last executing test programs: 9.77586131s ago: executing program 0 (id=4205): syz_80211_inject_frame(&(0x7f0000000040)=@broadcast, &(0x7f00000002c0)=ANY=[@ANYBLOB="30340800080211000001ffffffffffff505050505050030418000500a9002d1a0080046f000000000000000500060005000000000400000000c0ea9abf6726ec9d71b8f8d18fdcf5cc52bd22303c16c154e3e3c51b72b37e2c1d69f1b0ffb667036bfb1dba969a6fd8458d7de55b2bbbebe1dfa7a6a018c064d3d5f42559cc5f40ffded7b5c0137462ecc22705b78a8e498dc7dc7203a3e9136cccb8a24641820bff53a7e7608c52ba"], 0x3a) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f0000000040)="b9", 0x1, 0x0, &(0x7f0000000080)={0xa, 0x0, 0xfffffffd, @private2, 0x400}, 0x1c) listen(r3, 0x100101) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x1a4, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x178, 0x4, 0x0, 0x1, [{0x160, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x150, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_NAME={0xb, 0x1, 'policy\x00'}, @NFTA_MATCH_INFO={0x138, 0x3, "ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f5000000"}]}}}, {0x14, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20}}, 0x1cc}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) setsockopt$inet6_IPV6_DSTOPTS(r3, 0x29, 0x3b, &(0x7f00000003c0)={0x3b}, 0x8) accept4(r3, 0x0, 0x0, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f00000003c0)={0x1, 0x0, [{0x1, 0x8001, 0x0, 0x7ff, 0x195a43d7}]}) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r5, &(0x7f0000000080)={0x232, 0x2, 0x0, {{0x500, 0xf3, 0x500, 0x4, {0x0, 0x0, 0x5}, 0x3810000, 0x0, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pg>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1\x00\x00\x00\x00\x00\x00\x00\x00', 0x18, '\b\x00\x01\x81\x8cY\x9c\xb9_\x82\xe2\x16\njP\xc4\xedPeh\x9a*\x88\x89', 0x55, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0\xb4\xf1t\xa6f\xa8R\x9aE\x1b4\a\xdb\xda\xb2\x88K\xaf\x05\x00\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x80\xe8\xe2\x89\xdad\x9a7\x00'}, 0x12a, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9\x00\x00\x00\x00\x00\x00\x00\x05;\x11r\xd9{\xad\xc7\tZ\xfdv\xe9O\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x10i\x9e\xa4=\xab\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs\b\x00\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2Y?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xa7r\xbcS\x02\xf8o\xef\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69g}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00\x00\x00', 0x0, 0x0, 0xee01}}, 0x232) semtimedop(0x0, &(0x7f0000000380), 0x0, 0x0) r6 = semget(0x3, 0x4, 0x200) semop(r6, &(0x7f00000018c0)=[{0x0, 0x3ff, 0x1800}], 0x1) semop(0x0, &(0x7f0000001900)=[{0x0, 0xab, 0x1000}], 0x1) syz_80211_inject_frame(&(0x7f0000000000)=@broadcast, &(0x7f0000000080)=@mgmt_frame=@assoc_resp={{{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x6}, @broadcast, @device_a, @random="f6546a5e805a", {0x8, 0x4}}, 0x4, 0x62, @default, @val={0x1, 0x3, [{0x9}, {0xb}, {0x12, 0x1}]}, @val={0x2d, 0x1a, {0x400, 0x0, 0x0, 0x0, {0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x6, 0x8, 0x5}}, [{0xdd, 0x74, "dc0f8a84f3c473b89b495abc0c783c968082beb141d6cc5b1edd91449340f3da21db1c6940d14ed7d25b2c0ab481bbffab4c68816360bf024b5491e1b1d4a9e2ae0c1ec1d91807d1e7026794be8d6afa8724052411de87ca38c58f5b661bab055736e9745eafdcbea37c199402ff078c8383defd"}, {0xdd, 0x35, "ebf59d1d8f26d99f4560b179d313f1b481ac29c34225d8b65e81f0a12a014ef6890031987244c970e9d83639a86a21b4c6f0b95368"}, {0xdd, 0x69, "a0f7e87dd44ecbbad1e5422b612bfbdb778b08b367ee4b6465a35d9a2a4e43f3ea188b1d9e6a23d8f1088fc7b26600c23b57c90f396ae971de17c3f6777286d4c43289042c4c7b16bda0d2d65cb2bc575e65fb1a09948a5c49225072bad10e60f97a44f63bf0696956"}, {0xdd, 