8 [ 606.923992][ T5926] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 606.935416][ T5926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.948791][ T5910] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 606.961958][T14149] veth0_to_bond: entered promiscuous mode [ 606.980884][ T5910] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 606.997047][ T5926] pvrusb2: Hardware description: Terratec Grabster AV400 [ 607.005653][ T5926] pvrusb2: ********** [ 607.011592][ T5910] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 607.023586][ T5926] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 607.034159][ T5926] pvrusb2: Important functionality might not be entirely working. [ 607.042691][ T5926] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 607.055651][ T5926] pvrusb2: ********** [ 607.061090][ T5910] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 607.070498][ T5910] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 607.079650][ T5910] usb 6-1: Product: syz [ 607.085262][ T5910] usb 6-1: Manufacturer: syz [ 607.107863][ T5910] cdc_wdm 6-1:1.0: skipping garbage [ 607.113124][ T5910] cdc_wdm 6-1:1.0: skipping garbage [ 607.129302][ T5910] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 607.143491][ T5910] cdc_wdm 6-1:1.0: Unknown control protocol [ 607.212465][ T2342] pvrusb2: Invalid write control endpoint [ 607.292768][ T2342] pvrusb2: Invalid write control endpoint [ 607.304520][ T2342] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 607.327345][ T2342] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 607.340175][ T2342] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 607.350547][ T2342] pvrusb2: Device being rendered inoperable [ 607.356565][ T2342] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 607.365046][ T2342] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 607.382825][ T2342] pvrusb2: Attached sub-driver cx25840 [ 607.405053][ T2342] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 607.429118][T14156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 607.444745][T14156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 607.577618][T14162] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 607.611106][T14162] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 607.725609][ T2342] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 607.742997][ T5924] usb 3-1: USB disconnect, device number 100 [ 607.817818][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.824480][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.830770][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.837380][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.847872][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.854488][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.861240][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.868200][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.874487][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.880126][ T5838] Bluetooth: hci2: command 0x0419 tx timeout [ 607.881076][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.894036][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.900652][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.906936][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.913542][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.919891][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.926492][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.933385][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.939996][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.946953][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 607.953568][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 607.980067][ T5917] usb 6-1: USB disconnect, device number 46 [ 607.980125][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 608.557736][T14172] fuse: Bad value for 'fd' [ 609.340721][T14177] usb usb8: usbfs: process 14177 (syz.1.2393) did not claim interface 0 before use [ 609.344143][T14182] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2394'. [ 609.944726][ T5838] Bluetooth: hci2: command 0x0419 tx timeout [ 610.748917][T14194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 610.768846][T14194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 610.890213][ T24] usb 3-1: new low-speed USB device number 101 using dummy_hcd [ 610.984416][T14198] loop6: detected capacity change from 0 to 524287999 [ 611.005581][T11987] Buffer I/O error on dev loop6, logical block 65535998, async page read [ 611.044292][T14200] FAULT_INJECTION: forcing a failure. [ 611.044292][T14200] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 611.058025][ T5924] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 611.080352][T14200] CPU: 1 UID: 0 PID: 14200 Comm: syz.4.2401 Not tainted syzkaller #0 PREEMPT(full) [ 611.080376][T14200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 611.080387][T14200] Call Trace: [ 611.080394][T14200] [ 611.080403][T14200] dump_stack_lvl+0x189/0x250 [ 611.080432][T14200] ? __pfx____ratelimit+0x10/0x10 [ 611.080451][T14200] ? __pfx_dump_stack_lvl+0x10/0x10 [ 611.080471][T14200] ? __pfx__printk+0x10/0x10 [ 611.080488][T14200] ? __might_fault+0xb0/0x130 [ 611.080522][T14200] should_fail_ex+0x414/0x560 [ 611.080552][T14200] _copy_from_iter+0x1de/0x1790 [ 611.080579][T14200] ? rcu_is_watching+0x15/0xb0 [ 611.080599][T14200] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 