last executing test programs: 14.265057999s ago: executing program 1 (id=9431): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040c21504220000000000010902240001000000000904000002030400000921000000012205"], 0x0) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000024d40)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002400128009000100626f6e640000000014000280050001000600000008000b00", @ANYRES32=r1], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGBITSND(r6, 0x80404532, &(0x7f00000006c0)=""/120) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newlink={0x28, 0x10, 0x401, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40018}, [@IFLA_MASTER={0x8, 0xa, r8}]}, 0x28}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000010000000500000008"], 0x50) ioctl$XFS_IOC_OPEN_BY_HANDLE(r10, 0xc038586b, 0x0) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, r10}, 0x38) r11 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r11, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r11, &(0x7f0000005280)=[{{0x0, 0x0, 0x0}, 0x10009}], 0x1, 0x10000, 0x0) sendmmsg$inet6(r11, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="000000f5b8ac2bb992ebd4c7b3ba4f60bfed00", 0x13}, {0x0}, {&(0x7f0000000100)="127d589163267e4b0e", 0x9}], 0x3}}], 0x1, 0x20e8086) sendmmsg(r11, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), r9) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f00000007c0)={0x3f4, r12, 0x8, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x261}]}, @TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xb}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xc}]}]}, @TIPC_NLA_MEDIA={0xf4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x22}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8fce}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1af7}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_NODE={0x7c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xc}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "fda44a7214dfcc1f54dcf5465e99930468f73834a4653d3b04039c"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_LINK={0xb0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x84}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf99}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}]}, @TIPC_NLA_MEDIA={0x90, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}]}, @TIPC_NLA_NET={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2d1}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xe6}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8001}]}, @TIPC_NLA_BEARER={0x8c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7a3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffcd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ac000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}]}]}, 0x3f4}, 0x1, 0x0, 0x0, 0x400c000}, 0x880) r13 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1020, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r13, 0x0, 0x0) syz_usb_control_io$hid(r13, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) 11.61566681s ago: executing program 2 (id=9442): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'macvtap0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@ipv6_deladdrlabel={0x38, 0x49, 0x1, 0x70bd22, 0x25dfdbfd, {0xa, 0x0, 0x80, 0x0, r4}, [@IFAL_LABEL={0x8, 0x2, 0x7}, @IFAL_ADDRESS={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0xff, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040865}, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x8864000000000000) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r6 = socket$netlink(0x10, 0x3, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 11.101573846s ago: executing program 1 (id=9445): r0 = syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e0001010080fa0904000002ff00000007058302000200070504020002"], 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r1, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e", 0x45, 0x0, &(0x7f0000000540)={0xc9, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r3 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82, 0x0, 0x0}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x1f36, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000040)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x23456}) io_uring_enter(r3, 0x1, 0x1, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) r9 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r8, 0x84, 0x17, &(0x7f0000000080)={r10, 0x2, 0x1, "fa"}, 0x9) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000500)={0x9, 0x8, 0x9, 0x5, r10}, &(0x7f0000002c80)=0x10) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_connect$midi(0x0, 0xb9, &(0x7f00000001c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa7, 0x1, 0x1, 0x7, 0x20, 0x7, "", {{{0x9, 0x4, 0x0, 0x0, 0x7, 0x1, 0x3, 0x20, 0x40, [@midi_in_jack={0x6, 0x24, 0x2, 0x2, 0xe, 0xb0}], [{{0x9, 0x5, 0x4, 0x8, 0x20, 0x78, 0x7d, 0x9, {0x4}}}, {{0x9, 0x5, 0xb, 0x0, 0x400, 0x4, 0x4, 0x5, {0x8, 0x25, 0x1, 0x4, "6da27694"}}}, {{0x9, 0x5, 0xe, 0x0, 0x40, 0x0, 0x65, 0x2, {0x13, 0x25, 0x1, 0xf, "cb4f745461262bf24928fceb8c5070"}}}, {{0x9, 0x5, 0x6, 0x0, 0x3ff, 0x2, 0x7, 0x4, {0x13, 0x25, 0x1, 0xf, "5a288009eb2152a23304fc492c34d7"}}}, {{0x9, 0x5, 0x5eb594239065aca3, 0x2, 0x10, 0x7, 0x2f, 0xc, {0x11, 0x25, 0x1, 0xd, "7d7c49454f24e171d6fd3a30c3"}}}, {{0x9, 0x5, 0x6, 0x17e499494abeaf7e, 0x28, 0x1, 0x1, 0x2, {0x8, 0x25, 0x1, 0x4, "1c25bb7a"}}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0x9, 0x0, 0x2, {0x5, 0x25, 0x1, 0x1, "03"}}}]}}}}}]}}, &(0x7f0000000780)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x250, 0x0, 0x6, 0x40, 0x40, 0x25}, 0x1f, &(0x7f0000000300)={0x5, 0xf, 0x1f, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x83, "73bfd5c6c038da878698223d9a31fcc9"}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x7, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x410}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x3009}}, {0xcd, &(0x7f00000003c0)=@string={0xcd, 0x3, "b349b17701486a74785eadb132afdc2687f9f1773b89ca4022cff42998e97af460dd50518d97770971f0d4cd058d5d9f610cfa6cd246a889fe1a4140274c8cac851aa7f003ac7b56b2becc3d4751aa9e9b5ad6d5ef82b42ee8340854db8e76cc4de6b228ad5a8a6ad25052619ca9422f9a76064bbbc1b624b68cec389ba19877a40740dd46977cb227bf2c494bab9d58ec27da809c5c53b302040e3a93028020a8a6c8bbee6e08439bf6f4072047982ef745a7e041ac88927c94f5228a8800d44c81f912f7c9fe984cdd40"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x446}}, {0xd2, &(0x7f00000005c0)=@string={0xd2, 0x3, "92f18d51ce312d02aa716e008a30a6c02ba35ea69037a761a5c2a8a064ab0e9130006984bd9a87e2fa7d370da76dd7ee7b76d311df65644c8cec9e242d147240bd06e3ab1fc672bfde54c2ba2de75af661b8e921ba12aa62cc0f7dd57172c16b0707973480c014debc7c4f53021a7e2715e5ff9e2cdf5dd24326bbfac60f437d050b78caca061ff369399ad29b87e72746c5769bf93fcb5d36e7a72d848a260f8a9a73eed2013803c2afb37a8ac3f70f37dd135958bb883664cf78b49a6d6a0742e11200ca24d6531e9acd7599994fd6"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x458}}, {0x78, &(0x7f0000000700)=@string={0x78, 0x3, "7fc966f7caa92dc46c42735f89dbed180dc668df8e745c13107fd5da31c571b5a8eff2f026f0e6c41dd58c05c0035361868e9662f090c3586b62a9aa7d78312a58a23ba756623aaab1f189e9b20856e394fe62dc43765baa13e1e4859b31b7aed4e31f93702caaa03d7d88ba6b0104bd50d25941f1df"}}]}) 10.479540423s ago: executing program 2 (id=9450): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x807d, 0x1, 0x8}, &(0x7f00000000c0)=0x10) mmap(&(0x7f0000261000/0xc00000)=nil, 0xc00000, 0x3000003, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYRESOCT=r1], 0x20}, 0x1, 0x0, 0x0, 0x42014}, 0x20089890) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x48100) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000040)={0x1, 0x7ff, 0x0, 'queue1\x00'}) r4 = syz_open_procfs(0x0, &(0x7f0000000300)='clear_refs\x00') ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000340)=0x8000000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r3, 0xc08c5335, &(0x7f0000000780)={0x0, 0x80, 0x1, 'queue0\x00', 0x101}) timer_create(0x3, &(0x7f0000533fa0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) setrlimit(0xf, &(0x7f00000000c0)={0x0, 0x3}) mlock(&(0x7f0000bff000/0x400000)=nil, 0x400000) r5 = fsopen(&(0x7f0000000440)='mqueue\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r7 = open_tree(r6, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f00000020c0), 0x208002, &(0x7f0000000380)=ANY=[@ANYBLOB='fD=', @ANYRESHEX=r8, @ANYBLOB="2c726f6f746d6f64653d303030303030303030303030303030000031300100000000000000725f69643d", @ANYRESDEC=0x0, @ANYBLOB="1b67726f75705f69643d", @ANYRESDEC=0x0, @ANYBLOB="f9b40000000000000b6d00000000f4000006"]) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x7, @loopback, 0x9}]}, &(0x7f00000002c0)=0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000001c0)={0x8, &(0x7f0000000140)=[{0x8, 0x2, 0x9, 0x1}, {0x284, 0x7f, 0x7f, 0x400}, {0x9, 0xa, 0x8, 0x4}, {0x400, 0x1, 0x5, 0x7}, {0x3, 0x95, 0x2b, 0x8}, {0x5, 0x6, 0xff, 0x100}, {0x7, 0x33, 0x9, 0xfffffbff}, {0x100, 0xf5, 0xf3, 0x5}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000200)) 9.571738532s ago: executing program 2 (id=9454): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f00000002c0)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='illinois', 0x8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0xa00) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 9.514726487s ago: executing program 2 (id=9455): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000018406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="b801ddff180001000000000011000000e0000001000000000000000000000000fe8000000000000000000000000000bb4e22000b000300000a00208000000000477d7b", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000006000000000000008000000000000000000000000000000000000004000000000000000004010500fc000000000000000000000000000000000000003c0000000a000000ac1414bb000000000000000000000000ff3400000001000000000000040000806e000000ac1414aa000000000000000000000000000000003c0000000000000000000000000000000000000000000001f9ffffff0203000007000000030800000200100000000000000000000000000000000001000000003c000000000000000000000000000000000000000000000002000000010500000800000000000000000000007f000001000000000000000000000000000004d63300000002000000fc020000000000000000000000000001033500000000040000000000bb0a00003f0a0000"], 0x1b8}}, 0x8044) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r5 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$apparmor_exec(r5, &(0x7f00000004c0)=ANY=[@ANYRESHEX=r1], 0x1e0) lsm_get_self_attr(0x65, 0x0, &(0x7f00000002c0)=0x3000, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_io_uring_setup(0x47ec, &(0x7f0000000400)={0x0, 0x9ac7, 0x800, 0x0, 0x366}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f00000001c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x2, 0x6000, @fd_index=0x3, 0x1, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r7, 0x1, 0xfffffffd, 0x6f, 0x0, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000688600007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7020000721f00008500000086000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r11, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r12 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r14 = socket$inet(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r14, 0x1, 0x19, &(0x7f0000000140)='batadv0\x00', 0x10) sendmsg$nl_route(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x403, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90446}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r13}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) sendmsg$nl_route(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x58, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}, @IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 8.636569946s ago: executing program 1 (id=9457): r0 = socket$netlink(0x10, 0x3, 0x4) syz_usb_connect$cdc_ncm(0x4, 0x9f, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8d, 0x2, 0x1, 0x6, 0xc0, 0x82, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x6, 0x24, 0x6, 0x0, 0x1, "c8"}, {0x5, 0x24, 0x0, 0x97}, {0xd, 0x24, 0xf, 0x1, 0x9, 0xfe01, 0x52, 0x8}, {0x6, 0x24, 0x1a, 0x95, 0x4}, [@obex={0x5, 0x24, 0x15, 0xffff}, @country_functional={0xa, 0x24, 0x7, 0x9, 0x5, [0xc0, 0x9]}, @dmm={0x7, 0x24, 0x14, 0x100, 0x2000}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0xf4}, @mdlm={0x15, 0x24, 0x12, 0xff}]}, {{0x9, 0x5, 0x81, 0x3, 0x0, 0x9, 0x26, 0x3}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x400, 0x5, 0x5, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x2, 0x3, 0x2}}}}}}}]}}, &(0x7f00000001c0)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x201, 0x2, 0x4, 0x6f, 0x28, 0x7}, 0x5, &(0x7f0000000100)={0x5, 0xf, 0x5}, 0x2, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x425}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x1409}}]}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r0, 0xffffffffffffffff}, &(0x7f0000000200), &(0x7f0000000240)=r0}, 0x1c) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f00000002c0)={0xe868, 0x0, r0}) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f0000000300)={0x0, 0xdb4b, 0x1ff, 0x1}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000700)={0x0, 0x0, 0x2b, 0x1}) ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000b00)={0x0, 0x3, 0xa, 0x1}) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f0000000f00)={0xc, 0x2, {0x100000001, @struct={0x255, 0x340}, r3, 0x7, 0xffffffffffffffc0, 0x6, 0x81, 0xf455, 0x400, @usage=0x6, 0x10000, 0x6, [0x7fffffffffffffff, 0x401, 0x8, 0x3, 0x1, 0x7fff]}, {0xde73, @struct={0x5, 0x7f}, r4, 0x1, 0xee, 0x6, 0x8, 0x10001, 0x4, @struct={0x5, 0x2}, 0x5, 0x81, [0xb, 0x2, 0xb, 0x8, 0xfffffffffffffffe, 0x3]}, {0x7fffffffffffffff, @usage=0x400, r5, 0x2, 0x8, 0x23d, 0x6, 0x8, 0x8, @struct={0x5, 0x2}, 0x9, 0x1, [0x2, 0x8, 0x4, 0x59d57e1b, 0x7, 0x3]}, {0x1, 0x7, 0x6}}) syz_usb_connect$printer(0x2, 0x2d, &(0x7f0000001300)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x1, 0x60, 0x5, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x7, 0x1, 0x3, 0x3, "", {{{0x9, 0x5, 0x1, 0x2, 0x210, 0x7, 0x5, 0x5}}}}}]}}]}}, &(0x7f00000013c0)={0xa, &(0x7f0000001340)={0xa, 0x6, 0x250, 0xc0, 0xa, 0x7, 0x10, 0x4}, 0x5, &(0x7f0000001380)={0x5, 0xf, 0x5}}) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000001840)={0x8, 0x0, [{0x4, 0x60, &(0x7f0000001400)=""/96}, {0xa000, 0x90, &(0x7f0000001480)=""/144}, {0x10000, 0x14, &(0x7f0000001540)=""/20}, {0xdddd0000, 0x5c, &(0x7f0000001580)=""/92}, {0x7000, 0x87, &(0x7f0000001600)=""/135}, {0xfec00000, 0x96, &(0x7f00000016c0)=""/150}, {0x10000, 0x23, &(0x7f0000001780)=""/35}, {0xeeee0000, 0x56, &(0x7f00000017c0)=""/86}]}) syz_usb_connect$uac2(0x4, 0xf8, &(0x7f0000001980)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0xe41, 0x4247, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe6, 0x3, 0x1, 0x4a, 0x40, 0xa, {0x8, 0xb, 0x1, 0x2, 0x1, 0x3, 0x20, 0xc}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0xfff9, 0xc, 0x19, 0x9}, [@input_terminal={0x10, 0x24, 0x2, 0x5, 0x206, 0x2, 0x3, 0x8, 0x9, 0xfd, 0x0, 0x7}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0xf4}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0xe, 0x10, 0xfd, "3d408b3f46"}, @as_header={0x10, 0x24, 0x1, 0x4, 0xf3, 0x0, 0x0, 0xa9, 0xe7f, 0x5}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x3, 0x3}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x2, 0x8, 0x7f, "b44a0a9c1ad18c"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x4}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x1, 0x1, 0xe, {0x8, 0x25, 0x1, 0x80, 0x60, 0x3, 0x8000}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@as_header={0x10, 0x24, 0x1, 0x7f, 0x7, 0x3, 0x4, 0x81, 0x1, 0x7}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xd, 0xf, 0x0, 0xcd, 0x81}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x4, 0xbd, 0x4, 0x5}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x0, 0x1, 0x6d, 0xd}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0xa, 0x8, 0x92, {0x8, 0x25, 0x1, 0x80, 0xc, 0x10, 0x6}}}}}}}}]}}, &(0x7f0000001d40)={0xa, &(0x7f0000001a80)={0xa, 0x6, 0x250, 0xd1, 0x8, 0x7, 0xff, 0x2}, 0xb, &(0x7f0000001ac0)={0x5, 0xf, 0xb, 0x2, [@ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x7, [{0x4, &(0x7f0000001b00)=@lang_id={0x4, 0x3, 0x280a}}, {0x4, &(0x7f0000001b40)=@lang_id={0x4}}, {0x4, &(0x7f0000001b80)=@lang_id={0x4, 0x3, 0x2001}}, {0xa6, &(0x7f0000001bc0)=@string={0xa6, 0x3, "78b9ebe0cb03f1f89aa0036307a5b588ee328d6d9fa4a5779b63e4275d68b4a95275d8ef93974f8e665734f366eb6a296b08dba114c5037552f3672f55a292fb7b5151f0aa9245c3a60a7014e007e559fdbc9cf5e30dc6b374d47e71d3c71044b38a4e0ed002ac4d2557079246a1cfcd27a33e10e09dffcffa6da3ebbebed3393989461de846fcb141e1da0931af0c387e264664435180a3ac95f43906af9d349b7ee80e"}}, {0x2c, &(0x7f0000001c80)=@string={0x2c, 0x3, "debf5898c5491073d66ad1fd044c22cb4d81cb2ae2ec84bd56dff886bb928995a2876a6dce3710c1c403"}}, {0x4, &(0x7f0000001cc0)=@lang_id={0x4, 0x3, 0x41c}}, {0x4, &(0x7f0000001d00)=@lang_id={0x4, 0x3, 0x140c}}]}) r6 = fsmount(r2, 0x0, 0x1) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000001dc0)={0x0, 0x16, "cbaeee33dc5d5a40d0268dfb7caa5d9d7f750a652432"}, &(0x7f0000001e00)=0x1e) getsockopt$inet_sctp6_SCTP_RTOINFO(r7, 0x84, 0x0, &(0x7f0000001e40)={r8, 0x0, 0xc, 0x1}, &(0x7f0000001e80)=0x10) ioctl$MEDIA_IOC_ENUM_LINKS(r6, 0xc01c7c02, &(0x7f0000001f80)={0x80000000, &(0x7f0000001ec0), &(0x7f0000001f00)}) syz_usb_connect$uac1(0x4, 0xd2, &(0x7f0000001fc0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc0, 0x3, 0x1, 0x5, 0xc0, 0x0, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xfff, 0x1d}, [@input_terminal={0xc, 0x24, 0x2, 0x4, 0x402, 0x1, 0x4, 0x7fff, 0x10, 0x9}, @extension_unit={0x7, 0x24, 0x8, 0x4, 0x100}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x4, 0x1, 0x4, "8cd0ba12"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xd, 0xb7, 0x5, 0xb, 0x8}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x4, 0x3, 0x2, {0x7, 0x25, 0x1, 0xc, 0x8, 0x7fff}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x0, 0x944, 0x8, "6db38581cd88"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x4, 0x1, 0xfd, 0x7, "c4", "e021"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x8, 0x0, 0x3, 0x80}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x2, 0x1, 0x5, 0x8}, @format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0xf6, 0x3, 0x9, 0x4e, "a5"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x2, 0xc3, 0x5, {0x7, 0x25, 0x1, 0x4, 0x2, 0xae}}}}}}}}]}}, &(0x7f0000002300)={0xa, &(0x7f00000020c0)={0xa, 0x6, 0x0, 0x6, 0x4, 0x72, 0x20, 0x36}, 0x30, &(0x7f0000002100)={0x5, 0xf, 0x30, 0x2, [@ssp_cap={0x24, 0x10, 0xa, 0x0, 0x6, 0xb8, 0xff00, 0x400, [0x0, 0xff00, 0x30, 0xffc00f, 0x0, 0x3f]}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x5, 0x3, 0xfffd}]}, 0x4, [{0x5f, &(0x7f0000002140)=@string={0x5f, 0x3, "03afcd9b3236b98e3422f1cbf74bea5a5c3d57ce0255bfaf5095bf1ad26ff57906562bcda14cd6c767811cb3141c1239b575be1730c2145f9bf723525a7d9e843efea3095e8566134e046b4ab196349854bb7b47e33e84d9d598ae28a3"}}, {0x4, &(0x7f00000021c0)=@lang_id={0x4, 0x3, 0x41c}}, {0x4, &(0x7f0000002200)=@lang_id={0x4, 0x3, 0x405}}, {0x9d, &(0x7f0000002240)=@string={0x9d, 0x3, "72131309737fdf253d15f19c4c6b458f4a5e2a25512cc684580a2f7f39301ae96775787d21e2bb2b3fd36d37a4dc61e9e5063333722f84e0d58b1e6a7a422f32fb56710cd4efe6ef86bace46db6cd9c6b658eab8589a804487f892cd0accedeba7683b1d021784a3b6aad1fbf434af5effa06be02509ce25ca4627422daaec6a15eaa3fde725a241f2eeddbc6cb293c67be6a1f0f137aec2930eb5"}}]}) r9 = syz_mount_image$fuse(&(0x7f0000002340), &(0x7f0000002380)='./file0\x00', 0x800000, &(0x7f00000023c0)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, 0xee00}, 0x2c, {[{@allow_other}], [{@fsuuid={'fsuuid', 0x3d, {[0x65, 0x34, 0x30, 0x64, 0x63, 0x31, 0x34, 0x36], 0x2d, [0x65, 0xbfa6a8cc962d21be, 0x39, 0x33], 0x2d, [0x38, 0x63, 0x33, 0x32], 0x2d, [0x62, 0x31, 0x63, 0x66], 0x2d, [0x3f, 0x63, 0x30, 0x37, 0x32, 0x62, 0x63, 0x63]}}}]}}, 0x0, 0x0, &(0x7f0000002480)="58952eed222dd77eec292aab9aa0824f4fd69fbc4b00e9e5c3985b91310708dc874631fb923b7fb6355a579f7db6e3e3400c76eedaea938bb16eca2f97d8f1664ebdbbc52a41c402") r10 = openat(r9, &(0x7f0000002500)='\x00', 0xc000, 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000002800)={r6, 0xe0, &(0x7f0000002700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000002540)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, &(0x7f0000002580)=[0x0], &(0x7f00000025c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x26, &(0x7f0000002600)=[{}], 0x8, 0x10, &(0x7f0000002640), &(0x7f0000002680), 0x8, 0x67, 0x8, 0x8, &(0x7f00000026c0)}}, 0x10) clock_gettime(0x0, &(0x7f0000002880)={0x0, 0x0}) sendmsg$can_bcm(r10, &(0x7f0000002940)={&(0x7f0000002840)={0x1d, r11}, 0x10, &(0x7f0000002900)={&(0x7f00000028c0)={0x4, 0x0, 0x33e7, {}, {r12, r13/1000+10000}, {0x2, 0x1, 0x1}, 0x1, @can={{0x1, 0x0, 0x1, 0x1}, 0x3, 0x2, 0x0, 0x0, "045156236c7f3ec3"}}, 0x34}, 0x1, 0x0, 0x0, 0x8002}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000002b40)={r10, 0x58, &(0x7f0000002ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000002a80)={@ifindex=r14, 0x7, 0x0, 0x1ff, &(0x7f0000002980)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f00000029c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000002a00)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000002a40)}, 0x40) open_by_handle_at(r1, &(0x7f0000002b80)=@reiserfs_3={0xc, 0x3, {0x10000, 0x7, 0xfe}}, 0x2000) fcntl$addseals(r2, 0x409, 0x2) ioctl$KVM_X86_SET_MSR_FILTER(r2, 0x4104aec6, &(0x7f0000004500)={0x1, [{0x0, 0x0, 0x6, &(0x7f0000002bc0)}, {0x0, 0x7d0, 0x1, &(0x7f0000002c00)="9a237e32b4164a393edb826263780c0297822f5b51853e8cc7c14153700a739391758b1e2843e421e65000fefcd093e2b15922740a81deb363fe370f5519fe310b91dc9de5f0b99434b2f115b4b10d897e1a839e42372b9395c457546fc024a8acd23b34d0ca9ca348921d9103c5ac85bbf968d9ff9ed86741ab245bbd6c83535d82481dbc6fecec21b29fa9a1abad3b5383278752d8c53004b1a48ff3b0e80cf6381b6743d82a81e2e720829ad32bada8e0f4369b60a0d27b3de02346935cf48947e0ffc31ce23768b034b915940a23bd2aeafebfa8451b274bc9eec5e1522f4d28d6fca730803c41784b713f5279f3e48e78733adb2a7cbf73"}, {0xa108b953db82f812, 0x288, 0x1000, &(0x7f0000002d00)="9093cc83617b8fc75fb5b26fec49d425ff8244a9ad5d1013aa42e1f5d2b25ca942225334c351dc3c193376496ee9cd6966797513b7cf1c15027ccb3bb16c7bd2574c3e2b448e06aa953ee84ca2a5e24a7d"}, {0x2, 0x288, 0x298, &(0x7f0000002d80)="9b16f5296cd98f901adb71e72a24ea5a4c3baa92705019fee8139efa297bea4ff1e451ce1572b4d587a5b4a6b59cfa320c1b6d6378dbb9c60f7d50278c26a292ff486cafbd6138109945b2de0ce6b6f194"}, {0x0, 0x748, 0x7, &(0x7f0000002e00)="6861d5abcf3cf75b4f4ee7d8e319fb4b16b993064aed2c5e73f61ef8525f5d224fec460384cc141b9ef7878102eb8d696ac441657a0bca920b17c066b329eb89ee595dd7fc0fbc6603e7ccea9dac73931609fc764a7598eec0041f64c7cdda87edd18c9a0ea2ee95a7a3c63f4430967904c3752f646fcab87b5e074292326dfdcf4ed04a7438e00e020d6d70db4b160a9740c5cc0facc05123563279a42f62677e56bc2d84bc2df16ebb7aef246b1cc171bd9e3be8185d584999764c23228f678f106d080b409d3ca88f40e3fbaf42351304aa599eb3f01c60232f70e5e01981518ba6558e67be0c82"}, {0x1, 0x218, 0x3ff, &(0x7f0000002f00)="e3d296caa1d931cfc36700ae1311e81cb70cba6a2b409c4468d3297ff26b9fcb0715a2cc34a6e384aaa2c40b33887eb8ab91a86f8ef824a9d0ad9c6ce65df3eb14a5ea"}, {0x0, 0x548, 0x2, &(0x7f0000002f80)="774d9d8a4a7a28df26f45492d926deadb225cda7d5992a8885f8c586ad79d1b535edb7836c84196e91586c75abf3f66ba5e81629bbb0813577c0e5710a2afbc734ab1861392d49f1498897b08891565fdc2f22ccb21e922e569f4eb0537cbbafc866da4e7fcf25310660ee74cd66e15d3c4c20a925d690809a6bfe505c79d4828154540bc4a54260c6ebf3a18ed602a6dcde34aa66cdc4afce2cbb2734d623a7fe73160e653afd82d4"}, {0x2, 0x70, 0xfffffffd, &(0x7f0000003040)="a0bc2d52aa0b9931d095e4bab333"}, {0x2, 0x480, 0x5, &(0x7f0000003080)="f2d0f442f905cd5b8b0dd90344e2ce69dcb1f60b10d044570b7bf52e760cc9b808d3aa02b6b7638e010caec1bb32c208247b46724195358a3aa1d39ceb71225e42db710a0e25df70ccd91199c4c6ceeb89e5a847b1ccb0fe9dc9518caf0bee8604fcfac330b7106d023638f32dea2164aa2100ae3fcee1260a849aafff2e24caf665dc9ea0adfedbcbf8caef27ec17e6"}, {0x1, 0x400, 0x0, &(0x7f0000003140)="65b2eafdca5028f5c87eb16769c2ee973a4d21a7ed0c638f57617935808e76d18333675ae6ae672e028bdde072f41136ab12e3615ae0d5efe2d289545f699e95ce53b726b02f4ba4668782e8d2313023bd631814a5716dd18c49f417e644f4eb8b31a498f0039014c2da619ba6710b5246cea05b5cc24a195b1b6dcb11af06b1"}, {0x2, 0x548, 0x0, &(0x7f00000031c0)="75745491b28c3abdc82950919452fd64e2564a09d94143499b22be8ba8a6db4e9ede1fdadd37a5d2dc6ba519ae679202926d6952e976d7e4861c81fd1d577b7c7f29a5cb70cd24f7cbf5214c9918d635c0b401c038facc8b9e582124f97a5604f0eab96f78c78cac8ef1c572c5c0169f6b58cd643a9a0ea2c04b55e179022e2ca4ae34f510a5e06970383e1f842f329de183d30844771c6e22b77bf1918fc327ca160d820bc4bdbac2"}, {0x2, 0x80, 0x1, &(0x7f0000003280)="2346b03e61a1ae8666ca8d0a9cb99884"}, {0x1, 0x630, 