last executing test programs: 8.42428428s ago: executing program 0 (id=2443): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000002000000a00300000500000000000000", @ANYRES32, @ANYBLOB="0000000000000000405d86327c0001"], 0x48) r2 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB='V?\x00\x00-\x00Y'], 0xfe33) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$SNDCTL_SEQ_CTRLRATE(r1, 0xc0045103, &(0x7f0000000300)=0x36d) r4 = eventfd2(0x6, 0x80800) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000240)={r4, 0x7, 0x2}) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r5 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 8.117399369s ago: executing program 0 (id=2445): ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x96e, 0xb, 0x400}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000280)) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write(r0, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=nqn.201', 0x37) 6.052119484s ago: executing program 2 (id=2452): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x1}) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'syzkaller0\x00'}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="fc000000", @ANYRES16=r5, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r6, @ANYBLOB="e0005a80dc0000801400030020380000080003000600000003000800040002004a0002"], 0xfc}, 0x1, 0x0, 0x0, 0x4008821}, 0x8840) sched_setaffinity(r1, 0x8, &(0x7f0000000140)=0x2) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r7, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r7, 0xc0105512, &(0x7f00000000c0)=@usbdevfs_connect) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_LINKS(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x24, r8, 0x401, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x20004044}, 0x4800) 6.017267374s ago: executing program 4 (id=2453): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x3, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x0, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x921, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x100000, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x4, 0x0, 0x40, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x101, 0x7ffffffe, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$rtc(&(0x7f0000000240), 0x50f, 0x101000) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f00000002c0)={0x12, 0xd, 0x12, 0x8, 0x8, 0x8, 0x3, 0x1b, 0x1}) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000010000000000000000000000a5000000a000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYBLOB="04"], 0x10) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000140)={0x0, 0x7e}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, &(0x7f0000000380)={r5, 0x87, "e12dd3d0c2a6e368cacaa7db6715daeb72d8b93391c5715120fadb523ed107985bcf9e3f6f16591f1753a89a10f88d9811a76d585fe6448a28ed0db5f8f6e73678eda71a784e446d83e2b76148a08d1e9777d7875e11ca9a6e1c5c3039dfdcce65f0b730d346b70f9005cb759fd49c21f33963188ca003749062a40e67f02408aa2e52a7a74d70"}, &(0x7f0000000280)=0xb) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) r6 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r6, 0x8) landlock_restrict_self(r6, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1e3) r7 = landlock_create_ruleset(&(0x7f0000000200)={0x6490, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) set_mempolicy(0x4005, &(0x7f0000000080)=0x7e, 0x9) r8 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'lblc\x00', 0x30, 0x80001, 0x6f}, 0x2c) ioctl(0xffffffffffffffff, 0xe, &(0x7f0000000480)="f12dc7f596419146804149a63bd67b832e1775721939c31d96590dcf404666b9587f0dffdce72857b02554cf72a17a428e631517f3e0ae2e4bc54e817cd3078c0cc2d83722880cdaf94c590be3b96031a56b03c6f5387fa20c5999779d9fb1e525d257cbc59c0b9447581e7c45868a6332ea4e500ae7c7ebcdde30ab9020c56dc971d2474ba2df152392571d8a13612718d36af1e2f956bd97c944387c4b491573a5ca5814e2754581a8336d76563c8c752c9a7ff35ec6dd113b91550aac59971124b9c4fe05d685473072142e15cae108c6e9923cf0dd2e93806ffc0b00647d1970bd1de99454649faad78bcc") ioctl$DRM_IOCTL_MARK_BUFS(r2, 0x40206417, &(0x7f00000000c0)={0x200, 0x9, 0x6, 0x3, 0x12, 0x8001}) 5.470553733s ago: executing program 1 (id=2455): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff000000003f040000000000002d400300000000006504000001ed00007b130000000000006c440000000000007b0a00fe000000007b13000000000000b5000000000000009500000000000000023bc865b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a621a464a3778433e6e393002e7f3be361957adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9aa0d7d600c095090000100000000031eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7005005b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fc152b7b9da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33290933896a59ff61622cfd9aa58fe8d485f062ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bdef728d236619074d6ebdf098bc908f523d228a40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed415561c459565b1cd17572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7c00007502c7596566d674e425da5e87e59602a9f6590521d31d381eb3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2e454da0c052427d14c37960242b104e20dc2d9b0c3567aea26454a47b0f0797a7308d402ccdd9069bd50b994fda7a9de54022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c53c18294270a1ad10c80fef7c24b78b4ad83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca57138000b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae037f27feeb744ddcc536cbae315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0602a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844cea001ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e078b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1bb5916b9671b7000000000040f4bee5ad2dea2d070095265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879c8e7dc00624726042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b25393f7536bcda9f64b7c5640bf89d4a74d51dc233dee628c1dfbb55669f84784174b34eb234481547e484c6af101396b6977dd668b401391c1d2e242edccf1cabe6be9868d383ebf1db5aee9b73e92bb82c164ab14bb25189817742e054886ed6d7abbacf6319f3c050e7d53df64633eafcb64291b81188fab69b5a06fe029ce46c5cac1bb1ea8ea98aee207fa4c9618a9ce80bd8b530f4b9ba8860bf1e887ec670312ef0502e3d0a0e30dbaf38c042b7fd207c61e6b73d3b61d194acb4bf4d3e0187d62ee27cbee175eb2312209f68747eeeea30c1634d54799f42753df8e7462c6f5331ea8e56b5c4a373dfe9f111d0206f4e90f71c03bc24960dd84345e59e1289d47a929158babfb331f27370928198d2cd367e928e98c54c67b6382cb958fec947d2ece3695755bc71d55a84bb0a0da43cb9f526a20566e9d00cf9fe6be3adf3e0a05771d66664239d199ce84aa7f684c0ce4c342a85d654624736a3b9b067e2bd298ae8a2527ce59fba9448b13655281431335496da08ac626fe0b57ebb4ad0b9495a183587108b4308bc68eeca9062873703ed0ee726a7867436e01dcd6edf1583e7e17043afda8f46fdd688d461125d724404a3"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r2, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) listen(r2, 0x5) sendmsg(r2, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000100100000100000012000000eaff00001000000009000000100100000e000000601609467705a7c839214e83850dd83339baf7394dcba966c26d1ac044"], 0x28}, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="b054c11240", @ANYRES32=0x0, @ANYBLOB, @ANYRES64=0x0], 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYBLOB="1f0000003020000000000000", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) sendmsg(r2, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000000f800000000000f00000000000000100100000e0000006588615a89397fd9e752a9441ba3e6420c32100f79b29b36"], 0x28}, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x38, 0x1e, 0x301, 0x20000002, 0x0, {0x1}, [@nested={0x24, 0x3, 0x0, 0x1, [@nested={0x20, 0xc1, 0x0, 0x1, [@typed={0x8, 0xa4, 0x0, 0x0, @pid}, @typed={0x8, 0xb5, 0x0, 0x0, @fd=r4}, @typed={0x8, 0x106, 0x0, 0x0, @fd=r4}, @nested={0x4, 0x43}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x81}, 0x4004000) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x2082) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000000)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)={0xa, 0x8203, 0x4, 0x18000}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000000000000000000005000000b7080000000000007b8af8ff00000000b7080000003000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f0000000080)=[{0x6, 0xc0, 0x0, 0x6}]}) close_range(r7, 0xffffffffffffffff, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000100)={0x7}) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r8, 0x80286722, &(0x7f0000000240)={&(0x7f0000000140)=""/185, 0xb9, 0x0, 0x7ff}) 5.225841448s ago: executing program 0 (id=2456): r0 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x96e, 0xb, 0x400}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000280)={r1}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=nqn.201', 0x37) ioctl$TIOCCBRK(r2, 0x5428) 5.224111379s ago: executing program 4 (id=2457): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) r0 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000600)='mtd0\x00', &(0x7f0000000640)={0x200200, 0x101, 0x14}, 0x18) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000006c0), 0x80000, 0x0) mount_setattr(r0, &(0x7f0000000680)='./file1\x00', 0x800, &(0x7f0000000700)={0x77, 0x7e, 0x1c0000, {r1}}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x100) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000780), 0x80000, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0x18, &(0x7f0000000000)=0xa, 0x4) sendmsg(r2, &(0x7f0000000040)={&(0x7f0000000180)=@phonet={0x23, 0x2, 0xfc, 0x1}, 0x80, &(0x7f0000000280)=[{&(0x7f00000002c0)="01f80281000600a30000", 0xa}, {0x0}], 0x2}, 0x4000000) renameat2(0xffffffffffffff9c, &(0x7f00000007c0)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000800)='mtd0/file0\x00', 0x8) r3 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000540), 0x40400) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bond_slave_0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c0000001000010025bd7000fddbdf2500000000", @ANYRES32=r5, @ANYBLOB="10080400895504002c001280110001006272696467655f736c61766500000000140005"], 0x4c}, 0x1, 0x0, 0x0, 0x200404c1}, 0x4040010) connect$unix(r3, &(0x7f0000000580)=@abs={0x0, 0x0, 0x4e23}, 0x6e) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x20a080, 0x0) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(0xffffffffffffffff, 0xc0186445, &(0x7f0000000340)={0x5, 0x1, 0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000380)={0x0}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r10, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000600fc000000080011000700000008000e00800000000800", @ANYRES64=r10], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x80) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x7, &(0x7f0000000740)=[{0xc, 0x4, 0x3, 0x8}, {0x5, 0xf4, 0x5d, 0x785}, {0x0, 0x8, 0x5, 0x8}, {0x720, 0xae, 0x2, 0x2}, {0x0, 0x4, 0x1, 0xe}, {0x8, 0x9, 0x6, 0x81}, {0x5, 0x7, 0x0, 0x10001}]}) listns(&(0x7f0000000500)={0x20, 0x0, 0x9, 0x8000000, 0x0, 0x3}, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f00000003c0)={0x0, 0x0, 0x3, 0x0, 0x2, [0x0, 0x0, 0x0], [0x101, 0x9, 0x1, 0x100], [0x5, 0x582d, 0x80000000, 0x4], [0x8, 0xffffffff, 0x326, 0x2]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r7, 0xc06864b8, &(0x7f0000000440)={0x0, 0x8, 0xf, 0xa, 0x1, [r8, r9, 0x0, r12], [0x4, 0x9, 0x8, 0x4], [0x3, 0xa00000, 0x6cb, 0x7], [0x2daf, 0x1, 0xf290, 0x1]}) 5.15680269s ago: executing program 2 (id=2458): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000000640)={{0x0, 0x2, 0xf, 0x8000000000000000, 0x1, 0x401, 0x1, 0x9, 0x5, 0x7ff, 0x9, 0x8, 0x6, 0x3, 0x8}, 0x8, [0x0]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}}, 0x24}}, 0x4c840) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 4.782790024s ago: executing program 0 (id=2459): fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="fc000000", @ANYRES16=r4, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r5, @ANYBLOB="e0005a80dc0000801400030020380000080003000600000003000800040002004a0002"], 0xfc}, 0x1, 0x0, 0x0, 0x4008821}, 0x8840) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, 0x0) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000200)) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_GET_LINKS(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x24, r6, 0x401, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x6}}}, 0x24}, 0x1, 0x0, 0x0, 0x20004044}, 0x4800) 4.714351249s ago: executing program 4 (id=2460): socket$nl_generic(0x10, 0x3, 0x10) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000080)={0x1, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'syzkaller0\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, 0x0, 0x8840) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) 4.713284739s ago: executing program 2 (id=2461): sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="340000f401090102000000000000000808000640000000010900"], 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x20008051) ioctl$DRM_IOCTL_PANTHOR_TILER_HEAP_CREATE(0xffffffffffffffff, 0xc028644b, &(0x7f0000000340)={0x0, 0x74, 0x5c0000, 0x3, 0x4, 0x0, 0x6, 0x5}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000001c0)="1fd93fd76d4934184bbec63c656291062a3d29cd3034d4ceaba77debecd9573575cd14ce0838f22abc3c4abd5ed67a90ed87b702e18760b6d86669edc113fc3d0fb30d76c29ca5d1ca9327b1b13f5c020d14d28ff3452cec6811f625cbbd4a55a1418c1fe5cbbd20b990c63ba007e69518e03b5ce67f73", 0x77}, {&(0x7f00000002c0)="3c205b072336bce6ff13a65e159454de32ebdcbc4731acffd34e211c584048de1c7bcbe3d078fc02a51e5db635eec4e205f69b90cace8bb4d2da8a78b8d943e7217619c89d28fca63b956fd6e231e732d6", 0x51}], 0x2}, 0x8841) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x2000000000000000, 0x0, 0x4004840}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000000c0)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x29}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4.46846303s ago: executing program 1 (id=2462): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000180), 0x4) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0xe, 0xe, @vifc_lcl_addr=@multicast1, @empty}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000140)={'sit0\x00', &(0x7f0000000000)={@mcast2, @local, 0x8, 0x18}}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) chdir(&(0x7f0000000240)='./file0\x00') llistxattr(&(0x7f0000000040)='./file2\x00', 0x0, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0x3) 3.561511506s ago: executing program 2 (id=2463): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="340000f401090102000000000000000808000640000000010900010094797a300000000008000340800000010400020000000000"], 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x20008051) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'ipvlan1\x00'}) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(0xffffffffffffffff, 0xc0106441, &(0x7f0000000300)={0x0, 0x0}) ioctl$DRM_IOCTL_PANTHOR_TILER_HEAP_CREATE(r2, 0xc028644b, &(0x7f0000000340)={r3, 0x74, 0x5c0000, 0x3, 0x4, 0x0, 0x6, 0x5}) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000080)=[{0x48, 0x0, 0x7, 0x6}, {0x6, 0xfd, 0xee, 0x16}]}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x2000000000000000, 0x0, 0x4004840}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000000c0)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x29}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 3.129236907s ago: executing program 4 (id=2464): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_CREATE(0xffffffffffffffff, 0xc0106441, &(0x7f0000000300)) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000080)=[{0x48, 0x0, 0x7, 0x6}, {0x6, 0xfd, 0xee, 0x16}]}) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000540)=0xfff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x2000000000000000, 0x0, 0x4004840}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000000c0)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x29}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 2.419391007s ago: executing program 3 (id=2465): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x3, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x0, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x921, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x100000, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x4, 0x0, 0x40, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x101, 0x7ffffffe, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$rtc(&(0x7f0000000240), 0x50f, 0x101000) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f00000002c0)={0x12, 0xd, 0x12, 0x8, 0x8, 0x8, 0x3, 0x1b, 0x1}) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000010000000000000000000000a5000000a000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="04"], 0x10) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000140)={0x0, 0x7e}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f0000000380)={r6, 0x87, "e12dd3d0c2a6e368cacaa7db6715daeb72d8b93391c5715120fadb523ed107985bcf9e3f6f16591f1753a89a10f88d9811a76d585fe6448a28ed0db5f8f6e73678eda71a784e446d83e2b76148a08d1e9777d7875e11ca9a6e1c5c3039dfdcce65f0b730d346b70f9005cb759fd49c21f33963188ca003749062a40e67f02408aa2e52a7a74d70"}, &(0x7f0000000280)=0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r7, 0x8) landlock_restrict_self(r7, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1e3) r8 = landlock_create_ruleset(&(0x7f0000000200)={0x6490, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r8, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) set_mempolicy(0x4005, 0x0, 0x9) r9 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'lblc\x00', 0x30, 0x80001, 0x6f}, 0x2c) ioctl(0xffffffffffffffff, 0xe, &(0x7f0000000480)="f12dc7f596419146804149a63bd67b832e1775721939c31d96590dcf404666b9587f0dffdce72857b02554cf72a17a428e631517f3e0ae2e4bc54e817cd3078c0cc2d83722880cdaf94c590be3b96031a56b03c6f5387fa20c5999779d9fb1e525d257cbc59c0b9447581e7c45868a6332ea4e500ae7c7ebcdde30ab9020c56dc971d2474ba2df152392571d8a13612718d36af1e2f956bd97c944387c4b491573a5ca5814e2754581a8336d76563c8c752c9a7ff35ec6dd113b91550aac59971124b9c4fe05d685473072142e15cae108c6e9923cf0dd2e93806ffc0b00647d1970bd1de99454649faad78bcc") ioctl$DRM_IOCTL_MARK_BUFS(r2, 0x40206417, &(0x7f00000000c0)={0x200, 0x9, 0x6, 0x3, 0x12, 0x8001}) 2.221374447s ago: executing program 0 (id=2466): ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x96e, 0xb, 0x400}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(0xffffffffffffffff, 0xc00464b4, &(0x7f0000000280)) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write(r0, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=nqn.201', 0x37) 2.21615343s ago: executing program 1 (id=2467): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000000640)={{0x0, 0x2, 0xf, 0x8000000000000000, 0x1, 