611.080624][T14200] ? __pfx__copy_from_iter+0x10/0x10 [ 611.080645][T14200] ? __build_skb_around+0x257/0x3e0 [ 611.080669][T14200] ? netlink_sendmsg+0x642/0xb30 [ 611.080687][T14200] ? skb_put+0x11b/0x210 [ 611.080710][T14200] netlink_sendmsg+0x6b2/0xb30 [ 611.080739][T14200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 611.080760][T14200] ? __import_iovec+0x5d4/0x7f0 [ 611.080779][T14200] ? aa_sock_msg_perm+0xf1/0x1d0 [ 611.080799][T14200] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 611.080818][T14200] ? __pfx_netlink_sendmsg+0x10/0x10 [ 611.080838][T14200] __sock_sendmsg+0x21c/0x270 [ 611.080858][T14200] ____sys_sendmsg+0x505/0x830 [ 611.080885][T14200] ? __pfx_____sys_sendmsg+0x10/0x10 [ 611.080921][T14200] ___sys_sendmsg+0x21f/0x2a0 [ 611.080944][T14200] ? __pfx____sys_sendmsg+0x10/0x10 [ 611.081001][T14200] ? __fget_files+0x2a/0x420 [ 611.081016][T14200] ? __fget_files+0x3a0/0x420 [ 611.081043][T14200] __sys_sendmsg+0x164/0x220 [ 611.081066][T14200] ? __pfx___sys_sendmsg+0x10/0x10 [ 611.081103][T14200] ? lockdep_hardirqs_on+0x9c/0x150 [ 611.081126][T14200] __do_fast_syscall_32+0xb6/0x2b0 [ 611.081152][T14200] ? lockdep_hardirqs_on+0x9c/0x150 [ 611.081175][T14200] do_fast_syscall_32+0x34/0x80 [ 611.081194][T14200] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 611.081214][T14200] RIP: 0023:0xf7f78539 [ 611.081230][T14200] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 611.081245][T14200] RSP: 002b:00000000f546655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 611.081264][T14200] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 611.081276][T14200] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 611.081287][T14200] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 611.081297][T14200] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 611.081308][T14200] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 611.081333][T14200] [ 611.081625][ T24] usb 3-1: config index 0 descriptor too short (expected 1307, got 27) [ 611.231066][ T5924] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 611.246213][ T24] usb 3-1: config 0 has an invalid interface number: 0 but max is -1 [ 611.268969][ T5924] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 611.268997][ T5924] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.269015][ T5924] usb 6-1: Product: syz [ 611.269028][ T5924] usb 6-1: Manufacturer: syz [ 611.269041][ T5924] usb 6-1: SerialNumber: syz [ 611.314509][ T5924] usb 6-1: config 0 descriptor?? [ 611.315996][ T24] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 611.422006][ T24] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30 [ 611.433219][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 is Bulk; changing to Interrupt [ 611.443229][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 611.470884][ T24] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246 [ 611.493967][ T24] usb 3-1: string descriptor 0 read error: -22 [ 611.500730][ T24] usb 3-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 611.510469][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.525204][ T24] usb 3-1: config 0 descriptor?? [ 611.545914][ T24] hub 3-1:0.0: bad descriptor, ignoring hub [ 611.552352][ T24] hub 3-1:0.0: probe with driver hub failed with error -5 [ 611.557524][ T5888] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 611.567719][ T24] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input48 [ 611.732738][ T5888] usb 5-1: Using ep0 maxpacket: 16 [ 611.754365][ T5888] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 611.773513][ T24] usb 3-1: USB disconnect, device number 101 [ 611.779414][ T5888] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 611.803233][T14196] netlink: 'syz.5.2399': attribute type 4 has an invalid length. [ 611.813519][ T5888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.828111][ T5888] usb 5-1: Product: syz [ 611.832375][ T5888] usb 5-1: Manufacturer: syz [ 611.837361][ T5888] usb 5-1: SerialNumber: syz [ 611.847203][ T5888] usb 5-1: config 0 descriptor?? [ 611.857390][ T5888] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 611.866655][ T5888] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 611.926964][T14217] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2406'. [ 611.938864][T14217] netlink: 277 bytes leftover after parsing attributes in process `syz.1.2406'. [ 611.948690][T14217] netlink: 277 bytes leftover after parsing attributes in process `syz.1.2406'. [ 612.021154][ T5838] Bluetooth: hci2: command 0x0419 tx timeout [ 612.094466][ T24] usb 6-1: USB disconnect, device number 47 [ 612.463299][ T5888] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 612.868643][ T5926] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 612.880744][T14231] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2410'. [ 612.906521][ T5888] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 612.914687][ T5888] em28xx 5-1:0.0: board has no eeprom [ 613.099125][ T5926] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 613.111343][ T5926] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 613.197511][ T5888] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 613.208465][ T5888] em28xx 5-1:0.0: dvb set to bulk mode. [ 613.214054][ T5924] em28xx 5-1:0.0: Binding DVB extension [ 613.227542][ T5926] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 613.308782][ T5926] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 613.349008][ T5926] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 613.362719][ T5957] usb 5-1: USB disconnect, device number 88 [ 613.383640][ T5926] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 613.404715][ T5926] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 613.406337][ T5957] em28xx 5-1:0.0: Disconnecting em28xx [ 613.480332][ T5924] em28xx 5-1:0.0: Registering input extension [ 613.490593][ T5926] usb 4-1: Product: syz [ 613.495012][ T5957] em28xx 5-1:0.0: Closing input extension [ 613.548570][ T5926] usb 4-1: Manufacturer: syz [ 613.566670][ T5926] cdc_wdm 4-1:1.0: skipping garbage [ 613.572284][ T5926] cdc_wdm 4-1:1.0: skipping garbage [ 613.575435][ T5957] em28xx 5-1:0.0: Freeing device [ 613.634387][ T5926] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 613.640461][ T5926] cdc_wdm 4-1:1.0: Unknown control protocol [ 613.785052][T14224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 613.795419][T14224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 613.862672][ T5926] usb 4-1: USB disconnect, device number 106 [ 614.096374][ T5838] Bluetooth: hci2: command 0x0419 tx timeout [ 614.540838][T14252] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2417'. [ 614.587531][ T5926] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 614.610440][T14257] FAULT_INJECTION: forcing a failure. [ 614.610440][T14257] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 614.666389][T14259] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2418'. [ 614.881412][ T5926] usb 6-1: config 0 has no interfaces? [ 614.888456][ T5926] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 614.903865][ T5926] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 614.907613][T14257] CPU: 0 UID: 0 PID: 14257 Comm: syz.2.2419 Not tainted syzkaller #0 PREEMPT(full) [ 614.907635][T14257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 614.907646][T14257] Call Trace: [ 614.907655][T14257] [ 614.907662][T14257] dump_stack_lvl+0x189/0x250 [ 614.907688][T14257] ? __pfx____ratelimit+0x10/0x10 [ 614.907707][T14257] ? __pfx_dump_stack_lvl+0x10/0x10 [ 614.907727][T14257] ? __pfx__printk+0x10/0x10 [ 614.907750][T14257] ? __might_fault+0xb0/0x130 [ 614.907782][T14257] should_fail_ex+0x414/0x560 [ 614.907812][T14257] _copy_from_user+0x2d/0xb0 [ 614.907835][T14257] io_submit_one+0xc2/0x1310 [ 614.907868][T14257] ? __pfx_io_submit_one+0x10/0x10 [ 614.907887][T14257] ? __might_fault+0xb0/0x130 [ 614.907919][T14257] ? __might_fault+0xb0/0x130 [ 614.907944][T14257] __ia32_compat_sys_io_submit+0x1c7/0x330 [ 614.907965][T14257] ? __pfx___ia32_compat_sys_io_submit+0x10/0x10 [ 614.907981][T14257] ? ksys_write+0x22a/0x250 [ 614.908011][T14257] ? lockdep_hardirqs_on+0x9c/0x150 [ 614.908031][T14257] __do_fast_syscall_32+0xb6/0x2b0 [ 614.908051][T14257] ? lockdep_hardirqs_on+0x9c/0x150 [ 614.908071][T14257] do_fast_syscall_32+0x34/0x80 [ 614.908090][T14257] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 614.908109][T14257] RIP: 0023:0xf7f61539 [ 614.908123][T14257] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 614.908138][T14257] RSP: 002b:00000000f545655c EFLAGS: 00000206 ORIG_RAX: 00000000000000f8 [ 614.908156][T14257] RAX: ffffffffffffffda RBX: 00000000f73ff000 RCX: 0000000000000001 [ 614.908168][T14257] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 614.908178][T14257] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 614.908188][T14257] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 614.908197][T14257] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 614.908222][T14257] [ 615.328605][T14261] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2420'. [ 615.345916][ T5926] usb 6-1: Manufacturer: syz [ 615.606545][ T5926] usb 6-1: config 0 descriptor?? [ 615.665239][T14263] trusted_key: encrypted_key: insufficient parameters specified [ 615.854647][ T5924] usb 6-1: USB disconnect, device number 48 [ 615.893700][T14265] usb usb8: usbfs: process 14265 (syz.4.2422) did not claim interface 0 before use [ 616.138242][T14275] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2425'. [ 617.947698][ T5924] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 618.245526][T14318] netlink: 'syz.3.2436': attribute type 1 has an invalid length. [ 618.317609][ T5924] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 618.333946][ T5924] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 618.465602][ T5924] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 618.496306][ T5924] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 618.509804][T14320] usb usb8: usbfs: process 14320 (syz.1.2437) did not claim interface 0 before use [ 618.529758][ T5924] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 618.574614][ T5924] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 618.623681][ T5924] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 618.766430][ T5924] usb 5-1: Product: syz [ 618.783614][ T5924] usb 5-1: Manufacturer: syz [ 618.836751][ T5924] cdc_wdm 5-1:1.0: skipping garbage [ 618.989331][ T5924] cdc_wdm 5-1:1.0: skipping garbage [ 618.996241][ T5924] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 619.062360][ T5924] cdc_wdm 5-1:1.0: Unknown control protocol [ 619.062698][T14313] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 619.090091][T14313] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 619.139337][T14328] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 619.148843][T14328] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 