0xe4ebbefe, &(0x7f00000032c0)="c2dd51ee3677ad30e78d1908a63ecde2c5be29a8264a749ec6797aa5c3035a366028c0556b4de50b9dcad03deb11c69bbd2752fc033365a2c7fe9d4bbd0b53ade304c57fe7af195a8244472b90e341fdd9f0b56936cd1e932119e0ab9331e0b56fe9fc7cd06eb388787a232dcde3607b4af80ae610834f2a2b5b82d45c250479b6dd7f5c20fbb0062642566e84062c71f40c961cd898e062f5c895573758859f8b8a3893aca08414a07f30ea98ac6c12d704ec688933289f7165ad2113e29fa82c6b09a694dd"}, {0x0, 0x3d8, 0x6, &(0x7f00000033c0)="1fb559b98ca6b5ae300aa089b28dcdb1e7cc90d017a6208123ec18fcae80532e531fb4034de62f3ff49984e8ace244eafff3c7d65603d77c95c1c9f9fab61e2457876ec5ee7fb31bf474ef55a6fbe4509c091a1a5cab49d85cdcffa3d84a1832b215b4d4ec7bd9f081f7ed1a5c6a0244aa3ace346388602a17b1f1"}, {0x5, 0x4a0, 0x4, &(0x7f0000003440)="7355c0b452500fa7d971daefb93b08567bfa108a57c78e8075656ded4f46a74cb37b3297ed9d9085f8a3bbdee8bd91254e550b4b2f7cc00351fb10ff8399b71f29eafd9cb2716a7777ff3cd3ff3a2a14c42bb839f1cb963e0ded6689f508cf1ec8ee0ff55c67e4095cce6be133d118ded7c0f5c683dfdb5591c0a26b0da3b13c7f13e160f576ba49a346162d75bcb62e7a78ff92"}, {0x1, 0x8000, 0x0, &(0x7f0000003500)="ea01c91a3290a8592a0c1cf4b130ecb175a8afb31aae38dbfb02bfdfb12eb13330f699fa0c18e3aebd914866faec22ea898879d3609b1a9f7a8575aa197bda96c7b98ea2bda23ad192fc7a06044818f63a028b1a2f54145c8c92ffbc8f1ee8763814e95c789b84469fea54947d3e638cdb22d1dfc314738b132f3e2b3a576de770a28594f0d0f528bfa25829a6c8e4d2325ad1ca162cda5dd43f572b147cf81d03dbb205e93f890b98191d7e936c0ac93315b5b6c23a4ac6856789b7c2eb2f9a12e619db6ceb3433882aedb590f71d588e9d7422a4da8c5cb802f8d991aaddae7320777cce0f9aab980eab85ad153cce050237261e9def10c9643b45b3defceb1f084f35bab675f923e78961f8b7a29c4e560b6fae0f4f8a8c3de44293d823a818f1c8650cd33bdf91a932c9803ae03f00e1dd658bdc308ace3eb5357ff69ba33db7dc998864e901ceba7a0f2e0227bddbb2b9816993f93ea90f913bd0fe43cf145e591289f542940fa78673abe4c4e45b89b1f37793f72f90784630942117ada40dd4e6949801ef6503b1351854b3d8e9b54dbf6225347e88eaba0a1bd540090c5e53ae3142d0df4288283747a8f04eddb72d02159118fae587d35887e9e704dabe6c7c4442afaf3473b6d05f0e9eaacdaad3b76bf2e4d7ee6612ab47b5457264d9cdf1e3a82c876cb7859290b1d4c8ab10d3e9e646869ae86b0ee6b0c1da68873ff403bd5dabdd77525a4314d2a7eafb1464b71ac4134364051a5b79d78e639115daea4a03a10f2cf74a88f4cf58378a78e73e1f557681f6bf1eef80aeb5593e9353dbd1870615952859e8c5583e9f060be85ee5e1166bdd0e9f4f11222411bfa4cceb1211ed234bc504436cbcafb977c41273c1c2d03e96cf8738a25d17f5daf484bd0b5a41b5c1d8df411db70ba0361ee13581af377b75dbaecbb0f2eb7b9278580a629df7c77a02f0bf5333cc7b0c98798303469e5c714245b7562f1e2962c713a69e99d7b8e53a1c5197ea76c227ab9d2f91b8cec2de729ef127cdf60f4d523ec488611aa37a4790b8732b8877cc35a4e31dbd0501c7c4e3990f89ced7a35e16bc2970511eb405eaa152ba8a0d7d3cf6b73d07233044010a1c2e436cb9d015f0d1a34ef79b6e52baaa5296301d0106377fc5d760591125d0dc33d27ecb5702f4b54dba010e8fa244cc04bc7dbb5b76b97178c098cf7ad06d0dc6c1445ea85541a3145bdb3a53666f9806b4bf7267ca137afb629c79613008971c9065c7aa3f291e46fca262e7c8990772839c17d6b85a0f9a3be50ff4770e5e38b85b495812b769996bb00535efeadccdd7b0c62d4bf9c19e5bdca0d70c3ec1bd9603e0da65ab037846daae04f7b6f19b1a1379b213ba8b3a96c967312b6ab172ae981bd0fc9232c792a833c690a8b646dba5e0c49a11a0eabddfa38e3451ac8eb43595d620e3d525ee9c488aeffb2a41ffd7ac8fd1602b4d426a36a6875e718b39bf64cbe9b93afaedb658a4fbd1692bcdee3963a4cc5cc38726e50280fd0260970994f6cef81a27f25fcc1197b8618d079a2adc2bebdbfbd454e9799e88f48dde2404fb507977ce239d0f22d41382df6dab40720d0d5b67279f3f3f6ec1e9709417518742b45e7e9c71c871abb8fc6774c7f040917e4974bd7d982106b719b628dcdbab29932b96a0517a384e5fd3b77658615541719c4bb0d68d13d53ffcfff2e96f6afa370cd38b7e2865db50ab7e6c4f7ba4ecd96cc64984707d8c30584fb30fee6e37d1c6e67b4b8a40106d88687e4ecf39b23114e1fe0e1d0e745b58a9315738581ca5733ee1855aa67ef3a4e05a2f412d50a3e61bc34b0d8acfa6525a60293a73a377fec525fb5070c3d8f55c02fce71069194af3c8b095cb42ecf93622dd3b8ca16955bede2aa02d9339702de80fd6c99bb116d82cf32691f431c7ea5cdf3e88f2e7154c4cf208ef6440dbaf18eca241f108b77ef254e2102cf142c54c277c5663deb0aa5ec30d91fa191380a0b21858bfc17a35def683ee4288ebcee6401ff23547cc0376cb0d3b65d2bcd634e43851659b0cec2e6fcc4ba65b2594fcd500b796e485f827ea29f4826d45b0be6451397e74326e6f05e0586d726c3be434fabace0b206868ab6c391693a3dbebcbe6a6c8466b02cb8b3f014e6fa540c3c7a6e1f01ccb7f9204430df95129305af8858352de43cf1a815c67e440b13be33b0aa7d8541b2cf671500540c1426d6ed9dc4e2e2eb1948e8c2c7cdb744ba3f41dcde3a29ce1dc9bfc772573f933d5dc02a1d69e4253129d81b8d57f3fc725637ee6f6ac71d60574747d168d1e73c6c2086e0fe91e3557b78399904dd5cc156e7cb88cfa2c02a4354bf8dee1961d10b3868a2122c0a237d044c68d8ffc79ab8934a8e651dae86c95ab071ba6a315f369101c4ade1142a0575f45acc35a5f9bfb39df88cadc6a2f8a3e91a05f283b93403d480dc4f24cad97662998b66bdddac710ec93eedcf3cfe038768c106ad9e002d4758b391780dde601cc72f0304acbb7c6761039f4dd0c5446c48d6022261c99251de7528d687c562017184cf5501b19c9637fbb5eb2cf4e43e738b78fbe1e8b5edff681441a65b166efdc359910f57d5c48131ff4142de018cd3ce963dcc9f2c4577f15b77ee0ebb90beb81cca3652c145bbe7b11803497f82837c9231f2154a4ab3799938d9a5081ff4cbddf78d3effc7c1286e8e35a5207f45d684231ce12568d22a5441fcb54ca163bcbdacc3fedef122c8a777e8062717259c6ff2a62bb5ffd439767b2145fbb3cfb4c6d8e72d3a7990f32f35d8f93604fa9ec9f0a77889d7ad091815a5d846d4ebe92a1ed87babc93abec759cab70a4f824b1caeb7d8cdf68ac546912d2c56326b814fc38bf2122c6aad3051af6a9f33c3244ad067eafef18dbac45e10c7b20916ae986b723f299ddb3ccd8858f6680149a8692a50f806b03e1f4eecd22d42e9b54aa24cba3528519ad02a1ad82101d9f066fd875fbc06303115a8bf7dfb9201a1cab8fa4a09199a5489ce13610e42ec7043daafcfd5db298ad9dbfe09bb5f3600c787a5f035d5f4b838bb5c0830ca087400d004ce7adcc4aaa40387d71e77e83d0d1b4e626ecdf392fbe8721bbc8ccf08a35feb0a9428fc5b06edd8a1c021b46f1998d258de0a255aab56e6c2689ddd2c91ac034517b42b6832d674b14132cf09c7fb8b479f4402975fd93268fa87d4b2f54afb2a10d45deb66c8fac6df0373187202a7675b235c6b9863cd5a77ecc7fcd5c2af0a1d03e6da4bb16a57256efa0008da44801b78f78e3b716756b4a0dc1f092241af7603aa7a1a619851cf69018ca06646c6d206dfef1bee8bdad5a4bbaacbf8405ce77c71152c5827f9384dd909036baa42cc237743c0537974b267dad7a3ed2ac3ec5ae81f8d6045d8d30fc4714f98ec616c7c032540c4f8e2fde9c2b179c3798ea613c56cdc8a51b72e9fb7cbdda1ef6c943f5df6a9f55665e8ab4bb6c33ae7ed9ea445f4fe73c670c75d3b87156d963dcbe9d4d41c2ef1121152a531015b9af79318cd9ef3e4208bda8892a90a99393244df7543c6c11c29d1b088959dfb086c6cf8163cfba1d5f7b5abeb9160a21ef9f901f72682dea0f0fde6290f8874a8d32d5af785d2139513563bac8cc3beb9cc3486a4d9f9818a538d2a5998c9f971cd09f325f09651273fad898cc53927fabd5b4f3e6941743c5f6c1eeb4c995f2e1f84d8919535ad0bb83108104cea8f74426f03d72e458df792887c110d43d3d38541cdb122082e643136bb7e79601f6f59ed7a2624ed15c93c40d4597cea69f9e4781caa12742d971635d79f1d63b68daeb6f7aea586e75282b8f8802ec954f1ab72d460639f596351f7ea4d167fcd84e1072908cfb301e4d4c3b3dd7f51c52d6c08f574beb01a38ac7157537cb8a74bc0cd97d0f64a5fec5155e30ca3890f57a41f098a29575ea83a91c9ed85b0ec6d773a608b12156dbd828474b48ee15bacb312f56d0e045b807122a25532a86acd76ed42b5a2ecc8e60db123684e28c6f3c1705feed7b07e32db965c342184454101011c9a75d9d8ba21c7724c821034421b81a93a95223c3b0b62df276d5f40b67942d1343a0903078394f904f61f9989915645de22dfafd51cf1727c19d79863ff0e395beca36f8528e202da879bb1bee56d87f4409675779895526109d32120cbeb480bc600fff86ccaf1726b15b403651b381cdafdbed09ac091f1838a63a7cdceea1830c708ce15b9d2c1f1039a81614bff48962ff8dab7d498351d183e3699e81c1ab583a8fd26964408cd403235e1e492f4ad70ac070ae10daeda45686bebe37d00341eadb480d5ed70b0c098c9fc2b70557985ebee84efbffbc9fc7789789cf7c9792d057d91c3d7d3568e3352609faae1a9870d44b08643cc62d7620948a0f5a3b5a8dc98148c1ef1c21c9cb1bdf927598617afd07fddb303ad342f2e4b2d88cfbd73c33d28e18beeafe20823d3c43a67064d9e266dbf3185c8a4c955ce27fb2fd7a46a0362475b0b361359557de22439e23dcaaf22b27ed803af966f0a34abe145c4c2d4d3a780af0a590140b5948cdd41630ca82974db3e6cea89f67268f2565258f5516906d19f45675df8e98b701c105f3b4a04d1285c320062f47eeb721425abe9351b9c3e052f870212aeb6823e9ed32acf32fe35617c83cdd0fce993487b94d32ec003712c783f3703deb043e09f8d81ffbc6b22f3f07e5589c1153440187b6ab0b248bd3f5d9f29e3927e11b6898355a1fee917549c0dd9f42ff870a12c09635e9a9382f755623f0618523b1efb04410739de7994a2ae7a03fc2e84396ef3d53254e48241f4f8e0e241308a86d418f4346fdb46ce871aaf8f012679ed43cf339bd781178fbe8fa89ad62e16d2e045e745a9ce7b7c9f8b646a669a7caa03cae7fc6694fef0e847f1b1f0b36f311381ffce37b2ceedfe5b1f8a8386c8b6d6446a803d2279c14df6742b5cc8472536023e1252eb82fb76eddb4d0722d76cbf7fe4543c07abafe7e3bf586206efc2baab1381ca6dfd37e840a7de0de6c2483f9edb878a24709077309722fc25066e463a656dff520504b6ebd6f4d2c8c884a7a85ba7a98f2d13f78b0fb6c5b05dca60115622955a8dda478bc5b3cbbe98c74a22808c4842f1d494ce33bbe8c2ed2e21d8007e3fa8426d3cbdde1ae995526f3d98c8c1ed175f2a654b78663f6c840dcf4ae26a1214e04c3e7c82698f490a03b3d99695f837be9d5cca7d102ebc0823644113e4122b5d7a671088f14bcbd1cc7bbcddfbc1b8b04d992c4d22539de402b1a39b67ca29a8ac3517763cdf79732cb4d6bf28bfc3a17ec0067ee35ecdfddf04646ac84f7eb84276175c424347e81ed9a015a069adf6c91ec043493f3b5cc99a8a2f0716aaefbf5f8e42b98d0df835877d7ff7295b0cf780f9916d728ac403bb4c37050c6552dd8b0137099bfe8b58c74b8bce74d0f14a6c14e4c08052d4e8e3d2f25088d1db5f146a8f7ea247d48366594671bec35fbd5159ae647a5ded27aa64f1c37a7da47e6862af20a57c1b68b2f4f6d071b0d4ca9c73b1bcdb3d75e1fcbf98753d100b4fa8bac5398b63ac9c892a0ba4b2df443deb585024d7910f8397198b857f1f9c4aab26be9d189f5d243cd7afbe87a512a2ec9626a14376eaccd0bcc407da4b5d62fc13303940e7c7430696d5f04c4c6bada515f9c77d6a005735b91b2f03f68238997f858009c8ab31ae38004259570e66c21ea232605a1ad864b0e5bf6ee52a8644832ab9d3bbd5509"}]}) syz_ublk_setup_queues(0xffffffffffffffff, 0x0, &(0x7f0000004640)={0x0, 0xda9b, 0x200, 0x1, 0x32e}, &(0x7f00000046c0)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x50d3, 0x4000, 0x0, 0xf1, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5e5d, 0x4, 0x3, 0x399, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xa608, 0x20, 0x2, 0xea, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1a85, 0x80000, 0x3, 0x317, 0x0, r2}, 0xffffffffffffffff, 0x0, 0x0}], 0x4, &(0x7f0000005940)={0x2e, 0x5, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {0xb}, 0x0, 0x0, '\x00', {0x4, 0x49b, 0x0, &(0x7f0000004940)=@buf_512="5f4510b544efdfae578159689b087f2aea7fb10417cdf5c93b81f88137b7e6073f31dc7903b949ec312778c5dac97d2d7fe1ebbc13a791e7d73ae04c342617eb0a99db3c7496a73f26a5c571a000b04ddbc51be22f30d3ef5a193a833993628d72270a3c78069cdfbae0c5364e90f0753694a86f2c5922ec6e2cae6761f1ac52dea10368d1af256e6d944fb79cd374eacfd95b4020d94008887519d9b8e23b87e0f05477301469abb6a62b1d9e69256ae473014aca727056e7325644cfc90c5dc851d7b63551feb1291d8fa2c3e797f2948563afcb4f7f62ca5b45ad588b998872561a27f17fbac985959eaf4ad927fb6fb0d90df83abf9690277076096dee56e37ab111485a2fc1c205bacb5ed5d8b2e511530b74f96ebf41d2470c32fdd3e789b23e30b5f987e5c29536533fddd1188d6d9403e45c74b023ba6fd301fca223b3f302315f53d53c6ef0e97edf15f1f5e0d3a8ce470d534251e963fb76259c12c63802a2f1724161dd84903bdf10832662d01e78dd9dfca98acbe32f95b0174a0d21a69b078883083405250bb6b95b8be2ee2256315b50c8e66524572e781681aec10fc7695dc8707183b9daf879da67a9a21630e4466cde5cb4860f3f07d27995b0ea843cf5ad99713f16d2c0b8394f5b6c5ccc01535ff6880b195da45225be5d943d19663be09c7b068973cffcec85b7531648247b4b3dcd9c915a4e69af3f"}}, &(0x7f00000059c0)) r16 = mmap$IORING_OFF_SQES(0x0, 0x9, 0x11, 0x110, r2, 0x10000000) syz_ublk_add_dev(r2, 0x0, r15, r16, &(0x7f0000006b40)={0x2e, 0x26, 0x0, r6, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000006b00)=@any_dev={0x1, 0x397, 0x0, 0x0, 0x1000, 0xfffffff0, 0x0, 0x0, 0x10}}}, &(0x7f0000006bc0)) 8.285029863s ago: executing program 4 (id=9458): sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) 8.087721805s ago: executing program 4 (id=9459): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003700000008000300", @ANYRES32=r1, @ANYBLOB='\b\x00&'], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0xc044) 7.169318337s ago: executing program 1 (id=9460): clock_nanosleep(0x1, 0x1, &(0x7f0000000280), 0x0) syz_usb_ep_read(0xffffffffffffffff, 0x2, 0xc, &(0x7f0000000300)=""/12) r0 = syz_usb_connect$rtl8150(0x6, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000500)={0x18, &(0x7f00000001c0)={0x20, 0x11, 0x2d, {0x2d, 0x8, "1e269301d88935148fe5c75607abc3e1db85674c1ea91dcfa5f076f7201630e8739e8f2c2132eb9ac96fd5"}}, &(0x7f0000000340)={0x0, 0x3, 0xe4, @string={0xe4, 0x3, "a4d19821028c12267cc5f73d19b8953fd46b41f9cec1a62394a85ec5ff259ba6d822b9aa48cde3478bec1172998207c2bd6c7916c2993fdd0afcb845795934bdcc58db9ed32021f11b2c7e9df2118802c204ec90fb444c446b846706a24ff9057d305f8a3a64886767988a1b03016181ce0c9be7299e7915ba3a55f9b434e7548b9c474265d078aa7c68abb450445fe44fe9f388b6309798d1b721c1e75aec9a399d7f9e3a77f1036d6e8c1a470d478d3661f4da8c294690ab92c6816e83a69a2f4a5fa749bbf0dd933d0aa95491ecb254dd88694e95883426ae69fd7ca16084271d"}}, &(0x7f0000000440)={0x0, 0xf, 0x38, {0x5, 0xf, 0x38, 0x3, [@ptm_cap={0x3}, @ssp_cap={0xc, 0x10, 0xa, 0x44, 0x0, 0x7, 0xf000, 0xb1}, @ssp_cap={0x24, 0x10, 0xa, 0x1, 0x6, 0x7, 0x11f0f, 0x8, [0xc0, 0xffc000, 0x2080, 0xff0030, 0xff0000, 0xc0f0]}]}}, &(0x7f0000000480)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x80, 0x5, 0x4, "62bacb67", "03dbbfbf"}}, &(0x7f00000004c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x2, 0x3, 0x20, 0x40, 0xf, 0x6}}}, &(0x7f0000000a00)={0x44, &(0x7f0000000540)={0x20, 0xf, 0xf2, "e1e569b2e6c306ead2291fa19ea93326a56d837a1c02167ee2139076f11f0df2578038b5d3ad729358f45bad9c1395225bab8e338c091f4e856b46214c5f1a3eff3a626245b34c2ce9e9d177606302ae8736e865210d9c1b44afecd114c7927c5b7c98455dcbb4f5f268d14c002c67a4c5483c4d0ce1a6a4279228ba6f53db42dfc84ffd5b0c391a014438b99603aa8bfa26d342539d78d774da496277a76a470579e871cf3b0bb5de2db9fdf90264c9027fb93cdcb36cf846d95ab0655abb6538fdcba1d442a8327214838d32cdaa46b87985ad5d0a9e7c2b0c88b6de795ef3033e0b3495bb49e7ee8efe587be83a175cf6"}, &(0x7f0000000640)={0x0, 0xa, 0x1, 0xb}, &(0x7f0000000680)={0x0, 0x8, 0x1, 0xc}, &(0x7f00000006c0)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f0000000700)={0x20, 0x0, 0x4, {0xc0, 0x9}}, &(0x7f0000000740)={0x40, 0x7, 0x2}, &(0x7f0000000780)={0x40, 0x9, 0x1, 0x3}, &(0x7f00000007c0)={0x40, 0xb, 0x2, "0234"}, &(0x7f0000000800)={0x40, 0xf, 0x2, 0x1}, &(0x7f0000000840)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2d}}, &(0x7f0000000880)={0x40, 0x17, 0x6, @multicast}, &(0x7f00000008c0)={0x40, 0x19, 0x2, "ec04"}, &(0x7f0000000900)={0x40, 0x1a, 0x2, 0x9}, &(0x7f0000000940)={0x40, 0x1c, 0x1, 0x80}, &(0x7f0000000980)={0x40, 0x1e, 0x1, 0x9}, &(0x7f00000009c0)={0x40, 0x21, 0x1, 0x2}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002080)={0xffffffffffffffff}) io_setup(0x7, &(0x7f0000000280)=0x0) io_submit(r2, 0x1, &(0x7f0000000080)=[&(0x7f0000000540)={0x4c5, 0x0, 0x106, 0x800000000001, 0x0, r1, 0x0, 0x300}]) io_getevents(r2, 0x0, 0x1, &(0x7f0000000200)=[{}], &(0x7f0000000240)={0x0, 0x989680}) syz_usb_connect$cdc_ecm(0x3, 0x6d, &(0x7f0000000040)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5b, 0x1, 0x1, 0xc3, 0xc0, 0x33, "", [{{0x9, 0x4, 0x0, 0xf, 0x3, 0x2, 0x6, 0x0, 0x4, {{0x5}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x401, 0x9, 0xc, 0x3}, [@acm={0x4, 0x24, 0x2, 0x3}, @mdlm={0x15, 0x24, 0x12, 0x6}, @dmm={0x7, 0x24, 0x14, 0x400, 0x3}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x200, 0x2, 0x9, 0x4}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x80, 0x7d, 0x7}}}}}]}}]}}, &(0x7f0000000180)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x110, 0xf, 0x3b, 0x1, 0x20, 0x7}, 0x40, &(0x7f0000000100)={0x5, 0xf, 0x40, 0x3, [@wireless={0xb, 0x10, 0x1, 0x8, 0x20, 0xdd, 0x4, 0x2, 0xc}, @ssp_cap={0x1c, 0x10, 0xa, 0x1c, 0x4, 0x4, 0x0, 0xf8b4, [0x0, 0x30, 0x3f00, 0xcf]}, @ss_container_id={0x14, 0x10, 0x4, 0x40, "a7a59f7d2432c4ff992684dfca8e8c7d"}]}, 0x1, [{0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x1c0a}}]}) 5.843855465s ago: executing program 2 (id=9461): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000b40)=@newtaction={0x14, 0x30, 0x101, 0x70bd2b, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0xd0}, 0x20000800) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f00000006c0)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000880)=""/109, 0x6d}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf, 0xa1}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x38, 0x10, 0x401, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x31943}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_PDP_HASHSIZE={0x8, 0x3, 0x2}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xf8, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@private=0xa010102, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x7fffffffffffffff, 0x0, 0x0, 0x4, 0xffffffffffffffff, 0x7}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0xffffffff, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x0, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x6, 0x4, 0x3, 0x0, 0x1}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r3 = socket$inet6(0xa, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0xffd8) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(0x3) r6 = socket$inet_tcp(0x2, 0x1, 0x6) setsockopt$inet_tcp_buf(r6, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) r8 = syz_open_dev$sg(&(0x7f0000000180), 0xaf, 0x0) ioctl$SG_IO(r8, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x3, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000440)="1aec04b80000", 0x0, 0xfffffbfc, 0x2, 0x3, 0x0}) r9 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r9, &(0x7f0000000380)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000300)="bc", 0x1}], 0x1}}, {{&(0x7f00000000c0)={0xa, 0x4e20, 0x4, @remote, 0x1}, 0x1c, &(0x7f0000000240)=[{&(0x7f0000000140)="7f", 0x1}], 0x1}}], 0x2, 0x4) shutdown(r9, 0x1) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r9, 0x84, 0xa, &(0x7f0000000000)={0x1, 0x5, 0x0, 0x2, 0x1, 0x27, 0x0, 0x7}, 0x20) syz_usb_connect(0x2, 0x68, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000a1121710950b2a17f4f7010203010902240001000000000904"], 0x0) setsockopt(r7, 0x84, 0x81, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r7, 0x84, 0x16, 0x0, &(0x7f0000000040)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) 5.843688064s ago: executing program 4 (id=9462): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$inet(0x2, 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'macvtap0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@ipv6_deladdrlabel={0x38, 0x49, 0x1, 0x70bd22, 0x25dfdbfd, {0xa, 0x0, 0x80, 0x0, r4}, [@IFAL_LABEL={0x8, 0x2, 0x7}, @IFAL_ADDRESS={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0xff, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040865}, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x8864000000000000) 5.798715913s ago: executing program 3 (id=9463): r0 = socket$nl_route(0x10, 0x3, 0x0) fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x12) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0}) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, &(0x7f00000000c0)={'mangle\x00', 0x2, [{}, {}]}, 0x44) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) ioctl$KVM_CLEAR_DIRTY_LOG(r2, 0xc018aec0, &(0x7f0000000140)={0x0, 0x240, 0x380, 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'dummy0\x00', 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000280)=@ethtool_ringparam={0x33, 0x83, 0x20000a2e, 0x401000, 0xe, 0x3, 0x2000001, 0x1, 0xb000000}}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000002e00090027bd700000000000040000001400180008ac0f0006ac0f0009ac0f0006ac0f"], 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r9, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="000b0100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r9, 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r11, 0xc048aeca, &(0x7f00000002c0)={0x9, 0x0, [{0x99f, 0x0, 0x77}, {0xb06, 0x0, 0x4}, {0x8cc, 0x0, 0x1}, {0xba4, 0x0, 0x5}, {0x0, 0x0, 0x9}, {0x24a, 0x0, 0x4}, {0x40000080, 0x0, 0xfffffffffffffffe}, {0x5b9c0c5af81ad2d5, 0x0, 0x3}, {0x987, 0x0, 0x6}]}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000900)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r6, @ANYBLOB="2e003300d000003605021100000108021100000050505050505000"], 0x54}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff5667f, 0x5001, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0xfff3}, {0x0, 0xfff1}, {0x2, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x4004892) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000240)={0x921, "452860b24d659a5b4b8d5bf9d19f68060592b2165e1cd2b82216af1273b818cf", 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r12, 0xc0383e04, &(0x7f00000004c0)={""/32, 0x0, 0x0, 0x6, 0x0, &(0x7f00000002c0)=[{}, {}, {}, {}, {}, {}]}) 5.721851554s ago: executing program 1 (id=9464): syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x7ff, r0, 0x700}, 0x38) r1 = syz_usb_connect$uac3(0x0, 0x151, &(0x7f0000000100)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0xccd, 0x12, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x13f, 0x3, 0x1, 0x2, 0x10, 0x80, {0x8, 0xb, 0x0, 0x1, 0x1, 0x21, 0x30, 0x9}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x6, 0x57, 0x7}, [@feature_unit={0x15, 0x24, 0x7, 0x3, 0x3, [0x10, 0x10, 0xa, 0xe]}, @extension_unit={0x11, 0x24, 0xa, 0x1, 0x4, [0x3, 0x0, 0x0]}, @output_terminal={0x13, 0x24, 0x3, 0x2, 0x404, 0x1, 0x2, 0x4, 0x1, 0x2f93, 0x9, 0x2}, @input_terminal={0x14, 0x24, 0x2, 0x1, 0x204, 0x4, 0x6, 0x4, 0x1, 0x9, 0x3, 0xfffb}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xf8, 0xa, 0x6, 0x1, 0xa}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x7, 0x4, 0x7, 0x8, "d442"}, @as_header={0x17, 0x24, 0x1, 0x0, 0x5, 0x6, 0x2, 0x8, 0xa, 0x40, 0x80}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x6, 0x8, 0x6, 0x40}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x10}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x97, 0x2, 0x9, 0xd, "", "2ac242"}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x0, 0x7f, 0x8b, {0xa, 0x25, 0x25, 0x401, 0x0, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xfff8, 0x5, 0xdd, 0x1}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x0, 0x1, 0x36, 0x5, "a8217f"}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x5, 0x4, 0xa, 0x8, "63c9"}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x4a, 0x3, 0x3, 0xd, 'F', "9d"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0xcf}, @format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0x3, 0x4, 0x81, "0b9bf02457c96c"}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x6, 0x6, 0x4f, {0xa, 0x25, 0x25, 0x0, 0x4, 0x8}}}}}}}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x110, 0x1, 0x6, 0x2, 0x20, 0x75}, 0x10, &(0x7f0000000080)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0x8, 0x98, 0x7f, 0x3, 0x2}]}, 0x1, [{0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x445}}]}) syz_usb_control_io$uac3(r1, &(0x7f0000000500)={0xc, &(0x7f0000000400)={0x0, 0xc, 0x5a, {0x5a, 0x22, "5c286fb928afb4a81a499ecc17d6d05c790c121a3a73186c7b2a91f705e68482f8b7184216c921878bd8e7758cfd3c53b3dea31cce99e8e537af7cb4dc1f2386f58e59f1e61dfde86a7d379925679e09f53f4a4e84fe9eaf"}}, &(0x7f0000000480)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41a}}}, &(0x7f0000000740)={0x24, &(0x7f0000000540)={0x0, 0x16, 0x31, "5a0b63cdd417fcac9917687c1a3923bb2e999785b0887d16d669decbd714b9a2df9612aae3c095cebd5913868372c78136"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000600)={0x20, 0x81, 0x2, "90ca"}, &(0x7f0000000640)={0x20, 0x82, 0x2, "7c8f"}, &(0x7f0000000680)={0x20, 0x83, 0x1, "88"}, &(0x7f00000006c0)={0x20, 0x84, 0x1, "d7"}, &(0x7f0000000700)={0x20, 0x85, 0x3, "259556"}}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(r2, 0x801c581f, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00M'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000f80)={0x84, &(0x7f0000000a00)={0x20, 0xf, 0x5, "1f3e330ce9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.612868025s ago: executing program 0 (id=9465): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x807d, 0x1, 0x8}, &(0x7f00000000c0)=0x10) mmap(&(0x7f0000261000/0xc00000)=nil, 0xc00000, 0x3000003, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYRESOCT=r1], 0x20}, 0x1, 0x0, 0x0, 0x42014}, 0x20089890) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x48100) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000040)={0x1, 0x7ff, 0x0, 'queue1\x00'}) r4 = syz_open_procfs(0x0, &(0x7f0000000300)='clear_refs\x00') ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000340)=0x8000000) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r3, 0xc08c5335, &(0x7f0000000780)={0x0, 0x80, 0x1, 'queue0\x00', 0x101}) timer_create(0x3, &(0x7f0000533fa0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f00000001c0)) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) setrlimit(0xf, &(0x7f00000000c0)={0x0, 0x3}) mlock(&(0x7f0000bff000/0x400000)=nil, 0x400000) r5 = fsopen(&(0x7f0000000440)='mqueue\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r7 = open_tree(r6, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f00000020c0), 0x208002, &(0x7f0000000380)=ANY=[@ANYBLOB='fD=', @ANYRESHEX=r8, @ANYBLOB="2c726f6f746d6f64653d303030303030303030303030303030000031300100000000000000725f69643d", @ANYRESDEC=0x0, @ANYBLOB="1b67726f75705f69643d", @ANYRESDEC=0x0, @ANYBLOB="f9b40000000000000b6d00000000f4000006"]) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x7, @loopback, 