last executing test programs: 2m46.769347739s ago: executing program 0 (id=874): r0 = socket(0x840000000002, 0x3, 0x6) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80001) ioctl$XFS_IOC_GETBMAPX(r0, 0xc0205838, &(0x7f00000000c0)={0x47a49584, 0x100000001, 0x325, 0x49, 0x8, 0x20, 0x17}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=5']) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000200000000000000fdffffff18110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000038000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = eventfd(0x4) r5 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ipv6_route\x00') pread64(r5, &(0x7f0000000240)=""/164, 0x131, 0x131) r6 = eventfd2(0x3, 0x3) r7 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000600), 0x0, 0x0) r8 = eventfd(0x0) r9 = syz_open_procfs(0x0, &(0x7f0000000180)='net/mcfilter\x00') pread64(r9, &(0x7f00000000c0)=""/144, 0x90, 0x2f) r10 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') getdents64(r10, 0x0, 0x0) io_submit(0x0, 0x9, &(0x7f0000000b80)=[&(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x5, r2, &(0x7f0000000300)="c3862118dec4fa3860ff002a804e9b71bd11dd9b7d6e536390b40a6dd9fffac00f5972cfd6866ceb99d58d65caf1dc384e5bc6358af30c4b063393a4df81dd397672dd41efa3c49d520d6597e0e1015b3f7684b5f92247f199534d4eaa", 0x5d, 0x5, 0x0, 0x2, r4}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x6, r1, &(0x7f00000003c0)="e7fa5e1dd7d5a61de8e64b2ddd0bed6603332f94ec0f87019f355bbc5f8620a8feb3d47c0adb076f2550e51319c64c988f8ac9d7267f1165a5527a72af40a1b49c2ca3", 0x43, 0x10001, 0x0, 0x2, r5}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x40, r2, &(0x7f0000000500)="c82d8921f15c2a40c98720c755a6a4437babfa3cf7c9b63c8792addfef4757ca7e7ec9ab2a490b0cb646ecd30b5091038e84bc3e40c787154cb7a343ce5a039b00c863582d383e6ca5d11375065a2d74f1444b89", 0x54, 0xe, 0x0, 0x2, r6}, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x2, 0xa568, r7, &(0x7f0000000640)="3807c729a2a6673f1d1a9fb5a1ee8f4233863d47a2f26cfcebe185133d5e179f999b46566da74bd23d7443942604c7828339155661545ae4bc0c9f389002933355e031a243669b942d70fdb6b57f0d4be45ae46c94dfd1e267f8d0b50f35843f664c28d750881acaa07ab1cc126c3834d2768ea1d9de3a6950437617d79edbaa233c67283e", 0x85, 0x6, 0x0, 0x2, r8}, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x8, 0x7, r1, &(0x7f0000000740)="e51c11ebadc364a71f", 0x9, 0xff, 0x0, 0x3}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x3, 0x49, r3, &(0x7f00000007c0)="bbc5f5d49638f6d166bde44915aa95f9", 0x10, 0x1, 0x0, 0x1}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x1, 0x200, r0, &(0x7f0000000840)="60f5d63248a5ad1332b5084f088abdfa0854d82a4640d289e27827407b2a8cd5abe1353f7dca5d0a947461073dcd7b8030640a8bb77a7576eddf999e002b2d878073335d7c561377", 0x48, 0x5, 0x0, 0x1, r9}, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x7, 0x7f, r2, &(0x7f0000000900)="fc9c3c4f302fff58b4179cf4c81fc3c304572a20701f2db080f590f68a611e89fa97609e545978156201ae7cb92d3204e964d9f08a9045235af4a922a3f0b820dbfae30d7e11b7ed02807299ecc703cfb607e99adb4468807ccd4cd2eaff3bc692cdb763765920f22cc37b22914a34604d4f", 0x72, 0x9, 0x0, 0x3, r3}, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x5, 0x4, r0, &(0x7f0000000a40)="dd8ab4c8ab22e8e40716dc7897517fd45bd384914622dcdb3ee88faf2543e7ebb3971be8c5020e27f407324f975c4055c4e4d03f6b1750c5a9c837c9274c4fb552adb1ddc27d632f23acad7e6e0cac6ba4abd3077c3ca346a56073eaa5c2046bd759bda918aa03373239ba2de272f3add78e49078f5cb88854e76cf888b8cfe5a183bacf3f27a0be53bab0c85b74026b33715e0b0e777499dedaf0e4dfd7d15f58d651dc8fa801de566daef24811a6b75a4bc50c8ef42e72a28070ce534d81c4e1d015d2e2d147a13397accf8df955a8e59b990519a1db9cd4c59785cff9afbca81bffe9b92ce9f577", 0xe9, 0x0, 0x0, 0x0, r10}]) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r11, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc92b18236457ee3c8", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) chdir(&(0x7f0000000140)='./file0\x00') r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) ftruncate(r12, 0x8008976) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x13, r12, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x715}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) sendmmsg$inet(r0, &(0x7f0000001440)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, 0x0}}], 0x1, 0x40000) 2m46.132882209s ago: executing program 0 (id=878): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) shutdown(r0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0xc, &(0x7f00000002c0)=0x108005, 0x4) r2 = socket$l2tp(0x2, 0x2, 0x73) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="240000001800010000000000000200001d01080008000a00", @ANYRES32, @ANYBLOB='\b\x00\t\x00', @ANYRES32=r3], 0x24}}, 0x0) r4 = getpgrp(0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r1, &(0x7f0000000780)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x24, 0x0, 0x9, 0x301, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x14}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0xc044}, 0x80) sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$BATADV_CMD_TP_METER_CANCEL(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x6889}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}]}, 0x24}}, 0x20000000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f0000000200)={'nat\x00', 0x0, 0x0, 0x0, [0x10001, 0xffffffff, 0x81, 0xe0a3, 0xffffffffffffffff, 0x8]}, &(0x7f0000000080)=0x78) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) sendto$inet(r2, 0x0, 0x0, 0x4000010, &(0x7f0000000000)={0x2, 0xfffc, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000180)=ANY=[], 0x1c}, {&(0x7f0000000480)={0x3c, 0x3c, 0x1, 0x70bd28, 0x25dfdbff, "", [@generic="e198c506fd622e691fef47611f7233c896780f17adaf85dfa55e1fbd38fec12fe898684aad28dd8e221135"]}, 0x3c}, {&(0x7f00000004c0)={0x9c, 0x25, 0x200, 0x70bd26, 0x25dfdbfb, "", [@generic="94ea4ed8184cff4575853b96675e4d524cbd46f8037db13e5de51bf4929dfbfc9fcb9628a2ae1172f55af865d23b5d13fff614ebdb6bb877fc38852890b0ab2ffdbb01f40bbad39fce31bc073d021c849b42ed90ae73f59bec26320eba504c946e22250dae33026a444d7a7a02d76a31e4d9606346d6eb0a2aba8b22c63299281ef29d3d7e2a0f07bf96909c"]}, 0x9c}], 0x3}, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="840100001900010000000000000000001d0109005000118049002100c9a7befe6f6d645a1a1106000000101c7510e19feecb90ee6bb49f6cc7a2c50fd57c06fb1a75df432aa833928a0772ff9f5e9ed32d3b477d35b296674f1f07200000d236fd7e93a47fc9523c82da1ef21628a09bcf79585d35a7c5333093c3bee375d9d6f2fce0487694024bb7eca52b6aad055a250c322a8ab29672e04e3d02d9380c7b0b72d3a897701437c1cc6d7cf4ad41a5e3e0389004f49f637d9b2fe23a7a1b6e679151ad949fd7b5b10d"], 0x184}, 0x1, 0x0, 0x0, 0x80a5}, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r9, 0x89f3, &(0x7f0000000380)={'ip6gre0\x00', &(0x7f0000000280)={'ip6gre0\x00', 0x0, 0x4, 0x37, 0x4, 0x0, 0x48, @rand_addr=' \x01\x00', @private0, 0x20, 0x700, 0x6, 0x7c8}}) 2m44.331473528s ago: executing program 0 (id=882): socket$inet6(0xa, 0x3, 0x5) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000000) close(0xffffffffffffffff) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000380)=@ax25={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x6}, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x80, 0x0}, 0x4) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_CONTINUE(r1, 0xc020aa07, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) 2m37.808722352s ago: executing program 0 (id=894): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000240)='yeah', 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000ac0), 0x2, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000140)={0x1f, 0x4, 0x3}, 0x6) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r2 = getpid() sched_setattr(r2, &(0x7f0000000000)={0x38, 0x6, 0x33, 0x0, 0x10000, 0xf6d, 0xd, 0xde7, 0xcd44, 0x2f2e}, 0x0) ioctl$COMEDI_POLL(0xffffffffffffffff, 0x640f) socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) pipe2(&(0x7f0000001040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RGETLOCK(r3, &(0x7f00000000c0)=ANY=[], 0xffffff6a) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYRESDEC], 0x27) write$binfmt_script(r3, &(0x7f0000001d80)={'#! ', './file0'}, 0xb) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) 2m34.478898058s ago: executing program 0 (id=897): r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000640)={'wlan0\x00'}) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) dup(0xffffffffffffffff) sendto$inet6(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @private0}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000040)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x88, 0x1, 0x0, 0x3}, 0xe) recvmmsg(0xffffffffffffffff, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x80480, 0xcd) getdents64(r4, &(0x7f0000000580)=""/174, 0xae) r5 = syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) recvmmsg(0xffffffffffffffff, &(0x7f00000012c0)=[{{&(0x7f0000000040)=@pppoe, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/133, 0x85}, {&(0x7f00000002c0)=""/159, 0x9f}, {&(0x7f0000000380)=""/71, 0x47}, {&(0x7f0000000400)=""/220, 0xdc}, {&(0x7f0000000500)=""/151, 0x97}, {&(0x7f00000005c0)=""/180, 0xb4}, {&(0x7f0000000680)=""/59, 0x3b}], 0x7, &(0x7f0000000740)=""/57, 0x39}, 0x4}, {{&(0x7f0000000780)=@phonet, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000800)=""/95, 0x5f}, {&(0x7f0000000880)=""/137, 0x89}, {&(0x7f0000000940)=""/180, 0xb4}, {&(0x7f0000000a00)=""/37, 0x25}, {&(0x7f0000000a40)=""/4, 0x4}, {&(0x7f0000000a80)=""/105, 0x69}, {&(0x7f0000000b00)=""/229, 0xe5}, {&(0x7f0000000c00)=""/253, 0xfd}], 0x8, &(0x7f0000000d80)=""/77, 0x4d}, 0x9}, {{&(0x7f0000000e00)=@nl=@proc, 0x80, &(0x7f00000011c0)=[{&(0x7f0000000e80)=""/88, 0x58}, {0x0}, {&(0x7f0000000f80)=""/252, 0xfc}, {&(0x7f0000001080)=""/250, 0xfa}, {&(0x7f0000001180)=""/7, 0x7}], 0x5, &(0x7f0000001240)=""/122, 0x7a}, 0x9}], 0x3, 0x20, &(0x7f0000001380)={0x77359400}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000001500)={'erspan0\x00', &(0x7f0000001480)={'gre0\x00', 0x0, 0x80, 0x20, 0x7fffffff, 0x3, {{0xf, 0x4, 0x2, 0xf, 0x3c, 0x68, 0x0, 0x8, 0x29, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x24}, {[@timestamp={0x44, 0x14, 0x66, 0x0, 0x6, [0x9, 0x960, 0x3, 0x7fffffff]}, @timestamp_prespec={0x44, 0xc, 0x48, 0x3, 0x9, [{@multicast2, 0x7}]}, @noop, @ssrr={0x89, 0x7, 0x18, [@empty]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000001640)={'gre0\x00', &(0x7f0000001540)={'syztnl0\x00', 0x0, 0x10, 0x7800, 0x75, 0x8, {{0x5, 0x4, 0x1, 0x38, 0x14, 0x65, 0x0, 0x6, 0x4, 0x0, @private=0xa010101, @empty}}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001700)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000016c0)={&(0x7f0000001680)=ANY=[@ANYBLOB="3c0000005200000126bd7000ff9bdf250a08000100", @ANYRES32=r6, @ANYBLOB="080002000300000008000100", @ANYRES32=r7, @ANYBLOB="08000200010000000800060081000000000000"], 0x3c}, 0x1, 0x0, 0x0, 0x24000081}, 0x4048050) syz_usb_disconnect(r0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r5, 0xc01c5868, 0x0) 2m29.841552967s ago: executing program 0 (id=909): mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000140)='vfat\x00', 0x208000, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x2}}, 0x10) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200009200800000190000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/14], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$null(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x0, &(0x7f0000000200)}) ioctl$DRM_IOCTL_GEM_CLOSE(r2, 0x40086409, &(0x7f0000000200)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x94) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x5, 0x1}, {0x0, 0x5}, {0x8, 0x7}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x15625}]}}]}, 0xfffffffffffffe8c}, 0x1, 0x0, 0x0, 0x20844}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "9d09b974e9060a3c", "46a278ba392c53fa29a17543c440dc8a", "01a55c10", "969509a9c9f65fc4"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "f64e4099107323f5", "53c272d8b763f690b35605dff8a4a8d2", "3da2d199", "72392a24199b5903"}, 0x28) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000a00fc000000180001"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b40a000015b20900000001000000000000000000ba0060809c0a01"], 0xab4}, 0x1, 0x0, 0x0, 0x80}, 0xc4) 2m14.191355133s ago: executing program 32 (id=909): mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000140)='vfat\x00', 0x208000, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x2}}, 0x10) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200009200800000190000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/14], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$null(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x0, &(0x7f0000000200)}) ioctl$DRM_IOCTL_GEM_CLOSE(r2, 0x40086409, &(0x7f0000000200)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x94) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x5, 0x1}, {0x0, 0x5}, {0x8, 0x7}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x15625}]}}]}, 0xfffffffffffffe8c}, 0x1, 0x0, 0x0, 0x20844}, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "9d09b974e9060a3c", "46a278ba392c53fa29a17543c440dc8a", "01a55c10", "969509a9c9f65fc4"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "f64e4099107323f5", "53c272d8b763f690b35605dff8a4a8d2", "3da2d199", "72392a24199b5903"}, 0x28) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000a00fc000000180001"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b40a000015b20900000001000000000000000000ba0060809c0a01"], 0xab4}, 0x1, 0x0, 0x0, 0x80}, 0xc4) 13.083918453s ago: executing program 5 (id=1302): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @loopback, 0x3}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 13.066294952s ago: executing program 1 (id=1303): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x38, 0x10, 0x503, 0x2, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x14615, 0xef}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_ROLE={0x8}]}}}]}, 0x38}}, 0x0) (fail_nth: 20) 11.96586758s ago: executing program 1 (id=1304): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x1f0, 0x24, 0x100, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x7, 0x2}, {0x1, 0xfff2}, {0x2, 0xe}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x7fff}}, @qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x6}}}, @TCA_STAB={0x108, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x6, 0xbd, 0xb1e, 0x2, 0xd, 0x4, 0xa}}, {0x18, 0x2, [0xfff0, 0x4, 0x401, 0x100, 0x5, 0x0, 0x4, 0x81, 0x2, 0x6]}}, {{0x1c, 0x1, {0x0, 0xf1, 0x6, 0x9f, 0x1, 0x5, 0x7f, 0x6}}, {0x10, 0x2, [0xfc1, 0x3, 0xfffb, 0xc669, 0x80, 0x5]}}, {{0x1c, 0x1, {0x7, 0x9, 0x0, 0xff, 0x1, 0x80, 0xffffffff, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x0, 0x4, 0xa62c, 0xf9c, 0x2, 0x7, 0xb, 0x4}}, {0xc, 0x2, [0x8c93, 0x6800, 0x5fb, 0x3]}}, {{0x1c, 0x1, {0x2, 0x4, 0x7, 0x1000, 0x0, 0x6, 0x400, 0x3}}, {0xa, 0x2, [0xa, 0x6, 0x5746]}}, {{0x1c, 0x1, {0x9, 0x5, 0xceff, 0x8, 0x2, 0xa299, 0x3ff, 0x8}}, {0x14, 0x2, [0x7, 0x8, 0x5, 0x7, 0x9, 0x7fff, 0x2, 0x3]}}]}, @TCA_INGRESS_BLOCK={0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x4}, @TCA_STAB={0x80, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9, 0x6, 0x0, 0xffffffff, 0x2, 0xe5, 0xfffffffd, 0xa}}, {0x18, 0x2, [0x7, 0x1, 0x8, 0x1, 0x1f6, 0x6000, 0x8, 0x1, 0x1, 0x4]}}, {{0x1c, 0x1, {0x0, 0xe, 0x0, 0x896, 0x2, 0x1, 0xe8a5, 0x1}}, {0x6, 0x2, [0xfff1]}}, {{0x1c, 0x1, {0x7f, 0x1, 0x7, 0x3, 0x3, 0x7fffffff, 0x5, 0x2}}, {0x8, 0x2, [0x5, 0x800]}}]}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x2000}, 0x20040084) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0xfff2}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20041010}, 0x4044000) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x1, 0x8}, {}, {0x0, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x24040004) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) r9 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) ioctl$EVIOCGABS0(r9, 0x80184540, &(0x7f00000002c0)=""/205) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="8000000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000024000280140001800800010000000000080002007f0000010c00028005000100000000000800074000000000080003"], 0x80}}, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000015000103000000000000e7ff0b00000008000100", @ANYRES32], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4088010) kexec_load(0x0, 0x0, 0x0, 0x0) r13 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) pwrite64(r13, 0x0, 0x0, 0x26c) 11.816915114s ago: executing program 5 (id=1306): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) fcntl$lock(0xffffffffffffffff, 0x410, &(0x7f0000000080)={0x0, 0x1, 0x6, 0x1fd}) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x10000, 0x3, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffffffffff7}, {0x0, 0x8, 0xfffffffffffffff8, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in6=@empty, 0x2, 0x6c}, 0xa, @in=@empty, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) r2 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x62], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @loopback, 0x3}, 0x1c) r3 = fsopen(&(0x7f0000000140)='f2fs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\xeaul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x9521, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xfff2}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/vlan/vlan0\x00') ioctl$KVM_GET_MSR_INDEX_LIST(r4, 0xc004ae02, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x2f) syz_open_dev$video(&(0x7f0000000000), 0x7fff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000004c0)=@bpf_lsm={0x1d, 0x2, &(0x7f0000000040)=ANY=[@ANYBLOB="85100000fbffffff852059eeb11d0000"], &(0x7f0000000140)='GPL\x00', 0x7ff, 0x2, &(0x7f0000000180)=""/2, 0x41000, 0x0, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f00000003c0)={0x1, 0x2}, 0x8, 0x10, &(0x7f0000000400)={0x2, 0x3, 0xa31, 0x400}, 0x10, 0xffffffffffffffff, 0x0, 0x1, &(0x7f0000000440)=[r4, r4, r4, r4], &(0x7f0000000480)=[{0x3, 0x4, 0x3}], 0x10, 0x6}, 0x94) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) socket$igmp(0x2, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00'}) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000100)=0x17) rename(&(0x7f0000000040)='./file1\x00', &(0x7f0000000080)='./file1\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) getpid() 11.112419848s ago: executing program 2 (id=1309): openat$ppp(0xffffffffffffff9c, &(0x7f00000004c0), 0x101940, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000800), 0x0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0xff00000000000000, 0x5, 0xfffffffffffffffd, 0x8001, 0x800000000000000, 0x1000001000, 0x45}, 0x0, &(0x7f0000000080)={0x3ff, 0x4, 0x100000, 0x9, 0x0, 0x10, 0x80000002}, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r1, &(0x7f0000000480)=[{0x0}], 0x1, 0x2, 0x0) 10.863901724s ago: executing program 4 (id=1310): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000007c5e0000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000005700000095"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) times(&(0x7f0000000180)) socketpair(0x6, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000180)=0xc) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0x11, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007e9eb4104c053800f516010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r5, 0x0, &(0x7f0000000240)={0x1c, 0x0, 0x0, 0x0}) 9.079887771s ago: executing program 2 (id=1312): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)={0x5c, r1, 0x917, 0x1000, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @loopback={0xffff0000}}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}]}, 0x5c}, 0x1, 0x0, 0x0, 0x44}, 0x0) 9.014881686s ago: executing program 5 (id=1313): socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001011404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x57) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x702, 0xe, 0xff0f, &(0x7f0000000540)="e460334470b8d480eb00c15286dd", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='limits\x00') preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000200)=""/46, 0x2e}], 0x1, 0xf44, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x400100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = open(&(0x7f0000000040)='./file0\x00', 0x101040, 0x0) fcntl$lock(r3, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffa}) r4 = syz_io_uring_setup(0x7728, &(0x7f0000000400)={0x0, 0x4f40, 0x3180, 0x3, 0x400246, 0x0, r3}, &(0x7f0000000340)=0x0, &(0x7f00000006c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f0000000280)=[@ioring_restriction_register_op={0x0, 0x11}], 0x1) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000180)="f2de85000066b9600000000f320f210c66b9e006000066b80080000066ba000000000f302e64660f3881130f6ac7baf80c66b844edc08866efbafc0cedf20f38f15b71f2f083155aa7", 0x49}], 0x1, 0x51, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r9, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0xf000}, {'\x00', "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) ioctl$KVM_RUN(r9, 0xae80, 0x0) syz_io_uring_submit(r5, r6, &(0x7f00000003c0)=@IORING_OP_MSG_RING={0x28, 0x40, 0x0, r4, 0x1, 0x0, 0x0, 0x3}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)) io_uring_enter(r4, 0x4c6e, 0xa8a7, 0x8, 0x0, 0x0) 8.903820482s ago: executing program 2 (id=1314): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x1f0, 0x24, 0x100, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x7, 0x2}, {0x1, 0xfff2}, {0x2, 0xe}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x7fff}}, @qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x6}}}, @TCA_STAB={0x108, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x6, 0xbd, 0xb1e, 0x2, 0xd, 0x4, 0xa}}, {0x18, 0x2, [0xfff0, 0x4, 0x401, 0x100, 0x5, 0x0, 0x4, 0x81, 0x2, 0x6]}}, {{0x1c, 0x1, {0x0, 0xf1, 0x6, 0x9f, 0x1, 0x5, 0x7f, 0x6}}, {0x10, 0x2, [0xfc1, 0x3, 0xfffb, 0xc669, 0x80, 0x5]}}, {{0x1c, 0x1, {0x7, 0x9, 0x0, 0xff, 0x1, 0x80, 0xffffffff, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x0, 0x4, 0xa62c, 0xf9c, 0x2, 0x7, 0xb, 0x4}}, {0xc, 0x2, [0x8c93, 0x6800, 0x5fb, 0x3]}}, {{0x1c, 0x1, {0x2, 0x4, 0x7, 0x1000, 0x0, 0x6, 0x400, 0x3}}, {0xa, 0x2, [0xa, 0x6, 0x5746]}}, {{0x1c, 0x1, {0x9, 0x5, 0xceff, 0x8, 0x2, 0xa299, 0x3ff, 0x8}}, {0x14, 0x2, [0x7, 0x8, 0x5, 0x7, 0x9, 0x7fff, 0x2, 0x3]}}]}, @TCA_INGRESS_BLOCK={0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x4}, @TCA_STAB={0x80, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9, 0x6, 0x0, 0xffffffff, 0x2, 0xe5, 0xfffffffd, 0xa}}, {0x18, 0x2, [0x7, 0x1, 0x8, 0x1, 0x1f6, 0x6000, 0x8, 0x1, 0x1, 0x4]}}, {{0x1c, 0x1, {0x0, 0xe, 0x0, 0x896, 0x2, 0x1, 0xe8a5, 0x1}}, {0x6, 0x2, [0xfff1]}}, {{0x1c, 0x1, {0x7f, 0x1, 0x7, 0x3, 0x3, 0x7fffffff, 0x5, 0x2}}, {0x8, 0x2, [0x5, 0x800]}}]}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x2000}, 0x20040084) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0xfff2}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20041010}, 0x4044000) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x1, 0x8}, {}, {0x0, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x24040004) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) r9 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) ioctl$EVIOCGABS0(r9, 0x80184540, &(0x7f00000002c0)=""/205) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="8000000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000024000280140001800800010000000000080002007f0000010c00028005000100000000000800074000000000080003"], 0x80}}, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r12 = socket(0x40000000015, 0x5, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000015000103000000000000e7ff0b00000008000100", @ANYRES32=r12], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4088010) kexec_load(0x0, 0x0, 0x0, 0x0) r13 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) pwrite64(r13, 0x0, 0x0, 0x26c) 7.952785605s ago: executing program 1 (id=1315): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582020002"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r1) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000ffffffff0c000000180001801400020076657468315f746f5f626174616476001c00038018000380140001800500020000000000080001"], 0x48}}, 0x40844) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@mpls_delroute={0x1c, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1, 0x100000}}, 0x1c}}, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000040), 0x101, 0x16183) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x4}]}], {0x14}}, 0x60}}, 0x0) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r5) sendmsg$IEEE802154_LLSEC_DEL_KEY(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="33052dbd7000ffdbdf252800000005002b00000000000a0001007770616e3000000006000400a2aa00000601060002000000"], 0x38}, 0x1, 0x0, 0x0, 0xc081}, 0x4000) 7.135418835s ago: executing program 5 (id=1316): r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) r1 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYRES16=r0], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000240), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000040)='blacklist\x00', &(0x7f0000000180)=@secondary) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f0000000500), 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000c00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = openat$dsp1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r4, @ANYBLOB=',wfdno=', @ANYRESHEX=r5]) ioperm(0x0, 0x2, 0x7e) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r6 = mq_open(&(0x7f0000000100)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x800, 0x2c, &(0x7f0000000300)={0xffffffffffffffff, 0x100004, 0x2, 0xf0}) mq_timedsend(r6, 0x0, 0x0, 0x0, 0x0) mq_timedsend(r6, 0x0, 0x0, 0xa, 0x0) mq_timedreceive(r6, &(0x7f0000000340)=""/200, 0xc8, 0x0, 0x0) 7.075156658s ago: executing program 4 (id=1317): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x1f0, 0x24, 0x100, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x7, 0x2}, {0x1, 0xfff2}, {0x2, 0xe}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x7fff}}, @qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x6}}}, @TCA_STAB={0x108, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x6, 0xbd, 0xb1e, 0x2, 0xd, 0x4, 0xa}}, {0x18, 0x2, [0xfff0, 0x4, 0x401, 0x100, 0x5, 0x0, 0x4, 0x81, 0x2, 0x6]}}, {{0x1c, 0x1, {0x0, 0xf1, 0x6, 0x9f, 0x1, 0x5, 0x7f, 0x6}}, {0x10, 0x2, [0xfc1, 0x3, 0xfffb, 0xc669, 0x80, 0x5]}}, {{0x1c, 0x1, {0x7, 0x9, 0x0, 0xff, 0x1, 0x80, 0xffffffff, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x0, 0x4, 0xa62c, 0xf9c, 0x2, 0x7, 0xb, 0x4}}, {0xc, 0x2, [0x8c93, 0x6800, 0x5fb, 0x3]}}, {{0x1c, 0x1, {0x2, 0x4, 0x7, 0x1000, 0x0, 0x6, 0x400, 0x3}}, {0xa, 0x2, [0xa, 0x6, 0x5746]}}, {{0x1c, 0x1, {0x9, 0x5, 0xceff, 0x8, 0x2, 0xa299, 0x3ff, 0x8}}, {0x14, 0x2, [0x7, 0x8, 0x5, 0x7, 0x9, 0x7fff, 0x2, 0x3]}}]}, @TCA_INGRESS_BLOCK={0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x4}, @TCA_STAB={0x80, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9, 0x6, 0x0, 0xffffffff, 0x2, 0xe5, 0xfffffffd, 0xa}}, {0x18, 0x2, [0x7, 0x1, 0x8, 0x1, 0x1f6, 0x6000, 0x8, 0x1, 0x1, 0x4]}}, {{0x1c, 0x1, {0x0, 0xe, 0x0, 0x896, 0x2, 0x1, 0xe8a5, 0x1}}, {0x6, 0x2, [0xfff1]}}, {{0x1c, 0x1, {0x7f, 0x1, 0x7, 0x3, 0x3, 0x7fffffff, 0x5, 0x2}}, {0x8, 0x2, [0x5, 0x800]}}]}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x2000}, 0x20040084) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0xfff2}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20041010}, 0x4044000) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x1, 0x8}, {}, {0x0, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x24040004) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) r9 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) ioctl$EVIOCGABS0(r9, 0x80184540, &(0x7f00000002c0)=""/205) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="8000000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000024000280140001800800010000000000080002007f0000010c00028005000100000000000800074000000000080003"], 0x80}}, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = socket(0x40000000015, 0x5, 0x0) sendmsg$nl_generic(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000015000103000000000000e7ff0b00000008000100", @ANYRES32=r13], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4088010) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x26c) 6.637610034s ago: executing program 2 (id=1318): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x2}, 0xfffffffe) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000480)) timer_create(0x2, 0x0, &(0x7f0000000480)) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) timer_create(0x2, 0x0, &(0x7f0000000480)=0x0) timer_settime(r1, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg(r2, &(0x7f00000029c0), 0x400006d, 0x20000004) timer_delete(r1) r3 = fsopen(&(0x7f0000000180)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffffff000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c00010062"], 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x830, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xe}}, 0x14) r4 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="3101000009005e08cb06030000e8160000010902240001000064000904340102d486100009058acf"], 0x0) syz_usb_control_io$rtl8150(r4, 0x0, 0x0) r5 = fsmount(r3, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000080)="30a0", 0x2}], 0x1}, 0x4040001) recvmsg$unix(r6, &(0x7f00000038c0)={0x0, 0x0, 0x0}, 0x1) recvmsg$unix(r6, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f00000000c0)=""/109, 0x6d}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x2, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000ec0), 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r8, 0x89e2, 0x0) getsockopt$inet_mreqn(r5, 0x0, 0x24, &(0x7f00000002c0)={@multicast2, @empty, 0x0}, &(0x7f0000000300)=0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0xe, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xb}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3ff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f0000000240)='syzkaller\x00', 0x6b01, 0x0, 0x0, 0x40f00, 0x8, '\x00', r9, 0x25, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x2, 0x3, 0x6, 0x5}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000380), &(0x7f00000003c0)=[{0x0, 0x5, 0xd, 0x8}, {0x4, 0x4, 0xf, 0x3}, {0x0, 0x1, 0xf, 0x6}, {0x2, 0x5, 0xb}, {0x5, 0x3, 0xa, 0x7}, {0x5, 0x2, 0x1, 0x6}], 0x10, 0x3ff}, 0x94) openat(r5, &(0x7f0000000280)='.\x00', 0x2000, 0x0) ioctl$SG_GET_RESERVED_SIZE(r5, 0x2272, &(0x7f0000000000)) 6.480047661s ago: executing program 3 (id=1319): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') read$FUSE(r2, &(0x7f0000000280)={0x2020}, 0x2020) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000140000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',']) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000002c0), r0) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3d3959a7c6e65945782e1682bd1bf724f6d1c7c9f37295a82fe5279e53ca24839bbe7f42d98dee3825b9a5841fc187027b446689433f841b36313f3dbbfc456a59458f89ad721830a912991d224308bc8c467606008ac9ec3f2b410836642cf598e7a74e22469d3786abed007bc850a1dcd1cbc89191acbdff4c09715cf1b1994d85", @ANYRES16=r3, @ANYBLOB="010025bd7000fcdbdf252e0000000a0001007770616e30000000"], 0x20}, 0x1, 0x0, 0x0, 0x24008000}, 0x814) 6.152739908s ago: executing program 3 (id=1320): socket$alg(0x26, 0x5, 0x0) add_key(&(0x7f0000000180)='asymmetric\x00', 0x0, 0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r0 = syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000500)=ANY=[@ANYBLOB="20007c04a62b3d632d30dcaf35a516b4467c34799df834b52557efb912883b38ff0fd887b54f02f49548379fec41c1e27d5974e0245def40f62bd529b19c9126b36f6ebe0c95dd3d43e2b38b8e905996ebccca66085864cd26914d9e98465cfe3b5ff833f99e5921092b83686971d5b84e3356d13f2cbce53986144449c7fb1d42f93ee216914eabf53bc4c113d1d6452ec01c5219e2b34eb778973a4c94863e69d2f0a2904a6c751a196cb931311b45fb", @ANYRES16=r0, @ANYRES32, @ANYBLOB="04000280"], 0x6c}, 0x1, 0x0, 0x0, 0x4000401}, 0x44084) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) syz_open_dev$vim2m(&(0x7f0000000180), 0x10, 0x2) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r4, 0x3b89, &(0x7f0000000000)={0x28, 0x2, r6, r5, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = socket$kcm(0x29, 0x2, 0x0) recvmsg$kcm(r7, 0x0, 0x40010020) close_range(r3, 0xffffffffffffffff, 0x0) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000fc0)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x7, 0x7, 0x772a, 0xffffffffe, 0x1]}, &(0x7f0000000000)=0x78) r8 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r8, &(0x7f0000001440)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, 0x0}}], 0x1, 0x40000) 5.281516533s ago: executing program 1 (id=1321): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000500)="5c00000013006bcc9e3be35c17aa31076b876c", 0x13}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8881) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f00000002c0)=ANY=[@ANYBLOB="010011009c1a02e8f051"]) sendmsg$IPCTNL_MSG_CT_GET_DYING(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(0xffffffffffffffff, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) 5.271763258s ago: executing program 3 (id=1322): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0xc, 0x0, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={0x0}, 0x1, 0x0, 0x0, 0xc044}, 0x80) sendmsg$BATADV_CMD_TP_METER_CANCEL(r0, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000400)={0x0}}, 0x20000000) io_setup(0x58, &(0x7f00000001c0)=0x0) r2 = socket(0x1e, 0x1, 0x0) connect$tipc(r2, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r2, &(0x7f0000000400), 0x2000011a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, 0x0) recvmmsg(r2, &(0x7f0000002700)=[{{0x0, 0x0, &(0x7f00000023c0)=[{&(0x7f0000000040)=""/4096, 0x1000}], 0x1}, 0x74e96c96}, {{0x0, 0x0, 0x0}, 0xa}], 0x2, 0x40, 0x0) io_setup(0xffffff0a, &(0x7f0000001040)=0x0) io_destroy(r5) io_submit(r1, 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, &(0x7f0000001080)="2dec88d8670e633f8e895b58536fdab5", 0x10) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000180)=ANY=[@ANYBLOB="1c00000056000106000000000000000007"], 0x1c}], 0x1}, 0x0) 4.589664452s ago: executing program 1 (id=1323): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f00000010c0)=ANY=[@ANYBLOB="6b0ee0b3d41b1b", @ANYRES32=r0, @ANYBLOB="5a1a4a491a764978a6df944a78bb0c7d889e8ad43bb05ec055009323faec8824ea6e21c394fd75892faebf233e18ba849dcb407ca2b883", @ANYBLOB="647a693c8d6c84fb00f39e9edd1301de72dbdf5e1eb3b6a29058f715ce29f47cf4ee5fe866", @ANYRES64=0x0, @ANYBLOB="3c9b73697bcfa881e7520a9dbb75ff7fe2a668d81f16501ae405e78709a34f00364cdd105ef0c8a58575e18f5938b004dd15adaa683968d15ae1dc18f94ec0829918a0dc9bd7aec7db5d76d7019a2f3deeea8fc27e4dad9e5e2e84359f9f976a4259b722a01b2fe8662edc75d87478fa66e466726ad41d3f19e7ab39d451aa61014a2b9f8985e2d276417d4a10f8281b20265bde1842dd3af6f603c12457bd933d1d04e09bb254c2f72da086259e4c713c4bf1c04e287b7c15a4c6363d9f77d5599e31c6e4723306bfa268247f93775a88837654bf80875d016fc41c70e6c8fcfa8470fa8562e846cbc3f30bef7ecd480344774abd4933ef7bbe7f88d495346559f4825dfd0cdcb9950af5ede453ad7f8b6ea5fcb5a97d05e145dfa4b2f4fd920048035b505d787e1253eda430e3035187bfead765a2f55df82ae965baa6dafb1e5fffd58bb74eb193a3b26f13fced48ffd0065ced0ce8bd6601b771d03b9dc4ca62f4b3561affc5d8f0df43d779b7205606afd216180498f143e5b3d903d57cb15e30edb766b064ac3e7a8d547e5070ee45e4b2d0c021dc5b7b791299423d268dbe5c3b18d272ff374c82920fe60a856955ea0b36980e8ecb393f9ac4b49660b0afa9a30000ee7fe29f8bafab4f15061e40dc892b131ac3056c224ef28135d24b3a58418ef6b55d7369a245c939e10ae18ff3b6eb3c9a4260160d0d8239f77328978ef006c9c6bb8e0692ba3932558a66ec187d498530c727b6ce8aea59dddd2e4b91e315702e1ad122c2825d360508b865c26c97decafc7a13478c420ef60430fa9bc9368355abff8883e07b88cfce77124d5fbef2f39feeddc6ff8f77902ae37239812b958dd010719e73e7d0ba7f6b333a13c9a634e4cabf78e9e7277aee6c34160dc3debd8a0ed3d33eeb8a08b2925e08982720370a45895673db1500ea888e22808a7f88fd3ad1527aadc97f2c111c81da88c570d02ebb822131a7514ddf20778a27658074bca7ae170e3caefc44162214771e3f08678ed9600056b0165049e0650e0de5910583b733461a9d56f8a61970846b30ab53762bc79c86cc1e28e5708f683fff9170019d32acceaa33bf1a58dc198146db5f543cd05ab108af2898b3fcef7d8cef6990db4d1d62b36660a59f51649ccd2f8a953e32682532ff8d295f48ce802496c06d1e360b1057f949a84458126973d16a7e115776afee28c3fa704a6b9bab89aae4cbaa533df71c99896fef2aa99b6f15f0165167e563bbc76f8e8a7141254738b863a9ccea7902ad560c7bafb83cb5b5f7388de5c68526129133945076d1caaef8f96a70c95d00bb8eeb0f8c723deffef14323b64a8e4a8e05cfd7f5878a49c10eff5a9be9c7a7538ff38da32cfe72b7a25b881be3b95f5a7404da7a2782ec46e11b2dde51c69f5b35fcb12630ea400c7e95517584402a1555e13142f76b67f8d6083baea70c367412f1a62776cdcacbb09b61e7432e5ae368bd58dd0801287aeb04e81f6fb726f00521de0f0a40915c8bdecdce5334fea0b8e72d4719f941992cda086c4930138f81df4a8568c385accd7ba16f02848091d8984b22d92501d7fc394a89cc3a5415db77b9d09c62d33f786eb503311b25672b6d845f59c46c91d77273876dee1c208adc26683c3e9f5a7f45a6b7c2efa9fc492043fe04643c3d38d8b315b495fd395ff1f1864415c0a875f888e200f44173f41016a419424d609d642bf370caf97dc819997d2a6c55083af7e68116d733dc699cb66c60b70c458ae0471224964cbe630d2cfab132c8769d55f743df3b4f2e7db58630ae2d24125ef9421af4b05247962f6af6b3c89a237af83ae2fff4ec56ec9c180ca8ea8a717ac7a99e963f7371057c34761d1068b6544c043fcf850770d06a30ecf49c451413be25e76ca92ca5ba286b9978c54db7c4f3778e396858f8ff10488a84fa348749ff28701a36439ae9b4b1cd68b4855614cc94fc917b62edc8d767365c8ccb631bc58b18b7977bca077cd1212d884e01d00adb99b96d7c4580d2aba68dd2fe0d79b650b70ebb385141a233ad71d6cebb4f8f4f6303dd58f8a9aa5d8d32cdc0a4731f4bc6d91c8dcae2e33bc04089583d77eecc10572c91690b538adba272a40e6ce3c3d0fa18858ae8e54b6fa8166c047e17c60d974ba8def1f75da2cc7ce1c06f07c5c0a0dff6de198d42f86e9e2c165581af8da83e3e57166d25f281fc89a923d49323a9a7487b4a7940440a1ba22ccd02e38d58f69ae775e0f75cf909574ad1822b55056ee13d6c819160d735a8c4aa6533a92896be8187eb6b6305e0bd23c0ffa11e9a6fdc6aeaa637bf584fc6e422abe76b9f7519ac574292b9ce902f715afdec03b3b86c680fa7e77277eee85642e894de4cb53833b134c4ea1b6e217bdcd87625c9ccfcfd24ca57146a127ecc891b26533b8f4d10ea8cc40cd273aecbf599191b9d58f2336f637bf9ef050d381229237de1ff84b93767439484ac1a30b0ea763aff734c1b4531bcc61942cc2353139b86c0a414ceab2be450d4e554a5dd322d7ba3958408cfe37ea2b88c2556b8f8eac6b4e152ebee2f325c3bbcffc97a80752057a2bc0770b0ea505ed605c4a00a56a9fbdd83b21701e6a0fc17602d0d14140723a4b4fdf5a2dba88fc180f4a0c8c50a91559c5ff2f2b2408efb4706bded7f285a7bde54b1f1e11e2b9f04381bfbe1a11386c5c80702b2e0aae2c140accc497dab12e61f298cb9afca374783bd5e3cbb89bb283cd23f93dc0ebc02fc1567d00088795bf25c1dce3daf6926e66f5366af8d21c5fc0d6d55dc0f9f99c8ccb18b40897f2936c59c592dc158c9c2988996ab970046bb0bd79ad885bb6928fe9e41da145dc98b350888711cd2aeea3b8c842fa77bb9cdeef0d84999184f46d9a4caaa42f8f65571dfd85627a3a0a3352c953158fc8d2eb32c70b06f7830987603bfc4e242ab35cf29f072e594fa76b84791cc4ce90bc75bfb8b8dc202e572a764db50c280686c9763718fb7681cdf45d322ac52cc82a6f55344a7257081effc668966ea8733b6ec34eb20deba119d886c7a276799d2f4c1d7e3631bb548280daf1f8b485b0110424747bdfb4c0f8e43905aa17345fa5c0020e8b2b822811905e9b4422a6bf895be64a06a11b680ad614811f89746fae2ddc780d31e6d8de6e51172011f6a8cafa2452cad2bd584bc74b31d2bb5a32c8178575627bef1c924c0848d496303685562f24a11c66e11ab11927d8e904d917bc0faf3a4e03d4e8ac2b1b14dfba378dd974604435b17e4d96100f806398f09e0e235ecabc9d56f953d4e48338a4b30fd922e2660b57db142c29a81a0c366fbe39c12bd741effc4aa612e819040990550f917c2a5cf8f26388543ea9bf5d64e14977cb445740b0df911724ec641d7d4518973f5fc334ac739e8e72c3e473d7322e61e9027dddd848c1dfd8dd2c923a143a4ac28423a2079e93263591a68cb0d191229e843d45c7a1ca257977d462743effedbc97773391621e2caf44597c7caeb8770a42e6658bd3e9ae1716c73759aacd3bfe6ab7322a6a9e1c7b28588e53393b25425d690ec163189bd30c83d9bc3550d3206205e05748783fd4017058c3f3b95f6ce58cec96b2613e1930507ec3fed988e38a20d0624bddd29613f6fc09f864bed2313e2f5e0b08bed40828663c6ce7c3b62ad039398071ed3fadf34d0063bd52c07ab1b1fa5afe1047595fd8df231eb2584da47cceaff36e55e280cf966f341d2605bbd1fd600dc50ed2c93eb2cbff370d2dbe914af4226a7a3a7c2cf05887efa24647563e33e3da7ab0f80f372424bd69175bbd7533cd4afcad9bbd5ebfc3f303aeb441f93204e0db41b9ad137a57c83b8a0acf13bbff0c504ea49c8ce39424382eee8f42913876b30decdcb7db71f739183e978f646ab1509d805466a5c83b7230160bc4ab3580052fae18af576dbf91221239f7b59c1e35fa40e38f8c375f5e4bf42e01f7a71373f6b82fe21fea03561e00f4f77cd6f25da2b4b02ce1db5196256109aed09ce502b80aafb7041cb779b4ee966b15464a819f625b2e43f26d263219fcdb8588cac1d5ee29d25682e1f3ece192dcbb6425e9306e28f08b22cdec964189556acb1e83259cc84d7fe3a4615bc73a2f93800d45726bb9ccb0ff5df1c9cb058aaed916edb2df2f2cc98b7a45ad9e226a6a6d9be476e767cd60e54084aaf758081b56b56400b73c026e41401d5097a6b57186338a9a9f2e9e5cf2131c92cabbaea4d313e8b46c11e1a57ad3840b538b02d11fab4aa781c40ed63d6b09a6e606d05134338e7d3fca78a0f09abf95d22d9a67d17b21bbbc6efa3079fc33de77d9dbc1eb15960a5cc5128f79e3e6d57f859020145657dd7334de9a96e4564c739cc8e11aee1924da1e6aea2dd9bc5d678b643cfd181d5b365dd8f2296f14e2b3bff983a1295705692e807f1712cf3c22614553b55cdc322ea22d9ba5ffd770d988553de98d6649af2227ca1416481d76a3c5334d61327a21a6b0a22eb5d59f8b2535384254057dd8a826b484a588d1f304960c8c08b4e0ffdf82ea1c4be5075f987d587aa4e5345fc68adc233d8e3917c5f7fb89ac97f4c04d9b367b6745c9329516b346951653c951fa8d840f40cb2415bfd11f4d5e54e15c7a69852d19db5191cee6bb8a6c32a6c8e82393a67265645b4aad9c30e12a2a8e7a3c94043963e7cb5faf48bcccdb58dfe94208a5763ead8b95cace3b543aa6e9a8b6b3a202c554b226d896d76444ba3b105091c00c84d402f133926b7b998940c433159009d2693c3699cd0237bb73d5b536a1ca81272cbb658591d72397e8f8aac7ce655ec36a3458ec673953946200b2079f0c0dd875c0f52c3047201af9dc04032baa4ba9171584521840194d29d8badd69a86ac425f63a8b72c3e377c8f6ec1911bae792cede8a1ed75ddea30ad23615cc0038c69a2c43e17e63e5436d4051bd9a0fd3dfb27d30c31a0cd234bd1dcd8eeadcc31cf3622896b09c07721d9602e9eb85c91bd0beb488e7fd002d840e15f5d3dacab7fdbc0c2c729001539a7439dd74284179bd6c769162f03198562cecbb8cb154d11a9d4ce5e2c3476c09e72cdb65154840fa4c3068eeb6ffb05c989f138a37bd665057933683e17ef608b9015dbb9b76e29bb454356710e8ab63f1f1c4cdd535dc0ff3941814eebdf42a6e162f32e5a8f8f0f87d409b27e1805d0b7814abb54ace58fa547d42bf16d6d930ab58fbe54871654eb2000a496c0a3964b631dce807a3348b52716a35ab5f9af2cad44c7e9b2e842f79ebb4c9c95c965965f32be0f71a0404224f7bb3800d45386ddc059381024eff6a3d6ed4ad8475951a65d3e22d4a8377a07e244c86f3eb7dcfec44b07c4e32389a6aeac609d02a345a979f6457cc1066cb4091acde000d16f83241c8d22a407b1476d167d4611a25406d1b0251693fb557f03e0ae4f1e5f1636822d28a97762150937af91710bdf474b0eaa5e07c66ba2d4fb63d0bd10cd6f2144094030ef82f3e4eb0e01425cef0eca4f43df0db4dd651e066584b1339de3e95c907492da76fa2dcc4d1ca06c403b01ed4a914468486c33b8bff629879f5b22bc6be8a9f807fd2fb54a6f3c111e9813d28f87a2c745672447b85e2e54afda7dbc1d6ca60df7b151f73a1e12f2550396caecd95b7e9e9a50bc2e861b255311134687aa4514e6cf08988df57f21e07400cd8037bf6d3341baa748effa760899846101f8b346007c9c8ce4d89b0cc965b2994af84a2347cc41d3ede3dd2d7064d6", @ANYRESDEC=r1]) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x400017e) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r3 = open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000240)=[@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x39}}]}, &(0x7f0000000080)=0x10) syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb08004500002800000000000190780a110102ac1414aa0400ec68010000004500000000000000001100000000000000000000ba5366406a3fe3f65697d1ce8677133c47ae03d83ea73a50613f2fa84e7b866ad6d7dd1f3387d5c4741bb7d97be6b20663f28f87e4be5f29a24ec8f7ef85c1cf2d723bc403e355"], 0x0) listen(r4, 0xda90) accept4(r4, 0x0, 0x0, 0x0) r5 = open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r6, 0x2000009) sendfile(r5, r6, 0x0, 0x20000000000006) vmsplice(r3, &(0x7f0000000200)=[{&(0x7f00000002c0)='u', 0x1}], 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$TUNSETOFFLOAD(r8, 0x5421, 0x110e22fff7) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) 4.315103927s ago: executing program 4 (id=1324): mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, 0x0, &(0x7f0000000140)='vfat\x00', 0x208000, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x2}}, 0x10) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200009200800000190000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/14], 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = openat$null(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x0, &(0x7f0000000200)}) ioctl$DRM_IOCTL_GEM_CLOSE(r3, 0x40086409, &(0x7f0000000200)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x94) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x5, 0x1}, {0x0, 0x5}, {0x8, 0x7}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x15625}]}}]}, 0xfffffffffffffe8c}, 0x1, 0x0, 0x0, 0x20844}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "9d09b974e9060a3c", "46a278ba392c53fa29a17543c440dc8a", "01a55c10", "969509a9c9f65fc4"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "f64e4099107323f5", "53c272d8b763f690b35605dff8a4a8d2", "3da2d199", "72392a24199b5903"}, 0x28) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000a00fc000000180001"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 3.901234713s ago: executing program 2 (id=1325): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0xc, 0x3032, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) add_key(&(0x7f0000000180)='asymmetric\x00', 0x0, 0x0, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r0 = syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000500)=ANY=[@ANYBLOB="20007c04a62b3d632d30dcaf35a516b4467c34799df834b52557efb912883b38ff0fd887b54f02f49548379fec41c1e27d5974e0245def40f62bd529b19c9126b36f6ebe0c95dd3d43e2b38b8e905996ebccca66085864cd26914d9e98465cfe3b5ff833f99e5921092b83686971d5b84e3356d13f2cbce53986144449c7fb1d42f93ee216914eabf53bc4c113d1d6452ec01c5219e2b34eb778973a4c94863e", @ANYRES16=r0, @ANYRES32, @ANYBLOB="04000280"], 0x6c}, 0x1, 0x0, 0x0, 0x4000401}, 0x44084) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r5, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) ioctl$IOMMU_HWPT_ALLOC$NONE(r4, 0x3b89, &(0x7f0000000000)={0x28, 0x2, r6, r5, 0x0, 0x0, 0x0, 0x0, 0x0}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)=@alg, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000040)=""/64, 0x40}, {&(0x7f00000003c0)=""/101, 0x65}], 0x2, &(0x7f0000000440)=""/106, 0x6a}, 0x40010020) close_range(r3, 0xffffffffffffffff, 0x0) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000fc0)={'filter\x00', 0x0, 0x0, 0x0, [0x8, 0x7, 0x7, 0x772a, 0xffffffffe, 0x1]}, &(0x7f0000000000)=0x78) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001440)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, 0x0}}], 0x1, 0x40000) 3.900263127s ago: executing program 5 (id=1326): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r1) getsockname$packet(r1, 0x0, &(0x7f0000000200)) r2 = shmget$private(0x0, 0x4000, 0x2, &(0x7f00003af000/0x4000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) sendmsg$inet(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000240)="6e37cff5b582e082d58cb23de3c19dc4971d9b", 0x13}], 0x1}, 0x0) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) read(r6, &(0x7f0000000380)=""/41, 0x29) shmat(r2, &(0x7f0000000000/0x2000)=nil, 0x6000) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, @dev, @dev, 0x80, 0x0, 0x1, 0x1}}) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="640000001800080028bd7000fddbdf250214147fff03ff0a0022000008000f000000010008000100ac14141308000200e000000108000400", @ANYRES32=0x0, @ANYBLOB="05001b001100000008000100e0000001080005006401010108000100e000000208000300", @ANYRES32=0x0, @ANYBLOB="000000000032d0e0"], 0x64}}, 0x40) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x2a800, 0x0) 3.855843709s ago: executing program 3 (id=1327): socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001011404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x57) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x702, 0xe, 0xff0f, &(0x7f0000000540)="e460334470b8d480eb00c15286dd", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='limits\x00') preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000200)=""/46, 0x2e}], 0x1, 