last executing test programs: 25m44.898256382s ago: executing program 0 (id=739): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x3) accept4$bt_l2cap(r0, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) r1 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$FS_IOC_GETFSUUID(r1, 0x80111500, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, &(0x7f0000000380)=0x19) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_buf(r2, 0x29, 0x20, &(0x7f0000000080)="487df20acd6fd948", 0x8) io_uring_enter(0xffffffffffffffff, 0x26c8, 0x0, 0x1, 0x0, 0x10) ioctl$UI_DEV_DESTROY(r1, 0x5502) 25m44.418398415s ago: executing program 0 (id=742): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$sg(&(0x7f00000000c0), 0x2, 0x204402) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) socketpair(0x18, 0x0, 0x2, &(0x7f0000000000)) r3 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f000000b000/0x4000)=nil, 0x4000, 0x1, 0x12, r3, 0x1000) readlinkat(r3, 0x0, &(0x7f00000001c0)=""/5, 0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000a80)={0xffffffffffffffff, &(0x7f0000000700), 0x0}, 0x20) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006900000000000001000000940000000fad413e850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB, @ANYRES16, @ANYBLOB, @ANYBLOB], 0x1c}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000200001032abd7000ffdbdf250a000000000000080000"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f1, &(0x7f00000003c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x0, 0x2, 0x6, {0x3, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101, 0x0, 0x5}, {0x0, @empty, 0x6, 0x5, [0x6, 0x9]}, 0xff, 0x3}}}) 25m42.839696986s ago: executing program 0 (id=746): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x7, 0x38011, r0, 0x0) dup(r0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000380)=[@wr_crn={0x46, 0x20, {0x4, 0x1}}], 0x20}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIN_LINKS={0x8, 0x12, 0x2}]}}}]}, 0x3c}}, 0x4000000) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x540, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/tty/drivers\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000000640)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) openat$sysfs(0xffffffffffffff9c, 0x0, 0x31d043, 0x43) fcntl$lock(r4, 0x24, &(0x7f0000000000)={0x0, 0x1, 0x7fffffffffffffff, 0x9, r5}) r6 = fsopen(&(0x7f0000000040)='anon_inodefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0xf) fsconfig$FSCONFIG_CMD_RECONFIGURE(r6, 0x7, 0x0, 0x0, 0x0) openat$cgroup_ro(r7, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) process_vm_readv(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(0xffffffffffffffff, 0x80089419, 0x0) 25m38.975737246s ago: executing program 0 (id=753): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ioctl$COMEDI_INSNLIST(0xffffffffffffffff, 0x8010640b, &(0x7f000011d340)={0xfffffffffffffe27, &(0x7f000011d200)=[{0x8000001, 0x0, 0x0, 0x1, 0x7}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r3, &(0x7f0000000180), 0x400008a, 0x0) r4 = socket$kcm(0x2, 0x200000000000001, 0x106) prlimit64(0x0, 0x7, &(0x7f0000000040)={0x2, 0x7}, 0x0) sendmsg$inet(r4, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30000091) setsockopt$sock_attach_bpf(r4, 0x6, 0xd, &(0x7f0000000000), 0x4) 25m36.554128846s ago: executing program 0 (id=756): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x19, &(0x7f0000000540)=ANY=[@ANYRESDEC=r0, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000bb000000b70200000800000018230000", @ANYRES32=r0, @ANYRES8=r0], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r2, 0x18000000000002a0, 0xe, 0xffffff5e, &(0x7f0000000600)="763894147583ddd056fea56a8800f8ea60b8030847e64e6bc8302bac38fb3172cf738a6612a826b7446be6e1a40c4a7c765f156cf282c2b26fd43b944eaf4aff12d09d5da4b7248158d3e398a467d11fee69d196508a76eb30844c2572c0311d760c5cb32c1fcc2447bdd9c3030041b52b79954ac36d27a55672c7c81228d86852dc6e2dca125c54da593e0ad7f739f2968c01582beed67edfb34ff2372cd5540b84236c024470aeafb3001700"/184, 0x0, 0xe00, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x19) r3 = socket(0xa, 0x5, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) readv(r4, &(0x7f0000000500)=[{&(0x7f0000001300)=""/244, 0xf4}], 0x1) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000001200)={0x0, 0xffffff1e, 0xffffffff, 0x4, 0x16, "001bf100eeff0000a2c2000100000000002000"}) r5 = syz_open_pts(r4, 0x101) r6 = dup3(r5, r4, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x161281, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, &(0x7f0000000000)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r9, 0x40182103, &(0x7f0000000080)={r10, 0x1, r9, 0x4}) mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r7}}) unshare(0x949b7465cae2661b) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) pselect6(0x40, &(0x7f0000000140)={0x1, 0x4, 0x3, 0xff, 0x4, 0xea2b, 0x7, 0x2300000000000}, 0x0, &(0x7f00000001c0)={0x9, 0xbb18, 0x2, 0xc, 0x0, 0x4f, 0x0, 0x4}, 0x0, 0x0) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000280)="5c00000013006bec9e3be35c6e17aa31076b876c1d0000007ea60864160af3653c000cc004000202080003000300000007002100eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000200ffffc6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xd) write$UHID_INPUT(r6, &(0x7f0000002440)={0xa, {"08c39ee52f329f1698b1c4865f8b540a5eee9f496a0809c3d20325867b6edda88489ab4c09fe0a7f1e8640aa8e344f412df0d69475a5d6570e21f31fac7dfb4aa7ade0e851582d5c1abdd809580cb34c9e48576b1c73ed76023256fca058ada3db47d86cc75b33cf762b67fe61f152618c49a40858f68794a4fc484ab73ccd254ba3d147f5feddaf91dacc238c0a8096f79597ca1e6da781fcf37a0141a335c6a7577d2d53c6e552a7be208381bb31d1d3e0e92ea651655217535734b286d3f19780a4c720075a36a734151f8c00e651cb3a6bbe30e3f6aee48750436da6471e965e81f38134674fcb697108fb7345010bb8fa15fba9b33355d7858327171ab9c68f6c21b2ffbff4eb061dab80bc77a4a7769e7ff73bcd98790e09415bfc5978cf5af45c3ec9ef9c1a39f766c59d59590281038dbcb765580ba2b3f141d5bbfc40910a0894cd1f22d2a8b6d4e4778debef99438b54d44b4b7568de2777431a5b2f3e8d1a45a60a468f5e33e8ef534f803dfb6798c270f52edf031ecd996bb78c4e92961c63c079676d77412ebc6074e5f235417785e7a14b14ce7626b015071c154cc2bf8f4499b93293e9997c23df4c7a1498cf12414fb31eb873728e4f613b540d22e7ca718f18da5b82ed24995e4309c3af4a2e1097465bf09728082d09e71ea365522035eb9772b8e072f8454777ee304dacd59d3eb9f933f151fa14f8c38eadbeba04810a2dea7a66824f09235c13a45f07870210d0d310ce3ae6284577bd4e65f32700f6723727926cb52e4f27776a1dab0f6668327ab5cf1893879a635261f2e0d9923ccecbf5b80f10a8275c1515f47930d614e787f14c105d3a4f8faf8e7f738cf4eae4fc39ef3db3cb87794ace87f7239b69dc4ab4e5ae57cdfbd309e847d99600ef14b51faead01e8ade57d24270bc13a1787896096eeacb8ab1c93d31d93cfb244bb09ecfecf336362a5656db7df327cbb9aeb898f8af229c7bb9452805f2b4510c5df86b6d564e01f000000167ade5205331523a6392af2bea9e6db0ba5480cbf1b202714233289c4017cb66e83c0c8b6e88bedb922162d0ceecf6c5da173bbefe6781ab7720d2be6cca378db650c69d4228141ae190922fbbaddb86c7f0fe138b704e8305b3bcc7910b2280d96d71dafdbfa876b0013fc4de586f85d9ee077b6349becbdca8bd989a51c4c76ed8a8cc691a65078e0272a62edec8236a779f0cbffeda49dcdccd4def7064e0d77ae5a8c64f3057b4a3a0d4457d33f2bc6c112378315411baa4bb126fe540d750491fc58fbb66911ef82bce5ed76872dbcd8e05dea2f3f347a653aa39ab5d75e71671bfeb924e71476134dbf91e3f287fd853cc34bf81e717edd41aa04b6fbeb43cf2074f0c8fe5350401b6cff801c147a3b58b972aa5652629a9fd8b1df2852708ce958d4e9974ec4383aa5da4e3f75fdc85981e97b75863546f67a8703673b6fe2c26f0e9eeb8c45c26f673adac55fa5d69b82ae7d032fd3b26866047e8c029b90a62794a89c11398944b398b4177b2dcc5a743c16d4a5333b1e30af678d3db8df849c1753db067a6f94bab00c0dd3c7e94a8675924c89bda98ac09e10bcdf83f5114b9b466c413477a5cdc48c857230798934bcc1f0eb3a2d2944b139e459af32e515785f46ed4e97cdcb23c7e4dc7c4f91b5b5ca5228344aeb6652fffaf31325c7429bc70a5f6beaaa98ef190dffdeccc94bd814b3edfdd48243bf34291076ab5438ee00e924a827d5b453df42d24144fe1a45bb6c84fcbb2143d0a561c1e867c1279bdf0a47061ea77a84f36c720aff785f0db10eda84c767b5f3874f9455c0f026735ded32f0403ef7dbcf97d2233d59c670114ddf89314ba74fc248bcbdbf43c24e46304e229b3cf583aa410f4dfd119152495da8737518ee2a05a8ca1f004be3c551408f2e4013e444b63bf2bb26ddeae505642dffcc989ee241c48741181b506e22fdc4530319522780c74bf786852dc66ebbb51f8ecbb1e35de09ef7afe589bb8a31c5d63477db5d5e7174694ea04cfa98057d39127a4e5eedb4897a491c6693acd0a036abf846f3b6f3006e5e5fd586f29a4a8a31abbccf732e4f1b88187a72d669c16302657e9cbbeb9322662e111edc7771526400b6123d0f8207bcaa38bee07043e36e223d418ac948d65e7acfe72cc3fdcf03a3e43ecfec8ae489ddba09126709c5c7968829e3504de8a5010c9372de09476a7b96b04d7aed2486d8f89f21f075321abe350024abe00a81f87df3dc372fc3206496776c26b6958243070bda4cace3e358da5d39a3945765c2ba4b002b06efd416af66f3343f218ed84550ea83f02f9a5c3fc677ea60987aa25f0406d6154081cfdc074814a2465accdfa102858f5a52c9eae293c56ddcaf8f6926d3dd0ccb51a30c960d6b7e473038ebd3702b5106f6bc040efdfd7169fd3f2dc42ff23de26a239e13b74278729fd7e843b38a35c55fd50181ac13a9cbbbfd8feb36afaeb1993349c0ac5a0c44ffd92919dfe272b0f8ed7df7198cd299715f021109a58dced4753d3c7ddd6e9ea01596f18b2fe7000000004ccfca57aed5b5cebdff65de480a56bd53f4c7f83ddef00d7c9686311d1fce76f320bb3222a11db30ba6ed31535d8fda61e694478ca9935d72719b8d6b9be88ae3df30b60ee251b919b4d1734b994c62accdf855488b351738331b462eccf27efdc5577d7a5548579dc90d227a42ac010f33a720dc3cf0a63454f8b07c775287495761a058ec1e28e6aaf8057241f4ef8b5de56e279355bb66630c4ddf35e7c2cfff26a4241b1df0379d2a1e9f959e46d3843f89844ead50aff44640fcbc4a1edb033afff7cc9e57c4f8d31900764233e11fa4c28e547788c1b00de4268df692ba3415a9ad90fa712f9618f5ecff57da32809380eeff040cd3b23f508614c72b303cec3bcd732708303b166193366a062b9cea536f28478c387e626744c6a611a8e7162d274efccc84eee8eb31d3310c86752777dd5b5ffe234e895c54909f19a4aabcf3c15b90c02170409e314fd90e766ec4ba93c8ec6321237a980ad3c32fb2fab69e57541ea7f5427a85c2c57d40f9ebe9de5572f46a4713fb28e0af42d0adef3e29195aa41a3ba318181512eebfadffede4e35ff7f975928edc5d4d9f2d931fb44b30e1df55e66c52e1648e9cdaf71221b57c6a6b087428ccc57ade5b1531341cba2be452b426c434c70fd8c493337d4995cbd76ea1dd545226e3eb59d5f94ffb5352f87a4a66cd7c5e88322404fd397c46e198646a9c819d0eb1f10e54d8a3ea912f1cb134ff1095aa7325287f6ea9af8c13b67d6abcbb70dbc06838ecb33e45b60f6cb832c3e72d1401770f66bd02f35a2d007815ab676099e31f5102000000c0e83d5e7107c8dc5830c9cddb9781185b94d7f2814c5058ba3ac54c268741c5728f4997a9628602c2a36090162379f3f37c47619b3e7c7397a5913b7060b51e0c7f7226ff1135444f866f89a4b74136cbd3acb7178bd63183b3fd9cd19fdeb6fcc6341910ad4605da76a9af4bfb8b75fcd666f8188902b380ae560d9aa04f8f9b0ac5c109d1824a470726e06a49d955f8f71c8a86081e75b13f62600deb941da181eaff544cd559c467d8dae432debd22e7a7b3e1ad731a5b9470f5f60423dda061ff899c07c79f3da34f38e1d8182d6ee0c36c6029455091676c214569a8a8a759b20e41638fd57152029b190b5701d30a86f579e2d0cc53a2f809ca9bd3aba1eb2772a7acc35c4d983afa83a9baea35c0ed4931234719636cf8f5fe1884bde6cebbdf23bd62b1ebf0a5cb78c27295349bd7d5cf28c4ee4689497238fd3aa71a417914e6892667a56bd69dc2e5882cfb67df71494e9a9199e025892e4e7435f727636cd988cc7563d28db5133f649849c5b3973a3428de10ad39d96146b22acc50f50eee5a038876452b960686892de40efe30081ccdaa2bf64af78d5988026e529b36c62a21378ac42d220d0dd878010178e374e6dbb2b61206066d040700ed03c6fd9a4e00547fe9304aec0925d85a0acd07fdc5d48c1a1cff656916f5d25952327792255e0d606a32517781cc3d737ec753eb95b5b5b95dabd8946907ab54cc85d05b475e2e5486c6fc070417198d3a50910e2949d20d3fa68fd327934cff5171224942b8f18d88947763a7c710d09c4b269bdf2d3e99b755ba8fc04deabf4bc4bcffc4d62d491538c65078122bf2c263ae0020af67cfc9cf19e5b929e086af281fb43d5504d728935c5cfac136eb81703d50fddb39a5a713b2914c6acd9b2d07819cf7bba495ac5734fe423e611d309b80eeafcf9053d51b0ab3c29d5ca5eb8861ffc1ebc4d53f361b8991baecb52860c15202f979e34054fcde869d018103ccd6d914a70f1840fc6aaf426beec975ddb980b19b0f4cc2ca393c0b9e6ebe5e7d1c9fc1ef7a1c91378f0b73262993fb80667ecf62bac3c47cbd002ae1b87b8dc3ec99d5c987765d778868eb55022cc3bed14b8f934a584bcc98fa0b4f6e6982ab8d8a2bb49f9074ef429dd7b8db332a96ccec6983a97be7c8634c02e7937ffc8d613b83aa375886bf40a87ec062090382f874bf2c8e5fbb58ac18a46c4d9e85af3ca21bdacb7755f49776b0eb3972ff682c84beb07d74cbe2764e378253e72128991b73d2730704a5448280e8a0fd8cc87d4cddcffbfe5525ae3d2304877a3988e33c8e12bf77793e753f25840e9af2ce56bdb999fc62623a2298b4244534f662eb398a2577c72f6cfd5174697dcee151d4f3a7293b11de3889c43744da4165aca4e4a1e926d37ae4d7471584a06f3641f2037a74a58c2397a594f29d142d59f91bb57e24e1a3f30f68c626033cc34895c1b16d62e3a375c3e09f5dbd9338cd3a500643143cd404b57019c648c3ec31d696233fe16efc3c4c84aca0830ca8b9fbf1144b98d82f41e4cf67631c74cdcf8d9c8b8556b876ff1592683ccac0b47a26cb3a2cb1b917f433bb54e0b53deae9ac4b1cd0594c1fa0e6744e7ed88fdac60901e3da989f3b0d7c12b140cc576fa1b0e8e705321d37c303691aafc9fed9c3dc419078d0925ead56455ea5f3cd57941e410c1c14c2e8972d7cca44fcaca1f64fc817f4a41b6d9fb237fed159cb09e788ae560726537f49cb64b9f60915d402e0931355c55ad792cde758548b1af54b196e414046d4af3579a6c30ceac3d68bbfd2adef309c064e759a9f0dd69d682a3880b8ff27b69abffaa45ee7e65d8f1f6e40c188f6249fdf72220b4c87243217ba0292b9e9b67ebeda4fb83406216a4d765812bafeff34cc57f7d2cd1608282079c076055b9cabffe5fa491b970291bc2672540ccc15ed877d7dbe3ef683724c715ace770905e48c2dc6a44e1fc095773676d070eac00ee3834b07590cba7093f56b678313870471c81599d34c53fc03ec6c913d8ba3f604ace8da12d2025cbb5000bc062f4db65a6feacaf3915206d1c15ce7e78c17dc2ea32cb57d6fab0a22d487c77118e75016006f812541ec8180a321287a2d57248d4ee4a19706a19d802c70e250c3b0fc400a0b5cdc06537d2f55fd5300be4eeeaab8cc481a84b6a5e17d8c47ec92fe40710d4ec3530a94ca16710ade2ec7562398106e0ddbb6c8af6412166afd99d45d29a3a967e58decd0d6fc5bebb98d639b5606efd358a43d635d50f0ccb8472197da604994e7fb700243d5f7e45700", 0xe24}}, 0xffffff5c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2, 0x4e24, @empty}], 0x10) sendmmsg$inet_sctp(r3, &(0x7f0000003440)=[{&(0x7f0000000040)=@in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000003580)=[{&(0x7f0000000300)="85", 0x1}], 0x1, 0x0, 0x0, 0x1}], 0x1, 0x40) recvmsg(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40000000) 25m33.905264038s ago: executing program 0 (id=760): syz_emit_ethernet(0x3e, &(0x7f0000000240)=ANY=[@ANYBLOB="aa"], 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000000040)={0x0, "d4aa55a2851d891f14d7730ad980210f3c0d2ec5700ff0cd90d3cda056809c13b0ec5c08ce4974ca4666516f251459a32599646625e40aae2811eaa5eebd026c284494802e05d411252d7c6d475d91992d7dd7ad0561d4a7b3d547fc6c6d287b44d8f21976083a70a036f09d07462deb1532f0da46c652e64f2589b17ca66fa444ab35deb801bb9a6099cca1a782953cbafb42b95a7f8c815e38bbe376f8a4ce4f8ed2b7ee56d036d7360bccac353d04b08a97de58862672f3d05223cba789b52dffc0ebc3fff6534ac9e1e5fe3768bf18672ad48ef870ba1c8ccf6c1dc612e396d7c15ad90910ec0bce37f100c7b944ac2c71ef81836a62af4a762f9d9614c3503887207c5fe6f4a3b1075ec5f6e6e13804e0554efdf7a2ac62774870d8f8d13c7a514164a8d189ab17ae0a8055a66a4dcf661633c632873300de543d26a62c841e82d37e697258d733f699cfea0ad39ce3cc20241ca464a2ba7accf74ba3230451882d67d6bdd52d00f567793a00bca63e25fe4f4283f0fa8512eea9f70c555776f6ba88db5f966f8508df5c5fbb2b6e67d33cb92ca4f94d6331e262537395a0b8fe4bddd909126960e15b94c25a0fd815068fb9d5add15b2502137f5880667febf9a82c2a6c5409a0e993b404fe10287884192053cd2c01e10071aa77e87e7d2617f64b30f42982ef81b40352bf6f9cd6c456b3095e9be0360a7be4f0870e"}) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="ea3d8100", 0x4, 0xb01, &(0x7f0000000080)={0x11, 0x8100}, 0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000940)) socket$inet(0x10, 0x3, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0xffffffff9673e35d]}}) 25m18.77906579s ago: executing program 32 (id=760): syz_emit_ethernet(0x3e, &(0x7f0000000240)=ANY=[@ANYBLOB="aa"], 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000000040)={0x0, "d4aa55a2851d891f14d7730ad980210f3c0d2ec5700ff0cd90d3cda056809c13b0ec5c08ce4974ca4666516f251459a32599646625e40aae2811eaa5eebd026c284494802e05d411252d7c6d475d91992d7dd7ad0561d4a7b3d547fc6c6d287b44d8f21976083a70a036f09d07462deb1532f0da46c652e64f2589b17ca66fa444ab35deb801bb9a6099cca1a782953cbafb42b95a7f8c815e38bbe376f8a4ce4f8ed2b7ee56d036d7360bccac353d04b08a97de58862672f3d05223cba789b52dffc0ebc3fff6534ac9e1e5fe3768bf18672ad48ef870ba1c8ccf6c1dc612e396d7c15ad90910ec0bce37f100c7b944ac2c71ef81836a62af4a762f9d9614c3503887207c5fe6f4a3b1075ec5f6e6e13804e0554efdf7a2ac62774870d8f8d13c7a514164a8d189ab17ae0a8055a66a4dcf661633c632873300de543d26a62c841e82d37e697258d733f699cfea0ad39ce3cc20241ca464a2ba7accf74ba3230451882d67d6bdd52d00f567793a00bca63e25fe4f4283f0fa8512eea9f70c555776f6ba88db5f966f8508df5c5fbb2b6e67d33cb92ca4f94d6331e262537395a0b8fe4bddd909126960e15b94c25a0fd815068fb9d5add15b2502137f5880667febf9a82c2a6c5409a0e993b404fe10287884192053cd2c01e10071aa77e87e7d2617f64b30f42982ef81b40352bf6f9cd6c456b3095e9be0360a7be4f0870e"}) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="ea3d8100", 0x4, 0xb01, &(0x7f0000000080)={0x11, 0x8100}, 0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000940)) socket$inet(0x10, 0x3, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0xffffffff9673e35d]}}) 10m49.261715294s ago: executing program 3 (id=3450): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r0, &(0x7f0000000980)=ANY=[@ANYBLOB="7f454c4600000006010000000000000003003e000000000003000000000000004000000000000000980100000000000002000000000038000200000002000000000000600300000008000000000000000d00000000000000ed08000000000000f0ffffffffffffff0000000000000000080000000000000003"], 0x5b0) r1 = syz_open_dev$vbi(&(0x7f0000002100), 0x1, 0x2) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000000)={0x3, 0x5, 0x1, 0x0, 0x2}) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000040)={0x5, @pix_mp={0x8, 0x4000000, 0x55595659, 0x0, 0x3, [{0x1, 0x7}, {0x6}, {0x2, 0x6}, {0x4, 0x7fff}, {0xffffff80, 0x9}, {0x2, 0x100003}, {0x6, 0xfff}, {0x9, 0x3ff}], 0xca, 0x1, 0x6, 0x3}}) close(r0) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f0000000840)={{0x12, 0x1, 0x110, 0xbb, 0xe0, 0x3e, 0x10, 0x41e, 0x3f19, 0x3f7c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xa, 0x0, 0x0, 0x40, [{{0x9, 0x4, 0x1d, 0x0, 0x1, 0xff, 0xa1, 0x1c, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x101, 0x4}}], [{{0x9, 0x5, 0x7, 0x517627915b247a24, 0x8, 0x3, 0x5, 0x1}}]}}]}}]}}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) (async) write$binfmt_elf64(r0, &(0x7f0000000980)=ANY=[@ANYBLOB="7f454c4600000006010000000000000003003e000000000003000000000000004000000000000000980100000000000002000000000038000200000002000000000000600300000008000000000000000d00000000000000ed08000000000000f0ffffffffffffff0000000000000000080000000000000003"], 0x5b0) (async) syz_open_dev$vbi(&(0x7f0000002100), 0x1, 0x2) (async) ioctl$VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f0000000000)={0x3, 0x5, 0x1, 0x0, 0x2}) (async) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000040)={0x5, @pix_mp={0x8, 0x4000000, 0x55595659, 0x0, 0x3, [{0x1, 0x7}, {0x6}, {0x2, 0x6}, {0x4, 0x7fff}, {0xffffff80, 0x9}, {0x2, 0x100003}, {0x6, 0xfff}, {0x9, 0x3ff}], 0xca, 0x1, 0x6, 0x3}}) (async) close(r0) (async) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) (async) syz_usb_connect(0x3, 0x36, &(0x7f0000000840)={{0x12, 0x1, 0x110, 0xbb, 0xe0, 0x3e, 0x10, 0x41e, 0x3f19, 0x3f7c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xa, 0x0, 0x0, 0x40, [{{0x9, 0x4, 0x1d, 0x0, 0x1, 0xff, 0xa1, 0x1c, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x101, 0x4}}], [{{0x9, 0x5, 0x7, 0x517627915b247a24, 0x8, 0x3, 0x5, 0x1}}]}}]}}]}}, 0x0) (async) 10m47.53716313s ago: executing program 3 (id=3456): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, &(0x7f0000000440)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x1ff, 0xe, 0x7fffffff, 0xa7, 0x2, 0x2, 0xb3, 0xfffffffc, 0x5, 0x1ff, 0xfff5, 0x1}}, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r1}, &(0x7f0000000280), &(0x7f0000000300)=r2}, 0x20) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = socket(0xa, 0x1, 0x0) ioctl(r4, 0x8916, &(0x7f0000000000)) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_int(r5, 0x0, 0x13, &(0x7f0000000200)=0x1, 0x4) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000000)=0x4) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000001440)=""/4106, 0x100a}], 0x1, 0x300, 0x0) ioctl$FS_IOC_GETVERSION(r3, 0xc0145b0d, &(0x7f0000000040)) 10m44.890560353s ago: executing program 3 (id=3472): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) socket$nl_route(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0xc3ac}, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, 0x0, {0x7, 0x1f, 0xdfffffff, 0x5e490420, 0x2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}, 0x50) syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x800000000003731, {0x0, 0x7f69ff17f1e1ab77}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, 0x0) 10m43.831062142s ago: executing program 3 (id=3474): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x61, 0x10, 0x28, 0x2}, [@ldst={0x4, 0x2, 0x6, 0x0, 0x0, 0x2, 0x10}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000040)=""/96) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='freezer.self_freezing\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000600)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67100000000000560602000fff00006706000020000000170200000ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffbd35010000000000840400000000000014000000100000009500000000000000db13d5d8b741f2cdaabc8383c8f56b8c2b848b00ea6553f304000000815dcf00c3ee7b042d1937ba52037fdedb2150e1918c30b6301f0212feb0cff9fc67357d81b2cc1a9e37d7b75c020b070000003eb22062bafaca036d9ec7db6671573e202e0a92ee4ba12b064981cc32d1ac0b9ecc8f604dca20563e1c1e7624cc3b88b330ad416c4c1d8c60589b6445a4ffff50df4d34bc5847bebb943a84cb56956931ba9cc39c4a9deea5d77aa843240000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) write$binfmt_script(r1, &(0x7f0000000100), 0x208e24b) (async) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0], 0x2}) 10m42.945008341s ago: executing program 3 (id=3476): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) (async) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') (async) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/key-users\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0x8ffb) r2 = openat(r0, &(0x7f0000000100)='./file0\x00', 0x60000, 0x120) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) (async) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x0, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r3, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x1}}, './file0\x00'}) 10m42.585240524s ago: executing program 3 (id=3479): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000400)=[{0x6, 0x1, 0x2, 0x7fff7ffc}]}) syz_init_net_socket$ax25(0x3, 0x2, 0xc3) socket$netlink(0x10, 0x3, 0xf) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) r2 = epoll_create1(0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) migrate_pages(0x0, 0x9, &(0x7f0000000040)=0x9, &(0x7f0000000380)=0x102) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f00004d6000/0x4000)=nil, 0x4000, 0x4000, 0x2, &(0x7f00001e2000/0x4000)=nil) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, 0x0, &(0x7f0000000100)={0x80000001, 0x8000001, [0x997, 0x8bf, 0xe4b, 0xc70]}) munlockall() r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r5, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) dup(r2) socket$inet(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x14}}, 0x84) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYRES8, @ANYBLOB="0000000000000000140012800b0001006d6163736563000004000280"], 0x48}}, 0x8800) recvmmsg(r6, &(0x7f0000003080)=[{{&(0x7f0000000440)=@pptp={0x18, 0x2, {0x0, @broadcast}}, 0x0, &(0x7f0000000600)=[{&(0x7f00000004c0)=""/215}, {&(0x7f00000005c0)=""/5}], 0x0, &(0x7f0000000700)=""/215}, 0x8}, {{&(0x7f0000000640)=@in6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @local}}, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000800)=""/170}, {&(0x7f00000008c0)=""/188}, {&(0x7f0000000980)=""/212}, {&(0x7f0000000a80)=""/215}, {&(0x7f0000000b80)=""/4096}], 0x0, &(0x7f0000001c00)=""/4096}, 0x7ff}, {{&(0x7f0000002c00)=@l2tp6={0xa, 0x0, 0x0, @loopback}, 0x0, &(0x7f0000003000)=[{&(0x7f0000002c80)=""/98}, {&(0x7f0000002d00)=""/117}, {&(0x7f0000002d80)=""/8}, {&(0x7f0000002dc0)=""/21}, {&(0x7f0000002e00)=""/65}, {&(0x7f0000002e80)=""/102}, {&(0x7f0000002f00)=""/241}]}, 0x1}], 0x40003a1, 0x10000, 0x0) r8 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x6fa7264d) ioctl$KDFONTOP_SET(r8, 0x4b72, &(0x7f0000000000)={0x4, 0x0, 0xa, 0x15, 