0xbd, "ed3300723156cfb1ef31edafdf8e46d5ce5b367539bcc3da6f1be159a5c430b01fec29a192dcff36b16e0d10342b25d2c9958dfb76f4c79db3b6baeab2f76e498d4dfa529d69825103f21bc509815e2b11cc9854a2f4005dd2efd43aaf25bc1726b6bca7b590ee8b62d4274bee1b3e95f3c5d278138dfc4132236244f1616308d6f76ce1f9c9f703f6f99af0f428f4d413e60299d47114b994395e7f8c2fdcaa002f1d910ba3cc135495613cefdb90cfa2234e8a9762195ae2bc7e93dc"}]}, 0x216) 8.256548785s ago: executing program 0 (id=4212): request_key(0x0, &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) syz_usb_connect(0x5, 0x255, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000670250404020014964680102030109024302010000000009042100021085d80009050402ff0300000007250180000500872266"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) getitimer(0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xb}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x44}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) utimes(0x0, &(0x7f0000000280)={{}, {0x0, 0xea60}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000002c0)={{0xd000, 0xeeef0000, 0xe, 0x0, 0x81, 0x4, 0xa, 0x4e, 0x0, 0x7, 0x6, 0x1}, {0x5000, 0xffff1000, 0x3, 0x5, 0x2, 0x8, 0xd, 0x3, 0x0, 0x81, 0x8, 0x1}, {0x5000, 0x0, 0x0, 0x7, 0x3, 0x1, 0x7, 0xf, 0x8, 0x6, 0x2}, {0xffff1000, 0xd5dd0000, 0xe, 0x2, 0x1, 0x3, 0x10, 0x0, 0x1, 0x6, 0x4, 0x9}, {0x100002, 0xeeee8000, 0x9, 0x0, 0x80, 0xee, 0x0, 0x7, 0x7c, 0x0, 0xe, 0x9}, {0x3000, 0x4, 0x8, 0x1, 0x5, 0x4, 0x1, 0x1, 0x6, 0x86, 0xb, 0x2}, {0xeeee8000, 0xeeee0000, 0xc, 0x7, 0x7, 0x3, 0x1d, 0x47, 0x30, 0x2, 0x8, 0xe1}, {0xf000, 0x2, 0xc, 0xf8, 0xfd, 0xa, 0x2, 0x4, 0x3, 0x8, 0x5, 0xce}, {0x4, 0x7}, {0x6000, 0x5}, 0x80000035, 0x0, 0x0, 0x40, 0x7, 0x1000, 0xeeef0000, [0x5, 0x8001, 0x8]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e60, 0x0, @mcast2, 0xd}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="82", 0x1}, {&(0x7f0000000280)="ca", 0x1}], 0x2}}], 0x1, 0x4400c800) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000140)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c00000010000907327f7c6919f500000000000056c4177c1034a53cd296bb4a62dc831764435dc22cce09466a2649c5b6e8a1e295f54dcf210f00da94b3067310384d513803716c279570ab2cece6fbe830f61c2243b23be4ce95b46d8e8cc5401e6273e8d57b97001d7ca95f378acb2b95fd718a7459bc14bc2122e436350e55a850d1673605bb58dacad3f62069f91850a4eef77c807a423a3448f50d94cb414ba42da44767ea117ce4ab36d235ccad7f4653c38c13512acfffba7b7a04546f4c6ce750e83beeb1311f559217a57afea02b6d3c3824fa552c47cfaee788c6ff7b4aa6b847b26ea956d7dae5acf93f7648909a72ad980a63b73fe45d7324", @ANYRES32=r6, @ANYBLOB="00000000000001001c0012800b00010069703667726500000c0005800600030003000000"], 0x3c}}, 0x0) sendto$inet6(r0, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) mmap$xdp(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000007, 0x10010, 0xffffffffffffffff, 0x180000000) 8.252418001s ago: executing program 1 (id=4213): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) (async) r2 = syz_io_uring_setup(0x17d0, &(0x7f0000000240)={0x0, 0x0, 0x80, 0x0, 0x4}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async, rerun: 32) syz_io_uring_submit(r3, r4, &(0x7f0000000380)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x1, 0x3, 0x0, 0x200, 0x0, 0x1}) (rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1, 0x8, 0x43, 0x7f, 0x1, 0x1, 0x3b}, 0x50) (async) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0xf, "f42a97b96d02674f51eae4da000000"}}) io_uring_enter(r2, 0x47fa, 0x0, 0x0, 0x0, 0x0) (async) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r1, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0, 0x0, 0x1}) (async, rerun: 32) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x14}}, 0x0) (async, rerun: 32) syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xa005, 0x10100}, 0x0, 0x0) read$FUSE(r0, &(0x7f0000008340)={0x2020, 0x0, 0x0}, 