0xf44, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x400100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = open(&(0x7f0000000040)='./file0\x00', 0x101040, 0x0) fcntl$lock(r3, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffa}) r4 = syz_io_uring_setup(0x7728, &(0x7f0000000400)={0x0, 0x4f40, 0x3180, 0x3, 0x400246, 0x0, r3}, &(0x7f0000000340)=0x0, &(0x7f00000006c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f0000000280)=[@ioring_restriction_register_op={0x0, 0x11}], 0x1) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000180)="f2de85000066b9600000000f320f210c66b9e006000066b80080000066ba000000000f302e64660f3881130f6ac7baf80c66b844edc08866efbafc0cedf20f38f15b71f2f083155aa7", 0x49}], 0x1, 0x51, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r9, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0xf000}, {'\x00', "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) ioctl$KVM_RUN(r9, 0xae80, 0x0) syz_io_uring_submit(r5, r6, &(0x7f00000003c0)=@IORING_OP_MSG_RING={0x28, 0x40, 0x0, r4, 0x1, 0x0, 0x0, 0x3}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)) io_uring_enter(r4, 0x4c6e, 0xa8a7, 0x8, 0x0, 0x0) 3.811874801s ago: executing program 4 (id=1328): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f00000010c0)=ANY=[@ANYBLOB="6b0ee0b3d41b1b", @ANYRES32=r0, @ANYBLOB="5a1a4a491a764978a6df944a78bb0c7d889e8ad43bb05ec055009323faec8824ea6e21c394fd75892faebf233e18ba849dcb407ca2b883", @ANYBLOB="647a693c8d6c84fb00f39e9edd1301de72dbdf5e1eb3b6a29058f715ce29f47cf4ee5fe866", @ANYRES64=0x0, @ANYBLOB="3c9b73697bcfa881e7520a9dbb75ff7fe2a668d81f16501ae405e78709a34f00364cdd105ef0c8a58575e18f5938b004dd15adaa683968d15ae1dc18f94ec0829918a0dc9bd7aec7db5d76d7019a2f3deeea8fc27e4dad9e5e2e84359f9f976a4259b722a01b2fe8662edc75d87478fa66e466726ad41d3f19e7ab39d451aa61014a2b9f8985e2d276417d4a10f8281b20265bde1842dd3af6f603c12457bd933d1d04e09bb254c2f72da086259e4c713c4bf1c04e287b7c15a4c6363d9f77d5599e31c6e4723306bfa268247f93775a88837654bf80875d016fc41c70e6c8fcfa8470fa8562e846cbc3f30bef7ecd480344774abd4933ef7bbe7f88d495346559f4825dfd0cdcb9950af5ede453ad7f8b6ea5fcb5a97d05e145dfa4b2f4fd920048035b505d787e1253eda430e3035187bfead765a2f55df82ae965baa6dafb1e5fffd58bb74eb193a3b26f13fced48ffd0065ced0ce8bd6601b771d03b9dc4ca62f4b3561affc5d8f0df43d779b7205606afd216180498f143e5b3d903d57cb15e30edb766b064ac3e7a8d547e5070ee45e4b2d0c021dc5b7b791299423d268dbe5c3b18d272ff374c82920fe60a856955ea0b36980e8ecb393f9ac4b49660b0afa9a30000ee7fe29f8bafab4f15061e40dc892b131ac3056c224ef28135d24b3a58418ef6b55d7369a245c939e10ae18ff3b6eb3c9a4260160d0d8239f77328978ef006c9c6bb8e0692ba3932558a66ec187d498530c727b6ce8aea59dddd2e4b91e315702e1ad122c2825d360508b865c26c97decafc7a13478c420ef60430fa9bc9368355abff8883e07b88cfce77124d5fbef2f39feeddc6ff8f77902ae37239812b958dd010719e73e7d0ba7f6b333a13c9a634e4cabf78e9e7277aee6c34160dc3debd8a0ed3d33eeb8a08b2925e08982720370a45895673db1500ea888e22808a7f88fd3ad1527aadc97f2c111c81da88c570d02ebb822131a7514ddf20778a27658074bca7ae170e3caefc44162214771e3f08678ed9600056b0165049e0650e0de5910583b733461a9d56f8a61970846b30ab53762bc79c86cc1e28e5708f683fff9170019d32acceaa33bf1a58dc198146db5f543cd05ab108af2898b3fcef7d8cef6990db4d1d62b36660a59f51649ccd2f8a953e32682532ff8d295f48ce802496c06d1e360b1057f949a84458126973d16a7e115776afee28c3fa704a6b9bab89aae4cbaa533df71c99896fef2aa99b6f15f0165167e563bbc76f8e8a7141254738b863a9ccea7902ad560c7bafb83cb5b5f7388de5c68526129133945076d1caaef8f96a70c95d00bb8eeb0f8c723deffef14323b64a8e4a8e05cfd7f5878a49c10eff5a9be9c7a7538ff38da32cfe72b7a25b881be3b95f5a7404da7a2782ec46e11b2dde51c69f5b35fcb12630ea400c7e95517584402a1555e13142f76b67f8d6083baea70c367412f1a62776cdcacbb09b61e7432e5ae368bd58dd0801287aeb04e81f6fb726f00521de0f0a40915c8bdecdce5334fea0b8e72d4719f941992cda086c4930138f81df4a8568c385accd7ba16f02848091d8984b22d92501d7fc394a89cc3a5415db77b9d09c62d33f786eb503311b25672b6d845f59c46c91d77273876dee1c208adc26683c3e9f5a7f45a6b7c2efa9fc492043fe04643c3d38d8b315b495fd395ff1f1864415c0a875f888e200f44173f41016a419424d609d642bf370caf97dc819997d2a6c55083af7e68116d733dc699cb66c60b70c458ae0471224964cbe630d2cfab132c8769d55f743df3b4f2e7db58630ae2d24125ef9421af4b05247962f6af6b3c89a237af83ae2fff4ec56ec9c180ca8ea8a717ac7a99e963f7371057c34761d1068b6544c043fcf850770d06a30ecf49c451413be25e76ca92ca5ba286b9978c54db7c4f3778e396858f8ff10488a84fa348749ff28701a36439ae9b4b1cd68b4855614cc94fc917b62edc8d767365c8ccb631bc58b18b7977bca077cd1212d884e01d00adb99b96d7c4580d2aba68dd2fe0d79b650b70ebb385141a233ad71d6cebb4f8f4f6303dd58f8a9aa5d8d32cdc0a4731f4bc6d91c8dcae2e33bc04089583d77eecc10572c91690b538adba272a40e6ce3c3d0fa18858ae8e54b6fa8166c047e17c60d974ba8def1f75da2cc7ce1c06f07c5c0a0dff6de198d42f86e9e2c165581af8da83e3e57166d25f281fc89a923d49323a9a7487b4a7940440a1ba22ccd02e38d58f69ae775e0f75cf909574ad1822b55056ee13d6c819160d735a8c4aa6533a92896be8187eb6b6305e0bd23c0ffa11e9a6fdc6aeaa637bf584fc6e422abe76b9f7519ac574292b9ce902f715afdec03b3b86c680fa7e77277eee85642e894de4cb53833b134c4ea1b6e217bdcd87625c9ccfcfd24ca57146a127ecc891b26533b8f4d10ea8cc40cd273aecbf599191b9d58f2336f637bf9ef050d381229237de1ff84b93767439484ac1a30b0ea763aff734c1b4531bcc61942cc2353139b86c0a414ceab2be450d4e554a5dd322d7ba3958408cfe37ea2b88c2556b8f8eac6b4e152ebee2f325c3bbcffc97a80752057a2bc0770b0ea505ed605c4a00a56a9fbdd83b21701e6a0fc17602d0d14140723a4b4fdf5a2dba88fc180f4a0c8c50a91559c5ff2f2b2408efb4706bded7f285a7bde54b1f1e11e2b9f04381bfbe1a11386c5c80702b2e0aae2c140accc497dab12e61f298cb9afca374783bd5e3cbb89bb283cd23f93dc0ebc02fc1567d00088795bf25c1dce3daf6926e66f5366af8d21c5fc0d6d55dc0f9f99c8ccb18b40897f2936c59c592dc158c9c2988996ab970046bb0bd79ad885bb6928fe9e41da145dc98b350888711cd2aeea3b8c842fa77bb9cdeef0d84999184f46d9a4caaa42f8f65571dfd85627a3a0a3352c953158fc8d2eb32c70b06f7830987603bfc4e242ab35cf29f072e594fa76b84791cc4ce90bc75bfb8b8dc202e572a764db50c280686c9763718fb7681cdf45d322ac52cc82a6f55344a7257081effc668966ea8733b6ec34eb20deba119d886c7a276799d2f4c1d7e3631bb548280daf1f8b485b0110424747bdfb4c0f8e43905aa17345fa5c0020e8b2b822811905e9b4422a6bf895be64a06a11b680ad614811f89746fae2ddc780d31e6d8de6e51172011f6a8cafa2452cad2bd584bc74b31d2bb5a32c8178575627bef1c924c0848d496303685562f24a11c66e11ab11927d8e904d917bc0faf3a4e03d4e8ac2b1b14dfba378dd974604435b17e4d96100f806398f09e0e235ecabc9d56f953d4e48338a4b30fd922e2660b57db142c29a81a0c366fbe39c12bd741effc4aa612e819040990550f917c2a5cf8f26388543ea9bf5d64e14977cb445740b0df911724ec641d7d4518973f5fc334ac739e8e72c3e473d7322e61e9027dddd848c1dfd8dd2c923a143a4ac28423a2079e93263591a68cb0d191229e843d45c7a1ca257977d462743effedbc97773391621e2caf44597c7caeb8770a42e6658bd3e9ae1716c73759aacd3bfe6ab7322a6a9e1c7b28588e53393b25425d690ec163189bd30c83d9bc3550d3206205e05748783fd4017058c3f3b95f6ce58cec96b2613e1930507ec3fed988e38a20d0624bddd29613f6fc09f864bed2313e2f5e0b08bed40828663c6ce7c3b62ad039398071ed3fadf34d0063bd52c07ab1b1fa5afe1047595fd8df231eb2584da47cceaff36e55e280cf966f341d2605bbd1fd600dc50ed2c93eb2cbff370d2dbe914af4226a7a3a7c2cf05887efa24647563e33e3da7ab0f80f372424bd69175bbd7533cd4afcad9bbd5ebfc3f303aeb441f93204e0db41b9ad137a57c83b8a0acf13bbff0c504ea49c8ce39424382eee8f42913876b30decdcb7db71f739183e978f646ab1509d805466a5c83b7230160bc4ab3580052fae18af576dbf91221239f7b59c1e35fa40e38f8c375f5e4bf42e01f7a71373f6b82fe21fea03561e00f4f77cd6f25da2b4b02ce1db5196256109aed09ce502b80aafb7041cb779b4ee966b15464a819f625b2e43f26d263219fcdb8588cac1d5ee29d25682e1f3ece192dcbb6425e9306e28f08b22cdec964189556acb1e83259cc84d7fe3a4615bc73a2f93800d45726bb9ccb0ff5df1c9cb058aaed916edb2df2f2cc98b7a45ad9e226a6a6d9be476e767cd60e54084aaf758081b56b56400b73c026e41401d5097a6b57186338a9a9f2e9e5cf2131c92cabbaea4d313e8b46c11e1a57ad3840b538b02d11fab4aa781c40ed63d6b09a6e606d05134338e7d3fca78a0f09abf95d22d9a67d17b21bbbc6efa3079fc33de77d9dbc1eb15960a5cc5128f79e3e6d57f859020145657dd7334de9a96e4564c739cc8e11aee1924da1e6aea2dd9bc5d678b643cfd181d5b365dd8f2296f14e2b3bff983a1295705692e807f1712cf3c22614553b55cdc322ea22d9ba5ffd770d988553de98d6649af2227ca1416481d76a3c5334d61327a21a6b0a22eb5d59f8b2535384254057dd8a826b484a588d1f304960c8c08b4e0ffdf82ea1c4be5075f987d587aa4e5345fc68adc233d8e3917c5f7fb89ac97f4c04d9b367b6745c9329516b346951653c951fa8d840f40cb2415bfd11f4d5e54e15c7a69852d19db5191cee6bb8a6c32a6c8e82393a67265645b4aad9c30e12a2a8e7a3c94043963e7cb5faf48bcccdb58dfe94208a5763ead8b95cace3b543aa6e9a8b6b3a202c554b226d896d76444ba3b105091c00c84d402f133926b7b998940c433159009d2693c3699cd0237bb73d5b536a1ca81272cbb658591d72397e8f8aac7ce655ec36a3458ec673953946200b2079f0c0dd875c0f52c3047201af9dc04032baa4ba9171584521840194d29d8badd69a86ac425f63a8b72c3e377c8f6ec1911bae792cede8a1ed75ddea30ad23615cc0038c69a2c43e17e63e5436d4051bd9a0fd3dfb27d30c31a0cd234bd1dcd8eeadcc31cf3622896b09c07721d9602e9eb85c91bd0beb488e7fd002d840e15f5d3dacab7fdbc0c2c729001539a7439dd74284179bd6c769162f03198562cecbb8cb154d11a9d4ce5e2c3476c09e72cdb65154840fa4c3068eeb6ffb05c989f138a37bd665057933683e17ef608b9015dbb9b76e29bb454356710e8ab63f1f1c4cdd535dc0ff3941814eebdf42a6e162f32e5a8f8f0f87d409b27e1805d0b7814abb54ace58fa547d42bf16d6d930ab58fbe54871654eb2000a496c0a3964b631dce807a3348b52716a35ab5f9af2cad44c7e9b2e842f79ebb4c9c95c965965f32be0f71a0404224f7bb3800d45386ddc059381024eff6a3d6ed4ad8475951a65d3e22d4a8377a07e244c86f3eb7dcfec44b07c4e32389a6aeac609d02a345a979f6457cc1066cb4091acde000d16f83241c8d22a407b1476d167d4611a25406d1b0251693fb557f03e0ae4f1e5f1636822d28a97762150937af91710bdf474b0eaa5e07c66ba2d4fb63d0bd10cd6f2144094030ef82f3e4eb0e01425cef0eca4f43df0db4dd651e066584b1339de3e95c907492da76fa2dcc4d1ca06c403b01ed4a914468486c33b8bff629879f5b22bc6be8a9f807fd2fb54a6f3c111e9813d28f87a2c745672447b85e2e54afda7dbc1d6ca60df7b151f73a1e12f2550396caecd95b7e9e9a50bc2e861b255311134687aa4514e6cf08988df57f21e07400cd8037bf6d3341baa748effa760899846101f8b346007c9c8ce4d89b0cc965b2994af84a2347cc41d3ede3dd2d7064d6", @ANYRESDEC=r1]) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x400017e) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r3 = open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r4, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000240)=[@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x39}}]}, &(0x7f0000000080)=0x10) syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb08004500002800000000000190780a110102ac1414aa0400ec68010000004500000000000000001100000000000000000000ba5366406a3fe3f65697d1ce8677133c47ae03d83ea73a50613f2fa84e7b866ad6d7dd1f3387d5c4741bb7d97be6b20663f28f87e4be5f29a24ec8f7ef85c1cf2d723bc403e355"], 0x0) listen(r4, 0xda90) accept4(r4, 0x0, 0x0, 0x0) r5 = open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r6, 0x2000009) sendfile(r5, r6, 0x0, 0x20000000000006) vmsplice(r3, &(0x7f0000000200)=[{&(0x7f00000002c0)='u', 0x1}], 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) ioctl$TUNSETOFFLOAD(r8, 0x5421, 0x110e22fff7) r9 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r9, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x60) 3.019311159s ago: executing program 2 (id=1329): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x89a0, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x1f0, 0x24, 0x100, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x7, 0x2}, {0x1, 0xfff2}, {0x2, 0xe}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x7fff}}, @qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x6}}}, @TCA_STAB={0x108, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x6, 0xbd, 0xb1e, 0x2, 0xd, 0x4, 0xa}}, {0x18, 0x2, [0xfff0, 0x4, 0x401, 0x100, 0x5, 0x0, 0x4, 0x81, 0x2, 0x6]}}, {{0x1c, 0x1, {0x0, 0xf1, 0x6, 0x9f, 0x1, 0x5, 0x7f, 0x6}}, {0x10, 0x2, [0xfc1, 0x3, 0xfffb, 0xc669, 0x80, 0x5]}}, {{0x1c, 0x1, {0x7, 0x9, 0x0, 0xff, 0x1, 0x80, 0xffffffff, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x0, 0x4, 0xa62c, 0xf9c, 0x2, 0x7, 0xb, 0x4}}, {0xc, 0x2, [0x8c93, 0x6800, 0x5fb, 0x3]}}, {{0x1c, 0x1, {0x2, 0x4, 0x7, 0x1000, 0x0, 0x6, 0x400, 0x3}}, {0xa, 0x2, [0xa, 0x6, 0x5746]}}, {{0x1c, 0x1, {0x9, 0x5, 0xceff, 0x8, 0x2, 0xa299, 0x3ff, 0x8}}, {0x14, 0x2, [0x7, 0x8, 0x5, 0x7, 0x9, 0x7fff, 0x2, 0x3]}}]}, @TCA_INGRESS_BLOCK={0x8}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x4}, @TCA_STAB={0x80, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9, 0x6, 0x0, 0xffffffff, 0x2, 0xe5, 0xfffffffd, 0xa}}, {0x18, 0x2, [0x7, 0x1, 0x8, 0x1, 0x1f6, 0x6000, 0x8, 0x1, 0x1, 0x4]}}, {{0x1c, 0x1, {0x0, 0xe, 0x0, 0x896, 0x2, 0x1, 0xe8a5, 0x1}}, {0x6, 0x2, [0xfff1]}}, {{0x1c, 0x1, {0x7f, 0x1, 0x7, 0x3, 0x3, 0x7fffffff, 0x5, 0x2}}, {0x8, 0x2, [0x5, 0x800]}}]}]}, 0x1f0}, 0x1, 0x0, 0x0, 0x2000}, 0x20040084) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newtfilter={0x34, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0xfff2}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20041010}, 0x4044000) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newtfilter={0x34, 0x2c, 0xd3f, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x1, 0x8}, {}, {0x0, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000010}, 0x24040004) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) r9 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) ioctl$EVIOCGABS0(r9, 0x80184540, &(0x7f00000002c0)=""/205) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="8000000000010104000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001000000000024000280140001800800010000000000080002007f0000010c00028005000100000000000800074000000000080003"], 0x80}}, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r12 = socket(0x40000000015, 0x5, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c00000015000103000000000000e7ff0b00000008000100", @ANYRES32=r12], 0x1c}, 0x1, 0x0, 0x0, 0xc001}, 0x4088010) kexec_load(0x0, 0x0, 0x0, 0x0) r13 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) pwrite64(r13, 0x0, 0x0, 0x26c) 2.882314524s ago: executing program 5 (id=1330): openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x4008000) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = socket$nl_route(0x10, 0x3, 0x0) fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0x3, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa1ef8000) r3 = syz_clone(0x42004680, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x3, r3, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_pid(r6, &(0x7f0000000480), 0xfdef) recvmsg$unix(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[{0x0}, {&(0x7f0000000000)=""/15, 0xf}], 0x2}, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a000028060001001a"], 0x1c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r1) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000100), 0x10, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x20000810}, 0x20000047) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'wlan1\x00', &(0x7f0000000080)=@ethtool_ringparam={0x11}}) ioctl(r0, 0x8b1a, &(0x7f0000000040)) prctl$PR_SCHED_CORE(0x3e, 0x10000001, 0x0, 0x3, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) 2.236380936s ago: executing program 3 (id=1331): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) socket$kcm(0x21, 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) modify_ldt$write2(0x11, 0x0, 0x0) modify_ldt$read(0x0, &(0x7f0000000280)=""/66, 0x42) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x2180, 0x0, 0x0, 0x0, 0x0, 0x0) 253.620933ms ago: executing program 3 (id=1332): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001030000000904"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000400)={0x34, &(0x7f0000000180)={0x20, 0x15, 0x9, "5c35c733674746c5c6"}, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e0d3e9362420e22fbca9ab0e153d48b163912368aeb3a496c26639f57281f98691a6d68a8c2fe11ed2a77c8ef8719acf1066fac3dc1853ca4361ffe13a81798634ad12b804711eaf6186c0163129bc736f94add4c6aa44563a403dbec282a5bf63b6a3c3913739c714d6697ff6f84c940683cc714a9"], 0x0, 0x37}, 0x28) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000008c0)}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0900000004000000040000000a", @ANYRES32, @ANYRES32=0x0, @ANYRES32=r3, @ANYBLOB="02000000010000000000000000"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f00000001c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xe}, @printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, 0x0, 0x7, 0x0, 0x0, 0x0, 0x11}, 0x94) r5 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) linkat(r5, &(0x7f0000000100)='./file1\x00', r5, &(0x7f0000000240)='./file0\x00', 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0x11) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x0) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_SET(r1, &(0x7f0000000540)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)={0x98, r6, 0x200, 0x70bd29, 0x25dfdbfb, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x6}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x6}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x6, 0x4, 0x2}}]}, 0x98}, 0x1, 0x0, 0x0, 0x40000}, 0x8001) r7 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000840)) r8 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) r9 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r9, 0xc0884113, &(0x7f0000000380)={0x1, 0x20, 0xfffffd0a, 0x10001, 0x0, 0x6, 0x5, 0x0, 0xfbfffffffffffffd, 0x9, 0xffffffbb}) ioctl$SNDRV_PCM_IOCTL_FORWARD(r9, 0x40084149, &(0x7f0000000340)=0x6) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={r4, 0x5b, &(0x7f00000001c0)}, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETBE(0xffffffffffffffff, 0x400454de, &(0x7f0000000040)) 182.114371ms ago: executing program 4 (id=1333): close(0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0x4000006}, 0x1c) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, 0x0, 0x0) r1 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r1, 0x4008af00, &(0x7f0000000000)=0x200000000) r2 = socket$kcm(0xa, 0x2, 0x0) r3 = socket(0x2, 0x80805, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r3, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r2, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x3f00, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 72.844584ms ago: executing program 1 (id=1334): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[], 0x84}}, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sched_setaffinity(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) ptrace(0x10, r1) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f0000000100), 0x4, 0x151042) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x40, 0x1, 0x70bd2a, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0xc, 0xb, 0x0, 0x1, [@typed={0x8, 0x0, 0x0, 0x0, @ipv4=@loopback}]}]}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r3}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x40080b4) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='smaps_rollup\x00') read$FUSE(r4, &(0x7f00000005c0)={0x2020}, 0x2020) write$binfmt_elf64(r4, &(0x7f0000000600)={{0x7f, 0x45, 0x4c, 0x46, 0x2, 0x2e, 0x2, 0x8, 0x7fffffffffffffff, 0x2, 0x3e, 0x2, 0x359, 0x40, 0x71, 0x10001, 0x9, 0x38, 0x4, 0x4, 0xf, 0x5}, [{0x5, 0x5, 0xfff, 0x1, 0x0, 0x3, 0x5, 0x10000000000}, {0x1, 0x0, 0x0, 0x6, 0xff, 0x9, 0x6, 0xffff}, {0x6, 0x9, 0x0, 0x0, 0xfffffffffffffffa, 0x4, 0x80, 0x3}, {0x2, 0x9, 0xe27, 0x8, 0x8, 0x3, 0x9, 0x6}], "b27b3f98beab13eafe025e1e33ced08758cc6048e4bab4f19caa8e68f878de7ceaeda0afb5e1b4150babe5af1e5362d31e13579917c0ace9f41fb09eb39e2de539995b3a1eeaa11d10120b6964800d668f8029f6c8b3109b85ab5c9f1969368350de3475ce582ad8d8eb33e61a55fa1ac1ccb4bb99625e3d370a47ab1cd1fdc5db77d35a8b330cc65256e9618729cf", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x9af) io_uring_setup(0x346, &(0x7f0000000000)={0x0, 0x70e6, 0x2, 0x2, 0xf2}) io_setup(0x80000001, &(0x7f0000000080)) write(0xffffffffffffffff, &(0x7f00000000c0), 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000003, 0x13, 0xffffffffffffffff, 0x8b24f000) 0s ago: executing program 4 (id=1335): mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000140)='vfat\x00', 0x208000, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x2}}, 0x10) bind$tipc(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0200009200800000190000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = openat$null(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x0, &(0x7f0000000200)}) ioctl$DRM_IOCTL_GEM_CLOSE(r3, 0x40086409, &(0x7f0000000200)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x10, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x94) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x5, 0x1}, {0x0, 0x5}, {0x8, 0x7}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x15625}]}}]}, 0xfffffffffffffe8c}, 0x1, 0x0, 0x0, 0x20844}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "9d09b974e9060a3c", "46a278ba392c53fa29a17543c440dc8a", "01a55c10", "969509a9c9f65fc4"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x304}, "f64e4099107323f5", "53c272d8b763f690b35605dff8a4a8d2", "3da2d199", "72392a24199b5903"}, 0x28) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, 0x0, 0xc4) kernel console output (not intermixed with test programs): ink: VXLAN extension 0 has unexpected len 4 expected 0 [ 450.340711][ T30] audit: type=1400 audit(1771074932.384:475): avc: denied { getattr } for pid=9367 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf/eth0.dhcp" dev="tmpfs" ino=1881 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 450.590734][ T5140] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 450.597181][ T5140] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 450.610649][ T51] Bluetooth: hci0: command 0x0406 tx timeout [ 451.628440][ T9408] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=9408 comm=syz.0.878 [ 451.662585][ T9408] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9408 comm=syz.0.878 [ 452.568552][ T9408] syz.0.878 (9408): drop_caches: 2 [ 452.610787][ T1204] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 452.623368][ T9408] netlink: 288 bytes leftover after parsing attributes in process `syz.0.878'. [ 452.771519][ T1204] usb 5-1: Using ep0 maxpacket: 32 [ 452.818770][ T1204] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 452.831058][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 452.837230][ T5140] Bluetooth: hci2: Opcode 0x0c1a failed: -110 [ 452.861991][ T1204] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.880664][ T5140] Bluetooth: hci2: Error when powering off device on rfkill (-110) [ 452.902944][ T1204] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 455.496411][ T5140] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 455.499844][ T5807] Bluetooth: hci1: command 0x0406 tx timeout [ 455.547795][ T5140] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 455.701000][ T5855] usb 5-1: USB disconnect, device number 37 [ 457.710702][ T5140] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 457.710991][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 457.716810][ T5140] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 457.885265][ T9466] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=9466 comm=syz.4.890 [ 457.930966][ T9466] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9466 comm=syz.4.890 [ 458.072198][ T9471] FAT-fs (nbd1): unable to read boot sector [ 458.206961][ T11] block nbd0: Possible stuck request ffff888027cb0000: control (read@0,4096B). Runtime 30 seconds [ 458.280867][ T9475] netlink: 288 bytes leftover after parsing attributes in process `syz.4.890'. [ 458.318026][ T9468] syz.4.890 (9468): drop_caches: 2 [ 459.256155][ T9487] ip6t_srh: unknown srh match flags FF3F [ 459.382325][ T1204] IPVS: starting estimator thread 0... [ 459.486249][ T9489] IPVS: using max 47 ests per chain, 112800 per kthread [ 459.526891][ T9494] befs: (nbd1): unable to read superblock [ 459.950862][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 460.017120][ T5140] Bluetooth: hci4: Opcode 0x0c1a failed: -110 [ 460.029928][ T5140] Bluetooth: hci4: Error when powering off device on rfkill (-110) [ 460.290829][ T29] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 460.350771][ T792] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 460.491346][ T29] usb 3-1: Using ep0 maxpacket: 8 [ 460.543947][ T29] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 460.560646][ T792] usb 2-1: Using ep0 maxpacket: 32 [ 460.619375][ T792] usb 2-1: config 0 has an invalid