619.376030][ T5917] usb 5-1: USB disconnect, device number 89 [ 619.671587][T14339] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2440'. [ 620.152192][ T30] audit: type=1326 audit(1759231306.970:697): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 620.186759][ T30] audit: type=1326 audit(1759231306.970:698): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 620.263006][T14345] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2442'. [ 620.272938][ T30] audit: type=1326 audit(1759231307.000:699): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=399 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 620.487757][ T30] audit: type=1326 audit(1759231307.000:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 620.511060][T14346] netlink: 108 bytes leftover after parsing attributes in process `syz.5.2442'. [ 620.520283][ T30] audit: type=1326 audit(1759231307.000:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 620.577134][ T30] audit: type=1326 audit(1759231307.000:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 620.646373][ T30] audit: type=1326 audit(1759231307.000:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 620.714676][ T30] audit: type=1326 audit(1759231307.000:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 620.996880][ T30] audit: type=1326 audit(1759231307.000:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 621.034621][ T30] audit: type=1326 audit(1759231307.050:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14344 comm="syz.5.2442" exe="/root/syz-executor" sig=0 arch=40000003 syscall=402 compat=1 ip=0xf7f34539 code=0x7ffc0000 [ 621.550597][T14367] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2446'. [ 623.080314][ T5917] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 623.941732][T14410] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2456'. [ 623.951365][T14410] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2456'. [ 624.042168][T14412] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2457'. [ 624.573732][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.580197][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.697883][ T5910] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 624.867526][ T5917] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 624.916517][ T5910] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 624.935833][ T5910] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 624.950918][T14421] usb usb8: usbfs: process 14421 (syz.3.2461) did not claim interface 0 before use [ 624.952771][T14423] syz_tun: entered allmulticast mode [ 624.988096][ T5910] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 625.008910][T14423] dvmrp1: entered allmulticast mode [ 625.016476][ T5910] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 625.019771][T14422] syz_tun: left allmulticast mode [ 625.046447][ T5910] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 625.070268][ T5917] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 625.079204][ T5917] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 625.091315][ T5910] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 625.100927][ T5910] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 625.109256][ T5910] usb 6-1: Product: syz [ 625.113659][ T5910] usb 6-1: Manufacturer: syz [ 625.119662][ T5917] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 625.129241][ T5917] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 625.137242][ T5917] usb 5-1: Manufacturer: syz [ 625.152162][ T5910] cdc_wdm 6-1:1.0: skipping garbage [ 625.162873][ T5910] cdc_wdm 6-1:1.0: skipping garbage [ 625.178645][ T5917] usb 5-1: config 0 descriptor?? [ 625.183995][ T5910] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 625.194117][ T5910] cdc_wdm 6-1:1.0: Unknown control protocol [ 625.203338][ T5917] igorplugusb 5-1:0.0: incorrect number of endpoints [ 625.281555][T14432] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2464'. [ 625.409594][T14434] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 625.418574][T14434] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 625.434797][ T5924] usb 5-1: USB disconnect, device number 90 [ 625.498522][ T5888] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 625.649176][ C1] wdm_int_callback: 120 callbacks suppressed [ 625.649200][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 625.649636][ T5924] usb 6-1: USB disconnect, device number 49 [ 625.655395][ C1] wdm_int_callback: 120 callbacks suppressed [ 625.655413][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 625.655431][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 625.690508][T14437] cdc_wdm 6-1:1.0: Tx URB error: -19 [ 625.758296][T14440] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2466'. [ 625.903836][T14440] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 625.927139][T14440] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 627.027754][ T5910] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 627.557517][ T5910] usb 5-1: device descriptor read/64, error -71 [ 627.868369][ T5910] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 627.998218][ T5910] usb 5-1: device descriptor read/64, error -71 [ 628.058057][T14475] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.2474'. [ 628.113730][ T5910] usb usb5-port1: attempt power cycle [ 628.165832][T14477] usb usb8: usbfs: process 14477 (syz.2.2475) did not claim interface 0 before use [ 