0x9}]}, &(0x7f00000002c0)=0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000001c0)={0x8, &(0x7f0000000140)=[{0x8, 0x2, 0x9, 0x1}, {0x2f77, 0x2, 0x5}, {0x9, 0xa, 0x8, 0x4}, {0x400, 0x1, 0x5, 0x7}, {0x3, 0x95, 0x2b, 0x8}, {0x5, 0x6, 0xff, 0x100}, {0x7, 0x33, 0x9, 0xfffffbff}, {0x100, 0xf5, 0xf3, 0x5}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000200)) 5.285362645s ago: executing program 0 (id=9466): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, 0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x2}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x10, 0x1, 0x51, 0x3}}], 0x10}, 0x40004) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f00000004c0)=[@ioring_restriction_register_op={0x0, 0x9}], 0x1) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x22c01) sendfile64(r3, 0xffffffffffffffff, &(0x7f0000000180)=0x830, 0x8000) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000040)={0x0, 0x1, 0x20a4b}) socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004041, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e23, 0xfffffff8, @ipv4={'\x00', '\xff\xff', @rand_addr=0xfffffffe}}, 0xec) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r6, {0x4, 0x8}, {0xa, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4040091}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'tunl0\x00', r6, 0x40, 0x8, 0x8001, 0xec, {{0x5, 0x4, 0x2, 0x9, 0x14, 0x65, 0x0, 0x0, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x15}, @multicast1}}}}) ioctl$sock_SIOCGIFBR(r2, 0x8940, 0x0) unshare(0x62040200) 4.578460729s ago: executing program 4 (id=9467): r0 = syz_usb_connect(0x3, 0x50, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040ca08100100010102030109023e0001010080fa0904000002ff00000007058302000200070504020002"], 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r1, &(0x7f00000000c0)="3f03fe7feee8140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e", 0x45, 0x0, &(0x7f0000000540)={0xc9, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) r3 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82, 0x0, 0x0}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000040)=0x1f36, 0x4) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r4, r5, r6, &(0x7f0000000040)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x23456}) io_uring_enter(r3, 0x1, 0x1, 0x1, 0x0, 0x0) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) r9 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r8, 0x84, 0x17, &(0x7f0000000080)={r10, 0x2, 0x1, "fa"}, 0x9) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000500)={0x9, 0x8, 0x9, 0x5, r10}, &(0x7f0000002c80)=0x10) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_ep_write(r0, 0x83, 0x0, 0x0) syz_usb_ep_read(r0, 0x4, 0x0, 0x0) syz_usb_connect$midi(0x0, 0xb9, &(0x7f00000001c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x0, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa7, 0x1, 0x1, 0x7, 0x20, 0x7, "", {{{0x9, 0x4, 0x0, 0x0, 0x7, 0x1, 0x3, 0x20, 0x40, [@midi_in_jack={0x6, 0x24, 0x2, 0x2, 0xe, 0xb0}], [{{0x9, 0x5, 0x4, 0x8, 0x20, 0x78, 0x7d, 0x9, {0x4}}}, {{0x9, 0x5, 0xb, 0x0, 0x400, 0x4, 0x4, 0x5, {0x8, 0x25, 0x1, 0x4, "6da27694"}}}, {{0x9, 0x5, 0xe, 0x0, 0x40, 0x0, 0x65, 0x2, {0x13, 0x25, 0x1, 0xf, "cb4f745461262bf24928fceb8c5070"}}}, {{0x9, 0x5, 0x6, 0x0, 0x3ff, 0x2, 0x7, 0x4, {0x13, 0x25, 0x1, 0xf, "5a288009eb2152a23304fc492c34d7"}}}, {{0x9, 0x5, 0x5eb594239065aca3, 0x2, 0x10, 0x7, 0x2f, 0xc, {0x11, 0x25, 0x1, 0xd, "7d7c49454f24e171d6fd3a30c3"}}}, {{0x9, 0x5, 0x6, 0x17e499494abeaf7e, 0x28, 0x1, 0x1, 0x2, {0x8, 0x25, 0x1, 0x4, "1c25bb7a"}}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0x9, 0x0, 0x2, {0x5, 0x25, 0x1, 0x1, "03"}}}]}}}}}]}}, &(0x7f0000000780)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x250, 0x0, 0x6, 0x40, 0x40, 0x25}, 0x1f, &(0x7f0000000300)={0x5, 0xf, 0x1f, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x83, "73bfd5c6c038da878698223d9a31fcc9"}, @ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x7, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x410}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x3009}}, {0xcd, &(0x7f00000003c0)=@string={0xcd, 0x3, "b349b17701486a74785eadb132afdc2687f9f1773b89ca4022cff42998e97af460dd50518d97770971f0d4cd058d5d9f610cfa6cd246a889fe1a4140274c8cac851aa7f003ac7b56b2becc3d4751aa9e9b5ad6d5ef82b42ee8340854db8e76cc4de6b228ad5a8a6ad25052619ca9422f9a76064bbbc1b624b68cec389ba19877a40740dd46977cb227bf2c494bab9d58ec27da809c5c53b302040e3a93028020a8a6c8bbee6e08439bf6f4072047982ef745a7e041ac88927c94f5228a8800d44c81f912f7c9fe984cdd40"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x446}}, {0xd2, &(0x7f00000005c0)=@string={0xd2, 0x3, "92f18d51ce312d02aa716e008a30a6c02ba35ea69037a761a5c2a8a064ab0e9130006984bd9a87e2fa7d370da76dd7ee7b76d311df65644c8cec9e242d147240bd06e3ab1fc672bfde54c2ba2de75af661b8e921ba12aa62cc0f7dd57172c16b0707973480c014debc7c4f53021a7e2715e5ff9e2cdf5dd24326bbfac60f437d050b78caca061ff369399ad29b87e72746c5769bf93fcb5d36e7a72d848a260f8a9a73eed2013803c2afb37a8ac3f70f37dd135958bb883664cf78b49a6d6a0742e11200ca24d6531e9acd7599994fd6"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x458}}, {0x78, &(0x7f0000000700)=@string={0x78, 0x3, "7fc966f7caa92dc46c42735f89dbed180dc668df8e745c13107fd5da31c571b5a8eff2f026f0e6c41dd58c05c0035361868e9662f090c3586b62a9aa7d78312a58a23ba756623aaab1f189e9b20856e394fe62dc43765baa13e1e4859b31b7aed4e31f93702caaa03d7d88ba6b0104bd50d25941f1df"}}]}) 4.053555301s ago: executing program 1 (id=9468): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f00000002c0)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='illinois', 0x8) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380100000001010400"], 0x138}}, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000080)=0xb309) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x8, &(0x7f0000000080)=ANY=[]) syz_usb_ep_write$ath9k_ep2(r1, 0x83, 0x8, &(0x7f00000000c0)=ANY=[]) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 3.471648276s ago: executing program 2 (id=9469): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x4008031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$SEG6_CMD_GET_TUNSRC(0xffffffffffffffff, 0x0, 0x4008811) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0xa6f81, 0x0) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50}, 0x24000085) add_key$user(0x0, &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r2, 0xc0045006, 0x0) r3 = dup2(r2, r2) read$FUSE(r3, &(0x7f00000063c0)={0x2020}, 0xfffffffffffffe46) r4 = fsopen(&(0x7f00000003c0)='ubifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000400)='{\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x19) r5 = socket(0x40000000015, 0x5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x8, &(0x7f0000000140)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x33}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "1a00000180ffffffffffff0700", "8c76287d", "3d8efa05fdffffff"}, 0x28) 3.471369672s ago: executing program 3 (id=9470): ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0xeeef0000}) unshare(0x6a060000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000001840)) unshare(0x20000400) r0 = socket$kcm(0x2, 0x922000000001, 0x106) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e23, @private=0xa010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000380)={r2, 0x4800, 0x4e}, &(0x7f00000003c0)=0x8) setsockopt$sock_attach_bpf(r0, 0x1, 0x43, &(0x7f0000000000), 0xff7b) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) r5 = openat$full(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) splice(r5, &(0x7f0000000000)=0x6, r4, 0x0, 0x3e9, 0x8) sendmsg$nl_route(r4, &(0x7f0000000580)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)=@ipv6_getroute={0xf8, 0x1a, 0x300, 0x70bd29, 0x25dfdbff, {0xa, 0x0, 0x0, 0x1, 0xff, 0x3, 0xc8, 0x7, 0x1000}, [@RTA_MARK={0x8, 0x10, 0x8b}, @RTA_METRICS={0xc6, 0x8, 0x0, 0x1, "c66fcbc265e461d4c30f967ec37b763421efa717220e3ce123eee385709e670c3ecd33dfbcb62c12b35951526c6fd40d3550c3c9cc032e8f4df51ff2f5888c0b96b316e18d5500083d198fda58fce56cca92ed1349396be09e50b5c09ca9099a8069b88141876abf98b53210700fc0b02701cc8c95bde6ae22a91ccb716112f889969674643044d0b660678e8d8f9f465e9eb609be87618bce5fededc745b849be74d6a5d329553293596b4150e88dcafbfc6604d5701e9230f8f3a16b1c33ef26bb"}, @RTA_MULTIPATH={0xc, 0x9, {0xfff6, 0xb, 0x4d}}]}, 0xf8}, 0x1, 0x0, 0x0, 0x80}, 0x4) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000001300000000ebff00000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00000500070088000000060005404e220000"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) openat$zero(0xffffff9c, &(0x7f00000001c0), 0x18000, 0x0) r7 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x80000000, 0x8, 0x2, 0x0, 0x4b}) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r10, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB='X\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r9, @ANYBLOB="3a003300d0000000080211000001080211000000fffffffffffff00f0c0669006512080211000000ffffffffffffffffffffffff68040c0000000000"], 0x58}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001dc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad0e0e2b45d14ee446b840edaa1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c50ce6a8e9f65de13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522"], 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000540)={r12, 0xffffffffffffffff, 0x13, 0x0, @void}, 0x10) 3.389296187s ago: executing program 0 (id=9471): socket$packet(0x11, 0x2, 0x300) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req={0x8000, 0x6, 0x300, 0xfc}, 0x10) mmap(&(0x7f0000000000/0x30000)=nil, 0x30000, 0x3, 0x11, r0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d80000001000810468", 0x9}], 0x1}, 0x0) pipe2(&(0x7f0000000200)={0x0, 0x0}, 0x0) write(r2, &(0x7f0000000210)="01", 0x1) read(r1, &(0x7f0000000000)=""/8, 0x8) sendto$packet(r0, 0x0, 0x300, 0x0, &(0x7f0000000100)={0x11, 0x0, 0x1, 0x1, 0x0, 0x0, @random="29ed47fe6a91"}, 0x14) 3.27031051s ago: executing program 0 (id=9472): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x300, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="7c0000001000010400e5ffff0200000000000000", @ANYRES32=0x0, @ANYBLOB="fab0817dbcb5f31a48001280110001006272696467655f736c61766500000000300005800400180005001e00000000000500090001000000080025008000000006001f00060000000500010003000000140003006272696467655f736c6176655f30"], 0x7c}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 3.004824595s ago: executing program 0 (id=9473): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000018406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="b801ddff180001000000000011000000e0000001000000000000000000000000fe8000000000000000000000000000bb4e22000b000300000a00208000000000477d7b", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000006000000000000008000000000000000000000000000000000000004000000000000000004010500fc000000000000000000000000000000000000003c0000000a000000ac1414bb000000000000000000000000ff3400000001000000000000040000806e000000ac1414aa000000000000000000000000000000003c0000000000000000000000000000000000000000000001f9ffffff0203000007000000030800000200100000000000000000000000000000000001000000003c000000000000000000000000000000000000000000000002000000010500000800000000000000000000007f000001000000000000000000000000000004d63300000002000000fc020000000000000000000000000001033500000000040000000000bb0a00003f0a0000"], 0x1b8}}, 0x8044) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f0000000300)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x18, 0x0, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r5 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$apparmor_exec(r5, &(0x7f00000004c0)=ANY=[@ANYRESHEX=r1], 0x1e0) lsm_get_self_attr(0x65, 0x0, &(0x7f00000002c0)=0x3000, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_io_uring_setup(0x47ec, &(0x7f0000000400)={0x0, 0x9ac7, 0x800, 0x0, 0x366}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r8, r9, r10, &(0x7f00000001c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x2, 0x6000, @fd_index=0x3, 0x1, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r7, 0x1, 0xfffffffd, 0x6f, 0x0, 0x0) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x1c, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000688600007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7020000721f00008500000086000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r11, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r12 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r14 = socket$inet(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r14, 0x1, 0x19, &(0x7f0000000140)='batadv0\x00', 0x10) sendmsg$nl_route(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0x403, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90446}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r13}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) sendmsg$nl_route(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x58, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8008, 0x4408}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @loopback}, @IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 2.209696275s ago: executing program 4 (id=9474): r0 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuset.memory_pressure\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x10, 0x4]}}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0xc031, 0xffffffffffffffff, 0x0) mq_open(0x0, 0x40, 0x20, &(0x7f00000000c0)={0x0, 0x5, 0x64, 0x61ecdc31}) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r3 = syz_open_dev$tty1(0xc, 0x4, 0x2) r4 = openat$vnet(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r4, 0xaf02, 0x0) write$UHID_INPUT(r3, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b5b09094bf70e0dd038e7ff7fc6e5539b324c078b089b3b34076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b32310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1061}}, 0x1006) 1.675529925s ago: executing program 3 (id=9475): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x5c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x4, {0x0, 0x0, 0x0, r2, {0x0, 0x6}, {0xffff, 0xffff}, {0x4, 0x7}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_STAB={0x2c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0xfa, 0x80, 0x4, 0x1, 0xd7, 0xea60, 0x3}}, {0xa, 0x2, [0x8, 0x80bd, 0xfffa]}}]}]}, 0x5c}}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socket$xdp(0x2c, 0x3, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0xfffffffffffffffe, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000180)={@dev={0xfe, 0x80, '\x00', 0xc4}}, 0x14) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r6 = fsopen(&(0x7f0000000200)='binder\x00', 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYRES8=r1, @ANYRES64=r3], 0x48) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[], &(0x7f0000005d80)='GPL\x00', 0xc}, 0x94) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000200)=r8, 0x4) r9 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$nl_xfrm(r7, &(0x7f0000000080)={0x0, 0x2f, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYRES32=r9], 0x34}, 0x1, 0x0, 0x0, 0x9090}, 0x4000081) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) 1.423622435s ago: executing program 3 (id=9476): socket(0x40000000015, 0x5, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000002c80)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000440)=""/177, 0xb1}], 0x1}, 0x9}], 0x1, 0x23, 0x0) sendto$inet6(r0, &(0x7f0000000140)="d067", 0x2, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socket$inet6_tcp(0xa, 0x1, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x300, 0x0, 0x3, 0xfffffffffffffffd, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0xfffffffffffffffd, 0x0, 0x9, 0xfffffffffffffffc, 0x0, 0x7fffffff}, 0x0, 0x0) 701.443888ms ago: executing program 4 (id=9477): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, 0x0, 0x0, 0x0, &(0x7f0000000000)) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x2}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x10, 0x1, 0x51, 0x3}}], 0x10}, 0x40004) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f00000004c0)=[@ioring_restriction_register_op={0x0, 0x9}], 0x1) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x22c01) sendfile64(r3, 0xffffffffffffffff, &(0x7f0000000180)=0x830, 0x8000) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000040)={0x0, 0x1, 0x20a4b}) socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004041, 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e23, 0xfffffff8, @ipv4={'\x00', '\xff\xff', @rand_addr=0xfffffffe}}, 0xec) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r6, {0x4, 0x8}, {0xa, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4040091}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f00000000c0)={'tunl0\x00', r6, 0x40, 0x8, 0x8001, 0xec, {{0x11, 0x4, 0x2, 0x9, 0x44, 0x65, 0x0, 0x0, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x15}, @multicast1, {[@rr={0x7, 0xb, 0xad, [@remote, @broadcast]}, @noop, @generic={0x88, 0x2}, @rr={0x7, 0x13, 0x2c, [@private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @dev={0xac, 0x14, 0x14, 0x32}]}, @timestamp_prespec={0x44, 0xc, 0x95, 0x3, 0x4, [{@dev={0xac, 0x14, 0x14, 0x20}, 0xe20d}]}]}}}}}) ioctl$sock_SIOCGIFBR(r2, 0x8940, 0x0) unshare(0x62040200) 599.995726ms ago: executing program 0 (id=9478): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040c21504220000000000010902240001000000000904000002030400000921000000012205"], 0x0) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000024d40)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002400128009000100626f6e640000000014000280050001000600000008000b00", @ANYRES32=r1], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGBITSND(r6, 0x80404532, &(0x7f00000006c0)=""/120) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x401, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40018}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x3c}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$XFS_IOC_OPEN_BY_HANDLE(r10, 0xc038586b, 0x0) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, r10}, 0x38) r11 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r11, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r11, &(0x7f0000005280)=[{{0x0, 0x0, 0x0}, 0x10009}], 0x1, 0x10000, 0x0) sendmmsg$inet6(r11, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="000000f5b8ac2bb992ebd4c7b3ba4f60bfed00", 0x13}, {0x0}, {&(0x7f0000000100)="127d589163267e4b0e", 0x9}], 0x3}}], 0x1, 0x20e8086) sendmmsg(r11, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), r9) sendmsg$TIPC_NL_KEY_SET(r7, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f00000007c0)={0x3f4, r12, 0x8, 0x70bd25, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x261}]}, @TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xb}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xc}]}]}, @TIPC_NLA_MEDIA={0xf4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x22}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8fce}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1af7}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_NODE={0x7c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xc}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x400}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x800}, @TIPC_NLA_NODE_KEY={0x43, 0x4, {'gcm(aes)\x00', 0x1b, "fda44a7214dfcc1f54dcf5465e99930468f73834a4653d3b04039c"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_LINK={0xb0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x84}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x81}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf99}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}]}, @TIPC_NLA_MEDIA={0x90, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}]}, @TIPC_NLA_NET={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xf}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2d1}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xe6}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8001}]}, @TIPC_NLA_BEARER={0x8c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7a3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffcd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3ac000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}]}]}, 0x3f4}, 0x1, 0x0, 0x0, 0x400c000}, 0x880) r13 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1020, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r13, 0x0, 0x0) syz_usb_control_io$hid(r13, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0) 212.899762ms ago: executing program 3 (id=9479): sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$inet6(0xa, 0x3, 0x3c) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x5000, 0x80000001, @remote, 0x7}, 0x1c) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) 0s ago: executing program 3 (id=9480): openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0xa) kernel console output (not intermixed with test programs): 064.314056][ T7162] fuse: Bad value for 'fd' [ 2064.625433][T25297] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 2064.795007][T25297] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 2064.831009][T25297] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2064.841044][ T7150] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2064.854330][T21373] usb 4-1: new full-speed USB device number 77 using dummy_hcd [ 2064.868368][ T7150] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2064.879957][T25297] usb 3-1: config 0 descriptor?? [ 2064.904097][T25297] cp210x 3-1:0.0: cp210x converter detected [ 2064.921564][ T9] gspca_mr97310a: reg read [21] error -71 [ 2064.936759][ T9] mr97310a 1-1:1.0: probe with driver mr97310a failed with error -71 [ 2064.991797][ T9] usb 1-1: USB disconnect, device number 121 [ 2065.084913][T21373] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2065.101486][T25297] cp210x 3-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 2065.118071][T21373] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2065.146851][T25297] cp210x 3-1:0.0: querying part number failed [ 2065.160790][T21373] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2065.177264][T21373] usb 4-1: Product: syz [ 2065.181453][T21373] usb 4-1: Manufacturer: syz [ 2065.191467][T21373] usb 4-1: SerialNumber: syz [ 2065.201914][T25297] usb 3-1: cp210x converter now attached to ttyUSB0 [ 2065.210063][T21373] usb 4-1: config 0 descriptor?? [ 2065.257321][T21373] asix 4-1:0.0: probe with driver asix failed with error -22 [ 2065.300159][ T9] usb 5-1: USB disconnect, device number 64 [ 2065.618822][ T7196] FAULT_INJECTION: forcing a failure. [ 2065.618822][ T7196] name failslab, interval 1, probability 0, space 0, times 0 [ 2065.636763][ T7196] CPU: 1 UID: 0 PID: 7196 Comm: syz.1.9308 Tainted: G L syzkaller #0 PREEMPT(full) [ 2065.636789][ T7196] Tainted: [L]=SOFTLOCKUP [ 2065.636795][ T7196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2065.636804][ T7196] Call Trace: [ 2065.636811][ T7196] [ 2065.636818][ T7196] dump_stack_lvl+0xe8/0x150 [ 2065.636845][ T7196] should_fail_ex+0x40c/0x560 [ 2065.636870][ T7196] should_failslab+0xa8/0x100 [ 2065.636894][ T7196] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 2065.636915][ T7196] ? skb_clone+0x212/0x3a0 [ 2065.636935][ T7196] ? skb_clone+0x212/0x3a0 [ 2065.636958][ T7196] skb_clone+0x212/0x3a0 [ 2065.636974][ T7196] ? ip6_finish_output2+0xedd/0x13c0 [ 2065.636997][ T7196] ip6_finish_output2+0xeeb/0x13c0 [ 2065.637014][ T7196] ? ip6_mtu+0x38c/0x490 [ 2065.637035][ T7196] ? ip6_output+0x11e/0x540 [ 2065.637058][ T7196] ip6_output+0x337/0x540 [ 2065.637092][ T7196] ip6_mr_output+0x53e/0x1170 [ 2065.637218][ T7196] ? kfree+0x1c5/0x640 [ 2065.637233][ T7196] ? __pfx___get_hash_from_flowi6+0x10/0x10 [ 2065.637255][ T7196] ? __ip6_local_out+0x15c/0x940 [ 2065.637273][ T7196] ? ip6_mr_output+0x1f3/0x1170 [ 2065.637299][ T7196] ? __pfx_ip6_mr_output+0x10/0x10 [ 2065.637325][ T7196] ? __ip6_local_out+0x15c/0x940 [ 2065.637347][ T7196] ? __ip6_local_out+0x54e/0x940 [ 2065.637366][ T7196] ? __ip6_local_out+0x15c/0x940 [ 2065.637386][ T7196] ? __pfx___ip6_local_out+0x10/0x10 [ 2065.637416][ T7196] ? __asan_memcpy+0x40/0x70 [ 2065.637438][ T7196] ? ip6_local_out+0x16e/0x190 [ 2065.637455][ T7196] ? ip6_send_skb+0x10a/0x380 [ 2065.637474][ T7196] ip6_send_skb+0x1cd/0x380 [ 2065.637494][ T7196] rawv6_push_pending_frames+0x69f/0x860 [ 2065.637520][ T7196] ? __pfx_rawv6_push_pending_frames+0x10/0x10 [ 2065.637551][ T7196] rawv6_sendmsg+0x134f/0x18c0 [ 2065.637581][ T7196] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 2065.637632][ T7196] ? sock_rps_record_flow+0x19/0x350 [ 2065.637655][ T7196] ? inet_sendmsg+0x298/0x320 [ 2065.637675][ T7196] ? __pfx_inet_sendmsg+0x10/0x10 [ 2065.637692][ T7196] sock_sendmsg_nosec+0x10e/0x180 [ 2065.637716][ T7196] __sys_sendto+0x408/0x5a0 [ 2065.637739][ T7196] ? __pfx___sys_sendto+0x10/0x10 [ 2065.637766][ T7196] ? __fget_files+0x3a2/0x420 [ 2065.637797][ T7196] ? ksys_write+0x242/0x270 [ 2065.637827][ T7196] __ia32_sys_sendto+0xdd/0x100 [ 2065.637847][ T7196] __do_fast_syscall_32+0x23e/0x6f0 [ 2065.637868][ T7196] ? do_fast_syscall_32+0x33/0x70 [ 2065.637886][ T7196] ? lockdep_hardirqs_on+0x7a/0x110 [ 2065.637904][ T7196] ? asm_int80_emulation+0x1a/0x20 [ 2065.637919][ T7196] ? do_int80_emulation+0x29f/0x550 [ 2065.637938][ T7196] ? trace_irq_disable+0x3b/0x140 [ 2065.637958][ T7196] do_fast_syscall_32+0x33/0x70 [ 2065.637978][ T7196] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2065.637996][ T7196] RIP: 0023:0xf7fd70ec [ 2065.638012][ T7196] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2065.638026][ T7196] RSP: 002b:00000000f549650c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 2065.638043][ T7196] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 2065.638055][ T7196] RDX: 0000000000000017 RSI: 0000000004000000 RDI: 0000000000000000 [ 2065.638073][ T7196] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2065.638083][ T7196] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2065.638093][ T7196] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2065.638120][ T7196] [ 2065.720729][ T9] usb 4-1: USB disconnect, device number 77 [ 2065.741484][ T7200] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9309'. [ 2065.793306][ T7201] FAULT_INJECTION: forcing a failure. [ 2065.793306][ T7201] name failslab, interval 1, probability 0, space 0, times 0 [ 2065.851316][ T7202] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9304'. [ 2065.858959][ T7201] CPU: 0 UID: 0 PID: 7201 Comm: syz.4.9309 Tainted: G L syzkaller #0 PREEMPT(full) [ 2065.858984][ T7201] Tainted: [L]=SOFTLOCKUP [ 2065.858998][ T7201] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2065.859007][ T7201] Call Trace: [ 2065.859015][ T7201] [ 2065.859022][ T7201] dump_stack_lvl+0xe8/0x150 [ 2065.859054][ T7201] should_fail_ex+0x40c/0x560 [ 2065.859078][ T7201] should_failslab+0xa8/0x100 [ 2065.859101][ T7201] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 2065.859121][ T7201] ? skb_clone+0x212/0x3a0 [ 2065.859138][ T7201] ? skb_clone+0x212/0x3a0 [ 2065.859161][ T7201] skb_clone+0x212/0x3a0 [ 2065.859182][ T7201] __netlink_deliver_tap+0x413/0x860 [ 2065.859209][ T7201] ? netlink_deliver_tap+0x2e/0x1b0 [ 2065.859228][ T7201] netlink_deliver_tap+0x19c/0x1b0 [ 2065.859247][ T7201] netlink_unicast+0x77f/0x940 [ 2065.859273][ T7201] netlink_sendmsg+0x813/0xb40 [ 2065.859298][ T7201] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2065.859319][ T7201] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2065.859341][ T7201] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2065.859358][ T7201] sock_sendmsg_nosec+0x13a/0x180 [ 2065.859381][ T7201] ____sys_sendmsg+0x54e/0x850 [ 2065.859403][ T7201] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2065.859434][ T7201] ___sys_sendmsg+0x2a5/0x360 [ 2065.859451][ T7201] ? __lock_acquire+0x683/0x2cf0 [ 2065.859474][ T7201] ? __pfx____sys_sendmsg+0x10/0x10 [ 2065.859490][ T7201] ? get_pid_task+0x20/0x1f0 [ 2065.859510][ T7201] ? get_pid_task+0x20/0x1f0 [ 2065.859527][ T7201] ? get_pid_task+0x20/0x1f0 [ 2065.859573][ T7201] ? __fget_files+0x2a/0x420 [ 2065.859592][ T7201] ? __fget_files+0x3a2/0x420 [ 2065.859619][ T7201] __sys_sendmsg+0x177/0x240 [ 2065.859638][ T7201] ? __pfx___sys_sendmsg+0x10/0x10 [ 2065.859673][ T7201] __do_fast_syscall_32+0x23e/0x6f0 [ 2065.859694][ T7201] ? do_fast_syscall_32+0x33/0x70 [ 2065.859713][ T7201] ? lockdep_hardirqs_on+0x7a/0x110 [ 2065.859731][ T7201] ? asm_int80_emulation+0x1a/0x20 [ 2065.859747][ T7201] ? do_int80_emulation+0x29f/0x550 [ 2065.859766][ T7201] ? trace_irq_disable+0x3b/0x140 [ 2065.859788][ T7201] do_fast_syscall_32+0x33/0x70 [ 2065.859808][ T7201] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2065.859826][ T7201] RIP: 0023:0xf700f0ec [ 2065.859841][ T7201] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2065.859855][ T7201] RSP: 002b:00000000f53dc50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2065.859872][ T7201] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 2065.859884][ T7201] RDX: 0000000032358a4c RSI: 0000000000000000 RDI: 0000000000000000 [ 2065.859894][ T7201] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2065.859904][ T7201] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2065.859914][ T7201] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2065.859938][ T7201] [ 2065.860019][ T7201] netlink: 104 bytes leftover after parsing attributes in process `syz.4.9309'. [ 2065.937033][ T5613] usb 1-1: new full-speed USB device number 122 using dummy_hcd [ 2065.950911][ T7201] netlink: 104 bytes leftover after parsing attributes in process `syz.4.9309'. [ 2066.127527][ T5613] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 2066.365814][ T5613] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2066.376568][ T5613] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 2066.388131][ T5613] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 2066.401495][ T5613] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 2066.411634][ T5613] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2066.427171][ T5613] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 2066.435650][ T5613] usb 1-1: Product: syz [ 2066.439893][ T5613] usb 1-1: Manufacturer: syz [ 2066.445090][ T5613] usb 1-1: SerialNumber: syz [ 2066.451536][ T5613] usb 1-1: config 0 descriptor?? [ 2066.524325][ T9] usb 5-1: new full-speed USB device number 65 using dummy_hcd [ 2066.673406][ T5613] radio-si470x 1-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 2066.683602][ T5613] radio-si470x 1-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 2066.685398][ T9] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2066.708592][T21373] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 2066.733555][ T9] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2066.745003][ T9] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2066.757026][ T9] usb 5-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2066.767460][ T9] usb 5-1: Product: syz [ 2066.771723][ T9] usb 5-1: Manufacturer: syz [ 2066.782252][ T9] hub 5-1:4.0: USB hub found [ 2066.864380][T21373] usb 2-1: Using ep0 maxpacket: 32 [ 2066.871671][T21373] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2066.881568][ T5613] radio-si470x 1-1:0.0: si470x_get_report: usb_control_msg returned -32 [ 2066.882328][ T7192] netlink: 76 bytes leftover after parsing attributes in process `syz.0.9307'. [ 2066.895176][T15721] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 2066.900069][T21373] usb 2-1: config 0 has no interfaces? [ 2066.915158][T21373] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2066.926592][ T5613] radio-si470x 1-1:0.0: si470x_get_scratch: si470x_get_report returned -32 [ 2066.929837][T21373] usb 2-1: Product: syz [ 2066.953849][ T5613] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -5 [ 2066.986422][T21373] usb 2-1: Manufacturer: syz [ 2067.018544][ T5613] usb 1-1: USB disconnect, device number 122 [ 2067.084773][T21373] usb 2-1: config 0 descriptor?? [ 2067.097993][T15721] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 2067.098170][ T9] hub 5-1:4.0: config failed, hub has too many ports! (err -19) [ 2067.108390][T15721] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 2067.141983][T15721] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 2067.153889][T15721] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 2067.172387][T15721] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2067.188845][T15721] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2067.229954][T15721] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2067.240276][T15721] usb 4-1: invalid MIDI out EP 0 [ 2067.377255][ T5613] usb 3-1: USB disconnect, device number 97 [ 2067.406954][ T5613] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 2067.437370][ T7214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2067.450586][T15721] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 2067.466848][ T5613] cp210x 3-1:0.0: device disconnected [ 2067.487834][ T9] usb 2-1: USB disconnect, device number 9 [ 2067.502994][ T7214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2067.665299][ T5618] usb 5-1: USB disconnect, device number 65 [ 2067.784262][ T5613] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 2067.854258][T15721] usb 1-1: new full-speed USB device number 123 using dummy_hcd [ 2067.934954][ T5613] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2067.946242][ T5613] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2067.956477][ T5613] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 2067.969988][ T5613] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2067.980256][ T5613] usb 3-1: config 0 descriptor?? [ 2067.989681][ T5613] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 2068.008187][T15721] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2068.019024][T15721] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2068.031860][T15721] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2068.042542][T15721] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2068.054714][T15721] usb 1-1: config 0 descriptor?? [ 2068.354308][ T9] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 2068.516252][ T9] usb 5-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2068.524328][ T5613] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 2068.533169][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2068.544198][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2068.558181][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2068.569648][ T9] usb 5-1: config 0 descriptor?? [ 2068.580684][ T9] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 2068.667339][ T7221] netlink: 'syz.0.9315': attribute type 1 has an invalid length. [ 2068.684381][ T5613] usb 2-1: Using ep0 maxpacket: 16 [ 2068.698451][ T5613] usb 2-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 2068.708300][ T7221] 8021q: adding VLAN 0 to HW filter on device bond36 [ 2068.718417][ T5613] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2068.733974][ T5613] usb 2-1: config 0 interface 0 has no altsetting 0 [ 2068.748161][ T5613] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2068.765501][ T5613] usb 2-1: config 0 descriptor?? [ 2068.792311][ T7227] bond1: option mode: unable to set because the bond device has slaves [ 2068.802962][T15721] usbhid 1-1:0.0: can't add hid device: -32 [ 2068.818990][T15721] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 2068.829999][T15721] usb 1-1: USB disconnect, device number 123 [ 2068.866206][ T7227] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2068.876494][ T7227] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2068.888656][ T9] usb 5-1: USB disconnect, device number 66 [ 2069.180631][ T7225] raw-gadget.5 gadget.1: fail, usb_ep_set_halt returned -11 [ 2069.193093][ T5613] usbhid 2-1:0.0: can't add hid device: -71 [ 2069.199900][ T5613] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 2069.210670][ T5613] usb 2-1: USB disconnect, device number 10 [ 2069.536432][ T7238] program syz.4.9319 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2069.560533][ T7238] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9319'. [ 2069.581715][ T5618] usb 4-1: USB disconnect, device number 78 [ 2069.595635][ T9] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 2069.644727][ T7240] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9320'. [ 2069.658779][ T7240] netlink: 104 bytes leftover after parsing attributes in process `syz.3.9320'. [ 2069.672614][ T7240] netlink: 104 bytes leftover after parsing attributes in process `syz.3.9320'. [ 2069.775721][ T9] usb 1-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 2069.787046][ T9] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2069.800961][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2069.810296][ T9] usb 1-1: Product: syz [ 2069.814896][ T9] usb 1-1: Manufacturer: syz [ 2069.823155][ T9] usb 1-1: SerialNumber: syz [ 2069.843409][ T9] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 2070.002801][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880572b0800: rx timeout, send abort [ 2070.502892][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880572b1000: rx timeout, send abort [ 2070.511277][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880572b0800: abort rx timeout. Force session deactivation [ 2070.511417][ T5613] usb 3-1: USB disconnect, device number 98 [ 2070.784275][ T5618] usb 5-1: new full-speed USB device number 67 using dummy_hcd [ 2070.827265][ T7234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2070.839089][ T7234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2070.856537][ T9] gspca_mr97310a: reg read [21] error -71 [ 2070.876022][ T9] mr97310a 1-1:1.0: probe with driver mr97310a failed with error -71 [ 2070.886489][T21373] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 2070.910547][ T9] usb 1-1: USB disconnect, device number 124 [ 2070.965968][ T5618] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2070.992507][ T5618] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2071.011163][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880572b1000: abort rx timeout. Force session deactivation [ 2071.035683][ T5613] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 2071.049018][T15721] usb 4-1: new full-speed USB device number 79 using dummy_hcd [ 2071.058536][ T5618] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2071.073446][T21373] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 2071.089023][ T5618] usb 5-1: Product: syz [ 2071.100748][T21373] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2071.110709][ T5618] usb 5-1: Manufacturer: syz [ 2071.118841][ T5618] usb 5-1: SerialNumber: syz [ 2071.133395][T21373] usb 2-1: config 0 descriptor?? [ 2071.145896][ T5618] usb 5-1: config 0 descriptor?? [ 2071.176465][ T5618] asix 5-1:0.0: probe with driver asix failed with error -22 [ 2071.185000][T21373] cp210x 2-1:0.0: cp210x converter detected [ 2071.205846][T15721] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2071.217273][ T5613] usb 3-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=f6.6a [ 2071.237213][T15721] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2071.258653][ T5613] usb 3-1: config 0 has an invalid interface number: 238 but max is 0 [ 2071.274288][T15721] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2071.286937][ T5613] usb 3-1: config 0 has no interface number 0 [ 2071.301559][ T5613] usb 3-1: config 0 interface 238 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 2071.322569][T15721] usb 4-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2071.336528][ T5613] usb 3-1: config 0 interface 238 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 2071.346658][T15721] usb 4-1: Product: syz [ 2071.353716][T15721] usb 4-1: Manufacturer: syz [ 2071.381296][T21373] usb 2-1: cp210x converter now attached to ttyUSB0 [ 2071.399308][ T5613] usb 3-1: config 0 interface 238 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 128 [ 2071.428331][T15721] hub 4-1:4.0: USB hub found [ 2071.465922][ T5613] usb 3-1: New USB device strings: Mfr=181, Product=147, SerialNumber=160 [ 2071.491126][ T5613] usb 3-1: Product: syz [ 2071.501610][ T5613] usb 3-1: Manufacturer: syz [ 2071.509485][ T5613] usb 3-1: SerialNumber: syz [ 2071.528014][ T5613] usb 3-1: config 0 descriptor?? [ 2071.544798][ T7262] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 2071.582834][ T5613] ni6501 3-1:0.238: driver 'ni6501' failed to auto-configure device. [ 2071.707773][T15721] hub 4-1:4.0: config failed, hub has too many ports! (err -19) [ 2071.916609][T15721] usb 5-1: USB disconnect, device number 67 [ 2071.938127][ T5613] usb 1-1: new full-speed USB device number 125 using dummy_hcd [ 2071.950848][ T7289] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9325'. [ 2072.075082][ T5773] usb 4-1: USB disconnect, device number 79 [ 2072.115229][ T5613] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2072.128379][ T5613] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2072.148124][ T5613] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2072.164986][ T5613] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2072.181803][ T5613] usb 1-1: config 0 descriptor?? [ 2072.704286][ T5773] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 2072.810407][ T7283] netlink: 'syz.0.9329': attribute type 1 has an invalid length. [ 2072.855162][ T5773] usb 5-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2072.870882][ T5773] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2072.890781][ T7283] 8021q: adding VLAN 0 to HW filter on device bond37 [ 2072.899207][ T5773] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2072.913170][ T5773] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2072.932494][ T5773] usb 5-1: config 0 descriptor?? [ 2072.944753][ T5773] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 2073.024415][ T5613] usbhid 1-1:0.0: can't add hid device: -32 [ 2073.038315][ T5613] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 2073.060870][ T5613] usb 1-1: USB disconnect, device number 125 [ 2073.143297][ T7291] bond1: option mode: unable to set because the bond device has slaves [ 2073.211198][ T7301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2073.222207][ T7301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2073.463942][ T7303] FAULT_INJECTION: forcing a failure. [ 2073.463942][ T7303] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2073.479027][ T7303] CPU: 0 UID: 0 PID: 7303 Comm: syz.3.9332 Tainted: G L syzkaller #0 PREEMPT(full) [ 2073.479051][ T7303] Tainted: [L]=SOFTLOCKUP [ 2073.479063][ T7303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2073.479070][ T7303] Call Trace: [ 2073.479075][ T7303] [ 2073.479080][ T7303] dump_stack_lvl+0xe8/0x150 [ 2073.479100][ T7303] should_fail_ex+0x40c/0x560 [ 2073.479115][ T7303] _copy_from_user+0x2d/0xb0 [ 2073.479130][ T7303] simple_attr_write_xsigned+0x147/0x2f0 [ 2073.479147][ T7303] ? __pfx_simple_attr_write_xsigned+0x10/0x10 [ 2073.479166][ T7303] debugfs_attr_write+0x76/0x130 [ 2073.479266][ T7303] ? __pfx_debugfs_attr_write+0x10/0x10 [ 2073.479276][ T7303] vfs_write+0x296/0xba0 [ 2073.479295][ T7303] ? __pfx_vfs_write+0x10/0x10 [ 2073.479310][ T7303] ? __fget_files+0x2a/0x420 [ 2073.479324][ T7303] ? __fget_files+0x3a2/0x420 [ 2073.479335][ T7303] ? __fget_files+0x2a/0x420 [ 2073.479351][ T7303] ksys_write+0x150/0x270 [ 2073.479366][ T7303] ? __pfx_ksys_write+0x10/0x10 [ 2073.479385][ T7303] __do_fast_syscall_32+0x23e/0x6f0 [ 2073.479399][ T7303] ? do_fast_syscall_32+0x33/0x70 [ 2073.479411][ T7303] ? lockdep_hardirqs_on+0x7a/0x110 [ 2073.479422][ T7303] ? asm_int80_emulation+0x1a/0x20 [ 2073.479432][ T7303] ? do_int80_emulation+0x29f/0x550 [ 2073.479444][ T7303] ? trace_irq_disable+0x3b/0x140 [ 2073.479458][ T7303] do_fast_syscall_32+0x33/0x70 [ 2073.479471][ T7303] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2073.479482][ T7303] RIP: 0023:0xf7f590ec [ 2073.479492][ T7303] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2073.479500][ T7303] RSP: 002b:00000000f541650c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 2073.479511][ T7303] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 2073.479518][ T7303] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 2073.479523][ T7303] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2073.479528][ T7303] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2073.479534][ T7303] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2073.479562][ T7303] [ 2073.768171][T25297] usb 2-1: USB disconnect, device number 11 [ 2073.801522][ T5618] usb 3-1: USB disconnect, device number 99 [ 2073.836603][T25297] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 2073.853952][ T30] audit: type=1326 audit(1786394247.419:6760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7306 comm="syz.3.9335" exe="/root/ci-upstream-kasan-gce-386/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f590ec code=0x0 [ 2073.880283][T25297] cp210x 2-1:0.0: device disconnected [ 2074.005926][ T7318] program syz.0.9333 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2074.044112][ T7318] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9333'. [ 2074.189293][T25297] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 2074.366675][T25297] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2074.380107][T25297] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 2074.394593][ T5773] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 2074.414697][T25297] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2074.427012][T25297] usb 2-1: config 0 descriptor?? [ 2074.449354][T25297] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 2074.576769][ T5773] usb 4-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 2074.594888][ T5773] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2074.619784][ T5773] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2074.644318][ T5773] usb 4-1: Product: syz [ 2074.657786][ T5773] usb 4-1: Manufacturer: syz [ 2074.666748][ T5773] usb 4-1: SerialNumber: syz [ 2074.690454][ T5773] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 2075.344266][ T9] usb 1-1: new full-speed USB device number 126 using dummy_hcd [ 2075.495004][ T9] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2075.509327][T25297] usb 5-1: USB disconnect, device number 68 [ 2075.559515][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2075.612277][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2075.632546][ T9] usb 1-1: Product: syz [ 2075.646413][ T9] usb 1-1: Manufacturer: syz [ 2075.657174][ T9] usb 1-1: SerialNumber: syz [ 2075.679901][ T9] usb 1-1: config 0 descriptor?? [ 2075.695521][ T7353] FAULT_INJECTION: forcing a failure. [ 2075.695521][ T7353] name failslab, interval 1, probability 0, space 0, times 0 [ 2075.696419][ T9] asix 1-1:0.0: probe with driver asix failed with error -22 [ 2075.734316][ T7353] CPU: 1 UID: 0 PID: 7353 Comm: syz.2.9342 Tainted: G L syzkaller #0 PREEMPT(full) [ 2075.734342][ T7353] Tainted: [L]=SOFTLOCKUP [ 2075.734357][ T7353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2075.734367][ T7353] Call Trace: [ 2075.734374][ T7353] [ 2075.734384][ T7353] dump_stack_lvl+0xe8/0x150 [ 2075.734411][ T7353] should_fail_ex+0x40c/0x560 [ 2075.734436][ T7353] should_failslab+0xa8/0x100 [ 2075.734461][ T7353] __kmalloc_cache_noprof+0xa8/0x660 [ 2075.734483][ T7353] ? genl_start+0x1c9/0x6d0 [ 2075.734503][ T7353] ? genl_start+0x1c9/0x6d0 [ 2075.734530][ T7353] genl_start+0x1c9/0x6d0 [ 2075.734559][ T7353] __netlink_dump_start+0x442/0x7b0 [ 2075.734584][ T7353] genl_family_rcv_msg_dumpit+0x213/0x310 [ 2075.734610][ T7353] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 2075.734630][ T7353] ? genl_get_cmd+0x82f/0x960 [ 2075.734656][ T7353] ? __pfx_genl_start+0x10/0x10 [ 2075.734675][ T7353] ? __pfx_genl_dumpit+0x10/0x10 [ 2075.734694][ T7353] ? __pfx_genl_done+0x10/0x10 [ 2075.734717][ T7353] ? __dev_queue_xmit+0x29b/0x3820 [ 2075.734746][ T7353] genl_rcv_msg+0x5e1/0x7a0 [ 2075.734773][ T7353] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2075.734793][ T7353] ? __pfx_psample_nl_cmd_get_group_dumpit+0x10/0x10 [ 2075.734926][ T7353] ? __pfx_ref_tracker_free+0x10/0x10 [ 2075.734945][ T7353] ? __asan_memcpy+0x40/0x70 [ 2075.734962][ T7353] ? __skb_clone+0x5c/0x6c0 [ 2075.734986][ T7353] netlink_rcv_skb+0x226/0x4a0 [ 2075.735006][ T7353] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2075.735028][ T7353] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2075.735060][ T7353] ? down_read+0x2be/0x330 [ 2075.735086][ T7353] genl_rcv+0x28/0x40 [ 2075.735105][ T7353] netlink_unicast+0x7bb/0x940 [ 2075.735132][ T7353] netlink_sendmsg+0x813/0xb40 [ 2075.735151][ T7353] ? __pfx___schedule+0x10/0x10 [ 2075.735176][ T7353] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2075.735199][ T7353] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2075.735221][ T7353] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2075.735238][ T7353] sock_sendmsg_nosec+0x13a/0x180 [ 2075.735262][ T7353] ____sys_sendmsg+0x54e/0x850 [ 2075.735286][ T7353] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2075.735321][ T7353] ___sys_sendmsg+0x2a5/0x360 [ 2075.735337][ T7353] ? __lock_acquire+0x683/0x2cf0 [ 2075.735381][ T7353] ? __pfx____sys_sendmsg+0x10/0x10 [ 2075.735398][ T7353] ? get_pid_task+0x20/0x1f0 [ 2075.735418][ T7353] ? get_pid_task+0x20/0x1f0 [ 2075.735436][ T7353] ? get_pid_task+0x20/0x1f0 [ 2075.735485][ T7353] ? __fget_files+0x2a/0x420 [ 2075.735505][ T7353] ? __fget_files+0x3a2/0x420 [ 2075.735535][ T7353] __sys_sendmsg+0x177/0x240 [ 2075.735555][ T7353] ? __pfx___sys_sendmsg+0x10/0x10 [ 2075.735591][ T7353] __do_fast_syscall_32+0x23e/0x6f0 [ 2075.735613][ T7353] ? do_fast_syscall_32+0x33/0x70 [ 2075.735633][ T7353] ? lockdep_hardirqs_on+0x7a/0x110 [ 2075.735652][ T7353] ? asm_int80_emulation+0x1a/0x20 [ 2075.735667][ T7353] ? do_int80_emulation+0x29f/0x550 [ 2075.735692][ T7353] do_fast_syscall_32+0x33/0x70 [ 2075.735714][ T7353] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2075.735732][ T7353] RIP: 0023:0xf7f170ec [ 2075.735748][ T7353] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2075.735762][ T7353] RSP: 002b:00000000f53d650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2075.735780][ T7353] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 2075.735792][ T7353] RDX: 00000000000000c4 RSI: 0000000000000000 RDI: 0000000000000000 [ 2075.735802][ T7353] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2075.735811][ T7353] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2075.735822][ T7353] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2075.735848][ T7353] [ 2075.805531][ T7324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2076.136639][ T7324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2076.191871][ T5773] gspca_mr97310a: reg read [21] error -71 [ 2076.198734][ T5773] mr97310a 4-1:1.0: probe with driver mr97310a failed with error -71 [ 2076.225775][ T5773] usb 4-1: USB disconnect, device number 80 [ 2076.311155][T15721] usb 1-1: USB disconnect, device number 126 [ 2076.504290][ T9] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 2076.514577][T25297] usb 5-1: new full-speed USB device number 69 using dummy_hcd [ 2076.654795][ T9] usb 3-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 2076.664904][T25297] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2076.665517][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2076.675471][T25297] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2076.685797][ T9] usb 3-1: config 0 descriptor?? [ 2076.693539][T25297] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2076.721493][ T9] cp210x 3-1:0.0: cp210x converter detected [ 2076.726782][T25297] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2076.743176][T25297] usb 5-1: config 0 descriptor?? [ 2076.919801][ T5618] usb 2-1: USB disconnect, device number 12 [ 2076.950067][ T9] usb 3-1: cp210x converter now attached to ttyUSB0 [ 2077.007749][ T7380] FAULT_INJECTION: forcing a failure. [ 2077.007749][ T7380] name failslab, interval 1, probability 0, space 0, times 0 [ 2077.021946][ T7380] CPU: 0 UID: 0 PID: 7380 Comm: syz.1.9349 Tainted: G L syzkaller #0 PREEMPT(full) [ 2077.021971][ T7380] Tainted: [L]=SOFTLOCKUP [ 2077.021977][ T7380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2077.021983][ T7380] Call Trace: [ 2077.021987][ T7380] [ 2077.021991][ T7380] dump_stack_lvl+0xe8/0x150 [ 2077.022010][ T7380] should_fail_ex+0x40c/0x560 [ 2077.022025][ T7380] should_failslab+0xa8/0x100 [ 2077.022044][ T7380] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 2077.022065][ T7380] ? skb_clone+0x212/0x3a0 [ 2077.022082][ T7380] ? skb_clone+0x212/0x3a0 [ 2077.022106][ T7380] skb_clone+0x212/0x3a0 [ 2077.022125][ T7380] __netlink_deliver_tap+0x413/0x860 [ 2077.022144][ T7380] ? netlink_deliver_tap+0x2e/0x1b0 [ 2077.022155][ T7380] netlink_deliver_tap+0x19c/0x1b0 [ 2077.022167][ T7380] netlink_unicast+0x77f/0x940 [ 2077.022182][ T7380] netlink_sendmsg+0x813/0xb40 [ 2077.022208][ T7380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2077.022231][ T7380] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2077.022253][ T7380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2077.022276][ T7380] sock_sendmsg_nosec+0x13a/0x180 [ 2077.022293][ T7380] ____sys_sendmsg+0x54e/0x850 [ 2077.022306][ T7380] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2077.022324][ T7380] ___sys_sendmsg+0x2a5/0x360 [ 2077.022334][ T7380] ? __lock_acquire+0x683/0x2cf0 [ 2077.022356][ T7380] ? __pfx____sys_sendmsg+0x10/0x10 [ 2077.022374][ T7380] ? get_pid_task+0x20/0x1f0 [ 2077.022395][ T7380] ? get_pid_task+0x20/0x1f0 [ 2077.022413][ T7380] ? get_pid_task+0x20/0x1f0 [ 2077.022444][ T7380] ? __fget_files+0x2a/0x420 [ 2077.022456][ T7380] ? __fget_files+0x3a2/0x420 [ 2077.022473][ T7380] __sys_sendmsg+0x177/0x240 [ 2077.022484][ T7380] ? __pfx___sys_sendmsg+0x10/0x10 [ 2077.022517][ T7380] __do_fast_syscall_32+0x23e/0x6f0 [ 2077.022540][ T7380] ? do_fast_syscall_32+0x33/0x70 [ 2077.022559][ T7380] ? lockdep_hardirqs_on+0x7a/0x110 [ 2077.022577][ T7380] ? asm_int80_emulation+0x1a/0x20 [ 2077.022587][ T7380] ? do_int80_emulation+0x29f/0x550 [ 2077.022599][ T7380] ? trace_irq_disable+0x3b/0x140 [ 2077.022612][ T7380] do_fast_syscall_32+0x33/0x70 [ 2077.022625][ T7380] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2077.022636][ T7380] RIP: 0023:0xf7fd70ec [ 2077.022651][ T7380] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2077.022666][ T7380] RSP: 002b:00000000f549650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2077.022684][ T7380] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080006000 [ 2077.022696][ T7380] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2077.022706][ T7380] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2077.022715][ T7380] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2077.022725][ T7380] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2077.022739][ T7380] [ 2077.513794][ T4928] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2077.536277][ T4928] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2077.547447][ T4928] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2077.548919][ T7368] netlink: 'syz.4.9344': attribute type 1 has an invalid length. [ 2077.571425][ T4928] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2077.581299][ T4928] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2077.676122][ T7368] 8021q: adding VLAN 0 to HW filter on device bond6 [ 2077.697970][ T7393] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9345'. [ 2077.713801][T25297] usbhid 5-1:0.0: can't add hid device: -32 [ 2077.725461][ T5773] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 2077.746296][T25297] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 2077.786319][T25297] usb 5-1: USB disconnect, device number 69 [ 2077.867304][ T10] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 2077.905062][ T5773] usb 2-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2077.921681][ T5773] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2077.941643][ T5773] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2077.969883][ T5773] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2077.992418][ T5773] usb 2-1: config 0 descriptor?? [ 2078.019774][ T5773] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 2078.055942][ T10] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 2078.066583][ T10] usb 4-1: config 0 has an invalid interface number: 50 but max is 0 [ 2078.078152][ T10] usb 4-1: config 0 has no interface number 0 [ 2078.084778][ T10] usb 4-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2078.099969][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2078.117173][ T10] usb 4-1: Product: syz [ 2078.121516][ T10] usb 4-1: Manufacturer: syz [ 2078.128429][ T10] usb 4-1: SerialNumber: syz [ 2078.145321][ T10] usb 4-1: config 0 descriptor?? [ 2078.158601][ T10] yurex 4-1:0.50: USB YUREX device now attached to Yurex #0 [ 2078.225077][ T7385] bond1: option mode: unable to set because the bond device has slaves [ 2078.302284][ T7385] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2078.333482][ T7391] bridge0: port 1(bridge_slave_0) entered blocking state [ 2078.335090][ T7385] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2078.349899][ T7391] bridge0: port 1(bridge_slave_0) entered disabled state [ 2078.358188][ T7391] bridge_slave_0: entered allmulticast mode [ 2078.358251][ T5773] usb 2-1: USB disconnect, device number 13 [ 2078.366451][ T7391] bridge_slave_0: entered promiscuous mode [ 2078.393627][ T7391] bridge0: port 2(bridge_slave_1) entered blocking state [ 2078.407869][ T7390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2078.415410][ T7391] bridge0: port 2(bridge_slave_1) entered disabled state [ 2078.420374][ T7390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2078.429694][ T7391] bridge_slave_1: entered allmulticast mode [ 2078.448249][ T7391] bridge_slave_1: entered promiscuous mode [ 2078.454043][T25297] usb 4-1: USB disconnect, device number 81 [ 2078.478087][T25297] yurex 4-1:0.50: USB YUREX #0 now disconnected [ 2078.562450][ T7391] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2078.581986][ T7391] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2078.657697][ T7391] team0: Port device team_slave_0 added [ 2078.667576][ T7391] team0: Port device team_slave_1 added [ 2078.720638][ T7391] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2078.738408][ T7391] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2078.765592][ T7391] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2078.778864][ T7391] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2078.786714][ T7391] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2078.813454][ T7391] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2079.049418][ T7391] hsr_slave_0: entered promiscuous mode [ 2079.059339][ T7391] hsr_slave_1: entered promiscuous mode [ 2079.066135][ T7391] debugfs: 'hsr0' already exists in 'hsr' [ 2079.072318][ T7391] Cannot create hsr debugfs directory [ 2079.177972][ T9131] bridge_slave_0: left allmulticast mode [ 2079.183730][ T9131] bridge_slave_0: left promiscuous mode [ 2079.191478][ T9131] bridge0: port 1(bridge_slave_0) entered disabled state [ 2079.239809][ T10] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 2079.314704][ T5773] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 2079.360308][T25298] usb 3-1: USB disconnect, device number 100 [ 2079.401922][T25298] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 2079.438127][T25298] cp210x 3-1:0.0: device disconnected [ 2079.438341][ T10] usb 2-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 2079.475492][ T5773] usb 4-1: Using ep0 maxpacket: 8 [ 2079.477323][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2079.491703][ T5773] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2079.507785][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2079.515979][ T10] usb 2-1: Product: syz [ 2079.522422][ T7420] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9358'. [ 2079.542466][ T10] usb 2-1: Manufacturer: syz [ 2079.543300][ T5773] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 2079.550004][ T10] usb 2-1: SerialNumber: syz [ 2079.570338][ T5773] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2079.586938][ T5773] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2079.597545][ T5773] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2079.602280][ T10] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 2079.647309][ T5773] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2079.672136][ T5773] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2079.689378][ T4928] Bluetooth: hci4: command tx timeout [ 2079.698456][ T9131] bond1 (unregistering): (slave geneve2): Releasing active interface [ 2079.791928][ T9131] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2079.813698][ T9131] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2079.827621][ T9131] bond0 (unregistering): Released all slaves [ 2079.852898][ T9131] bond1 (unregistering): Released all slaves [ 2079.904362][ T9131] bond2 (unregistering): Released all slaves [ 2079.918821][ T5773] usb 4-1: GET_CAPABILITIES returned 0 [ 2079.935016][ T5773] usbtmc 4-1:16.0: can't read capabilities [ 2079.954616][ T9131] team0: Port device macvlan2 removed [ 2079.989404][ T9131] bond3 (unregistering): Released all slaves [ 2080.041149][ T9131] team0: Port device macvlan3 removed [ 2080.064719][ T9131] bond4 (unregistering): Released all slaves [ 2080.090640][ T9131] bond5 (unregistering): Released all slaves [ 2080.117771][ T9131] team0: Port device macvlan4 removed [ 2080.120354][ T7410] FAULT_INJECTION: forcing a failure. [ 2080.120354][ T7410] name failslab, interval 1, probability 0, space 0, times 0 [ 2080.137810][ T7410] CPU: 1 UID: 0 PID: 7410 Comm: syz.3.9357 Tainted: G L syzkaller #0 PREEMPT(full) [ 2080.137836][ T7410] Tainted: [L]=SOFTLOCKUP [ 2080.137843][ T7410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2080.137852][ T7410] Call Trace: [ 2080.137860][ T7410] [ 2080.137867][ T7410] dump_stack_lvl+0xe8/0x150 [ 2080.137895][ T7410] should_fail_ex+0x40c/0x560 [ 2080.137919][ T7410] should_failslab+0xa8/0x100 [ 2080.137943][ T7410] __kmalloc_noprof+0xfe/0x720 [ 2080.137962][ T7410] ? rcu_is_watching+0x15/0xb0 [ 2080.137985][ T7410] ? tomoyo_realpath_from_path+0xef/0x640 [ 2080.138003][ T7410] ? tomoyo_realpath_from_path+0xef/0x640 [ 2080.138027][ T7410] tomoyo_realpath_from_path+0xef/0x640 [ 2080.138053][ T7410] ? tomoyo_path_number_perm+0x219/0x5f0 [ 2080.138076][ T7410] tomoyo_path_number_perm+0x246/0x5f0 [ 2080.138101][ T7410] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2080.138123][ T7410] ? __lock_acquire+0x683/0x2cf0 [ 2080.138163][ T7410] ? hook_file_ioctl_compat+0x1f0/0x5f0 [ 2080.138206][ T7410] ? __fget_files+0x2a/0x420 [ 2080.138230][ T7410] ? __fget_files+0x3a2/0x420 [ 2080.138248][ T7410] ? __fget_files+0x2a/0x420 [ 2080.138271][ T7410] security_file_ioctl_compat+0xc3/0x2a0 [ 2080.138295][ T7410] __ia32_compat_sys_ioctl+0x139/0x950 [ 2080.138316][ T7410] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 2080.138334][ T7410] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2080.138357][ T7410] ? __fget_files+0x3a2/0x420 [ 2080.138382][ T7410] ? fput+0xa0/0xd0 [ 2080.138405][ T7410] ? ksys_write+0x242/0x270 [ 2080.138439][ T7410] __do_fast_syscall_32+0x23e/0x6f0 [ 2080.138461][ T7410] ? do_fast_syscall_32+0x33/0x70 [ 2080.138480][ T7410] ? lockdep_hardirqs_on+0x7a/0x110 [ 2080.138499][ T7410] ? asm_int80_emulation+0x1a/0x20 [ 2080.138515][ T7410] ? do_int80_emulation+0x29f/0x550 [ 2080.138535][ T7410] ? trace_irq_disable+0x3b/0x140 [ 2080.138557][ T7410] do_fast_syscall_32+0x33/0x70 [ 2080.138579][ T7410] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2080.138597][ T7410] RIP: 0023:0xf7f590ec [ 2080.138613][ T7410] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2080.138626][ T7410] RSP: 002b:00000000f541650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 2080.138644][ T7410] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0145b0e [ 2080.138655][ T7410] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2080.138665][ T7410] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2080.138675][ T7410] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2080.138685][ T7410] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2080.138712][ T7410] [ 2080.139012][ T7410] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2080.328367][ T30] audit: type=1800 audit(1786394253.819:6761): pid=7434 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.9357" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 2080.442239][ T9131] bond6 (unregistering): Released all slaves [ 2080.443016][ T5773] usb 4-1: USB disconnect, device number 82 [ 2080.481722][ T9131] bond7 (unregistering): Released all slaves [ 2080.530036][ T9131] bond8 (unregistering): Released all slaves [ 2080.557060][ T9131] bond9 (unregistering): Released all slaves [ 2080.591992][ T7408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2080.604709][ T7408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2080.613943][ T9131] team0: Port device macvlan5 removed [ 2080.623363][ T10] gspca_mr97310a: reg read [21] error -71 [ 2080.630094][ T10] mr97310a 2-1:1.0: probe with driver mr97310a failed with error -71 [ 2080.653572][ T10] usb 2-1: USB disconnect, device number 14 [ 2080.685341][ T9131] bond10 (unregistering): Released all slaves [ 2080.712328][ T9131] team0: Port device macvlan6 removed [ 2080.733278][ T9131] bond11 (unregistering): Released all slaves [ 2080.767899][ T9131] bond12 (unregistering): Released all slaves [ 2080.796666][ T9131] bond13 (unregistering): Released all slaves [ 2080.830485][ T9131] bond14 (unregistering): Released all slaves [ 2080.852290][ T9131] bond15 (unregistering): Released all slaves [ 2080.874815][ T9131] bond16 (unregistering): Released all slaves [ 2080.892155][ T9131] bond17 (unregistering): Released all slaves [ 2080.908421][ T9131] team0: Port device macvlan8 removed [ 2080.919563][ T9131] bond18 (unregistering): Released all slaves [ 2080.939726][ T9131] bond19 (unregistering): Released all slaves [ 2080.961518][ T9131] team0: Port device macvlan9 removed [ 2080.972887][ T9131] bond20 (unregistering): Released all slaves [ 2081.002579][ T9131] bond21 (unregistering): Released all slaves [ 2081.038535][ T9131] bond22 (unregistering): Released all slaves [ 2081.069753][ T9131] bond23 (unregistering): Released all slaves [ 2081.106516][ T9131] bond24 (unregistering): Released all slaves [ 2081.138105][ T9131] bond25 (unregistering): Released all slaves [ 2081.183244][ T9131] bond26 (unregistering): Released all slaves [ 2081.228965][ T9131] bond27 (unregistering): Released all slaves [ 2081.235236][T25298] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 2081.268627][ T9131] bond28 (unregistering): Released all slaves [ 2081.311124][ T9131] bond29 (unregistering): Released all slaves [ 2081.341733][ T9131] bond30 (unregistering): Released all slaves [ 2081.367282][ T9131] bond31 (unregistering): Released all slaves [ 2081.384253][ T5613] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 2081.401935][ T9131] bond32 (unregistering): Released all slaves [ 2081.414082][T25298] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2081.435260][T25298] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 2081.453704][T25298] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2081.467711][T25298] usb 4-1: config 0 descriptor?? [ 2081.476188][ T9131] bond33 (unregistering): Released all slaves [ 2081.487102][T25298] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 2081.514334][ T5773] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 2081.537786][ T5613] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2081.549824][ T9131] bond34 (unregistering): Released all slaves [ 2081.557024][ T5613] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2081.576259][ T5613] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2081.586050][ T5613] usb 5-1: Product: syz [ 2081.590931][ T9131] bond35 (unregistering): Released all slaves [ 2081.605648][ T5613] usb 5-1: Manufacturer: syz [ 2081.610847][ T5613] usb 5-1: SerialNumber: syz [ 2081.618550][ T5613] usb 5-1: config 0 descriptor?? [ 2081.639990][ T5613] asix 5-1:0.0: probe with driver asix failed with error -22 [ 2081.660200][ T9131] bond36 (unregistering): Released all slaves [ 2081.691229][ T5773] usb 2-1: Using ep0 maxpacket: 8 [ 2081.703328][ T5773] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2081.723944][ T5773] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 2081.739797][ T5773] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2081.749969][ T9131] bond37 (unregistering): Released all slaves [ 2081.760273][ T5773] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2081.774768][ T4928] Bluetooth: hci4: command tx timeout [ 2081.780277][ T5773] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2081.780301][ T5773] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2081.780335][ T5773] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2081.848348][ T5273] 8021q: adding VLAN 0 to HW filter on device eth1 [ 2081.914440][ T7421] bridge0: port 2(syz_tun) entered blocking state [ 2081.935839][ T7421] bridge0: port 2(syz_tun) entered disabled state [ 2081.953128][ T7421] syz_tun: entered allmulticast mode [ 2081.973127][ T7421] syz_tun: entered promiscuous mode [ 2081.978576][ T10] usb 5-1: USB disconnect, device number 70 [ 2082.002654][ T7421] bridge0: port 2(syz_tun) entered blocking state [ 2082.007102][ T5773] usb 2-1: GET_CAPABILITIES returned 0 [ 2082.010260][ T7421] bridge0: port 2(syz_tun) entered forwarding state [ 2082.017800][ T5773] usbtmc 2-1:16.0: can't read capabilities [ 2082.099618][ T7430] bridge0: port 3(bond0) entered blocking state [ 2082.108532][ T7430] bridge0: port 3(bond0) entered disabled state [ 2082.118094][ T7430] bond0: entered allmulticast mode [ 2082.123748][ T7430] bond_slave_0: entered allmulticast mode [ 2082.137919][ T7430] bond_slave_1: entered allmulticast mode [ 2082.146524][ T7430] geneve3: entered allmulticast mode [ 2082.170747][ T7430] bond0: entered promiscuous mode [ 2082.176925][ T7430] bond_slave_0: entered promiscuous mode [ 2082.182763][ T7430] bond_slave_1: entered promiscuous mode [ 2082.190286][ T7430] geneve3: entered promiscuous mode [ 2082.214837][ C1] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 2082.228125][ T7430] bridge0: port 3(bond0) entered blocking state [ 2082.235254][ T7430] bridge0: port 3(bond0) entered forwarding state [ 2082.262853][ T9131] tipc: Disabling bearer [ 2082.269295][ T9131] tipc: Left network mode [ 2082.273887][ T7432] bridge0: port 4(team0) entered blocking state [ 2082.282089][ T7432] bridge0: port 4(team0) entered disabled state [ 2082.290019][ T30] audit: type=1800 audit(1786394255.849:6762): pid=7473 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.9361" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 2082.311133][ T7432] team0: entered allmulticast mode [ 2082.317162][ T7432] team_slave_0: entered allmulticast mode [ 2082.342779][ T7432] team_slave_1: entered allmulticast mode [ 2082.382745][ T7432] team0: entered promiscuous mode [ 2082.387856][ T7432] team_slave_0: entered promiscuous mode [ 2082.403505][ T7432] team_slave_1: entered promiscuous mode [ 2082.420909][ T7432] bridge0: port 4(team0) entered blocking state [ 2082.427299][ T7432] bridge0: port 4(team0) entered forwarding state [ 2082.914753][ T5773] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 2082.939534][ T9131] hsr_slave_0: left promiscuous mode [ 2082.949984][ T9131] hsr_slave_1: left promiscuous mode [ 2082.959378][ T9131] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2082.967820][ T9131] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2083.074449][ T5773] usb 3-1: Using ep0 maxpacket: 8 [ 2083.080295][ T5773] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2083.092785][ T5773] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 2083.107422][ T5773] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2083.117643][ T5773] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2083.128888][ T5773] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2083.139046][ T5773] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2083.152960][ T5773] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2083.181932][ T9131] team0 (unregistering): Port device team_slave_1 removed [ 2083.204556][ T9131] team0 (unregistering): Port device team_slave_0 removed [ 2083.347567][ T5273] 8021q: adding VLAN 0 to HW filter on device eth2 [ 2083.377642][ T5773] usb 3-1: GET_CAPABILITIES returned 0 [ 2083.383541][ T5773] usbtmc 3-1:16.0: can't read capabilities [ 2083.583820][ C0] usbtmc 2-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 2083.655835][ T30] audit: type=1800 audit(1786394257.229:6763): pid=7484 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9362" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 2083.803266][ T9131] IPVS: stop unused estimator thread 0... [ 2083.844637][ T4928] Bluetooth: hci4: command tx timeout [ 2083.853178][ T7391] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2083.866376][ T7391] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 2083.875353][ T7391] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2083.887347][ T7391] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 2083.895903][ T7391] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2083.908313][ T7391] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 2083.916543][ T7391] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2083.928556][ T7391] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 2084.021331][T15721] usb 4-1: USB disconnect, device number 83 [ 2084.071137][ T7391] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2084.116527][ T7391] 8021q: adding VLAN 0 to HW filter on device team0 [ 2084.141896][ T9131] bridge0: port 1(bridge_slave_0) entered blocking state [ 2084.149137][ T9131] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2084.169884][ T9131] bridge0: port 2(bridge_slave_1) entered