0x401, 0x1, 0x9, 0x5, 0x7ff, 0x9, 0x8, 0x6, 0x3, 0x8}, 0x8, [0x0]}) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 1.963727932s ago: executing program 2 (id=2468): socket$inet6(0xa, 0x80002, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000280)={'\x00', 0x8001, 0x9, 0x8, 0xfffffffffffffffc, 0x6, 0xffffffffffffffff}) sched_setscheduler(r1, 0x7, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) io_uring_register$IORING_REGISTER_QUERY(0xffffffffffffffff, 0x23, &(0x7f0000006c00)=[{&(0x7f00000067c0)={&(0x7f00000066c0)={0x0, &(0x7f0000006680)="ef98e2f1", 0x1, 0x4}, &(0x7f0000006700)="eadf0f4cb006047e60683d54aba3298b86e77af4ae8b74df4731ca14fc16531fadd068305747a1373bf2a421e25e314b85aa0f3a6f388fdd326b6860a35e36e97be816e928869f4162f2fc51f968fabe44b705aca06a13a2fd91cf690b7ce20681329935e595", 0x46ac38d78b2c5958, 0x66}, 0x0}], 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x8c, 0x1e, 0x21, 0x70bd2b, 0x0, {0xa}, [@generic="ecec35ba9a94e888f3dff41bfc2c812835c32223bdb350e5e2b30cebcc2ace5a0481aee8ba1ab6f8cdc788090a9c82925aae1ff617b3f8afea8490cb30274289e9e271118466bfc9c4635c6d1c9f070c72af5a58791c716dde70d344fc4b80b26bf1e6daf67579065861e0", @nested={0x4, 0x4c}, @typed={0x8, 0x152, 0x0, 0x0, @fd=r2}]}, 0x8c}}, 0x0) syz_open_dev$usbfs(&(0x7f0000000040), 0x1ff, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usb/unbind\x00', 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000ab9ff0), 0x10) sendmmsg$inet(r4, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) r6 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) read(r6, 0x0, 0x0) write(r3, &(0x7f0000000200)='usb1', 0x4) sendmsg$netlink(0xffffffffffffffff, 0x0, 0xc000) sendmmsg$inet(r0, &(0x7f0000000a80)=[{{&(0x7f0000000000)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10, 0x0, 0x0, &(0x7f0000000200)=[@ip_ttl={{0x14, 0x0, 0x2, 0x7}}], 0x18}}], 0x1, 0x24008080) 1.945934934s ago: executing program 1 (id=2469): r0 = syz_open_dev$dri(&(0x7f0000000180), 0xcaf8, 0x40000) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x96e, 0xb, 0x400}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r0, 0xc00464b4, &(0x7f0000000280)={r1}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = openat$nvme_fabrics(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r3, &(0x7f0000000180)='transport=tcp,traddr=127.0.0.1,trsvcid=4420,nqn=nqn.201', 0x37) ioctl$TIOCCBRK(r2, 0x5428) 1.891472721s ago: executing program 3 (id=2470): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000000640)={{0x0, 0x2, 0xf, 0x8000000000000000, 0x1, 0x401, 0x1, 0x9, 0x5, 0x7ff, 0x9, 0x8, 0x6, 0x3, 0x8}, 0x8, [0x0]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000002000000a00300000500000000000000", @ANYRES32, @ANYBLOB="0000000000000000405d86327c0001"], 0x48) socket$kcm(0x10, 0x2, 0x0) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = eventfd2(0x6, 0x80800) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000240)={r2, 0x7, 0x2}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r3 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 1.729919496s ago: executing program 1 (id=2471): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$DRM_IOCTL_PANTHOR_TILER_HEAP_CREATE(0xffffffffffffffff, 0xc028644b, &(0x7f0000000340)={0x0, 0x74, 0x5c0000, 0x3, 0x4, 0x0, 0x6, 0x5}) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f0000000180)={0x2, &(0x7f0000000080)=[{0x48, 0x0, 0x7, 0x6}, {0x6, 0xfd, 0xee, 0x16}]}) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000540)=0xfff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000001c0)="1fd93fd76d4934184bbec63c656291062a3d29cd3034d4ceaba77debecd9573575cd14ce0838f22abc3c4abd5ed67a90ed87b702e18760b6d86669edc113fc3d0fb30d76c29ca5d1ca9327b1b13f5c020d14d28ff3452cec6811f625cbbd4a55a1418c1fe5cbbd20b990c63ba007e69518e03b5ce67f73", 0x77}, {&(0x7f00000002c0)="3c205b072336bce6ff13a65e159454de32ebdcbc4731acffd34e211c584048de1c7bcbe3d078fc02a51e5db635eec4e205f69b90cace8bb4d2da8a78b8d943e7217619c89d28fca63b956fd6e231e732d6", 0x51}], 0x2}, 0x8841) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x2000000000000000, 0x0, 0x4004840}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.692349957s ago: executing program 4 (id=2472): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff000000003f040000000000002d400300000000006504000001ed00007b130000000000006c440000000000007b0a00fe000000007b13000000000000b5000000000000009500000000000000023bc865b7a379d17cf9333379fc9e94af69912435f1a864a710aad58db6a621a464a3778433e6e393002e7f3be361957adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554a090f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9aa0d7d600c095090000100000000031eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7005005b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fc152b7b9da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33290933896a59ff61622cfd9aa58fe8d485f062ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bdef728d236619074d6ebdf098bc908f523d228a40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18ec0ae564162a27afea62d84f3a10746443d64364f56e24e6d2105bd901204a1deeed415561c459565b1cd17572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063be9261b2e1aab1675b34a220488c126aeef5f510a8f1aded94a129e4aec6f8c3a13596c2ea3e2e04cfe0e669e51731b2875353193f82ade69d0540059fe6c7fe7c00007502c7596566d674e425da5e87e59602a9f6590521d31d381eb3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c95300000000010000003baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2e454da0c052427d14c37960242b104e20dc2d9b0c3567aea26454a47b0f0797a7308d402ccdd9069bd50b994fda7a9de54022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed82641687f3b3a70bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c03987d198899b212c53c18294270a1ad10c80fef7c24b78b4ad83238273f4fc87afce829ba0f85da6d888f18ea40ab959f6074ab2a4009b9e5f07ab513cdc6c0e57fb1c1ca57138000b4ead35a385e0b4a26b702396df7e0cbe02b6e4114f244a9bf93f04beb72f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a9b702cc1b6912a1e717d29135753208165b9cdbae037f27feeb744ddcc536cbae315c7d951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91114a6b244f9acf41ac5d73a008364e0602a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844cea001ddeb6dc5f6a9037d2283c42efc54fa84323a3c3e6e4fd2e078b796a825b3dad9ce7b37507e0b83c3ecd01549bca6a016b3e18a00c748894dc3bfe5efda8b0a477d6a6562fdee45eb16e276dee992094ba9830f6c164179e7d532d86060bea930118d3cae1bb5916b9671b7000000000040f4bee5ad2dea2d070095265504c05bba38b095e1679f96ddef65ba5de9c8cfb6465ae4165c0689a314a6eb6b36aa705b957edef3035e14b879c8e7dc00624726042e00bf9a7f7ae5f308744770759558e4fcb99c0dc957521ef255362bf2f3966f3754e81fb9bdef22c19f5a49147b25393f7536bcda9f64b7c5640bf89d4a74d51dc233dee628c1dfbb55669f84784174b34eb234481547e484c6af101396b6977dd668b401391c1d2e242edccf1cabe6be9868d383ebf1db5aee9b73e92bb82c164ab14bb25189817742e054886ed6d7abbacf6319f3c050e7d53df64633eafcb64291b81188fab69b5a06fe029ce46c5cac1bb1ea8ea98aee207fa4c9618a9ce80bd8b530f4b9ba8860bf1e887ec670312ef0502e3d0a0e30dbaf38c042b7fd207c61e6b73d3b61d194acb4bf4d3e0187d62ee27cbee175eb2312209f68747eeeea30c1634d54799f42753df8e7462c6f5331ea8e56b5c4a373dfe9f111d0206f4e90f71c03bc24960dd84345e59e1289d47a929158babfb331f27370928198d2cd367e928e98c54c67b6382cb958fec947d2ece3695755bc71d55a84bb0a0da43cb9f526a20566e9d00cf9fe6be3adf3e0a05771d66664239d199ce84aa7f684c0ce4c342a85d654624736a3b9b067e2bd298ae8a2527ce59fba9448b13655281431335496da08ac626fe0b57ebb4ad0b9495a183587108b4308bc68eeca9062873703ed0ee726a7867436e01dcd6edf1583e7e17043afda8f46fdd688d461125d724404a3"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r2, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) listen(r2, 0x5) sendmsg(r2, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000100100000100000012000000eaff00001000000009000000100100000e000000601609467705a7c839214e83850dd83339baf7394dcba966c26d1ac044"], 0x28}, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="b054c11240", @ANYRES32=0x0, @ANYBLOB, @ANYRES64=0x0], 0x20) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32=r0, @ANYBLOB="1f0000003020000000000000", @ANYRES32=0x0, @ANYBLOB, @ANYRES64=0x0], 0x20) sendmsg(r2, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000000f800000000000f00000000000000100100000e0000006588615a89397fd9e752a9441ba3e6420c32100f79b29b36"], 0x28}, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x38, 0x1e, 0x301, 0x20000002, 0x0, {0x1}, [@nested={0x24, 0x3, 0x0, 0x1, [@nested={0x20, 0xc1, 0x0, 0x1, [@typed={0x8, 0xa4, 0x0, 0x0, @pid}, @typed={0x8, 0xb5, 0x0, 0x0, @fd=r4}, @typed={0x8, 0x106, 0x0, 0x0, @fd=r4}, @nested={0x4, 0x43}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x81}, 0x4004000) syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x2082) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000000)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x7d, &(0x7f0000000000)={0xa, 0x8203, 0x4, 0x18000}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0200000004000000080000000100"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, &(0x7f0000000a00)=ANY=[@ANYBLOB="18000000000000000000000005000000b7080000000000007b8af8ff00000000b7080000003000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f0000000080)=[{0x6, 0xc0, 0x0, 0x6}]}) close_range(r7, 0xffffffffffffffff, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000100)={0x7}) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r8, 0x80286722, &(0x7f0000000240)={&(0x7f0000000140)=""/185, 0xb9, 0x0, 0x7ff}) 1.69155875s ago: executing program 3 (id=2473): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9}, {}, {0x0, 0xffff}}}, 0x24}}, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, 0x0, &(0x7f0000000300)) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.447604919s ago: executing program 3 (id=2474): socket$nl_generic(0x10, 0x3, 0x10) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000080)={0x1, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000440)={'syzkaller0\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, 0x0, 0x8840) keyctl$KEYCTL_PKEY_QUERY(0x18, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, 0x0) 1.398367267s ago: executing program 1 (id=2475): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x5000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000002c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha256\x00'}, 0x58) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x1, 0x0, 0x25dfdbfc}, 0x14}}, 0x4091) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r3) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r3) sendmsg$NL802154_CMD_NEW_INTERFACE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)={0x30, r5, 0x1, 0x70bd24, 0x0, {0x1c}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan3\x00'}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x0) accept4(r2, 0x0, 0x0, 0x800) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000b40)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f00000001c0)={0x28, 0x2, r7, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x6}) ioctl$IOMMU_IOAS_COPY$syz(0xffffffffffffffff, 0x3b83, &(0x7f0000000100)={0x28, 0x10000, 0x0, r7, 0xc955d, 0x683, 0x2, 0x243461}) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="2800000005060101000000000000000000000500010007f900"/40], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) close_range(r6, 0xffffffffffffffff, 0x0) sigaltstack(&(0x7f0000000180)={0xffffffffffffffff, 0x0, 0xfffffffffffffeab}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 374.685557ms ago: executing program 3 (id=2476): ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f0000000640)={{0x0, 0x2, 0xf, 0x8000000000000000, 0x1, 0x401, 0x1, 0x9, 0x5, 0x7ff, 0x9, 0x8, 0x6, 0x3, 0x8}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 184.314115ms ago: executing program 2 (id=2477): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000180), 0x4) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0xe, 0xe, @vifc_lcl_addr=@multicast1, @empty}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f0000000140)={'sit0\x00', &(0x7f0000000000)={@mcast2, @local, 0x8, 0x18}}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) chdir(&(0x7f0000000240)='./file0\x00') llistxattr(&(0x7f0000000040)='./file2\x00', 0x0, 0x12) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0x3) 142.449833ms ago: executing program 4 (id=2478): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'ipvlan1\x00'}) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000002c0), 0x20000, 0x0) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000540)=0xfff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0x80}}, 0x26}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000001c0)="1fd93fd76d4934184bbec63c656291062a3d29cd3034d4ceaba77debecd9573575cd14ce0838f22abc3c4abd5ed67a90ed87b702e18760b6d86669edc113fc3d0fb30d76c29ca5d1ca9327b1b13f5c020d14d28ff3452cec6811f625cbbd4a55a1418c1fe5cbbd20b990c63ba007e69518e03b5ce67f73", 0x77}, {&(0x7f00000002c0)="3c205b072336bce6ff13a65e159454de32ebdcbc4731acffd34e211c584048de1c7bcbe3d078fc02a51e5db635eec4e205f69b90cace8bb4d2da8a78b8d943e7217619c89d28fca63b956fd6e231e732d6", 0x51}], 0x2}, 0x8841) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x2000000000000000, 0x0, 0x4004840}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000000c0)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0x29}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 52.642178ms ago: executing program 3 (id=2479): sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) r0 = syz_open_procfs(0x0, &(0x7f0000000380)='clear_refs\x00') writev(r0, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) getsockname$packet(0xffffffffffffffff, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(0xffffffffffffffff, 0x402) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ed56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x62, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f00000006c0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 0s ago: executing program 0 (id=2480): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2, 0x9}, 0x3, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x4000, 0x20, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x0, 0x9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x296, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1, 0x6], [0x0, 0x0, 0x8, 0x0, 0x0, 0x5, 0x0, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x768, 0x0, 0x7, 0x2, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x0, 0x3, 0x5, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xffff], [0x4, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x80, 0x0, 0x200, 0x0, 0xffffffff, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x921, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x800, 0x100000, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x8], [0x40000000, 0x0, 0x635, 0x0, 0x8000000, 0x3, 0x0, 0x4, 0x0, 0x40, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x40, 0x9, 0x0, 0xbd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffd, 0x6, 0x9, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x101, 0x7ffffffe, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcaa, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$rtc(&(0x7f0000000240), 0x50f, 0x101000) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f00000002c0)={0x12, 0xd, 0x12, 0x8, 0x8, 0x8, 0x3, 0x1b, 0x1}) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000010000000000000000000000a5000000a000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="04"], 0x10) pipe2$watch_queue(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000140)={0x0, 0x7e}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f0000000380)={r6, 0x87, "e12dd3d0c2a6e368cacaa7db6715daeb72d8b93391c5715120fadb523ed107985bcf9e3f6f16591f1753a89a10f88d9811a76d585fe6448a28ed0db5f8f6e73678eda71a784e446d83e2b76148a08d1e9777d7875e11ca9a6e1c5c3039dfdcce65f0b730d346b70f9005cb759fd49c21f33963188ca003749062a40e67f02408aa2e52a7a74d70"}, &(0x7f0000000280)=0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r7 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r7, 0x8) landlock_restrict_self(r7, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x1e3) r8 = landlock_create_ruleset(&(0x7f0000000200)={0x6490, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r8, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) set_mempolicy(0x4005, 0x0, 0x9) r9 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r9, 0x0, 0x482, &(0x7f0000000140)={0x84, @rand_addr=0x64010105, 0x4e22, 0x3, 'lblc\x00', 0x30, 0x80001, 0x6f}, 0x2c) ioctl(0xffffffffffffffff, 0xe, &(0x7f0000000480)="f12dc7f596419146804149a63bd67b832e1775721939c31d96590dcf404666b9587f0dffdce72857b02554cf72a17a428e631517f3e0ae2e4bc54e817cd3078c0cc2d83722880cdaf94c590be3b96031a56b03c6f5387fa20c5999779d9fb1e525d257cbc59c0b9447581e7c45868a6332ea4e500ae7c7ebcdde30ab9020c56dc971d2474ba2df152392571d8a13612718d36af1e2f956bd97c944387c4b491573a5ca5814e2754581a8336d76563c8c752c9a7ff35ec6dd113b91550aac59971124b9c4fe05d685473072142e15cae108c6e9923cf0dd2e93806ffc0b00647d1970bd1de99454649faad78bcc") ioctl$DRM_IOCTL_MARK_BUFS(r2, 0x40206417, &(0x7f00000000c0)={0x200, 0x9, 0x6, 0x3, 0x12, 0x8001}) kernel console output (not intermixed with test programs): ributes in process `syz.3.1585'. [ 425.402629][ T5709] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 425.403893][ T5709] em28xx 5-1:0.0: Config register raw data: 0xaf [ 425.403916][ T5709] em28xx 5-1:0.0: I2S Audio (1 sample rate(s)) [ 425.403933][ T5709] em28xx 5-1:0.0: No AC97 audio processor [ 425.549172][T10142] netlink: 52 bytes leftover after parsing attributes in process `syz.3.1586'. [ 425.649984][ T5709] usb 5-1: USB disconnect, device number 26 [ 425.678169][ T31] usb 3-1: USB disconnect, device number 25 [ 425.736048][ T31] em28xx 3-1:0.0: Disconnecting em28xx [ 425.872224][ T31] em28xx 3-1:0.0: Freeing device [ 427.451157][T10153] kvm: kvm [10152]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 427.496276][T10151] input: syz1 as /devices/virtual/input/input71 [ 427.692071][T10163] hub 8-0:1.0: USB hub found [ 427.695033][T10163] hub 8-0:1.0: 1 port detected [ 427.991644][T10164] hub 8-0:1.0: USB hub found [ 427.995241][T10164] hub 8-0:1.0: 1 port detected [ 430.090161][T10172] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1594'. [ 430.644051][T10181] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1596'. [ 431.719409][T10185] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1602'. [ 431.938375][T10190] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1601'. [ 432.295608][ T5722] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 432.887469][ T5722] usb 4-1: not running at top speed; connect to a high speed hub [ 432.887524][ T5722] usb 