0x124, &(0x7f0000000040)="387ed7626d850509a2d6c1aa38f15cd0c263cb226db671261fff7ce9c555f18dafae3530db6dd493f2a3cc88731b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef494c89092883b902a41cd75387ef6f7bc7d461d5e665f398ff95596dc94ec97003c7e6f3c82fbd8de6e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd80800000038a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1aed6e850ecb3421143c5c4ded0f06affc524dcf3208272619b6a952db5bc96141b26c54d13c7a5416287a3b6f7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3c7520b285d8ddbf5e20d604413ed2ddf9bcbf881caf811852806175d638909f6234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa0284abe90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695efbd649f42f310859122c0d2c1e558dc6586958a283762386ecf369274e43003a0fdff59ea515eb44504901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90000c4bd2a3d6bc5092548feaef7204a12cece59181fcb5bad8c24bd9f8f78d17ab82831325501e80d899e9252f99d3a266639438ac5252d9bccff4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd333b30d3ce2f50dddeea3447aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b68986af3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9000400002f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d01000100df6f40a80ace2bb8a2aad3b0c66915927db4233181943d88c0c76d5969e2043db5bd77fd600000013139929ccfec965c0c769785a4d23332ba1f0875e3146afef5b20cc306d3ecee65944fe9829ed0c3f6bb2fd81bc31152538db50f47dc38ba908a0d808687e478a609fe0daa02d4e9c618b99266e7f2e98597e2813e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d472dd0e1338688ba782b41bde141f99c4894ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e87dde71929f918b98c4cbfcb11a9013923167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d2195ff9c6320c85bddc42915e4f3a5db642447bc2195a3d64e04c9ecd1c313808e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e0e32b75ce814731c542091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00"}) 10m27.115423708s ago: executing program 33 (id=3479): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000400)=[{0x6, 0x1, 0x2, 0x7fff7ffc}]}) syz_init_net_socket$ax25(0x3, 0x2, 0xc3) socket$netlink(0x10, 0x3, 0xf) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) r2 = epoll_create1(0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) migrate_pages(0x0, 0x9, &(0x7f0000000040)=0x9, &(0x7f0000000380)=0x102) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mremap(&(0x7f00004d6000/0x4000)=nil, 0x4000, 0x4000, 0x2, &(0x7f00001e2000/0x4000)=nil) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, 0x0, &(0x7f0000000100)={0x80000001, 0x8000001, [0x997, 0x8bf, 0xe4b, 0xc70]}) munlockall() r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r5, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) dup(r2) socket$inet(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x14}}, 0x84) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYRES8, @ANYBLOB="0000000000000000140012800b0001006d6163736563000004000280"], 0x48}}, 0x8800) recvmmsg(r6, &(0x7f0000003080)=[{{&(0x7f0000000440)=@pptp={0x18, 0x2, {0x0, @broadcast}}, 0x0, &(0x7f0000000600)=[{&(0x7f00000004c0)=""/215}, {&(0x7f00000005c0)=""/5}], 0x0, &(0x7f0000000700)=""/215}, 0x8}, {{&(0x7f0000000640)=@in6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @local}}, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000800)=""/170}, {&(0x7f00000008c0)=""/188}, {&(0x7f0000000980)=""/212}, {&(0x7f0000000a80)=""/215}, {&(0x7f0000000b80)=""/4096}], 0x0, &(0x7f0000001c00)=""/4096}, 0x7ff}, {{&(0x7f0000002c00)=@l2tp6={0xa, 0x0, 0x0, @loopback}, 0x0, &(0x7f0000003000)=[{&(0x7f0000002c80)=""/98}, {&(0x7f0000002d00)=""/117}, {&(0x7f0000002d80)=""/8}, {&(0x7f0000002dc0)=""/21}, {&(0x7f0000002e00)=""/65}, {&(0x7f0000002e80)=""/102}, {&(0x7f0000002f00)=""/241}]}, 0x1}], 0x40003a1, 0x10000, 0x0) r8 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x6fa7264d) ioctl$KDFONTOP_SET(r8, 0x4b72, &(0x7f0000000000)={0x4, 0x0, 0xa, 0x15, 0x124, &(0x7f0000000040)="387ed7626d850509a2d6c1aa38f15cd0c263cb226db671261fff7ce9c555f18dafae3530db6dd493f2a3cc88731b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef494c89092883b902a41cd75387ef6f7bc7d461d5e665f398ff95596dc94ec97003c7e6f3c82fbd8de6e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd80800000038a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1aed6e850ecb3421143c5c4ded0f06affc524dcf3208272619b6a952db5bc96141b26c54d13c7a5416287a3b6f7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3c7520b285d8ddbf5e20d604413ed2ddf9bcbf881caf811852806175d638909f6234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa0284abe90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695efbd649f42f310859122c0d2c1e558dc6586958a283762386ecf369274e43003a0fdff59ea515eb44504901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90000c4bd2a3d6bc5092548feaef7204a12cece59181fcb5bad8c24bd9f8f78d17ab82831325501e80d899e9252f99d3a266639438ac5252d9bccff4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd333b30d3ce2f50dddeea3447aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b68986af3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9000400002f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d01000100df6f40a80ace2bb8a2aad3b0c66915927db4233181943d88c0c76d5969e2043db5bd77fd600000013139929ccfec965c0c769785a4d23332ba1f0875e3146afef5b20cc306d3ecee65944fe9829ed0c3f6bb2fd81bc31152538db50f47dc38ba908a0d808687e478a609fe0daa02d4e9c618b99266e7f2e98597e2813e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d472dd0e1338688ba782b41bde141f99c4894ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e87dde71929f918b98c4cbfcb11a9013923167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d2195ff9c6320c85bddc42915e4f3a5db642447bc2195a3d64e04c9ecd1c313808e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e0e32b75ce814731c542091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00"}) 27.612827344s ago: executing program 2 (id=5589): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES8=r1], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000800000000000000", @ANYRES32=r2, @ANYBLOB="0400001100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB], 0xc0) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000003c0)=@newtaction={0xac, 0x30, 0x9, 0x0, 0x0, {}, [{0x98, 0x1, [@m_mirred={0x94, 0xf, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0xe, 0xffffffffffffffff, 0x6, 0x4}, 0x2}}]}, {0x45, 0x6, "7c760a973353e92343840ede6b5645b6ee0a84cbc8890a90412a8c039dc6967d0fc5822a94752cda57aeb6453f7c41fd6026a3db2567d8393e86540d80b0eec4ba"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0xac}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$ptys(0xc, 0x3, 0x1) 22.151836618s ago: executing program 2 (id=5589): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES8=r1], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000800000000000000", @ANYRES32=r2, @ANYBLOB="0400001100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB], 0xc0) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000003c0)=@newtaction={0xac, 0x30, 0x9, 0x0, 0x0, {}, [{0x98, 0x1, [@m_mirred={0x94, 0xf, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0xe, 0xffffffffffffffff, 0x6, 0x4}, 0x2}}]}, {0x45, 0x6, "7c760a973353e92343840ede6b5645b6ee0a84cbc8890a90412a8c039dc6967d0fc5822a94752cda57aeb6453f7c41fd6026a3db2567d8393e86540d80b0eec4ba"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0xac}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$ptys(0xc, 0x3, 0x1) 13.067520753s ago: executing program 2 (id=5589): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES8=r1], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000800000000000000", @ANYRES32=r2, @ANYBLOB="0400001100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB], 0xc0) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000003c0)=@newtaction={0xac, 0x30, 0x9, 0x0, 0x0, {}, [{0x98, 0x1, [@m_mirred={0x94, 0xf, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0xe, 0xffffffffffffffff, 0x6, 0x4}, 0x2}}]}, {0x45, 0x6, "7c760a973353e92343840ede6b5645b6ee0a84cbc8890a90412a8c039dc6967d0fc5822a94752cda57aeb6453f7c41fd6026a3db2567d8393e86540d80b0eec4ba"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0xac}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$ptys(0xc, 0x3, 0x1) 10.851267099s ago: executing program 5 (id=5629): fsopen(0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000001040)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292", 0xc) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) r4 = add_key$user(&(0x7f00000001c0), &(0x7f0000000280)={'syz', 0x2}, &(0x7f0000000480)="2f77abd63ebfe7dbf2f6bfd198b30957f888d4114bbe8a57a5fdc09f903c1d7b5fa8f24db0fdafe48b0405a97cdb0826dc0000000000a1cc5ec9c66a9914a800bdaf69416b535f3c35d8950367b47dec292546c56079060001ee9c74cdc83c4ce9b1e4ef329334b3efedd1e50100000041173086073cae790d486b0881febbce71d1a2331f3a6bf67b9317d0d37ab63d65c6b2d66e6b46ab901d4189a4fc154b6a735a11f844838e0a94cd0815a7000000000000000000", 0xb7, 0xffffffffffffffff) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x14}}, 0x0) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, r5, r4}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 10.766143804s ago: executing program 6 (id=5630): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x40c00, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x2) r3 = syz_open_pts(r0, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000000)=0x13) r4 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0xec25, 0x0, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[], 0x48) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x33) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000dc0)={{r8, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f00000000c0)='%ps \x00'}, 0x20) r10 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_GET_STATS(r10, 0x80f86406, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000003c0)={r9}, 0x4) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x1c, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r9}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r11, 0x0, 0xfffffffffffffffc}, 0x18) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r12, 0x541b, &(0x7f0000000240)) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000140)={0x1000, 0x7, 0x8, 0x1, 0xa, "9c3e6edc53f8a905af693eb30eac24e5fdc04f", 0x2, 0x8}) 9.649284053s ago: executing program 4 (id=5633): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x20000, 0x0, 0x27}, &(0x7f00000000c0), 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock2(&(0x7f0000658000/0x4000)=nil, 0x4000, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) fsopen(&(0x7f0000000240)='cgroup2\x00', 0x0) syz_open_dev$amidi(&(0x7f00000006c0), 0x3e0, 0x123e81) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="640000000206030004000000000000000000000005000100070000000900020073797a30000000001400078005001500040000000800124000000000050005000a000000050004000000000015000300686173683a69702c706f72742c6e6574"], 0x64}}, 0x10000) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x166) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @multicast1}}, 0x0, 0x0, 0x2, 0x0, "954f3b91f54aa78eb1ffb374125cd8327f0e152670040f301c1428c4a8511a8be8955942b32b934c23581ae7ac9b12d3215964a4d640754c467c41f36b02a24b627d26ed282dbd5b496e33585ea60e5e"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x22, 0x0, "43cad7b04bde5bbd8035d89034a56bad61a87c614899a37c5d0d7da4d7fc948375f3593dbd21eb7618ffb4ff4984e01eedc37998dd16526edb40eaadabe6cd2bd9f9dfeade7787ea64309c01ae05fb70"}, 0xd8) setsockopt$inet_tcp_int(r4, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) sendmsg$IPSET_CMD_HEADER(r3, &(0x7f00000000c0)={0x0, 0x14, 0x0}, 0x20048c00) syz_open_dev$video4linux(&(0x7f0000010300), 0xffff, 0x161742) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x4, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) 8.723674713s ago: executing program 5 (id=5634): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x20000, 0x0, 0x27}, &(0x7f00000000c0)=0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock2(&(0x7f0000658000/0x4000)=nil, 0x4000, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) fsopen(&(0x7f0000000240)='cgroup2\x00', 0x0) syz_open_dev$amidi(&(0x7f00000006c0), 0x3e0, 0x123e81) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="640000000206030004000000000000000000000005000100070000000900020073797a30000000001400078005001500040000000800124000000000050005000a000000050004000000000015000300686173683a69702c706f72742c6e6574"], 0x64}}, 0x10000) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x166) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @multicast1}}, 0x0, 0x0, 0x2, 0x0, "954f3b91f54aa78eb1ffb374125cd8327f0e152670040f301c1428c4a8511a8be8955942b32b934c23581ae7ac9b12d3215964a4d640754c467c41f36b02a24b627d26ed282dbd5b496e33585ea60e5e"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x22, 0x0, "43cad7b04bde5bbd8035d89034a56bad61a87c614899a37c5d0d7da4d7fc948375f3593dbd21eb7618ffb4ff4984e01eedc37998dd16526edb40eaadabe6cd2bd9f9dfeade7787ea64309c01ae05fb70"}, 0xd8) setsockopt$inet_tcp_int(r5, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) r6 = syz_open_dev$video4linux(&(0x7f0000010300), 0xffff, 0x161742) ioctl$VIDIOC_SUBDEV_S_FMT(r6, 0xc0585605, &(0x7f0000000040)={0x0, 0x0, {0x0, 0x0, 0x101b, 0x0, 0x0, 0x6, 0x2, 0x1}}) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x4, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) syz_io_uring_submit(r2, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) r7 = socket$inet6(0xa, 0x80000, 0x7) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) 8.405155454s ago: executing program 1 (id=5635): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES8=r1], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000800000000000000", @ANYRES32=r2, @ANYBLOB="0400001100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/14], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB], 0xc0) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000003c0)=@newtaction={0xac, 0x30, 0x9, 0x0, 0x0, {}, [{0x98, 0x1, [@m_mirred={0x94, 0xf, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0xe, 0xffffffffffffffff, 0x6, 0x4}, 0x2}}]}, {0x45, 0x6, "7c760a973353e92343840ede6b5645b6ee0a84cbc8890a90412a8c039dc6967d0fc5822a94752cda57aeb6453f7c41fd6026a3db2567d8393e86540d80b0eec4ba"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0xac}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$ptys(0xc, 0x3, 0x1) 7.637243321s ago: executing program 2 (id=5589): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES8=r1], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000800000000000000", @ANYRES32=r2, @ANYBLOB="0400001100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB], 0xc0) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000003c0)=@newtaction={0xac, 0x30, 0x9, 0x0, 0x0, {}, [{0x98, 0x1, [@m_mirred={0x94, 0xf, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0xe, 0xffffffffffffffff, 0x6, 0x4}, 0x2}}]}, {0x45, 0x6, "7c760a973353e92343840ede6b5645b6ee0a84cbc8890a90412a8c039dc6967d0fc5822a94752cda57aeb6453f7c41fd6026a3db2567d8393e86540d80b0eec4ba"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0xac}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$ptys(0xc, 0x3, 0x1) 7.535782128s ago: executing program 1 (id=5636): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="f000000010000100feffffff00010000fe880000000000000000000000000001fc0100000000000000000000000000010001071c4e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c0000007f00000100000000000000000000000000000000000000009201000000000000a39b000000000000ffff0000000000001c250800000000000200000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcff00002abd700004350000020001002000000000000000"], 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001c0001"], 0x14}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000c00)="1486184e05de316fd4727d7b6d9a20406561207d565f2c6903b396a6a980db1ca0c40dc93ff563ec5a06", 0x2a}, {&(0x7f0000000c80)="499d61952d196ff92758d292fcf6fd2f6188e6f0eef79a97678110c3f8ffbfc6fe884c9ee49a56132d2f5a72631630076eec1ac511dbfd66820de429d5673b0f42261ac78e85211bf526b83e2f84d62592cd867cd9d2dc", 0x57}, {&(0x7f0000000dc0)="8033c2faca9b47faafd26bebceae487a6cd48bd6961ac6154bb23316c5452242e91571d37bf6437f065a2eae4d3f299dedb360832a3eebdc446a3a0e57423928f82bb98452a8dd2c8e2ea0fc1c136de37a79f019aa519c27bd28e3cbc3db6e7badcb360906cf6318d24742", 0x6b}, {&(0x7f0000000e40)="4c3f035f4d7532c470b20d340b5409292337111bd1fa0b69660659eb5162df430c5976ea2d421dfd229b3c98aa96ecd0e4b4f9506ebd9749c62fd3971cb6d18a310af982f841fea4fac4a54df7f6d2d386a6b204789544f833e69ecae6485f0923a2bbda168ad3ee03993b3cd8a49f6c4a1bf18084641184ebec86cefcbdd82d6eaed13f96c2bb7576882944a527cccb1e07343803804606fd1c0b8590ce952bf7da558db4826d0e4ed79eb7a714cc808e638de8e22ad1a393a6978f0cb7f9a5c9858c3b91e55cab9c8bd8268774c1d7eabe", 0xd2}], 0x4}], 0x1, 0x40800) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) 6.625437987s ago: executing program 5 (id=5637): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x84) r1 = syz_open_dev$usbfs(0x0, 0x201, 0x2002) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r1, 0x0) syz_init_net_socket$ax25(0x3, 0x2, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfec8d000) 6.623099092s ago: executing program 6 (id=5638): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x2cf9977a71da3cb, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) close(0x3) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0), 0x2) r3 = memfd_create(&(0x7f0000000580)='y\x105\xfb\xf7\x88\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7`\x9b=\xec\x9f\x1d\x9b@$\x8c\bb\x1a\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\'\xffO,4\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2\x01G\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\rr\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\xc6\x8a=\x04\xa35\x9b\xf5\x80E\x8f\x1e\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x10\x00'/276, 0x2) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x7) r4 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000100)={r3, 0x0, 0x0, 0x1000}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r4, &(0x7f0000000080)={0x30000009}) flock(0xffffffffffffffff, 0x40044c7f67c5cb78) r5 = syz_io_uring_setup(0x111, &(0x7f0000000140)={0x0, 0xfad6}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2085}}) io_uring_enter(r5, 0x1f85, 0x40110a, 0x4d, 0x0, 0x85) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x4, 0x316}, &(0x7f0000000340), &(0x7f0000000280)) 6.594020882s ago: executing program 4 (id=5639): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000280)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f00000001c0)=0x8, 0x4) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000200), 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x80041, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x1) 5.973693866s ago: executing program 1 (id=5640): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs$namespace(0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) recvmsg$kcm(r3, &(0x7f0000001480)={0x0, 0x0, 0x0}, 0x2000) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x700, &(0x7f0000000000)=[{&(0x7f00000000c0)="5c00000012006bab9a3fe3d86e17aa0a076b876c1d000c6c7ea60864160af365040041000a001d002b7f6f4c9ee517d34460bc060000f0a705651e6182949a3651f60a84f709d182c5bb5b64f69853362a65a113827e4b4237268a9a", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) r4 = getpid() r5 = socket$nl_route(0x10, 0x3, 0x0) kcmp(0xffffffffffffffff, r4, 0x0, r5, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "ffffffffffffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f0000000000), 0xffffff6a) sendfile(r2, r6, 0x0, 0xffffffff004) syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 5.910246254s ago: executing program 4 (id=5641): openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/diskstats\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$LOOP_GET_STATUS64(0xffffffffffffffff, 0x4c05, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) syz_emit_vhci(0x0, 0x7) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, &(0x7f0000000140)='/dev/hwrng\x00') 5.685745825s ago: executing program 6 (id=5642): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="648485f159b50000000000020086b9", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/27], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="0000000000000000000000b700000000000000007c003cb086c0cb19ad912b0412df90a5b0904f00ab2ee6", @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, 0x0, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000003702000020febfff7a0af0fff8ff00f869a4f0ff00000000b70600001218d1fe2d640500000000002404000000ffffffd404000040000000b7040000100000206a07f0ff00000000850000002e000000b70000000a00000095000000000000006458c2c62fca868f0399d909a63396c113943219aab9d607000000cb3924b611f5969f62c28b22edf3cf393d14c46cc4f79fd2b316da4f0de8163f6242fa8a23f1740637c48468766af54043000000ec44631ac2622cdcae18c3d14bfbe96dd87235b44174f7c034318508f49f09781dc7a2cfbb9a0f119e31975f551557f05dc2dc2739e2e735d0ab961dac07f4f6d8aa1c3f16765d427c0e01000000fe4c16737d50d2a4bfc463450d524eacf2b734b0289c7a3a16eeca71296746681d61af491e4fa734318e0d72b8dbbc2b2b869af2f87903000000b6ecc7de09a2257e908cd92e664fa7aba7f07474863333c460e34caf0806a7e2575a56fba3eadd8efbd5dae6c024585d972b1bf8c4e872bba38160be9e92b6ddb90fc51b894917b50876b5708e64e70f7d8225da90ce9bc019084873ed07c0c59c4ba053fe77e0d37ccc3318da2e9fefaf025527e734ed1de5d12b4c56ca3b03dc121086061d1f26821a428d28eefa22ead6a3dab9388da53263b81ebe6be197a48a63440000a356240c4e2df57457000100000000000000000000008d2516510b29804b3cc034c19cef0d773f01064709edd63a185cbab8456c25283b9514b220fe401503ff536478088eb9fd932a0703a7bf9ea40429b2d49177824f210a69f8e5227fd32e7d5a2c7ecf57ac64509224090000000000000096e5a55d2c805bf725b9d14756c8cfa292aae0872866cf9fe063317741a0db9081d4393a7f9bcc0917d60a11b4a9ece831660ce625de441cef915eba31255d163f7033045ceb97f8ea006efc5b84f75ca1fb74c9faef444eb12f46b435de87feb2f7f2d7fb659395e4b38178b5c67e6ac100000000000000001b2e77bd5de136fa1bec1a26c622bb9662d9ee70147acc5605aa2318855cb8b918000000c5f265dcb5dce05f94ea051c4e8dcdf37d01ad7aff64f84ce32b841c799f47c2949725285fc50f1dd3f5e264023082eec752704c1f598151aa7d29e0d79522df196278acf327a74777d1f658f50c27020198770ff8ebef9df1b750d56d4d195ad7a267c46b3348b0e03ed33b5bca13cafc304dc6da78d20f029742d8d2f36acfdd331081ca00c1d5c8b7bed2ef603d6e7f1764246aab2d7d531559a971939a038055ac28625ec837f824ff537cd67993a3589be73a18680da50287b9e962b1a0235c290346a21ca5de55c49c78e411c791617000ef8df75411a5d300000000000000e0ffffff004deb8d49806823655735bd6deb49edb2e42f4ed9e6e9080366660b847bf03c144f6796920726dcf29e9a6c808459e82cbb0000000000000000000000000000000000006b5530865aaa7aa6171f66f2bca881a4201588427bb65ed3d5e7a74e9b5ece44067d4a9875a310bc7ec42b844b9eb3c9083560ef5c92b8a01188d615efbf70893d2eaf76517e990021fa5020a71023bca1194ad87cade480ba3dce8f57294e31ca24a8d181210bb6d18ff2c58293c2e314a7447ed3a1c870908aa8e3b33e6a94c7381bce9fa71dcbb758451f247e38d80d66e03d7564a5cddfaf06574b05cefb2670f30c2d501ee625ce3ffc08f15b53d28ce552c1807bc6866f06098a0e5517068aa48f2a82496fe83ee85218fe7f52b48742c7055f2a144c13e9c54be60b0a4f979ef7eb216897875946dc6ca1571930b1cf7c93de103f5289f782ae538e02612c717a76c787a873936eb8dcf1bfe581cc8ef965a0424bc140939e3274e251e519d188f6af680402c49458065dccfcb4f0d4f2ec9cf6fb3cf0a1807e34fb8d0108007734c1d2bc6a9d32d2560a88bad976b6000100002b712e632eeca810fb73fc8aaef94acf8bde18b9149cadc688254eabbe91f943592ccf68e717bcc6852828bd621e3a9dcb1cc6f1a6d1915200d95087838c2dc0a002c3aa554f725b965714144652cdc14761b0236f1a05b7f50f4149057e63d713103b5a6c2919161efc165a2e6981d76d29c95ad9f180135fb8962f59495fd33be3a6d35274941790bc1bd9da5e9c67c39de2c9f6fe35b8f528edbd8ea2a77dccdc3fe247feb121d9440a3ea9012a9d23a7e3110b0f25c5f8bf803d688de4d92b5dfdbd69fb8b426b55c10ba01b5f18b10cce8de3369300000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff8d}, 0x48) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) syz_clone3(&(0x7f0000003a80)={0x8000, &(0x7f0000000b00), &(0x7f0000000b40), &(0x7f0000000b80)=0x0, {0x29}, &(0x7f0000002980)=""/226, 0xe2, &(0x7f0000002a80)=""/4096, &(0x7f0000001300)=[0x0], 0x1}, 0x58) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_pressure(r7, &(0x7f0000000140)={'full'}, 0xfffffdef) shutdown(0xffffffffffffffff, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(0xffffffffffffffff, 0x40045010, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) sched_setscheduler(r5, 0x3, &(0x7f0000003b00)=0x8) r8 = getpid() sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000180)=@abs, 0x6e) 4.679731026s ago: executing program 5 (id=5643): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x8100, 0x0) socket$inet6(0xa, 0x802, 0x88) preadv2(r3, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) 4.132405827s ago: executing program 1 (id=5644): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000200), 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x80041, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x1) 