interface number: 111 but max is 1 [ 460.644498][ T29] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 460.664435][ T792] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 460.719291][ T29] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 460.742856][ T792] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 460.781294][ T29] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 460.805226][ T792] usb 2-1: config 0 has no interface number 0 [ 460.892619][ T29] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 460.937104][ T792] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=4a.83 [ 460.971224][ T29] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 460.989034][ T792] usb 2-1: New USB device strings: Mfr=33, Product=2, SerialNumber=3 [ 461.056419][ T792] usb 2-1: Product: syz [ 461.091107][ T792] usb 2-1: Manufacturer: syz [ 461.115845][ T792] usb 2-1: SerialNumber: syz [ 461.279262][ T792] usb 2-1: config 0 descriptor?? [ 461.713969][ T29] usb 3-1: GET_CAPABILITIES returned 0 [ 461.767422][ T29] usbtmc 3-1:16.0: can't read capabilities [ 462.112602][ T792] snd-usb-6fire 2-1:0.111: unable to receive device firmware state. [ 462.244057][ T792] snd-usb-6fire 2-1:0.111: probe with driver snd-usb-6fire failed with error -32 [ 462.772220][ T29] usb 3-1: USB disconnect, device number 57 [ 463.048328][ T9495] netlink: 8 bytes leftover after parsing attributes in process `syz.4.892'. [ 463.060674][ T7061] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 463.429873][ T7061] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 463.495673][ T7061] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 463.517045][ T7061] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 463.539045][ T7061] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 463.577050][ T9516] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 463.608402][ T7061] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 463.635832][ T9534] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 463.839607][ T5140] usb 2-1: USB disconnect, device number 43 [ 464.120614][ T5884] usb 1-1: USB disconnect, device number 51 [ 465.388322][ T9545] loop7: detected capacity change from 0 to 1 [ 466.810888][ T5140] usb 4-1: new low-speed USB device number 49 using dummy_hcd [ 467.233411][ T5140] usb 4-1: unable to get BOS descriptor or descriptor too short [ 467.252782][ T5140] usb 4-1: no configurations [ 467.278818][ T5140] usb 4-1: can't read configurations, error -22 [ 467.900486][ T5884] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 467.910650][ T5855] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 468.291102][ T5884] usb 5-1: Using ep0 maxpacket: 32 [ 468.300505][ T5855] usb 2-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 468.315216][ T5884] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 468.332806][ T5855] usb 2-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 468.348984][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 468.373924][ T5855] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.393950][ T5855] usb 2-1: Product: syz [ 468.405511][ T5884] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 468.424723][ T5855] usb 2-1: Manufacturer: syz [ 468.441521][ T5855] usb 2-1: SerialNumber: syz [ 468.470017][ T5855] usb 2-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 468.891105][ T5140] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 468.899716][ T5855] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 469.220938][ T5855] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 469.245249][ T5884] usb 5-1: USB disconnect, device number 38 [ 469.274329][ T5855] usb 2-1: media controller created [ 469.288764][ T9595] netlink: 8 bytes leftover after parsing attributes in process `syz.1.908'. [ 469.309812][ T5855] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 469.370918][ T5140] usb 3-1: Using ep0 maxpacket: 32 [ 469.385534][ T5140] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 469.401339][ T5140] usb 3-1: config 0 has no interface number 0 [ 469.421362][ T5140] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 469.451549][ T5140] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.470688][ T5140] usb 3-1: Product: syz [ 469.476687][ T5140] usb 3-1: Manufacturer: syz [ 469.484098][ T5140] usb 3-1: SerialNumber: syz [ 469.503307][ T5140] usb 3-1: config 0 descriptor?? [ 469.532559][ T5140] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 469.732777][ T9588] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.741795][ T9588] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.794755][ T5140] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 469.832619][ T9599] FAT-fs (nbd3): unable to read boot sector [ 469.843183][ T5140] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 470.120613][ C0] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 170 [ 470.323190][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 470.332541][ T5140] usb 3-1: USB disconnect, device number 58 [ 470.348025][ T5140] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 470.364430][ T5140] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 470.377899][ T5140] quatech2 3-1:0.51: device disconnected [ 470.425229][ T9608] netlink: 32 bytes leftover after parsing attributes in process `syz.3.915'. [ 470.552560][ T9611] befs: (nbd3): unable to read superblock [ 470.600019][ T9613] FAT-fs (nbd3): unable to read boot sector [ 470.658002][ T5855] usb 2-1: USB disconnect, device number 44 [ 471.119436][ T9625] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 471.168596][ T9629] syzkaller0: entered promiscuous mode [ 471.174397][ T9629] syzkaller0: entered allmulticast mode [ 471.232782][ T9631] FAULT_INJECTION: forcing a failure. [ 471.232782][ T9631] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 471.246016][ T9631] CPU: 0 UID: 0 PID: 9631 Comm: syz.1.924 Tainted: G L syzkaller #0 PREEMPT(full) [ 471.246044][ T9631] Tainted: [L]=SOFTLOCKUP [ 471.246049][ T9631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 471.246056][ T9631] Call Trace: [ 471.246062][ T9631] [ 471.246068][ T9631] dump_stack_lvl+0x100/0x190 [ 471.246098][ T9631] should_fail_ex.cold+0x5/0xa [ 471.246122][ T9631] _copy_from_user+0x2e/0xd0 [ 471.246144][ T9631] core_sys_select+0x472/0xbb0 [ 471.246168][ T9631] ? __pfx_core_sys_select+0x10/0x10 [ 471.246184][ T9631] ? find_held_lock+0x2b/0x80 [ 471.246200][ T9631] ? get_pid_task+0xfc/0x250 [ 471.246232][ T9631] ? __pfx_set_user_sigmask+0x10/0x10 [ 471.246244][ T9631] ? __mutex_unlock_slowpath+0x15c/0x790 [ 471.246260][ T9631] ? __fget_files+0x215/0x3d0 [ 471.246279][ T9631] do_pselect.constprop.0+0x238/0x270 [ 471.246298][ T9631] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 471.246317][ T9631] ? ksys_write+0x1ac/0x250 [ 471.246335][ T9631] __x64_sys_pselect6+0x149/0x1c0 [ 471.246354][ T9631] do_syscall_64+0x106/0xf80 [ 471.246365][ T9631] ? clear_bhb_loop+0x40/0x90 [ 471.246391][ T9631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 471.246403][ T9631] RIP: 0033:0x7f45f479bf79 [ 471.246415][ T9631] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 471.246426][ T9631] RSP: 002b:00007f45f56a7028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 471.246439][ T9631] RAX: ffffffffffffffda RBX: 00007f45f4a16090 RCX: 00007f45f479bf79 [ 471.246446][ T9631] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040 [ 471.246453][ T9631] RBP: 00007f45f56a7090 R08: 0000000000000000 R09: 0000000000000000 [ 471.246459][ T9631] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 471.246466][ T9631] R13: 00007f45f4a16128 R14: 00007f45f4a16090 R15: 00007ffd25552db8 [ 471.246480][ T9631] [ 471.445342][ T9632] usb usb1: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 471.511088][ T5855] usb 5-1: new low-speed USB device number 39 using dummy_hcd [ 471.842685][ T5855] usb 5-1: unable to get BOS descriptor or descriptor too short [ 471.881484][ T5855] usb 5-1: no configurations [ 471.886276][ T5855] usb 5-1: can't read configurations, error -22 [ 472.387462][ T9639] netlink: 32 bytes leftover after parsing attributes in process `syz.3.927'. [ 472.413768][ T9636] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 472.433592][ T9640] netlink: 20 bytes leftover after parsing attributes in process `syz.1.926'. [ 472.466645][ T9634] netlink: 44 bytes leftover after parsing attributes in process `syz.1.926'. [ 472.491355][ T9636] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 472.508110][ T9642] input: syz0 as /devices/virtual/input/input16 [ 473.033199][ T9658] FAT-fs (nbd2): unable to read boot sector [ 473.170971][ T7061] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 473.430667][ T7061] usb 4-1: Using ep0 maxpacket: 32 [ 473.437359][ T7061] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 473.448534][ T7061] usb 4-1: config 0 has no interface number 0 [ 473.457026][ T7061] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 473.466333][ T7061] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 473.474420][ T7061] usb 4-1: Product: syz [ 473.478658][ T7061] usb 4-1: Manufacturer: syz [ 473.484113][ T7061] usb 4-1: SerialNumber: syz [ 473.493724][ T7061] usb 4-1: config 0 descriptor?? [ 473.507771][ T7061] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 473.650954][ T9669] befs: (nbd2): unable to read superblock [ 474.004160][ T9654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 474.021245][ T9654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 474.052014][ T9671] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 474.098024][ T7061] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 474.116537][ T9673] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=9673 comm=syz.2.937 [ 474.136392][ T7061] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 474.147808][ T9673] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9673 comm=syz.2.937 [ 474.301988][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 170 [ 474.427300][ T9675] syz.2.937 (9675): drop_caches: 2 [ 474.448001][ T9675] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=9675 comm=syz.2.937 [ 474.465779][ T9675] netlink: 288 bytes leftover after parsing attributes in process `syz.2.937'. [ 474.704665][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 474.705746][ T5140] usb 4-1: USB disconnect, device number 51 [ 474.751092][ T5140] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 474.782342][ T5140] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 474.810038][ T5140] quatech2 4-1:0.51: device disconnected [ 474.933717][ T9680] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=9680 comm=syz.1.939 [ 474.978380][ T9680] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9680 comm=syz.1.939 [ 475.102436][ T9683] netlink: 20 bytes leftover after parsing attributes in process `syz.2.940'. [ 475.643768][ T5855] usb 5-1: new low-speed USB device number 41 using dummy_hcd [ 475.714008][ T9682] netlink: 44 bytes leftover after parsing attributes in process `syz.2.940'. [ 475.735308][ T9680] syz.1.939 (9680): drop_caches: 2 [ 475.743664][ T9680] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=9680 comm=syz.1.939 [ 475.766883][ T9680] netlink: 288 bytes leftover after parsing attributes in process `syz.1.939'. [ 475.949196][ T5855] usb 5-1: unable to get BOS descriptor or descriptor too short [ 475.970460][ T5855] usb 5-1: no configurations [ 475.991158][ T5855] usb 5-1: can't read configurations, error -22 [ 478.263246][ T9713] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 480.813598][ T9723] netlink: 20 bytes leftover after parsing attributes in process `syz.4.951'. [ 480.872810][ T9723] netlink: 44 bytes leftover after parsing attributes in process `syz.4.951'. [ 480.967141][ T9728] befs: (nbd2): unable to read superblock [ 481.021058][ T7061] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 481.180629][ T7061] usb 2-1: Using ep0 maxpacket: 32 [ 481.208655][ T7061] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 481.240650][ T7061] usb 2-1: config 0 has no interface number 0 [ 481.279351][ T7061] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 481.327608][ T7061] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.343346][ T7061] usb 2-1: Product: syz [ 481.348063][ T7061] usb 2-1: Manufacturer: syz [ 481.353310][ T7061] usb 2-1: SerialNumber: syz [ 481.361542][ T7061] usb 2-1: config 0 descriptor?? [ 481.630804][ T7061] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 481.635752][ T9725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 481.672502][ T9725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 481.722191][ T7061] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 481.735800][ T7061] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 481.770675][ T5140] usb 5-1: new low-speed USB device number 43 using dummy_hcd [ 482.007898][ T5140] usb 5-1: unable to get BOS descriptor or descriptor too short [ 482.016285][ T5140] usb 5-1: no configurations [ 482.028451][ T5140] usb 5-1: can't read configurations, error -22 [ 482.128739][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 482.136605][ T7061] usb 2-1: USB disconnect, device number 45 [ 482.156848][ T7061] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 482.195303][ T7061] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 482.214905][ T7061] quatech2 2-1:0.51: device disconnected [ 483.193974][ T5807] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 483.204252][ T5807] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 483.340752][ T5807] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 483.356691][ T5807] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 483.367454][ T5807] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 483.839485][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 483.847129][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 483.854512][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 483.862511][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 483.869922][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 484.209014][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 484.209034][ T30] audit: type=1400 audit(1771074968.504:486): avc: denied { ioctl } for pid=9753 comm="syz.3.963" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4601 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 485.098701][ T30] audit: type=1400 audit(1771074969.394:487): avc: denied { module_request } for pid=9743 comm="syz-executor" kmod="rtnl-link-nicvf" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 485.174328][ T9743] chnl_net:caif_netlink_parms(): no params data found [ 485.962064][ T51] Bluetooth: hci5: command tx timeout [ 485.993983][ T9780] befs: (nbd4): unable to read superblock [ 486.022365][ T9743] bridge0: port 1(bridge_slave_0) entered blocking state [ 486.034763][ T9743] bridge0: port 1(bridge_slave_0) entered disabled state [ 486.043643][ T9743] bridge_slave_0: entered allmulticast mode [ 486.052649][ T9743] bridge_slave_0: entered promiscuous mode [ 486.060034][ T9743] bridge0: port 2(bridge_slave_1) entered blocking state [ 486.069093][ T9743] bridge0: port 2(bridge_slave_1) entered disabled state [ 486.077261][ T9743] bridge_slave_1: entered allmulticast mode [ 486.093107][ T9743] bridge_slave_1: entered promiscuous mode [ 486.264698][ T9783] befs: (nbd4): unable to read superblock [ 486.458774][ T9743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 486.512890][ T9743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 486.626513][ T9743] team0: Port device team_slave_0 added [ 486.679908][ T9743] team0: Port device team_slave_1 added [ 486.950731][ T9795] tipc: Started in network mode [ 486.955723][ T9795] tipc: Node identity ac14140f, cluster identity 4711 [ 486.966067][ T9795] tipc: New replicast peer: 255.255.255.255 [ 486.973614][ T9795] tipc: Enabled bearer , priority 10 [ 487.190803][ T5884] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 487.624822][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 487.657521][ T5884] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 487.690814][ T5884] usb 3-1: config 0 has no interface number 0 [ 487.738565][ T5884] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 487.760603][ T5884] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.796870][ T9743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 487.803914][ T9743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 487.812359][ T5884] usb 3-1: Product: syz [ 487.849608][ T5884] usb 3-1: Manufacturer: syz [ 487.854496][ T5884] usb 3-1: SerialNumber: syz [ 487.931020][ T5884] usb 3-1: config 0 descriptor?? [ 487.952312][ T5884] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 488.011562][ T9743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 488.026288][ T5855] tipc: Node number set to 2886997007 [ 488.036521][ T9743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 488.043732][ T51] Bluetooth: hci5: command tx timeout [ 488.052575][ T30] audit: type=1400 audit(1771074972.354:488): avc: denied { watch } for pid=9796 comm="syz.4.973" path="/197/file0" dev="tmpfs" ino=1079 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 488.079025][ T9743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 488.114267][ T30] audit: type=1400 audit(1771074972.354:489): avc: denied { watch_sb watch_reads } for pid=9796 comm="syz.4.973" path="/197/file0" dev="tmpfs" ino=1079 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 488.139905][ T9743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 488.155222][ T9792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.177658][ T9792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.218317][ T5884] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 488.237549][ T7061] usb 2-1: new low-speed USB device number 46 using dummy_hcd [ 488.260318][ T9743] hsr_slave_0: entered promiscuous mode [ 488.272531][ T11] block nbd0: Possible stuck request ffff888027cb0000: control (read@0,4096B). Runtime 60 seconds [ 488.284010][ T5884] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 488.307360][ T9743] hsr_slave_1: entered promiscuous mode [ 488.320857][ T9743] debugfs: 'hsr0' already exists in 'hsr' [ 488.337035][ T9743] Cannot create hsr debugfs directory [ 488.404346][ T30] audit: type=1400 audit(1771074972.704:490): avc: denied { read } for pid=9801 comm="syz.3.975" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 488.449369][ T30] audit: type=1400 audit(1771074972.724:491): avc: denied { open } for pid=9801 comm="syz.3.975" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 488.454076][ T7061] usb 2-1: unable to get BOS descriptor or descriptor too short [ 488.512747][ T7061] usb 2-1: no configurations [ 488.517389][ T7061] usb 2-1: can't read configurations, error -22 [ 488.544123][ T9802] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 488.552572][ T9802] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 488.570237][ T9802] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 488.609907][ T9743] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 488.623793][ T9743] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 488.635640][ T9743] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 488.659661][ T9743] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 488.660047][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 488.676507][ T5884] usb 3-1: USB disconnect, device number 59 [ 488.694419][ T5884] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 488.908869][ T5884] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 488.920866][ T5884] quatech2 3-1:0.51: device disconnected [ 489.077665][ T9743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 489.958016][ T9743] 8021q: adding VLAN 0 to HW filter on device team0 [ 489.993309][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 490.000416][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 490.090451][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 490.097665][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 490.135386][ T9826] netlink: 20 bytes leftover after parsing attributes in process `syz.3.980'. [ 490.402162][ T5884] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 490.508777][ T7061] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 490.584484][ T9847] netlink: 8 bytes leftover after parsing attributes in process `syz.1.985'. [ 490.595550][ T51] Bluetooth: hci5: command 0x0419 tx timeout [ 490.624128][ T5884] usb 4-1: Using ep0 maxpacket: 8 [ 490.727760][ T5884] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 490.791589][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.900496][ T5884] usb 4-1: Product: syz [ 490.980103][ T5884] usb 4-1: Manufacturer: syz [ 491.054362][ T5884] usb 4-1: SerialNumber: syz [ 491.286217][ T5884] usb 4-1: config 0 descriptor?? [ 491.448633][ T5884] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 491.483144][ T5884] pctv452e: pctv452e_power_ctrl: 1 [ 491.483144][ T5884] [ 491.507102][ T5884] usb 4-1: selecting invalid altsetting 3 [ 491.514213][ T5884] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 491.514213][ T5884] [ 491.556965][ T5884] dvb-usb: bulk message failed: -22 (5/0) [ 491.643755][ T5884] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 491.657128][ T9743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 491.667931][ T9826] dvb-usb: bulk message failed: -22 (7/0) [ 491.679438][ T9826] pctv452e: I2C error -22; AA 01 00 00 00 -> aa 01 31 03 00 00 00 [ 491.698959][ T5884] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 491.714782][ T5884] usb 4-1: media controller created [ 491.771390][ T5884] dvb-usb: bulk message failed: -22 (8/0) [ 491.777399][ T5884] pctv452e: I2C error -22; AA 02 A0 01 14 -> aa 02 31 04 a0 01 14 [ 491.810794][ T7061] usb 3-1: device descriptor read/64, error -71 [ 491.817487][ T5884] dvb-usb: MAC address reading failed. [ 491.911792][ T5884] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 492.122456][ T7061] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 492.681881][ T51] Bluetooth: hci5: command 0x0419 tx timeout [ 492.695267][ T5884] DVB: Unable to find symbol stb0899_attach() [ 492.726748][ T5884] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 492.817036][ T5911] usb 2-1: new low-speed USB device number 48 using dummy_hcd [ 492.820144][ T7061] usb 3-1: device descriptor read/64, error -71 [ 492.876110][ T9743] veth0_vlan: entered promiscuous mode [ 492.901667][ T5884] rc_core: IR keymap rc-tt-1500 not found [ 492.904959][ T9743] veth1_vlan: entered promiscuous mode [ 492.911738][ T5884] Registered IR keymap rc-empty [ 493.003666][ T7061] usb usb3-port1: attempt power cycle [ 493.215711][ T9743] veth0_macvtap: entered promiscuous mode [ 493.223153][ T5884] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 493.225873][ T9743] veth1_macvtap: entered promiscuous mode [ 493.271394][ T5884] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input17 [ 493.344988][ T9743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 493.357298][ T5911] usb 2-1: unable to get BOS descriptor or descriptor too short [ 493.366458][ T5884] dvb-usb: schedule remote query interval to 100 msecs. [ 493.376662][ T5911] usb 2-1: no configurations [ 493.399933][ T30] audit: type=1400 audit(1771074977.684:492): avc: denied { getopt } for pid=9879 comm="syz.4.993" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 493.425133][ T5911] usb 2-1: can't read configurations, error -22 [ 493.431834][ T5884] pctv452e: pctv452e_power_ctrl: 0 [ 493.431834][ T5884] [ 493.442360][ T9743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 493.452284][ T5884] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 493.532407][ T5884] usb 4-1: USB disconnect, device number 52 [ 493.561866][ T7966] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.608650][ T7966] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.619199][ T5884] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 493.632386][ T792] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 493.641021][ T7966] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.652528][ T7966] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 493.704888][ T9889] xt_hashlimit: size too large, truncated to 1048576 [ 493.772107][ T7966] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 493.805617][ T7966] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 493.842934][ T9890] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 493.861703][ T792] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 493.895801][ T792] usb 5-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 493.945150][ T792] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 493.985557][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 494.020226][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 494.461198][ T792] usb 5-1: config 0 descriptor?? [ 494.527346][ T30] audit: type=1400 audit(1771074978.824:493): avc: denied { mounton } for pid=9743 comm="syz-executor" path="/root/syzkaller.9IkNyc/syz-tmp" dev="sda1" ino=2047 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 494.580712][ T30] audit: type=1400 audit(1771074978.824:494): avc: denied { mounton } for pid=9743 comm="syz-executor" path="/root/syzkaller.9IkNyc/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 494.624243][ T30] audit: type=1400 audit(1771074978.824:495): avc: denied { mounton } for pid=9743 comm="syz-executor" path="/root/syzkaller.9IkNyc/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=32035 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 494.652016][ T30] audit: type=1400 audit(1771074978.884:496): avc: denied { mounton } for pid=9743 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=2786 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 494.753024][ T51] Bluetooth: hci5: command 0x0419 tx timeout [ 494.796494][ T9880] netlink: 24 bytes leftover after parsing attributes in process `syz.4.993'. [ 494.810746][ T5884] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 494.826477][ T30] audit: type=1400 audit(1771074979.124:497): avc: denied { setopt } for pid=9899 comm="syz.5.959" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 494.960711][ T5884] usb 2-1: Using ep0 maxpacket: 32 [ 494.967906][ T5884] usb 2-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 494.977629][ T5884] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 494.998656][ T5884] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 495.023815][ T792] usbhid 5-1:0.0: can't add hid device: -71 [ 495.029874][ T792] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 495.078387][ T792] usb 5-1: USB disconnect, device number 45 [ 496.244277][ T1204] usb 2-1: USB disconnect, device number 50 [ 496.831186][ T51] Bluetooth: hci5: command 0x0419 tx timeout [ 497.042796][ T9940] FAT-fs (nbd3): unable to read boot sector [ 497.280991][ T792] usb 5-1: new low-speed USB device number 46 using dummy_hcd [ 497.567599][ T792] usb 5-1: unable to get BOS descriptor or descriptor too short [ 497.591427][ T792] usb 5-1: no configurations [ 497.596085][ T792] usb 5-1: can't read configurations, error -22 [ 498.249079][ T5877] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 498.534238][ T5877] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 498.646703][ T5877] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.658100][ T5877] usb 4-1: config 0 descriptor?? [ 498.671693][ T5877] cp210x 4-1:0.0: cp210x converter detected [ 499.485683][ T5877] cp210x 4-1:0.0: failed to get vendor val 0x370b size 1: -121 [ 499.504073][ T5877] cp210x 4-1:0.0: querying part number failed [ 499.514860][ T5877] usb 4-1: cp210x converter now attached to ttyUSB0 [ 499.811086][ T9965] befs: (nbd5): unable to read superblock [ 501.320678][ T7061] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 501.470889][ T7061] usb 5-1: Using ep0 maxpacket: 32 [ 501.481738][ T7061] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 501.494255][ T7061] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 501.500703][ T1204] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 501.533028][ T7061] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 501.602157][ T9987] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1020'. [ 501.650743][ T1204] usb 3-1: device descriptor read/64, error -71 [ 501.680701][ T5877] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 501.737611][ T792] usb 4-1: USB disconnect, device number 53 [ 501.760333][ T792] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 501.782729][ T792] cp210x 4-1:0.0: device disconnected [ 501.843492][ T5877] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 501.856499][ T5877] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 501.870715][ T5877] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 501.882489][ T5877] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 501.891701][ T5877] usb 2-1: Manufacturer: syz [ 501.900705][ T1204] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 502.357790][ T5877] usb 2-1: config 0 descriptor?? [ 502.439291][ T7061] usb 5-1: USB disconnect, device number 48 [ 502.458926][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.471655][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.870712][ T1204] usb 3-1: device descriptor read/64, error -71 [ 502.981125][ T1204] usb usb3-port1: attempt power cycle [ 503.171098][ T7061] usb 6-1: new low-speed USB device number 2 using dummy_hcd [ 503.361255][ T1204] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 503.510685][ T1204] usb 3-1: device descriptor read/8, error -71 [ 503.705788][ T7061] usb 6-1: unable to get BOS descriptor or descriptor too short [ 503.716639][ T7061] usb 6-1: no configurations [ 503.728578][ T7061] usb 6-1: can't read configurations, error -22 [ 503.760738][ T1204] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 503.795184][ T1204] usb 3-1: device descriptor read/8, error -71 [ 503.809047][T10011] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=10011 comm=syz.3.1025 [ 503.839611][T10011] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10011 comm=syz.3.1025 [ 503.948842][ T1204] usb usb3-port1: unable to enumerate USB device [ 504.433842][T10020] netlink: 288 bytes leftover after parsing attributes in process `syz.3.1025'. [ 504.620433][ T1204] usb 2-1: USB disconnect, device number 51 [ 504.825128][T10028] xt_hashlimit: size too large, truncated to 1048576 [ 505.285057][T10030] befs: (nbd1): unable to read superblock [ 505.498521][T10031] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 506.306563][T10012] syz.3.1025 (10012): drop_caches: 2 [ 506.651557][T10039] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1033'. [ 509.740615][T10070] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1040'. [ 509.828312][T10070] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 509.850792][ T7061] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 509.930926][ T792] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 510.059389][ T7061] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 510.059968][T10072] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1042'. [ 510.151952][ T7061] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 510.220973][ T792] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 510.235761][ T792] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 510.246827][ T7061] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 510.257468][ T792] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 510.267150][ T7061] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 510.276213][ T792] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.285028][ T7061] usb 6-1: Manufacturer: syz [ 510.297889][ T7061] usb 6-1: config 0 descriptor?? [ 510.316271][T10068] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 510.342864][ T792] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 510.471265][ T7061] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 510.643256][ T7061] usb 2-1: Using ep0 maxpacket: 8 [ 510.685612][ T7061] usb 2-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 510.711094][ T7061] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.750459][ T7061] usb 2-1: Product: syz [ 510.776826][ T7061] usb 2-1: Manufacturer: syz [ 510.812933][ T7061] usb 2-1: SerialNumber: syz [ 510.877867][ T7061] usb 2-1: config 0 descriptor?? [ 510.935980][ T7061] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 510.970357][ T7061] pctv452e: pctv452e_power_ctrl: 1 [ 510.970357][ T7061] [ 510.990338][ T7061] usb 2-1: selecting invalid altsetting 3 [ 511.018580][ T7061] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 511.018580][ T7061] [ 511.046060][ T7061] dvb-usb: bulk message failed: -22 (5/0) [ 511.086762][ T792] usb 5-1: USB disconnect, device number 49 [ 511.362542][ T7061] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 512.135354][ T7061] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 512.196108][T10072] dvb-usb: bulk message failed: -22 (7/0) [ 512.235402][ T7061] usb 2-1: media controller created [ 512.255561][T10072] pctv452e: I2C error -22; AA 01 00 00 00 -> aa 01 31 03 00 00 00 [ 512.371359][T10086] befs: (nbd3): unable to read superblock [ 512.475881][ T7061] dvb-usb: bulk message failed: -22 (8/0) [ 512.597964][ T1204] usb 6-1: USB disconnect, device number 4 [ 512.605207][ T7061] pctv452e: I2C error -22; AA 02 A0 01 14 -> aa 02 31 04 a0 01 14 [ 512.662967][ T7061] dvb-usb: MAC address reading failed. [ 512.914943][ T7061] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 513.638988][ T7061] DVB: Unable to find symbol stb0899_attach() [ 515.236609][ T7061] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 515.330772][ T7061] rc_core: IR keymap rc-tt-1500 not found [ 515.336833][ T7061] Registered IR keymap rc-empty [ 515.352440][ T7061] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 515.364592][ T7061] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input18 [ 515.386661][T10107] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1050'. [ 515.400925][ T7061] dvb-usb: schedule remote query interval to 100 msecs. [ 515.407892][ T7061] pctv452e: pctv452e_power_ctrl: 0 [ 515.407892][ T7061] [ 515.422120][ T7061] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 515.463318][ T7061] usb 2-1: USB disconnect, device number 52 [ 515.519219][ T29] dvb-usb: bulk message failed: -22 (4/0) [ 515.536466][ T29] dvb-usb: error -22 while querying for an remote control event. [ 515.695280][ T7061] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 515.930772][ T1204] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 516.111021][ T1204] usb 5-1: Using ep0 maxpacket: 32 [ 516.132154][ T1204] usb 5-1: config 0 interface 0 has no altsetting 0 [ 516.168195][ T1204] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 516.200170][ T1204] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.255716][ T1204] usb 5-1: Product: syz [ 516.283706][ T1204] usb 5-1: Manufacturer: syz [ 516.321172][ T1204] usb 5-1: SerialNumber: syz [ 516.468341][ T1204] usb 5-1: config 0 descriptor?? [ 517.277205][ T1204] gs_usb 5-1:0.0: Required endpoints not found [ 517.283804][T10119] comedi comedi2: reset error (fatal) [ 518.367444][ T11] block nbd0: Possible stuck request ffff888027cb0000: control (read@0,4096B). Runtime 90 seconds [ 518.443588][T10112] bridge1: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 518.517488][ T29] usb 5-1: USB disconnect, device number 50 [ 518.651531][ T1204] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 519.188610][ T1204] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 519.255692][ T1204] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 519.365291][ T1204] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 519.382940][ T5884] usb 2-1: new full-speed USB device number 53 using dummy_hcd [ 519.404021][ T1204] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 519.451713][ T1204] usb 4-1: Manufacturer: syz [ 519.540855][ T1204] usb 4-1: config 0 descriptor?? [ 519.718019][ T5884] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 519.822309][ T5884] usb 2-1: New USB device found, idVendor=17a1, idProduct=0128, bcdDevice=f4.8b [ 520.570508][ T5884] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.578721][ T5884] usb 2-1: Product: syz [ 520.585211][ T5884] usb 2-1: Manufacturer: syz [ 520.589849][ T5884] usb 2-1: SerialNumber: syz [ 520.602241][ T5884] usb 2-1: config 0 descriptor?? [ 520.622228][ T5884] gspca_main: t613-2.14.0 probing 17a1:0128 [ 520.947421][T10157] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1063'. [ 520.981926][ T5884] gspca_t613: unknown sensor 0000 [ 520.990623][ T5884] t613 2-1:0.0: probe with driver t613 failed with error -22 [ 521.001492][ T5884] usb 2-1: USB disconnect, device number 53 [ 521.708369][ T29] usb 4-1: USB disconnect, device number 54 [ 522.510726][T10172] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1066'. [ 525.261804][T10199] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1075'. [ 525.264979][T10201] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1076'. [ 525.309075][T10199] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 525.708016][T10201] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 525.950998][ T792] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 526.264385][ T792] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 526.284842][ T792] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 526.315996][ T792] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 526.330491][ T792] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 526.376635][ T792] usb 6-1: Manufacturer: syz [ 526.398917][ T792] usb 6-1: config 0 descriptor?? [ 526.560669][ T792] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 526.780644][ T792] usb 5-1: Using ep0 maxpacket: 32 [ 526.789671][ T792] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 526.806796][ T792] usb 5-1: config 0 has no interface number 0 [ 526.833593][ T792] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 526.843033][ T792] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 526.851606][ T792] usb 5-1: Product: syz [ 526.869433][ T792] usb 5-1: Manufacturer: syz [ 526.957026][ T792] usb 5-1: SerialNumber: syz [ 527.077176][ T792] usb 5-1: config 0 descriptor?? [ 527.115311][ T792] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 527.311672][T10218] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 527.330920][T10218] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 527.372761][ T792] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 527.547451][ T792] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 527.768725][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 527.897237][T10235] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1082'. [ 528.179691][ T792] usb 5-1: USB disconnect, device number 51 [ 528.595057][T10233] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1083'. [ 528.815643][T10239] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1084'. [ 528.996327][ T5911] usb 6-1: USB disconnect, device number 5 [ 529.051526][ T792] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 529.183476][ T792] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 529.200725][ T5884] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 529.228985][T10246] FAT-fs (nbd4): unable to read boot sector [ 529.248891][ T792] quatech2 5-1:0.51: device disconnected [ 529.405654][ T5884] usb 4-1: Using ep0 maxpacket: 8 [ 529.598901][ T5911] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 529.807072][ T5884] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 529.816323][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.843140][ T5884] usb 4-1: Product: syz [ 529.857988][ T5884] usb 4-1: Manufacturer: syz [ 529.869059][ T5884] usb 4-1: SerialNumber: syz [ 529.887543][ T5884] usb 4-1: config 0 descriptor?? [ 529.912556][ T5911] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 529.934333][ T5884] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 529.943082][ T5884] pctv452e: pctv452e_power_ctrl: 1 [ 529.943082][ T5884] [ 529.951303][ T5911] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 529.963108][ T5884] usb 4-1: selecting invalid altsetting 3 [ 529.969267][ T5911] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 529.979645][ T5884] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 529.979645][ T5884] [ 530.001056][ T5911] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.009756][ T5884] dvb-usb: bulk message failed: -22 (5/0) [ 530.037843][ T5884] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 530.037859][T10248] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 530.057528][ T5911] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 530.116401][ T5884] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 530.173275][ T5884] usb 4-1: media controller created [ 530.188806][ T5884] dvb-usb: bulk message failed: -22 (8/0) [ 530.203051][ T5884] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 530.217721][ T5884] dvb-usb: MAC address reading failed. [ 530.238602][ T5884] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 530.522917][ T5855] usb 2-1: USB disconnect, device number 54 [ 531.473271][ T5884] DVB: Unable to find symbol stb0899_attach() [ 531.609348][ T5884] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 532.570944][T10265] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1093'. [ 532.598201][ T5884] rc_core: IR keymap rc-tt-1500 not found [ 532.606290][T10265] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 532.623537][ T5884] Registered IR keymap rc-empty [ 532.811422][T10267] netlink: 112 bytes leftover after parsing attributes in process `syz.5.1095'. [ 532.811556][ T5884] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 532.967818][ T5884] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input19 [ 532.983624][T10267] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 533.270981][ T5884] dvb-usb: schedule remote query interval to 100 msecs. [ 533.288286][ T5884] pctv452e: pctv452e_power_ctrl: 0 [ 533.288286][ T5884] [ 533.302494][ T5884] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 533.360962][ T5884] usb 4-1: USB disconnect, device number 55 [ 533.555052][ T5884] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 533.613788][T10279] FAULT_INJECTION: forcing a failure. [ 533.613788][T10279] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 533.739138][T10281] befs: (nbd3): unable to read superblock [ 533.965962][T10279] CPU: 0 UID: 0 PID: 10279 Comm: syz.4.1096 Tainted: G L syzkaller #0 PREEMPT(full) [ 533.965992][T10279] Tainted: [L]=SOFTLOCKUP [ 533.965998][T10279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 533.966007][T10279] Call Trace: [ 533.966013][T10279] [ 533.966018][T10279] dump_stack_lvl+0x100/0x190 [ 533.966048][T10279] should_fail_ex.cold+0x5/0xa [ 533.966066][T10279] _copy_to_user+0x32/0xd0 [ 533.966089][T10279] rng_dev_read+0x223/0x910 [ 533.966111][T10279] ? __pfx_virtio_read+0x10/0x10 [ 533.966128][T10279] ? __pfx_rng_dev_read+0x10/0x10 [ 533.966142][T10279] ? avc_policy_seqno+0x9/0x20 [ 533.966164][T10279] ? bpf_lsm_file_permission+0x9/0x10 [ 533.966182][T10279] ? security_file_permission+0x76/0x210 [ 533.966198][T10279] ? rw_verify_area+0xce/0x6d0 [ 533.966213][T10279] ? __pfx_rng_dev_read+0x10/0x10 [ 533.966228][T10279] vfs_read+0x1e4/0xb30 [ 533.966244][T10279] ? __pfx_vfs_read+0x10/0x10 [ 533.966269][T10279] ? find_held_lock+0x2b/0x80 [ 533.966284][T10279] ? __fget_files+0x215/0x3d0 [ 533.966302][T10279] ? __fget_files+0x215/0x3d0 [ 533.966321][T10279] ? __fget_files+0x21f/0x3d0 [ 533.966341][T10279] ksys_read+0x12a/0x250 [ 533.966355][T10279] ? __pfx_ksys_read+0x10/0x10 [ 533.966374][T10279] do_syscall_64+0x106/0xf80 [ 533.966389][T10279] ? clear_bhb_loop+0x40/0x90 [ 533.966404][T10279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.966416][T10279] RIP: 0033:0x7fd45039bf79 [ 533.966427][T10279] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 533.966437][T10279] RSP: 002b:00007fd4511fd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 533.966450][T10279] RAX: ffffffffffffffda RBX: 00007fd450616180 RCX: 00007fd45039bf79 [ 533.966457][T10279] RDX: 00000000fffffec1 RSI: 00002000000024c0 RDI: 0000000000000003 [ 533.966464][T10279] RBP: 00007fd4511fd090 R08: 0000000000000000 R09: 0000000000000000 [ 533.966470][T10279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 533.966476][T10279] R13: 00007fd450616218 R14: 00007fd450616180 R15: 00007fff86c68e48 [ 533.966490][T10279] [ 534.467446][T10285] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1099'. [ 535.457682][T10298] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1102'. [ 535.553232][T10298] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1102'. [ 535.644220][ T30] audit: type=1400 audit(1771075019.944:498): avc: denied { shutdown } for pid=10296 comm="syz.5.1102" laddr=fe80::11 lport=47553 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 535.818867][T10307] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1103'. [ 535.856043][T10307] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 535.919459][T10282] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 536.315606][T10314] xt_hashlimit: size too large, truncated to 1048576 [ 536.439509][T10318] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 536.924041][ T792] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 539.234350][ T792] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 539.423143][ T792] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.048222][ T792] usb 5-1: config 0 descriptor?? [ 540.090850][ T792] usb 5-1: can't set config #0, error -71 [ 540.147207][ T792] usb 5-1: USB disconnect, device number 52 [ 540.671068][ T792] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 540.707874][T10344] netlink: 112 bytes leftover after parsing attributes in process `syz.5.1115'. [ 540.744058][T10344] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 540.841056][ T792] usb 5-1: Using ep0 maxpacket: 32 [ 541.089303][T10350] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1116'. [ 541.136501][ T792] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 541.163968][T10350] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 541.193157][ T792] usb 5-1: config 0 has no interface number 0 [ 541.520452][ T792] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 541.568175][ T792] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 541.604810][ T792] usb 5-1: Product: syz [ 541.637666][ T792] usb 5-1: Manufacturer: syz [ 541.671210][ T792] usb 5-1: SerialNumber: syz [ 541.696774][ T792] usb 5-1: config 0 descriptor?? [ 541.805560][ T792] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 541.840823][ T7061] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 542.451055][T10340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 542.488993][T10340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 542.529252][ T7061] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 542.570741][ T5884] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 542.676756][ T7061] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 542.905103][ T792] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 542.944867][ T7061] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 542.954269][ T792] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 542.986875][ T7061] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 543.022605][ T7061] usb 3-1: Manufacturer: syz [ 543.037048][ T7061] usb 3-1: config 0 descriptor?? [ 543.060686][ T5884] usb 2-1: Using ep0 maxpacket: 8 [ 543.090871][ T5884] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 543.104258][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 543.140832][ T5884] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 543.152193][ T5911] usb 5-1: USB disconnect, device number 53 [ 543.164981][ T5884] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 543.187365][ T5911] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 543.201746][ T5884] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 