4-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 432.914415][ T5722] usb 4-1: config 6 has an invalid interface number: 11 but max is 0 [ 432.914447][ T5722] usb 4-1: config 6 has an invalid interface number: 205 but max is 0 [ 432.914470][ T5722] usb 4-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 432.914492][ T5722] usb 4-1: config 6 has no interface number 0 [ 432.914510][ T5722] usb 4-1: config 6 has no interface number 1 [ 432.914588][ T5722] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 432.914617][ T5722] usb 4-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 432.914644][ T5722] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 432.914673][ T5722] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 432.914701][ T5722] usb 4-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 432.914760][ T5722] usb 4-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 432.914788][ T5722] usb 4-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 432.914817][ T5722] usb 4-1: config 6 interface 11 has no altsetting 0 [ 432.914836][ T5722] usb 4-1: config 6 interface 205 has no altsetting 0 [ 432.924115][ T5722] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.958781][ T5722] usb 4-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 432.958839][ T5722] usb 4-1: Manufacturer:   [ 432.958855][ T5722] usb 4-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 433.140650][T10186] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 433.140850][T10186] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 433.213037][T10194] 9p: Bad value for 'rfdno' [ 434.652212][T10197] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1606'. [ 435.587623][ T5722] option 4-1:6.11: GSM modem (1-port) converter detected [ 435.673752][ T5722] usb 4-1: USB disconnect, device number 28 [ 435.698902][ T5722] option 4-1:6.11: device disconnected [ 435.811916][T10205] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1608'. [ 435.898034][T10211] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1612'. [ 436.360382][T10222] hub 8-0:1.0: USB hub found [ 436.360900][T10222] hub 8-0:1.0: 1 port detected [ 437.464396][T10140] usb 3-1: new full-speed USB device number 26 using dummy_hcd [ 437.502406][T10237] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 437.534359][ T5722] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 437.621195][T10140] usb 3-1: not running at top speed; connect to a high speed hub [ 437.621239][T10140] usb 3-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 437.644778][T10140] usb 3-1: config 6 has an invalid interface number: 11 but max is 0 [ 437.644811][T10140] usb 3-1: config 6 has an invalid interface number: 205 but max is 0 [ 437.644832][T10140] usb 3-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 437.644854][T10140] usb 3-1: config 6 has no interface number 0 [ 437.644871][T10140] usb 3-1: config 6 has no interface number 1 [ 437.644943][T10140] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 437.644972][T10140] usb 3-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 437.644999][T10140] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 437.645028][T10140] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 437.645057][T10140] usb 3-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 437.645098][T10140] usb 3-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 437.645126][T10140] usb 3-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 437.645153][T10140] usb 3-1: config 6 interface 11 has no altsetting 0 [ 437.645171][T10140] usb 3-1: config 6 interface 205 has no altsetting 0 [ 437.651160][T10140] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.651190][T10140] usb 3-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 437.651231][T10140] usb 3-1: Manufacturer:   [ 437.651247][T10140] usb 3-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 437.724235][ T5722] usb 4-1: Using ep0 maxpacket: 16 [ 437.727009][ T5722] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 437.777842][ T5722] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 437.777878][ T5722] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 437.854542][ T5722] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.854573][ T5722] usb 4-1: Product: syz [ 437.854588][ T5722] usb 4-1: Manufacturer: syz [ 437.854603][ T5722] usb 4-1: SerialNumber: syz [ 437.944794][ T5722] usb 4-1: config 0 descriptor?? [ 437.962289][ T5722] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 437.962329][ T5722] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 438.051448][T10230] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 438.051589][T10230] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 438.313496][T10140] option 3-1:6.11: GSM modem (1-port) converter detected [ 438.379016][T10140] usb 3-1: USB disconnect, device number 26 [ 438.401924][T10140] option 3-1:6.11: device disconnected [ 438.567707][ T5722] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 438.568159][ T5722] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 438.568583][ T5722] em28xx 4-1:0.0: AC97 chip type couldn't be determined [ 438.568601][ T5722] em28xx 4-1:0.0: No AC97 audio processor [ 438.628513][ T5722] usb 4-1: USB disconnect, device number 29 [ 438.644425][ T5722] em28xx 4-1:0.0: Disconnecting em28xx [ 438.651757][ T5722] em28xx 4-1:0.0: Freeing device [ 438.996925][T10249] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1622'. [ 442.830131][T10259] kvm: kvm [10257]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 444.148361][T10261] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1627'. [ 444.303773][T10258] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.1625'. [ 444.602269][T10270] hub 8-0:1.0: USB hub found [ 444.602683][T10270] hub 8-0:1.0: 1 port detected [ 445.278183][ T5878] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 445.282451][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 445.282528][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 445.447552][T10277] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 445.447592][T10277] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 445.473860][ T5878] usb 3-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 445.488125][ T5878] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 445.488149][ T5878] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 445.488190][ T5878] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 445.580426][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 445.580456][ T5878] usb 3-1: Product: syz [ 445.580470][ T5878] usb 3-1: Manufacturer: syz [ 445.580485][ T5878] usb 3-1: SerialNumber: syz [ 445.768739][ T5878] uvcvideo 3-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 445.768777][ T5878] uvcvideo 3-1:1.0: No valid video chain found. [ 445.828963][ T5878] usb 3-1: USB disconnect, device number 27 [ 446.038333][T10284] tmpfs: Unknown parameter 'grpquota_block_hardli`it' [ 446.372036][T10292] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1636'. [ 448.017558][T10299] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1639'. [ 449.345267][T10311] hub 8-0:1.0: USB hub found [ 449.348176][T10311] hub 8-0:1.0: 1 port detected [ 449.846848][T10302] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.1640'. [ 450.320351][T10314] kvm: kvm [10313]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 450.818716][T10321] tipc: Failed to obtain node identity [ 450.818748][T10321] tipc: Enabling of bearer rejected, failed to enable media [ 450.934487][ T5604] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 451.085787][ T5604] usb 2-1: Using ep0 maxpacket: 32 [ 451.086511][ T5604] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 451.137696][ T5604] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 451.141822][ T5604] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.141889][ T5604] usb 2-1: Product: syz [ 451.141906][ T5604] usb 2-1: Manufacturer: syz [ 451.141922][ T5604] usb 2-1: SerialNumber: syz [ 451.178787][ T5604] usb 2-1: config 0 descriptor?? [ 451.198318][ T5604] gs_usb 2-1:0.0: Required endpoints not found [ 451.435318][ T5878] usb 2-1: USB disconnect, device number 28 [ 451.807806][T10335] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1650'. [ 452.714348][T10140] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 452.814289][ T5709] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 454.197346][T10345] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1651'. [ 454.285816][T10348] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1641'. [ 454.343577][T10140] usb 5-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 454.382273][T10140] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.382378][T10140] usb 5-1: Product: syz [ 454.382394][T10140] usb 5-1: Manufacturer: syz [ 454.382419][T10140] usb 5-1: SerialNumber: syz [ 454.431987][ T5709] usb 4-1: not running at top speed; connect to a high speed hub [ 454.432032][ T5709] usb 4-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 454.482318][ T5709] usb 4-1: config 6 has an invalid interface number: 11 but max is 0 [ 454.482351][ T5709] usb 4-1: config 6 has an invalid interface number: 205 but max is 0 [ 454.482372][ T5709] usb 4-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 454.482403][ T5709] usb 4-1: config 6 has no interface number 0 [ 454.482419][ T5709] usb 4-1: config 6 has no interface number 1 [ 454.482521][ T5709] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 454.482549][ T5709] usb 4-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 454.482575][ T5709] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 454.482603][ T5709] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 454.482629][ T5709] usb 4-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 454.482673][ T5709] usb 4-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 454.482701][ T5709] usb 4-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 454.482730][ T5709] usb 4-1: config 6 interface 11 has no altsetting 0 [ 454.482749][ T5709] usb 4-1: config 6 interface 205 has no altsetting 0 [ 454.757993][T10140] usb 5-1: can't set config #1, error -71 [ 454.829421][T10140] usb 5-1: USB disconnect, device number 27 [ 454.940128][ T5709] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.940159][ T5709] usb 4-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 454.940217][ T5709] usb 4-1: Manufacturer:   [ 455.019207][ T5709] usb 4-1: can't set config #6, error -71 [ 455.030691][ T5709] usb 4-1: USB disconnect, device number 30 [ 456.749811][T10372] kvm: kvm [10371]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 456.925806][ T5722] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 457.075690][ T5722] usb 2-1: Using ep0 maxpacket: 32 [ 457.078748][ T5722] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 457.081586][ T5722] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 457.144432][ T5722] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.144465][ T5722] usb 2-1: Product: syz [ 457.144481][ T5722] usb 2-1: Manufacturer: syz [ 457.144497][ T5722] usb 2-1: SerialNumber: syz [ 457.192709][ T5722] usb 2-1: config 0 descriptor?? [ 457.207293][ T5722] gs_usb 2-1:0.0: Required endpoints not found [ 457.428275][ T48] usb 2-1: USB disconnect, device number 29 [ 457.544691][T10378] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1660'. [ 460.197772][T10387] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1662'. [ 460.564537][T10389] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.1663'. [ 460.845849][T10393] input: syz1 as /devices/virtual/input/input72 [ 460.904490][ T5727] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 461.075220][ T5727] usb 5-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 461.077787][ T5727] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 461.077815][ T5727] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 461.077866][ T5727] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 461.080864][ T5727] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.080890][ T5727] usb 5-1: Product: syz [ 461.080906][ T5727] usb 5-1: Manufacturer: syz [ 461.080922][ T5727] usb 5-1: SerialNumber: syz [ 461.335410][ T5727] uvcvideo 5-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 461.335445][ T5727] uvcvideo 5-1:1.0: No valid video chain found. [ 462.644789][ T48] usb 5-1: USB disconnect, device number 28 [ 463.334409][ T9] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 463.487499][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 463.488529][ T9] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 463.490436][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 463.490472][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 463.493600][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.493633][ T9] usb 4-1: Product: syz [ 463.493652][ T9] usb 4-1: Manufacturer: syz [ 463.493669][ T9] usb 4-1: SerialNumber: syz [ 463.572483][ T9] usb 4-1: config 0 descriptor?? [ 463.601713][ T9] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 463.601754][ T9] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 466.277585][T10426] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1674'. [ 466.565499][ T9] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 466.573073][ T9] em28xx 4-1:0.0: Config register raw data: 0xaf [ 466.573101][ T9] em28xx 4-1:0.0: I2S Audio (1 sample rate(s)) [ 466.573120][ T9] em28xx 4-1:0.0: No AC97 audio processor [ 466.870375][ T9] usb 4-1: USB disconnect, device number 31 [ 467.494564][ T9] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 467.654332][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 467.655170][ T9] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 467.662015][ T9] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 467.662044][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 467.707975][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.708004][ T9] usb 5-1: Product: syz [ 467.708020][ T9] usb 5-1: Manufacturer: syz [ 467.708035][ T9] usb 5-1: SerialNumber: syz [ 467.742622][ T9] usb 5-1: config 0 descriptor?? [ 467.895966][ T9] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 467.896003][ T9] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 468.120367][T10447] tipc: Failed to obtain node identity [ 468.120399][T10447] tipc: Enabling of bearer rejected, failed to enable media [ 468.374927][ T9] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 468.375813][ T9] em28xx 5-1:0.0: Config register raw data: 0xaf [ 468.375834][ T9] em28xx 5-1:0.0: I2S Audio (1 sample rate(s)) [ 468.375852][ T9] em28xx 5-1:0.0: No AC97 audio processor [ 468.464372][ T5878] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 468.590337][ T9] usb 5-1: USB disconnect, device number 29 [ 468.642294][T10452] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1682'. [ 469.184329][ T5878] usb 2-1: Using ep0 maxpacket: 32 [ 469.187753][ T5878] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 469.189959][ T5878] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 469.214709][ T5878] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.214784][ T5878] usb 2-1: Product: syz [ 469.214825][ T5878] usb 2-1: Manufacturer: syz [ 469.214882][ T5878] usb 2-1: SerialNumber: syz [ 469.268032][ T5878] usb 2-1: config 0 descriptor?? [ 470.130204][ T5878] gs_usb 2-1:0.0: Required endpoints not found [ 470.446896][ T5722] usb 2-1: USB disconnect, device number 30 [ 471.074875][T10480] hub 8-0:1.0: USB hub found [ 471.077162][T10480] hub 8-0:1.0: 1 port detected [ 473.382590][T10512] IPVS: sync thread started: state = BACKUP, mcast_ifn = vxcan1, syncid = 0, id = 0 [ 474.815663][T10529] hub 8-0:1.0: USB hub found [ 474.816044][T10529] hub 8-0:1.0: 1 port detected [ 475.058193][T10532] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1708'. [ 475.213932][T10535] FAULT_INJECTION: forcing a failure. [ 475.213932][T10535] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 475.213969][T10535] CPU: 0 UID: 0 PID: 10535 Comm: syz.4.1709 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 475.213995][T10535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 475.214010][T10535] Call Trace: [ 475.214019][T10535] [ 475.214029][T10535] dump_stack_lvl+0xe8/0x150 [ 475.214071][T10535] should_fail_ex+0x467/0x600 [ 475.214121][T10535] _copy_from_user+0x2d/0xb0 [ 475.214150][T10535] ___sys_sendmsg+0x1c6/0x360 [ 475.214308][T10535] ? __lock_acquire+0x683/0x2ce0 [ 475.214357][T10535] ? __pfx____sys_sendmsg+0x10/0x10 [ 475.214425][T10535] ? __fget_files+0x2a/0x420 [ 475.214447][T10535] ? __fget_files+0x3a8/0x420 [ 475.214480][T10535] __x64_sys_sendmsg+0x1b7/0x290 [ 475.214512][T10535] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 475.214560][T10535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.214587][T10535] do_syscall_64+0x174/0x580 [ 475.214623][T10535] ? trace_irq_disable+0x3b/0x140 [ 475.214681][T10535] ? clear_bhb_loop+0x70/0xc0 [ 475.214710][T10535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.214733][T10535] RIP: 0033:0x7f5534cce0d9 [ 475.214755][T10535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 475.214774][T10535] RSP: 002b:00007f5532f05028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 475.214798][T10535] RAX: ffffffffffffffda RBX: 00007f5534f56090 RCX: 00007f5534cce0d9 [ 475.214815][T10535] RDX: 987a3a9f32358a4c RSI: 00002000000002c0 RDI: 0000000000000003 [ 475.214830][T10535] RBP: 00007f5532f05090 R08: 0000000000000000 R09: 0000000000000000 [ 475.214844][T10535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 475.214857][T10535] R13: 00007f5534f56128 R14: 00007f5534f56090 R15: 00007fff1ee075f8 [ 475.214892][T10535] [ 476.709611][T10542] kvm: kvm [10540]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 476.932494][T10552] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1714'. [ 477.157838][T10562] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1718'. [ 477.395525][ T37] audit: type=1326 audit(1786377411.317:368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10567 comm="syz.3.1721" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x0 [ 477.474340][ T5878] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 477.624270][ T5878] usb 2-1: Using ep0 maxpacket: 32 [ 477.625121][ T5878] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 477.626732][ T5878] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 477.626765][ T5878] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 477.626795][ T5878] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 477.626820][ T5878] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 477.626849][ T5878] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 477.630504][ T5878] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.630526][ T5878] usb 2-1: Product: syz [ 477.630538][ T5878] usb 2-1: Manufacturer: syz [ 477.630550][ T5878] usb 2-1: SerialNumber: syz [ 477.719340][ T5878] usb 2-1: config 0 descriptor?? [ 478.829122][ T5878] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 478.829966][ T5878] input input73: Device does not respond to id packet M [ 478.880356][ T5878] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 478.880896][ T5878] input input73: Device does not respond to id packet P [ 479.019659][ T5878] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 479.019716][ T5878] input input73: Device does not respond to id packet B [ 479.021557][ T5878] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 479.021606][ T5878] input input73: Device does not respond to id packet N [ 479.023715][ T5878] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 479.026002][ T5878] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 479.029351][ T5878] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 479.148698][ T5878] iforce 2-1:0.0: usb_submit_urb failed: -71 [ 479.229840][ T5878] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input73 [ 479.405757][T10582] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1726'. [ 479.476008][T10584] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1728'. [ 479.583276][T10590] input: syz1 as /devices/virtual/input/input74 [ 479.701151][ T5878] usb 2-1: USB disconnect, device number 31 [ 479.825733][T10594] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1730'. [ 480.215350][ T8564] udevd[8564]: setting owner of /dev/input/js0 to uid=0, gid=104 failed: No such file or directory [ 480.563445][T10604] IPVS: sync thread started: state = BACKUP, mcast_ifn = vxcan1, syncid = 0, id = 0 [ 480.952059][T10613] faux_driver vgem: [drm] Unknown color mode 55359; guessing buffer size. [ 482.165351][T10619] tipc: Failed to obtain node identity [ 482.165387][T10619] tipc: Enabling of bearer rejected, failed to enable media [ 482.509188][T10613] nvme nvme0: failed to connect socket: -512 [ 482.559416][ T9] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 482.724243][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 482.725134][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 482.726745][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 482.726774][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 482.731218][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.731248][ T9] usb 3-1: Product: syz [ 482.731264][ T9] usb 3-1: Manufacturer: syz [ 482.731280][ T9] usb 3-1: SerialNumber: syz [ 482.849393][ T9] usb 3-1: config 0 descriptor?? [ 482.877192][T10645] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1745'. [ 482.963759][ T9] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 482.963798][ T9] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 483.136830][T10651] kvm: kvm [10650]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 483.478912][ T9] em28xx 3-1:0.0: unknown em28xx chip ID (240) [ 483.483597][T10657] input: syz1 as /devices/virtual/input/input75 [ 483.687698][ T9] em28xx 3-1:0.0: Config register raw data: 0xaf [ 483.687724][ T9] em28xx 3-1:0.0: I2S Audio (3 sample rate(s)) [ 483.687847][ T9] em28xx 3-1:0.0: No AC97 audio processor [ 483.900948][T10659] kvm: kvm [10658]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 483.916369][ T9] usb 3-1: USB disconnect, device number 28 [ 484.946504][T10671] tipc: Failed to obtain node identity [ 484.946537][T10671] tipc: Enabling of bearer rejected, failed to enable media [ 485.294433][ T9] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 485.445269][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 485.448380][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 485.448440][ T9] usb 5-1: New USB device found, idVendor=0c2e, idProduct=0700, bcdDevice=d4.f4 [ 485.450464][ T9] usb 5-1: config 100 has an invalid interface number: 173 but max is 0 [ 485.450491][ T9] usb 5-1: config 100 has an invalid descriptor of length 0, skipping remainder of the config [ 485.450513][ T9] usb 5-1: config 100 has no interface number 0 [ 485.450561][ T9] usb 5-1: config 100 interface 173 altsetting 142 bulk endpoint 0xE has invalid maxpacket 64 [ 485.450588][ T9] usb 5-1: config 100 interface 173 altsetting 142 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 485.450616][ T9] usb 5-1: config 100 interface 173 has no altsetting 0 [ 485.514426][T10428] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 485.529524][ T9] usb 5-1: string descriptor 0 read error: -22 [ 485.529674][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.569313][T10678] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 485.585848][ T9] metro_usb 5-1:100.173: required endpoints missing [ 485.725393][T10428] usb 3-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 485.731905][T10428] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.731933][T10428] usb 3-1: Product: syz [ 485.731949][T10428] usb 3-1: Manufacturer: syz [ 485.731966][T10428] usb 3-1: SerialNumber: syz [ 485.833418][ T5709] usb 5-1: USB disconnect, device number 30 [ 485.925317][T10692] netlink: 16054 bytes leftover after parsing attributes in process `syz.1.1761'. [ 486.002367][T10428] usb 3-1: selecting invalid altsetting 1 [ 486.002393][T10428] speedtch 3-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 486.002471][T10428] speedtch 3-1:1.0: usbatm_usb_probe: bind failed: -22! [ 486.002535][T10428] speedtch 3-1:1.0: probe with driver speedtch failed with error -22 [ 486.055373][T10428] usb 3-1: selecting invalid altsetting 1 [ 486.055399][T10428] speedtch 3-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 486.055985][T10428] speedtch 3-1:1.1: usbatm_usb_probe: bind failed: -22! [ 486.056041][T10428] speedtch 3-1:1.1: probe with driver speedtch failed with error -22 [ 486.063596][T10428] usb 3-1: USB disconnect, device number 29 [ 486.484317][ T5725] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 486.562918][T10700] netlink: ct family unspecified [ 486.562950][T10700] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 486.634263][ T5725] usb 2-1: Using ep0 maxpacket: 16 [ 486.635442][ T5725] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 486.637777][ T5725] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 486.637814][ T5725] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 486.643784][ T5725] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.643812][ T5725] usb 2-1: Product: syz [ 486.643827][ T5725] usb 2-1: Manufacturer: syz [ 486.643843][ T5725] usb 2-1: SerialNumber: syz [ 486.713013][ T5725] usb 2-1: config 0 descriptor?? [ 486.737470][ T5725] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 486.737508][ T5725] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 487.371688][ T5725] em28xx 2-1:0.0: unknown em28xx chip ID (240) [ 487.572758][ T5725] em28xx 2-1:0.0: Config register raw data: 0xaf [ 487.572784][ T5725] em28xx 2-1:0.0: I2S Audio (3 sample rate(s)) [ 487.572801][ T5725] em28xx 2-1:0.0: No AC97 audio processor [ 487.801157][ T5725] usb 2-1: USB disconnect, device number 32 [ 488.174348][ T5604] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 488.314338][ T5604] usb 5-1: device descriptor read/64, error -71 [ 488.434873][T10722] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1772'. [ 488.595600][ T5604] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 488.735808][ T5604] usb 5-1: device descriptor read/64, error -71 [ 488.775794][T10728] ======================================================= [ 488.775794][T10728] WARNING: The mand mount option has been deprecated and [ 488.775794][T10728] and is ignored by this kernel. Remove the mand [ 488.775794][T10728] option from the mount to silence this warning. [ 488.775794][T10728] ======================================================= [ 488.844966][ T5604] usb usb5-port1: attempt power cycle [ 488.885195][T10728] UBIFS error (pid: 10728): cannot open "ubi0_0", error -19 [ 489.184679][ T48] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 489.215864][ T5604] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 489.235234][ T5604] usb 5-1: device descriptor read/8, error -71 [ 489.269544][T10739] binder: Bad value for 'stats' [ 489.337532][ T48] usb 2-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 489.354068][ T48] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.354093][ T48] usb 2-1: Product: syz [ 489.354108][ T48] usb 2-1: Manufacturer: syz [ 489.354266][ T48] usb 2-1: SerialNumber: syz [ 489.429003][T10742] kvm: kvm [10741]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 489.524351][ T5604] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 489.555071][ T5604] usb 5-1: device descriptor read/8, error -71 [ 489.627923][ T48] usb 2-1: selecting invalid altsetting 1 [ 489.627948][ T48] speedtch 2-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 489.628020][ T48] speedtch 2-1:1.0: usbatm_usb_probe: bind failed: -22! [ 489.628076][ T48] speedtch 2-1:1.0: probe with driver speedtch failed with error -22 [ 489.673281][ T48] usb 2-1: selecting invalid altsetting 1 [ 489.673305][ T48] speedtch 2-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 489.673988][ T48] speedtch 2-1:1.1: usbatm_usb_probe: bind failed: -22! [ 489.674054][ T48] speedtch 2-1:1.1: probe with driver speedtch failed with error -22 [ 489.676423][ T5604] usb usb5-port1: unable to enumerate USB device [ 489.731425][ T48] usb 2-1: USB disconnect, device number 33 [ 490.564484][ T5604] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 490.724330][ T5604] usb 2-1: Using ep0 maxpacket: 16 [ 490.725227][ T5604] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 490.726811][ T5604] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 490.726843][ T5604] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 490.730484][ T5604] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 490.730508][ T5604] usb 2-1: Product: syz [ 490.730523][ T5604] usb 2-1: Manufacturer: syz [ 490.730537][ T5604] usb 2-1: SerialNumber: syz [ 490.740008][ T9] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 490.807582][ T5604] usb 2-1: config 0 descriptor?? [ 490.825701][ T5604] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 490.825731][ T5604] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 490.831686][T10758] netlink: ct family unspecified [ 490.831717][T10758] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 490.964227][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 490.988819][ T9] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 491.022132][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 491.063800][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.064056][ T9] usb 4-1: Product: syz [ 491.064076][ T9] usb 4-1: Manufacturer: syz [ 491.064092][ T9] usb 4-1: SerialNumber: syz [ 491.112079][ T9] usb 4-1: config 0 descriptor?? [ 491.143529][ T9] gs_usb 4-1:0.0: Required endpoints not found [ 491.183061][T10760] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.1789'. [ 491.368231][ T9] usb 4-1: USB disconnect, device number 32 [ 491.451916][ T5604] em28xx 2-1:0.0: unknown em28xx chip ID (240) [ 491.655102][ T5604] em28xx 2-1:0.0: Config register raw data: 0xaf [ 491.655128][ T5604] em28xx 2-1:0.0: I2S Audio (3 sample rate(s)) [ 491.655144][ T5604] em28xx 2-1:0.0: No AC97 audio processor [ 491.838160][T10777] hub 8-0:1.0: USB hub found [ 491.838554][T10777] hub 8-0:1.0: 1 port detected [ 491.899023][ T5604] usb 2-1: USB disconnect, device number 34 [ 492.624717][T10781] kvm: kvm [10779]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010007) = 0x8019b [ 493.165773][T10800] netlink: 16054 bytes leftover after parsing attributes in process `syz.3.1802'. [ 494.144717][T10814] hub 8-0:1.0: USB hub found [ 494.145270][T10814] hub 8-0:1.0: 1 port detected [ 494.354673][ T9] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 494.535906][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 494.536820][ T9] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 494.538415][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 494.542430][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.542456][ T9] usb 2-1: Product: syz [ 494.542473][ T9] usb 2-1: Manufacturer: syz [ 494.542489][ T9] usb 2-1: SerialNumber: syz [ 494.610783][ T9] usb 2-1: config 0 descriptor?? [ 494.645425][ T9] gs_usb 2-1:0.0: Required endpoints not found [ 494.873145][ T9] usb 2-1: USB disconnect, device number 35 [ 494.922099][T10822] netlink: 'syz.4.1809': attribute type 3 has an invalid length. [ 495.092073][T10826] input: syz1 as /devices/virtual/input/input76 [ 495.495031][T10835] netlink: 'syz.3.1814': attribute type 3 has an invalid length. [ 496.815087][T10841] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1816'. [ 497.004315][ T9] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 497.144327][ T9] usb 5-1: device descriptor read/64, error -71 [ 497.147297][T10847] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1817'. [ 497.392135][T10852] hub 8-0:1.0: USB hub found [ 497.396851][ T9] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 497.415976][T10852] hub 8-0:1.0: 1 port detected [ 497.554464][ T9] usb 5-1: device descriptor read/64, error -71 [ 497.662542][T10859] hub 8-0:1.0: USB hub found [ 497.663074][T10859] hub 8-0:1.0: 1 port detected [ 497.691659][ T9] usb usb5-port1: attempt power cycle [ 498.315226][ T9] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 498.344977][ T9] usb 5-1: device descriptor read/8, error -71 [ 498.604310][ T9] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 498.637137][ T9] usb 5-1: device descriptor read/8, error -71 [ 498.744864][ T9] usb usb5-port1: unable to enumerate USB device [ 498.763251][T10862] input: syz1 as /devices/virtual/input/input77 [ 499.224101][T10865] netlink: 'syz.3.1825': attribute type 3 has an invalid length. [ 499.554620][T10872] 9p: Bad value for 'smackfstransmute' [ 501.371728][T10881] hub 8-0:1.0: USB hub found [ 501.372081][T10881] hub 8-0:1.0: 1 port detected [ 501.425013][T10893] input: syz1 as /devices/virtual/input/input78 [ 501.444658][T10894] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1832'. [ 501.446506][T10894] hub 8-0:1.0: USB hub found [ 501.446884][T10894] hub 8-0:1.0: 1 port detected [ 502.348849][T10905] netlink: 'syz.2.1837': attribute type 3 has an invalid length. [ 503.636822][T10923] input: syz1 as /devices/virtual/input/input79 [ 504.036971][T10931] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1847'. [ 504.338937][T10938] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1850'. [ 504.383477][T10935] netlink: 'syz.2.1849': attribute type 3 has an invalid length. [ 504.604279][ T9] usb 4-1: new full-speed USB device number 33 using dummy_hcd [ 504.762355][ T9] usb 4-1: not running at top speed; connect to a high speed hub [ 504.762399][ T9] usb 4-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 504.784387][ T9] usb 4-1: config 6 has an invalid interface number: 11 but max is 0 [ 504.784418][ T9] usb 4-1: config 6 has an invalid interface number: 205 but max is 0 [ 504.784441][ T9] usb 4-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 504.784463][ T9] usb 4-1: config 6 has no interface number 0 [ 504.784480][ T9] usb 4-1: config 6 has no interface number 1 [ 504.784544][ T9] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 504.784572][ T9] usb 4-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 504.784599][ T9] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 504.784627][ T9] usb 4-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 504.784655][ T9] usb 4-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 504.784697][ T9] usb 4-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 504.784725][ T9] usb 4-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 504.784753][ T9] usb 4-1: config 6 interface 11 has no altsetting 0 [ 504.784772][ T9] usb 4-1: config 6 interface 205 has no altsetting 0 [ 504.820927][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.820958][ T9] usb 4-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 504.820994][ T9] usb 4-1: Manufacturer:   [ 504.821009][ T9] usb 4-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 505.011400][T10938] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 505.011571][T10938] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 505.150007][T10954] input: syz1 as /devices/virtual/input/input80 [ 505.237671][ T9] option 4-1:6.11: GSM modem (1-port) converter detected [ 505.321101][ T9] usb 4-1: USB disconnect, device number 33 [ 505.355822][ T9] option 4-1:6.11: device disconnected [ 506.003903][T10967] FAULT_INJECTION: forcing a failure. [ 506.003903][T10967] name failslab, interval 1, probability 0, space 0, times 0 [ 506.003946][T10967] CPU: 1 UID: 0 PID: 10967 Comm: syz.3.1860 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 506.003974][T10967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 506.003990][T10967] Call Trace: [ 506.004000][T10967] [ 506.004011][T10967] dump_stack_lvl+0xe8/0x150 [ 506.004054][T10967] should_fail_ex+0x467/0x600 [ 506.004098][T10967] should_failslab+0xa8/0x100 [ 506.004170][T10967] kmem_cache_alloc_node_noprof+0xae/0x670 [ 506.004222][T10967] ? __alloc_skb+0x1d7/0x7a0 [ 506.004321][T10967] ? __alloc_skb+0x1d7/0x7a0 [ 506.004356][T10967] __alloc_skb+0x1d7/0x7a0 [ 506.004387][T10967] tcp_stream_alloc_skb+0x3f/0x5c0 [ 506.004492][T10967] tcp_sendmsg_locked+0x143d/0x55c0 [ 506.004554][T10967] ? __lock_acquire+0x683/0x2ce0 [ 506.004612][T10967] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 506.004656][T10967] ? __local_bh_enable_ip+0x1ae/0x2b0 [ 506.004705][T10967] ? lockdep_hardirqs_on+0x7a/0x110 [ 506.004748][T10967] tcp_sendmsg+0x2f/0x50 [ 506.004780][T10967] ? __pfx_inet_sendmsg+0x10/0x10 [ 506.004830][T10967] sock_sendmsg_nosec+0x10e/0x180 [ 506.004873][T10967] sock_write_iter+0x2e4/0x3f0 [ 506.004912][T10967] ? __pfx_sock_write_iter+0x10/0x10 [ 506.004958][T10967] ? bpf_lsm_file_permission+0x9/0x20 [ 506.005014][T10967] ? security_file_permission+0x75/0x260 [ 506.005063][T10967] vfs_write+0x61e/0xbb0 [ 506.005111][T10967] ? __pfx_vfs_write+0x10/0x10 [ 506.005155][T10967] ? __fget_files+0x2a/0x420 [ 506.005189][T10967] ksys_write+0x156/0x270 [ 506.005223][T10967] ? __pfx_ksys_write+0x10/0x10 [ 506.005263][T10967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.005292][T10967] do_syscall_64+0x174/0x580 [ 506.005326][T10967] ? trace_irq_disable+0x3b/0x140 [ 506.005366][T10967] ? clear_bhb_loop+0x70/0xc0 [ 506.005398][T10967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.005432][T10967] RIP: 0033:0x7f7ecbaee0d9 [ 506.005456][T10967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 506.005478][T10967] RSP: 002b:00007f7ec9d46028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 506.005504][T10967] RAX: ffffffffffffffda RBX: 00007f7ecbd75fa0 RCX: 00007f7ecbaee0d9 [ 506.005523][T10967] RDX: 00000000000002e9 RSI: 0000200000001e00 RDI: 0000000000000003 [ 506.005539][T10967] RBP: 00007f7ec9d46090 R08: 0000000000000000 R09: 0000000000000000 [ 506.005555][T10967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 506.005569][T10967] R13: 00007f7ecbd76038 R14: 00007f7ecbd75fa0 R15: 00007ffd1f62cd48 [ 506.005610][T10967] [ 506.708082][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 506.708132][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 506.785549][T10982] netlink: 'syz.4.1866': attribute type 3 has an invalid length. [ 506.830889][T10987] input: syz1 as /devices/virtual/input/input81 [ 506.871603][T10989] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1867'. [ 507.112711][T10993] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1870'. [ 507.376707][ T48] usb 2-1: new full-speed USB device number 36 using dummy_hcd [ 507.529218][ T48] usb 2-1: not running at top speed; connect to a high speed hub [ 507.529262][ T48] usb 2-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 507.532374][ T48] usb 2-1: config 6 has an invalid interface number: 11 but max is 0 [ 507.532404][ T48] usb 2-1: config 6 has an invalid interface number: 205 but max is 0 [ 507.532651][ T48] usb 2-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 507.532675][ T48] usb 2-1: config 6 has no interface number 0 [ 507.532693][ T48] usb 2-1: config 6 has no interface number 1 [ 507.532756][ T48] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 507.532786][ T48] usb 2-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 507.532823][ T48] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 507.532853][ T48] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 507.532883][ T48] usb 2-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 507.532925][ T48] usb 2-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 507.532954][ T48] usb 2-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 507.532983][ T48] usb 2-1: config 6 interface 11 has no altsetting 0 [ 507.533003][ T48] usb 2-1: config 6 interface 205 has no altsetting 0 [ 507.692762][ T48] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.692791][ T48] usb 2-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 507.692838][ T48] usb 2-1: Manufacturer:   [ 507.692853][ T48] usb 2-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 507.798099][T10993] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 507.798227][T10993] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 507.939385][T11007] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.1874'. [ 508.113724][ T48] option 2-1:6.11: GSM modem (1-port) converter detected [ 508.209051][ T48] usb 2-1: USB disconnect, device number 36 [ 508.260825][ T48] option 2-1:6.11: device disconnected [ 508.269962][ T5725] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 508.316762][T11012] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1875'. [ 508.415314][ T5725] usb 3-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 508.417152][ T5725] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 508.417177][ T5725] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 508.417227][ T5725] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 508.420999][ T5725] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.421025][ T5725] usb 3-1: Product: syz [ 508.421040][ T5725] usb 3-1: Manufacturer: syz [ 508.421056][ T5725] usb 3-1: SerialNumber: syz [ 508.586686][ T5725] uvcvideo 3-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 508.586722][ T5725] uvcvideo 3-1:1.0: No valid video chain found. [ 508.755376][ T5725] usb 3-1: USB disconnect, device number 30 [ 508.764411][T11019] jffs2: notice: (11019) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 509.051714][T11022] netlink: 'syz.1.1878': attribute type 11 has an invalid length. [ 509.092075][T11021] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1878'. [ 509.154840][T11029] hub 8-0:1.0: USB hub found [ 509.155233][T11029] hub 8-0:1.0: 1 port detected [ 509.522571][T11033] netlink: 'syz.3.1882': attribute type 3 has an invalid length. [ 509.571524][T11035] input: syz1 as /devices/virtual/input/input82 [ 510.209946][T11047] hub 8-0:1.0: USB hub found [ 510.210517][T11047] hub 8-0:1.0: 1 port detected [ 512.300035][T11073] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.1891'. [ 512.349810][T11077] netlink: 'syz.0.1893': attribute type 3 has an invalid length. [ 512.724303][T10140] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 512.742375][T11083] input: syz1 as /devices/virtual/input/input83 [ 512.877163][T10140] usb 3-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 512.879685][T10140] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 512.879712][T10140] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 512.879764][T10140] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 512.929127][T10140] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.929155][T10140] usb 3-1: Product: syz [ 512.929171][T10140] usb 3-1: Manufacturer: syz [ 512.929187][T10140] usb 3-1: SerialNumber: syz [ 512.989628][T10140] uvcvideo 3-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 512.989663][T10140] uvcvideo 3-1:1.0: No valid video chain found. [ 513.035884][T11089] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1896'. [ 513.053688][T11089] hub 8-0:1.0: USB hub found [ 513.054085][T11089] hub 8-0:1.0: 1 port detected [ 513.202372][T10140] usb 3-1: USB disconnect, device number 31 [ 513.297188][T11094] netlink: 16054 bytes leftover after parsing attributes in process `syz.3.1898'. [ 513.578301][T11101] netlink: 116 bytes leftover after parsing attributes in process `syz.4.1899'. [ 513.952766][T11099] nvme nvme0: failed to connect socket: -111 [ 514.636345][T11112] netlink: 'syz.3.1905': attribute type 3 has an invalid length. [ 514.725201][T10140] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 514.874377][T10140] usb 5-1: Using ep0 maxpacket: 32 [ 514.875055][T10140] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 514.878430][T10140] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 514.909403][T10140] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.909433][T10140] usb 5-1: Product: syz [ 514.909450][T10140] usb 5-1: Manufacturer: syz [ 514.909465][T10140] usb 5-1: SerialNumber: syz [ 514.964306][T10140] usb 5-1: config 0 descriptor?? [ 514.993484][T10140] gs_usb 5-1:0.0: Required endpoints not found [ 515.183728][T10140] usb 5-1: USB disconnect, device number 39 [ 515.185947][ T5604] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 515.357741][ T5604] usb 3-1: Using ep0 maxpacket: 16 [ 515.360692][ T5604] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 515.361566][ T5604] usb 3-1: config 0 has no interfaces? [ 515.380022][ T5604] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.380103][ T5604] usb 3-1: Product: syz [ 515.380145][ T5604] usb 3-1: Manufacturer: syz [ 515.380186][ T5604] usb 3-1: SerialNumber: syz [ 515.429232][ T5604] usb 3-1: config 0 descriptor?? [ 515.656420][T11126] input: syz1 as /devices/virtual/input/input84 [ 516.035667][T11132] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.1911'. [ 516.539890][T11150] netlink: 'syz.3.1917': attribute type 3 has an invalid length. [ 516.889344][T11160] netlink: 116 bytes leftover after parsing attributes in process `syz.4.1919'. [ 516.920294][T11160] hub 8-0:1.0: USB hub found [ 516.922543][T11160] hub 8-0:1.0: 1 port detected [ 517.953189][ T9] usb 3-1: USB disconnect, device number 32 [ 517.995155][T11162] input: syz1 as /devices/virtual/input/input85 [ 519.359485][T11189] netlink: 'syz.2.1930': attribute type 3 has an invalid length. [ 519.924557][ T5604] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 520.074267][ T5604] usb 5-1: Using ep0 maxpacket: 32 [ 520.075355][ T5604] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 520.077222][ T5604] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 520.095394][ T5604] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.095424][ T5604] usb 5-1: Product: syz [ 520.095440][ T5604] usb 5-1: Manufacturer: syz [ 520.095455][ T5604] usb 5-1: SerialNumber: syz [ 520.156994][ T5604] usb 5-1: config 0 descriptor?? [ 520.188897][ T5604] gs_usb 5-1:0.0: Required endpoints not found [ 520.405293][ T5722] usb 5-1: USB disconnect, device number 40 [ 520.512923][T11218] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1940'. [ 520.558747][T11216] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.1939'. [ 520.578599][T11221] input: syz1 as /devices/virtual/input/input86 [ 520.784408][T10140] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 520.944558][T10140] usb 2-1: not running at top speed; connect to a high speed hub [ 520.944605][T10140] usb 2-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 520.948939][T10140] usb 2-1: config 6 has an invalid interface number: 11 but max is 0 [ 520.948972][T10140] usb 2-1: config 6 has an invalid interface number: 205 but max is 0 [ 520.948997][T10140] usb 2-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 520.949022][T10140] usb 2-1: config 6 has no interface number 0 [ 520.949041][T10140] usb 2-1: config 6 has no interface number 1 [ 520.949109][T10140] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 520.949142][T10140] usb 2-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 520.949172][T10140] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 520.949205][T10140] usb 2-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 520.949237][T10140] usb 2-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 520.949283][T10140] usb 2-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 520.949313][T10140] usb 2-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 520.949347][T10140] usb 2-1: config 6 interface 11 has no altsetting 0 [ 520.949369][T10140] usb 2-1: config 6 interface 205 has no altsetting 0 [ 521.094437][T10140] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.094468][T10140] usb 2-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 521.094506][T10140] usb 2-1: Manufacturer:   [ 521.094522][T10140] usb 2-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 521.195917][T11218] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 521.196051][T11218] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 521.306731][T11228] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 521.430267][T10140] option 2-1:6.11: GSM modem (1-port) converter detected [ 521.544499][T11234] hub 8-0:1.0: USB hub found [ 521.546794][T11234] hub 8-0:1.0: 1 port detected [ 521.992931][T11235] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1946'. [ 522.369971][T10140] usb 2-1: USB disconnect, device number 37 [ 522.528444][T10140] option 2-1:6.11: device disconnected [ 522.799822][T11243] hub 8-0:1.0: USB hub found [ 522.802899][T11243] hub 8-0:1.0: 1 port detected [ 524.071485][T11249] input: syz1 as /devices/virtual/input/input87 [ 524.334370][ T9] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 524.495147][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 524.497226][ T9] usb 3-1: config 0 has an invalid descriptor of length 144, skipping remainder of the config [ 524.497267][ T9] usb 3-1: too many endpoints for config 0 interface 0 altsetting 255: 255, using maximum allowed: 30 [ 524.497309][ T9] usb 3-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 524.497348][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 524.497382][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 524.575294][ T9] usb 3-1: config 0 descriptor?? [ 524.794846][ T5709] usb 3-1: USB disconnect, device number 33 [ 524.967538][T11270] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.1961'. [ 524.992326][T11274] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1959'. [ 525.124990][T11276] netlink: 116 bytes leftover after parsing attributes in process `syz.3.1962'. [ 525.445873][T11280] hub 8-0:1.0: USB hub found [ 525.455387][T11280] hub 8-0:1.0: 1 port detected [ 526.511349][T11284] input: syz1 as /devices/virtual/input/input88 [ 526.587313][T11286] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1964'. [ 527.624314][ T5709] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 527.775321][ T5709] usb 5-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 527.777027][ T5709] usb 5-1: config 0 has an invalid descriptor of length 144, skipping remainder of the config [ 527.777069][ T5709] usb 5-1: too many endpoints for config 0 interface 0 altsetting 255: 255, using maximum allowed: 30 [ 527.777111][ T5709] usb 5-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 527.777140][ T5709] usb 5-1: config 0 interface 0 has no altsetting 0 [ 527.777175][ T5709] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 527.847521][ T5709] usb 5-1: config 0 descriptor?? [ 527.852683][T11293] jffs2: notice: (11293) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 527.991694][T11297] netlink: 'syz.1.1968': attribute type 11 has an invalid length. [ 528.012138][T11293] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1968'. [ 528.089272][T11300] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1970'. [ 528.119228][ T5725] usb 5-1: USB disconnect, device number 41 [ 528.721529][T11316] hub 8-0:1.0: USB hub found [ 528.724576][T11316] hub 8-0:1.0: 1 port detected [ 529.509340][T11318] input: syz1 as /devices/virtual/input/input89 [ 529.876368][T11324] netlink: 116 bytes leftover after parsing attributes in process `syz.4.1977'. [ 530.046686][T11328] netlink: 116 bytes leftover after parsing attributes in process `syz.1.1978'. [ 530.580487][T11333] netlink: 116 bytes leftover after parsing attributes in process `syz.0.1979'. [ 531.041168][T11336] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.1981'. [ 531.067528][T11339] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1982'. [ 531.283336][T11341] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 531.283375][T11341] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 531.394396][ T5725] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 531.545035][ T5725] usb 5-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 531.546534][ T5725] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 531.546561][ T5725] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 531.546613][ T5725] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 531.553398][ T5725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 531.553425][ T5725] usb 5-1: Product: syz [ 531.553441][ T5725] usb 5-1: Manufacturer: syz [ 531.553457][ T5725] usb 5-1: SerialNumber: syz [ 531.657112][ T5725] uvcvideo 5-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 531.657174][ T5725] uvcvideo 5-1:1.0: No valid video chain found. [ 531.857328][ T5725] usb 5-1: USB disconnect, device number 42 [ 531.979846][T11355] input: syz1 as /devices/virtual/input/input90 [ 532.306648][T11344] nvme nvme0: failed to connect socket: -512 [ 532.493949][T11362] netlink: 116 bytes leftover after parsing attributes in process `syz.4.1991'. [ 532.807495][T11366] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1993'. [ 533.274468][T11382] hub 8-0:1.0: USB hub found [ 533.274928][T11382] hub 8-0:1.0: 1 port detected [ 533.414220][T11379] netlink: 116 bytes leftover after parsing attributes in process `syz.2.1997'. [ 534.107438][T11391] input: syz1 as /devices/virtual/input/input91 [ 534.279185][T11394] netlink: 16054 bytes leftover after parsing attributes in process `syz.3.2001'. [ 534.504496][ T9] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 534.604295][ T5725] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 534.666740][ T9] usb 3-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 0.00 [ 534.673995][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.674027][ T9] usb 3-1: Product: syz [ 534.674043][ T9] usb 3-1: Manufacturer: syz [ 534.674060][ T9] usb 3-1: SerialNumber: syz [ 534.776683][ T5725] usb 4-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 534.779309][ T5725] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 534.779338][ T5725] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 534.779389][ T5725] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 534.784005][ T5725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.784032][ T5725] usb 4-1: Product: syz [ 534.784049][ T5725] usb 4-1: Manufacturer: syz [ 534.784065][ T5725] usb 4-1: SerialNumber: syz [ 534.988993][T11408] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2007'. [ 535.004700][ T5725] uvcvideo 4-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 535.005474][ T5725] uvcvideo 4-1:1.0: No valid video chain found. [ 535.009314][ T9] usb 3-1: selecting invalid altsetting 1 [ 535.009337][ T9] speedtch 3-1:1.0: speedtch_bind: setting interface to 1 failed (-22)! [ 535.009411][ T9] speedtch 3-1:1.0: usbatm_usb_probe: bind failed: -22! [ 535.009472][ T9] speedtch 3-1:1.0: probe with driver speedtch failed with error -22 [ 535.089713][ T9] usb 3-1: selecting invalid altsetting 1 [ 535.089730][ T9] speedtch 3-1:1.1: speedtch_bind: setting interface to 1 failed (-22)! [ 535.090182][ T9] speedtch 3-1:1.1: usbatm_usb_probe: bind failed: -22! [ 535.090228][ T9] speedtch 3-1:1.1: probe with driver speedtch failed with error -22 [ 535.113128][T11410] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2006'. [ 535.179476][T10428] usb 4-1: USB disconnect, device number 34 [ 535.221900][ T9] usb 3-1: USB disconnect, device number 34 [ 535.445241][T11414] FAULT_INJECTION: forcing a failure. [ 535.445241][T11414] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 535.445280][T11414] CPU: 1 UID: 0 PID: 11414 Comm: syz.0.2009 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 535.445311][T11414] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 535.445325][T11414] Call Trace: [ 535.445334][T11414] [ 535.445343][T11414] dump_stack_lvl+0xe8/0x150 [ 535.445382][T11414] should_fail_ex+0x467/0x600 [ 535.445420][T11414] _copy_from_user+0x2d/0xb0 [ 535.445446][T11414] ___sys_sendmsg+0x1c6/0x360 [ 535.445474][T11414] ? __lock_acquire+0x683/0x2ce0 [ 535.445502][T11414] ? __pfx____sys_sendmsg+0x10/0x10 [ 535.445568][T11414] ? __fget_files+0x2a/0x420 [ 535.445590][T11414] ? __fget_files+0x3a8/0x420 [ 535.445623][T11414] __x64_sys_sendmsg+0x1b7/0x290 [ 535.445655][T11414] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 535.445702][T11414] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.445728][T11414] do_syscall_64+0x174/0x580 [ 535.445760][T11414] ? trace_irq_disable+0x3b/0x140 [ 535.445795][T11414] ? clear_bhb_loop+0x70/0xc0 [ 535.445824][T11414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.445847][T11414] RIP: 0033:0x7f3f65c4e0d9 [ 535.445868][T11414] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.445887][T11414] RSP: 002b:00007f3f63ea6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 535.445911][T11414] RAX: ffffffffffffffda RBX: 00007f3f65ed5fa0 RCX: 00007f3f65c4e0d9 [ 535.445937][T11414] RDX: 0000000000008004 RSI: 0000200000000180 RDI: 0000000000000004 [ 535.445953][T11414] RBP: 00007f3f63ea6090 R08: 0000000000000000 R09: 0000000000000000 [ 535.445967][T11414] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.445980][T11414] R13: 00007f3f65ed6038 R14: 00007f3f65ed5fa0 R15: 00007ffe14ce0d18 [ 535.446015][T11414] [ 536.158423][T11425] input: syz1 as /devices/virtual/input/input92 [ 536.781565][T11440] hub 8-0:1.0: USB hub found [ 536.786488][T11440] hub 8-0:1.0: 1 port detected [ 538.054929][T11450] jffs2: notice: (11450) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 538.144582][T11451] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.2022'. [ 538.151286][T11454] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2019'. [ 538.191962][T11450] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2021'. [ 538.239721][T11454] hub 8-0:1.0: USB hub found [ 538.240160][T11454] hub 8-0:1.0: 1 port detected [ 538.242082][T11450] netlink: 'syz.3.2021': attribute type 11 has an invalid length. [ 539.640526][T11476] input: syz1 as /devices/virtual/input/input93 [ 540.194257][ T9] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 540.355220][ T9] usb 4-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 540.356739][ T9] usb 4-1: config 0 has an invalid descriptor of length 144, skipping remainder of the config [ 540.356795][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 540.356840][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.423977][ T9] usb 4-1: config 0 descriptor?? [ 540.659947][T10140] usb 4-1: USB disconnect, device number 35 [ 541.388930][T11493] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2034'. [ 541.449439][T11493] hub 8-0:1.0: USB hub found [ 541.458881][T11493] hub 8-0:1.0: 1 port detected [ 542.626777][T11491] netlink: ct family unspecified [ 542.626810][T11491] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 542.713558][T11503] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2035'. [ 544.309967][T11510] input: syz1 as /devices/virtual/input/input94 [ 544.677572][T11516] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2042'. [ 545.417875][T11524] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.2044'. [ 545.794467][ T5604] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 545.795081][T11534] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2046'. [ 545.839425][T11534] hub 8-0:1.0: USB hub found [ 545.855881][T11534] hub 8-0:1.0: 1 port detected [ 545.945484][ T5604] usb 3-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 545.947694][ T5604] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 545.947723][ T5604] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 545.947774][ T5604] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 545.952223][ T5604] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.952252][ T5604] usb 3-1: Product: syz [ 545.952269][ T5604] usb 3-1: Manufacturer: syz [ 545.952285][ T5604] usb 3-1: SerialNumber: syz [ 546.062163][ T5604] uvcvideo 3-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 546.062202][ T5604] uvcvideo 3-1:1.0: No valid video chain found. [ 547.117520][ T31] usb 3-1: USB disconnect, device number 35 [ 547.154353][T11538] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2048'. [ 547.759832][T11543] jffs2: notice: (11543) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 547.920004][T11546] netlink: 'syz.1.2050': attribute type 11 has an invalid length. [ 548.084024][T11543] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2050'. [ 548.610347][T11554] input: syz1 as /devices/virtual/input/input95 [ 549.698205][T11570] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2059'. [ 551.784415][T11595] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2069'. [ 552.008344][T11608] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2071'. [ 552.084316][T10140] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 552.235047][T10140] usb 4-1: Using ep0 maxpacket: 8 [ 552.268964][ T31] usb 3-1: new full-speed USB device number 36 using dummy_hcd [ 552.322613][T11614] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2072'. [ 552.379814][T11614] hub 8-0:1.0: USB hub found [ 552.382579][T11614] hub 8-0:1.0: 1 port detected [ 553.341628][T10140] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 553.355547][T10140] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 553.355604][T10140] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 553.396273][T10140] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.396303][T10140] usb 4-1: Product: syz [ 553.396318][T10140] usb 4-1: Manufacturer: syz [ 553.396333][T10140] usb 4-1: SerialNumber: syz [ 553.443309][T10140] usbtest 4-1:1.0: couldn't get endpoints, -22 [ 553.443408][T10140] usbtest 4-1:1.0: probe with driver usbtest failed with error -22 [ 553.524034][ T31] usb 3-1: not running at top speed; connect to a high speed hub [ 553.524078][ T31] usb 3-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 553.548313][ T31] usb 3-1: config 6 has an invalid interface number: 11 but max is 0 [ 553.548346][ T31] usb 3-1: config 6 has an invalid interface number: 205 but max is 0 [ 553.548368][ T31] usb 3-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 553.548388][ T31] usb 3-1: config 6 has no interface number 0 [ 553.548405][ T31] usb 3-1: config 6 has no interface number 1 [ 553.548463][ T31] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 553.548491][ T31] usb 3-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 553.548528][ T31] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 553.548557][ T31] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 553.548586][ T31] usb 3-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 553.548628][ T31] usb 3-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 553.548656][ T31] usb 3-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 553.548686][ T31] usb 3-1: config 6 interface 11 has no altsetting 0 [ 553.548705][ T31] usb 3-1: config 6 interface 205 has no altsetting 0 [ 553.641491][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.641530][ T31] usb 3-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 553.641589][ T31] usb 3-1: Manufacturer:   [ 553.641606][ T31] usb 3-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 553.766072][T11608] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 553.766203][T11608] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 553.802651][T10428] usb 4-1: USB disconnect, device number 36 [ 553.949656][T11623] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2075'. [ 554.008041][ T31] option 3-1:6.11: GSM modem (1-port) converter detected [ 554.116412][ T31] usb 3-1: USB disconnect, device number 36 [ 554.142476][ T31] option 3-1:6.11: device disconnected [ 554.193722][T11625] hub 8-0:1.0: USB hub found [ 554.202492][T11625] hub 8-0:1.0: 1 port detected [ 554.428074][T11629] IPVS: sync thread started: state = BACKUP, mcast_ifn = vxcan1, syncid = 0, id = 0 [ 554.944389][T11637] jffs2: notice: (11637) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 555.224398][T11639] netlink: 'syz.2.2082': attribute type 11 has an invalid length. [ 555.459693][T11637] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2082'. [ 556.231969][T11661] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2089'. [ 556.439003][T11651] netlink: 'syz.1.2085': attribute type 11 has an invalid length. [ 556.439029][T11651] netlink: 'syz.1.2085': attribute type 4 has an invalid length. [ 556.867048][T11679] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.2095'. [ 557.237231][T11674] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2091'. [ 557.451998][T11693] input: syz1 as /devices/virtual/input/input96 [ 557.887096][T11699] FAULT_INJECTION: forcing a failure. [ 557.887096][T11699] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 557.887133][T11699] CPU: 1 UID: 0 PID: 11699 Comm: syz.4.2101 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 557.887157][T11699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 557.887171][T11699] Call Trace: [ 557.887180][T11699] [ 557.887190][T11699] dump_stack_lvl+0xe8/0x150 [ 557.887228][T11699] should_fail_ex+0x467/0x600 [ 557.887264][T11699] _copy_from_user+0x2d/0xb0 [ 557.887290][T11699] ___sys_sendmsg+0x1c6/0x360 [ 557.887316][T11699] ? __lock_acquire+0x683/0x2ce0 [ 557.887342][T11699] ? __pfx____sys_sendmsg+0x10/0x10 [ 557.887397][T11699] ? __fget_files+0x2a/0x420 [ 557.887415][T11699] ? __fget_files+0x3a8/0x420 [ 557.887441][T11699] __x64_sys_sendmsg+0x1b7/0x290 [ 557.887467][T11699] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 557.887523][T11699] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.887547][T11699] do_syscall_64+0x174/0x580 [ 557.887580][T11699] ? trace_irq_disable+0x3b/0x140 [ 557.887613][T11699] ? clear_bhb_loop+0x70/0xc0 [ 557.887641][T11699] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 557.887662][T11699] RIP: 0033:0x7f5534cce0d9 [ 557.887683][T11699] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 557.887702][T11699] RSP: 002b:00007f5532f26028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 557.887724][T11699] RAX: ffffffffffffffda RBX: 00007f5534f55fa0 RCX: 00007f5534cce0d9 [ 557.887741][T11699] RDX: 0000000020008004 RSI: 0000200000001680 RDI: 0000000000000004 [ 557.887754][T11699] RBP: 00007f5532f26090 R08: 0000000000000000 R09: 0000000000000000 [ 557.887766][T11699] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 557.887779][T11699] R13: 00007f5534f56038 R14: 00007f5534f55fa0 R15: 00007fff1ee075f8 [ 557.887818][T11699] [ 558.422522][T11709] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2103'. [ 558.467468][T11709] hub 8-0:1.0: USB hub found [ 558.471768][T11709] hub 8-0:1.0: 1 port detected [ 559.579202][T11720] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2107'. [ 559.849702][T11730] FAULT_INJECTION: forcing a failure. [ 559.849702][T11730] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 559.849741][T11730] CPU: 0 UID: 0 PID: 11730 Comm: syz.4.2112 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 559.849766][T11730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 559.849780][T11730] Call Trace: [ 559.849788][T11730] [ 559.849798][T11730] dump_stack_lvl+0xe8/0x150 [ 559.849839][T11730] should_fail_ex+0x467/0x600 [ 559.849867][T11730] _copy_from_user+0x2d/0xb0 [ 559.849884][T11730] ___sys_sendmsg+0x1c6/0x360 [ 559.849904][T11730] ? __lock_acquire+0x683/0x2ce0 [ 559.849925][T11730] ? __pfx____sys_sendmsg+0x10/0x10 [ 559.849970][T11730] ? __fget_files+0x2a/0x420 [ 559.849984][T11730] ? __fget_files+0x3a8/0x420 [ 559.850007][T11730] __x64_sys_sendmsg+0x1b7/0x290 [ 559.850028][T11730] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 559.850061][T11730] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.850078][T11730] do_syscall_64+0x174/0x580 [ 559.850101][T11730] ? trace_irq_disable+0x3b/0x140 [ 559.850126][T11730] ? clear_bhb_loop+0x70/0xc0 [ 559.850145][T11730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.850162][T11730] RIP: 0033:0x7f5534cce0d9 [ 559.850176][T11730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.850189][T11730] RSP: 002b:00007f5532f26028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 559.850206][T11730] RAX: ffffffffffffffda RBX: 00007f5534f55fa0 RCX: 00007f5534cce0d9 [ 559.850218][T11730] RDX: 000000000000c0d4 RSI: 0000200000000380 RDI: 0000000000000003 [ 559.850228][T11730] RBP: 00007f5532f26090 R08: 0000000000000000 R09: 0000000000000000 [ 559.850238][T11730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 559.850247][T11730] R13: 00007f5534f56038 R14: 00007f5534f55fa0 R15: 00007fff1ee075f8 [ 559.850271][T11730] [ 559.871021][ T31] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 560.114352][ T31] usb 2-1: Using ep0 maxpacket: 8 [ 560.115574][ T31] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 560.118943][ T31] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 560.119000][ T31] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 560.122377][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.122441][ T31] usb 2-1: Product: syz [ 560.122457][ T31] usb 2-1: Manufacturer: syz [ 560.122474][ T31] usb 2-1: SerialNumber: syz [ 560.201968][ T31] usbtest 2-1:1.0: couldn't get endpoints, -22 [ 560.202058][ T31] usbtest 2-1:1.0: probe with driver usbtest failed with error -22 [ 560.215053][T11732] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2113'. [ 560.386805][T11732] netlink: 'syz.4.2113': attribute type 1 has an invalid length. [ 560.463805][ T31] usb 2-1: USB disconnect, device number 38 [ 560.975120][ T5604] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 561.104388][ T5604] usb 5-1: device descriptor read/64, error -71 [ 561.355672][ T5604] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 561.500859][ T5604] usb 5-1: device descriptor read/64, error -71 [ 561.604700][ T5604] usb usb5-port1: attempt power cycle [ 561.964269][ T5604] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 561.995426][ T5604] usb 5-1: device descriptor read/8, error -71 [ 562.234403][ T5604] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 562.255318][ T5604] usb 5-1: device descriptor read/8, error -71 [ 562.368051][ T5604] usb usb5-port1: unable to enumerate USB device [ 562.469698][T11782] input: syz1 as /devices/virtual/input/input97 [ 562.499889][T11783] tipc: Failed to obtain node identity [ 562.499916][T11783] tipc: Enabling of bearer rejected, failed to enable media [ 562.667210][T11769] nvme nvme0: failed to connect socket: -512 [ 563.374568][T11799] 9p: Bad value for 'rfdno' [ 563.439048][T11802] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2135'. [ 563.482297][T11803] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2136'. [ 563.614262][ T31] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 563.765092][ T31] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 563.769525][ T31] usb 2-1: config 1 has an invalid descriptor of length 102, skipping remainder of the config [ 563.769589][ T31] usb 2-1: config 1 interface 0 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 563.769618][ T31] usb 2-1: config 1 interface 0 has no altsetting 0 [ 563.816044][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 563.816074][ T31] usb 2-1: Product: syz [ 563.816090][ T31] usb 2-1: Manufacturer: syz [ 563.816105][ T31] usb 2-1: SerialNumber: syz [ 564.124762][ T31] cdc_ether 2-1:1.0: missing cdc ether descriptor [ 564.221771][ T31] usb 2-1: USB disconnect, device number 39 [ 564.596799][T11817] hub 8-0:1.0: USB hub found [ 564.599135][T11817] hub 8-0:1.0: 1 port detected [ 565.845233][T11828] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2144'. [ 567.449794][T11844] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2148'. [ 567.570291][T11849] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.2150'. [ 567.706700][T10428] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 568.709492][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.709578][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 571.309765][T10428] usb 5-1: device descriptor read/64, error -71 [ 572.178159][T11870] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2155'. [ 572.934941][T11883] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2157'. [ 573.005554][T11888] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2159'. [ 573.504218][ T5725] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 573.504590][ C0] raw-gadget.0 gadget.3: ignoring, device is not running [ 573.644314][ T5725] usb 4-1: device descriptor read/64, error -32 [ 573.888581][T11894] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2161'. [ 573.894795][ T5725] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 574.039121][T11900] netlink: 16054 bytes leftover after parsing attributes in process `syz.1.2163'. [ 574.084357][ T5725] usb 4-1: Using ep0 maxpacket: 8 [ 574.085289][ T5725] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 574.089558][ T5725] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 574.089618][ T5725] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 574.101866][ T5725] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.101892][ T5725] usb 4-1: Product: syz [ 574.101908][ T5725] usb 4-1: Manufacturer: syz [ 574.101924][ T5725] usb 4-1: SerialNumber: syz [ 574.175299][ T5725] usbtest 4-1:1.0: couldn't get endpoints, -22 [ 574.175424][ T5725] usbtest 4-1:1.0: probe with driver usbtest failed with error -22 [ 574.247924][T11904] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2164'. [ 574.395273][T11909] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2166'. [ 575.197432][T11906] input: syz1 as /devices/virtual/input/input98 [ 575.270480][ T9] usb 4-1: USB disconnect, device number 38 [ 575.863924][T11926] nvme_fabrics: unknown parameter or missing value 'nq' in ctrl creation request [ 576.038586][T11936] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2176'. [ 576.189937][T11940] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.2177'. [ 576.381031][T11945] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.2179'. [ 576.841017][T11934] nvme nvme0: failed to connect socket: -512 [ 577.260794][T11964] nvme_fabrics: unknown parameter or missing value 'nq' in ctrl creation request [ 577.487412][T11971] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2190'. [ 579.029891][T11989] netlink: ct family unspecified [ 579.029930][T11989] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 579.251303][ T37] audit: type=1326 audit(1786377513.167:369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11996 comm="syz.0.2199" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3f65c4e0d9 code=0x0 [ 579.583420][T12012] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2205'. [ 579.865731][ T9] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 579.912043][T12019] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2208'. [ 580.064705][T12024] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2209'. [ 580.099851][T12024] hub 8-0:1.0: USB hub found [ 580.102213][T12024] hub 8-0:1.0: 1 port detected [ 581.024521][ T9] usb 3-1: not running at top speed; connect to a high speed