3.708292414s ago: executing program 2 (id=5589): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES8=r1], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000800000000000000", @ANYRES32=r2, @ANYBLOB="0400001100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB], 0xc0) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000003c0)=@newtaction={0xac, 0x30, 0x9, 0x0, 0x0, {}, [{0x98, 0x1, [@m_mirred={0x94, 0xf, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0xe, 0xffffffffffffffff, 0x6, 0x4}, 0x2}}]}, {0x45, 0x6, "7c760a973353e92343840ede6b5645b6ee0a84cbc8890a90412a8c039dc6967d0fc5822a94752cda57aeb6453f7c41fd6026a3db2567d8393e86540d80b0eec4ba"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0xac}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$ptys(0xc, 0x3, 0x1) 2.509582575s ago: executing program 5 (id=5645): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0xc044) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = socket(0x10, 0x803, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000100), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000140)={0x3, @win={{0x85, 0x668000, 0x1, 0x2722}, 0x3, 0x4, &(0x7f0000000340)={{0x7fff, 0xa7, 0xe00000, 0xd}, &(0x7f0000000280)={{0x5, 0xc, 0x6, 0x9}, &(0x7f0000000240)={{0x101, 0x3, 0x8}}}}, 0x1, &(0x7f00000003c0)="385ab89b23015964bb191641770a174b79e492dcc3a1f8a5e3c1d278b87a4556988b49b8f2744f178f3194e5cf1677d5662dba8ce0eb741a36870c80be78617a3c596599a25535115e3a8ca125a6e9d0402f098dcf39bb83ee86522c254738fbdfe15edc8c75a6e6b6b892ecdd7a03d4373de4c11d64348f7d19a0db25a1414c78bd97609923c790c59f73039c735203f53923ec342576416602d528f1e72cffae9439d938b84f9ce3c642a3", 0x2}}) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@ipv6_newaddr={0x18, 0x14, 0x9535393fea6295b5, 0x0, 0x20000, {0xa, 0x40}}, 0x18}}, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000001400b59500000000000000000a000000"], 0x2c}}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) process_mrelease(0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r8) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={0x0}}, 0x4000054) 2.494884615s ago: executing program 1 (id=5646): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x14, 0x30, 0x4}, 0x14}, 0x1, 0x0, 0x0, 0x804}, 0x0) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0e, &(0x7f0000000040)) 2.494016612s ago: executing program 6 (id=5647): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) syz_emit_ethernet(0x37, &(0x7f00000001c0)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x39, 0x29, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @broadcast}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x0, 0x8f56}, {'\v'}}}}}}, 0x0) 2.491119262s ago: executing program 4 (id=5648): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x20000, 0x0, 0x27}, &(0x7f00000000c0)=0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock2(&(0x7f0000658000/0x4000)=nil, 0x4000, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) fsopen(&(0x7f0000000240)='cgroup2\x00', 0x0) syz_open_dev$amidi(&(0x7f00000006c0), 0x3e0, 0x123e81) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="640000000206030004000000000000000000000005000100070000000900020073797a30000000001400078005001500040000000800124000000000050005000a000000050004000000000015000300686173683a69702c706f72742c6e6574"], 0x64}}, 0x10000) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x166) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @multicast1}}, 0x0, 0x0, 0x2, 0x0, "954f3b91f54aa78eb1ffb374125cd8327f0e152670040f301c1428c4a8511a8be8955942b32b934c23581ae7ac9b12d3215964a4d640754c467c41f36b02a24b627d26ed282dbd5b496e33585ea60e5e"}, 0xd8) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x22, 0x0, "43cad7b04bde5bbd8035d89034a56bad61a87c614899a37c5d0d7da4d7fc948375f3593dbd21eb7618ffb4ff4984e01eedc37998dd16526edb40eaadabe6cd2bd9f9dfeade7787ea64309c01ae05fb70"}, 0xd8) sendmsg$IPSET_CMD_HEADER(r4, &(0x7f00000000c0)={0x0, 0x14, 0x0}, 0x20048c00) r6 = syz_open_dev$video4linux(&(0x7f0000010300), 0xffff, 0x161742) ioctl$VIDIOC_SUBDEV_S_FMT(r6, 0xc0585605, &(0x7f0000000040)={0x0, 0x0, {0x0, 0x0, 0x101b, 0x0, 0x0, 0x6, 0x2, 0x1}}) sendmsg$IPSET_CMD_FLUSH(r3, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x4, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) syz_io_uring_submit(r2, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) r7 = socket$inet6(0xa, 0x80000, 0x7) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000040)=0x80000004, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) 2.427892214s ago: executing program 6 (id=5649): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x40c00, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x1c5ed000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x2) r3 = syz_open_pts(r0, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000000)=0x13) r4 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0xec25, 0x0, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[], 0x48) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x33) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000dc0)={{r8, 0xffffffffffffffff}, &(0x7f0000000500), &(0x7f00000000c0)='%ps \x00'}, 0x20) r10 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_GET_STATS(r10, 0x80f86406, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000003c0)={r9}, 0x4) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x1c, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xd8}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r9}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r11, 0x0, 0xfffffffffffffffc}, 0x18) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r12, 0x541b, &(0x7f0000000240)) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000140)={0x1000, 0x7, 0x8, 0x1, 0xa, "9c3e6edc53f8a905af693eb30eac24e5fdc04f", 0x2, 0x8}) 1.228912836s ago: executing program 5 (id=5650): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs$namespace(0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000001480)={0x0, 0x0, 0x0}, 0x2000) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) r3 = getpid() kcmp(0xffffffffffffffff, r3, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "ffffffffffffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) shutdown(r2, 0x1) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) sendfile(r2, r4, 0x0, 0xffffffff004) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) close_range(r5, 0xffffffffffffffff, 0x0) 1.001301764s ago: executing program 4 (id=5651): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) 781.351771ms ago: executing program 4 (id=5652): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x2cf9977a71da3cb, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) close(0x3) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f00000000c0), 0x2) r3 = memfd_create(&(0x7f0000000580)='y\x105\xfb\xf7\x88\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7`\x9b=\xec\x9f\x1d\x9b@$\x8c\bb\x1a\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\'\xffO,4\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2\x01G\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\rr\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\xc6\x8a=\x04\xa35\x9b\xf5\x80E\x8f\x1e\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x10\x00'/276, 0x2) ftruncate(r3, 0xffff) fcntl$addseals(r3, 0x409, 0x7) r4 = ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000100)={r3, 0x0, 0x0, 0x1000}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r4, &(0x7f0000000080)={0x30000009}) flock(0xffffffffffffffff, 0x40044c7f67c5cb78) r5 = syz_io_uring_setup(0x111, &(0x7f0000000140)={0x0, 0xfad6}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2085}}) io_uring_enter(r5, 0x1f85, 0x40110a, 0x4d, 0x0, 0x85) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x4, 0x316}, &(0x7f0000000340), &(0x7f0000000280)) 699.952336ms ago: executing program 6 (id=5653): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000180), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x1000) r1 = syz_open_procfs(0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000040)={0x3, [0x0, 0x0, 0x0]}) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mincore(&(0x7f00001b4000/0x4000)=nil, 0x4000, &(0x7f0000000140)=""/139) r3 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r4 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x0, 0x80, 0x0, 0x4000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000440)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_SHUTDOWN={0x22, 0x9}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r7, 0x47f6, 0x0, 0x2, 0x0, 0x300) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) write$sndseq(r3, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {0x3}, @addr}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {0x0, 0x8}, @raw32={[0xeb, 0x0, 0x800]}}], 0x38) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xe) openat$sndtimer(0xffffff9c, &(0x7f0000000080), 0x22c080) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x881, 0x0) syz_io_uring_setup(0x10d, 0x0, &(0x7f0000000340), &(0x7f0000000280)) 578.029452ms ago: executing program 1 (id=5654): mkdir(&(0x7f0000000080)='./file0\x00', 0xfffffffffffffe76) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653da7387de13030303030303030303030303030c24b3030302c757365725f69643d", @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) removexattr(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000040)=@random={'btrfs.', '/dev/fuse\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) read$FUSE(r0, &(0x7f0000006180)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r0, &(0x7f0000004180)="92756f43b31ffe542788ef586b7c5a344424e3acac2590be6bbe37adface4a8f2e534ffe76a83a93f0b3680a72fddfde83f96d01982384e8d689219cb9669b14dbaa1b799f82ea1fc926126a4163618e16d4f94143a4e0f27c44fcef3920a0b3805ed4e78098d8689cc7791bd86648070718d238664332948d87866c8d2590fc0f017f9853abd9ed60b99f1aa6ae2dbd24ab6dbcebdb055246815ace147cc50fa3b2861148fcda374d5b203e51d72c45e4dde3e9ee9a47ffe458baf7bb49035135a8194aa1f0a83fa2abed56398f90daff679634619453f533f22583a6e0a4dc09e9de46684d5e0136e229510f3702cf3a4cd0065d3e5d3c419e38a80b070ca55010e082a9c510fd18cc0b26bb5e8e459e747befbc5c6b60ace80bf41417b7b78cf57e5b3984f0cdddc615c5e0000454d3f4a196fb6d18aa629cf0b0245f95ba958d86dc175616f8cd3ac473057dc3a5ff7107973326350107f4468e7ecd48d689b82c12d22ae5f1858302a1b4cfde8fd347a99ddcde40d1c49d9b5099fbccf09e782212be4b2ce36a2bc3c9ee794abffe72a5501e6c4f3f7f68b74761ffd6620609224a3bf11f655dadb5c8a5813b02fb46830e9ac6825f5d0e89910352eb3a58c0dd82d094f94dd2c85666f684a8f437bbd0e66b9f4d366117b67a054d212c4fbc287848cb0578391335d5d616b14d99a2e3df8e8a152d5de99bcefcaab5bb5cc71f3ddd66b379c104648e190e0b28a180d3aecc5423575d4ba7dbf31215c717da7b87dd454b6efcd36c91aaa631127f5bd88723d221752f102bc0c7ac6c5c7a1ad6747af40d01b6d39eab7b0e1292b44683c586386ad00acf60fb8f9bac551a6eb5bab7317b5d89f64db10bd9018dfa6d65d93862e851afbc30fd70fe5f0de322462045177231852ca80e4e78da4fea0c79ba354333026c8bc77d308a8d256a19ec45d2088c196691d3f9aac28ded36004a65ee1ce49ba9599ceee84534bb61d02d04a6732f1e27d72962f74b59f3522bf844c5022986d55934e48b8681b7f5b7532391448caeef00315d28320a46d8bd7813544e1e4bf994e14a519c2654ff20b42bdb69c262897e28eca528f0999840b00ed8256597d27cfc20d71d5f40d0bbca759f7594c6034aa1e16a84ed152fad0fdc1c303a7f61225712714f823afc5ea241d482d3585759623af8c97ca6a84a2033b3d7314ea0ef7ba9b288b362a294c92c8b9736829c16f61c5a1ee04aca965d71162292274595ea62c9c2918e8279c99f5d2830c617c58211fd7452330184b9428d5ec1d5cd75ddcc6de3326fdc70e891104b3b013c30ffccfaf3308d9671b01f6b080a930dac2052c6f39817a662121d90d40d6a1facfb50bec7d408030b6d0ae3e744f3bcc327c35dc43cf86b743db78ff2e593b19923235ed6467f299b08718fe1840c16a748935dff941150fb08b30573b37bf9af5c86cc8d9e229a832e4ef25ec91f71120f2b3e9062485976c280a2d172386029e2f2a4801197fca0a13514edacf5ddbac5a62e8bb13dd1572657a821a8739297f72e29239d1cdddf3e30cbe9af3141f2275ee4ae85d86ec888fe9a6751f252057e95b8beb055e276439581afee93cd44f1e92f70e5f725451d3ab662918ffbb1269509fbd511e95a00ec717f9d60d643864abd6ad1cc4dd7f933379a6078a86c2158db8076e7b660366fca7b1c46d09d2c8e67a6494bfb4c2c6750e76593895b5e2b2bc78093840c3c4a807826bc2750a96b4e1dd5b82b492bb2215518c92064d1763c37132604e52e73fac3f4511f791753aeecfbb19816e0da7a1bfbea9eeaa0f256eaedcb119a61f7d0ea0f5cd4969d45cb014800f2c888d5c2217cf0f69a7507779883b57352bb8883cc584891950d6e792537074f4fc4337aa19b9bf60e18edd939d289fb4a6b7aa6c66da20774e249ca4f779d3c910b1a9a8e4c38af6adecc87d5481d181fd66023ffff246f4e2556b218fe8110acebe20b1675f1de6f265b6d1d8514a53522396bf0e2f2b153c498e48b36d16f8b9bd56f45d7f5b9397d7f1339117a176d0bad0b68e800682416d3e18fe2197c7f8dc20600feb95cc6ba86ad47f113e159bd4389e30eab2874bd27eebc56020c4dab9973b13f3e82aa62a7e0a151d73de48cb811e32be63ffd303f5a6ea6f097ed763fbf36c430821e451146de79922348354ce285af0997bf3c66e6ef02942e24b8f1ccdd542f09cfe65c0da0094c0b5fd26bbc061538b41e5ed2cbb390ee29b10a4b7a696009e1b5b86c44c0a561a257c15415feaeb1433ea275ed6e4b228503fe71ee5942665164faaed6697112206be0fe7863aebd4bbe951d5dea1da294dba0793196385f4d5141c9d6c4b0fa22b2e200cfb70b52aca31655e71e5a576ccb8ccb5b1364748aa981edbb81a813b1aebc67be1f7619e7e197622d981280429f6ca5145c5b3b05e6bace9191e5c58fbf140f71f594cbfd4db0e9f6923f1758ff9464a61a720a5d4f09c622c3ce3f5d0d3a1d191111168108f41f12b16e9eaf3617c353715cd35260560cbfd0555d51ce5c40bbdb7c95ceaeadadb8902974de50b0863348183864f5ea682e678286a06a6f396af29a7c7fb33a3579e25835963612f3c0d4cf369d85959a0adeda94d35824050e6fba7f83f90867583f713d7783323c7010e94c9be331f860db395dbde6face5bfdb616fcefa9c6b01f6963daa840a31ff554a458c0c50cb5e09f91f54f63234589decaf45bbfbaef0dcbff4ae6e65ca26a530261c491ef8eb9a855a1d7463391c9b66be96cf24c3c321ee5a5bdc857f60b582683c6ae1e3775b62a9f19ff8fa51380ca8a2a3c6de79012f5727ba12025e7e6723a23a81e067ca6e54c7b38ff64880d235d21e7ee5258953dcbf9e2a962f006ca4ffe870859242c850cbae4222b3b72c4f86934379ba2ead1dcde906241b994d95c88355af5a9a30ace9c933a6942f341ad221dd825846a8fd44c03e2eaa9311c26e15a1bd7cbba961a22ef23d7ebba0e34cec5ef09b1ce72814a97e33bd29f3d9ec80a4f45d1d29486accf15c11f1a800bd84918e7626f678275d7c7acb02cc0e6e34bb766ba6b75c3ad14fca9352e09c3b69390c045cfc842ff9ade8ca693c07fadc7047a946e6e570c3afc5b501c964103397f5ddadc2d59a048348dd42f07cfe31bc9b5ae453f5086bb41bba4c8a3e518e30b0855184b053f923025dd72ce1bcbf41231978b34a8547c71d7313992165078903c61d312b0d9469413c9fd97ccdf0ea270fb6c47ec8861a1c8d909eeace761b5a06ba46e25785ff87f867777abb237c6c980687991f1ed0157d58492260c712cec34c1fc0962103955db4d5090b6e8409cf3c3c79d0e691cf4fbc0b2251a016dcd456969cd32e5429533bf0d6f8bda84c05f0e2040de8b53bfb8676eec4b76c3df6f46b1e43732035dda577e75f640777f6ae90fd2f1af42ba462dac732019c599bfef01acd6a0d4d1796bcb8f58519d6f9ad9a3206704a94d472516b988141f44ecd2e6f28a49aa0c449db87972fc995a97379914546ea43143ea2cf779a9cbe81f111fe89129db3610492164ab2598eca7e60d9a6963d8ba03a86729db86e420fd96d61b8fb11edc2b339b57a740074ae5b775eaf60cd85dc934e604bf2b4bd58ee01205b4df57ac20ff8db45a05982b579643882407050c005102a2e71f1e56dc76dbf5331112e83e48bfb5cf2a78a893190d78426175c162ffaa7278a43b9932318fc17fb8cb0dfac610b1ad235b91f9cb7623b155117e07f7b876a3c37627aa31eafed141cc0c5491c4f621a66b6d837a144d78719c46511c04a093cf65fce9fabe5bd6d499eceb63538ece3cf19053550a239bf978c08c879f9954485a4e3e0d5bedb84b407ced85c4dfc4d75af116815992c29f0bc927c4a990c38ae4fcc9feb90fec1b1b555e04d010423010855394d5ccfc8ed21164190cd8f83be5debb70290c3547f07e4dc42814f1e001798e6ceee2558b0c6ff8c1759f90269ee226131116332b99ac8dd104c92088e1f91ace3198c0f59bfb75c4e4a697660eed43a29c831a552de37fce6dce96fa51b6e2111f3071a4e94422d15e102e5f67da7ca6cae6bed7743ebffacb8a811a143605791d17232181a517e872f71262c3c73668f0ef83aad498f67fa26bae698cf78f24c2dbecd399a190e6b8d0684e929f2e8083765eb2c67793a1adbb89d36b58bfb197cdc5f3c894ac9d886e8f3b0936fabd233c09de8fab8099f72a74d908ba5c5e4d39790b0bf9e45b710f5587b7c937c76690c5c5fce621a53a9fd03b0a4ee6d8d1abbe2ed561820a77f12a08cad0755540ab6dd1604b7c30a8652995ab80b85e919011de9438a4637eb0291124ed4b745e782cff98510cb03be79c2a81351abf276584d75cdd96b9c97e73eb71000b3ab7c3c19c2cab4497298fcb3052b5d4503d05e7f310318be6f848547b1a4f4db82caee190801478be28065036aa4d91f290c1f396343e73a5fe8bb5ccf0a317177ed1f77acda1a4a49dccfcab8d1b5d79f015f788b6d5e9f8228a8bcdc0696e6b19f5edffbcd7e9509c87fbe1f726b93bf8c6d8d37428763e142560c46c9e894f7317859000c25abc4f3691ebcd020171e0d4911b5d97a238109aedeb00b2eb475c1e7b45175f8aa85193b5c0f43b434c15de01610c4d022646cd6e3637f349a434a77f571ac1c5d698452d1b991e267f78dca5e592ecd31ccafcad84e4e98d134b4adc525b81bd6843428883023a6ea407201738c8bf16b541ff7280274a34d4cf14819f2dbae167ca0cae8471c495e006b45194ad91c4516f21cbb10e0d26fd5d734cd7725df5b3fbe92955f4a9bb3b9b813aeeff79d6ed5db92def19d060a208c3ec8c42c110786f1e1496c50a7249b03fc792764366894a35320b99d0bef9fd0b6a246c36a357c6b985dc83a37a8d9b8b9ad643dea94860cbe763bb73cc8422b69d4d12332242c8954075fb7117a6679638073617abcdb4619855b2036af160647f66b3531645a3bf047ae290d6ae2249f114e7a8464278bae1486022bcc7c37390c8d9a0efb0e1cfa0da8ef7a5e072f99a47ecc75e4e442880375193db49bb82ba34901286ca473ed5b63e4048db4dc455e74b3fdd2e7898ca3f4c3a02d435cde6141eea645055123a7dcf0d22057f8d425701afc55859f5147954e719d58c7486b1e02ac16cb799b77632c66bb78e6e52e11017c1736424fa4d433f1e19b4c881d23f0b2a12d5fae3ae24339088088d9b496ad97bd9f6e20a8597d1452a0c72dcf43dbbda8f18166585c06d21fbffe5fe7b55f71c9b9f1b34a02bd05ca63c7c1b1bebbb9dd24fb10291b04c665d45154dd28b85d821ce7e613119128996785e1006a8dabc4899b10d2671107d5a0658ed363b9d4b39d02f8cc5e350fbf0a31048adecd1f9e2ca749bd86f195eb48e9b4605f050de03d642940d79184618f7f88a9a0a4683ad84d6134e395305bc1d4d9d17cc334b97653529d6682a87a5fac80a6d46d6e72fc22e58be7b8f8617b3372ef2622110ab1ec448717118b257acffe55d18c7855e9e8710ad977a6792b2315a189eb4468c68641e9b60c0dab7016ac1ad63cd8004b6eca8fc88b1e4263acc00499255c16b11487a0af858075f9c892dc8044c4146e5a5677c4a2cb24bde5e078985020d4ab1e4c87492e76b7e6f4bbd71d84bab1885c9702849e70cf728776b1a94c2a8fb8c7ca01b6111ef6f2032a290949bfe473fe215273b8b5b3ad540f187490f63077dccbca6f62f0a7a66717c596cdef412f2560b10685ede967b3ee68b8c951959aeb1d7564c3b9d806b2ce858381393a79916b78f7e90beadae30ffc0b2b614380f1c2cc551a44565209db3516be379ef566ab00c673fd8aaeeecdcf1168c1960e9a477b9e13757498a44ff089351d1f27abf9fd76816f924504647d1247715ca861ebe624172c322146d66eb2b247f8ecb3e1b5ddca89b287c57510cec40fcf89d802cf4368a861af320e01e34f7a6177d4bc549181b5e87ecdfe02f78c9a59a3bf91ebb6364023ec06410e7b4476ec4e3685bfa3bfe9ef9ecc12dcd899abe0f3c7f16b4686801c0c0a949aa26bed57df56f2bc54ef19af7fcbc7b0d691075f42a4a67acf980b568acb2342f42249f7c1ee3527c13182b096064ecd250887a942d26f637e1c4041b139659d2462a68680bb04387a3b399e396b9fe74de10356125fa47d0a20827370cbf36a79b6fffade91c439dd6cfff4bbe0dd3efefb61c491ee32f935d62307cba369ac8c20f6fe3d4857ce6d240ece5e4d149f0587155a8350fcc18efae2ff11cdbe15218a82499a1996df8b5462ee170b284321e76bbe5c3f4158387644d95f087c598e3d46fbe27f63fa784bda239512113424045a2c5dbc6bc3662ca730a86d13cf8f6fe2743224ca7b535caf6b4701a7dae9cfad3d7290104bbba15b6a064ae6e909a099f75fbe47c9e654d8e3b8dc0f3dbffe829e6c56f7a241e565136812a857f59ab565a9991c6b1d8abcc94c6b33bba314f6e5060e657e4647f969a551dd6c51dfca0ff5d9e4f401fedbc2c927eb1ed95ef25f4e5accba4999322ba1539499310dd5875433a22835cfd42fd77fd4680b7fe767d7aa5c33acde04a65bd3a663fcde4c80e9f2af498f13bf9abbaa1c1265edc691e94abdcc92270c05811cd2a8104eb18efbfec9e4ba9ae5cde211b9b93082ce034b6cd5fbe9cfbac4f7e2404ef159766124f73017cc3600f3c81cd78db25fc3459629eaf20dfdb062c7e502aa69412381d847a9d254d5befc451cda3606f0bc8ae62e0aee928f9ed0b21d705a8d31b899e16445ee064563d32f7b6bb5ad197023cf528d9b329ec67815c6ddf27d2a6ffa7328bb993407cde3d166159fd49fe469254b84c2916daea8df9d69bef019f1351b9bce193e30278835b82ea5f60dc0bdd7f7452b7a820ae7cd6dc29d7ac6a6c1b6411711a96338b1e769146b2a385d282bfaae61b041166efafab2d89a4567b9460cc22d752f8e9aacaaa0db7c84879f5359662d55df6570d4214740851c74574ced733807cbb54571110410892394c3dea07bd4154d0e5689d57c3360207dac951f96a358e9c466a5c5113f3a632e184f57f075edef4dcc9721b963beb95df09dedf848260cbc1ebfdc7408218eaba6d2c51928cd37c4c0c9f321fbb0994a56947cfd9643056db5dbea60a241f8f004c932bc8e645b2ec2eb9bc4e9e2f4156293234d05e70cb26b8a370b0206c756bda6defc11c5eb386640f535a4ffb714168defc6d82f40d8f5ba8768537ead5773c53bd779ca899a2dd31c9138569ff5107c2fb12b804375c3b3dc9b828bfd550328adf358f71e86a0c49fb119f5ef9e06c13855cbfc7d1a62ca2ea655ed912a6dc7bb8b18656e8923fc7a1702ab36947d79384d681c31923e98cf40209f776bc2b219a7ccd139e756a905aa351e6eaae90770c8a193f96cd5c66e4d77a357985556e14333716d80204a5c390e0d76f4081afe917f99ad8a0976b3342f51854b374b4baa9a7f22124d2b82749446e30d9795acb9c3c3a305a6d273ac528e8e9c95c37a78e765fdda55982c2961fbc85a14fc095a78b4654ee6dfc3298749a639ab9c8e155af3a77f8a409ce174532a492ef550a140f774d77d732b3b4ca5bc41fa4488ce5957ce219b032ae1f585273748d81b19edcf3e6cb9a93ec24e41c6b3c472f9baf3ca46cb8b9a91df18acebe7d83bd4473750c4f26806da2f95b9ea48b342460af729ab15e9f033eda67feec645f985d4b9489cf6ceec1b100d007bf46c74be53c7ea17296f9c5b5cbae736491213c93b513009ebdecfcd60d46d7b86c6e3b5e288f2ba5867c07936e7bd1b00de52191eb8630ff82ccafb27a59295164751811bf74eff1e5e2abdf3c93bc5dc9814be83b2562477935e2fa30db7ebb6ec380170cf10c1f98f8c5eb71c730c2b31b55a1dd1c12a64802ab95b63c529e0a96cec8f38680221d6089926d8309796c79994d63b67bfb62f66b4a502f30ed12be41e896e88bc45a160a526fbd5f002e677322f116ec5740d7563cd23ee853c008b84998e38fdf158556e28a532573956e7c00f91f08ca245c295a3d5e003a99ea727f61d12893b435d4c8f2f5cce00c6a3091e2a47f290c07168975c53d7529b71d10faf42d2bac9db8d53669cf59c709c25e9e40b5feaed4c37dde8b84c4961c00712326fb6aaa06e80d766b40b72480f3971def61d1d129676df2478e778d899ed317426ec33e496d1fdd2ec27128f8faee92828e13da72d6aee8330a7988ea1cc8b64ec4d8b20990864c16c52c4be6d00b304b87d97bffdd9c66a740b517223089d9f3f414abedc53c768dab9220b980e6c18d5f20ba8994cc8886d7bdee213442f456d79fce1b1eb48fbf600a666c8ade24d118e6328251cf7b57a6285c650e019850f392b1c29aec5c8fc489a3819d60d5de377d4c11b8ee5625b7c02c5d50d2af3397006f2e2a41a06f039229eef5878ed91f9f6be7e988924dbaeb8455f616275e8698d93fb536e2c839b203aa69bceceddbf9c53f8addba53d50ca0f7a4729a42ac6eb757f1b408ad4a0147546173e62f7621eb18a9e1681510cceb48e0a30ab7a1bf71d56742d5f034f2d725e7ea68a011dbb100fa6eefe4ee093873de366d34f4240ca027a25c5b979c9ac47dd1dcb6ed82c4aee09dcc23cf329a8644f89b5cf00e5683934b1837574e9b39b31b1009f276e15aa040959fdf100838ca3f5ab17e45036668d06044e3a13f3a0a6f68579e50d5b0164f900d7bcfcde78396cf30f0b1dff76dc397ab1a5a44b207eb1eaaf73b945c575029ae2dce20724991e6550155ded6a42672609f2439c5aab4882b2ffaf7da787b71d05d15516bd68c6f1a9d79b675395845f24ee853f877e72c14b6c6702f7b8775ca1bfabbbcf4019f7bccf07f1c211531dfc66a7a1df79e92a20dd1cbe1b22e1209e7e3ecb9d3c2450fc22a57bfe09bd735f61c361cdac2488ae0adc7885edc0712655daaf535e1de96ccbe7869d531d8bf3db512fbd17c772332a3f8cf1e052ee0202eb99a36a0f8d7219888acbb57090cdaf3b28e1e62e8fc2ec237bdf18592a7afe4d8390dcb5e7fcc31bf4f797e6f5710070902265cc2e8c459b7da1451046abd6c8c5b02c0be2d2f505a65376266563ac7b59ef3b4e2570a6cb0bd94d46ad861317c743ce1de12bfa2295a98cdded4414d87a1580b1e4675bbdf73a22cac4a1d8d456d089e0b60cbfd16158f073bd1dac481db49fa5d8801d0fb0844b4afec1bab4e61fa0f381fa667880a1cd8163953be7b591cc9dfd7f91902370b783ae8a0f3c7cbefa7d229a37c00f523529e159b11d2e240629b64af2d11404773e991207a722c320221ce23baed7cbe40a440c5680814b122cfba9092fe03478f85adcbdeacb76d6cbf2491eafae98327b278e267821a0e1cd06ef90cb0328e246c19d8c63b9332291a89bc9f989effc675c79a870ac024756c6f5a7e32babd69625d61487ae7399490b70dd0fade7d70ad9b0757300a2dde77abaff4f63a0303853589d44efa968e10d36561f04408ad0cc227fc6b2f904cead189a0fcca9b2e6cbde5498652e0b3bc9d8b7921474403718feb5cc750dc70f5a9b1a0ae2c642015b6a1a8ab0572182b4e39e0c869cbdc60c9465f5d564d18ba2f5b3bc3e05a458744077430c5ea031ee02dd8f0a65d7dd8d90dd9b8717f77d202239a5778719423fb2aec7ca86eb07c39de65a34b988d65377a7473e9145f16d79593e96903330bbf3a8024fc15519d9baa0fae2018786f4b1846fca355ff0fccf65cccad1896309a5ccf2056dd542c929850cc91cd655962360fe316557ab3fb378328f77a07d9da24447d3fa2020b382ed2e808ec9529a01273434c64b0b7c35a06a019e4ab51cdc9c0f266ab25b6984338a0ba910d1060283b636c5d7e8a3f969c1ee1c99b54bba7ff3679fbeecbb70349f076480a867cc4ee4cacaea39c80f642533599486d2ffb77b8c9109a9d25fa0b06e58eca764f7d56469eb9547036bbea9d5c3d35b4c1fbc3d39a372c2b7ad184965cad3819c8928f1588d00949949c0c4c93d30ac7f6665247c0108bd89dff3aafe780ac66febfacc8c6a3cc387d09da6de700487a80e2c8d56df94d7ebd3e1d9e06411a6c5f7eb6da41c6f52997b5ad47ba985261103fdf12eb4a2828b248f652ef00b6abccab2eb161b878b9dbc0aa911405b6f67adda83c16187748d7b524ffe6381f489f432d592e6171bd9ccb2cd52f977143f57fbf2ab0b823d449ae55f02440972334344cda01837b93afa4f46a2fdefe27e92764cf9596780846de2e3b1ea83e62ee43b1c05aee675e25363504addfaa68e7c53ed685413f5ba951f120d0a646e474872c81e5a887464c19f8460ae814ffff24cb51dd2dca28d597ab2ea60949f8dbbe67f263e722fdb51bce4e328a19f5ff1218e1f63b8da6d40dbd5490964499b2522ea323310634893ead661407966207a66ab13adfcf1a725ed14339c46011c0e0401f2386b47cd9f902fdf84bc85e74d3ae7cc544e4d65670a554a537712c6ee9f75191631d2a4c4da06fc38423b1d5b828d7201235b2974164f52aa16bee70ee509250752f4fdd6b9f8d021943df8320682a6f80ff0d67ab7a4ceea807bd5b3b7b6380b0c7f0caa67b0208ba71317f0355a3b755af0e2c007186389438615df80b7b25104a733fc90625b62682198733c0f1625dfaa08cf81e3df043094b7b5a098b3b36f803b5b0f10a057bf814ae3579932c0a5f208985bab3d817f975283b8838ae5cb709be72b58df7425e059fdbf4e0ee51b3da01fe0b44963c1196baee5ec5909ad80d9d1660f3edd90374952a0bf8b3bece2c2f944593f4de7de5e05ded096b8f4f05d65dfc2e806f78220d84b3db564fb12f4e5e8f5eab316591f004e9374cce8e787263bc3827affe6793c130b8621d3bbb2a86fd87f070ea21718281ee7aec4bb3bb71af4bf5721cecd139c4be8c9df4ec8dfb09a5cf1d86a25d39faa9f064a997c214f334e4410917fc3b4d67ada8d87a38c0f86b02bf653dddaeb5b75b300f8bcfd792858bef8ab23e063421939c59212964c9ed5dd56e215db58cef53d31a966bb8ce4ed56287fecb3a85ba435e0b41b20ba1164b9c9f2c49fa0f7b17a89e0ec47eefe992d63ee29c8c0a1ece2664fee8edadd43636a54c48519b4fcf55b0d9103602b92441a5f85cf8c5e406d0f5815f8f37309934bd78fbc2acf0a03b051b4528db4f7c09de7d0aabafca3736b8259c818ca338ca6754e0747717c2794d664a1cacc1e9c52764a308e6df73d975638630b74cce6c49b1bac16454e96852c4f9d8ed118e86d2f1c8dc33bccd4a07be128db5e80f5684ddcc1158e744411acde590f902f0987cfb750bb5bfeed53bff076868986b566d7701f48ddfcacbd325c8d930bcef26713bf60585d5c991e2a6cc33ccbc27f7ddfba18f998497c2eb378cc8f2cc07a1b4f141c5e0fb6f52e18242e505bcf6dd20e33a469d056a0b4fd5e72d0da9d0bcce1e2f9e9dc7d1c7b6cb0f3604287eca", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r0, &(0x7f0000000800)={0x50, 