543.215985][ T5884] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 543.229605][ T5911] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 543.251606][ T5911] quatech2 5-1:0.51: device disconnected [ 543.257335][ T5884] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 543.273209][ T5884] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.300694][ T1204] usb 6-1: new low-speed USB device number 6 using dummy_hcd [ 543.510683][ T1204] usb 6-1: unable to get BOS descriptor or descriptor too short [ 543.523593][ T5884] usb 2-1: usb_control_msg returned -32 [ 543.529209][ T5884] usbtmc 2-1:16.0: can't read capabilities [ 543.541312][ T1204] usb 6-1: no configurations [ 543.546071][ T1204] usb 6-1: can't read configurations, error -22 [ 543.930769][ T5884] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 544.412665][T10382] usbtmc 2-1:16.0: usb_clear_halt returned -32 [ 544.604092][T10382] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 544.670942][T10382] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 544.827722][ T7061] usb 2-1: USB disconnect, device number 55 [ 545.022569][ T792] usb 3-1: USB disconnect, device number 67 [ 545.253632][ T1204] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 545.727146][ T1204] usb 6-1: Using ep0 maxpacket: 8 [ 545.740880][ T5884] usb 5-1: Using ep0 maxpacket: 32 [ 545.853079][ T5884] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 545.911043][ T5884] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 545.960388][ T1204] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 545.977758][ T5884] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 546.000523][ T1204] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 546.024428][ T1204] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 546.034728][ T1204] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 546.050220][ T1204] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 546.060986][ T1204] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 546.203861][T10396] xt_hashlimit: size too large, truncated to 1048576 [ 546.264112][T10398] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 546.321232][ T1204] usb 6-1: GET_CAPABILITIES returned 0 [ 546.343844][ T1204] usbtmc 6-1:16.0: can't read capabilities [ 546.470672][ T7061] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 546.702312][ T30] audit: type=1400 audit(1771075031.004:499): avc: denied { bind } for pid=10383 comm="syz.5.1125" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 547.216868][T10411] bridge0: entered allmulticast mode [ 547.339182][ T29] usb 5-1: USB disconnect, device number 54 [ 547.394495][ T7061] usb 4-1: unable to get BOS descriptor or descriptor too short [ 547.431024][T10411] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1125'. [ 547.440007][T10411] bridge_slave_1: left allmulticast mode [ 547.445762][T10411] bridge_slave_1: left promiscuous mode [ 547.472499][T10411] bridge0: port 2(bridge_slave_1) entered disabled state [ 547.508508][ T7061] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 547.524547][ T7061] usb 4-1: can't read configurations, error -71 [ 547.561552][T10411] bridge_slave_0: left allmulticast mode [ 547.601117][T10411] bridge_slave_0: left promiscuous mode [ 547.606932][T10411] bridge0: port 1(bridge_slave_0) entered disabled state [ 547.787542][T10411] bridge0 (unregistering): left allmulticast mode [ 548.017496][T10420] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1133'. [ 548.786309][ T11] block nbd0: Possible stuck request ffff888027cb0000: control (read@0,4096B). Runtime 120 seconds [ 549.188515][T10426] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1135'. [ 549.328989][T10426] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 549.717437][ T5911] usb 6-1: USB disconnect, device number 7 [ 549.938303][T10434] overlayfs: The uuid=off requires a single fs for lower and upper, falling back to uuid=null. [ 550.185926][T10432] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 550.285225][ T30] audit: type=1400 audit(1771075034.454:500): avc: denied { mounton } for pid=10430 comm="syz.3.1137" path="/230/file0" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 550.343292][T10434] overlayfs: overlapping lowerdir path [ 550.535902][ T30] audit: type=1400 audit(1771075034.474:501): avc: denied { getattr } for pid=10430 comm="syz.3.1137" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 550.881671][ T30] audit: type=1400 audit(1771075035.174:502): avc: denied { unmount } for pid=5811 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 551.246513][T10453] FAT-fs (nbd3): unable to read boot sector [ 551.606004][ T5877] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 551.853486][ T5877] usb 2-1: Using ep0 maxpacket: 32 [ 552.014447][T10467] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 552.089729][T10469] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1147'. [ 552.817704][ T5877] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 552.889770][ T5877] usb 2-1: config 0 has no interface number 0 [ 553.183273][ T5877] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 553.229393][T10474] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1150'. [ 553.242192][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.254912][ T5877] usb 2-1: Product: syz [ 553.259064][ T5877] usb 2-1: Manufacturer: syz [ 553.263728][ T5877] usb 2-1: SerialNumber: syz [ 553.278026][ T5877] usb 2-1: config 0 descriptor?? [ 553.297557][ T5877] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 553.352664][T10479] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1149'. [ 553.571120][ T29] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 553.711447][ T5877] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 553.781225][ T29] usb 4-1: Using ep0 maxpacket: 8 [ 553.850046][ T29] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 553.938930][ T5877] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 553.950498][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.972761][ T29] usb 4-1: Product: syz [ 553.977140][ T29] usb 4-1: Manufacturer: syz [ 554.009886][T10491] befs: (nbd2): unable to read superblock [ 554.047146][ T29] usb 4-1: SerialNumber: syz [ 554.110990][ T7061] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 554.227356][ T29] usb 4-1: config 0 descriptor?? [ 554.331361][ T7061] usb 5-1: Using ep0 maxpacket: 32 [ 554.397725][ T29] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 554.448293][ T7061] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 554.460688][ T7061] usb 5-1: config 0 has no interface number 0 [ 554.467198][ T29] pctv452e: pctv452e_power_ctrl: 1 [ 554.467198][ T29] [ 554.479444][ T29] usb 4-1: selecting invalid altsetting 3 [ 554.487230][ T7061] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 554.497117][ T7061] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 554.505526][ T29] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 554.505526][ T29] [ 554.517646][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 554.518088][ T5911] usb 2-1: USB disconnect, device number 56 [ 554.527595][ T7061] usb 5-1: Product: syz [ 554.540332][ T7061] usb 5-1: Manufacturer: syz [ 554.552974][ T29] dvb-usb: bulk message failed: -22 (5/0) [ 554.560228][ T7061] usb 5-1: SerialNumber: syz [ 554.577822][ T5911] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 554.580053][ T29] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 554.600400][ T7061] usb 5-1: config 0 descriptor?? [ 554.610251][ T29] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 554.620460][ T7061] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 554.631293][ T5911] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 554.631604][ T29] usb 4-1: media controller created [ 554.648814][ T29] dvb-usb: bulk message failed: -22 (8/0) [ 554.675739][ T5911] quatech2 2-1:0.51: device disconnected [ 554.690465][ T29] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 554.709220][ T29] dvb-usb: MAC address reading failed. [ 554.826920][ T29] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 554.929349][ T7061] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 555.298754][ T7061] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 555.683779][T10507] xt_hashlimit: size too large, truncated to 1048576 [ 555.722006][ T29] DVB: Unable to find symbol stb0899_attach() [ 555.759749][ T29] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 555.870890][T10511] netlink: 'syz.3.1159': attribute type 1 has an invalid length. [ 555.879126][T10511] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1159'. [ 556.180813][T10513] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 556.250261][ T29] rc_core: IR keymap rc-tt-1500 not found [ 556.299248][ T29] Registered IR keymap rc-empty [ 556.321493][ T29] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 556.385947][ T29] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input20 [ 556.471382][ T29] dvb-usb: schedule remote query interval to 100 msecs. [ 556.478425][ T29] pctv452e: pctv452e_power_ctrl: 0 [ 556.478425][ T29] [ 556.512302][ T30] audit: type=1400 audit(1771075040.794:503): avc: denied { bind } for pid=10485 comm="syz.4.1153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 556.549417][ T29] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 556.570112][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 556.588943][ T5869] usb 5-1: USB disconnect, device number 55 [ 556.616188][ T5869] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 556.632729][ T30] audit: type=1400 audit(1771075040.794:504): avc: denied { write } for pid=10485 comm="syz.4.1153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 556.654194][ T29] usb 4-1: USB disconnect, device number 58 [ 556.662463][ T7061] dvb-usb: bulk message failed: -22 (4/0) [ 556.671237][ T7061] dvb-usb: error -22 while querying for an remote control event. [ 556.695864][ T5869] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 556.752520][ T5869] quatech2 5-1:0.51: device disconnected [ 556.853861][ T29] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 556.871982][ T6708] Bluetooth: hci6: Frame reassembly failed (-84) [ 556.883311][ T6708] Bluetooth: hci6: Frame reassembly failed (-84) [ 556.972608][ T5911] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 557.150797][ T5911] usb 3-1: Using ep0 maxpacket: 8 [ 557.211075][ T29] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 557.492816][ T29] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 557.503569][ T29] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.516463][ T29] usb 4-1: Product: syz [ 557.525905][ T29] usb 4-1: Manufacturer: syz [ 557.530620][ T29] usb 4-1: SerialNumber: syz [ 557.588902][ T5911] usb 3-1: unable to get BOS descriptor or descriptor too short [ 557.640106][ T5911] usb 3-1: config 4 has an invalid interface number: 147 but max is 0 [ 557.821587][ T5911] usb 3-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 557.850622][ T5911] usb 3-1: config 4 has no interface number 0 [ 558.033675][ T5911] usb 3-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e [ 558.062339][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 558.103806][ T5911] usb 3-1: Product: syz [ 558.112958][ T29] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 558.143843][ T29] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 558.151985][ T5911] usb 3-1: Manufacturer: syz [ 558.159343][ T5911] usb 3-1: SerialNumber: syz [ 558.470372][T10551] loop7: detected capacity change from 1 to 0 [ 558.484737][T10550] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1167'. [ 558.910878][ T5807] Bluetooth: hci6: command 0x1003 tx timeout [ 558.987344][ T5911] uvcvideo 3-1:4.147: Found multiple Units with ID 6 [ 559.036640][ T51] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 559.112689][ T5911] uvcvideo 3-1:4.147: Found UVC 0.02 device syz (04f2:b746) [ 559.120261][ T5911] uvcvideo 3-1:4.147: No valid video chain found. [ 559.135328][T10550] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1167'. [ 559.142487][ T5911] usb 3-1: USB disconnect, device number 68 [ 559.210427][T10554] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1169'. [ 559.804167][ T29] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x0000011c. ret = -EPROTO [ 560.020230][ T29] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 560.031191][ T29] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 560.078021][ T29] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 560.119399][ T29] usb 4-1: USB disconnect, device number 59 [ 560.159755][T10570] FAULT_INJECTION: forcing a failure. [ 560.159755][T10570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 560.173769][T10570] CPU: 1 UID: 0 PID: 10570 Comm: syz.1.1173 Tainted: G L syzkaller #0 PREEMPT(full) [ 560.173805][T10570] Tainted: [L]=SOFTLOCKUP [ 560.173818][T10570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 560.173830][T10570] Call Trace: [ 560.173838][T10570] [ 560.173845][T10570] dump_stack_lvl+0x100/0x190 [ 560.173887][T10570] should_fail_ex.cold+0x5/0xa [ 560.173917][T10570] _copy_from_user+0x2e/0xd0 [ 560.173949][T10570] copy_msghdr_from_user+0x9f/0x4f0 [ 560.173980][T10570] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 560.174019][T10570] ___sys_sendmsg+0x106/0x1e0 [ 560.174044][T10570] ? __pfx____sys_sendmsg+0x10/0x10 [ 560.174101][T10570] __sys_sendmsg+0x170/0x220 [ 560.174131][T10570] ? __pfx___sys_sendmsg+0x10/0x10 [ 560.174177][T10570] do_syscall_64+0x106/0xf80 [ 560.174199][T10570] ? clear_bhb_loop+0x40/0x90 [ 560.174224][T10570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 560.174243][T10570] RIP: 0033:0x7f45f479bf79 [ 560.174261][T10570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 560.174279][T10570] RSP: 002b:00007f45f56c8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 560.174300][T10570] RAX: ffffffffffffffda RBX: 00007f45f4a15fa0 RCX: 00007f45f479bf79 [ 560.174312][T10570] RDX: 00000000000040c4 RSI: 00002000000000c0 RDI: 0000000000000003 [ 560.174324][T10570] RBP: 00007f45f56c8090 R08: 0000000000000000 R09: 0000000000000000 [ 560.174334][T10570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 560.174345][T10570] R13: 00007f45f4a16038 R14: 00007f45f4a15fa0 R15: 00007ffd25552db8 [ 560.174372][T10570] [ 560.472587][T10573] xt_hashlimit: size too large, truncated to 1048576 [ 560.538078][T10572] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 561.831417][ T9888] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 562.082192][ T9888] usb 5-1: Using ep0 maxpacket: 32 [ 562.102872][ T9888] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 562.111897][ T9888] usb 5-1: config 0 has no interface number 0 [ 562.250855][ T9888] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 562.312352][ T9888] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.394417][ T9888] usb 5-1: Product: syz [ 562.398662][ T9888] usb 5-1: Manufacturer: syz [ 562.441517][ T9888] usb 5-1: SerialNumber: syz [ 562.452978][ T9888] usb 5-1: config 0 descriptor?? [ 562.474006][ T9888] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 562.686049][T10581] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 562.720728][T10581] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 562.781489][ T9888] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 562.825496][ T9888] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 562.860647][ T30] audit: type=1400 audit(1771075046.954:505): avc: denied { setopt } for pid=10593 comm="syz.5.1182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 563.159403][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 563.244760][ T9888] usb 5-1: USB disconnect, device number 56 [ 563.300457][ T9888] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 563.441442][ T9888] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 563.748922][T10614] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1185'. [ 563.795337][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.804091][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.142008][ T9888] quatech2 5-1:0.51: device disconnected [ 564.734755][T10624] befs: (nbd4): unable to read superblock [ 565.240689][ T5911] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 565.541155][ T5911] usb 4-1: Using ep0 maxpacket: 16 [ 565.583253][ T5911] usb 4-1: config index 0 descriptor too short (expected 91, got 27) [ 565.641509][ T5911] usb 4-1: config 0 has an invalid interface number: 9 but max is 1 [ 565.720251][ T5911] usb 4-1: config 0 has an invalid interface number: 9 but max is 1 [ 565.789260][ T5911] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 565.849476][ T5911] usb 4-1: config 0 has no interface number 0 [ 565.878729][ T5911] usb 4-1: config 0 interface 9 has no altsetting 0 [ 565.888197][T10638] netlink: 112 bytes leftover after parsing attributes in process `syz.5.1192'. [ 565.909804][ T5911] usb 4-1: config 0 interface 9 has no altsetting 1 [ 565.934999][ T5911] usb 4-1: New USB device found, idVendor=1199, idProduct=6891, bcdDevice= 9.a0 [ 565.959075][T10638] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 566.238457][ T5911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 566.250957][ T5911] usb 4-1: Product: syz [ 566.255231][ T5911] usb 4-1: Manufacturer: syz [ 566.297895][ T5911] usb 4-1: SerialNumber: syz [ 566.492333][T10647] befs: (nbd5): unable to read superblock [ 566.699912][ T5911] usb 4-1: config 0 descriptor?? [ 566.796921][T10637] binder: 10635:10637 ioctl c0306201 200000000080 returned -14 [ 566.976381][T10651] batadv_slave_0: entered promiscuous mode [ 566.994028][ T30] audit: type=1400 audit(1771075051.294:506): avc: denied { create } for pid=10648 comm="syz.1.1195" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 567.052737][ T30] audit: type=1400 audit(1771075051.294:507): avc: denied { ioctl } for pid=10648 comm="syz.1.1195" path="socket:[35791]" dev="sockfs" ino=35791 ioctlcmd=0x89fb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 567.588836][T10648] batadv_slave_0: left promiscuous mode [ 567.793397][ T5869] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 567.940892][ T9888] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 567.950850][ T5869] usb 5-1: Using ep0 maxpacket: 32 [ 568.156759][ T9888] usb 2-1: Using ep0 maxpacket: 32 [ 568.270140][ T5911] usb 4-1: selecting invalid altsetting 1 [ 568.283684][ T5869] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 568.292471][ T5869] usb 5-1: config 0 has no interface number 0 [ 568.306541][ T5869] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 568.316169][ T5869] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.324330][ T5869] usb 5-1: Product: syz [ 568.328545][ T5869] usb 5-1: Manufacturer: syz [ 568.333258][ T5869] usb 5-1: SerialNumber: syz [ 568.410951][ T5869] usb 5-1: config 0 descriptor?? [ 568.492675][ T5869] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 568.764372][ T5869] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 568.854727][ T5911] sierra 4-1:0.9: Sierra USB modem converter detected [ 568.862128][ T9888] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 568.870320][ T9888] usb 2-1: config 0 has no interface number 0 [ 568.881952][ T9888] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 568.890983][ T5869] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 568.901158][ T5911] usb 4-1: Sierra USB modem converter now attached to ttyUSB2 [ 568.912516][ T9888] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.921476][ T5911] usb 4-1: USB disconnect, device number 60 [ 568.931661][ T9888] usb 2-1: Product: syz [ 568.935882][ T9888] usb 2-1: Manufacturer: syz [ 568.940620][ T9888] usb 2-1: SerialNumber: syz [ 568.951591][ T9888] usb 2-1: config 0 descriptor?? [ 568.957042][ T5911] sierra ttyUSB2: Sierra USB modem converter now disconnected from ttyUSB2 [ 568.979470][ T5911] sierra 4-1:0.9: device disconnected [ 569.000764][ T9888] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 569.774178][T10659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 569.802831][T10659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 569.844486][ T9888] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB2 [ 569.862952][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 569.864149][ T5911] usb 5-1: USB disconnect, device number 57 [ 569.925855][ T5911] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 569.944438][ T9888] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB3 [ 569.964604][ T5911] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 570.021658][ T5911] quatech2 5-1:0.51: device disconnected [ 570.121431][T10678] netlink: 112 bytes leftover after parsing attributes in process `syz.5.1204'. [ 570.159568][T10678] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 570.255277][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 570.256310][ T7061] usb 2-1: USB disconnect, device number 57 [ 570.481664][ T7061] quatech-serial ttyUSB2: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB2 [ 570.612656][ T7061] quatech-serial ttyUSB3: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB3 [ 570.631663][ T7061] quatech2 2-1:0.51: device disconnected [ 571.329199][T10693] befs: (nbd1): unable to read superblock [ 571.516820][T10695] netlink: 112 bytes leftover after parsing attributes in process `syz.3.1210'. [ 571.550675][ T5911] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 571.572979][T10695] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 571.961675][ T5911] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 571.988933][ T5911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 572.044041][ T5911] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 572.077685][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.096246][ T5911] usb 5-1: Product: syz [ 572.115044][ T5911] usb 5-1: Manufacturer: syz [ 572.119717][ T5911] usb 5-1: SerialNumber: syz [ 572.132358][ T5911] usb 5-1: config 0 descriptor?? [ 572.312111][T10692] comedi comedi2: reset error (fatal) [ 572.354445][ T30] audit: type=1400 audit(1771075056.644:508): avc: denied { listen } for pid=10701 comm="syz.3.1212" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 572.683633][T10710] xt_hashlimit: size too large, truncated to 1048576 [ 572.731750][ T30] audit: type=1400 audit(1771075057.034:509): avc: denied { read } for pid=5472 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 572.754560][ T5911] usb 5-1: USB disconnect, device number 58 [ 572.884206][T10713] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 573.362885][T10720] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 573.885905][T10729] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1217'. [ 574.035261][T10729] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 574.451989][T10738] befs: (nbd4): unable to read superblock [ 574.484230][ T5911] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 574.542578][T10743] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1221'. [ 574.644923][ T5911] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 574.658194][ T5911] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 574.671464][ T5911] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 574.682892][ T5911] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 574.704634][ T5911] usb 2-1: Manufacturer: syz [ 574.738141][ T5911] usb 2-1: config 0 descriptor?? [ 575.099166][T10735] comedi comedi2: reset error (fatal) [ 575.420748][ T7061] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 575.640893][ T7061] usb 6-1: Using ep0 maxpacket: 32 [ 575.719683][ T7061] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 575.822598][ T7061] usb 6-1: config 0 has no interface number 0 [ 575.919862][ T7061] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 576.025692][ T7061] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.134214][ T7061] usb 6-1: Product: syz [ 576.185769][ T7061] usb 6-1: Manufacturer: syz [ 576.248191][ T7061] usb 6-1: SerialNumber: syz [ 576.415791][ T7061] usb 6-1: config 0 descriptor?? [ 