blocking state [ 2084.177073][ T9131] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2084.277292][ T7391] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2084.301645][ T5613] usb 2-1: USB disconnect, device number 15 [ 2084.350160][ T7391] veth0_vlan: entered promiscuous mode [ 2084.358942][ T10] usb 3-1: USB disconnect, device number 101 [ 2084.375878][ T9] usb 5-1: new full-speed USB device number 71 using dummy_hcd [ 2084.412590][ T7391] veth1_vlan: entered promiscuous mode [ 2084.444645][T15721] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 2084.469727][ T7391] veth0_macvtap: entered promiscuous mode [ 2084.497126][ T7391] veth1_macvtap: entered promiscuous mode [ 2084.546959][ T7391] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2084.565320][ T9] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2084.588300][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2084.595589][ T7391] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2084.607363][T15721] usb 4-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2084.621778][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2084.627940][T15721] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2084.653736][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2084.677179][T15721] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2084.688452][ T9] usb 5-1: config 0 descriptor?? [ 2084.695513][T17894] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2084.713407][T15721] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2084.730212][T17894] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2084.766770][T15721] usb 4-1: config 0 descriptor?? [ 2084.798474][T15721] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 2084.824838][ T9131] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2084.858374][ T9131] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2084.923066][ T9131] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2084.960050][ T9131] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2085.016127][ T7515] bond1: option mode: unable to set because the bond device has slaves [ 2085.049059][T17894] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2085.080185][T17894] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2085.111921][ T7515] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2085.151279][ T7515] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2085.208350][T21373] usb 4-1: USB disconnect, device number 84 [ 2085.336724][ T7514] netlink: 'syz.4.9364': attribute type 1 has an invalid length. [ 2085.392920][ T7551] program syz.0.9351 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2085.470718][ T7514] 8021q: adding VLAN 0 to HW filter on device bond7 [ 2085.523340][ T7551] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9351'. [ 2085.554622][ T2268] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 2085.597282][ T7551] bridge0: port 2(bridge_slave_1) entered disabled state [ 2085.641022][ T7551] bridge_slave_1 (unregistering): left allmulticast mode [ 2085.683787][ T7551] bridge_slave_1 (unregistering): left promiscuous mode [ 2085.704891][ T7551] bridge0: port 2(bridge_slave_1) entered disabled state [ 2085.739244][ T2268] usb 2-1: unable to get BOS descriptor or descriptor too short [ 2085.762036][ T2268] usb 2-1: New USB device found, idVendor=0b05, idProduct=1739, bcdDevice= 0.40 [ 2085.793254][ T2268] usb 2-1: config 1 has an invalid descriptor of length 145, skipping remainder of the config [ 2085.821627][ T2268] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2085.856158][ T2268] usb 2-1: too many endpoints for config 1 interface 1 altsetting 141: 46, using maximum allowed: 30 [ 2085.883978][ T2268] usb 2-1: config 1 interface 1 altsetting 141 has 0 endpoint descriptors, different from the interface descriptor's value: 46 [ 2085.925471][T24088] Bluetooth: hci4: command tx timeout [ 2085.939373][ T2268] usb 2-1: config 1 interface 1 has no altsetting 0 [ 2085.954374][ T2268] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2085.964685][ T2268] usb 2-1: Product: syz [ 2085.973237][ T2268] usb 2-1: Manufacturer: syz [ 2085.985319][ T9] usb 5-1: string descriptor 0 read error: -71 [ 2085.996795][ T2268] usb 2-1: SerialNumber: syz [ 2086.002111][ T9] uclogic 0003:256C:006D.01AD: failed retrieving string descriptor #200: -71 [ 2086.028660][ T9] uclogic 0003:256C:006D.01AD: failed retrieving pen parameters: -71 [ 2086.059084][ T9] uclogic 0003:256C:006D.01AD: failed probing pen v2 parameters: -71 [ 2086.091541][ T9] uclogic 0003:256C:006D.01AD: failed probing parameters: -71 [ 2086.109672][ T9] uclogic 0003:256C:006D.01AD: probe with driver uclogic failed with error -71 [ 2086.125512][ T9] usb 5-1: USB disconnect, device number 71 [ 2086.905772][T15721] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 2087.087412][T15721] usb 3-1: New USB device found, idVendor=0e8d, idProduct=0608, bcdDevice= 1.00 [ 2087.108250][T15721] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 2087.118641][T15721] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 2087.144553][T15721] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2087.170002][T15721] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 2087.189497][T15721] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2087.210199][ T7576] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 2087.227790][ T7576] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 2087.229077][T21373] usb 5-1: new full-speed USB device number 72 using dummy_hcd [ 2087.318932][ T7569] netlink: 'syz.3.9370': attribute type 4 has an invalid length. [ 2087.327453][ T4928] Bluetooth: hci3: urb ffff888026cfab00 submission failed (90) [ 2087.383102][ T7569] netlink: 'syz.3.9370': attribute type 4 has an invalid length. [ 2087.436682][T21373] usb 5-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2087.472056][T21373] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2087.478439][ T5773] usb 3-1: USB disconnect, device number 102 [ 2087.507902][T21373] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2087.521175][T21373] usb 5-1: Product: syz [ 2087.531264][T21373] usb 5-1: Manufacturer: syz [ 2087.542976][T21373] usb 5-1: SerialNumber: syz [ 2087.580569][T21373] usb 5-1: config 0 descriptor?? [ 2087.600020][T21373] asix 5-1:0.0: probe with driver asix failed with error -22 [ 2087.734573][ T9] usb 1-1: new full-speed USB device number 127 using dummy_hcd [ 2087.897441][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2087.911536][ T9] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2087.924209][ T9] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2087.942621][ T9] usb 1-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2087.951607][ T9] usb 1-1: Product: syz [ 2087.956359][ T9] usb 1-1: Manufacturer: syz [ 2087.970279][ T9] hub 1-1:4.0: USB hub found [ 2088.054569][T21373] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 2088.151257][ T5618] usb 5-1: USB disconnect, device number 72 [ 2088.193617][ T7594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2088.206274][ T7594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2088.228524][T21373] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2088.248897][T21373] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 2088.262776][T21373] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2088.279202][ T2268] usb 2-1: unit 5 not found! [ 2088.287135][T21373] usb 4-1: config 0 descriptor?? [ 2088.305504][ T9] hub 1-1:4.0: config failed, hub has too many ports! (err -19) [ 2088.313312][T21373] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 2088.344261][T15721] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 2088.402489][ T2268] usb 2-1: USB disconnect, device number 16 [ 2088.470172][ T5620] udevd[5620]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2088.534738][T15721] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2088.544953][T15721] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2088.556914][T15721] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2088.569044][T15721] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2088.578921][T15721] usb 3-1: Product: syz [ 2088.583102][T15721] usb 3-1: Manufacturer: syz [ 2088.593430][T15721] hub 3-1:4.0: USB hub found [ 2088.624476][ T5618] usb 1-1: USB disconnect, device number 127 [ 2088.803358][ T7612] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2088.813906][ T2268] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 2088.825007][ T7612] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2088.898514][T15721] hub 3-1:4.0: config failed, hub has too many ports! (err -19) [ 2088.971738][ T7626] syzkaller0: entered promiscuous mode [ 2088.977513][ T7626] syzkaller0: entered allmulticast mode [ 2088.988859][ T7626] FAULT_INJECTION: forcing a failure. [ 2088.988859][ T7626] name failslab, interval 1, probability 0, space 0, times 0 [ 2089.001679][ T7626] CPU: 1 UID: 0 PID: 7626 Comm: syz.4.9379 Tainted: G L syzkaller #0 PREEMPT(full) [ 2089.001703][ T7626] Tainted: [L]=SOFTLOCKUP [ 2089.001709][ T7626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2089.001719][ T7626] Call Trace: [ 2089.001726][ T7626] [ 2089.001733][ T7626] dump_stack_lvl+0xe8/0x150 [ 2089.001760][ T7626] should_fail_ex+0x40c/0x560 [ 2089.001784][ T7626] should_failslab+0xa8/0x100 [ 2089.001806][ T7626] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 2089.001820][ T7626] ? local_lock_release+0x9c/0x160 [ 2089.001835][ T7626] ? __alloc_skb+0x1d7/0x7a0 [ 2089.001844][ T7626] ? __alloc_skb+0x1d7/0x7a0 [ 2089.001862][ T7626] __alloc_skb+0x1d7/0x7a0 [ 2089.001880][ T7626] netlink_sendmsg+0x5d4/0xb40 [ 2089.001906][ T7626] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2089.001927][ T7626] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2089.001946][ T7626] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2089.001961][ T7626] sock_sendmsg_nosec+0x13a/0x180 [ 2089.001984][ T7626] ____sys_sendmsg+0x54e/0x850 [ 2089.002007][ T7626] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2089.002045][ T7626] ___sys_sendmsg+0x2a5/0x360 [ 2089.002061][ T7626] ? __lock_acquire+0x683/0x2cf0 [ 2089.002084][ T7626] ? __pfx____sys_sendmsg+0x10/0x10 [ 2089.002100][ T7626] ? get_pid_task+0x20/0x1f0 [ 2089.002119][ T7626] ? get_pid_task+0x20/0x1f0 [ 2089.002137][ T7626] ? get_pid_task+0x20/0x1f0 [ 2089.002180][ T7626] ? __fget_files+0x2a/0x420 [ 2089.002196][ T2268] usb 2-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 2089.002198][ T7626] ? __fget_files+0x3a2/0x420 [ 2089.002226][ T7626] __sys_sendmsg+0x177/0x240 [ 2089.002244][ T7626] ? __pfx___sys_sendmsg+0x10/0x10 [ 2089.002277][ T7626] __do_fast_syscall_32+0x23e/0x6f0 [ 2089.002299][ T7626] ? do_fast_syscall_32+0x33/0x70 [ 2089.002318][ T7626] ? lockdep_hardirqs_on+0x7a/0x110 [ 2089.002337][ T7626] ? asm_int80_emulation+0x1a/0x20 [ 2089.002352][ T7626] ? do_int80_emulation+0x29f/0x550 [ 2089.002370][ T7626] ? trace_irq_disable+0x3b/0x140 [ 2089.002392][ T7626] do_fast_syscall_32+0x33/0x70 [ 2089.002412][ T7626] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2089.002431][ T7626] RIP: 0023:0xf700f0ec [ 2089.002446][ T7626] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2089.002461][ T7626] RSP: 002b:00000000f53fd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2089.002479][ T7626] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800002c0 [ 2089.002489][ T7626] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 2089.002499][ T7626] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2089.002508][ T7626] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2089.002517][ T7626] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2089.002541][ T7626] [ 2089.288684][ T2268] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2089.300648][ T2268] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2089.310462][ T2268] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2089.318732][ T5773] usb 3-1: USB disconnect, device number 103 [ 2089.321650][ T2268] usb 2-1: config 0 descriptor?? [ 2089.384845][T15721] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 2089.524231][T15721] usb 1-1: device descriptor read/64, error -71 [ 2089.538217][ T2268] hid_parser_main: 27 callbacks suppressed [ 2089.538236][ T2268] cm6533_jd 0003:0D8C:0022.01AE: unknown main item tag 0x0 [ 2089.554580][ T2268] cm6533_jd 0003:0D8C:0022.01AE: unknown main item tag 0x0 [ 2089.569851][ T2268] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0D8C:0022.01AE/input/input394 [ 2089.628572][ T2268] cm6533_jd 0003:0D8C:0022.01AE: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.1-1/input0 [ 2089.658663][ T2268] usb 2-1: USB disconnect, device number 17 [ 2089.664728][ T5618] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 2089.738476][ T7638] fido_id[7638]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 2089.769300][T15721] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 2089.816624][ T5618] usb 5-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2089.831019][ T5618] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2089.851323][ T5618] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2089.865375][ T5618] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2089.879274][ T5618] usb 5-1: config 0 descriptor?? [ 2089.889276][ T5618] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 2089.914920][T15721] usb 1-1: device descriptor read/64, error -71 [ 2090.045077][T15721] usb usb1-port1: attempt power cycle [ 2090.064711][ T5773] usb 3-1: new full-speed USB device number 104 using dummy_hcd [ 2090.091236][ T7633] bond1: option mode: unable to set because the bond device has slaves [ 2090.164748][ T7633] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2090.175530][ T7633] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2090.200513][ T5618] usb 5-1: USB disconnect, device number 73 [ 2090.236803][ T5773] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2090.248589][ T5773] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2090.261614][ T5773] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2090.271564][ T5773] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2090.289913][ T5773] usb 3-1: config 0 descriptor?? [ 2090.384431][T15721] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 2090.415431][T15721] usb 1-1: device descriptor read/8, error -71 [ 2090.648101][ T7647] program syz.1.9384 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2090.664240][T15721] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 2090.665720][ T7647] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9384'. [ 2090.696286][T15721] usb 1-1: device descriptor read/8, error -71 [ 2090.808896][T25298] usb 4-1: USB disconnect, device number 85 [ 2090.818013][T15721] usb usb1-port1: unable to enumerate USB device [ 2090.865954][ T7650] syzkaller0: entered promiscuous mode [ 2090.872309][ T7650] syzkaller0: entered allmulticast mode [ 2090.889069][ T7649] tipc: Enabled bearer , priority 0 [ 2090.911675][ T7641] netlink: 'syz.2.9383': attribute type 1 has an invalid length. [ 2090.948793][ T7648] tipc: Resetting bearer [ 2090.974933][ T7648] tipc: Disabling bearer [ 2091.014937][ T7641] 8021q: adding VLAN 0 to HW filter on device bond12 [ 2091.167751][ T5773] usb 3-1: string descriptor 0 read error: -71 [ 2091.176876][ T5773] uclogic 0003:256C:006D.01AF: failed retrieving string descriptor #200: -71 [ 2091.192921][ T5773] uclogic 0003:256C:006D.01AF: failed retrieving pen parameters: -71 [ 2091.204744][ T5773] uclogic 0003:256C:006D.01AF: failed probing pen v2 parameters: -71 [ 2091.213698][ T5773] uclogic 0003:256C:006D.01AF: failed probing parameters: -71 [ 2091.221663][ T5773] uclogic 0003:256C:006D.01AF: probe with driver uclogic failed with error -71 [ 2091.247655][ T5773] usb 3-1: USB disconnect, device number 104 [ 2091.354223][T25298] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 2091.518889][T25298] usb 5-1: Using ep0 maxpacket: 16 [ 2091.541141][T25298] usb 5-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 2091.572451][T25298] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2091.581939][T25298] usb 5-1: Product: syz [ 2091.599434][T25298] usb 5-1: Manufacturer: syz [ 2091.612703][T25298] usb 5-1: SerialNumber: syz [ 2091.632009][T25298] usb 5-1: config 0 descriptor?? [ 2091.667751][T25298] visor 5-1:0.0: Sony Clie 3.5 converter detected [ 2091.922686][ T7658] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9387'. [ 2092.169592][T25298] usb 5-1: clie_3_5_startup: get interface number failed: -71 [ 2092.180335][T25298] visor 5-1:0.0: probe with driver visor failed with error -71 [ 2092.197116][T25298] usb 5-1: USB disconnect, device number 74 [ 2092.234591][ T9] usb 3-1: new full-speed USB device number 105 using dummy_hcd [ 2092.395054][ T9] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2092.407451][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2092.423376][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2092.432373][ T9] usb 3-1: Product: syz [ 2092.436953][ T9] usb 3-1: Manufacturer: syz [ 2092.441673][ T9] usb 3-1: SerialNumber: syz [ 2092.452377][ T9] usb 3-1: config 0 descriptor?? [ 2092.461741][ T9] asix 3-1:0.0: probe with driver asix failed with error -22 [ 2092.514912][ T5773] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 2092.665842][T15721] usb 3-1: USB disconnect, device number 105 [ 2092.679218][ T5773] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2092.709342][ T5773] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2092.737521][ T5773] usb 1-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2092.754550][ T5773] usb 1-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2092.773772][ T5773] usb 1-1: Product: syz [ 2092.778977][ T7696] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9392'. [ 2092.790053][ T5773] usb 1-1: Manufacturer: syz [ 2092.800650][ T7696] netlink: 104 bytes leftover after parsing attributes in process `syz.3.9392'. [ 2092.805705][ T5773] hub 1-1:4.0: USB hub found [ 2092.814389][ T7696] netlink: 104 bytes leftover after parsing attributes in process `syz.3.9392'. [ 2093.023698][ T7680] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2093.036570][ T7680] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2093.105214][ T5773] hub 1-1:4.0: config failed, hub has too many ports! (err -19) [ 2093.224224][T15721] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 2093.244402][T25298] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 2093.254472][ T9] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 2093.385923][T15721] usb 5-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2093.399162][T15721] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2093.411375][T15721] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2093.427537][T25298] usb 2-1: Using ep0 maxpacket: 16 [ 2093.435181][ T5613] usb 1-1: USB disconnect, device number 6 [ 2093.441294][T25298] usb 2-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 2093.455400][ T5773] usb 3-1: new full-speed USB device number 106 using dummy_hcd [ 2093.465957][T15721] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2093.476723][T25298] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 2093.496374][ T9] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 2093.514855][ T9] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 2093.515942][T15721] usb 5-1: config 0 descriptor?? [ 2093.531022][ T9] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 2093.547421][ T9] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 2093.558027][ T9] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2093.566238][T15721] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 2093.577874][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2093.578613][T25298] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2093.605013][T25298] usb 2-1: Product: syz [ 2093.610387][T25298] usb 2-1: Manufacturer: syz [ 2093.612501][ T9] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2093.628924][T25298] usb 2-1: SerialNumber: syz [ 2093.629723][ T9] usb 4-1: invalid MIDI out EP 0 [ 2093.645022][ T5773] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2093.658599][ T5773] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2093.674072][T25298] usb 2-1: config 0 descriptor?? [ 2093.721313][ T5773] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2093.733251][T25298] hub 2-1:0.0: bad descriptor, ignoring hub [ 2093.744574][T25298] hub 2-1:0.0: probe with driver hub failed with error -5 [ 2093.759627][ T5773] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2093.790962][ T7708] bond1: option mode: unable to set because the bond device has slaves [ 2093.800495][ T5773] usb 3-1: config 0 descriptor?? [ 2093.857160][ T7710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2093.870598][ T9] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 2093.881500][T25298] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 2093.889038][ T7710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2093.977340][ T7708] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2093.994633][ T7708] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2094.015861][ T2268] usb 5-1: USB disconnect, device number 75 [ 2094.054116][ T5773] usbhid 3-1:0.0: can't add hid device: -71 [ 2094.073816][ T5773] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 2094.100457][ T7724] vcan0: tx drop: invalid da for name 0x0000000000000002 [ 2094.136311][T25298] usb 2-1: USB disconnect, device number 18 [ 2094.142397][ T5773] usb 3-1: USB disconnect, device number 106 [ 2094.207663][ T9] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 2094.371080][ T7728] program syz.2.9401 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2094.404853][ T9] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2094.424915][ T7728] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9401'. [ 2094.435798][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2094.453697][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2094.474577][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2094.491877][ T9] usb 1-1: config 0 descriptor?? [ 2094.865623][ T2268] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 2095.025304][ T2268] usb 5-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 2095.038426][ T2268] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2095.071035][ T2268] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2095.107781][ T2268] usb 5-1: Product: syz [ 2095.118248][ T7719] netlink: 'syz.0.9399': attribute type 1 has an invalid length. [ 2095.135636][ T2268] usb 5-1: Manufacturer: syz [ 2095.154383][ T2268] usb 5-1: SerialNumber: syz [ 2095.190414][ T2268] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 2095.249210][ T7719] 8021q: VLANs not supported on nlmon0 [ 2095.344579][ T9] usb 1-1: string descriptor 0 read error: -71 [ 2095.358606][ T9] uclogic 0003:256C:006D.01B0: failed retrieving string descriptor #200: -71 [ 2095.380183][ T9] uclogic 0003:256C:006D.01B0: failed retrieving pen parameters: -71 [ 2095.389577][ T9] uclogic 0003:256C:006D.01B0: failed probing pen v2 parameters: -71 [ 2095.401780][ T9] uclogic 0003:256C:006D.01B0: failed probing parameters: -71 [ 2095.412861][ T9] uclogic 0003:256C:006D.01B0: probe with driver uclogic failed with error -71 [ 2095.478766][ T9] usb 1-1: USB disconnect, device number 7 [ 2095.504231][ T5773] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 2095.686406][ T5773] usb 2-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 2095.699168][ T5773] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2095.711894][ T5773] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2095.720467][ T5773] usb 2-1: Product: syz [ 2095.725213][ T5773] usb 2-1: Manufacturer: syz [ 2095.729901][ T5773] usb 2-1: SerialNumber: syz [ 2095.746549][ T5773] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 2095.933863][ T7745] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9407'. [ 2096.220024][ T7730] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2096.229312][ T7730] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2096.242442][ T2268] gspca_mr97310a: reg read [21] error -71 [ 2096.249811][ T2268] mr97310a 5-1:1.0: probe with driver mr97310a failed with error -71 [ 2096.284318][ T2268] usb 5-1: USB disconnect, device number 76 [ 2096.331898][T15721] usb 4-1: USB disconnect, device number 86 [ 2096.338502][T25298] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 2096.505046][T25298] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2096.516279][T25298] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2096.527758][T25298] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 2096.546869][T25298] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 2096.560789][T25298] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2096.570061][T25298] usb 