hub [ 581.024603][ T9] usb 3-1: New USB device found, idVendor=12d1, idProduct=4b3b, bcdDevice=e7.d6 [ 581.044871][ T9] usb 3-1: config 6 has an invalid interface number: 11 but max is 0 [ 581.044953][ T9] usb 3-1: config 6 has an invalid interface number: 205 but max is 0 [ 581.045001][ T9] usb 3-1: config 6 has 2 interfaces, different from the descriptor's value: 1 [ 581.045056][ T9] usb 3-1: config 6 has no interface number 0 [ 581.045099][ T9] usb 3-1: config 6 has no interface number 1 [ 581.045289][ T9] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 581.045363][ T9] usb 3-1: config 6 interface 11 altsetting 8 has an endpoint descriptor with address 0x76, changing to 0x6 [ 581.045456][ T9] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x6 has invalid maxpacket 59513, setting to 64 [ 581.045561][ T9] usb 3-1: config 6 interface 11 altsetting 8 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 581.045633][ T9] usb 3-1: too many endpoints for config 6 interface 205 altsetting 46: 113, using maximum allowed: 30 [ 581.045736][ T9] usb 3-1: config 6 interface 205 altsetting 46 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 581.045801][ T9] usb 3-1: config 6 interface 205 altsetting 46 has 1 endpoint descriptor, different from the interface descriptor's value: 113 [ 581.045875][ T9] usb 3-1: config 6 interface 11 has no altsetting 0 [ 581.045926][ T9] usb 3-1: config 6 interface 205 has no altsetting 0 [ 581.086280][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.086360][ T9] usb 3-1: Product: 梅⟸衆甁ꥸ⯒॔䄠贈넃쫬㏵ᢟ䄻ᳪ萯둮뛙䗏럵안띸顙沰ꊬ荽ꅗ橀㛩緺ऩꊡ罤台颱鐜3쉗⸆ⁿ넿ᗉ뾵᪖㐅쟼劘驹鎉拕샄路✳쳿帒ﵑⓖ剋嘢頗裚㯗규૥㵃࠵楂ᎆ舄췌괼㛇읲钁Ꟑ켃搡亽꾕퍩䞇㧔᪾돐㨢믈쵮䡃備鑌퀠⍫ঽ⟤珐뻗௯㿍꫶ﲭ鐙忤Ɥ뙎 [ 581.086459][ T9] usb 3-1: Manufacturer:   [ 581.086493][ T9] usb 3-1: SerialNumber: 瞡檢ᙵꟋ䍰갴蛹遰ꍹт現ଽ褠韊璪돟譵䨟鞉ୁ秫ܷ먍왤쾊愎䮑楛耠ඩ̻ိ磻淎ꏾ쟼⢦ꦩ쪲蹣䠟閂 [ 581.174820][ T5725] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 581.232491][T12012] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 581.250077][T12012] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 581.414427][ T5725] usb 5-1: Using ep0 maxpacket: 8 [ 581.415355][ T5725] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 581.418026][ T5725] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 581.418079][ T5725] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 581.482458][ T5725] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.482552][ T5725] usb 5-1: Product: syz [ 581.482571][ T5725] usb 5-1: Manufacturer: syz [ 581.482587][ T5725] usb 5-1: SerialNumber: syz [ 581.731986][ T9] option 3-1:6.11: GSM modem (1-port) converter detected [ 581.747974][ T5725] usbtest 5-1:1.0: couldn't get endpoints, -22 [ 581.748063][ T5725] usbtest 5-1:1.0: probe with driver usbtest failed with error -22 [ 581.872986][ T9] usb 3-1: USB disconnect, device number 37 [ 581.938989][ T5725] usb 5-1: USB disconnect, device number 49 [ 582.046903][ T9] option 3-1:6.11: device disconnected [ 582.075120][T12034] netlink: ct family unspecified [ 582.075155][T12034] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 582.327218][T12041] hub 8-0:1.0: USB hub found [ 582.327774][T12041] hub 8-0:1.0: 1 port detected [ 583.117859][T12053] input: syz1 as /devices/virtual/input/input99 [ 584.176529][ T37] audit: type=1326 audit(1786377518.097:370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12069 comm="syz.3.2222" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x0 [ 584.459038][T12081] netlink: ct family unspecified [ 584.459071][T12081] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 584.508514][T12083] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2226'. [ 584.658273][T12089] hub 8-0:1.0: USB hub found [ 584.666359][T12089] hub 8-0:1.0: 1 port detected [ 585.825144][ T5604] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 586.034892][T12097] hub 8-0:1.0: USB hub found [ 586.035327][T12097] hub 8-0:1.0: 1 port detected [ 586.102692][ T5604] usb 3-1: Using ep0 maxpacket: 8 [ 586.104758][ T5604] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 586.108116][ T5604] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 586.108195][ T5604] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 586.115475][ T5604] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.115502][ T5604] usb 3-1: Product: syz [ 586.115519][ T5604] usb 3-1: Manufacturer: syz [ 586.115535][ T5604] usb 3-1: SerialNumber: syz [ 586.229023][ T5604] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 586.229118][ T5604] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 586.429154][ T5604] usb 3-1: USB disconnect, device number 38 [ 586.693694][T12099] input: syz1 as /devices/virtual/input/input100 [ 587.358890][T12113] input: syz1 as /devices/virtual/input/input101 [ 587.626494][T12114] nvme_fabrics: missing parameter 'transport=%s' [ 587.626513][T12114] nvme_fabrics: missing parameter 'nqn=%s' [ 587.712397][T12122] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2237'. [ 587.858813][T12126] netlink: ct family unspecified [ 587.858848][T12126] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 588.365118][T12130] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.2241'. [ 588.569588][T12138] hub 8-0:1.0: USB hub found [ 588.571051][T12138] hub 8-0:1.0: 1 port detected [ 588.654303][ T5722] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 588.730595][T12140] input: syz1 as /devices/virtual/input/input102 [ 588.805071][ T5722] usb 5-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 588.806783][ T5722] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 588.806810][ T5722] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 588.806860][ T5722] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 588.812133][ T5722] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.812160][ T5722] usb 5-1: Product: syz [ 588.812176][ T5722] usb 5-1: Manufacturer: syz [ 588.812191][ T5722] usb 5-1: SerialNumber: syz [ 588.939995][ T5722] uvcvideo 5-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 588.940033][ T5722] uvcvideo 5-1:1.0: No valid video chain found. [ 589.229469][T12144] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2244'. [ 590.243359][T10140] usb 5-1: USB disconnect, device number 50 [ 590.699607][T12152] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2248'. [ 590.699682][T12152] bond0: Unable to set down delay as MII monitoring is disabled [ 592.426323][T12165] nvme_fabrics: missing parameter 'transport=%s' [ 592.426342][T12165] nvme_fabrics: missing parameter 'nqn=%s' [ 592.455836][T12166] netlink: ct family unspecified [ 592.455870][T12166] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 592.766485][T12174] hub 8-0:1.0: USB hub found [ 592.768932][T12174] hub 8-0:1.0: 1 port detected [ 593.169482][T12180] input: syz1 as /devices/virtual/input/input103 [ 593.244258][T10140] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 593.395702][T10140] usb 4-1: Using ep0 maxpacket: 32 [ 593.396719][T10140] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 593.398292][T10140] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 593.404012][T10140] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.404050][T10140] usb 4-1: Product: syz [ 593.404067][T10140] usb 4-1: Manufacturer: syz [ 593.448798][T10140] usb 4-1: SerialNumber: syz [ 593.467131][T10140] usb 4-1: config 0 descriptor?? [ 593.482057][T10140] gs_usb 4-1:0.0: Required endpoints not found [ 593.735979][T10428] usb 4-1: USB disconnect, device number 39 [ 594.117327][T12192] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2261'. [ 594.414295][ T9] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 594.585152][T12201] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2265'. [ 595.513330][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 595.514546][ T9] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 595.517254][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 595.517309][ T9] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 595.534254][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.534286][ T9] usb 2-1: Product: syz [ 595.534303][ T9] usb 2-1: Manufacturer: syz [ 595.534318][ T9] usb 2-1: SerialNumber: syz [ 595.627615][ T9] usbtest 2-1:1.0: couldn't get endpoints, -22 [ 595.627708][ T9] usbtest 2-1:1.0: probe with driver usbtest failed with error -22 [ 595.845121][ T9] usb 2-1: USB disconnect, device number 40 [ 596.125783][T12214] hub 8-0:1.0: USB hub found [ 596.126111][T12214] hub 8-0:1.0: 1 port detected [ 596.182736][T12216] input: syz1 as /devices/virtual/input/input104 [ 596.526241][T12219] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2272'. [ 597.120411][T12236] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.2279'. [ 597.150590][ T37] audit: type=1326 audit(1786377531.037:371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12229 comm="syz.2.2278" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f348ca9e0d9 code=0x0 [ 597.846496][T12243] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.2281'. [ 598.265462][ T5604] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 598.415219][ T5604] usb 5-1: New USB device found, idVendor=046d, idProduct=0821, bcdDevice= 1.00 [ 598.423512][ T5604] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 598.423542][ T5604] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 598.423598][ T5604] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 598.486033][ T5604] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.486064][ T5604] usb 5-1: Product: syz [ 598.486080][ T5604] usb 5-1: Manufacturer: syz [ 598.486096][ T5604] usb 5-1: SerialNumber: syz [ 598.533312][ T5604] uvcvideo 5-1:1.0: Found UVC 1.00 device syz (046d:0821) [ 598.533350][ T5604] uvcvideo 5-1:1.0: No valid video chain found. [ 598.791848][T12264] hub 8-0:1.0: USB hub found [ 598.794548][T12264] hub 8-0:1.0: 1 port detected [ 598.801956][ T31] usb 5-1: USB disconnect, device number 51 [ 598.844321][ T5878] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 598.996550][ T5878] usb 4-1: Using ep0 maxpacket: 32 [ 598.997571][ T5878] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 598.999466][ T5878] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 598.999497][ T5878] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 598.999527][ T5878] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 598.999551][ T5878] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 598.999596][ T5878] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 598.999624][ T5878] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 599.090066][ T5878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.090098][ T5878] usb 4-1: Product: syz [ 599.090115][ T5878] usb 4-1: Manufacturer: syz [ 599.090131][ T5878] usb 4-1: SerialNumber: syz [ 599.130972][ T5878] usb 4-1: config 0 descriptor?? [ 599.758369][T12273] nvme_fabrics: missing parameter 'nqn=%s' [ 599.974587][ T37] audit: type=1326 audit(1786377533.887:372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12279 comm="syz.4.2295" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5534cce0d9 code=0x0 [ 600.113277][T12289] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2292'. [ 601.455742][ T5604] usb 4-1: USB disconnect, device number 40 [ 602.243589][ T37] audit: type=1326 audit(1786377536.157:373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.243648][ T37] audit: type=1326 audit(1786377536.157:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.243695][ T37] audit: type=1326 audit(1786377536.157:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.264220][ T37] audit: type=1326 audit(1786377536.177:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.264288][ T37] audit: type=1326 audit(1786377536.177:377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.278770][ T37] audit: type=1326 audit(1786377536.197:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.279457][ T37] audit: type=1326 audit(1786377536.197:379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.286092][ T37] audit: type=1326 audit(1786377536.207:380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.286390][ T37] audit: type=1326 audit(1786377536.207:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.294278][ T37] audit: type=1326 audit(1786377536.207:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12310 comm="syz.3.2304" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 602.756934][T12320] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2307'. [ 604.404350][ T31] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 604.554285][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 604.556490][ T31] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 604.560925][ T31] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 604.560960][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 604.560988][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 604.561012][ T31] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 604.561100][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 604.561129][ T31] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 604.662084][ T31] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.662114][ T31] usb 2-1: Product: syz [ 604.662129][ T31] usb 2-1: Manufacturer: syz [ 604.662145][ T31] usb 2-1: SerialNumber: syz [ 604.703409][ T31] usb 2-1: config 0 descriptor?? [ 605.521482][T12350] input: syz1 as /devices/virtual/input/input105 [ 607.255896][ T37] kauditd_printk_skb: 334 callbacks suppressed [ 607.255964][ T37] audit: type=1326 audit(1786377541.017:717): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12345 comm="syz.3.2316" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 607.589273][ T37] audit: type=1326 audit(1786377541.497:718): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12345 comm="syz.3.2316" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f7ecbaee0d9 code=0x7ffc0000 [ 607.730927][T12359] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2319'. [ 608.057012][T10428] usb 2-1: USB disconnect, device number 41 [ 608.427449][T12371] input: syz1 as /devices/virtual/input/input106 [ 608.474871][T12372] netlink: 16054 bytes leftover after parsing attributes in process `syz.4.2324'. [ 608.718366][T12373] nvme_fabrics: missing parameter 'nqn=%s' [ 610.435834][T12396] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2331'. [ 610.711428][T12401] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2336'. [ 610.843164][T12406] input: syz1 as /devices/virtual/input/input107 [ 610.975567][ T5878] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 611.124260][ T5878] usb 3-1: Using ep0 maxpacket: 8 [ 611.125726][ T5878] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 611.126912][ T5878] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 611.126965][ T5878] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 611.133084][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.133110][ T5878] usb 3-1: Product: syz [ 611.133127][ T5878] usb 3-1: Manufacturer: syz [ 611.133143][ T5878] usb 3-1: SerialNumber: syz [ 611.214020][ T5878] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 611.220860][ T5878] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 611.427001][ T5878] usb 3-1: USB disconnect, device number 39 [ 611.745852][T12412] nvme_fabrics: missing parameter 'nqn=%s' [ 611.877703][T12417] input: syz1 as /devices/virtual/input/input108 [ 612.203801][T12427] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2343'. [ 612.327848][T12430] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2345'. [ 613.376366][T12433] hub 8-0:1.0: USB hub found [ 613.398126][T12433] hub 8-0:1.0: 1 port detected [ 613.591674][T12435] nvme_fabrics: missing parameter 'nqn=%s' [ 615.468988][T12455] netlink: 'syz.0.2350': attribute type 3 has an invalid length. [ 615.597291][ T37] audit: type=1326 audit(1786377549.517:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12449 comm="syz.0.2350" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3f65c4e0d9 code=0x0 [ 616.012189][T12460] nvme_fabrics: missing parameter 'nqn=%s' [ 616.475472][T12466] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2355'. [ 616.734265][ T5878] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 616.738158][T12468] input: syz1 as /devices/virtual/input/input109 [ 616.907933][ T5878] usb 4-1: Using ep0 maxpacket: 8 [ 616.908965][ T5878] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 616.910453][ T5878] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 616.910508][ T5878] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 616.956089][ T5878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.956121][ T5878] usb 4-1: Product: syz [ 616.956157][ T5878] usb 4-1: Manufacturer: syz [ 616.956174][ T5878] usb 4-1: SerialNumber: syz [ 617.009232][ T5878] usbtest 4-1:1.0: couldn't get endpoints, -22 [ 617.009324][ T5878] usbtest 4-1:1.0: probe with driver usbtest failed with error -22 [ 617.211847][ T5878] usb 4-1: USB disconnect, device number 41 [ 617.310269][T12472] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2359'. [ 617.403227][T12472] netlink: 'syz.2.2359': attribute type 1 has an invalid length. [ 617.621695][T12478] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2358'. [ 618.385960][T12476] nvme_fabrics: missing parameter 'nqn=%s' [ 618.880545][T12486] nvme_fabrics: unknown parameter or missing value 'trsv' in ctrl creation request [ 620.138929][T12509] netlink: 'syz.1.2368': attribute type 3 has an invalid length. [ 620.424343][ T9] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 620.594265][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 620.596360][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 620.598861][ T9] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 620.598895][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 620.602469][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 620.602498][ T9] usb 3-1: Product: syz [ 620.602513][ T9] usb 3-1: Manufacturer: syz [ 620.602529][ T9] usb 3-1: SerialNumber: syz [ 620.698948][ T9] usb 3-1: config 0 descriptor?? [ 620.771141][ T9] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 620.771177][ T9] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 621.196696][T12521] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2372'. [ 622.027121][T12514] nvme nvme0: failed to connect socket: -512 [ 622.217005][T12528] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2374'. [ 622.238481][ T9] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 622.382919][ T9] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 622.383381][ T9] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 622.383400][ T9] em28xx 3-1:0.0: No AC97 audio processor [ 622.437665][ T9] usb 3-1: USB disconnect, device number 40 [ 622.453336][ T9] em28xx 3-1:0.0: Disconnecting em28xx [ 622.554545][T10428] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 622.611526][ T9] em28xx 3-1:0.0: Freeing device [ 622.718759][T12532] nvme_fabrics: unknown parameter or missing value 'trsv' in ctrl creation request [ 622.724808][T10428] usb 4-1: Using ep0 maxpacket: 8 [ 622.746383][T10428] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 622.773668][T10428] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 622.773728][T10428] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 4 [ 622.822822][T10428] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.822854][T10428] usb 4-1: Product: syz [ 622.822871][T10428] usb 4-1: Manufacturer: syz [ 622.822887][T10428] usb 4-1: SerialNumber: syz [ 622.919501][T10428] usbtest 4-1:1.0: couldn't get endpoints, -22 [ 622.919598][T10428] usbtest 4-1:1.0: probe with driver usbtest failed with error -22 [ 623.156598][T10428] usb 4-1: USB disconnect, device number 42 [ 625.101197][T12555] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2382'. [ 625.361281][T12556] hub 8-0:1.0: USB hub found [ 625.362046][T12556] hub 8-0:1.0: 1 port detected [ 625.557124][T12567] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2385'. [ 625.698965][T12571] netlink: 'syz.0.2383': attribute type 3 has an invalid length. [ 626.481291][T12576] tipc: Failed to obtain node identity [ 626.481323][T12576] tipc: Enabling of bearer rejected, failed to enable media [ 627.871811][T12586] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2390'. [ 627.964238][T12579] nvme nvme0: failed to connect socket: -512 [ 628.798584][T12591] input: syz1 as /devices/virtual/input/input110 [ 629.593999][ T1331] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.600956][ T1331] ieee802154 phy1 wpan1: encryption failed: -22 [ 630.888899][T12615] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2402'. [ 631.114380][ T5604] usb 2-1: new low-speed USB device number 42 using dummy_hcd [ 631.281971][ T5604] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 631.283453][ T5604] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 631.283493][ T5604] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 631.283536][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 631.283564][ T5604] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xEC, changing to 0x8C [ 631.283592][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8C is Bulk; changing to Interrupt [ 631.283616][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8C has invalid wMaxPacketSize 0 [ 631.283639][ T5604] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 631.283669][ T5604] usb 2-1: config 168 interface 0 has no altsetting 0 [ 631.290968][ T5604] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 631.291095][ T5604] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 631.291224][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 631.291300][ T5604] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xEC, changing to 0x8C [ 631.291349][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8C is Bulk; changing to Interrupt [ 631.291388][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8C has invalid wMaxPacketSize 0 [ 631.291452][ T5604] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 631.291527][ T5604] usb 2-1: config 168 interface 0 has no altsetting 0 [ 631.337931][ T5604] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 631.338030][ T5604] usb 2-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 631.338143][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 631.338222][ T5604] usb 2-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xEC, changing to 0x8C [ 631.338296][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8C is Bulk; changing to Interrupt [ 631.338364][ T5604] usb 2-1: config 168 interface 0 altsetting 188 endpoint 0x8C has invalid wMaxPacketSize 0 [ 631.338426][ T5604] usb 2-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 631.338502][ T5604] usb 2-1: config 168 interface 0 has no altsetting 0 [ 631.729752][T12631] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2407'. [ 631.963988][T12618] nvme nvme0: failed to connect socket: -512 [ 632.597461][T12625] nvme nvme0: failed to connect socket: -512 [ 633.114261][ T9] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 634.163202][ T5604] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.208736][ T5604] usb 2-1: can't set config #168, error -71 [ 634.220791][ T5604] usb 2-1: USB disconnect, device number 42 [ 634.244171][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 634.245128][ T9] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 634.246799][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 634.246831][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 634.246860][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 634.246883][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 634.246911][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 634.251270][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.251296][ T9] usb 4-1: Product: syz [ 634.251313][ T9] usb 4-1: Manufacturer: syz [ 634.251329][ T9] usb 4-1: SerialNumber: syz [ 634.359073][ T9] usb 4-1: config 0 descriptor?? [ 635.652277][T12652] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2414'. [ 636.309005][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.309492][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.309951][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.310397][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.310851][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.311292][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.311724][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.325909][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.329213][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.329680][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.330151][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.330609][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.331063][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.331780][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.333919][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.334603][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.336110][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.337247][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.344431][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.345459][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 636.345558][ T9] input input111: Timeout waiting for response from device. [ 636.471363][ T9] usb 4-1: USB disconnect, device number 43 [ 636.634376][T12662] netlink: 116 bytes leftover after parsing attributes in process `syz.3.2418'. [ 636.639859][T12662] hub 8-0:1.0: USB hub found [ 636.640203][T12662] hub 8-0:1.0: 1 port detected [ 637.232861][T12666] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2419'. [ 638.719182][T12671] nvme nvme0: failed to connect socket: -512 [ 638.928259][T12687] input: syz1 as /devices/virtual/input/input112 [ 639.151705][T12692] input: syz1 as /devices/virtual/input/input113 [ 639.296363][T12696] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2429'. [ 639.300265][T12696] hub 8-0:1.0: USB hub found [ 639.303514][T12696] hub 8-0:1.0: 1 port detected [ 639.369545][T12679] nvme nvme0: failed to connect socket: -512 [ 639.452642][T12698] netlink: 16054 bytes leftover after parsing attributes in process `syz.2.2431'. [ 639.524319][ T9] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 639.610708][T12682] nvme_fabrics: unknown parameter or missing value 'trsvcid=' in ctrl creation request [ 639.684346][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 639.685426][ T9] usb 4-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 639.687222][ T9] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 639.687251][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 639.687278][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 639.687303][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 639.687330][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 639.690306][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 639.690331][ T9] usb 4-1: Product: syz [ 639.690346][ T9] usb 4-1: Manufacturer: syz [ 639.690360][ T9] usb 4-1: SerialNumber: syz [ 639.797516][ T9] usb 4-1: config 0 descriptor?? [ 640.058450][T12710] netlink: 116 bytes leftover after parsing attributes in process `syz.4.2435'. [ 641.219151][ T9] iforce 4-1:0.0: usb_submit_urb failed: -110 [ 641.219205][ T9] input input114: Device does not respond to id packet M [ 641.220840][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 641.220887][ T9] input input114: Device does not respond to id packet P [ 641.249231][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 641.249282][ T9] input input114: Device does not respond to id packet B [ 641.250731][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 641.250780][ T9] input input114: Device does not respond to id packet N [ 641.252271][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 641.276660][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 641.310230][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 641.310721][ T9] iforce 4-1:0.0: usb_submit_urb failed: -71 [ 641.344381][ T9] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input114 [ 641.423913][ T9] usb 4-1: USB disconnect, device number 44 [ 641.555940][T12718] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2437'. [ 641.906468][T12727] input: syz1 as /devices/virtual/input/input115 [ 642.136490][T12731] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2441'. [ 642.141084][T12731] hub 8-0:1.0: USB hub found [ 642.141453][T12731] hub 8-0:1.0: 1 port detected [ 642.271012][T12734] input: syz1 as /devices/virtual/input/input116 [ 642.314893][T12721] nvme nvme0: failed to connect socket: -512 [ 642.340754][T12735] netlink: 16054 bytes leftover after parsing attributes in process `syz.0.2443'. [ 642.522780][T12737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2444'. [ 642.633151][T12737] netlink: 'syz.1.2444': attribute type 1 has an invalid length. [ 642.633175][T12737] netlink: 'syz.1.2444': attribute type 2 has an invalid length. [ 644.086840][T12755] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2449'. [ 644.330410][T12739] nvme nvme0: failed to connect socket: -512 [ 644.374562][T12755] bond0: Unable to set down delay as MII monitoring is disabled [ 644.680204][T12763] netlink: 116 bytes leftover after parsing attributes in process `syz.2.2452'. [ 644.776611][T12766] input: syz1 as /devices/virtual/input/input117 [ 644.901014][T12770] input: syz1 as /devices/virtual/input/input118 [ 645.214858][T12762] hub 8-0:1.0: USB hub found [ 645.225070][T12762] hub 8-0:1.0: 1 port detected [ 645.487530][T12775] netlink: 'syz.1.2455': attribute type 3 has an invalid length. [ 645.577312][T12780] jffs2: notice: (12780) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 645.627851][T12768] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2451'. [ 645.777478][T12780] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2457'. [ 645.803419][T12780] netlink: 'syz.4.2457': attribute type 11 has an invalid length. [ 646.078983][T12798] netlink: 116 bytes leftover after parsing attributes in process `syz.0.2459'. [ 648.469356][T12819] input: syz1 as /devices/virtual/input/input119 [ 649.017494][T12833] netlink: 'syz.4.2472': attribute type 3 has an invalid length. [ 649.819698][T12818] nvme nvme0: failed to connect socket: -512 [ 650.579499][T12847] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2475'. [ 650.788535][T12862] input: syz1 as /devices/virtual/input/input120 [ 650.957837][ C1] ------------[ cut here ]------------ [ 650.957854][ C1] DEBUG_LOCKS_WARN_ON(1) [ 650.957952][ C1] WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x382/0x2ce0, CPU#1: ktimers/1/29 [ 650.958033][ C1] Modules linked in: [ 650.958060][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 650.958089][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 650.958104][ C1] RIP: 0010:__lock_acquire+0x389/0x2ce0 [ 650.958129][ C1] Code: 83 3d fa 84 07 18 00 75 27 90 e8 a2 ae 1d 03 85 c0 74 1c 83 3d eb fd 0d 0e 00 75 13 48 8d 3d 3e 48 11 0e 48 c7 c6 d4 f6 99 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f [ 650.958155][ C1] RSP: 0018:ffffc90000a3f6b8 EFLAGS: 00010046 [ 650.958175][ C1] RAX: 0000000000000001 RBX: 0000000000040000 RCX: ffff88801d2b3e00 [ 650.958193][ C1] RDX: 0000000000000100 RSI: ffffffff8d99f6d4 RDI: ffffffff8fb2a8e0 [ 650.958210][ C1] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000100 [ 650.958223][ C1] R10: dffffc0000000000 R11: fffffbfff1f5ebd1 R12: 0000000000000df2 [ 650.958240][ C1] R13: ffff88801d2b4af8 R14: ffff88801d2b3e00 R15: ffff88801d2b4a08 [ 650.958263][ C1] FS: 0000000000000000(0000) GS:ffff888125d46000(0000) knlGS:0000000000000000 [ 650.958282][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 650.958298][ C1] CR2: 0000001b32222ff8 CR3: 0000000077212000 CR4: 00000000003526f0 [ 650.958319][ C1] Call Trace: [ 650.958328][ C1] [ 650.958345][ C1] ? finish_task_switch+0x412/0xc60 [ 650.958392][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 650.958429][ C1] ? rcu_is_watching+0x15/0xb0 [ 650.958468][ C1] ? tcp_tsq_handler+0x29/0x200 [ 650.958539][ C1] lock_acquire+0x106/0x350 [ 650.958559][ C1] ? tcp_tsq_handler+0x29/0x200 [ 650.958599][ C1] ? register_lock_class+0x31/0x2e0 [ 650.958638][ C1] rt_spin_lock+0x83/0x400 [ 650.958662][ C1] ? tcp_tsq_handler+0x29/0x200 [ 650.958696][ C1] ? __pfx_rt_spin_lock+0x10/0x10 [ 650.958722][ C1] ? __pfx___schedule+0x10/0x10 [ 650.958755][ C1] ? irqentry_exit+0x218/0x8f0 [ 650.958794][ C1] tcp_tsq_handler+0x29/0x200 [ 650.958828][ C1] tcp_tsq_workfn+0x384/0x410 [ 650.958862][ C1] ? __pfx_tcp_tsq_workfn+0x10/0x10 [ 650.958896][ C1] ? rcu_is_watching+0x15/0xb0 [ 650.958923][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 650.958949][ C1] process_scheduled_works+0xa8e/0x14e0 [ 650.958988][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 650.959012][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 650.959051][ C1] bh_worker+0x46a/0x880 [ 650.959083][ C1] tasklet_action+0xc/0x70 [ 650.959111][ C1] handle_softirqs+0x1d9/0x6c0 [ 650.959142][ C1] run_ktimerd+0x69/0x100 [ 650.959170][ C1] smpboot_thread_fn+0x57c/0xa80 [ 650.959200][ C1] ? smpboot_thread_fn+0x4e/0xa80 [ 650.959231][ C1] kthread+0x388/0x470 [ 650.959263][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 650.959290][ C1] ? __pfx_kthread+0x10/0x10 [ 650.959322][ C1] ret_from_fork+0x514/0xb70 [ 650.959370][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 650.959402][ C1] ? __switch_to+0xc89/0x1420 [ 650.959431][ C1] ? __pfx_kthread+0x10/0x10 [ 650.959462][ C1] ret_from_fork_asm+0x1a/0x30 [ 650.959515][ C1] [ 650.959532][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 650.959549][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 650.959576][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 650.959591][ C1] Call Trace: [ 650.959599][ C1] [ 650.959607][ C1] vpanic+0x56c/0xa60 [ 650.959649][ C1] ? __pfx__printk+0x10/0x10 [ 650.959673][ C1] ? __pfx_vpanic+0x10/0x10 [ 650.959705][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 650.959731][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 650.959759][ C1] panic+0xc5/0xd0 [ 650.959792][ C1] ? __pfx_panic+0x10/0x10 [ 650.959830][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 650.959867][ C1] __warn+0x315/0x4c0 [ 650.959900][ C1] ? __lock_acquire+0x382/0x2ce0 [ 650.959922][ C1] ? __lock_acquire+0x382/0x2ce0 [ 650.959943][ C1] __report_bug+0x276/0x570 [ 650.960037][ C1] ? __lock_acquire+0x382/0x2ce0 [ 650.960060][ C1] ? __pfx___report_bug+0x10/0x10 [ 650.960098][ C1] ? __lock_acquire+0x683/0x2ce0 [ 650.960121][ C1] report_bug_entry+0x19a/0x290 [ 650.960153][ C1] ? __lock_acquire+0x389/0x2ce0 [ 650.960173][ C1] ? __lock_acquire+0x38e/0x2ce0 [ 650.960193][ C1] handle_bug+0xce/0x200 [ 650.960214][ C1] exc_invalid_op+0x1a/0x50 [ 650.960240][ C1] asm_exc_invalid_op+0x1a/0x20 [ 650.960263][ C1] RIP: 0010:__lock_acquire+0x389/0x2ce0 [ 650.960286][ C1] Code: 83 3d fa 84 07 18 00 75 27 90 e8 a2 ae 1d 03 85 c0 74 1c 83 3d eb fd 0d 0e 00 75 13 48 8d 3d 3e 48 11 0e 48 c7 c6 d4 f6 99 8d <67> 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f [ 650.960307][ C1] RSP: 0018:ffffc90000a3f6b8 EFLAGS: 00010046 [ 650.960328][ C1] RAX: 0000000000000001 RBX: 0000000000040000 RCX: ffff88801d2b3e00 [ 650.960345][ C1] RDX: 0000000000000100 RSI: ffffffff8d99f6d4 RDI: ffffffff8fb2a8e0 [ 650.960362][ C1] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000100 [ 650.960377][ C1] R10: dffffc0000000000 R11: fffffbfff1f5ebd1 R12: 0000000000000df2 [ 650.960394][ C1] R13: ffff88801d2b4af8 R14: ffff88801d2b3e00 R15: ffff88801d2b4a08 [ 650.960422][ C1] ? __lock_acquire+0x36e/0x2ce0 [ 650.960449][ C1] ? finish_task_switch+0x412/0xc60 [ 650.960485][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 650.960526][ C1] ? rcu_is_watching+0x15/0xb0 [ 650.960553][ C1] ? tcp_tsq_handler+0x29/0x200 [ 650.960586][ C1] lock_acquire+0x106/0x350 [ 650.960605][ C1] ? tcp_tsq_handler+0x29/0x200 [ 650.960641][ C1] ? register_lock_class+0x31/0x2e0 [ 650.960681][ C1] rt_spin_lock+0x83/0x400 [ 650.960705][ C1] ? tcp_tsq_handler+0x29/0x200 [ 650.960739][ C1] ? __pfx_rt_spin_lock+0x10/0x10 [ 650.960766][ C1] ? __pfx___schedule+0x10/0x10 [ 650.960793][ C1] ? irqentry_exit+0x218/0x8f0 [ 650.960828][ C1] tcp_tsq_handler+0x29/0x200 [ 650.960862][ C1] tcp_tsq_workfn+0x384/0x410 [ 650.960897][ C1] ? __pfx_tcp_tsq_workfn+0x10/0x10 [ 650.960931][ C1] ? rcu_is_watching+0x15/0xb0 [ 650.960959][ C1] ? process_scheduled_works+0xa20/0x14e0 [ 650.960989][ C1] process_scheduled_works+0xa8e/0x14e0 [ 650.961035][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 650.961060][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 650.961100][ C1] bh_worker+0x46a/0x880 [ 650.961131][ C1] tasklet_action+0xc/0x70 [ 650.961158][ C1] handle_softirqs+0x1d9/0x6c0 [ 650.961190][ C1] run_ktimerd+0x69/0x100 [ 650.961218][ C1] smpboot_thread_fn+0x57c/0xa80 [ 650.961247][ C1] ? smpboot_thread_fn+0x4e/0xa80 [ 650.961280][ C1] kthread+0x388/0x470 [ 650.961311][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 650.961339][ C1] ? __pfx_kthread+0x10/0x10 [ 650.961372][ C1] ret_from_fork+0x514/0xb70 [ 650.961405][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 650.961438][ C1] ? __switch_to+0xc89/0x1420 [ 650.961467][ C1] ? __pfx_kthread+0x10/0x10 [ 650.961505][ C1] ret_from_fork_asm+0x1a/0x30 [ 650.961548][ C1] [ 650.962159][ C1] Kernel Offset: disabled