576.686630][ T7061] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 576.962704][T10775] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1228'. [ 576.965355][ T7061] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 577.003940][T10775] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 577.129521][ T29] usb 2-1: USB disconnect, device number 58 [ 577.411405][ T7061] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 577.531144][T10785] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1230'. [ 577.603267][T10785] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 577.976663][T10779] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 577.987388][T10779] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 578.135201][T10797] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=10797 comm=syz.1.1232 [ 578.198978][T10797] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10797 comm=syz.1.1232 [ 578.452753][T10802] befs: (nbd3): unable to read superblock [ 579.122704][ C1] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 579.123153][ T9888] usb 6-1: USB disconnect, device number 8 [ 579.139122][ T9888] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 579.152725][ T11] block nbd0: Possible stuck request ffff888027cb0000: control (read@0,4096B). Runtime 150 seconds [ 579.212216][ T9888] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 579.251617][T10797] syz.1.1232 (10797): drop_caches: 2 [ 579.261304][ T9888] quatech2 6-1:0.51: device disconnected [ 579.317977][T10806] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1234'. [ 579.353791][T10797] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=10797 comm=syz.1.1232 [ 579.601164][ T5884] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 579.763788][ T29] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 579.780874][ T5884] usb 4-1: Using ep0 maxpacket: 8 [ 579.795331][ T5884] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 579.815309][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.845650][ T5884] usb 4-1: Product: syz [ 579.860069][ T5884] usb 4-1: Manufacturer: syz [ 579.870772][ T5884] usb 4-1: SerialNumber: syz [ 579.888113][ T5884] usb 4-1: config 0 descriptor?? [ 579.898515][ T5884] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 579.930843][ T5884] pctv452e: pctv452e_power_ctrl: 1 [ 579.930843][ T5884] [ 579.932989][ T29] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 579.938242][ T5884] usb 4-1: selecting invalid altsetting 3 [ 579.938265][ T5884] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 579.938265][ T5884] [ 579.938283][ T5884] dvb-usb: bulk message failed: -22 (5/0) [ 579.951731][ T5884] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 579.977154][ T29] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 580.000678][ T29] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 580.009980][ T29] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.019403][ T5884] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 580.040655][ T5884] usb 4-1: media controller created [ 580.043221][T10810] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 580.046384][ T5884] dvb-usb: bulk message failed: -22 (8/0) [ 580.057616][ T29] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 580.070662][ T5884] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 580.089263][ T5884] dvb-usb: MAC address reading failed. [ 580.100681][T10806] dvb-usb: bulk message failed: -22 (7/0) [ 580.108759][T10806] pctv452e: I2C error -22; AA 02 00 00 00 -> aa 02 31 03 00 00 00 [ 580.143055][ T5884] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 580.297510][ T5884] DVB: Unable to find symbol stb0899_attach() [ 580.310696][ T5884] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 580.421821][ T5911] usb 5-1: USB disconnect, device number 59 [ 581.660726][ T5884] rc_core: IR keymap rc-tt-1500 not found [ 581.713354][ T5884] Registered IR keymap rc-empty [ 581.849429][ T5884] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 582.112358][ T5884] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input21 [ 582.323759][ T5884] dvb-usb: schedule remote query interval to 100 msecs. [ 582.339116][ T5884] pctv452e: pctv452e_power_ctrl: 0 [ 582.339116][ T5884] [ 582.346737][T10824] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=10824 comm=syz.1.1237 [ 582.347171][ T5884] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 582.440619][ T9888] dvb-usb: bulk message failed: -22 (4/0) [ 582.487055][ T9888] dvb-usb: error -22 while querying for an remote control event. [ 582.548110][T10824] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=10824 comm=syz.1.1237 [ 582.651328][ T9888] dvb-usb: bulk message failed: -22 (4/0) [ 582.651365][ T29] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 582.657144][ T9888] dvb-usb: error -22 while querying for an remote control event. [ 582.701837][ T5884] usb 4-1: USB disconnect, device number 61 [ 582.802728][ T5884] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 582.834535][ T29] usb 3-1: Using ep0 maxpacket: 32 [ 582.841826][ T29] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 582.860226][ T29] usb 3-1: config 0 has no interface number 0 [ 582.895135][ T29] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 582.910830][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.921013][ T29] usb 3-1: Product: syz [ 582.925234][ T29] usb 3-1: Manufacturer: syz [ 582.940898][ T29] usb 3-1: SerialNumber: syz [ 583.376235][ T29] usb 3-1: config 0 descriptor?? [ 583.383193][T10829] netlink: 112 bytes leftover after parsing attributes in process `syz.5.1241'. [ 583.401959][ T29] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 583.437636][T10829] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 583.595747][ T5884] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 583.697714][T10820] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 583.782934][T10825] syz.1.1237 (10825): drop_caches: 2 [ 583.798609][T10833] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1242'. [ 583.804355][T10820] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 583.861855][ T29] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 583.872664][T10833] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 583.980808][ T29] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 584.124796][ T5884] usb 4-1: unable to get BOS descriptor or descriptor too short [ 584.142558][ T5884] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 584.150202][ T5884] usb 4-1: can't read configurations, error -71 [ 584.158192][T10824] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=60 sclass=netlink_route_socket pid=10824 comm=syz.1.1237 [ 584.368033][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 584.369086][ T9888] usb 3-1: USB disconnect, device number 69 [ 584.419072][ T9888] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 585.014809][ T9888] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 585.233332][ T9888] quatech2 3-1:0.51: device disconnected [ 585.281037][T10853] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1248'. [ 586.732840][ T30] audit: type=1400 audit(1771075071.024:510): avc: denied { write } for pid=10874 comm="syz.3.1255" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 586.736248][T10876] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1254'. [ 586.982129][T10882] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1256'. [ 587.236973][ T5884] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 587.460267][T10886] netlink: 'syz.2.1257': attribute type 39 has an invalid length. [ 587.968718][T10890] netlink: 'syz.1.1258': attribute type 39 has an invalid length. [ 588.066351][T10891] FAULT_INJECTION: forcing a failure. [ 588.066351][T10891] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 588.079670][T10891] CPU: 0 UID: 0 PID: 10891 Comm: syz.1.1258 Tainted: G L syzkaller #0 PREEMPT(full) [ 588.079703][T10891] Tainted: [L]=SOFTLOCKUP [ 588.079709][T10891] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 588.079718][T10891] Call Trace: [ 588.079727][T10891] [ 588.079733][T10891] dump_stack_lvl+0x100/0x190 [ 588.079772][T10891] should_fail_ex.cold+0x5/0xa [ 588.079796][T10891] _copy_from_user+0x2e/0xd0 [ 588.079825][T10891] copy_msghdr_from_user+0x9f/0x4f0 [ 588.079853][T10891] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 588.079886][T10891] ___sys_sendmsg+0x106/0x1e0 [ 588.079911][T10891] ? __pfx____sys_sendmsg+0x10/0x10 [ 588.079962][T10891] __sys_sendmsg+0x170/0x220 [ 588.079990][T10891] ? __pfx___sys_sendmsg+0x10/0x10 [ 588.080033][T10891] do_syscall_64+0x106/0xf80 [ 588.080053][T10891] ? clear_bhb_loop+0x40/0x90 [ 588.080076][T10891] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.080095][T10891] RIP: 0033:0x7f45f479bf79 [ 588.080113][T10891] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 588.080130][T10891] RSP: 002b:00007f45f56a7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 588.080151][T10891] RAX: ffffffffffffffda RBX: 00007f45f4a16090 RCX: 00007f45f479bf79 [ 588.080162][T10891] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 588.080173][T10891] RBP: 00007f45f56a7090 R08: 0000000000000000 R09: 0000000000000000 [ 588.080183][T10891] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 588.080193][T10891] R13: 00007f45f4a16128 R14: 00007f45f4a16090 R15: 00007ffd25552db8 [ 588.080216][T10891] [ 589.444962][ T30] audit: type=1400 audit(1771075073.634:511): avc: denied { mount } for pid=10895 comm="syz.2.1261" name="/" dev="selinuxfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 589.610486][T10904] overlayfs: fs on './file1/file0' does not support file handles, falling back to index=off,nfs_export=off. [ 589.927115][T10901] overlayfs: missing 'lowerdir' [ 589.947618][T10905] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1263'. [ 590.209689][ T5884] usb 5-1: device descriptor read/64, error -71 [ 590.212604][ T30] audit: type=1400 audit(1771075074.514:512): avc: denied { unmount } for pid=5803 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=filesystem permissive=1 [ 590.480730][ T5884] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 590.586973][T10920] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1268'. [ 590.728015][T10921] FAT-fs (nbd1): unable to read boot sector [ 590.740364][T10920] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 590.800630][ T5884] usb 5-1: Using ep0 maxpacket: 32 [ 590.817351][ T5884] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 590.859273][ T5884] usb 5-1: config 0 has no interface number 0 [ 590.891143][ T5884] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 590.925706][ T5884] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 591.079386][ T5884] usb 5-1: Product: syz [ 591.246233][T10924] befs: (nbd2): unable to read superblock [ 591.257737][ T5884] usb 5-1: Manufacturer: syz [ 591.262567][ T5884] usb 5-1: SerialNumber: syz [ 591.297389][ T5884] usb 5-1: config 0 descriptor?? [ 591.341009][ T5884] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 592.000421][T10894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 592.029058][T10894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 592.054325][ T5869] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 592.379110][ T5884] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 592.452445][ T5869] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 592.452457][ T5884] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 592.482272][ T5869] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 592.504106][ T5869] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 592.523228][ T5869] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.547435][ T5869] usb 4-1: Product: syz [ 592.555538][ T5869] usb 4-1: Manufacturer: syz [ 592.560237][ T5869] usb 4-1: SerialNumber: syz [ 592.571273][T10946] netlink: 'syz.1.1273': attribute type 1 has an invalid length. [ 592.586422][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 592.586679][ T7061] usb 5-1: USB disconnect, device number 61 [ 592.611174][ T5869] usb 4-1: config 0 descriptor?? [ 592.623289][ T7061] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 592.661748][ T7061] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 592.712366][ T29] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 592.749493][ T7061] quatech2 5-1:0.51: device disconnected [ 592.781544][T10946] bond1: entered promiscuous mode [ 592.918908][T10946] 8021q: adding VLAN 0 to HW filter on device bond1 [ 592.961355][T10951] bond1: (slave bridge1): making interface the new active one [ 592.971533][ T29] usb 6-1: Using ep0 maxpacket: 32 [ 593.008527][ T29] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 593.034865][T10951] bridge1: entered promiscuous mode [ 593.047204][ T29] usb 6-1: config 0 has no interface number 0 [ 593.346943][ T29] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 593.365438][T10951] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 593.375251][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.439906][ T29] usb 6-1: Product: syz [ 593.518393][ T29] usb 6-1: Manufacturer: syz [ 593.544829][ T29] usb 6-1: SerialNumber: syz [ 593.571204][ T29] usb 6-1: config 0 descriptor?? [ 593.840933][T10964] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1277'. [ 593.996747][ T30] audit: type=1326 audit(1771075078.284:513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10957 comm="syz.4.1276" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd45039bf79 code=0x0 [ 594.030735][T10944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 594.072956][T10944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 594.097911][ T29] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 594.210407][ T29] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 594.268255][T10969] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1279'. [ 594.307004][T10969] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 594.937012][ T5869] usb 4-1: USB disconnect, device number 64 [ 594.943935][T10944] Driver unsupported XDP return value 0 on prog (id 112) dev N/A, expect packet loss! [ 594.982792][T10970] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 595.234818][T10979] netlink: 'syz.3.1281': attribute type 1 has an invalid length. [ 595.527454][ T5794] udevd[5794]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 595.535882][T10982] FAULT_INJECTION: forcing a failure. [ 595.535882][T10982] name failslab, interval 1, probability 0, space 0, times 0 [ 595.599670][ T29] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 595.630179][T10982] CPU: 0 UID: 0 PID: 10982 Comm: syz.2.1283 Tainted: G L syzkaller #0 PREEMPT(full) [ 595.630213][T10982] Tainted: [L]=SOFTLOCKUP [ 595.630219][T10982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 595.630230][T10982] Call Trace: [ 595.630237][T10982] [ 595.630244][T10982] dump_stack_lvl+0x100/0x190 [ 595.630289][T10982] should_fail_ex.cold+0x5/0xa [ 595.630315][T10982] should_failslab+0xc2/0x120 [ 595.630343][T10982] kmem_cache_alloc_noprof+0x7b/0x6e0 [ 595.630366][T10982] ? alloc_empty_file+0x55/0x1c0 [ 595.630388][T10982] alloc_empty_file+0x55/0x1c0 [ 595.630408][T10982] alloc_file_pseudo+0x13a/0x230 [ 595.630427][T10982] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 595.630446][T10982] ? _raw_spin_unlock+0x28/0x50 [ 595.630474][T10982] ? alloc_fd+0x476/0x790 [ 595.630508][T10982] __anon_inode_getfile+0xe8/0x280 [ 595.630530][T10982] __anon_inode_getfd+0x5c/0xe0 [ 595.630551][T10982] __x64_sys_fsopen+0x190/0x220 [ 595.630573][T10982] do_syscall_64+0x106/0xf80 [ 595.630588][T10982] ? clear_bhb_loop+0x40/0x90 [ 595.630607][T10982] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.630624][T10982] RIP: 0033:0x7fd659f9bf79 [ 595.630639][T10982] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 595.630654][T10982] RSP: 002b:00007fd65aebc028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 595.630672][T10982] RAX: ffffffffffffffda RBX: 00007fd65a215fa0 RCX: 00007fd659f9bf79 [ 595.630682][T10982] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 595.630691][T10982] RBP: 00007fd65aebc090 R08: 0000000000000000 R09: 0000000000000000 [ 595.630700][T10982] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 595.630709][T10982] R13: 00007fd65a216038 R14: 00007fd65a215fa0 R15: 00007ffeb643c138 [ 595.630730][T10982] [ 595.632834][ T29] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 595.844458][ T29] usb 6-1: USB disconnect, device number 9 [ 596.077211][ T30] audit: type=1400 audit(1771075080.374:514): avc: denied { lock } for pid=10986 comm="syz.3.1285" path="socket:[38251]" dev="sockfs" ino=38251 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 596.430747][ T29] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 596.621676][T10995] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.688147][ T29] usb 3-1: Using ep0 maxpacket: 32 [ 596.729285][ T29] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 596.743407][T10995] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.776427][ T29] usb 3-1: config 0 has no interface number 0 [ 596.792685][ T29] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 596.816447][ T29] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.839754][T10995] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.869142][ T29] usb 3-1: Product: syz [ 596.877514][ T29] usb 3-1: Manufacturer: syz [ 596.882548][ T29] usb 3-1: SerialNumber: syz [ 596.895596][ T29] usb 3-1: config 0 descriptor?? [ 596.903990][ T29] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 597.932887][T10995] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.957284][ T29] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 598.001019][ T29] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 598.152206][ T7966] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 598.481898][ T6708] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 598.484391][ T9888] usb 3-1: USB disconnect, device number 70 [ 598.490234][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 598.533947][ T6708] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 598.535131][ T9888] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 598.550896][ T6708] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 598.636916][ T9888] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 598.686754][ T9888] quatech2 3-1:0.51: device disconnected [ 598.874307][T11012] netlink: 'syz.5.1294': attribute type 1 has an invalid length. [ 599.048680][T11014] Invalid option length (1048308) for dns_resolver key [ 601.113724][ T29] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 605.326889][T11048] netlink: 112 bytes leftover after parsing attributes in process `syz.2.1305'. [ 605.419615][T11046] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1304'. [ 605.445172][T11048] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 605.856245][ T29] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 606.046900][T11058] xt_hashlimit: size too large, truncated to 1048576 [ 606.095913][T11061] F2FS-fs: Value of option "test_dummy_encryption" is unrecognized [ 606.163887][ T29] usb 2-1: Using ep0 maxpacket: 8 [ 606.184868][ T29] usb 2-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 606.207472][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.530005][ T29] usb 2-1: Product: syz [ 607.421750][ T29] usb 2-1: Manufacturer: syz [ 607.426479][ T29] usb 2-1: SerialNumber: syz [ 607.443294][ T29] usb 2-1: config 0 descriptor?? [ 607.452385][ T29] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 607.461257][ T29] pctv452e: pctv452e_power_ctrl: 1 [ 607.461257][ T29] [ 607.468700][ T29] usb 2-1: selecting invalid altsetting 3 [ 607.479270][ T29] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 607.479270][ T29] [ 607.489763][ T29] dvb-usb: bulk message failed: -22 (5/0) [ 607.584896][ T29] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 607.594937][ T29] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 607.603523][ T29] usb 2-1: media controller created [ 607.608788][ T29] dvb-usb: bulk message failed: -22 (8/0) [ 607.614712][ T29] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 607.624609][ T29] dvb-usb: MAC address reading failed. [ 608.122758][ T1204] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 608.159148][ T29] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 608.200764][T11046] dvb-usb: bulk message failed: -22 (7/0) [ 608.206782][T11046] pctv452e: I2C error -22; AA 02 00 00 00 -> aa 02 31 03 00 00 00 [ 608.290669][ T1204] usb 5-1: Using ep0 maxpacket: 16 [ 608.307903][ T29] DVB: Unable to find symbol stb0899_attach() [ 608.312529][ T1204] usb 5-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 608.316271][ T29] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 608.331972][ T1204] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.332004][ T1204] usb 5-1: Product: syz [ 608.332020][ T1204] usb 5-1: Manufacturer: syz [ 608.332034][ T1204] usb 5-1: SerialNumber: syz [ 608.375321][ T7061] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 608.381426][ T1204] usb 5-1: config 0 descriptor?? [ 608.407370][T11087] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1314'. [ 608.419999][ T1204] visor 5-1:0.0: Sony Clie 3.5 converter detected [ 608.480675][ T29] rc_core: IR keymap rc-tt-1500 not found [ 608.486513][ T29] Registered IR keymap rc-empty [ 608.497815][ T29] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 608.544137][ T29] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input22 [ 608.558458][ T7061] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 608.577676][ T7061] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 7 [ 608.613704][ T29] dvb-usb: schedule remote query interval to 100 msecs. [ 608.626817][ T1204] usb 5-1: clie_3_5_startup: get config number failed: -32 [ 608.633777][ T29] pctv452e: pctv452e_power_ctrl: 0 [ 608.633777][ T29] [ 608.644926][ T29] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 608.657765][ T7061] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 608.667143][ T5869] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 608.682310][ T7061] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.695913][ T7061] usb 4-1: Product: syz [ 608.715441][ T7061] usb 4-1: Manufacturer: syz [ 608.738530][ T29] usb 2-1: USB disconnect, device number 59 [ 608.765436][ T7061] usb 4-1: SerialNumber: syz [ 608.830787][ T5869] usb 3-1: Using ep0 maxpacket: 8 [ 608.880854][ T5869] usb 3-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 608.929427][ T7061] usb 4-1: config 0 descriptor?? [ 608.948131][ T5869] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.985728][ T5869] usb 3-1: Product: syz [ 609.023205][ T5869] usb 3-1: Manufacturer: syz [ 609.053920][ T5869] usb 3-1: SerialNumber: syz [ 609.139832][ T5869] usb 3-1: config 0 descriptor?? [ 609.226080][ T29] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 609.242923][ T8941] block nbd0: Possible stuck request ffff888027cb0000: control (read@0,4096B). Runtime 180 seconds [ 609.245157][ T5869] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 609.312992][ T5869] pctv452e: pctv452e_power_ctrl: 1 [ 609.312992][ T5869] [ 609.335097][ T5869] usb 3-1: selecting invalid altsetting 3 [ 609.370353][ T5869] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 609.370353][ T5869] [ 609.522285][ T5869] dvb-usb: bulk message failed: -22 (5/0) [ 609.793901][ T5869] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 609.803757][ T29] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 609.939107][ T5869] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 609.961834][ T5869] usb 3-1: media controller created [ 609.967602][ T5869] dvb-usb: bulk message failed: -22 (8/0) [ 609.977044][ T5869] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 609.987447][ T5869] dvb-usb: MAC address reading failed. [ 610.031235][ T29] usb 2-1: Using ep0 maxpacket: 32 [ 610.053219][ T29] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 610.076193][ T29] usb 2-1: config 0 has no interface number 0 [ 