628.433398][T14484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 628.443612][T14484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 628.477742][ T5910] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 628.529064][ T5910] usb 5-1: device descriptor read/8, error -71 [ 628.594761][T14487] bridge0: port 2(bridge_slave_1) entered disabled state [ 628.603168][T14487] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.711427][T14491] xt_l2tp: missing protocol rule (udp|l2tpip) [ 628.777588][ T5910] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 628.802916][ T5910] usb 5-1: device descriptor read/8, error -71 [ 628.917809][ T5910] usb usb5-port1: unable to enumerate USB device [ 629.037572][ T5924] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 629.099930][T14499] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2482'. [ 629.190076][ T5924] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 629.199039][ T5924] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 629.313761][ T5924] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 629.482680][ T5924] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 629.686692][ T5924] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 629.891397][ T5924] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 629.901088][ T5924] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 629.911159][ T5924] usb 3-1: Product: syz [ 629.915321][ T5924] usb 3-1: Manufacturer: syz [ 629.964825][ T5924] cdc_wdm 3-1:1.0: skipping garbage [ 629.975637][ T5924] cdc_wdm 3-1:1.0: skipping garbage [ 629.986492][ T5924] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 630.001417][ T5924] cdc_wdm 3-1:1.0: Unknown control protocol [ 630.105007][T14518] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2489'. [ 630.117725][T14515] usb usb8: usbfs: process 14515 (syz.3.2488) did not claim interface 0 before use [ 630.222077][T14522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.253735][T14522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.286544][T14525] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 630.296053][T14525] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 630.487432][ C0] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 630.491084][ T5917] usb 3-1: USB disconnect, device number 103 [ 630.494070][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 630.494090][ C0] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 630.549235][T14533] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2493'. [ 630.727794][ T5910] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 630.891466][ T5910] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 630.948866][ T5910] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 631.017677][ T5910] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 631.091937][ T5910] usb 5-1: config 0 descriptor?? [ 631.517931][ T5957] usb 6-1: new full-speed USB device number 50 using dummy_hcd [ 631.626463][ T5910] usbhid 5-1:0.0: can't add hid device: -71 [ 631.635311][ T5910] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 631.655190][ T5910] usb 5-1: USB disconnect, device number 95 [ 631.690005][ T5957] usb 6-1: config 0 has an invalid interface number: 11 but max is 0 [ 631.698599][ T5957] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 631.750276][ T5957] usb 6-1: config 0 has no interface number 0 [ 631.769338][ T5957] usb 6-1: config 0 interface 11 altsetting 253 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 631.790611][ T5957] usb 6-1: config 0 interface 11 altsetting 253 endpoint 0x87 has invalid maxpacket 8456, setting to 64 [ 631.858808][ T5957] usb 6-1: config 0 interface 11 altsetting 253 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 631.911585][ T5957] usb 6-1: config 0 interface 11 has no altsetting 0 [ 631.928866][ T5957] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 631.947881][ T5957] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 631.982624][ T5957] usb 6-1: config 0 descriptor?? [ 631.999716][ T5957] keyspan 6-1:0.11: Keyspan 2 port adapter converter detected [ 632.012039][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 7 [ 632.031119][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 81 [ 632.061575][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 82 [ 632.077778][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 1 [ 632.086078][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 2 [ 632.095272][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 85 [ 632.104020][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 5 [ 632.242452][ T5910] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 632.275962][ T5957] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 632.335900][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 83 [ 632.344305][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 84 [ 632.361649][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 3 [ 632.383007][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 4 [ 632.395728][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 86 [ 632.404349][ T5957] keyspan 6-1:0.11: found no endpoint descriptor for endpoint 6 [ 632.421873][T14552] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2499'. [ 632.537339][T14553] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 632.545615][ T5910] usb 5-1: Using ep0 maxpacket: 16 [ 632.554237][ T5910] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 