0x0, r1, {0x7, 0x29, 0x0, 0x10048c80, 0x40, 0x73, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ffffffd}}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x3, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket(0x1, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0xe, 0x4, &(0x7f00000008c0)=ANY=[@ANYRESHEX=r2], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x6}, 0x8, 0x10, &(0x7f0000000000)={0xfffffffe, 0x2}, 0x10}, 0x94) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000200)={0x28f, 0xfff, 0x1}) r7 = syz_open_dev$dri(&(0x7f0000000340), 0x1ff, 0x2000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r6, 0xc01c64a3, &(0x7f0000000040)={0x3, r8, 0xfffffffe, 0x80000001, 0xb, 0x1fd, 0x1}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32=r9, @ANYRES32=r5, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r9, 0x0, &(0x7f00000000c0)=@tcp=r4}, 0x20) bind$unix(r4, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000001680)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x1, 0x0) syz_usb_connect(0x3, 0x3b, &(0x7f0000000240)=ANY=[@ANYBLOB="12010003af1e6a40d11242ce800f010203010902290001a004000f0904ba0500ff113112aef50a7dcc9bfdac95013900052406000005240000000d"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 2 (id=5589): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRES8=r1], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000040000000800000000000000", @ANYRES32=r2, @ANYBLOB="0400001100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r7, 0x29, 0x36, &(0x7f0000001440)=ANY=[@ANYBLOB], 0xc0) sendmmsg$inet6(r7, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) sendmsg$nl_route_sched(r1, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000002f40)={&(0x7f00000003c0)=@newtaction={0xac, 0x30, 0x9, 0x0, 0x0, {}, [{0x98, 0x1, [@m_mirred={0x94, 0xf, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x4, 0xe, 0xffffffffffffffff, 0x6, 0x4}, 0x2}}]}, {0x45, 0x6, "7c760a973353e92343840ede6b5645b6ee0a84cbc8890a90412a8c039dc6967d0fc5822a94752cda57aeb6453f7c41fd6026a3db2567d8393e86540d80b0eec4ba"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0xac}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$ptys(0xc, 0x3, 0x1) kernel console output (not intermixed with test programs): 1589.761026][ T5955] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1590.025592][ T5955] usb 7-1: GET_CAPABILITIES returned 0 [ 1590.155995][ T30] audit: type=1326 audit(1760294495.691:1130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24896 comm="syz.4.4980" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f93de78eec9 code=0x0 [ 1590.156024][ T5955] usbtmc 7-1:16.0: can't read capabilities [ 1590.397249][ T5955] usb 7-1: USB disconnect, device number 45 [ 1590.631647][T23447] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 1590.791418][T23447] usb 6-1: Using ep0 maxpacket: 32 [ 1590.798079][T23447] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1590.808077][T23447] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1590.818548][T23447] usb 6-1: config 0 descriptor?? [ 1590.828005][T23447] as10x_usb: device has been detected [ 1590.834491][T23447] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1590.861044][ T5858] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 1590.886322][T23447] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1590.904148][T23447] as10x_usb: error during firmware upload part1 [ 1590.913457][T23447] Registered device nBox DVB-T Dongle [ 1591.020952][ T5858] usb 2-1: Using ep0 maxpacket: 32 [ 1591.039698][T23447] usb 6-1: USB disconnect, device number 103 [ 1591.053347][T23447] Unregistered device nBox DVB-T Dongle [ 1591.056114][ T5858] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1591.071743][T23447] as10x_usb: device has been disconnected [ 1591.086481][ T5858] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1591.147218][ T5858] usb 2-1: config 0 descriptor?? [ 1591.875440][ T5858] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1592.030156][ T5858] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1592.543688][ T5858] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1592.560858][ T5858] usb 2-1: media controller created [ 1592.586241][ T5858] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1592.626100][T24926] syz_tun: entered allmulticast mode [ 1592.652249][T24926] dvmrp8: entered allmulticast mode [ 1592.668286][T24925] syz_tun: left allmulticast mode [ 1592.673703][T24925] dvmrp8: left allmulticast mode [ 1592.900983][T23447] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 1593.074013][T24937] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4993'. [ 1593.097455][T23447] usb 5-1: Using ep0 maxpacket: 8 [ 1593.429538][T23447] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1593.742281][ T5858] az6027: usb out operation failed. (-71) [ 1593.757608][ T5858] az6027: usb out operation failed. (-71) [ 1593.765252][T23447] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1593.776362][ T5858] stb0899_attach: Driver disabled by Kconfig [ 1593.782848][T23447] usb 5-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1593.793678][ T5858] az6027: no front-end attached [ 1593.793678][ T5858] [ 1593.811846][T23447] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1593.825609][ T5858] az6027: usb out operation failed. (-71) [ 1593.839007][ T5858] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1593.849129][T23447] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1593.872070][ T5858] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input102 [ 1593.886062][T23447] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1593.926031][T23447] usbtmc 5-1:16.0: bulk endpoints not found [ 1593.933976][ T5858] dvb-usb: schedule remote query interval to 400 msecs. [ 1593.984218][ T5858] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1594.081973][ T5858] usb 2-1: USB disconnect, device number 126 [ 1594.376554][ T5858] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1594.521086][T23447] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 1594.696367][T23447] usb 7-1: Using ep0 maxpacket: 32 [ 1594.771610][T23447] usb 7-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1594.781267][T23447] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1594.917047][T23447] usb 7-1: config 0 descriptor?? [ 1595.198086][T24959] macsec1: entered promiscuous mode [ 1595.204054][T24959] mac80211_hwsim hwsim26 wlan1: entered promiscuous mode [ 1595.577652][T23447] as10x_usb: device has been detected [ 1595.648693][ T5871] usb 5-1: USB disconnect, device number 41 [ 1595.669615][T23447] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1595.671646][T24959] mac80211_hwsim hwsim26 wlan1: left promiscuous mode [ 1595.752667][T23447] usb 7-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1595.802526][T23447] as10x_usb: error during firmware upload part1 [ 1595.813142][T23447] Registered device nBox DVB-T Dongle [ 1595.845711][T23447] usb 7-1: USB disconnect, device number 46 [ 1595.882385][T23447] Unregistered device nBox DVB-T Dongle [ 1595.887927][T23447] as10x_usb: device has been disconnected [ 1596.121370][ T5871] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 1596.281060][ T5871] usb 5-1: Using ep0 maxpacket: 8 [ 1596.298671][ T5871] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1596.328480][ T5871] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1596.384502][ T5871] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1596.524201][ T5871] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1596.713209][ T5871] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1597.005656][ T5871] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1597.239270][ T5871] usb 5-1: GET_CAPABILITIES returned 0 [ 1597.253170][ T5871] usbtmc 5-1:16.0: can't read capabilities [ 1597.350036][T24979] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5006'. [ 1597.598894][ T5871] usb 5-1: USB disconnect, device number 42 [ 1597.835536][T24981] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5007'. [ 1597.881526][T24981] netlink: 16 bytes leftover after parsing attributes in process `syz.6.5007'. [ 1598.241095][T24989] hub 2-0:1.0: USB hub found [ 1598.246653][T24989] hub 2-0:1.0: 1 port detected [ 1599.060648][T24998] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5013'. [ 1599.491109][ T5871] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1599.771416][ T5920] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 1599.811129][ T5871] usb 6-1: Using ep0 maxpacket: 8 [ 1599.818774][ T5871] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1599.844861][ T5871] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1599.871885][ T5871] usb 6-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1599.921182][ T5871] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1599.935352][ T5871] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1599.947718][ T5920] usb 2-1: Using ep0 maxpacket: 16 [ 1599.956923][ T5920] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1599.967501][ T5871] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1599.977173][ T5920] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1599.998497][ T5920] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 1600.010988][ T5871] usbtmc 6-1:16.0: bulk endpoints not found [ 1600.045062][ T5920] usb 2-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1600.054997][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1600.070331][ T5920] usb 2-1: Product: syz [ 1600.074645][ T5920] usb 2-1: Manufacturer: syz [ 1600.079322][ T5920] usb 2-1: SerialNumber: syz [ 1600.099936][ T5920] usb 2-1: config 0 descriptor?? [ 1600.106816][T24995] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1600.152301][ T5920] mcba_usb 2-1:0.0 can0: failed tx_urb -90 [ 1600.158515][ T5920] mcba_usb 2-1:0.0 can0: Failed to send cmd (169) [ 1600.208160][ T5920] mcba_usb 2-1:0.0 can0: failed tx_urb -90 [ 1600.215253][ T5920] mcba_usb 2-1:0.0 can0: Failed to send cmd (169) [ 1600.239754][ T5920] mcba_usb 2-1:0.0: Microchip CAN BUS Analyzer connected [ 1600.461325][ T5920] usb 2-1: USB disconnect, device number 127 [ 1600.462797][ T5920] mcba_usb 2-1:0.0 can0: device disconnected [ 1600.557427][T25020] mkiss: ax0: crc mode is auto. [ 1601.052358][T25036] netlink: 4628 bytes leftover after parsing attributes in process `syz.1.5022'. [ 1601.129084][T25036] openvswitch: netlink: Flow actions attr not present in new flow. [ 1601.343572][T25041] binder: BINDER_SET_CONTEXT_MGR already set [ 1601.414481][T25041] binder: 25040:25041 ioctl 4018620d 200000000040 returned -16 [ 1601.617907][ T5920] usb 6-1: USB disconnect, device number 104 [ 1602.011086][ T5871] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1602.194635][ T5871] usb 2-1: Using ep0 maxpacket: 8 [ 1602.218000][ T5871] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1602.245132][ T5871] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1602.387687][ T5871] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1602.406023][ T5871] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1602.471202][ T5871] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1602.483268][ T5871] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1602.683009][T25075] netlink: 'syz.4.5028': attribute type 1 has an invalid length. [ 1602.701044][T25075] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5028'. [ 1602.946808][ T5871] usb 2-1: GET_CAPABILITIES returned 0 [ 1603.010545][ T5871] usbtmc 2-1:16.0: can't read capabilities [ 1603.177777][ T5871] usb 2-1: USB disconnect, device number 2 [ 1604.041287][T23447] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1604.178079][T25101] binder: 25100:25101 ioctl c0306201 0 returned -14 [ 1604.230950][T23447] usb 2-1: Using ep0 maxpacket: 8 [ 1604.282561][T23447] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1604.294225][T23447] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1604.308137][T23447] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1604.323665][T23447] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1604.359005][T23447] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1604.464629][T23447] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1604.474574][T23447] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1606.335602][T23447] usbtmc 2-1:16.0: probe with driver usbtmc failed with error -22 [ 1606.578572][ T5872] usb 2-1: USB disconnect, device number 3 [ 1606.924621][T25135] hub 2-0:1.0: USB hub found [ 1606.930237][ T5871] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1606.938280][T25135] hub 2-0:1.0: 1 port detected [ 1606.968804][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.267796][ T5871] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 1607.280022][ T5871] usb 6-1: config 1 has no interface number 0 [ 1607.290243][ T5871] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1607.304695][ T5871] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1607.324634][ T5871] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1607.347113][ T5871] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1607.363179][ T5871] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1607.372921][ T5871] usb 6-1: Product: syz [ 1607.378177][ T5871] usb 6-1: Manufacturer: syz [ 1607.385672][ T5871] usb 6-1: SerialNumber: syz [ 1607.403605][T25123] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1607.646361][T25123] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1607.733682][ T5871] usb 6-1: No status endpoint found [ 1608.675559][T23447] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 1608.873512][T23447] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1608.884258][T23447] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1609.857363][T23447] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1609.867292][T23447] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1609.876777][T23447] usb 7-1: Manufacturer: syz [ 1609.916733][T23447] usb 7-1: config 0 descriptor?? [ 1610.418274][ T5871] usb 7-1: USB disconnect, device number 47 [ 1611.292233][T13807] usb 6-1: USB disconnect, device number 105 [ 1613.851252][ T5871] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 1614.262355][ T5871] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1614.273147][ T5871] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1614.304552][ T5871] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1614.326465][ T5871] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1614.342029][ T5871] usb 7-1: Manufacturer: syz [ 1614.352423][ T5871] usb 7-1: config 0 descriptor?? [ 1616.285964][T25252] binder: BINDER_SET_CONTEXT_MGR already set [ 1616.301143][T25252] binder: 25251:25252 ioctl 4018620d 200000000040 returned -16 [ 1617.030182][ T5920] usb 7-1: USB disconnect, device number 48 [ 1617.161235][ T5871] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 1617.433115][ T5871] usb 5-1: Using ep0 maxpacket: 32 [ 1617.441933][ T5871] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1617.511246][ T5871] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1617.562295][ T30] audit: type=1326 audit(1760294523.061:1131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25265 comm="syz.6.5088" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f662338eec9 code=0x0 [ 1617.570889][T23447] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1617.601854][ T5871] usb 5-1: config 0 descriptor?? [ 1617.814752][ T5871] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1617.824430][ T5871] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1617.841323][ T5871] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1617.848533][ T5871] usb 5-1: media controller created [ 1617.915313][T23447] usb 6-1: Using ep0 maxpacket: 16 [ 1617.932364][T23447] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1617.945120][T23447] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1617.959364][ T5871] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1617.994619][T23447] usb 6-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1620.184195][ T5871] az6027: usb out operation failed. (-110) [ 1620.190855][ T5871] az6027: usb out operation failed. (-32) [ 1620.197467][ T5871] stb0899_attach: Driver disabled by Kconfig [ 1620.205350][ T5871] az6027: no front-end attached [ 1620.205350][ T5871] [ 1620.215326][ T5871] az6027: usb out operation failed. (-32) [ 1620.221555][ T5871] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1620.229246][T23447] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1620.329139][ T5871] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input103 [ 1620.348751][ T5871] dvb-usb: schedule remote query interval to 400 msecs. [ 1620.357050][ T5871] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1620.428172][T23447] usb 6-1: Product: syz [ 1620.568401][T23447] usb 6-1: Manufacturer: syz [ 1620.680113][T23447] usb 6-1: SerialNumber: syz [ 1621.191745][T13807] usb 5-1: USB disconnect, device number 43 [ 1621.367459][T25294] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5095'. [ 1621.429697][T23447] usb 6-1: config 0 descriptor?? [ 1621.431791][T23447] usb 6-1: can't set config #0, error -71 [ 1621.472258][T13807] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1621.489098][T23447] usb 6-1: USB disconnect, device number 106 [ 1622.412714][T25310] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5100'. [ 1623.305607][ T5871] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1623.481470][ T5871] usb 2-1: Using ep0 maxpacket: 16 [ 1623.493082][ T5871] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1623.542032][ T5871] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1623.577987][ T5871] usb 2-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1623.814223][ T30] audit: type=1326 audit(1760294529.361:1132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25328 comm="syz.6.5108" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f662338eec9 code=0x0 [ 1623.838653][ T5871] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1623.848333][ T5871] usb 2-1: Product: syz [ 1623.860520][ T5871] usb 2-1: Manufacturer: syz [ 1623.865177][ T5871] usb 2-1: SerialNumber: syz [ 1624.398950][T25348] geneve2: entered allmulticast mode [ 1624.438562][ T5871] usb 2-1: config 0 descriptor?? [ 1624.799492][ T5871] mcba_usb 2-1:0.0: Can't find endpoints [ 1625.047680][T13807] usb 2-1: USB disconnect, device number 4 [ 1625.316696][T25358] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5115'. [ 1625.401026][ T5871] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 1625.521006][ T5872] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 1625.570800][ T5871] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1625.613885][ T5871] usb 5-1: config 160 has an invalid interface number: 186 but max is 0 [ 1625.689710][ T5872] usb 7-1: device descriptor read/64, error -71 [ 1625.696944][ T5871] usb 5-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1625.708397][ T5871] usb 5-1: config 160 has no interface number 0 [ 1625.715599][ T5871] usb 5-1: config 160 interface 186 has no altsetting 0 [ 1625.725278][ T5871] usb 5-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1625.755241][ T5871] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1625.768097][ T5871] usb 5-1: Product: syz [ 1625.768116][ T30] audit: type=1326 audit(1760294531.341:1133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25359 comm="syz.5.5116" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc3cb38eec9 code=0x0 [ 1625.775180][ T5871] usb 5-1: Manufacturer: syz [ 1625.795868][ C1] vkms_vblank_simulate: vblank timer overrun [ 1625.851505][ T5871] usb 5-1: SerialNumber: syz [ 1625.991016][ T5872] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 1626.264364][ T5872] usb 7-1: device descriptor read/64, error -71 [ 1626.287519][ T5871] usb 5-1: USB disconnect, device number 44 [ 1626.391642][ T5872] usb usb7-port1: attempt power cycle [ 1626.840883][ T5872] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 1626.881788][ T5872] usb 7-1: device descriptor read/8, error -71 [ 1627.140984][ T5872] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 1627.191509][ T5872] usb 7-1: device descriptor read/8, error -71 [ 1627.366755][ T5872] usb usb7-port1: unable to enumerate USB device [ 1627.670967][ T5872] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 1627.902489][ T5872] usb 5-1: Using ep0 maxpacket: 8 [ 1627.902594][ T30] audit: type=1326 audit(1760294533.451:1134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25390 comm="syz.2.5125" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3261d8eec9 code=0x0 [ 1628.353855][ T5872] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1628.376953][ T5872] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1628.411964][ T5872] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1628.437886][ T5872] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1628.468217][ T5872] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1628.487999][ T5872] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1628.714056][T25407] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5131'. [ 1628.830983][ T5872] usb 5-1: usb_control_msg returned -32 [ 1628.836623][ T5872] usbtmc 5-1:16.0: can't read capabilities [ 1628.855004][T25408] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5129'. [ 1629.396309][ T5872] usb 5-1: USB disconnect, device number 45 [ 1630.234288][T25428] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5137'. [ 1631.947945][T25452] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5145'. [ 1634.211627][T25490] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5156'. [ 1634.313182][T25491] hub 2-0:1.0: USB hub found [ 1634.319269][T25491] hub 2-0:1.0: 1 port detected [ 1636.980520][T25508] netlink: 20 bytes leftover after parsing attributes in process `syz.6.5158'. [ 1637.277371][T25518] syz.1.5162: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1637.277533][T25518] CPU: 1 UID: 0 PID: 25518 Comm: syz.1.5162 Not tainted syzkaller #0 PREEMPT(full) [ 1637.277555][T25518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1637.277566][T25518] Call Trace: [ 1637.277572][T25518] [ 1637.277580][T25518] dump_stack_lvl+0x16c/0x1f0 [ 1637.277606][T25518] warn_alloc+0x248/0x3a0 [ 1637.277631][T25518] ? __pfx_warn_alloc+0x10/0x10 [ 1637.277651][T25518] ? __pfx_stack_trace_save+0x10/0x10 [ 1637.277680][T25518] ? kasan_save_stack+0x42/0x60 [ 1637.277701][T25518] ? kasan_save_stack+0x33/0x60 [ 1637.277722][T25518] ? kasan_save_track+0x14/0x30 [ 1637.277744][T25518] ? xskq_create+0x52/0x1d0 [ 1637.277758][T25518] ? xsk_setsockopt+0x74e/0x9a0 [ 1637.277782][T25518] ? do_sock_setsockopt+0xf3/0x1d0 [ 1637.277807][T25518] ? xskq_create+0xfb/0x1d0 [ 1637.277823][T25518] __vmalloc_node_range_noprof+0xfbc/0x1480 [ 1637.277861][T25518] ? xskq_create+0xfb/0x1d0 [ 1637.277884][T25518] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1637.277923][T25518] ? xskq_create+0xfb/0x1d0 [ 1637.277939][T25518] vmalloc_user_noprof+0x9e/0xe0 [ 1637.277967][T25518] ? xskq_create+0xfb/0x1d0 [ 1637.277985][T25518] xskq_create+0xfb/0x1d0 [ 1637.278004][T25518] xsk_setsockopt+0x74e/0x9a0 [ 1637.278032][T25518] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1637.278058][T25518] ? find_held_lock+0x2b/0x80 [ 1637.278087][T25518] ? selinux_socket_setsockopt+0x6a/0x80 [ 1637.278112][T25518] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1637.278142][T25518] do_sock_setsockopt+0xf3/0x1d0 [ 1637.278171][T25518] __sys_setsockopt+0x1a0/0x230 [ 1637.278198][T25518] __x64_sys_setsockopt+0xbd/0x160 [ 1637.278218][T25518] ? do_syscall_64+0x91/0xfa0 [ 1637.278240][T25518] ? lockdep_hardirqs_on+0x7c/0x110 [ 1637.278262][T25518] do_syscall_64+0xcd/0xfa0 [ 1637.278285][T25518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1637.278303][T25518] RIP: 0033:0x7fe50eb8eec9 [ 1637.278318][T25518] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1637.278335][T25518] RSP: 002b:00007fe50f95c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1637.278352][T25518] RAX: ffffffffffffffda RBX: 00007fe50ede6090 RCX: 00007fe50eb8eec9 [ 1637.278364][T25518] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 1637.278375][T25518] RBP: 00007fe50ec11f91 R08: 0000000000000004 R09: 0000000000000000 [ 1637.278386][T25518] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1637.278397][T25518] R13: 00007fe50ede6128 R14: 00007fe50ede6090 R15: 00007fff1c2463d8 [ 1637.278423][T25518] [ 1637.278451][T25518] Mem-Info: [ 1637.278460][T25518] active_anon:36693 inactive_anon:0 isolated_anon:0 [ 1637.278460][T25518] active_file:5332 inactive_file:58179 isolated_file:0 [ 1637.278460][T25518] unevictable:768 dirty:467 writeback:0 [ 1637.278460][T25518] slab_reclaimable:12764 slab_unreclaimable:104991 [ 1637.278460][T25518] mapped:31849 shmem:26485 pagetables:1709 [ 1637.278460][T25518] sec_pagetables:0 bounce:0 [ 1637.278460][T25518] kernel_misc_reclaimable:0 [ 1637.278460][T25518] free:1238425 free_pcp:24866 free_cma:0 [ 1637.278508][T25518] Node 0 active_anon:146772kB inactive_anon:0kB active_file:21328kB inactive_file:232496kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:127384kB dirty:1868kB writeback:0kB shmem:104404kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13308kB pagetables:6688kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1637.278557][T25518] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:12kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1637.278599][T25518] Node 0 DMA free:15344kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:0kB free_cma:0kB [ 1637.278651][T25518] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 1637.278690][T25518] Node 0 DMA32 free:1076800kB boost:0kB min:34092kB low:42612kB high:51132kB reserved_highatomic:0KB free_highatomic:0KB active_anon:146772kB inactive_anon:0kB active_file:21328kB inactive_file:232496kB unevictable:1536kB writepending:1868kB zspages:0kB present:3129332kB managed:2541344kB mlocked:0kB bounce:0kB free_pcp:50056kB local_pcp:36964kB free_cma:0kB [ 1637.278745][T25518] lowmem_reserve[]: 0 0 1 1 1 [ 1637.278781][T25518] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1637.278833][T25518] lowmem_reserve[]: 0 0 0 0 0 [ 1637.278870][T25518] Node 1 Normal free:3861556kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:49392kB local_pcp:22336kB free_cma:0kB [ 1637.278923][T25518] lowmem_reserve[]: 0 0 0 0 0 [ 1637.278960][T25518] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15344kB [ 1637.279112][T25518] Node 0 DMA32: 4642*4kB (UME) 431*8kB (UME) 223*16kB (UME) 489*32kB (UME) 197*64kB (UME) 482*128kB (UME) 293*256kB (UME) 113*512kB (UME) 33*1024kB (UME) 8*2048kB (UME) 190*4096kB (M) = 1076816kB [ 1637.279283][T25518] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1637.279381][T25518] Node 1 Normal: 4*4kB (UE) 7*8kB (UE) 10*16kB (UME) 8*32kB (UME) 8*64kB (UME) 7*128kB (UME) 3*256kB (UME) 3*512kB (UM) 3*1024kB (UM) 2*2048kB (ME) 940*4096kB (M) = 3861608kB [ 1637.279571][T25518] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1637.279586][T25518] Node 0 hugepages_total=1 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1637.279601][T25518] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1637.279616][T25518] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1637.279630][T25518] 89992 total pagecache pages [ 1637.279638][T25518] 0 pages in swap cache [ 1637.279645][T25518] Free swap = 124996kB [ 1637.279653][T25518] Total swap = 124996kB [ 1637.279661][T25518] 2097051 pages RAM [ 1637.279668][T25518] 0 pages HighMem/MovableOnly [ 1637.279675][T25518] 429689 pages reserved [ 1637.279683][T25518] 0 pages cma reserved [ 1638.503224][T13807] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1638.703994][T13807] usb 6-1: Using ep0 maxpacket: 8 [ 1638.705767][T13807] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1638.705788][T13807] usb 6-1: config 0 has no interfaces? [ 1638.705804][T13807] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1638.705817][T13807] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1638.707280][T13807] usb 6-1: config 0 descriptor?? [ 1639.316799][T25553] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5175'. [ 1640.521039][ T5920] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 1640.670998][T23447] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1640.682343][ T5920] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1640.691146][ T5920] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1640.701389][ T5920] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1640.711207][ T5920] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1640.722729][ T5920] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1640.735961][ T5920] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1640.745787][ T5920] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1640.754318][ T5920] usb 5-1: Product: syz [ 1640.759363][ T5920] usb 5-1: Manufacturer: syz [ 1640.768307][ T5920] cdc_wdm 5-1:1.0: skipping garbage [ 1640.774448][ T5920] cdc_wdm 5-1:1.0: skipping garbage [ 1640.782805][ T5920] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 1640.788833][ T5920] cdc_wdm 5-1:1.0: Unknown control protocol [ 1640.825048][T23447] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1640.858674][T23447] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1640.876019][T23447] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1640.886039][T23447] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1640.894802][T23447] usb 2-1: Manufacturer: syz [ 1640.909207][T23447] usb 2-1: config 0 descriptor?? [ 1640.921808][T23447] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1641.242384][T23447] usb 6-1: USB disconnect, device number 107 [ 1642.100986][T23447] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 1642.660369][T23447] usb 7-1: Using ep0 maxpacket: 8 [ 1642.666996][T23447] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1642.678505][T23447] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1642.687983][T23447] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1642.698172][T23447] usb 7-1: config 0 descriptor?? [ 1642.912553][T23447] iowarrior 7-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior1 [ 1642.931114][ T5872] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1643.101047][ T5872] usb 6-1: Using ep0 maxpacket: 8 [ 1643.111576][ T5872] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1643.124253][ T5872] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1643.135241][ T5872] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1643.147906][ T5920] usb 7-1: USB disconnect, device number 53 [ 1643.187869][ T5872] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1643.208524][ T5872] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1643.218802][ T5872] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1643.421683][ T5871] usb 5-1: USB disconnect, device number 46 [ 1643.476419][ T5920] usb 2-1: USB disconnect, device number 5 [ 1643.718866][ T5872] usb 6-1: usb_control_msg returned -32 [ 1643.749686][ T5872] usbtmc 6-1:16.0: can't read capabilities [ 1643.873581][ T5872] usb 6-1: USB disconnect, device number 108 [ 1668.343550][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1712.342082][T25639] warn_alloc: 1 callbacks suppressed [ 1712.342099][T25639] syz.6.5199: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1712.342162][T25639] CPU: 0 UID: 0 PID: 25639 Comm: syz.6.5199 Not tainted syzkaller #0 PREEMPT(full) [ 1712.342186][T25639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1712.342198][T25639] Call Trace: [ 1712.342205][T25639] [ 1712.342213][T25639] dump_stack_lvl+0x16c/0x1f0 [ 1712.342242][T25639] warn_alloc+0x248/0x3a0 [ 1712.342276][T25639] ? __pfx_warn_alloc+0x10/0x10 [ 1712.342297][T25639] ? __pfx_stack_trace_save+0x10/0x10 [ 1712.342328][T25639] ? kasan_save_stack+0x42/0x60 [ 1712.342353][T25639] ? kasan_save_stack+0x33/0x60 [ 1712.342376][T25639] ? kasan_save_track+0x14/0x30 [ 1712.342401][T25639] ? xskq_create+0x52/0x1d0 [ 1712.342416][T25639] ? xsk_setsockopt+0x74e/0x9a0 [ 1712.342440][T25639] ? do_sock_setsockopt+0xf3/0x1d0 [ 1712.342468][T25639] ? xskq_create+0xfb/0x1d0 [ 1712.342486][T25639] __vmalloc_node_range_noprof+0xfbc/0x1480 [ 1712.342526][T25639] ? xskq_create+0xfb/0x1d0 [ 1712.342550][T25639] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1712.342590][T25639] ? xskq_create+0xfb/0x1d0 [ 1712.342607][T25639] vmalloc_user_noprof+0x9e/0xe0 [ 1712.342637][T25639] ? xskq_create+0xfb/0x1d0 [ 1712.342655][T25639] xskq_create+0xfb/0x1d0 [ 1712.342675][T25639] xsk_setsockopt+0x74e/0x9a0 [ 1712.342704][T25639] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1712.342741][T25639] ? find_held_lock+0x2b/0x80 [ 1712.342766][T25639] ? selinux_socket_setsockopt+0x6a/0x80 [ 1712.342792][T25639] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1712.342823][T25639] do_sock_setsockopt+0xf3/0x1d0 [ 1712.342853][T25639] __sys_setsockopt+0x1a0/0x230 [ 1712.342880][T25639] __x64_sys_setsockopt+0xbd/0x160 [ 1712.342901][T25639] ? do_syscall_64+0x91/0xfa0 [ 1712.342923][T25639] ? lockdep_hardirqs_on+0x7c/0x110 [ 1712.342945][T25639] do_syscall_64+0xcd/0xfa0 [ 1712.342970][T25639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1712.342989][T25639] RIP: 0033:0x7f662338eec9 [ 1712.343005][T25639] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1712.343022][T25639] RSP: 002b:00007f6624267038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1712.343041][T25639] RAX: ffffffffffffffda RBX: 00007f66235e6090 RCX: 00007f662338eec9 [ 1712.343053][T25639] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 1712.343064][T25639] RBP: 00007f6623411f91 R08: 0000000000000004 R09: 0000000000000000 [ 1712.343075][T25639] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1712.343087][T25639] R13: 00007f66235e6128 R14: 00007f66235e6090 R15: 00007ffc80434bd8 [ 1712.343114][T25639] [ 1712.343122][T25639] Mem-Info: [ 1712.343130][T25639] active_anon:32290 inactive_anon:0 isolated_anon:0 [ 1712.343130][T25639] active_file:5332 inactive_file:58183 isolated_file:0 [ 1712.343130][T25639] unevictable:768 dirty:50 writeback:0 [ 1712.343130][T25639] slab_reclaimable:12586 slab_unreclaimable:111707 [ 1712.343130][T25639] mapped:31823 shmem:26465 pagetables:1545 [ 1712.343130][T25639] sec_pagetables:0 bounce:0 [ 1712.343130][T25639] kernel_misc_reclaimable:0 [ 1712.343130][T25639] free:1243186 free_pcp:17998 free_cma:0 [ 1712.343178][T25639] Node 0 active_anon:129160kB inactive_anon:0kB active_file:21328kB inactive_file:232512kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:127292kB dirty:200kB writeback:0kB shmem:104324kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13144kB pagetables:6032kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1712.343223][T25639] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1712.343272][T25639] Node 0 DMA free:15344kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:16kB free_cma:0kB [ 1712.343328][T25639] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 1712.343368][T25639] Node 0 DMA32 free:1083696kB boost:0kB min:34092kB low:42612kB high:51132kB reserved_highatomic:0KB free_highatomic:0KB active_anon:129160kB inactive_anon:0kB active_file:21328kB inactive_file:232512kB unevictable:1536kB writepending:200kB zspages:0kB present:3129332kB managed:2541344kB mlocked:0kB bounce:0kB free_pcp:34680kB local_pcp:17380kB free_cma:0kB [ 1712.343425][T25639] lowmem_reserve[]: 0 0 1 1 1 [ 1712.343463][T25639] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1712.343514][T25639] lowmem_reserve[]: 0 0 0 0 0 [ 1712.343550][T25639] Node 1 Normal free:3873704kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:37296kB local_pcp:21144kB free_cma:0kB [ 1712.343601][T25639] lowmem_reserve[]: 0 0 0 0 0 [ 1712.343639][T25639] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15344kB [ 1712.343792][T25639] Node 0 DMA32: 5991*4kB (UME) 1866*8kB (UME) 837*16kB (UME) 3239*32kB (UME) 964*64kB (UME) 234*128kB (UME) 68*256kB (UME) 35*512kB (UME) 10*1024kB (ME) 6*2048kB (UME) 190*4096kB (M) = 1083676kB [ 1712.343963][T25639] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1712.344064][T25639] Node 1 Normal: 142*4kB (UME) 10*8kB (UE) 14*16kB (UME) 80*32kB (UME) 25*64kB (UME) 8*128kB (UME) 2*256kB (UE) 3*512kB (UM) 3*1024kB (UM) 4*2048kB (UME) 941*4096kB (UM) = 3873704kB [ 1712.344230][T25639] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1712.344247][T25639] Node 0 hugepages_total=1 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1712.344268][T25639] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1712.344284][T25639] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1712.344300][T25639] 89976 total pagecache pages [ 1712.344307][T25639] 0 pages in swap cache [ 1712.344315][T25639] Free swap = 124996kB [ 1712.344322][T25639] Total swap = 124996kB [ 1712.344330][T25639] 2097051 pages RAM [ 1712.344338][T25639] 0 pages HighMem/MovableOnly [ 1712.344345][T25639] 429689 pages reserved [ 1712.344352][T25639] 0 pages cma reserved [ 1712.414070][ T30] audit: type=1326 audit(1760294617.981:1135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=25627 comm="syz.5.5196" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc3cb38eec9 code=0x0 [ 1712.664565][T25649] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5202'. [ 1716.409732][T25702] netlink: 4676 bytes leftover after parsing attributes in process `syz.5.5217'. [ 1716.409749][T25702] openvswitch: netlink: Flow key attr not present in new flow. [ 1716.505245][T25705] binder: 25704:25705 ioctl 4018620d 0 returned -22 [ 1719.005555][T25759] netlink: 4676 bytes leftover after parsing attributes in process `syz.6.5228'. [ 1719.072574][T25759] openvswitch: netlink: Flow key attr not present in new flow. [ 1719.318697][T25766] netlink: 'syz.4.5229': attribute type 1 has an invalid length. [ 1719.332904][T25766] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5229'. [ 1720.140993][T25776] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5231'. [ 1722.935074][T25802] mkiss: ax0: crc mode is auto. [ 1723.078746][T25809] binder: 25808:25809 ioctl c0306201 0 returned -14 [ 1723.474452][T25818] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 1723.480986][T25818] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1723.504195][T25818] vhci_hcd vhci_hcd.0: Device attached [ 1723.736186][ T5872] vhci_hcd: vhci_device speed not set [ 1723.801817][T25825] hub 2-0:1.0: USB hub found [ 1723.807502][T25825] hub 2-0:1.0: 1 port detected [ 1724.211280][ T5872] usb 35-1: new full-speed USB device number 2 using vhci_hcd [ 1724.471070][ T5920] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1724.537370][T25837] netlink: 'syz.5.5244': attribute type 1 has an invalid length. [ 1724.546440][T25837] netlink: 224 bytes leftover after parsing attributes in process `syz.5.5244'. [ 1724.621002][ T5920] usb 2-1: Using ep0 maxpacket: 8 [ 1724.627975][ T5920] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 1724.654758][ T5920] usb 2-1: config 179 has no interface number 0 [ 1724.672642][ T5920] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1724.698979][ T5920] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1724.729768][ T5920] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1724.755362][ T5920] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1724.786373][ T5920] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1724.819739][ T5920] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1724.845289][ T5920] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1724.868454][T25827] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1725.105437][ T5920] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input104 [ 1725.464859][ C1] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1725.473169][ C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1725.485329][T25819] vhci_hcd: connection reset by peer [ 1726.399231][ T5920] usb 2-1: USB disconnect, device number 6 [ 1726.412292][ T3565] vhci_hcd: stop threads [ 1726.419094][ T3565] vhci_hcd: release socket [ 1726.451023][ T3565] vhci_hcd: disconnect device [ 1726.947865][T25856] fuse: Bad value for 'rootmode' [ 1727.360468][ T5955] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 1727.400010][T25864] binder: 25861:25864 ioctl c0306201 0 returned -14 [ 1727.568631][ T5955] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1727.591388][ T5955] usb 5-1: config 160 has an invalid interface number: 186 but max is 0 [ 1727.640231][ T5955] usb 5-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1727.682483][ T5955] usb 5-1: config 160 has no interface number 0 [ 1727.700869][ T5955] usb 5-1: config 160 interface 186 has no altsetting 0 [ 1727.741073][ T5955] usb 5-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1727.750201][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1727.769832][ T5955] usb 5-1: Product: syz [ 1727.792024][ T5955] usb 5-1: Manufacturer: syz [ 1727.815605][ T5955] usb 5-1: SerialNumber: syz [ 1728.259073][ T5955] usb 5-1: USB disconnect, device number 47 [ 1729.321152][ T5872] vhci_hcd: vhci_device speed not set [ 1729.797812][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1732.015984][ T5872] usb 7-1: new full-speed USB device number 54 using dummy_hcd [ 1732.291284][ T5920] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 1733.492879][ T5955] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1733.898411][ T5920] usb 2-1: config 0 has an invalid interface number: 160 but max is 0 [ 1733.972471][ T5920] usb 2-1: config 0 has no interface number 0 [ 1733.977884][ T5955] usb 6-1: Using ep0 maxpacket: 8 [ 1733.987122][ T5920] usb 2-1: config 0 interface 160 has no altsetting 0 [ 1734.008032][ T5955] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1734.037751][ T5955] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1734.038539][ T5920] usb 2-1: New USB device found, idVendor=a6da, idProduct=1e78, bcdDevice=56.e4 [ 1734.056446][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1734.065503][ T5955] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1734.074442][ T5920] usb 2-1: Product: syz [ 1734.079070][ T5920] usb 2-1: Manufacturer: syz [ 1734.107038][ T5920] usb 2-1: SerialNumber: syz [ 1734.271162][ T5920] usb 2-1: config 0 descriptor?? [ 1734.292645][ T5955] usb 6-1: config 0 descriptor?? [ 1734.292766][ T5920] usb-storage 2-1:0.160: USB Mass Storage device detected [ 1734.549611][ T5955] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 1734.638251][T25946] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 1734.644776][T25946] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1734.654054][T25946] vhci_hcd vhci_hcd.0: Device attached [ 1734.664226][T25947] vhci_hcd: connection closed [ 1734.664439][ T3565] vhci_hcd: stop threads [ 1734.676005][ T3565] vhci_hcd: release socket [ 1734.688490][ T3565] vhci_hcd: disconnect device [ 1734.748047][T23447] usb 2-1: USB disconnect, device number 7 [ 1734.764003][T13807] usb 6-1: USB disconnect, device number 109 [ 1735.252146][ T5872] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 1735.420940][ T5872] usb 7-1: Using ep0 maxpacket: 8 [ 1735.427459][ T5872] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 1735.439703][ T5872] usb 7-1: config 179 has no interface number 0 [ 1735.458948][ T5872] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1735.530839][ T5872] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1735.878541][ T5872] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1735.924088][ T5872] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1735.976625][ T5872] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1736.091331][ T5872] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1736.114533][ T5872] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1736.142480][T25946] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1736.483497][ T5920] input: Generic X-Box pad as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:179.65/input/input105 [ 1737.403738][ T5955] usb 7-1: USB disconnect, device number 55 [ 1737.403776][ C1] xpad 7-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1737.418945][ C1] dummy_hcd dummy_hcd.6: timer fired with no URBs pending? [ 1737.597896][T25984] fuse: Bad value for 'rootmode' [ 1738.141112][ T5955] usb 7-1: new high-speed USB device number 56 using dummy_hcd [ 1738.178492][T25992] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5291'. [ 1738.281078][T13807] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1738.393650][ T5955] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1738.412274][ T5955] usb 7-1: config 160 has an invalid interface number: 186 but max is 0 [ 1738.422978][ T5955] usb 7-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1738.434930][ T5955] usb 7-1: config 160 has no interface number 0 [ 1738.441678][ T5955] usb 7-1: config 160 interface 186 has no altsetting 0 [ 1738.453274][ T5955] usb 7-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1738.463534][ T5955] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1738.473007][ T5955] usb 7-1: Product: syz [ 1738.479299][ T5955] usb 7-1: Manufacturer: syz [ 1738.484517][ T5955] usb 7-1: SerialNumber: syz [ 1738.570981][T13807] usb 2-1: Using ep0 maxpacket: 32 [ 1738.580094][T13807] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1738.604359][T13807] usb 2-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1738.626299][T13807] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1738.664699][T13807] usb 2-1: config 0 descriptor?? [ 1738.843686][ T5955] usb 7-1: USB disconnect, device number 56 [ 1738.952541][T25999] usb 2-1: USB disconnect, device number 8 [ 1739.335103][T26000] hub 2-0:1.0: USB hub found [ 1739.339948][T26000] hub 2-0:1.0: 1 port detected [ 1740.458764][ T30] audit: type=1326 audit(1760294645.951:1136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26018 comm="syz.6.5300" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f662338eec9 code=0x0 [ 1741.358658][T26041] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5307'. [ 1742.351694][ T5955] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1742.701729][ T5955] usb 6-1: Using ep0 maxpacket: 32 [ 1742.718924][ T5955] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1742.760494][ T5955] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1742.792989][ T5955] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1742.821626][ T5955] usb 6-1: config 0 descriptor?? [ 1743.051649][ T5955] usb 6-1: USB disconnect, device number 110 [ 1744.440027][T26080] vimc link validate: Scaler:src:16x16 (0x33424752, 0, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1744.481165][ T5920] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 1744.621019][ T5920] usb 2-1: device descriptor read/64, error -71 [ 1744.861517][ T5920] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 1745.003269][ T5920] usb 2-1: device descriptor read/64, error -71 [ 1745.126610][ T5920] usb usb2-port1: attempt power cycle [ 1745.340928][ T5955] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 1745.473996][ T5920] usb 2-1: new full-speed USB device number 12 using dummy_hcd [ 1745.490896][ T5955] usb 7-1: Using ep0 maxpacket: 16 [ 1745.501359][ T5920] usb 2-1: device descriptor read/8, error -71 [ 1745.501785][ T5955] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1745.534181][ T5955] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1745.553939][ T5955] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 1745.572412][ T5955] usb 7-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1745.610857][ T5955] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1745.619003][ T5955] usb 7-1: Product: syz [ 1745.623965][ T5955] usb 7-1: Manufacturer: syz [ 1745.628571][ T5955] usb 7-1: SerialNumber: syz [ 1745.738930][ T5955] usb 7-1: config 0 descriptor?? [ 1745.753953][T26079] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1745.761616][ T5920] usb 2-1: new full-speed USB device number 13 using dummy_hcd [ 1745.782203][ T5920] usb 2-1: device descriptor read/8, error -71 [ 1745.919293][ T5920] usb usb2-port1: unable to enumerate USB device [ 1746.154361][ T5955] mcba_usb 7-1:0.0 can0: failed tx_urb -90 [ 1746.163277][ T5955] mcba_usb 7-1:0.0 can0: Failed to send cmd (169) [ 1746.169732][ T5955] mcba_usb 7-1:0.0 can0: failed tx_urb -90 [ 1746.205575][ T5955] mcba_usb 7-1:0.0 can0: Failed to send cmd (169) [ 1746.232034][ T5955] mcba_usb 7-1:0.0: Microchip CAN BUS Analyzer connected [ 1746.279868][ T5955] usb 7-1: USB disconnect, device number 57 [ 1746.294131][ T5955] mcba_usb 7-1:0.0 can0: device disconnected [ 1747.202249][T26110] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5326'. [ 1747.772771][ T5955] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 1747.931024][ T5955] usb 7-1: Using ep0 maxpacket: 32 [ 1747.938291][ T5955] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1747.983908][ T5955] usb 7-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1747.993310][ T5955] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1748.003608][ T5955] usb 7-1: config 0 descriptor?? [ 1748.217088][ T5858] usb 7-1: USB disconnect, device number 58 [ 1748.270978][ T5955] usb 5-1: new full-speed USB device number 48 using dummy_hcd [ 1748.432606][ T5955] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1748.498165][ T5955] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1748.512196][ T5955] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1748.522113][ T5955] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1748.752032][ T5955] usb 5-1: usb_control_msg returned -32 [ 1748.765736][ T5955] usbtmc 5-1:16.0: can't read capabilities [ 1749.867805][ T30] audit: type=1326 audit(1760294655.421:1137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26123 comm="syz.2.5332" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3261d8eec9 code=0x0 [ 1750.686725][T26148] netlink: 'syz.1.5338': attribute type 1 has an invalid length. [ 1750.697165][T26148] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5338'. [ 1750.811044][T13807] usb 6-1: new full-speed USB device number 111 using dummy_hcd [ 1751.013337][T13807] usb 6-1: device descriptor read/64, error -71 [ 1751.070160][ T5858] usb 5-1: USB disconnect, device number 48 [ 1751.270961][T13807] usb 6-1: new full-speed USB device number 112 using dummy_hcd [ 1751.540952][ T5858] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 1751.591000][T13807] usb 6-1: device descriptor read/64, error -71 [ 1751.711235][ T5858] usb 5-1: Using ep0 maxpacket: 8 [ 1751.716744][T13807] usb usb6-port1: attempt power cycle [ 1751.726815][ T5858] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1751.735894][ T5858] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1751.756210][ T5858] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1751.811699][ T5858] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1751.832114][ T5858] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1751.856893][ T5858] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1751.866678][ T5858] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1752.171018][T13807] usb 6-1: new full-speed USB device number 113 using dummy_hcd [ 1752.217002][T13807] usb 6-1: device descriptor read/8, error -71 [ 1752.480921][T13807] usb 6-1: new full-speed USB device number 114 using dummy_hcd [ 1752.650909][T13807] usb 6-1: device descriptor read/8, error -71 [ 1752.790019][ T5858] usb 5-1: GET_CAPABILITIES returned 0 [ 1752.796383][ T5858] usbtmc 5-1:16.0: can't read capabilities [ 1752.908996][T13807] usb usb6-port1: unable to enumerate USB device [ 1753.187193][ T5872] usb 5-1: USB disconnect, device number 49 [ 1754.300929][ T5872] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1754.450948][ T5872] usb 2-1: Using ep0 maxpacket: 8 [ 1754.457648][ T5872] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1754.490991][ T5920] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 1754.719049][ T5872] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1754.771650][ T5920] usb 5-1: Using ep0 maxpacket: 8 [ 1754.786011][ T5872] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1754.796676][ T5920] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1754.829561][ T5920] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1754.886007][ T5920] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1754.929750][ T5920] usb 5-1: config 0 descriptor?? [ 1754.954924][ T5920] iowarrior 5-1:0.0: no interrupt-in endpoint found [ 1755.043454][T26219] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5356'. [ 1755.819545][T26246] overlayfs: missing 'lowerdir' [ 1756.995135][T23447] usb 2-1: USB disconnect, device number 14 [ 1757.251038][ T30] audit: type=1326 audit(1760294662.791:1138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26250 comm="syz.6.5360" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f662338eec9 code=0x0 [ 1757.416693][T13807] usb 5-1: USB disconnect, device number 50 [ 1759.252275][T26278] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5368'. [ 1759.561906][T26286] hub 2-0:1.0: USB hub found [ 1759.567860][T26286] hub 2-0:1.0: 1 port detected [ 1760.220417][T13807] usb 5-1: new full-speed USB device number 51 using dummy_hcd [ 1760.622984][T13807] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1760.643777][T13807] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1760.672311][T13807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1763.052295][T13807] usb 5-1: USB disconnect, device number 51 [ 1766.656897][T26378] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5395'. [ 1766.900999][ T5858] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1767.052843][ T5858] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1767.064215][ T5858] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1767.083700][ T5858] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 1767.104362][ T5858] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1767.113500][ T5858] usb 6-1: Manufacturer: syz [ 1767.125510][ T5858] usb 6-1: config 0 descriptor?? [ 1767.545355][ T5858] usbhid 6-1:0.0: can't add hid device: -71 [ 1767.554383][ T5858] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1767.582437][ T5858] usb 6-1: USB disconnect, device number 115 [ 1767.852952][T26407] fuse: Bad value for 'rootmode' [ 1768.071475][ T5920] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1768.210924][T13807] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 1768.230973][ T5920] usb 2-1: Using ep0 maxpacket: 32 [ 1768.237503][ T5920] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1768.259969][ T5920] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1768.278067][ T5920] usb 2-1: config 0 descriptor?? [ 1768.291037][ T5858] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 1768.372965][T13807] usb 7-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1768.387987][T13807] usb 7-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1768.419500][T13807] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1768.433714][T13807] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1768.470085][T13807] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1768.502337][ T5920] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1768.512399][ T5858] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1768.521355][ T5858] usb 5-1: config 160 has an invalid interface number: 186 but max is 0 [ 1768.529690][ T5858] usb 5-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1768.560929][T13807] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1768.571933][ T5920] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1768.580275][ T5858] usb 5-1: config 160 has no interface number 0 [ 1768.591227][T13807] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1768.599228][T13807] usb 7-1: Product: syz [ 1768.603795][ T5920] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1768.603836][ T5920] usb 2-1: media controller created [ 1768.621282][ T5858] usb 5-1: config 160 interface 186 has no altsetting 0 [ 1768.623937][ T5920] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1768.661366][T13807] usb 7-1: Manufacturer: syz [ 1768.676556][ T5858] usb 5-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1768.686570][ T5858] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1768.702849][ T5858] usb 5-1: Product: syz [ 1768.714876][T13807] cdc_wdm 7-1:1.0: skipping garbage [ 1768.720176][ T5858] usb 5-1: Manufacturer: syz [ 1768.725679][T13807] cdc_wdm 7-1:1.0: skipping garbage [ 1768.731731][ T5858] usb 5-1: SerialNumber: syz [ 1768.840835][T13807] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 1768.860193][T13807] cdc_wdm 7-1:1.0: Unknown control protocol [ 1769.391895][ T5858] usb 5-1: USB disconnect, device number 52 [ 1770.742450][ T5920] az6027: usb out operation failed. (-110) [ 1770.792103][ T5920] az6027: usb out operation failed. (-32) [ 1770.798841][ T5920] stb0899_attach: Driver disabled by Kconfig [ 1770.808021][ T5920] az6027: no front-end attached [ 1770.808021][ T5920] [ 1770.816494][ T5920] az6027: usb out operation failed. (-32) [ 1770.864548][ T5920] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1770.934134][T13807] usb 7-1: USB disconnect, device number 59 [ 1770.937682][ T5920] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input107 [ 1770.961704][ T5920] dvb-usb: schedule remote query interval to 400 msecs. [ 1770.968755][ T5920] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1771.024692][ T5920] usb 2-1: USB disconnect, device number 15 [ 1771.351723][ T5920] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1773.150917][T13807] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1773.978826][T13807] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1774.031040][T13807] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1774.127863][T26472] fuse: Bad value for 'rootmode' [ 1774.459323][T13807] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1774.474524][T13807] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1774.507266][T13807] usb 6-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1774.526653][T13807] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1774.550742][T13807] usb 6-1: Product: syz [ 1774.554938][T13807] usb 6-1: Manufacturer: syz [ 1774.580779][T13807] usb 6-1: SerialNumber: syz [ 1774.619324][T13807] usb 6-1: config 0 descriptor?? [ 1774.752474][T13807] ums-isd200 6-1:0.0: USB Mass Storage device detected [ 1774.790880][ T5955] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 1774.945295][ T5955] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1774.956317][ T5955] usb 5-1: config 160 has an invalid interface number: 186 but max is 0 [ 1774.965733][ T5955] usb 5-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1774.993374][ T5955] usb 5-1: config 160 has no interface number 0 [ 1775.007041][ T5955] usb 5-1: config 160 interface 186 has no altsetting 0 [ 1775.023053][ T5955] usb 5-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1775.033204][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1775.041763][ T5955] usb 5-1: Product: syz [ 1775.046095][ T5955] usb 5-1: Manufacturer: syz [ 1775.066310][ T5955] usb 5-1: SerialNumber: syz [ 1775.106850][T13807] scsi host1: usb-storage 6-1:0.0 [ 1775.118840][T13807] usb 6-1: USB disconnect, device number 116 [ 1775.336418][ T5955] usb 5-1: USB disconnect, device number 53 [ 1775.839906][T26503] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5429'. [ 1776.014732][T26508] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5431'. [ 1776.110981][ T5955] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1776.271503][ T5955] usb 5-1: Using ep0 maxpacket: 8 [ 1776.287694][ T5955] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1776.309773][ T5955] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1776.330920][ T5955] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1776.341767][ T5955] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1776.355330][ T5955] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1776.365824][ T5955] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1776.611091][ T5955] usb 5-1: GET_CAPABILITIES returned 0 [ 1776.640808][ T5955] usbtmc 5-1:16.0: can't read capabilities [ 1776.722929][T26521] fuse: Bad value for 'fd' [ 1776.821515][ T5872] usb 5-1: USB disconnect, device number 54 [ 1777.435106][T26536] vimc link validate: Scaler:src:16x16 (0x33424752, 0, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1778.638746][T26550] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5442'. [ 1781.719938][T26575] hub 2-0:1.0: USB hub found [ 1781.726619][T26575] hub 2-0:1.0: 1 port detected [ 1782.665414][T26582] hub 2-0:1.0: USB hub found [ 1782.671619][T26582] hub 2-0:1.0: 1 port detected [ 1784.679239][T26601] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1784.689469][T26601] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1786.151852][T26620] netlink: 'syz.4.5460': attribute type 1 has an invalid length. [ 1786.159610][T26620] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5460'. [ 1786.633261][ T5955] usb 2-1: new full-speed USB device number 16 using dummy_hcd [ 1787.011000][T13807] usb 5-1: new full-speed USB device number 55 using dummy_hcd [ 1787.042916][ C0] raw-gadget.1 gadget.4: ignoring, device is not running [ 1787.257512][T13807] usb 5-1: device descriptor read/64, error -32 [ 1787.740979][T13807] usb 5-1: new full-speed USB device number 56 using dummy_hcd [ 1788.200817][ T5920] usb 6-1: new high-speed USB device number 117 using dummy_hcd [ 1788.353339][ T5920] usb 6-1: Using ep0 maxpacket: 8 [ 1788.360522][ T5920] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1788.372456][ T5920] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1788.391139][ T5920] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1788.413272][ T5920] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1788.438657][ T5920] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1788.454000][ T5920] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1788.714370][ T5920] usb 6-1: GET_CAPABILITIES returned 0 [ 1788.719901][ T5920] usbtmc 6-1:16.0: can't read capabilities [ 1789.368163][T13807] usb 5-1: device descriptor read/all, error -71 [ 1789.381224][T13807] usb usb5-port1: attempt power cycle [ 1789.391388][T23447] usb 6-1: USB disconnect, device number 117 [ 1789.735249][ T30] audit: type=1326 audit(1760294695.311:1139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26651 comm="syz.4.5467" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f93de78eec9 code=0x0 [ 1790.455604][T26660] fuse: Bad value for 'rootmode' [ 1791.224526][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1791.260330][ T5955] usb 6-1: new full-speed USB device number 118 using dummy_hcd [ 1791.992171][ T5955] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1792.092458][ T5955] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1792.279217][ T5955] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1792.315282][ T5955] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1792.743019][ T30] audit: type=1326 audit(1760294698.291:1140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=26684 comm="syz.4.5475" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f93de78eec9 code=0x0 [ 1792.746714][ T5955] usb 6-1: usb_control_msg returned -32 [ 1792.842087][ T5955] usbtmc 6-1:16.0: can't read capabilities [ 1793.097453][ T5955] usb 6-1: USB disconnect, device number 118 [ 1793.823673][T26705] netlink: 'syz.4.5480': attribute type 10 has an invalid length. [ 1797.061266][T26744] warn_alloc: 1 callbacks suppressed [ 1797.061277][T26744] syz.6.5492: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1797.061318][T26744] CPU: 1 UID: 0 PID: 26744 Comm: syz.6.5492 Not tainted syzkaller #0 PREEMPT(full) [ 1797.061332][T26744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1797.061339][T26744] Call Trace: [ 1797.061343][T26744] [ 1797.061349][T26744] dump_stack_lvl+0x16c/0x1f0 [ 1797.061367][T26744] warn_alloc+0x248/0x3a0 [ 1797.061385][T26744] ? __pfx_warn_alloc+0x10/0x10 [ 1797.061397][T26744] ? __pfx_stack_trace_save+0x10/0x10 [ 1797.061415][T26744] ? kasan_save_stack+0x42/0x60 [ 1797.061430][T26744] ? kasan_save_stack+0x33/0x60 [ 1797.061443][T26744] ? kasan_save_track+0x14/0x30 [ 1797.061458][T26744] ? xskq_create+0x52/0x1d0 [ 1797.061467][T26744] ? xsk_setsockopt+0x74e/0x9a0 [ 1797.061483][T26744] ? do_sock_setsockopt+0xf3/0x1d0 [ 1797.061500][T26744] ? xskq_create+0xfb/0x1d0 [ 1797.061510][T26744] __vmalloc_node_range_noprof+0xfbc/0x1480 [ 1797.061533][T26744] ? xskq_create+0xfb/0x1d0 [ 1797.061547][T26744] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1797.061569][T26744] ? xskq_create+0xfb/0x1d0 [ 1797.061579][T26744] vmalloc_user_noprof+0x9e/0xe0 [ 1797.061596][T26744] ? xskq_create+0xfb/0x1d0 [ 1797.061606][T26744] xskq_create+0xfb/0x1d0 [ 1797.061617][T26744] xsk_setsockopt+0x74e/0x9a0 [ 1797.061634][T26744] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1797.061651][T26744] ? find_held_lock+0x2b/0x80 [ 1797.061664][T26744] ? selinux_socket_setsockopt+0x6a/0x80 [ 1797.061678][T26744] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1797.061695][T26744] do_sock_setsockopt+0xf3/0x1d0 [ 1797.061712][T26744] __sys_setsockopt+0x1a0/0x230 [ 1797.061726][T26744] __x64_sys_setsockopt+0xbd/0x160 [ 1797.061737][T26744] ? do_syscall_64+0x91/0xfa0 [ 1797.061750][T26744] ? lockdep_hardirqs_on+0x7c/0x110 [ 1797.061763][T26744] do_syscall_64+0xcd/0xfa0 [ 1797.061776][T26744] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1797.061787][T26744] RIP: 0033:0x7f662338eec9 [ 1797.061796][T26744] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1797.061807][T26744] RSP: 002b:00007f6624267038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1797.061817][T26744] RAX: ffffffffffffffda RBX: 00007f66235e6090 RCX: 00007f662338eec9 [ 1797.061824][T26744] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 1797.061830][T26744] RBP: 00007f6623411f91 R08: 0000000000000004 R09: 0000000000000000 [ 1797.061837][T26744] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1797.061843][T26744] R13: 00007f66235e6128 R14: 00007f66235e6090 R15: 00007ffc80434bd8 [ 1797.061858][T26744] [ 1797.061876][T26744] Mem-Info: [ 1797.061882][T26744] active_anon:37442 inactive_anon:0 isolated_anon:0 [ 1797.061882][T26744] active_file:5332 inactive_file:58215 isolated_file:0 [ 1797.061882][T26744] unevictable:768 dirty:398 writeback:0 [ 1797.061882][T26744] slab_reclaimable:12606 slab_unreclaimable:105552 [ 1797.061882][T26744] mapped:35483 shmem:29340 pagetables:1679 [ 1797.061882][T26744] sec_pagetables:0 bounce:0 [ 1797.061882][T26744] kernel_misc_reclaimable:0 [ 1797.061882][T26744] free:1244484 free_pcp:15887 free_cma:0 [ 1797.061912][T26744] Node 0 active_anon:149768kB inactive_anon:0kB active_file:21328kB inactive_file:232640kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:141920kB dirty:1592kB writeback:0kB shmem:115824kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13572kB pagetables:6556kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1797.061941][T26744] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:12kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:160kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1797.061969][T26744] Node 0 DMA free:15344kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:0kB free_cma:0kB [ 1797.062004][T26744] lowmem_reserve[]: 0 2481 2483 2483 2483 [ 1797.062027][T26744] Node 0 DMA32 free:1080320kB boost:0kB min:34092kB low:42612kB high:51132kB reserved_highatomic:0KB free_highatomic:0KB active_anon:149768kB inactive_anon:0kB active_file:21328kB inactive_file:232640kB unevictable:1536kB writepending:1592kB zspages:0kB present:3129332kB managed:2541344kB mlocked:0kB bounce:0kB free_pcp:34816kB local_pcp:13856kB free_cma:0kB [ 1797.062059][T26744] lowmem_reserve[]: 0 0 1 1 1 [ 1797.062080][T26744] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1797.062110][T26744] lowmem_reserve[]: 0 0 0 0 0 [ 1797.062131][T26744] Node 1 Normal free:3882272kB boost:0kB min:55784kB low:69728kB high:83672kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:220kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:28716kB local_pcp:12284kB free_cma:0kB [ 1797.062162][T26744] lowmem_reserve[]: 0 0 0 0 0 [ 1797.062191][T26744] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15344kB [ 1797.062531][T26744] Node 0 DMA32: 559*4kB (ME) 916*8kB (UM) 693*16kB (UME) 2909*32kB (UME) 984*64kB (UME) 451*128kB (UME) 96*256kB (UME) 38*512kB (UME) 11*1024kB (UME) 6*2048kB (UME) 190*4096kB (UM) = 1080268kB [ 1797.062709][T26744] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1797.062816][T26744] Node 1 Normal: 192*4kB (UME) 46*8kB (UME) 13*16kB (UME) 145*32kB (UME) 97*64kB (UME) 7*128kB (UME) 2*256kB (UE) 2*512kB (UM) 3*1024kB (UM) 3*2048kB (UME) 942*4096kB (UM) = 3882272kB [ 1797.062981][T26744] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1797.062995][T26744] Node 0 hugepages_total=1 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1797.063010][T26744] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1797.063026][T26744] Node 1 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1797.063041][T26744] 92883 total pagecache pages [ 1797.063049][T26744] 0 pages in swap cache [ 1797.063056][T26744] Free swap = 124996kB [ 1797.063064][T26744] Total swap = 124996kB [ 1797.063072][T26744] 2097051 pages RAM [ 1797.063079][T26744] 0 pages HighMem/MovableOnly [ 1797.063087][T26744] 429689 pages reserved [ 1797.063094][T26744] 0 pages cma reserved [ 1797.851076][ T5858] usb 6-1: new high-speed USB device number 119 using dummy_hcd [ 1798.010916][ T5858] usb 6-1: Using ep0 maxpacket: 8 [ 1798.016636][ T5858] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1798.016691][ T5858] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1798.016742][ T5858] usb 6-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1798.016776][ T5858] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1798.016879][ T5858] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1798.016929][ T5858] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1798.088888][ T5858] usbtmc 6-1:16.0: bulk endpoints not found [ 1798.322296][ C0] vkms_vblank_simulate: vblank timer overrun [ 1798.354871][ C0] vkms_vblank_simulate: vblank timer overrun [ 1798.385875][ C0] vkms_vblank_simulate: vblank timer overrun [ 1798.463921][ C0] vkms_vblank_simulate: vblank timer overrun [ 1798.509920][ C0] vkms_vblank_simulate: vblank timer overrun [ 1798.548382][ C0] vkms_vblank_simulate: vblank timer overrun [ 1798.590664][ C0] vkms_vblank_simulate: vblank timer overrun [ 1800.540104][ T5872] usb 6-1: USB disconnect, device number 119 [ 1800.571047][ T5920] usb 5-1: new full-speed USB device number 58 using dummy_hcd [ 1800.793254][ T5920] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1800.849348][ T5920] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1800.900116][ T5920] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1800.927966][ T5920] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1801.008183][T26802] fuse: Unknown parameter '/dev/input/mouse#' [ 1801.111026][ T5858] usb 7-1: new full-speed USB device number 60 using dummy_hcd [ 1801.225682][ T5920] usb 5-1: usb_control_msg returned -32 [ 1801.232010][ T5920] usbtmc 5-1:16.0: can't read capabilities [ 1801.277470][ T5920] usb 5-1: USB disconnect, device number 58 [ 1801.312821][ T5858] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1801.334343][ T5858] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1801.473498][ T5858] usb 7-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1801.525357][ T5858] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1801.536614][ T5858] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1801.556356][ T5858] usbtmc 7-1:16.0: bulk endpoints not found [ 1801.789981][T26807] hub 2-0:1.0: USB hub