1-1: Product: syz [ 2096.575187][T25298] usb 1-1: Manufacturer: syz [ 2096.580955][T25298] usb 1-1: SerialNumber: syz [ 2096.590116][ T7749] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 2096.734233][T15721] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 2096.754863][ T7739] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2096.764779][ T7739] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2096.780939][ T5773] gspca_mr97310a: reg read [21] error -71 [ 2096.787027][ T5773] mr97310a 2-1:1.0: probe with driver mr97310a failed with error -71 [ 2096.805736][ T5773] usb 2-1: USB disconnect, device number 19 [ 2096.813496][ T7749] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 2096.835496][ T9] usb 3-1: new full-speed USB device number 107 using dummy_hcd [ 2096.891611][T15721] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2096.907968][T15721] usb 4-1: New USB device found, idVendor=0b05, idProduct=1739, bcdDevice= 0.40 [ 2096.920882][T15721] usb 4-1: config 1 has an invalid descriptor of length 145, skipping remainder of the config [ 2096.931719][T15721] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 2096.940883][T15721] usb 4-1: too many endpoints for config 1 interface 1 altsetting 141: 46, using maximum allowed: 30 [ 2096.957706][T15721] usb 4-1: config 1 interface 1 altsetting 141 has 0 endpoint descriptors, different from the interface descriptor's value: 46 [ 2096.978878][T15721] usb 4-1: config 1 interface 1 has no altsetting 0 [ 2096.995911][T15721] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2097.005043][T15721] usb 4-1: Product: syz [ 2097.006049][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2097.015159][T15721] usb 4-1: Manufacturer: syz [ 2097.024823][T15721] usb 4-1: SerialNumber: syz [ 2097.025621][ T9] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2097.042673][ T9] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2097.055435][ T9] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2097.064227][ T9] usb 3-1: Product: syz [ 2097.076039][ T9] usb 3-1: Manufacturer: syz [ 2097.089024][ T9] hub 3-1:4.0: USB hub found [ 2097.324925][ T7755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2097.336471][ T7763] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9412'. [ 2097.367127][ T7755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2097.378800][ T7765] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2097.469720][ T9] hub 3-1:4.0: config failed, hub has too many ports! (err -19) [ 2097.764254][ T5773] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 2097.797579][T15721] usb 4-1: unit 5 not found! [ 2097.832453][ T7749] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 2097.863822][T15721] usb 4-1: USB disconnect, device number 87 [ 2097.887926][ T9] usb 3-1: USB disconnect, device number 107 [ 2097.954886][ T5773] usb 2-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2097.970177][ T5773] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2097.981579][ T6118] udevd[6118]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2097.997781][ T5773] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2097.997824][ T5773] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2098.000694][ T5773] usb 2-1: config 0 descriptor?? [ 2098.055281][ T5773] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 2098.106062][T25298] cdc_ncm 1-1:1.0: failed to get mac address [ 2098.112491][T25298] cdc_ncm 1-1:1.0: bind() failure [ 2098.121029][T25298] cdc_ncm 1-1:1.1: probe with driver cdc_ncm failed with error -71 [ 2098.130113][T25298] cdc_mbim 1-1:1.1: probe with driver cdc_mbim failed with error -71 [ 2098.141590][T25298] usbtest 1-1:1.1: probe with driver usbtest failed with error -71 [ 2098.155284][T25298] usb 1-1: USB disconnect, device number 8 [ 2098.254885][ T7768] bond1: option mode: unable to set because the bond device has slaves [ 2098.274267][ T9] usb 5-1: new full-speed USB device number 77 using dummy_hcd [ 2098.325493][ T7768] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2098.349352][ T7768] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2098.372762][ T2268] usb 2-1: USB disconnect, device number 20 [ 2098.404650][ T9] usb 5-1: device descriptor read/64, error -71 [ 2098.674267][ T9] usb 5-1: new full-speed USB device number 78 using dummy_hcd [ 2098.694204][T25298] usb 4-1: new full-speed USB device number 88 using dummy_hcd [ 2098.726247][ T1307] ieee802154 phy0 wpan0: encryption failed: -22 [ 2098.732582][ T1307] ieee802154 phy1 wpan1: encryption failed: -22 [ 2098.804425][ T9] usb 5-1: device descriptor read/64, error -71 [ 2098.864943][T25298] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2098.885810][T25298] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2098.923911][T25298] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2098.935546][ T9] usb usb5-port1: attempt power cycle [ 2098.954241][T25298] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2098.969325][T25298] usb 4-1: config 0 descriptor?? [ 2099.294234][ T9] usb 5-1: new full-speed USB device number 79 using dummy_hcd [ 2099.315462][ T9] usb 5-1: device descriptor read/8, error -71 [ 2099.384234][ T2268] usb 2-1: new full-speed USB device number 21 using dummy_hcd [ 2099.487419][T15721] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 2099.545206][ T2268] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 2099.556403][ T2268] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2099.569522][ T9] usb 5-1: new full-speed USB device number 80 using dummy_hcd [ 2099.590000][ T2268] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 2099.607151][ T2268] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 2099.619439][ T9] usb 5-1: device descriptor read/8, error -71 [ 2099.629841][ T2268] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 2099.643592][ T2268] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2099.663091][ T2268] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 2099.671806][ T2268] usb 2-1: Product: syz [ 2099.680960][ T2268] usb 2-1: Manufacturer: syz [ 2099.686237][ T2268] usb 2-1: SerialNumber: syz [ 2099.694979][ T7783] netlink: 'syz.3.9418': attribute type 1 has an invalid length. [ 2099.704963][ T2268] usb 2-1: config 0 descriptor?? [ 2099.730138][ T7783] 8021q: adding VLAN 0 to HW filter on device bond3 [ 2099.744919][ T9] usb usb5-port1: unable to enumerate USB device [ 2099.788892][T25298] usb 4-1: string descriptor 0 read error: -71 [ 2099.795982][T25298] uclogic 0003:256C:006D.01B1: failed retrieving string descriptor #200: -71 [ 2099.808825][T25298] uclogic 0003:256C:006D.01B1: failed retrieving pen parameters: -71 [ 2099.817453][T25298] uclogic 0003:256C:006D.01B1: failed probing pen v2 parameters: -71 [ 2099.827350][T25298] uclogic 0003:256C:006D.01B1: failed probing parameters: -71 [ 2099.835030][T25298] uclogic 0003:256C:006D.01B1: probe with driver uclogic failed with error -71 [ 2099.846088][T15721] usb 1-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 2099.859787][T25298] usb 4-1: USB disconnect, device number 88 [ 2099.868690][T15721] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2099.887793][T15721] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2099.895902][T15721] usb 1-1: Product: syz [ 2099.900070][T15721] usb 1-1: Manufacturer: syz [ 2099.915108][T15721] usb 1-1: SerialNumber: syz [ 2099.931136][T15721] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 2099.948892][ T2268] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 2099.956026][ T2268] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 2100.155540][ T2268] radio-si470x 2-1:0.0: si470x_get_report: usb_control_msg returned -32 [ 2100.156319][ T7798] netlink: 76 bytes leftover after parsing attributes in process `syz.1.9425'. [ 2100.164150][ T2268] radio-si470x 2-1:0.0: si470x_get_scratch: si470x_get_report returned -32 [ 2100.183056][ T2268] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -5 [ 2100.254016][ T2268] usb 2-1: USB disconnect, device number 21 [ 2100.314709][ T5773] usb 3-1: new full-speed USB device number 108 using dummy_hcd [ 2100.359325][ T7811] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9428'. [ 2100.466217][ T5773] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2100.477723][ T5773] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2100.490668][ T5773] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2100.503423][ T5773] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2100.515422][ T5773] usb 3-1: Product: syz [ 2100.524316][ T5773] usb 3-1: Manufacturer: syz [ 2100.539862][ T5773] hub 3-1:4.0: USB hub found [ 2100.752832][ T7808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2100.767136][ T7808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2100.870423][ T5773] hub 3-1:4.0: config failed, hub has too many ports! (err -19) [ 2100.906415][ T7794] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2100.923114][ T7794] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2100.947707][T15721] gspca_mr97310a: reg read [21] error -71 [ 2100.954541][T15721] mr97310a 1-1:1.0: probe with driver mr97310a failed with error -71 [ 2100.970521][T15721] usb 1-1: USB disconnect, device number 9 [ 2101.204877][ T9] usb 3-1: USB disconnect, device number 108 [ 2101.210968][ T2268] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 2101.376191][ T2268] usb 2-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2101.384594][T15721] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 2101.386743][ T2268] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2101.403170][ T2268] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2101.416266][ T2268] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2101.428118][ T2268] usb 2-1: config 0 descriptor?? [ 2101.437268][ T2268] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 2101.534227][T15721] usb 5-1: Using ep0 maxpacket: 32 [ 2101.539902][T15721] usb 5-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 2101.553474][T15721] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2101.562862][T15721] usb 5-1: Product: syz [ 2101.567554][T15721] usb 5-1: Manufacturer: syz [ 2101.572149][T15721] usb 5-1: SerialNumber: syz [ 2101.585394][T15721] usb 5-1: config 0 descriptor?? [ 2101.598447][T15721] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 2101.631442][T15721] dvb-usb: bulk message failed: -22 (4/0) [ 2101.641189][ T7833] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9435'. [ 2101.658280][T15721] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 2101.673772][ T7823] bond1: option mode: unable to set because the bond device has slaves [ 2101.689038][T15721] dvb-usb: bulk message failed: -22 (5/0) [ 2101.707506][T15721] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 2101.741511][ T7839] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9435'. [ 2101.768391][T15721] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2101.790012][ T7840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2101.799933][ T7827] dvb-usb: bulk message failed: -22 (7/0) [ 2101.805742][T15721] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 2101.817050][ T7840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2101.825097][T15721] usb 5-1: media controller created [ 2101.844012][ T7827] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 2101.867014][ T7827] ttusb2: i2c transfer failed. [ 2101.872218][ T7843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9433'. [ 2101.882930][T15721] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2101.894688][ T7843] batman_adv: batadv0: Adding interface: veth0 [ 2101.905573][ T7843] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2101.938906][T15721] usb 5-1: selecting invalid altsetting 3 [ 2101.945083][T15721] ttusb2: set interface to alts=3 failed [ 2101.962175][ T7843] batman_adv: batadv0: Interface activated: veth0 [ 2102.004414][ T2268] usb 3-1: new full-speed USB device number 109 using dummy_hcd [ 2102.032083][T15721] DVB: Unable to find symbol tda10086_attach() [ 2102.049342][T15721] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 2102.062931][ T7843] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2102.070680][ T5618] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 2102.085854][T15721] dvb-usb: bulk message failed: -22 (4/0) [ 2102.093244][T15721] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 2102.103764][ T7843] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2102.104894][T15721] dvb-usb: bulk message failed: -22 (5/0) [ 2102.119091][ T7847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2102.127841][T15721] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 2102.129182][ T7843] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2102.139260][ T7847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2102.154218][T15721] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 2102.187581][ T2268] usb 3-1: New USB device found, idVendor=0a07, idProduct=00d0, bcdDevice=10.13 [ 2102.201402][ T7843] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2102.209844][ T2268] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 10 [ 2102.221141][ T2268] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 2102.231509][ T2268] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 2102.242939][ T2268] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 2102.254305][ T7843] batman_adv: batadv0: Interface deactivated: veth0 [ 2102.261553][ T7843] batman_adv: batadv0: Removing interface: veth0 [ 2102.267978][ T5773] usb 4-1: new full-speed USB device number 89 using dummy_hcd [ 2102.275774][ T5618] usb 1-1: Using ep0 maxpacket: 16 [ 2102.286144][ T2268] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2102.295692][ T2268] usb 3-1: Product: syz [ 2102.302279][ T2268] usb 3-1: Manufacturer: syz [ 2102.311149][ T2268] usb 3-1: SerialNumber: syz [ 2102.320363][ T2268] usb 3-1: config 0 descriptor?? [ 2102.327328][ T5618] usb 1-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 2102.341103][ T5618] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 2102.354634][ T5618] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2102.372184][ T5618] usb 1-1: config 0 descriptor?? [ 2102.418707][T15721] usb 5-1: USB disconnect, device number 81 [ 2102.427060][ T5773] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2102.452435][ T5773] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2102.481149][ T5773] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2102.493420][T15721] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 2102.504805][ T5773] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2102.532708][ T5773] usb 4-1: config 0 descriptor?? [ 2102.553621][ T7835] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2102.572658][ T7835] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2102.596101][ T2268] adutux 3-1:0.0: Could not retrieve serial number [ 2102.610727][ T2268] adutux 3-1:0.0: probe with driver adutux failed with error -5 [ 2102.807734][ T2268] usb 3-1: USB disconnect, device number 109 [ 2103.160504][ T7846] netlink: 'syz.3.9439': attribute type 1 has an invalid length. [ 2103.235527][ T7846] 8021q: adding VLAN 0 to HW filter on device bond4 [ 2103.340755][ T5773] usb 4-1: string descriptor 0 read error: -71 [ 2103.347828][ T5773] uclogic 0003:256C:006D.01B2: failed retrieving string descriptor #200: -71 [ 2103.357847][ T5773] uclogic 0003:256C:006D.01B2: failed retrieving pen parameters: -71 [ 2103.366768][ T5773] uclogic 0003:256C:006D.01B2: failed probing pen v2 parameters: -71 [ 2103.375807][ T5773] uclogic 0003:256C:006D.01B2: failed probing parameters: -71 [ 2103.383509][ T5773] uclogic 0003:256C:006D.01B2: probe with driver uclogic failed with error -71 [ 2103.398151][ T5773] usb 4-1: USB disconnect, device number 89 [ 2103.778289][ T7863] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2104.028222][T25297] usb 2-1: USB disconnect, device number 22 [ 2104.331064][ T7861] netlink: 'syz.2.9442': attribute type 4 has an invalid length. [ 2104.347672][ T7861] netlink: 'syz.2.9442': attribute type 4 has an invalid length. [ 2104.405207][T25297] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 2104.534256][ T5773] usb 5-1: new full-speed USB device number 82 using dummy_hcd [ 2104.567513][T25297] usb 2-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 2104.600821][T25297] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2104.632351][T25297] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2104.633468][ T5618] usbhid 1-1:0.0: can't add hid device: -71 [ 2104.641598][T25297] usb 2-1: Product: syz [ 2104.662268][ T5618] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 2104.683597][ T5618] usb 1-1: USB disconnect, device number 10 [ 2104.683969][T25297] usb 2-1: Manufacturer: syz [ 2104.706440][T25297] usb 2-1: SerialNumber: syz [ 2104.719208][ T5773] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2104.737820][ T7886] FAULT_INJECTION: forcing a failure. [ 2104.737820][ T7886] name failslab, interval 1, probability 0, space 0, times 0 [ 2104.762519][ T5773] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2104.777917][ T7886] CPU: 0 UID: 0 PID: 7886 Comm: syz.0.9449 Tainted: G L syzkaller #0 PREEMPT(full) [ 2104.777943][ T7886] Tainted: [L]=SOFTLOCKUP [ 2104.777950][ T7886] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2104.777959][ T7886] Call Trace: [ 2104.777965][ T7886] [ 2104.777973][ T7886] dump_stack_lvl+0xe8/0x150 [ 2104.778001][ T7886] should_fail_ex+0x40c/0x560 [ 2104.778025][ T7886] should_failslab+0xa8/0x100 [ 2104.778048][ T7886] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 2104.778067][ T7886] ? skb_clone+0x212/0x3a0 [ 2104.778083][ T7886] ? skb_clone+0x212/0x3a0 [ 2104.778107][ T7886] skb_clone+0x212/0x3a0 [ 2104.778128][ T7886] __netlink_deliver_tap+0x413/0x860 [ 2104.778157][ T7886] ? netlink_deliver_tap+0x2e/0x1b0 [ 2104.778176][ T7886] netlink_deliver_tap+0x19c/0x1b0 [ 2104.778197][ T7886] netlink_unicast+0x77f/0x940 [ 2104.778224][ T7886] netlink_sendmsg+0x813/0xb40 [ 2104.778250][ T7886] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2104.778271][ T7886] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2104.778292][ T7886] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2104.778309][ T7886] sock_sendmsg_nosec+0x13a/0x180 [ 2104.778332][ T7886] ____sys_sendmsg+0x54e/0x850 [ 2104.778355][ T7886] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2104.778387][ T7886] ___sys_sendmsg+0x2a5/0x360 [ 2104.778403][ T7886] ? __lock_acquire+0x683/0x2cf0 [ 2104.778426][ T7886] ? __pfx____sys_sendmsg+0x10/0x10 [ 2104.778443][ T7886] ? get_pid_task+0x20/0x1f0 [ 2104.778463][ T7886] ? get_pid_task+0x20/0x1f0 [ 2104.778481][ T7886] ? get_pid_task+0x20/0x1f0 [ 2104.778549][ T7886] ? __fget_files+0x2a/0x420 [ 2104.778562][T25297] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 2104.778568][ T7886] ? __fget_files+0x3a2/0x420 [ 2104.778596][ T7886] __sys_sendmsg+0x177/0x240 [ 2104.778614][ T7886] ? __pfx___sys_sendmsg+0x10/0x10 [ 2104.778645][ T7886] __do_fast_syscall_32+0x23e/0x6f0 [ 2104.778667][ T7886] ? do_fast_syscall_32+0x33/0x70 [ 2104.778687][ T7886] ? lockdep_hardirqs_on+0x7a/0x110 [ 2104.778706][ T7886] ? asm_int80_emulation+0x1a/0x20 [ 2104.778722][ T7886] ? do_int80_emulation+0x29f/0x550 [ 2104.778740][ T7886] ? trace_irq_disable+0x3b/0x140 [ 2104.778762][ T7886] do_fast_syscall_32+0x33/0x70 [ 2104.778783][ T7886] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2104.778801][ T7886] RIP: 0023:0xf7f830ec [ 2104.778817][ T7886] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2104.778830][ T7886] RSP: 002b:00000000f544650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 2104.778848][ T7886] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800003c0 [ 2104.778859][ T7886] RDX: 0000000000000800 RSI: 0000000000000000 RDI: 0000000000000000 [ 2104.778869][ T7886] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 2104.778878][ T7886] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2104.778887][ T7886] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2104.778917][ T7886] [ 2104.780173][ T7886] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9449'. [ 2104.791083][ T5773] usb 5-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2105.128055][ T5773] usb 5-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 2105.143391][ T5773] usb 5-1: Product: syz [ 2105.148067][ T5773] usb 5-1: Manufacturer: syz [ 2105.176658][ T5773] hub 5-1:4.0: USB hub found [ 2105.200226][ T7889] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9451'. [ 2105.319461][ T7892] fuse: Bad value for 'fd' [ 2105.337702][ T7891] syzkaller0: entered promiscuous mode [ 2105.345070][ T7891] syzkaller0: entered allmulticast mode [ 2105.380265][ T7880] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2105.395142][ T7880] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2105.410605][ T30] audit: type=1400 audit(1786394278.979:6764): apparmor="DENIED" operation="stack" class="file" info="label not found" error=-2 profile="unconfined" name=3A3A2F2F848A6A41A9D6E271 pid=7890 comm="syz.3.9452" [ 2105.469123][ T5773] hub 5-1:4.0: config failed, hub has too many ports! (err -19) [ 2105.858376][T25298] usb 5-1: USB disconnect, device number 82 [ 2105.894247][ T5773] usb 3-1: new full-speed USB device number 110 using dummy_hcd [ 2105.899399][ T7876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2105.916283][ T7876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2105.928304][ T4928] Bluetooth: hci5: command 0x0406 tx timeout [ 2105.950678][T25297] gspca_mr97310a: reg read [21] error -71 [ 2105.956861][T25297] mr97310a 2-1:1.0: probe with driver mr97310a failed with error -71 [ 2105.971689][T25297] usb 2-1: USB disconnect, device number 23 [ 2106.045057][ T5773] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2106.055705][ T5773] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2106.067372][ T5773] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2106.077818][ T5773] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2106.095233][ T5773] usb 3-1: config 0 descriptor?? [ 2106.125245][ T2268] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 2106.294942][ T2268] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 2106.309398][ T2268] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 2106.319844][ T2268] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 2106.354027][ T2268] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 2106.377589][ T2268] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2106.381293][ T7905] FAULT_INJECTION: forcing a failure. [ 2106.381293][ T7905] name failslab, interval 1, probability 0, space 0, times 0 [ 2106.390837][ T2268] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2106.403527][ T7905] CPU: 1 UID: 0 PID: 7905 Comm: syz.4.9456 Tainted: G L syzkaller #0 PREEMPT(full) [ 2106.403551][ T7905] Tainted: [L]=SOFTLOCKUP [ 2106.403557][ T7905] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2106.403566][ T7905] Call Trace: [ 2106.403573][ T7905] [ 2106.403580][ T7905] dump_stack_lvl+0xe8/0x150 [ 2106.403607][ T7905] should_fail_ex+0x40c/0x560 [ 2106.403632][ T7905] should_failslab+0xa8/0x100 [ 2106.403655][ T7905] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 2106.403675][ T7905] ? skb_clone+0x212/0x3a0 [ 2106.403692][ T7905] ? skb_clone+0x212/0x3a0 [ 2106.403713][ T7905] skb_clone+0x212/0x3a0 [ 2106.403730][ T7905] ? dev_queue_xmit_nit+0x270/0xac0 [ 2106.403749][ T7905] dev_queue_xmit_nit+0x28d/0xac0 [ 2106.403764][ T7905] ? dev_queue_xmit_nit+0x2d/0xac0 [ 2106.403787][ T7905] dev_hard_start_xmit+0x1c1/0x830 [ 2106.403820][ T7905] __dev_queue_xmit+0x14c0/0x3820 [ 2106.403844][ T7905] ? __alloc_skb+0x4cc/0x7a0 [ 2106.403863][ T7905] ? alloc_skb_with_frags+0x6b3/0x760 [ 2106.403879][ T7905] ? __dev_queue_xmit+0x29b/0x3820 [ 2106.403897][ T7905] ? __lock_acquire+0x683/0x2cf0 [ 2106.403921][ T7905] ? skb_set_owner_w+0x263/0x3d0 [ 2106.403941][ T7905] ? __pfx___dev_queue_xmit+0x10/0x10 [ 2106.403957][ T7905] ? sock_alloc_send_pskb+0x896/0x990 [ 2106.403982][ T7905] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 2106.404006][ T7905] ? packet_parse_headers+0x4dc/0x7b0 [ 2106.404025][ T7905] ? packet_parse_headers+0x57e/0x7b0 [ 2106.404048][ T7905] ? __pfx_packet_parse_headers+0x10/0x10 [ 2106.404069][ T7905] ? packet_xmit+0x68/0x330 [ 2106.404089][ T7905] packet_sendmsg+0x1f38/0x4e80 [ 2106.404158][ T7905] ? __pfx_packet_sendmsg+0x10/0x10 [ 2106.404181][ T7905] ? aa_sk_perm+0x6d5/0x900 [ 2106.404218][ T7905] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2106.404238][ T7905] ? __pfx_packet_sendmsg+0x10/0x10 [ 2106.404258][ T7905] sock_sendmsg_nosec+0x13a/0x180 [ 2106.404283][ T7905] __sys_sendto+0x408/0x5a0 [ 2106.404305][ T7905] ? __pfx___sys_sendto+0x10/0x10 [ 2106.404334][ T7905] ? __fget_files+0x3a2/0x420 [ 2106.404364][ T7905] ? ksys_write+0x242/0x270 [ 2106.404393][ T7905] __ia32_sys_sendto+0xdd/0x100 [ 2106.404412][ T7905] __do_fast_syscall_32+0x23e/0x6f0 [ 2106.404434][ T7905] ? do_fast_syscall_32+0x33/0x70 [ 2106.404458][ T7905] ? lockdep_hardirqs_on+0x7a/0x110 [ 2106.404478][ T7905] ? asm_int80_emulation+0x1a/0x20 [ 2106.404494][ T7905] ? do_int80_emulation+0x29f/0x550 [ 2106.404518][ T7905] do_fast_syscall_32+0x33/0x70 [ 2106.404539][ T7905] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2106.404557][ T7905] RIP: 0023:0xf700f0ec [ 2106.404573][ T7905] Code: 90 85 d2 74 0a 89 ce 81 e6 ff 0f 00 00 89 32 85 c0 74 05 c1 e9 0c 89 08 31 c0 5e 5d c3 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 58 b8 [ 2106.404587][ T7905] RSP: 002b:00000000f53fd50c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 2106.404604][ T7905] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000000 [ 2106.404615][ T7905] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000080000100 [ 2106.404625][ T7905] RBP: 0000000000000014 R08: 0000000000000000 R09: 0000000000000000 [ 2106.404635][ T7905] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 2106.404645][ T7905] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2106.404671][ T7905] [ 2106.726395][ T7900] netlink: 'syz.2.9455': attribute type 1 has an invalid length. [ 2106.739815][ T2268] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 2106.764634][ T2268] usb 1-1: invalid MIDI out EP 0 [ 2106.786538][T15721] usb 2-1: new full-speed USB device number 24 using dummy_hcd [ 2106.947856][T15721] usb 2-1: not running at top speed; connect to a high speed hub [ 2106.949578][ T2268] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 2106.955781][T15721] usb 2-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 2106.958434][T15721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 528, setting to 64 [ 2107.004265][T15721] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2107.047064][T15721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2107.055332][T15721] usb 2-1: Product: syz [ 2107.061237][T15721] usb 2-1: Manufacturer: syz [ 2107.083643][T15721] usb 2-1: SerialNumber: syz [ 2107.084760][ T7915] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9459'. [ 2107.124017][ T7907] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 2107.250266][ T7901] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2107.263336][ T7901] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2107.357368][ T7907] fuse: Bad value for 'fd' [ 2107.397847][T15721] usb 2-1: USB disconnect, device number 24 [ 2108.284419][T15721] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 2108.449805][T15721] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2108.460927][T15721] usb 2-1: config 1 interface 0 altsetting 15 bulk endpoint 0x3 has invalid maxpacket 1023 [ 2108.471290][T15721] usb 2-1: config 1 interface 0 altsetting 15 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2108.490475][T15721] usb 2-1: config 1 interface 0 has no altsetting 0 [ 2108.501310][T15721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2108.509873][T15721] usb 2-1: Product: syz [ 2108.514076][T15721] usb 2-1: Manufacturer: syz [ 2108.518818][T15721] usb 2-1: SerialNumber: syz [ 2108.546542][ T7917] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 2108.778080][T15721] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 2108.793317][T15721] usb 2-1: USB disconnect, device number 25 [ 2109.232222][ T7900] workqueue: Failed to create a rescuer kthread for wq "bond13": -EINTR [ 2109.242630][ T7901] kthread_run failed with err -4 [ 2109.295714][ T5773] usb 3-1: string descriptor 0 read error: -71 [ 2109.306801][ T5773] uclogic 0003:256C:006D.01B3: failed retrieving string descriptor #200: -71 [ 2109.327120][ T5773] uclogic 0003:256C:006D.01B3: failed retrieving pen parameters: -71 [ 2109.352285][ T5773] uclogic 0003:256C:006D.01B3: failed probing pen v2 parameters: -71 [ 2109.363704][T15721] usb 1-1: USB disconnect, device number 11 [ 2109.408860][ T5773] uclogic 0003:256C:006D.01B3: failed probing parameters: -71 [ 2109.432661][ T5773] uclogic 0003:256C:006D.01B3: probe with driver uclogic failed with error -71 [ 2109.475122][ T5773] usb 3-1: USB disconnect, device number 110 [ 2109.714752][ T5618] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 2109.745147][ T5613] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 2109.903103][ T5618] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 2109.906509][ T5613] usb 2-1: Using ep0 maxpacket: 32 [ 2109.929935][ T5613] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0012, bcdDevice= 0.40 [ 2109.941705][ T5613] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 2109.963324][ T5618] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2109.968445][ T5613] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2109.992824][ T5618] usb 4-1: config 0 descriptor?? [ 2109.993692][ T5613] usb 2-1: Product: syz [ 2110.011723][ T5618] cp210x 4-1:0.0: cp210x converter detected [ 2110.031594][ T5613] usb 2-1: Manufacturer: syz [ 2110.037884][ T5613] usb 2-1: SerialNumber: syz [ 2110.125161][ T7953] program syz.0.9466 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2110.190369][ T7953] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9466'. [ 2110.266248][ T5613] usb 2-1: BAAD HEADPHONE p_chmask mismatch [ 2110.288086][ T2268] usb 3-1: new full-speed USB device number 111 using dummy_hcd [ 2110.420987][ T5613] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2110.423735][ T5618] cp210x 4-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 2110.460486][ T7927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9463'. [ 2110.478946][ T2268] usb 3-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 2110.525654][ T5613] usb 2-1: USB disconnect, device number 26 [ 2110.547356][ T2268] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2110.588087][ T5620] udevd[5620]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2110.776554][ T2268] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2110.789474][ T2268] usb 3-1: Product: syz [ 2110.803360][ T5618] cp210x 4-1:0.0: failed to get vendor val 0x370c size 73: -71 [ 2110.815673][ T2268] usb 3-1: Manufacturer: syz [ 2110.820323][ T5618] cp210x 4-1:0.0: GPIO initialisation failed: -71 [ 2110.829638][ T2268] usb 3-1: SerialNumber: syz [ 2110.847627][ T5618] usb 4-1: cp210x converter now attached to ttyUSB0 [ 2110.855309][ T2268] usb 3-1: config 0 descriptor?? [ 2110.883056][ T2268] asix 3-1:0.0: probe with driver asix failed with error -22 [ 2110.904071][ T5618] usb 4-1: USB disconnect, device number 90 [ 2110.930181][ T5618] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 2110.970962][ T5618] cp210x 4-1:0.0: device disconnected [ 2111.004519][ T9] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 2111.135207][ T5613] usb 3-1: USB disconnect, device number 111 [ 2111.185748][ T9] usb 5-1: New USB device found, idVendor=08ca, idProduct=0110, bcdDevice= 1.00 [ 2111.201866][ T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2111.223932][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2111.234449][ T9] usb 5-1: Product: syz [ 2111.240381][ T9] usb 5-1: Manufacturer: syz [ 2111.247821][ T9] usb 5-1: SerialNumber: syz [ 2111.263228][ T9] gspca_main: mr97310a-2.14.0 probing 08ca:0110 [ 2111.365156][ T2268] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 2111.535092][ T2268] usb 2-1: Using ep0 maxpacket: 8 [ 2111.546319][ T2268] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 2111.561529][ T2268] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 2111.569996][ T2268] usb 2-1: config 179 has no interface number 0 [ 2111.578020][ T2268] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 2111.590298][ T2268] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 2111.605307][ T2268] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 2111.620655][ T2268] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 2111.635578][ T2268] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 2111.651042][ T2268] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2111.687696][ T7967] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 2112.000835][ T7977] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2112.175164][ T2268] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input395 [ 2112.310778][ T7961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2112.382139][ T7961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2112.398836][ T9] gspca_mr97310a: reg read [21] error -71 [ 2112.423432][ T9] mr97310a 5-1:1.0: probe with driver mr97310a failed with error -71 [ 2112.454568][ T5613] usb 1-1: new full-speed USB device number 12 using dummy_hcd [ 2112.461623][ T9] usb 5-1: USB disconnect, device number 83 [ 2112.635093][ T5613] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 2112.658468][ T5613] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2112.682624][ T5613] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2112.731215][ T5613] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2112.771688][ T5613] usb 1-1: config 0 descriptor?? [ 2113.404643][ T7983] netlink: 'syz.0.9473': attribute type 1 has an invalid length. [ 2113.925360][ T5613] usb 1-1: string descriptor 0 read error: -71 [ 2113.934853][ T5613] uclogic 0003:256C:006D.01B4: failed retrieving string descriptor #200: -71 [ 2113.977070][ T5613] uclogic 0003:256C:006D.01B4: failed retrieving pen parameters: -71 [ 2114.004193][ T5613] uclogic 0003:256C:006D.01B4: failed probing pen v2 parameters: -71 [ 2114.030268][ T5613] uclogic 0003:256C:006D.01B4: failed probing parameters: -71 [ 2114.057414][ T5613] uclogic 0003:256C:006D.01B4: probe with driver uclogic failed with error -71 [ 2114.111353][ T5613] usb 1-1: USB disconnect, device number 12 [ 2114.653434][ T8003] program syz.4.9477 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2114.705941][ T8003] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9477'. [ 2114.884390][ T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 2115.085852][ T9] usb 1-1: New USB device found, idVendor=15c2, idProduct=2204, bcdDevice= 0.00 [ 2115.098476][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2115.110521][ T9] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2115.164420][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2115.203474][ T5613] usb 2-1: USB disconnect, device number 27 [ 2115.203484][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 2115.217943][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 2115.227052][ C0] ================================================================== [ 2115.235118][ C0] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x28b/0x2f0 [ 2115.242935][ C0] Read of size 4 at addr ffff88802662e05c by task swapper/0/0 [ 2115.250374][ C0] [ 2115.252688][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 2115.252703][ C0] Tainted: [L]=SOFTLOCKUP [ 2115.252707][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2115.252713][ C0] Call Trace: [ 2115.252718][ C0] [ 2115.252722][ C0] dump_stack_lvl+0xe8/0x150 [ 2115.252739][ C0] print_address_description+0x55/0x1e0 [ 2115.252778][ C0] ? do_raw_spin_lock+0x28b/0x2f0 [ 2115.252788][ C0] print_report+0x58/0x70 [ 2115.252798][ C0] kasan_report+0x117/0x150 [ 2115.252813][ C0] ? do_raw_spin_lock+0x28b/0x2f0 [ 2115.252824][ C0] do_raw_spin_lock+0x28b/0x2f0 [ 2115.252834][ C0] ? __wake_up_common_lock+0x30/0x1f0 [ 2115.252845][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2115.252856][ C0] _raw_spin_lock_irqsave+0x4c/0x60 [ 2115.252868][ C0] __wake_up_common_lock+0x30/0x1f0 [ 2115.252879][ C0] __usb_hcd_giveback_urb+0x3ae/0x530 [ 2115.252948][ C0] dummy_timer+0xa91/0x4cf0 [ 2115.252999][ C0] ? __lock_acquire+0x683/0x2cf0 [ 2115.253014][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2115.253025][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2115.253036][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2115.253047][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2115.253057][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 2115.253071][ C0] hrtimer_run_softirq+0x17a/0x240 [ 2115.253082][ C0] handle_softirqs+0x225/0x840 [ 2115.253093][ C0] ? __irq_exit_rcu+0xca/0x220 [ 2115.253104][ C0] __irq_exit_rcu+0xca/0x220 [ 2115.253114][ C0] irq_exit_rcu+0x9/0x30 [ 2115.253123][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2115.253136][ C0] [ 2115.253139][ C0] [ 2115.253143][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2115.253154][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2115.253167][ C0] Code: bb 7e 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d b3 be 18 00 fb f4 4c 07 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 2115.253176][ C0] RSP: 0000:ffffffff8e807de0 EFLAGS: 00000242 [ 2115.253185][ C0] RAX: 0000000002f9decb RBX: ffffffff819b4450 RCX: 0000000080000001 [ 2115.253193][ C0] RDX: 0000000000000001 RSI: ffffffff8e228aee RDI: ffffffff8c4bbe80 [ 2115.253200][ C0] RBP: ffffffff8e807eb8 R08: ffff8880b86338db R09: 1ffff110170c671b [ 2115.253208][ C0] R10: dffffc0000000000 R11: ffffed10170c671c R12: 0000000000000000 [ 2115.253215][ C0] R13: 1ffffffff1d11de8 R14: 1ffffffff1d00fc4 R15: dffffc0000000000 [ 2115.253223][ C0] ? do_idle+0x2e0/0x540 [ 2115.253237][ C0] default_idle+0x9/0x20 [ 2115.253249][ C0] default_idle_call+0x72/0xb0 [ 2115.253262][ C0] do_idle+0x2e0/0x540 [ 2115.253273][ C0] ? __pfx_do_idle+0x10/0x10 [ 2115.253286][ C0] cpu_startup_entry+0x43/0x60 [ 2115.253297][ C0] rest_init+0x2de/0x300 [ 2115.253306][ C0] start_kernel+0x392/0x3e0 [ 2115.253390][ C0] x86_64_start_reservations+0x24/0x30 [ 2115.253431][ C0] x86_64_start_kernel+0x137/0x1b0 [ 2115.253444][ C0] common_startup_64+0x13e/0x157 [ 2115.253465][ C0] [ 2115.253469][ C0] [ 2115.547800][ C0] Allocated by task 2268: [ 2115.552131][ C0] kasan_save_track+0x3e/0x80 [ 2115.556831][ C0] __kasan_kmalloc+0x93/0xb0 [ 2115.561433][ C0] __kmalloc_cache_noprof+0x32d/0x660 [ 2115.566812][ C0] xpad_probe+0x43f/0x2020 [ 2115.571325][ C0] usb_probe_interface+0x653/0xc60 [ 2115.576500][ C0] really_probe+0x254/0xae0 [ 2115.581063][ C0] __driver_probe_device+0x1e8/0x360 [ 2115.586344][ C0] driver_probe_device+0x4f/0x240 [ 2115.591355][ C0] __device_attach_driver+0x270/0x410 [ 2115.596709][ C0] bus_for_each_drv+0x258/0x2f0 [ 2115.601554][ C0] __device_attach+0x2c4/0x450 [ 2115.606297][ C0] device_initial_probe+0xa1/0xd0 [ 2115.611307][ C0] bus_probe_device+0x12a/0x220 [ 2115.616147][ C0] device_add+0x7d7/0xb80 [ 2115.620458][ C0] usb_set_configuration+0x1ad8/0x2180 [ 2115.625907][ C0] usb_generic_driver_probe+0x8d/0x150 [ 2115.631428][ C0] usb_probe_device+0x1c3/0x3b0 [ 2115.636262][ C0] really_probe+0x254/0xae0 [ 2115.640748][ C0] __driver_probe_device+0x1e8/0x360 [ 2115.646021][ C0] driver_probe_device+0x4f/0x240 [ 2115.651034][ C0] __device_attach_driver+0x270/0x410 [ 2115.656394][ C0] bus_for_each_drv+0x258/0x2f0 [ 2115.661231][ C0] __device_attach+0x2c4/0x450 [ 2115.665988][ C0] device_initial_probe+0xa1/0xd0 [ 2115.670997][ C0] bus_probe_device+0x12a/0x220 [ 2115.675833][ C0] device_add+0x7d7/0xb80 [ 2115.680146][ C0] usb_new_device+0x9aa/0x1690 [ 2115.684894][ C0] hub_event+0x28e8/0x4d30 [ 2115.689297][ C0] process_scheduled_works+0xa8e/0x14e0 [ 2115.694826][ C0] worker_thread+0xa47/0xfb0 [ 2115.699401][ C0] kthread+0x388/0x470 [ 2115.703453][ C0] ret_from_fork+0x514/0xb70 [ 2115.708033][ C0] ret_from_fork_asm+0x1a/0x30 [ 2115.712784][ C0] [ 2115.715093][ C0] Freed by task 5613: [ 2115.719054][ C0] kasan_save_track+0x3e/0x80 [ 2115.723715][ C0] kasan_save_free_info+0x40/0x50 [ 2115.728723][ C0] __kasan_slab_free+0x5c/0x80 [ 2115.733477][ C0] kfree+0x1c5/0x640 [ 2115.737353][ C0] xpad_disconnect+0x323/0x440 [ 2115.742099][ C0] usb_unbind_interface+0x295/0x9f0 [ 2115.747287][ C0] device_release_driver_internal+0x4f5/0x880 [ 2115.753335][ C0] bus_remove_device+0x444/0x560 [ 2115.758260][ C0] device_del+0x524/0x8f0 [ 2115.762569][ C0] usb_disable_device+0x3d4/0x8d0 [ 2115.767583][ C0] usb_disconnect+0x346/0x9a0 [ 2115.772339][ C0] hub_event+0x1bbb/0x4d30 [ 2115.776760][ C0] process_scheduled_works+0xa8e/0x14e0 [ 2115.782299][ C0] worker_thread+0xa47/0xfb0 [ 2115.786877][ C0] kthread+0x388/0x470 [ 2115.790934][ C0] ret_from_fork+0x514/0xb70 [ 2115.795513][ C0] ret_from_fork_asm+0x1a/0x30 [ 2115.800272][ C0] [ 2115.802580][ C0] Last potentially related work creation: [ 2115.808274][ C0] kasan_save_stack+0x3e/0x60 [ 2115.812945][ C0] kasan_record_aux_stack+0xbd/0xd0 [ 2115.818136][ C0] insert_work+0x3d/0x330 [ 2115.822452][ C0] __queue_work+0xcd8/0x10a0 [ 2115.827029][ C0] queue_work_on+0x106/0x1d0 [ 2115.831602][ C0] xpad_irq_in+0xac9/0x2400 [ 2115.836088][ C0] __usb_hcd_giveback_urb+0x374/0x530 [ 2115.841447][ C0] dummy_timer+0xa91/0x4cf0 [ 2115.845938][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 2115.851128][ C0] hrtimer_run_softirq+0x17a/0x240 [ 2115.856229][ C0] handle_softirqs+0x225/0x840 [ 2115.860980][ C0] __irq_exit_rcu+0xca/0x220 [ 2115.865553][ C0] irq_exit_rcu+0x9/0x30 [ 2115.869781][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2115.875430][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2115.881419][ C0] [ 2115.883723][ C0] Second to last potentially related work creation: [ 2115.890286][ C0] kasan_save_stack+0x3e/0x60 [ 2115.894966][ C0] kasan_record_aux_stack+0xbd/0xd0 [ 2115.900148][ C0] insert_work+0x3d/0x330 [ 2115.904462][ C0] __queue_work+0xcd8/0x10a0 [ 2115.909039][ C0] queue_work_on+0x106/0x1d0 [ 2115.913612][ C0] xpad_irq_in+0xac9/0x2400 [ 2115.918097][ C0] __usb_hcd_giveback_urb+0x374/0x530 [ 2115.923454][ C0] dummy_timer+0xa91/0x4cf0 [ 2115.927940][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 2115.933124][ C0] hrtimer_run_softirq+0x17a/0x240 [ 2115.938217][ C0] handle_softirqs+0x225/0x840 [ 2115.942968][ C0] __irq_exit_rcu+0xca/0x220 [ 2115.947542][ C0] irq_exit_rcu+0x9/0x30 [ 2115.951767][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2115.957383][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2115.963349][ C0] [ 2115.965656][ C0] The buggy address belongs to the object at ffff88802662e000 [ 2115.965656][ C0] which belongs to the cache kmalloc-1k of size 1024 [ 2115.979736][ C0] The buggy address is located 92 bytes inside of [ 2115.979736][ C0] freed 1024-byte region [ffff88802662e000, ffff88802662e400) [ 2115.993516][ C0] [ 2115.995826][ C0] The buggy address belongs to the physical page: [ 2116.002227][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26628 [ 2116.010975][ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2116.019456][ C0] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 2116.026989][ C0] page_type: f5(slab) [ 2116.030972][ C0] raw: 00fff00000000040 ffff88801b004dc0 dead000000000100 dead000000000122 [ 2116.039539][ C0] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 2116.048103][ C0] head: 00fff00000000040 ffff88801b004dc0 dead000000000100 dead000000000122 [ 2116.056755][ C0] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 2116.065405][ C0] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 2116.074054][ C0] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 2116.082700][ C0] page dumped because: kasan: bad access detected [ 2116.089101][ C0] page_owner tracks the page as allocated [ 2116.094794][ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 26947, tgid 26946 (syz.4.6219), ts 1309623991784, free_ts 1309583393046 [ 2116.116479][ C0] post_alloc_hook+0x1f9/0x250 [ 2116.121239][ C0] get_page_from_freelist+0x21fa/0x2270 [ 2116.126778][ C0] __alloc_frozen_pages_noprof+0x18d/0x380 [ 2116.132570][ C0] allocate_slab+0x79/0x5e0 [ 2116.137053][ C0] refill_objects+0x2d5/0x350 [ 2116.141710][ C0] __pcs_replace_empty_main+0x2bf/0x6b0 [ 2116.147244][ C0] __kvmalloc_node_noprof+0x66b/0x860 [ 2116.152600][ C0] io_alloc_cache_init+0x42/0x140 [ 2116.157707][ C0] io_ring_ctx_alloc+0x534/0xc40 [ 2116.162633][ C0] io_uring_create+0x50/0x990 [ 2116.167294][ C0] __se_sys_io_uring_setup+0x2a8/0x2c0 [ 2116.172772][ C0] __do_fast_syscall_32+0x23e/0x6f0 [ 2116.177957][ C0] do_fast_syscall_32+0x33/0x70 [ 2116.182792][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 2116.189105][ C0] page last free pid 5620 tgid 5620 stack trace: [ 2116.195407][ C0] __free_frozen_pages+0xc1e/0xd10 [ 2116.200514][ C0] __slab_free+0x274/0x2c0 [ 2116.204915][ C0] qlist_free_all+0x99/0x100 [ 2116.209491][ C0] kasan_quarantine_reduce+0x148/0x160 [ 2116.214934][ C0] __kasan_slab_alloc+0x22/0x80 [ 2116.219782][ C0] kmem_cache_alloc_noprof+0x2a0/0x5f0 [ 2116.225240][ C0] do_getname+0x2e/0x250 [ 2116.229475][ C0] do_readlinkat+0xc8/0x510 [ 2116.233966][ C0] __x64_sys_readlink+0x7f/0x90 [ 2116.238809][ C0] do_syscall_64+0x174/0x580 [ 2116.243399][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2116.249276][ C0] [ 2116.251586][ C0] Memory state around the buggy address: [ 2116.257207][ C0] ffff88802662df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2116.265249][ C0] ffff88802662df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 2116.273291][ C0] >ffff88802662e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2116.281358][ C0] ^ [ 2116.288538][ C0] ffff88802662e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2116.296581][ C0] ffff88802662e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2116.304621][ C0] ================================================================== [ 2116.312683][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 2116.319866][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 2116.330358][ C0] Tainted: [L]=SOFTLOCKUP [ 2116.334666][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2116.344719][ C0] Call Trace: [ 2116.348021][ C0] [ 2116.350860][ C0] vpanic+0x56c/0xa60 [ 2116.354930][ C0] ? __pfx_vpanic+0x10/0x10 [ 2116.359433][ C0] panic+0xc5/0xd0 [ 2116.363145][ C0] ? __pfx_panic+0x10/0x10 [ 2116.367554][ C0] ? do_raw_spin_lock+0x28b/0x2f0 [ 2116.372570][ C0] ? do_raw_spin_lock+0x28b/0x2f0 [ 2116.377583][ C0] ? do_raw_spin_lock+0x28b/0x2f0 [ 2116.382593][ C0] check_panic_on_warn+0x89/0xb0 [ 2116.387520][ C0] ? do_raw_spin_lock+0x28b/0x2f0 [ 2116.392528][ C0] end_report+0x73/0x170 [ 2116.396770][ C0] ? do_raw_spin_lock+0x28b/0x2f0 [ 2116.401777][ C0] kasan_report+0x128/0x150 [ 2116.406270][ C0] ? do_raw_spin_lock+0x28b/0x2f0 [ 2116.411299][ C0] do_raw_spin_lock+0x28b/0x2f0 [ 2116.416138][ C0] ? __wake_up_common_lock+0x30/0x1f0 [ 2116.421494][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2116.426856][ C0] _raw_spin_lock_irqsave+0x4c/0x60 [ 2116.432043][ C0] __wake_up_common_lock+0x30/0x1f0 [ 2116.437231][ C0] __usb_hcd_giveback_urb+0x3ae/0x530 [ 2116.442593][ C0] dummy_timer+0xa91/0x4cf0 [ 2116.447092][ C0] ? __lock_acquire+0x683/0x2cf0 [ 2116.452023][ C0] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2116.457380][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2116.462301][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 2116.468091][ C0] ? __pfx_dummy_timer+0x10/0x10 [ 2116.473010][ C0] __hrtimer_run_queues+0x3bc/0xa10 [ 2116.478204][ C0] hrtimer_run_softirq+0x17a/0x240 [ 2116.483300][ C0] handle_softirqs+0x225/0x840 [ 2116.488050][ C0] ? __irq_exit_rcu+0xca/0x220 [ 2116.492800][ C0] __irq_exit_rcu+0xca/0x220 [ 2116.497373][ C0] irq_exit_rcu+0x9/0x30 [ 2116.501597][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 2116.507217][ C0] [ 2116.510132][ C0] [ 2116.513047][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2116.519009][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2116.524629][ C0] Code: bb 7e 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d b3 be 18 00 fb f4 4c 07 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 2116.544222][ C0] RSP: 0000:ffffffff8e807de0 EFLAGS: 00000242 [ 2116.550286][ C0] RAX: 0000000002f9decb RBX: ffffffff819b4450 RCX: 0000000080000001 [ 2116.558242][ C0] RDX: 0000000000000001 RSI: ffffffff8e228aee RDI: ffffffff8c4bbe80 [ 2116.566202][ C0] RBP: ffffffff8e807eb8 R08: ffff8880b86338db R09: 1ffff110170c671b [ 2116.574164][ C0] R10: dffffc0000000000 R11: ffffed10170c671c R12: 0000000000000000 [ 2116.582125][ C0] R13: 1ffffffff1d11de8 R14: 1ffffffff1d00fc4 R15: dffffc0000000000 [ 2116.590089][ C0] ? do_idle+0x2e0/0x540 [ 2116.594326][ C0] default_idle+0x9/0x20 [ 2116.598558][ C0] default_idle_call+0x72/0xb0 [ 2116.603311][ C0] do_idle+0x2e0/0x540 [ 2116.607367][ C0] ? __pfx_do_idle+0x10/0x10 [ 2116.611945][ C0] cpu_startup_entry+0x43/0x60 [ 2116.616694][ C0] rest_init+0x2de/0x300 [ 2116.620922][ C0] start_kernel+0x392/0x3e0 [ 2116.625415][ C0] x86_64_start_reservations+0x24/0x30 [ 2116.630868][ C0] x86_64_start_kernel+0x137/0x1b0 [ 2116.635968][ C0] common_startup_64+0x13e/0x157 [ 2116.640899][ C0] [ 2116.644205][ C0] Kernel Offset: disabled [ 2116.648514][ C0] Rebooting in 86400 seconds..