632.559215][ T5957] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 632.592541][ T5910] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 632.631151][ T5910] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.644496][ T5957] usb 6-1: USB disconnect, device number 50 [ 632.781076][ T5910] usb 5-1: config 0 descriptor?? [ 633.076932][ T5957] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 633.179112][T14558] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2501'. [ 633.277355][ T5957] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 633.311074][ T5910] mcp2221 0003:04D8:00DD.0013: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.4-1/input0 [ 633.319120][ T5957] keyspan 6-1:0.11: device disconnected [ 633.330407][T14560] usb usb8: usbfs: process 14560 (syz.3.2500) did not claim interface 0 before use [ 633.450380][T14562] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2502'. [ 633.497522][ C1] ================================================================== [ 633.505734][ C1] BUG: KASAN: slab-out-of-bounds in mcp2221_raw_event+0x106a/0x1240 [ 633.513740][ C1] Read of size 1 at addr ffff88805789ffff by task syz.1.2499/14548 [ 633.521627][ C1] [ 633.523943][ C1] CPU: 1 UID: 0 PID: 14548 Comm: syz.1.2499 Not tainted syzkaller #0 PREEMPT(full) [ 633.523964][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 633.523974][ C1] Call Trace: [ 633.523982][ C1] [ 633.523989][ C1] dump_stack_lvl+0x189/0x250 [ 633.524013][ C1] ? __kasan_check_byte+0x12/0x40 [ 633.524039][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 633.524057][ C1] ? lock_release+0x4b/0x3e0 [ 633.524074][ C1] ? __virt_addr_valid+0x4a5/0x5c0 [ 633.524097][ C1] print_report+0xca/0x240 [ 633.524114][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 633.524134][ C1] kasan_report+0x118/0x150 [ 633.524157][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 633.524181][ C1] mcp2221_raw_event+0x106a/0x1240 [ 633.524203][ C1] ? down_trylock+0x50/0xb0 [ 633.524221][ C1] hid_input_report+0x407/0x520 [ 633.524239][ C1] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 633.524261][ C1] hid_irq_in+0x47e/0x6d0 [ 633.524285][ C1] __usb_hcd_giveback_urb+0x373/0x540 [ 633.524304][ C1] dummy_timer+0x862/0x4550 [ 633.524337][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 633.524353][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 633.524367][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 633.524382][ C1] __hrtimer_run_queues+0x52c/0xc60 [ 633.524404][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 633.524420][ C1] ? read_tsc+0x9/0x20 [ 633.524433][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 633.524451][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 633.524469][ C1] handle_softirqs+0x286/0x870 [ 633.524485][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 633.524501][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 633.524518][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 633.524538][ C1] __irq_exit_rcu+0xca/0x1f0 [ 633.524566][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 633.524589][ C1] irq_exit_rcu+0x9/0x30 [ 633.524604][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 633.524620][ C1] [ 633.524626][ C1] [ 633.524632][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 633.524648][ C1] RIP: 0010:kasan_check_range+0x9f/0x2c0 [ 633.524673][ C1] Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 41 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 de 01 00 00 49 ff c3 48 ff c3 75 ee e9 21 01 00 00 44 89 dd [ 633.524689][ C1] RSP: 0018:ffffc900037b7318 EFLAGS: 00000246 [ 633.524705][ C1] RAX: 1ffffffff32b8d01 RBX: ffffffffffffffff RCX: ffffffff822cc52b [ 633.524718][ C1] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88801d135558 [ 633.524729][ C1] RBP: ffff88801d135510 R08: ffff88801d13555b R09: 1ffff11003a26aab [ 633.524741][ C1] R10: dffffc0000000000 R11: ffffed1003a26aab R12: 0000000000000001 [ 633.524752][ C1] R13: 0000000000000001 R14: ffffed1003a26aac R15: 1ffff11003a26aab [ 633.524766][ C1] ? page_table_check_clear+0x2bb/0x700 [ 633.524791][ C1] ? page_ext_lookup+0x127/0x180 [ 633.524811][ C1] ? page_table_check_clear+0x187/0x700 [ 633.524833][ C1] page_table_check_clear+0x2bb/0x700 [ 633.524854][ C1] ? page_table_check_clear+0x187/0x700 [ 633.524876][ C1] unmap_page_range+0x3445/0x4370 [ 633.524908][ C1] ? __pfx_unmap_page_range+0x10/0x10 [ 633.524926][ C1] ? mas_find+0xb0e/0xd30 [ 633.524941][ C1] ? unmap_vmas+0x144/0x580 [ 633.524957][ C1] unmap_vmas+0x399/0x580 [ 633.524975][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 633.524998][ C1] exit_mmap+0x248/0xb50 [ 633.525020][ C1] ? uprobe_clear_state+0x20f/0x290 [ 633.525039][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 633.525059][ C1] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 633.525080][ C1] ? __pfx_exit_aio+0x10/0x10 [ 633.525097][ C1] ? uprobe_clear_state+0x274/0x290 [ 633.525116][ C1] __mmput+0x118/0x430 [ 633.525131][ C1] exit_mm+0x1da/0x2c0 [ 633.525151][ C1] ? __pfx_exit_mm+0x10/0x10 [ 633.525171][ C1] ? rcu_is_watching+0x15/0xb0 [ 633.525188][ C1] do_exit+0x648/0x2300 [ 633.525209][ C1] ? do_raw_spin_lock+0x121/0x290 [ 633.525229][ C1] ? __pfx_do_exit+0x10/0x10 [ 633.525253][ C1] do_group_exit+0x21c/0x2d0 [ 633.525273][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 633.525289][ C1] get_signal+0x1286/0x1340 [ 633.525311][ C1] arch_do_signal_or_restart+0x9a/0x750 [ 