found [ 1801.796695][T26807] hub 2-0:1.0: 1 port detected [ 1805.204135][ T5920] usb 7-1: USB disconnect, device number 60 [ 1805.668256][T26854] netlink: 'syz.2.5521': attribute type 10 has an invalid length. [ 1805.697803][T26854] veth0_vlan: left promiscuous mode [ 1805.708297][T26854] veth0_vlan: entered promiscuous mode [ 1805.953287][T26854] team0: Device veth0_vlan failed to register rx_handler [ 1806.201860][T26859] fuse: Unknown parameter '/dev/input/mouse#' [ 1808.430510][T26901] fuse: Bad value for 'rootmode' [ 1808.771160][ T5858] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1808.950291][ T5955] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 1808.968601][ T5858] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1808.999466][ T5858] usb 5-1: config 160 has an invalid interface number: 186 but max is 0 [ 1809.035759][ T5858] usb 5-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1809.050450][ T5858] usb 5-1: config 160 has no interface number 0 [ 1809.061908][ T5858] usb 5-1: config 160 interface 186 has no altsetting 0 [ 1809.079630][ T5858] usb 5-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1809.101397][ T5858] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1809.165997][ T5955] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1809.175642][ T5858] usb 5-1: Product: syz [ 1809.196165][ T5858] usb 5-1: Manufacturer: syz [ 1809.205898][ T5955] usb 2-1: config 160 has an invalid interface number: 186 but max is 0 [ 1809.220785][ T5858] usb 5-1: SerialNumber: syz [ 1809.230932][T13807] usb 7-1: new full-speed USB device number 61 using dummy_hcd [ 1809.239043][ T5955] usb 2-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1809.270962][ T5955] usb 2-1: config 160 has no interface number 0 [ 1809.300948][ T5955] usb 2-1: config 160 interface 186 has no altsetting 0 [ 1809.335013][ T5955] usb 2-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1809.363401][ T5955] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1809.399810][ T5955] usb 2-1: Product: syz [ 1809.412349][T13807] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1809.430765][ T5955] usb 2-1: Manufacturer: syz [ 1809.435392][ T5955] usb 2-1: SerialNumber: syz [ 1809.441343][T13807] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1809.500504][ T5858] usb 5-1: USB disconnect, device number 59 [ 1809.514050][T13807] usb 7-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1809.556199][T13807] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1809.566837][T13807] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1809.589463][T13807] usbtmc 7-1:16.0: bulk endpoints not found [ 1809.756381][ T5955] usb 2-1: USB disconnect, device number 17 [ 1811.925453][ T5858] usb 7-1: USB disconnect, device number 61 [ 1812.741582][T26955] fuse: Bad value for 'fd' [ 1813.884746][ T5858] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1814.128216][T26982] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(3) [ 1814.133439][ T5858] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1814.134742][T26982] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1814.154390][ T5858] usb 2-1: config 160 has an invalid interface number: 186 but max is 0 [ 1814.162929][ T5858] usb 2-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1814.174003][ T5858] usb 2-1: config 160 has no interface number 0 [ 1814.184560][ T5858] usb 2-1: config 160 interface 186 has no altsetting 0 [ 1814.192588][T26982] vhci_hcd vhci_hcd.0: Device attached [ 1814.205222][ T5858] usb 2-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1814.232444][ T5858] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1814.241599][ T5858] usb 2-1: Product: syz [ 1814.246144][ T5858] usb 2-1: Manufacturer: syz [ 1814.260049][ T5858] usb 2-1: SerialNumber: syz [ 1814.531740][ T5955] vhci_hcd: vhci_device speed not set [ 1814.627897][ T5955] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 1814.635843][T13807] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1814.680977][ T5858] usb 2-1: USB disconnect, device number 18 [ 1814.811005][T13807] usb 5-1: Using ep0 maxpacket: 8 [ 1814.830094][T13807] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 1814.875467][T13807] usb 5-1: config 179 has no interface number 0 [ 1814.899760][T13807] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1814.931875][T13807] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1814.944098][T13807] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1814.956360][T13807] usb 5-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1814.968989][T13807] usb 5-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1814.993280][T13807] usb 5-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1815.008640][T13807] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1815.078723][T26982] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1815.102667][T27002] netlink: 'syz.2.5551': attribute type 10 has an invalid length. [ 1815.111248][T27002] veth0_vlan: left promiscuous mode [ 1815.117429][T27002] veth0_vlan: entered promiscuous mode [ 1815.126875][T27002] team0: Device veth0_vlan failed to register rx_handler [ 1815.473057][T13807] input: Generic X-Box pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input108 [ 1815.666330][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1815.666337][ T5871] usb 5-1: USB disconnect, device number 60 [ 1815.705878][T26983] vhci_hcd: connection reset by peer [ 1815.713402][T13090] vhci_hcd: stop threads [ 1815.718178][T13090] vhci_hcd: release socket [ 1815.738594][T13090] vhci_hcd: disconnect device [ 1816.705967][ T30] audit: type=1326 audit(1760294722.141:1141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27019 comm="syz.6.5553" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f662338eec9 code=0x0 [ 1817.541710][ T5858] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 1817.718439][ T5858] usb 5-1: config 0 has an invalid interface number: 160 but max is 0 [ 1817.727300][ T5858] usb 5-1: config 0 has no interface number 0 [ 1817.736282][ T5858] usb 5-1: config 0 interface 160 has no altsetting 0 [ 1817.846685][T27044] fuse: Bad value for 'fd' [ 1817.887104][ T5858] usb 5-1: New USB device found, idVendor=a6da, idProduct=1e78, bcdDevice=56.e4 [ 1817.896398][ T5858] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1817.954949][ T5858] usb 5-1: Product: syz [ 1817.954986][T27046] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 1817.959129][ T5858] usb 5-1: Manufacturer: syz [ 1817.965613][T27046] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1817.998117][T27046] vhci_hcd vhci_hcd.0: Device attached [ 1818.122643][ T5858] usb 5-1: SerialNumber: syz [ 1818.157070][ T5858] usb 5-1: config 0 descriptor?? [ 1818.182524][ T5858] usb-storage 5-1:0.160: USB Mass Storage device detected [ 1818.241091][ T5871] vhci_hcd: vhci_device speed not set [ 1818.302261][ T5871] usb 43-1: new full-speed USB device number 2 using vhci_hcd [ 1818.903754][ T30] audit: type=1326 audit(1760294724.481:1142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27051 comm="syz.2.5559" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3261d8eec9 code=0x0 [ 1818.927491][ T10] usb 6-1: new high-speed USB device number 120 using dummy_hcd [ 1819.200165][T27069] netlink: 'syz.1.5560': attribute type 10 has an invalid length. [ 1819.214381][T27069] veth0_vlan: left promiscuous mode [ 1819.221035][T27069] veth0_vlan: entered promiscuous mode [ 1819.233585][T27069] team0: Device veth0_vlan failed to register rx_handler [ 1819.244254][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 1819.256747][ T10] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 1819.265542][ T10] usb 6-1: config 179 has no interface number 0 [ 1819.323810][ T10] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1819.336061][ T10] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1819.348257][ T10] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1819.361579][ T10] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1819.375136][ T10] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1819.391249][ T10] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1819.400714][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1819.421296][T27046] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1819.812177][ T5955] vhci_hcd: vhci_device speed not set [ 1819.879916][ T10] input: Generic X-Box pad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input109 [ 1819.966610][T27075] netlink: 'syz.6.5561': attribute type 10 has an invalid length. [ 1819.979180][T27075] veth0_vlan: left promiscuous mode [ 1819.987616][T27075] veth0_vlan: entered promiscuous mode [ 1820.015351][T27075] team0: Device veth0_vlan failed to register rx_handler [ 1820.169763][ T5920] usb 6-1: USB disconnect, device number 120 [ 1820.169804][ C0] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1820.190912][ C0] dummy_hcd dummy_hcd.5: timer fired with no URBs pending? [ 1820.201433][T27047] vhci_hcd: connection reset by peer [ 1820.208347][T19751] vhci_hcd: stop threads [ 1820.214823][T19751] vhci_hcd: release socket [ 1820.236974][T19751] vhci_hcd: disconnect device [ 1820.469390][ T10] usb 5-1: USB disconnect, device number 61 [ 1822.272600][T27097] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5566'. [ 1822.619026][T27104] fuse: Unknown parameter '0x0000000000000003' [ 1823.451930][ T5871] vhci_hcd: vhci_device speed not set [ 1823.550952][ T10] usb 6-1: new full-speed USB device number 121 using dummy_hcd [ 1823.850943][ T5858] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 1823.886350][ T10] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1824.466673][ T10] usb 6-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1824.491870][ T10] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1824.528882][ T10] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1824.589583][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1824.615579][ T5858] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1824.633381][ T10] usbtmc 6-1:16.0: bulk endpoints not found [ 1824.641659][ T5858] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1824.697462][ T30] audit: type=1326 audit(1760294730.251:1143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27112 comm="syz.1.5572" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe50eb8eec9 code=0x0 [ 1824.732076][ T5858] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1824.756032][ T5858] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1824.780352][ T5858] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1825.085085][ T5858] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1825.095477][ T5858] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1825.111486][ T5858] usb 5-1: Product: syz [ 1825.121362][ T5858] usb 5-1: Manufacturer: syz [ 1825.153729][ T5858] cdc_wdm 5-1:1.0: skipping garbage [ 1825.159824][ T5858] cdc_wdm 5-1:1.0: skipping garbage [ 1825.176942][ T5858] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 1825.191674][ T5858] cdc_wdm 5-1:1.0: Unknown control protocol [ 1825.311570][T27132] netlink: 'syz.2.5576': attribute type 10 has an invalid length. [ 1825.322228][T27132] veth0_vlan: left promiscuous mode [ 1825.329725][T27132] veth0_vlan: entered promiscuous mode [ 1825.343712][T27134] fuse: Bad value for 'rootmode' [ 1825.454815][T27132] team0: Device veth0_vlan failed to register rx_handler [ 1825.757404][ T30] audit: type=1400 audit(1760294731.331:1144): avc: denied { ioctl } for pid=27108 comm="syz.5.5570" path="/dev/cdc-wdm0" dev="devtmpfs" ino=5258 ioctlcmd=0x5b0a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 1825.950908][ T5858] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 1826.124031][ T5858] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1826.142030][ T5858] usb 2-1: config 160 has an invalid interface number: 186 but max is 0 [ 1826.151286][ T5858] usb 2-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1826.175346][ T5858] usb 2-1: config 160 has no interface number 0 [ 1826.183309][ T5858] usb 2-1: config 160 interface 186 has no altsetting 0 [ 1826.194504][ T5858] usb 2-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1826.205453][ T5858] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1826.218492][ T5858] usb 2-1: Product: syz [ 1826.223584][ T5858] usb 2-1: Manufacturer: syz [ 1826.228413][ T5858] usb 2-1: SerialNumber: syz [ 1826.560097][ T5858] usb 2-1: USB disconnect, device number 19 [ 1826.796309][ T5858] usb 6-1: USB disconnect, device number 121 [ 1827.095031][ T5871] usb 5-1: USB disconnect, device number 62 [ 1827.692338][T27158] netlink: 'syz.4.5580': attribute type 10 has an invalid length. [ 1829.066171][T27171] fuse: Unknown parameter '0x0000000000000003' [ 1829.670900][T13807] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 1830.027753][ T30] audit: type=1326 audit(1760294735.481:1145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27176 comm="syz.2.5587" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3261d8eec9 code=0x0 [ 1830.695895][T13807] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1830.732150][T13807] usb 6-1: config 160 has an invalid interface number: 186 but max is 0 [ 1830.764308][T13807] usb 6-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1830.813164][T13807] usb 6-1: config 160 has no interface number 0 [ 1830.829153][T13807] usb 6-1: config 160 interface 186 has no altsetting 0 [ 1830.918698][T13807] usb 6-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1830.946349][T13807] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1830.996836][T13807] usb 6-1: Product: syz [ 1831.005345][T13807] usb 6-1: Manufacturer: syz [ 1831.050863][T13807] usb 6-1: SerialNumber: syz [ 1831.322696][T13807] usb 6-1: USB disconnect, device number 122 [ 1832.636067][T22473] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1832.802658][T27208] vimc link validate: Scaler:src:16x16 (0x33424752, 0, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1833.441478][T22473] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1833.631543][T12295] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1833.641331][T12295] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1833.648607][T12295] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1833.678968][T27204] lo speed is unknown, defaulting to 1000 [ 1834.051998][ T5858] usb 7-1: new full-speed USB device number 62 using dummy_hcd [ 1834.676653][T27204] lo speed is unknown, defaulting to 1000 [ 1834.809234][ T5858] usb 7-1: config 0 has an invalid interface number: 160 but max is 0 [ 1834.818060][ T5858] usb 7-1: config 0 has no interface number 0 [ 1834.859835][ T5858] usb 7-1: config 0 interface 160 has no altsetting 0 [ 1834.889169][ T5858] usb 7-1: New USB device found, idVendor=a6da, idProduct=1e78, bcdDevice=56.e4 [ 1834.894145][T19605] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 1834.936234][ T5858] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1834.960932][ T5858] usb 7-1: Product: syz [ 1834.998943][ T5858] usb 7-1: Manufacturer: syz [ 1835.020916][ T5858] usb 7-1: SerialNumber: syz [ 1835.071602][ T5858] usb 7-1: config 0 descriptor?? [ 1835.125608][ T5858] usb-storage 7-1:0.160: USB Mass Storage device detected [ 1835.143111][T19605] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 1835.381367][T13807] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 1835.405721][T19605] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 1835.492349][T19605] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20001 - 0 [ 1835.577225][T13807] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1835.591914][T13807] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1835.714777][T13807] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1835.765305][T13807] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1835.838356][T13807] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1835.868833][T13807] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1835.883112][T13807] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1835.895535][T19605] bridge_slave_1: left allmulticast mode [ 1835.910060][T13807] usb 2-1: Product: syz [ 1836.022661][T19605] bridge_slave_1: left promiscuous mode [ 1836.034426][T19605] bridge0: port 2(bridge_slave_1) entered disabled state [ 1836.079675][T13807] usb 2-1: Manufacturer: syz [ 1836.116438][T13807] cdc_wdm 2-1:1.0: skipping garbage [ 1836.129621][T19605] bridge_slave_0: left allmulticast mode [ 1836.137533][T13807] cdc_wdm 2-1:1.0: skipping garbage [ 1836.147337][T19605] bridge_slave_0: left promiscuous mode [ 1836.277364][T13807] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1836.294124][T19605] bridge0: port 1(bridge_slave_0) entered disabled state [ 1836.355488][T13807] cdc_wdm 2-1:1.0: Unknown control protocol [ 1836.722238][T19605] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1836.796712][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1836.812724][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1836.830017][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1836.839779][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1836.848274][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1836.885020][T19605] batman_adv: batadv0: Removing interface: ip6gretap1 [ 1837.323019][ T5871] usb 7-1: USB disconnect, device number 62 [ 1837.591246][T19605] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1837.632491][T19605] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1837.643243][T19605] bond0 (unregistering): Released all slaves [ 1837.709933][T19605] bond1 (unregistering): Released all slaves [ 1837.790049][T27253] lo speed is unknown, defaulting to 1000 [ 1837.827699][ T5871] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 1838.001150][ T5871] usb 7-1: Using ep0 maxpacket: 16 [ 1838.018670][ T5871] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1838.035506][ T5871] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1838.090383][ T5871] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1838.136413][ T5871] usb 7-1: Product: syz [ 1838.141595][T27269] usb 2-1: USB disconnect, device number 20 [ 1838.160084][ T5871] usb 7-1: Manufacturer: syz [ 1838.372681][ T5871] usb 7-1: SerialNumber: syz [ 1838.451755][ T5871] usb 7-1: config 0 descriptor?? [ 1838.488275][ T5871] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1838.523835][ T5871] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 1838.961954][T27278] vimc link validate: Scaler:src:16x16 (0x33424752, 0, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1839.374985][T23659] Bluetooth: hci2: command tx timeout [ 1839.399701][T27253] lo speed is unknown, defaulting to 1000 [ 1840.021121][ T5871] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 1840.568907][ T5871] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1840.577173][ T5871] em28xx 7-1:0.0: board has no eeprom [ 1841.232915][T19605] hsr_slave_0: left promiscuous mode [ 1841.281669][T19605] hsr_slave_1: left promiscuous mode [ 1841.293224][T19605] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1841.332476][T19605] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1841.889506][T27321] hub 2-0:1.0: USB hub found [ 1841.895042][T27321] hub 2-0:1.0: 1 port detected [ 1842.061519][ T5871] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1842.079480][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1842.091758][ T5871] em28xx 7-1:0.0: dvb set to bulk mode. [ 1842.097938][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1842.112804][T27269] em28xx 7-1:0.0: Binding DVB extension [ 1842.118458][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1842.126930][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1842.135024][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1842.200078][T27269] em28xx 7-1:0.0: Registering input extension [ 1842.279760][ T5858] usb 7-1: USB disconnect, device number 63 [ 1842.692563][ T5858] em28xx 7-1:0.0: Disconnecting em28xx [ 1842.698063][ T5858] em28xx 7-1:0.0: Closing input extension [ 1842.820043][ T5858] em28xx 7-1:0.0: Freeing device [ 1843.360943][ T5871] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 1843.381370][ T5858] usb 7-1: new full-speed USB device number 64 using dummy_hcd [ 1843.556384][ T5858] usb 7-1: config 0 has an invalid interface number: 160 but max is 0 [ 1843.566184][ T5858] usb 7-1: config 0 has no interface number 0 [ 1843.573552][ T5858] usb 7-1: config 0 interface 160 has no altsetting 0 [ 1843.588100][ T5871] usb 2-1: Using ep0 maxpacket: 16 [ 1843.596687][ T5858] usb 7-1: New USB device found, idVendor=a6da, idProduct=1e78, bcdDevice=56.e4 [ 1843.612649][ T5871] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1843.626390][ T5871] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1843.636536][ T5871] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1843.644960][ T5871] usb 2-1: Product: syz [ 1843.649300][ T5871] usb 2-1: Manufacturer: syz [ 1843.655217][ T5871] usb 2-1: SerialNumber: syz [ 1843.671619][ T5858] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1843.699443][ T5858] usb 7-1: Product: syz [ 1843.704182][ T5871] usb 2-1: config 0 descriptor?? [ 1843.711831][ T5858] usb 7-1: Manufacturer: syz [ 1843.715572][ T5871] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1843.716530][ T5858] usb 7-1: SerialNumber: syz [ 1843.752181][T27269] usb 6-1: new high-speed USB device number 123 using dummy_hcd [ 1843.804169][ T5858] usb 7-1: config 0 descriptor?? [ 1843.832813][ T5858] usb-storage 7-1:0.160: USB Mass Storage device detected [ 1843.861802][ T5871] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 1843.980982][T27269] usb 6-1: Using ep0 maxpacket: 32 [ 1843.986901][T19605] team0 (unregistering): Port device team_slave_1 removed [ 1843.987877][T27269] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1844.003929][T27269] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1844.018857][T27269] usb 6-1: config 0 descriptor?? [ 1844.178620][T19605] team0 (unregistering): Port device team_slave_0 removed [ 1844.187094][T23659] Bluetooth: hci2: command tx timeout [ 1844.293525][T27269] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1844.312151][T27269] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1844.334034][T27269] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1844.347595][T27269] usb 6-1: media controller created [ 1844.367128][ T5871] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1844.445461][T27269] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1845.130701][ T5871] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1845.138989][ T5871] em28xx 2-1:0.0: board has no eeprom [ 1845.480987][ T5871] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1845.489452][ T5871] em28xx 2-1:0.0: dvb set to bulk mode. [ 1845.497146][ T5920] em28xx 2-1:0.0: Binding DVB extension [ 1845.600049][ T5871] usb 2-1: USB disconnect, device number 21 [ 1845.771120][ T5871] em28xx 2-1:0.0: Disconnecting em28xx [ 1845.946397][ T5920] em28xx 2-1:0.0: Registering input extension [ 1845.953458][ T5871] em28xx 2-1:0.0: Closing input extension [ 1846.017598][ T5871] em28xx 2-1:0.0: Freeing device [ 1846.091984][ T5920] usb 7-1: USB disconnect, device number 64 [ 1846.268609][T12295] Bluetooth: hci2: command tx timeout [ 1846.366253][T19605] team0 (unregistering): Port device dummy0 removed [ 1846.675624][T27368] vimc link validate: Scaler:src:16x16 (0x33424752, 0, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1847.362241][T27269] az6027: usb out operation failed. (-71) [ 1847.391135][T27269] az6027: usb out operation failed. (-71) [ 1847.396954][T27269] stb0899_attach: Driver disabled by Kconfig [ 1847.457983][T27269] az6027: no front-end attached [ 1847.457983][T27269] [ 1847.589081][T27269] az6027: usb out operation failed. (-71) [ 1847.595849][T27269] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1847.610744][T27269] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input112 [ 1847.624034][T27269] dvb-usb: schedule remote query interval to 400 msecs. [ 1847.631807][T27269] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1848.174727][T27269] usb 6-1: USB disconnect, device number 123 [ 1848.257865][T27269] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1848.346180][T23659] Bluetooth: hci2: command tx timeout [ 1848.624036][T27269] usb 6-1: new high-speed USB device number 124 using dummy_hcd [ 1848.632538][T27325] lo speed is unknown, defaulting to 1000 [ 1848.912441][T27269] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 