610.130028][ T1204] visor 5-1:0.0: probe with driver visor failed with error -32 [ 610.171653][ T1204] usb 5-1: USB disconnect, device number 63 [ 610.206632][ T5869] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 610.217339][ T29] usb 2-1: config 0 interface 184 has no altsetting 0 [ 610.246501][ T29] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 610.288444][ T29] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.319405][ T29] usb 2-1: Product: syz [ 610.329245][ T29] usb 2-1: Manufacturer: syz [ 610.340446][ T29] usb 2-1: SerialNumber: syz [ 610.357705][ T29] usb 2-1: config 0 descriptor?? [ 610.379436][ T5869] DVB: Unable to find symbol stb0899_attach() [ 610.392381][ T5869] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 610.450972][ T5911] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 610.490741][ T5869] rc_core: IR keymap rc-tt-1500 not found [ 610.496653][ T5869] Registered IR keymap rc-empty [ 610.504731][ T5869] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 610.519268][ T5869] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input23 [ 610.535326][ T5869] dvb-usb: schedule remote query interval to 100 msecs. [ 610.542833][ T5869] pctv452e: pctv452e_power_ctrl: 0 [ 610.542833][ T5869] [ 610.550182][ T5869] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 610.600647][ T5869] usb 3-1: USB disconnect, device number 71 [ 610.600693][ T5911] usb 6-1: device descriptor read/64, error -71 [ 610.809128][T11093] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1315'. [ 610.827634][ T29] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 610.851620][T11103] fuse: Unknown parameter 'racerPid: 0 [ 610.851620][T11103] Uid: 0 0 0 0 [ 610.851620][T11103] Gid: 0 0 0 0 [ 610.851620][T11103] FDSize: 256 [ 610.851620][T11103] Groups: 0 10 [ 610.851620][T11103] NStgid: 922 [ 610.851620][T11103] NSpid: 923 [ 610.851620][T11103] NSpgid: 922 [ 610.851620][T11103] NSsid: 0 [ 610.851620][T11103] Kthread: 0 [ 610.851620][T11103] VmPeak: 102220 kB [ 610.851620][T11103] VmSize: 102220 kB [ 610.851620][T11103] VmLck: 0 kB [ 610.851620][T11103] VmPin: 0 kB [ 610.851620][T11103] VmHWM: 24084 kB [ 610.851620][T11103] VmRSS: 24084 kB [ 610.851620][T11103] RssAnon: 1416 kB [ 610.851620][T11103] RssFile: 22668 kB [ 610.851620][T11103] RssShmem: 0 kB [ 610.851620][T11103] VmData: 36584 kB [ 610.851620][T11103] VmStk: 132 kB [ 610.851620][T11103] VmExe: 1772 kB [ 610.851620][T11103] VmLib: 8 kB [ 610.851620][T11103] VmPTE: 136 kB [ 610.851620][T11103] VmSwap: 0 kB [ 610.851620][T11103] HugetlbPages: 0 kB [ 610.851620][T11103] CoreDumping: 0 [ 610.851620][T11103] THP_enabled: 1 [ 610.851620][T11103] untag_mask: 0xffffffffffffffff [ 610.851620][T11103] Threads: 2 [ 610.851620][T11103] SigQ: 1/12960 [ 610.851620][T11103] SigPnd: 0000000000000000 [ 610.851620][T11103] ShdPnd: 0000000000000000 [ 610.851620][T11103] SigBlk: 0000000000000000 [ 610.851620][T11103] SigIgn: fffffffefffaba35 [ 610.851620][T11103] SigCgt: 0000000100010440 [ 610.851620][T11103] CapInh: 0000000000000000 [ 610.851620][T11103] CapPrm: 000001ffff77ffff [ 610.851620][T11103] CapEff: 000001ffff77ffff [ 610.851620][T11103] CapBnd: 000001ffffffffff [ 610.851620][T11103] CapAmb: 0000000000000000 [ 610.851620][T11103] NoNewPrivs: 0 [ 610.851620][T11103] Seccomp: 0 [ 610.851620][T11103] Seccomp_filters: 0 [ 610.851620][T11103] Speculation_Store_Bypass: thread vulnerable [ 610.851620][T11103] SpeculationIndirectBranch: conditional enabled [ 610.851620][T11103] Cpus_allowed: 3 [ 610.862182][ T29] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 611.033551][ T5911] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 611.104843][ T5869] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 611.121112][ T29] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 611.132011][ T29] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 611.171345][ T7061] usb 4-1: USB disconnect, device number 65 [ 611.180764][ T5911] usb 6-1: device descriptor read/64, error -71 [ 611.223738][ T29] usb 2-1: USB disconnect, device number 60 [ 611.260400][ T6119] udevd[6119]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 611.301277][ T5911] usb usb6-port1: attempt power cycle [ 611.308488][T11106] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1317'. [ 611.377992][T11116] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 611.450961][ T5869] usb 3-1: new full-speed USB device number 72 using dummy_hcd [ 611.603866][ T7061] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 611.614294][ T5869] usb 3-1: config 0 has an invalid interface number: 52 but max is 0 [ 611.640860][ T5911] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 611.782728][ T5911] usb 6-1: device descriptor read/8, error -71 [ 611.965282][ T5869] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 611.976496][ T5869] usb 3-1: config 0 has no interface number 0 [ 611.983567][ T5869] usb 3-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 611.996897][ T5869] usb 3-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 98, setting to 64 [ 612.007805][ T5869] usb 3-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 612.020732][ T5869] usb 3-1: config 0 interface 52 has no altsetting 0 [ 612.028742][ T5869] usb 3-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 612.038091][ T5869] usb 3-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 612.046831][ T5869] usb 3-1: Manufacturer: syz [ 612.058104][ T5869] usb 3-1: config 0 descriptor?? [ 612.065288][ T30] audit: type=1400 audit(1771075096.364:515): avc: denied { connect } for pid=11118 comm="syz.3.1322" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 612.088018][ T5869] hub 3-1:0.52: bad descriptor, ignoring hub [ 612.094832][ T5869] hub 3-1:0.52: probe with driver hub failed with error -5 [ 612.111329][ T5911] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 612.132236][ T7061] usb 5-1: Using ep0 maxpacket: 8 [ 612.141380][ T7061] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 612.142377][ T5911] usb 6-1: device descriptor read/8, error -71 [ 612.158221][ T7061] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.166807][ T7061] usb 5-1: Product: syz [ 612.171121][ T7061] usb 5-1: Manufacturer: syz [ 612.175743][ T7061] usb 5-1: SerialNumber: syz [ 612.183985][ T7061] usb 5-1: config 0 descriptor?? [ 612.194966][ T7061] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 612.203631][ T7061] pctv452e: pctv452e_power_ctrl: 1 [ 612.203631][ T7061] [ 612.211324][ T7061] usb 5-1: selecting invalid altsetting 3 [ 612.217145][ T7061] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 612.217145][ T7061] [ 612.230589][ T7061] dvb-usb: bulk message failed: -22 (5/0) [ 612.239980][ T7061] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 612.250083][ T7061] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 612.258548][ T7061] usb 5-1: media controller created [ 612.263863][ T7061] dvb-usb: bulk message failed: -22 (8/0) [ 612.270069][ T7061] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 612.278606][ T7061] dvb-usb: MAC address reading failed. [ 612.290242][ T7061] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 612.301928][ T5911] usb usb6-port1: unable to enumerate USB device [ 612.322058][ T5869] input: syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.52/input/input24 [ 612.353500][ T7061] DVB: Unable to find symbol stb0899_attach() [ 612.359594][ T7061] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 612.470822][ T7061] rc_core: IR keymap rc-tt-1500 not found [ 612.477289][ T7061] Registered IR keymap rc-empty [ 612.483172][ T7061] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 612.495030][ T7061] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input25 [ 612.507915][ T7061] dvb-usb: schedule remote query interval to 100 msecs. [ 612.515128][ T7061] pctv452e: pctv452e_power_ctrl: 0 [ 612.515128][ T7061] [ 612.522659][ T7061] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 612.544663][ T7061] usb 5-1: USB disconnect, device number 64 [ 612.600206][ T7061] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 612.640849][ T5911] usb 3-1: USB disconnect, device number 72 [ 612.880645][ T5869] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 613.030856][ T5869] usb 2-1: Using ep0 maxpacket: 32 [ 613.113941][ T5869] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 613.177127][ T5869] usb 2-1: config 0 has no interface number 0 [ 613.289749][ T5869] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 613.330851][ T5869] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 613.338890][ T5869] usb 2-1: Product: syz [ 613.380616][ T5869] usb 2-1: Manufacturer: syz [ 613.400980][ T5869] usb 2-1: SerialNumber: syz [ 613.420423][ T5869] usb 2-1: config 0 descriptor?? [ 613.452992][ T5869] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 613.654539][T11140] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 614.100864][ T5911] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 614.155037][ T5869] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 614.208561][ T5869] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 614.961560][T11148] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1329'. [ 615.041998][ T5911] usb 5-1: Using ep0 maxpacket: 32 [ 615.052968][ T5911] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 615.061784][ T5911] usb 5-1: config 0 has no interface number 0 [ 615.084387][ T5911] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 615.098801][ T5911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.974814][ T5911] usb 5-1: Product: syz [ 616.980702][ T5911] usb 5-1: Manufacturer: syz [ 616.985341][ T5911] usb 5-1: SerialNumber: syz [ 617.013915][ T5911] usb 5-1: config 0 descriptor?? [ 617.019398][ T5911] usb 5-1: can't set config #0, error -71 [ 617.074314][ T5911] usb 5-1: USB disconnect, device number 65 [ 617.090750][ T1204] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 617.116560][ C1] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 617.118520][ T5884] usb 2-1: USB disconnect, device number 61 [ 617.193190][ T5884] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 617.226553][T11161] netlink: 112 bytes leftover after parsing attributes in process `syz.1.1334'. [ 617.252222][ T5884] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 617.263784][ T1204] usb 3-1: Using ep0 maxpacket: 8 [ 617.299328][T11161] openvswitch: netlink: VXLAN extension 0 has unexpected len 4 expected 0 [ 617.320495][ T1204] usb 3-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 617.388542][ T5884] quatech2 2-1:0.51: device disconnected [ 617.600750][ T31] INFO: task syz.0.909:9574 blocked for more than 143 seconds. [ 617.611660][ T1204] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.621106][T11164] FAT-fs (nbd4): unable to read boot sector [ 617.631000][ T31] Tainted: G L syzkaller #0 [ 617.637509][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 617.646300][ T1204] usb 3-1: Product: syz [ 617.650804][ T1204] usb 3-1: Manufacturer: syz [ 617.655735][ T1204] usb 3-1: SerialNumber: syz [ 617.659939][ T31] task:syz.0.909 state:D stack:28776 pid:9574 tgid:9572 ppid:5802 task_flags:0x400140 flags:0x00080002 [ 617.704047][ T1204] usb 3-1: config 0 descriptor?? [ 617.710189][ T31] Call Trace: [ 617.721237][ T31] [ 617.733749][ T31] __schedule+0xfee/0x60e0 [ 617.746936][ T31] ? __lock_acquire+0x4a5/0x2630 [ 617.748694][ T1204] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 617.921250][ T1204] pctv452e: pctv452e_power_ctrl: 1 [ 617.921250][ T1204] [ 618.073124][ T1204] usb 3-1: selecting invalid altsetting 3 [ 618.088028][ T31] ? __pfx___schedule+0x10/0x10 [ 618.096308][ T31] ? find_held_lock+0x2b/0x80 [ 618.103018][ T31] ? schedule+0x2bf/0x390 [ 618.109393][ T31] schedule+0xdd/0x390 [ 618.113692][ T1204] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 618.113692][ T1204] [ 618.151458][ T1204] dvb-usb: bulk message failed: -22 (5/0) [ 618.153092][ T31] schedule_preempt_disabled+0x13/0x30 [ 618.167678][ T31] __mutex_lock+0xc9a/0x1b90 [ 618.176133][ T31] ? bdev_open+0xa2/0xe40 [ 618.180826][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 618.185933][ T31] ? bd_prepare_to_claim+0x1e0/0x280 [ 618.186895][ T1204] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 618.193319][ T31] ? __pfx_bd_prepare_to_claim+0x10/0x10 [ 618.205080][ T1204] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 618.222964][ T31] ? file_init_path+0x48e/0x670 [ 618.237686][ T1204] usb 3-1: media controller created [ 618.240600][ T31] ? bdev_open+0xa2/0xe40 [ 618.243249][ T1204] dvb-usb: bulk message failed: -22 (8/0) [ 618.249575][ T31] bdev_open+0xa2/0xe40 [ 618.253877][ T1204] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 618.261685][ T31] ? iput+0x3a/0x40 [ 618.265828][ T1204] dvb-usb: MAC address reading failed. [ 618.270822][ T31] bdev_file_open_by_dev+0x179/0x210 [ 618.286063][ T1204] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 618.290630][ T31] setup_bdev_super+0x385/0x730 [ 618.299787][ T31] get_tree_bdev_flags+0x363/0x620 [ 618.306189][ T31] ? __pfx_vfat_fill_super+0x10/0x10 [ 618.320655][ T31] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 618.329752][ T31] ? cap_capable+0x107/0x460 [ 618.340050][ T31] ? bpf_lsm_capable+0x9/0x10 [ 618.347895][ T1204] DVB: Unable to find symbol stb0899_attach() [ 618.349264][ T31] ? security_capable+0x80/0x260 [ 618.354831][ T1204] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 618.370641][ T31] vfs_get_tree+0x92/0x320 [ 618.375165][ T31] path_mount+0x7d0/0x23d0 [ 618.382966][ T31] ? __pfx_path_mount+0x10/0x10 [ 618.392271][ T31] ? lockdep_hardirqs_on+0x78/0x100 [ 618.397508][ T31] ? putname+0xb1/0x110 [ 618.404424][ T31] ? kmem_cache_free+0x124/0x6a0 [ 618.409477][ T31] ? __x64_sys_mount+0x293/0x310 [ 618.417606][ T31] __x64_sys_mount+0x293/0x310 [ 618.420615][ T1204] rc_core: IR keymap rc-tt-1500 not found [ 618.428564][ T1204] Registered IR keymap rc-empty [ 618.433428][ T31] ? __pfx___x64_sys_mount+0x10/0x10 [ 618.433462][ T31] ? kcov_ioctl+0x16a/0x720 [ 618.433492][ T31] do_syscall_64+0x106/0xf80 [ 618.433512][ T31] ? clear_bhb_loop+0x40/0x90 [ 618.433535][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.433553][ T31] RIP: 0033:0x7f83d9f9bf79 [ 618.433567][ T31] RSP: 002b:00007f83dae91028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 618.441573][ T1204] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 618.452846][ T31] RAX: ffffffffffffffda RBX: 00007f83da215fa0 RCX: 00007f83d9f9bf79 [ 618.452866][ T31] RDX: 0000200000000140 RSI: 0000200000000000 RDI: 00002000000000c0 [ 618.452884][ T31] RBP: 00007f83da0327e0 R08: 0000000000000000 R09: 0000000000000000 [ 618.452895][ T31] R10: 0000000000208000 R11: 0000000000000246 R12: 0000000000000000 [ 618.452907][ T31] R13: 00007f83da216038 R14: 00007f83da215fa0 R15: 00007ffffaf50308 [ 618.452934][ T31] [ 618.461795][ T1204] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input26 [ 618.470810][ T31] [ 618.470810][ T31] Showing all locks held in the system: [ 618.553469][ T31] 1 lock held by khungtaskd/31: [ 618.560834][ T31] #0: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 [ 618.572335][ T31] 6 locks held by kworker/0:2/1204: [ 618.577715][ T31] 2 locks held by kworker/u8:8/1310: [ 618.579410][ T1204] dvb-usb: schedule remote query interval to 100 msecs. [ 618.583532][ T31] 2 locks held by getty/5566: [ 618.595357][ T31] #0: ffff888038a6b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 618.622388][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 [ 618.627428][ T1204] pctv452e: pctv452e_power_ctrl: 0 [ 618.627428][ T1204] [ 618.640110][ T31] 6 locks held by kworker/0:6/5911: [ 618.642676][ T1204] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 618.645601][ T31] #0: ffff888020ac4548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 [ 618.660698][ T5911] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 618.675435][ T1204] usb 3-1: USB disconnect, device number 73 [ 618.682949][ T31] #1: ffffc9000462fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 [ 618.696917][ T31] #2: ffff88802ae7d198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 [ 618.716414][ T31] #3: ffff88802ae7a518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x2bd2/0x4af0 [ 618.726924][ T31] #4: ffff88802ac3e768 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2bfb/0x4af0 [ 618.736712][ T31] #5: ffffffff8fbabaf0 (ehci_cf_port_reset_rwsem){.+.+}-{4:4}, at: hub_port_reset+0x1a5/0x1c60 [ 618.747217][ T31] 1 lock held by udevd/5947: [ 618.753071][ T31] #0: ffff888027c09358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 [ 618.762482][ T31] 2 locks held by syz.0.909/9574: [ 618.767594][ T31] #0: ffff888049c860e0 (&type->s_umount_key#71/1){+.+.}-{4:4}, at: alloc_super+0x244/0xd20 [ 618.777938][ T31] #1: ffff888027c09358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xa2/0xe40 [ 618.787264][ T31] 3 locks held by syz.5.1330/11166: [ 618.792546][ T31] #0: ffffffff905f2370 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 [ 618.802008][ T31] #1: ffffffff9060ac68 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7ec/0xab0 [ 618.811209][ T31] #2: ffffffff8e7f50b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 [ 618.821789][ T31] 1 lock held by syz.4.1335/11162: [ 618.826902][ T31] #0: ffffffff8e7f4f80 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6d0 [ 618.837555][ T31] [ 618.839893][ T31] ============================================= [ 618.839893][ T31] [ 618.843763][ T5911] usb 4-1: Using ep0 maxpacket: 32 [ 618.865549][ T5911] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 618.879928][ T31] NMI backtrace for cpu 1 [ 618.879948][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 618.879970][ T31] Tainted: [L]=SOFTLOCKUP [ 618.879976][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 618.879999][ T31] Call Trace: [ 618.880005][ T31] [ 618.880011][ T31] dump_stack_lvl+0x100/0x190 [ 618.880051][ T31] nmi_cpu_backtrace.cold+0x12d/0x151 [ 618.880072][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 618.880104][ T31] nmi_trigger_cpumask_backtrace+0x1d7/0x230 [ 618.880131][ T31] sys_info+0x141/0x190 [ 618.880152][ T31] watchdog+0xd25/0x1050 [ 618.880183][ T31] ? __pfx_watchdog+0x10/0x10 [ 618.880206][ T31] ? __kthread_parkme+0x18c/0x230 [ 618.880234][ T31] ? kthread+0x13a/0x450 [ 618.880248][ T31] ? __pfx_watchdog+0x10/0x10 [ 618.880267][ T31] kthread+0x370/0x450 [ 618.880282][ T31] ? __pfx_kthread+0x10/0x10 [ 618.880300][ T31] ret_from_fork+0x754/0xd80 [ 618.880321][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 618.880341][ T31] ? __switch_to+0x7b4/0x1120 [ 618.880364][ T31] ? __pfx_kthread+0x10/0x10 [ 618.880381][ T31] ret_from_fork_asm+0x1a/0x30 [ 618.880412][ T31] [ 618.880418][ T31] Sending NMI from CPU 1 to CPUs 0: [ 618.893189][ T5911] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.895849][ C0] NMI backtrace for cpu 0 [ 618.895868][ C0] CPU: 0 UID: 0 PID: 5911 Comm: kworker/0:6 Tainted: G L syzkaller #0 PREEMPT(full) [ 618.895893][ C0] Tainted: [L]=SOFTLOCKUP [ 618.895898][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 618.895913][ C0] Workqueue: usb_hub_wq hub_event [ 618.895937][ C0] RIP: 0010:io_serial_out+0x8f/0xb0 [ 618.895957][ C0] Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d c3 cc cc cc cc e8 b1 54 fd fc eb a0 e8 3a 55 fd [ 618.895970][ C0] RSP: 0018:ffffc9000462f200 EFLAGS: 00000002 [ 618.895981][ C0] RAX: 0000000000000020 RBX: 00000000000003f8 RCX: 0000000000000000 [ 618.895989][ C0] RDX: 00000000000003f8 RSI: ffffffff85777fc5 RDI: ffffffff9b48d7c0 [ 618.895998][ C0] RBP: ffffffff9b48d780 R08: 0000000000000001 R09: 000000000000001f [ 618.896007][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 618.896015][ C0] R13: 0000000000000020 R14: 0000000000000010 R15: ffffffff85777f60 [ 618.896023][ C0] FS: 0000000000000000(0000) GS:ffff888124358000(0000) knlGS:0000000000000000 [ 618.896037][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 618.896046][ C0] CR2: 00007f4deaff33ec CR3: 000000007b4df000 CR4: 00000000003526f0 [ 618.896054][ C0] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 618.896061][ C0] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 618.896070][ C0] Call Trace: [ 618.896076][ C0] [ 618.896082][ C0] serial8250_console_write+0xde8/0x1900 [ 618.896111][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 618.896128][ C0] ? lock_acquire+0x1cf/0x380 [ 618.896153][ C0] console_flush_one_record+0x790/0xe50 [ 618.896175][ C0] ? __pfx_console_flush_one_record+0x10/0x10 [ 618.896193][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 618.896211][ C0] console_unlock+0x103/0x260 [ 618.896226][ C0] ? __pfx_console_unlock+0x10/0x10 [ 618.896241][ C0] ? lock_acquire+0x140/0x380 [ 618.896263][ C0] vprintk_emit+0x407/0x6b0 [ 618.896279][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 618.896297][ C0] dev_vprintk_emit+0x394/0x3e0 [ 618.896317][ C0] ? __pfx_dev_vprintk_emit+0x10/0x10 [ 618.896334][ C0] ? usb_get_configuration+0x2502/0x4220 [ 618.896355][ C0] dev_printk_emit+0xd2/0x10d [ 618.896370][ C0] ? __pfx_dev_printk_emit+0x10/0x10 [ 618.896388][ C0] ? trace_rpm_return_int+0x78/0x250 [ 618.896409][ C0] __dev_printk+0xcb/0x100 [ 618.896425][ C0] _dev_info+0xef/0x127 [ 618.896440][ C0] ? __pfx__dev_info+0x10/0x10 [ 618.896454][ C0] ? __pfx_usb_get_configuration+0x10/0x10 [ 618.896471][ C0] ? usb_match_device+0xd5/0x570 [ 618.896487][ C0] ? usb_detect_static_quirks+0x335/0x3e0 [ 618.896511][ C0] usb_new_device.cold+0x3df/0x115c [ 618.896530][ C0] ? do_raw_spin_lock+0x128/0x260 [ 618.896544][ C0] ? __pfx_usb_new_device+0x10/0x10 [ 618.896558][ C0] ? mark_held_locks+0x40/0x70 [ 618.896577][ C0] hub_event+0x314d/0x4af0 [ 618.896600][ C0] ? __pfx_hub_event+0x10/0x10 [ 618.896613][ C0] ? debug_object_deactivate+0x2e4/0x3b0 [ 618.896633][ C0] ? tg_set_bandwidth+0x410/0xcc0 [ 618.896654][ C0] ? rcu_is_watching+0x12/0xc0 [ 618.896671][ C0] process_one_work+0x9d7/0x1920 [ 618.896693][ C0] ? __pfx_process_one_work+0x10/0x10 [ 618.896709][ C0] ? __pfx_hub_event+0x10/0x10 [ 618.896724][ C0] worker_thread+0x5da/0xe40 [ 618.896739][ C0] ? __pfx_worker_thread+0x10/0x10 [ 618.896753][ C0] ? kthread+0x13a/0x450 [ 618.896764][ C0] ? __pfx_worker_thread+0x10/0x10 [ 618.896776][ C0] kthread+0x370/0x450 [ 618.896787][ C0] ? __pfx_kthread+0x10/0x10 [ 618.896798][ C0] ret_from_fork+0x754/0xd80 [ 618.896815][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 618.896831][ C0] ? __switch_to+0x7b4/0x1120 [ 618.896848][ C0] ? __pfx_kthread+0x10/0x10 [ 618.896860][ C0] ret_from_fork_asm+0x1a/0x30 [ 618.896881][ C0] [ 618.902139][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 618.902164][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 618.902187][ T31] Tainted: [L]=SOFTLOCKUP [ 618.902193][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 618.902204][ T31] Call Trace: [ 618.902210][ T31] [ 618.902217][ T31] dump_stack_lvl+0x100/0x190 [ 618.902250][ T31] vpanic+0x552/0x970 [ 618.902268][ T31] ? __pfx_vpanic+0x10/0x10 [ 618.902285][ T31] ? rcu_is_watching+0x12/0xc0 [ 618.902308][ T31] panic+0xd1/0xe0 [ 618.902323][ T31] ? __pfx_panic+0x10/0x10 [ 618.902341][ T31] ? nmi_trigger_cpumask_backtrace+0x1b5/0x230 [ 618.902365][ T31] ? nmi_trigger_cpumask_backtrace+0x1f6/0x230 [ 618.902386][ T31] ? nmi_trigger_cpumask_backtrace+0x200/0x230 [ 618.902406][ T31] ? watchdog.cold+0x198/0x1ca [ 618.902423][ T31] ? watchdog+0xd35/0x1050 [ 618.902444][ T31] watchdog.cold+0x1a9/0x1ca [ 618.902468][ T31] ? __pfx_watchdog+0x10/0x10 [ 618.902488][ T31] ? __kthread_parkme+0x18c/0x230 [ 618.902512][ T31] ? kthread+0x13a/0x450 [ 618.902525][ T31] ? __pfx_watchdog+0x10/0x10 [ 618.902543][ T31] kthread+0x370/0x450 [ 618.902556][ T31] ? __pfx_kthread+0x10/0x10 [ 618.902571][ T31] ret_from_fork+0x754/0xd80 [ 618.902595][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 618.902612][ T31] ? __switch_to+0x7b4/0x1120 [ 618.902631][ T31] ? __pfx_kthread+0x10/0x10 [ 618.902646][ T31] ret_from_fork_asm+0x1a/0x30 [ 618.902675][ T31] [ 618.911385][ T31] Kernel Offset: disabled