633.525327][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 633.525341][ C1] ? __sys_recvmmsg+0x19d/0x280 [ 633.525366][ C1] ? exit_to_user_mode_loop+0x40/0x110 [ 633.525389][ C1] exit_to_user_mode_loop+0x75/0x110 [ 633.525411][ C1] __do_fast_syscall_32+0x1f4/0x2b0 [ 633.525432][ C1] do_fast_syscall_32+0x34/0x80 [ 633.525450][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 633.525468][ C1] RIP: 0023:0xf703e539 [ 633.525480][ C1] Code: Unable to access opcode bytes at 0xf703e50f. [ 633.525488][ C1] RSP: 002b:00000000f540d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 633.525503][ C1] RAX: 0000000000010106 RBX: 0000000000000004 RCX: 00000000800000c0 [ 633.525514][ C1] RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000 [ 633.525523][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 633.525532][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 633.525541][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 633.525556][ C1] [ 633.525561][ C1] [ 634.028593][ C1] Allocated by task 5853: [ 634.032907][ C1] kasan_save_track+0x3e/0x80 [ 634.037926][ C1] __kasan_kmalloc+0x93/0xb0 [ 634.042510][ C1] __kmalloc_noprof+0x27a/0x4f0 [ 634.047355][ C1] __register_sysctl_table+0x72/0x1340 [ 634.052802][ C1] __addrconf_sysctl_register+0x328/0x4c0 [ 634.058509][ C1] addrconf_sysctl_register+0x168/0x1c0 [ 634.064074][ C1] addrconf_notify+0x82b/0x1010 [ 634.068907][ C1] notifier_call_chain+0x1b6/0x3e0 [ 634.074006][ C1] netif_change_name+0x5e9/0x960 [ 634.078932][ C1] do_setlink+0x9f6/0x41c0 [ 634.083337][ C1] rtnl_newlink+0x160b/0x1c70 [ 634.088001][ C1] rtnetlink_rcv_msg+0x7cc/0xb70 [ 634.092930][ C1] netlink_rcv_skb+0x208/0x470 [ 634.097680][ C1] netlink_unicast+0x82c/0x9e0 [ 634.102432][ C1] netlink_sendmsg+0x805/0xb30 [ 634.107179][ C1] __sock_sendmsg+0x21c/0x270 [ 634.111839][ C1] __sys_sendto+0x3bd/0x520 [ 634.116327][ C1] __ia32_compat_sys_socketcall+0x71c/0x9c0 [ 634.122295][ C1] __do_fast_syscall_32+0xb6/0x2b0 [ 634.127402][ C1] do_fast_syscall_32+0x34/0x80 [ 634.132244][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 634.138560][ C1] [ 634.140867][ C1] The buggy address belongs to the object at ffff88805789e000 [ 634.140867][ C1] which belongs to the cache kmalloc-cg-4k of size 4096 [ 634.155168][ C1] The buggy address is located 6087 bytes to the right of [ 634.155168][ C1] allocated 2104-byte region [ffff88805789e000, ffff88805789e838) [ 634.169998][ C1] [ 634.172311][ C1] The buggy address belongs to the physical page: [ 634.178723][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57898 [ 634.187469][ C1] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 634.195949][ C1] memcg:ffff88801ba87641 [ 634.200171][ C1] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 634.207700][ C1] page_type: f5(slab) [ 634.211668][ C1] raw: 00fff00000000040 ffff88801a04b500 ffffea0000995200 dead000000000002 [ 634.220237][ C1] raw: 0000000000000000 0000000000040004 00000000f5000000 ffff88801ba87641 [ 634.228805][ C1] head: 00fff00000000040 ffff88801a04b500 ffffea0000995200 dead000000000002 [ 634.237465][ C1] head: 0000000000000000 0000000000040004 00000000f5000000 ffff88801ba87641 [ 634.246120][ C1] head: 00fff00000000003 ffffea00015e2601 00000000ffffffff 00000000ffffffff [ 634.254774][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 634.263425][ C1] page dumped because: kasan: bad access detected [ 634.269832][ C1] page_owner tracks the page as allocated [ 634.275532][ C1] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5889, tgid 5889 (udevd), ts 74829009768, free_ts 20801330907 [ 634.296271][ C1] post_alloc_hook+0x240/0x2a0 [ 634.301044][ C1] get_page_from_freelist+0x21e4/0x22c0 [ 634.306583][ C1] __alloc_frozen_pages_noprof+0x181/0x370 [ 634.312375][ C1] alloc_pages_mpol+0x232/0x4a0 [ 634.317216][ C1] allocate_slab+0x8a/0x370 [ 634.321705][ C1] ___slab_alloc+0xbeb/0x1420 [ 634.326367][ C1] __kvmalloc_node_noprof+0x429/0x5f0 [ 634.331731][ C1] seq_read_iter+0x1fd/0xe10 [ 634.336306][ C1] vfs_read+0x55a/0xa30 [ 634.340446][ C1] ksys_read+0x145/0x250 [ 634.344677][ C1] do_syscall_64+0xfa/0x3b0 [ 634.349171][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 634.355051][ C1] page last free pid 1 tgid 1 stack trace: [ 634.360832][ C1] __free_frozen_pages+0xbc4/0xd30 [ 634.365927][ C1] free_contig_range+0x1bd/0x4a0 [ 634.370856][ C1] destroy_args+0x69/0x660 [ 634.375261][ C1] debug_vm_pgtable+0x39f/0x3b0 [ 634.380104][ C1] do_one_initcall+0x233/0x820 [ 634.384862][ C1] do_initcall_level+0x104/0x190 [ 634.389875][ C1] do_initcalls+0x59/0xa0 [ 634.394222][ C1] kernel_init_freeable+0x334/0x4b0 [ 634.399405][ C1] kernel_init+0x1d/0x1d0 [ 634.403735][ C1] ret_from_fork+0x439/0x7d0 [ 634.408314][ C1] ret_from_fork_asm+0x1a/0x30 [ 634.413073][ C1] [ 634.415380][ C1] Memory state around the buggy address: [ 634.420991][ C1] ffff88805789fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 634.429049][ C1] ffff88805789ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 634.437109][ C1] >ffff88805789ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 634.445170][ C1] ^ [ 634.453147][ C1] ffff8880578a0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 634.461203][ C1] ffff8880578a0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 634.469252][ C1] ================================================================== [ 634.477315][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 634.484504][ C1] CPU: 1 UID: 0 PID: 14548 Comm: syz.1.2499 Not tainted