1848.921243][T27269] usb 6-1: config 1 has no interface number 0 [ 1848.941133][T27269] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1848.986068][T27269] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1849.010948][T27269] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1849.035085][T27269] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1849.159677][T27269] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1849.179209][T27269] usb 6-1: Product: syz [ 1849.185433][T27325] lo speed is unknown, defaulting to 1000 [ 1849.457939][T27269] usb 6-1: Manufacturer: syz [ 1849.490243][T27269] usb 6-1: SerialNumber: syz [ 1849.514380][T27378] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1849.524120][T19605] IPVS: stop unused estimator thread 0... [ 1849.741742][ T5955] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1849.890001][T27378] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1849.934095][T27269] usb 6-1: No status endpoint found [ 1849.948256][ T5920] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 1849.973421][ T5955] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1849.983051][ T5955] usb 5-1: config 160 has an invalid interface number: 186 but max is 0 [ 1850.019375][ T5955] usb 5-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1850.106760][ T5955] usb 5-1: config 160 has no interface number 0 [ 1850.130904][ T5955] usb 5-1: config 160 interface 186 has no altsetting 0 [ 1850.154095][ T5920] usb 2-1: Using ep0 maxpacket: 32 [ 1850.166167][ T5955] usb 5-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1850.175730][ T5955] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1850.211742][ T5955] usb 5-1: Product: syz [ 1850.215523][ T5920] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1850.215925][ T5955] usb 5-1: Manufacturer: syz [ 1850.241009][ T5920] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1850.280824][ T5955] usb 5-1: SerialNumber: syz [ 1850.287380][ T5858] usb 6-1: USB disconnect, device number 124 [ 1850.305532][ T5920] usb 2-1: config 0 descriptor?? [ 1850.574614][ T5920] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1850.865398][T27418] vimc link validate: Scaler:src:16x16 (0x33424752, 0, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1850.994839][ T5955] usb 5-1: USB disconnect, device number 63 [ 1851.574016][ T5920] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1851.635103][ T5920] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1851.666196][ T5920] usb 2-1: media controller created [ 1852.190059][ T5920] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1852.662730][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1853.216355][ T5920] az6027: usb out operation failed. (-71) [ 1853.236251][ T5920] az6027: usb out operation failed. (-71) [ 1853.308476][ T5920] stb0899_attach: Driver disabled by Kconfig [ 1853.318565][ T5920] az6027: no front-end attached [ 1853.318565][ T5920] [ 1853.339111][ T5920] az6027: usb out operation failed. (-71) [ 1853.359058][ T5920] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1853.393351][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1853.402806][ T5920] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input113 [ 1853.405234][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1853.423821][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1853.431718][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1853.439511][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1853.521761][ T5920] dvb-usb: schedule remote query interval to 400 msecs. [ 1853.545669][T27438] lo speed is unknown, defaulting to 1000 [ 1853.570583][ T5920] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1853.598797][T27446] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5632'. [ 1853.847311][ T5920] usb 2-1: USB disconnect, device number 22 [ 1854.248066][ T5920] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1854.264371][T27438] lo speed is unknown, defaulting to 1000 [ 1857.133606][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1857.157668][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1857.226263][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1857.239595][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1857.289670][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1857.955317][T27482] lo speed is unknown, defaulting to 1000 [ 1858.786479][T27482] lo speed is unknown, defaulting to 1000 [ 1860.633819][T27548] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5645'. [ 1860.840910][ T5920] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1861.162709][ T5920] usb 2-1: Using ep0 maxpacket: 8 [ 1861.169168][ T5920] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1861.179699][ T5920] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1861.193973][ T5920] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1861.511526][ T5920] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1861.528096][ T5920] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1861.591751][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1861.602628][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1861.609623][ T5920] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1861.618104][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1861.633888][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1861.642432][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1861.699443][T27556] lo speed is unknown, defaulting to 1000 [ 1861.890110][ T5920] usb 2-1: usb_control_msg returned -32 [ 1861.980861][ T5920] usbtmc 2-1:16.0: can't read capabilities [ 1862.032923][ T30] audit: type=1326 audit(1760294767.611:1146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=27559 comm="syz.5.5650" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc3cb38eec9 code=0x0 [ 1862.034309][ T5920] usb 2-1: USB disconnect, device number 23 [ 1862.159538][T27556] lo speed is unknown, defaulting to 1000 [ 1862.440054][T27574] fuse: Bad value for 'rootmode' [ 1863.112749][T13807] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1863.332755][T13807] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1863.367584][T13807] usb 2-1: config 160 has an invalid interface number: 186 but max is 0 [ 1863.470629][T13807] usb 2-1: config 160 has an invalid descriptor of length 174, skipping remainder of the config [ 1863.498860][T13807] usb 2-1: config 160 has no interface number 0 [ 1863.517127][T13807] usb 2-1: config 160 interface 186 has no altsetting 0 [ 1863.558039][T13807] usb 2-1: New USB device found, idVendor=12d1, idProduct=ce42, bcdDevice= f.80 [ 1863.581179][T13807] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1863.589177][T13807] usb 2-1: Product: syz [ 1863.594502][T13807] usb 2-1: Manufacturer: syz [ 1863.599094][T13807] usb 2-1: SerialNumber: syz [ 1863.857978][T13807] usb 2-1: USB disconnect, device number 24 [ 1865.939189][T27616] netlink: 'syz.4.5661': attribute type 10 has an invalid length. [ 1865.991126][ T5920] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 1866.018162][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1866.029636][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1866.046244][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1866.088168][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1866.096705][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1866.174501][ T5920] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1866.207941][T27617] lo speed is unknown, defaulting to 1000 [ 1866.254288][ T5920] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1866.285510][ T5920] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1866.474124][ T5920] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1866.509352][ T5920] usb 2-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1866.519381][ T5920] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1866.544516][ T5920] usb 2-1: Product: syz [ 1866.548733][ T5920] usb 2-1: Manufacturer: syz [ 1866.562991][ T5920] usb 2-1: SerialNumber: syz [ 1866.578579][ T5920] usb 2-1: config 0 descriptor?? [ 1866.608050][ T5920] ums-isd200 2-1:0.0: USB Mass Storage device detected [ 1866.918060][T27617] lo speed is unknown, defaulting to 1000 [ 1866.918755][ T5920] scsi host1: usb-storage 2-1:0.0 [ 1866.992886][ T5920] usb 2-1: USB disconnect, device number 25 [ 1867.249184][T27641] netlink: 'syz.5.5664': attribute type 10 has an invalid length. [ 1867.378338][T27641] veth0_vlan: left promiscuous mode [ 1867.389236][T27641] veth0_vlan: entered promiscuous mode [ 1867.408914][T27641] team0: Device veth0_vlan failed to register rx_handler [ 1869.165767][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1869.176142][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1869.185194][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1869.193854][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1869.202092][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1869.249817][T27677] lo speed is unknown, defaulting to 1000 [ 1869.352320][T27677] lo speed is unknown, defaulting to 1000 [ 1870.487421][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1870.497306][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1870.506270][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1870.514634][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1870.523697][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1870.553260][T27684] lo speed is unknown, defaulting to 1000 [ 1870.638382][T27684] lo speed is unknown, defaulting to 1000 [ 1871.855612][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1871.864900][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1871.873124][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1871.882521][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1871.889972][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1871.921942][T27688] lo speed is unknown, defaulting to 1000 [ 1872.004300][T27688] lo speed is unknown, defaulting to 1000 [ 1873.325770][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1873.334123][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1873.342573][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1873.352167][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1873.361637][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1873.392502][T27693] lo speed is unknown, defaulting to 1000 [ 1873.474383][T27693] lo speed is unknown, defaulting to 1000 [ 1874.893558][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1874.902138][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1874.910041][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1874.919282][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1874.928550][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1874.957819][T27697] lo speed is unknown, defaulting to 1000 [ 1875.041651][T27697] lo speed is unknown, defaulting to 1000 [ 1876.571912][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1876.579875][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1876.588204][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1876.596964][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1876.604908][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1876.636978][T27701] lo speed is unknown, defaulting to 1000 [ 1876.719126][T27701] lo speed is unknown, defaulting to 1000 [ 1878.333813][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1878.344860][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1878.353593][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1878.363570][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1878.371397][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1878.400728][T27705] lo speed is unknown, defaulting to 1000 [ 1878.483245][T27705] lo speed is unknown, defaulting to 1000 [ 1880.194443][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1880.205135][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1880.214115][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1880.222244][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1880.229724][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1880.259495][T27709] lo speed is unknown, defaulting to 1000 [ 1880.343569][T27709] lo speed is unknown, defaulting to 1000 [ 1882.223802][T12295] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1882.233025][T12295] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1882.242403][T12295] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1882.251197][T12295] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1882.258926][T12295] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1882.291818][T27713] lo speed is unknown, defaulting to 1000 [ 1882.375052][T27713] lo speed is unknown, defaulting to 1000 [ 1884.309508][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1884.318148][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1884.329042][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1884.337885][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1884.345833][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1884.376196][T27717] lo speed is unknown, defaulting to 1000 [ 1884.459290][T27717] lo speed is unknown, defaulting to 1000 [ 1886.479228][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1886.487829][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1886.496863][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1886.505078][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1886.512958][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1886.544269][T27721] lo speed is unknown, defaulting to 1000 [ 1886.627173][T27721] lo speed is unknown, defaulting to 1000 [ 1888.785565][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1888.794623][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1888.803127][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1888.812712][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1888.821317][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1888.852320][T27725] lo speed is unknown, defaulting to 1000 [ 1888.935532][T27725] lo speed is unknown, defaulting to 1000 [ 1891.133122][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1891.142724][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1891.152643][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1891.161999][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1891.169660][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1891.198781][T27729] lo speed is unknown, defaulting to 1000 [ 1891.281334][T27729] lo speed is unknown, defaulting to 1000 [ 1893.607034][T23659] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1893.615655][T23659] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1893.626222][T23659] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1893.634021][T23659] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1893.644091][T23659] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1893.672174][T27733] lo speed is unknown, defaulting to 1000 [ 1893.753293][T27733] lo speed is unknown, defaulting to 1000 [ 1894.855950][ T36] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1894.984840][ T36] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1895.092203][ T36] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1895.152521][T26424] tipc: Resetting bearer [ 1895.185450][ T36] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1895.657414][ T36] bridge_slave_1: left allmulticast mode [ 1895.664791][ T36] bridge_slave_1: left promiscuous mode [ 1895.671220][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 1895.679577][ T36] bridge_slave_0: left allmulticast mode [ 1895.685740][ T36] bridge_slave_0: left promiscuous mode [ 1895.691855][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 1895.829011][ T36] dvmrp0 (unregistering): left allmulticast mode [ 1896.014841][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1896.025881][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1896.035893][ T36] bond0 (unregistering): Released all slaves [ 1896.159920][ T36] bond2 (unregistering): (slave geneve2): Releasing active interface [ 1896.193329][ T36] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1896.305718][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1896.315165][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1896.325298][ T36] bond0 (unregistering): Released all slaves [ 1896.413647][ T36] bond1 (unregistering): (slave veth3): Releasing active interface [ 1896.422905][ T36] bond1 (unregistering): Released all slaves [ 1896.434489][ T36] bond2 (unregistering): Released all slaves [ 1896.444970][ T36] bond3 (unregistering): Released all slaves [ 1914.112556][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1975.545432][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 2036.983122][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 2044.660541][ T31] INFO: task kworker/u8:2:36 blocked for more than 143 seconds. [ 2044.668237][ T31] Not tainted syzkaller #0 [ 2044.673382][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2044.682458][ T31] task:kworker/u8:2 state:D stack:22184 pid:36 tgid:36 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 2044.694931][ T31] Workqueue: netns cleanup_net [ 2044.699704][ T31] Call Trace: [ 2044.703579][ T31] [ 2044.706510][ T31] __schedule+0x1190/0x5de0 [ 2044.711471][ T31] ? __lock_acquire+0xb8a/0x1c90 [ 2044.716411][ T31] ? __lock_acquire+0x622/0x1c90 [ 2044.721722][ T31] ? __pfx___schedule+0x10/0x10 [ 2044.726557][ T31] ? find_held_lock+0x2b/0x80 [ 2044.731298][ T31] ? schedule+0x2d7/0x3a0 [ 2044.735621][ T31] schedule+0xe7/0x3a0 [ 2044.739668][ T31] afs_cell_purge+0x41f/0x4f0 [ 2044.744435][ T31] ? __try_to_del_timer_sync+0x115/0x170 [ 2044.750064][ T31] ? __pfx_afs_cell_purge+0x10/0x10 [ 2044.755695][ T31] ? __pfx_var_wake_function+0x10/0x10 [ 2044.761632][ T31] ? __timer_delete_sync+0x108/0x1b0 [ 2044.766905][ T31] ? __pfx_afs_net_exit+0x10/0x10 [ 2044.772458][ T31] afs_net_exit+0x83/0x140 [ 2044.776873][ T31] ops_undo_list+0x2ee/0xab0 [ 2044.781913][ T31] ? __pfx_ops_undo_list+0x10/0x10 [ 2044.787027][ T31] ? cleanup_net+0x347/0x8b0 [ 2044.792144][ T31] ? idr_destroy+0x62/0x2e0 [ 2044.796638][ T31] cleanup_net+0x41b/0x8b0 [ 2044.801495][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 2044.806417][ T31] ? rcu_is_watching+0x12/0xc0 [ 2044.811641][ T31] process_one_work+0x9cf/0x1b70 [ 2044.816568][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 2044.822027][ T31] ? __pfx_process_one_work+0x10/0x10 [ 2044.827413][ T31] ? assign_work+0x1a0/0x250 [ 2044.832428][ T31] worker_thread+0x6c8/0xf10 [ 2044.837014][ T31] ? __pfx_worker_thread+0x10/0x10 [ 2044.842563][ T31] kthread+0x3c5/0x780 [ 2044.846618][ T31] ? __pfx_kthread+0x10/0x10 [ 2044.851651][ T31] ? rcu_is_watching+0x12/0xc0 [ 2044.856396][ T31] ? __pfx_kthread+0x10/0x10 [ 2044.861419][ T31] ret_from_fork+0x675/0x7d0 [ 2044.865993][ T31] ? __pfx_kthread+0x10/0x10 [ 2044.871012][ T31] ret_from_fork_asm+0x1a/0x30 [ 2044.875763][ T31] [ 2044.878850][ T31] [ 2044.878850][ T31] Showing all locks held in the system: [ 2044.887156][ T31] 1 lock held by khungtaskd/31: [ 2044.892406][ T31] #0: ffffffff8e3c4460 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 2044.902651][ T31] 3 locks held by kworker/u8:2/36: [ 2044.907734][ T31] #0: ffff88801bad4948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 2044.918683][ T31] #1: ffffc90000ac7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 2044.929230][ T31] #2: ffffffff900e4f30 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x8b0 [ 2044.939297][ T31] 4 locks held by kworker/u8:6/1139: [ 2044.945021][ T31] #0: ffff8880b853a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 2044.955473][ T31] #1: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 2044.964569][ T31] #2: ffff8880b8525b18 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x127/0x1d0 [ 2044.974307][ T31] #3: ffffffff9adb03f8 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x14c/0x4c0 [ 2044.985305][ T31] 2 locks held by getty/5565: [ 2044.989972][ T31] #0: ffff888035b250a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 2045.000406][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 2045.010975][ T31] [ 2045.013281][ T31] ============================================= [ 2045.013281][ T31] [ 2045.022180][ T31] NMI backtrace for cpu 0 [ 2045.022190][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2045.022203][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 2045.022214][ T31] Call Trace: [ 2045.022219][ T31] [ 2045.022223][ T31] dump_stack_lvl+0x116/0x1f0 [ 2045.022240][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 2045.022257][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2045.022271][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 2045.022289][ T31] watchdog+0xf3f/0x1170 [ 2045.022301][ T31] ? rcu_is_watching+0x12/0xc0 [ 2045.022312][ T31] ? __pfx_watchdog+0x10/0x10 [ 2045.022321][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 2045.022334][ T31] ? __kthread_parkme+0x19e/0x250 [ 2045.022347][ T31] ? __pfx_watchdog+0x10/0x10 [ 2045.022357][ T31] kthread+0x3c5/0x780 [ 2045.022371][ T31] ? __pfx_kthread+0x10/0x10 [ 2045.022386][ T31] ? rcu_is_watching+0x12/0xc0 [ 2045.022396][ T31] ? __pfx_kthread+0x10/0x10 [ 2045.022410][ T31] ret_from_fork+0x675/0x7d0 [ 2045.022423][ T31] ? __pfx_kthread+0x10/0x10 [ 2045.022437][ T31] ret_from_fork_asm+0x1a/0x30 [ 2045.022455][ T31] [ 2045.022459][ T31] Sending NMI from CPU 0 to CPUs 1: [ 2045.146156][ C1] NMI backtrace for cpu 1 [ 2045.146170][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 2045.146186][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 2045.146195][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2045.146215][ C1] Code: f7 74 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 05 24 00 fb f4 3c 0a 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 2045.146240][ C1] RSP: 0018:ffffc90000197de8 EFLAGS: 000002c6 [ 2045.146252][ C1] RAX: 000000000982ebcb RBX: 0000000000000001 RCX: ffffffff8b6622a9 [ 2045.146262][ C1] RDX: 0000000000000000 RSI: ffffffff8db032d9 RDI: ffffffff8bf1e2c0 [ 2045.146271][ C1] RBP: ffffed1003b53490 R08: 0000000000000001 R09: ffffed10170a6655 [ 2045.146280][ C1] R10: ffff8880b85332ab R11: 0000000000000001 R12: 0000000000000001 [ 2045.146288][ C1] R13: ffff88801da9a480 R14: ffffffff90832dd0 R15: 0000000000000000 [ 2045.146298][ C1] FS: 0000000000000000(0000) GS:ffff888124ad9000(0000) knlGS:0000000000000000 [ 2045.146312][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2045.146322][ C1] CR2: 0000556c646bb660 CR3: 000000000e182000 CR4: 00000000003526f0 [ 2045.146331][ C1] Call Trace: [ 2045.146337][ C1] [ 2045.146342][ C1] default_idle+0x13/0x20 [ 2045.146364][ C1] default_idle_call+0x6c/0xb0 [ 2045.146381][ C1] do_idle+0x38d/0x500 [ 2045.146396][ C1] ? __pfx_do_idle+0x10/0x10 [ 2045.146408][ C1] ? trace_sched_exit_tp+0x2f/0x120 [ 2045.146429][ C1] cpu_startup_entry+0x4f/0x60 [ 2045.146441][ C1] start_secondary+0x21d/0x2b0 [ 2045.146456][ C1] ? __pfx_start_secondary+0x10/0x10 [ 2045.146473][ C1] common_startup_64+0x13e/0x148 [ 2045.146496][ C1] [ 2045.147184][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 2045.323025][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2045.332116][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 2045.342147][ T31] Call Trace: [ 2045.345586][ T31] [ 2045.348495][ T31] dump_stack_lvl+0x3d/0x1f0 [ 2045.353076][ T31] vpanic+0x640/0x6f0 [ 2045.357033][ T31] panic+0xca/0xd0 [ 2045.360728][ T31] ? __pfx_panic+0x10/0x10 [ 2045.365122][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 2045.370471][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 2045.376603][ T31] ? watchdog+0xe48/0x1170 [ 2045.380998][ T31] ? watchdog+0xe3b/0x1170 [ 2045.385390][ T31] watchdog+0xe59/0x1170 [ 2045.389606][ T31] ? rcu_is_watching+0x12/0xc0 [ 2045.394341][ T31] ? __pfx_watchdog+0x10/0x10 [ 2045.398987][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 2045.404163][ T31] ? __kthread_parkme+0x19e/0x250 [ 2045.409162][ T31] ? __pfx_watchdog+0x10/0x10 [ 2045.413807][ T31] kthread+0x3c5/0x780 [ 2045.417851][ T31] ? __pfx_kthread+0x10/0x10 [ 2045.422425][ T31] ? rcu_is_watching+0x12/0xc0 [ 2045.427170][ T31] ? __pfx_kthread+0x10/0x10 [ 2045.431734][ T31] ret_from_fork+0x675/0x7d0 [ 2045.436305][ T31] ? __pfx_kthread+0x10/0x10 [ 2045.440870][ T31] ret_from_fork_asm+0x1a/0x30 [ 2045.445622][ T31] [ 2045.448815][ T31] Kernel Offset: disabled [ 2045.453127][ T31] Rebooting in 86400 seconds..