syzkaller #0 PREEMPT(full) [ 634.493875][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 634.504019][ C1] Call Trace: [ 634.507295][ C1] [ 634.510131][ C1] dump_stack_lvl+0x99/0x250 [ 634.514716][ C1] ? __asan_memcpy+0x40/0x70 [ 634.519300][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 634.524492][ C1] ? __pfx__printk+0x10/0x10 [ 634.529104][ C1] vpanic+0x281/0x750 [ 634.533099][ C1] ? __pfx_print_hex_dump+0x10/0x10 [ 634.538287][ C1] ? __pfx_vpanic+0x10/0x10 [ 634.542783][ C1] panic+0xb9/0xc0 [ 634.546494][ C1] ? __pfx_panic+0x10/0x10 [ 634.550904][ C1] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 634.556796][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 634.562075][ C1] check_panic_on_warn+0x89/0xb0 [ 634.567007][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 634.572286][ C1] end_report+0x78/0x160 [ 634.576535][ C1] kasan_report+0x129/0x150 [ 634.581468][ C1] ? mcp2221_raw_event+0x106a/0x1240 [ 634.586847][ C1] mcp2221_raw_event+0x106a/0x1240 [ 634.591960][ C1] ? down_trylock+0x50/0xb0 [ 634.596457][ C1] hid_input_report+0x407/0x520 [ 634.601300][ C1] ? __pfx_mcp2221_raw_event+0x10/0x10 [ 634.606756][ C1] hid_irq_in+0x47e/0x6d0 [ 634.611080][ C1] __usb_hcd_giveback_urb+0x373/0x540 [ 634.616443][ C1] dummy_timer+0x862/0x4550 [ 634.620951][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 634.625875][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 634.630798][ C1] ? __pfx_dummy_timer+0x10/0x10 [ 634.635720][ C1] __hrtimer_run_queues+0x52c/0xc60 [ 634.640915][ C1] ? __pfx___hrtimer_run_queues+0x10/0x10 [ 634.646627][ C1] ? read_tsc+0x9/0x20 [ 634.650684][ C1] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 634.656486][ C1] hrtimer_run_softirq+0x187/0x2b0 [ 634.661590][ C1] handle_softirqs+0x286/0x870 [ 634.666344][ C1] ? __irq_exit_rcu+0xca/0x1f0 [ 634.671097][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 634.676374][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 634.681652][ C1] __irq_exit_rcu+0xca/0x1f0 [ 634.686230][ C1] ? __pfx___irq_exit_rcu+0x10/0x10 [ 634.691416][ C1] irq_exit_rcu+0x9/0x30 [ 634.695644][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 634.701267][ C1] [ 634.704182][ C1] [ 634.707099][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 634.713066][ C1] RIP: 0010:kasan_check_range+0x9f/0x2c0 [ 634.718697][ C1] Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 41 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 de 01 00 00 49 ff c3 48 ff c3 75 ee e9 21 01 00 00 44 89 dd [ 634.738900][ C1] RSP: 0018:ffffc900037b7318 EFLAGS: 00000246 [ 634.744958][ C1] RAX: 1ffffffff32b8d01 RBX: ffffffffffffffff RCX: ffffffff822cc52b [ 634.752925][ C1] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88801d135558 [ 634.760883][ C1] RBP: ffff88801d135510 R08: ffff88801d13555b R09: 1ffff11003a26aab [ 634.768866][ C1] R10: dffffc0000000000 R11: ffffed1003a26aab R12: 0000000000000001 [ 634.776823][ C1] R13: 0000000000000001 R14: ffffed1003a26aac R15: 1ffff11003a26aab [ 634.784788][ C1] ? page_table_check_clear+0x2bb/0x700 [ 634.790332][ C1] ? page_ext_lookup+0x127/0x180 [ 634.795348][ C1] ? page_table_check_clear+0x187/0x700 [ 634.800887][ C1] page_table_check_clear+0x2bb/0x700 [ 634.806254][ C1] ? page_table_check_clear+0x187/0x700 [ 634.811797][ C1] unmap_page_range+0x3445/0x4370 [ 634.816826][ C1] ? __pfx_unmap_page_range+0x10/0x10 [ 634.822189][ C1] ? mas_find+0xb0e/0xd30 [ 634.826508][ C1] ? unmap_vmas+0x144/0x580 [ 634.830996][ C1] unmap_vmas+0x399/0x580 [ 634.835315][ C1] ? __pfx_unmap_vmas+0x10/0x10 [ 634.840159][ C1] exit_mmap+0x248/0xb50 [ 634.844395][ C1] ? uprobe_clear_state+0x20f/0x290 [ 634.849596][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 634.854350][ C1] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 634.859974][ C1] ? __pfx_exit_aio+0x10/0x10 [ 634.864643][ C1] ? uprobe_clear_state+0x274/0x290 [ 634.869831][ C1] __mmput+0x118/0x430 [ 634.873888][ C1] exit_mm+0x1da/0x2c0 [ 634.877954][ C1] ? __pfx_exit_mm+0x10/0x10 [ 634.882540][ C1] ? rcu_is_watching+0x15/0xb0 [ 634.887291][ C1] do_exit+0x648/0x2300 [ 634.891443][ C1] ? do_raw_spin_lock+0x121/0x290 [ 634.896460][ C1] ? __pfx_do_exit+0x10/0x10 [ 634.901045][ C1] do_group_exit+0x21c/0x2d0 [ 634.905627][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 634.910815][ C1] get_signal+0x1286/0x1340 [ 634.915312][ C1] arch_do_signal_or_restart+0x9a/0x750 [ 634.920846][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 634.926988][ C1] ? __sys_recvmmsg+0x19d/0x280 [ 634.931835][ C1] ? exit_to_user_mode_loop+0x40/0x110 [ 634.937287][ C1] exit_to_user_mode_loop+0x75/0x110 [ 634.942579][ C1] __do_fast_syscall_32+0x1f4/0x2b0 [ 634.947770][ C1] do_fast_syscall_32+0x34/0x80 [ 634.952611][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 634.958930][ C1] RIP: 0023:0xf703e539 [ 634.962985][ C1] Code: Unable to access opcode bytes at 0xf703e50f. [ 634.969645][ C1] RSP: 002b:00000000f540d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 634.978047][ C1] RAX: 0000000000010106 RBX: 0000000000000004 RCX: 00000000800000c0 [ 634.986007][ C1] RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000 [ 634.993963][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 635.002006][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 635.010315][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 635.018276][ C1] [ 635.021560][ C1] Kernel Offset: disabled [ 635.025866][ C1] Rebooting in 86400 seconds..