0x206f) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r6, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) (async) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) (async) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x80000000) mmap$IORING_OFF_CQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2, 0x12, 0xffffffffffffffff, 0x8000000) 8.04738032s ago: executing program 1 (id=4214): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@getnetconf={0x14, 0x52, 0x4, 0x70bd28, 0x25dfdbff, {}, ["", "", ""]}, 0x14}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a8c000000060a0b040000000000000000020000400900020073797a32000000000900010073797a30000000006000048018000180080001006f7366000c000280080001400000000424000180090001006d6574610000000014000280080002400000000c080003400000001729000180070001007274000014000280080001400000000908000240000000031400000011"], 0xb4}}, 0x0) r1 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x300, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, 0x0, {0xfff2}}}, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000640)=@newqdisc={0xc8, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x98, 0x2, [@TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x3}, @TCA_TAPRIO_ATTR_TXTIME_DELAY={0x8, 0xb, 0xfffffffb}, @TCA_TAPRIO_ATTR_TXTIME_DELAY={0x8, 0xb, 0x400}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x6c, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x80000000}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x1c}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x3}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x3}]}, {0x34, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0xda}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xfff}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x10}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x1000}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x1}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x2}]}, {0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0xb}]}, {0x4}]}]}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)=@newtfilter={0x48, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x9}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x24000000) r3 = syz_open_dev$usbfs(&(0x7f0000000140), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x4004551e, &(0x7f00000004c0)={0x83, 0x2, "5a77bd038786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500031681905db88235f8a5447dd2a2fd6e91626f068881e50f68530c2b21a100efb76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd500800000000000000e4a62fb73c33424b437bb192c9d06ea6ed0ff83fe5c5ca033dfce0a82577ef14eee686be0fc58e384f93a13e4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b394de70400d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca147df97db"}) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f00000001c0)={0x1, 0x8, 0x9, 0x4, 0x0, 0x10000, 0x0}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r4) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="340015c06804620896bd7000fe0a00010000000000088008000400870000000600070004000000080005000000c4d3fb1669e7629ded887b", @ANYRES32=r7, @ANYBLOB], 0x34}}, 0x40040d0) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r4, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xa00000}, 0xc, &(0x7f0000000240)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="10050000", @ANYRES16=r5, @ANYBLOB="000227bd7000fbdbdf250e0000002800018008000100", @ANYRES32=r2, @ANYBLOB="0800030001000000140002006e6574706369300000000000000000002c0202801c010380200001800800010001000080040003000b000200402f7d2a2728000004000300100001800400030008000100e9efe2242800018004000300080002006472720008000200042b7b00040003000b0002005d2a282de75d00005000018008000100f8ffffff090002005e2d2424000000000b000200402e5e215b5e0000040003000800010040000000080001000600000008000100000000800500020000000000080001000100008004000180040001800c0001800400030004000300180001800800010001000000040003000800010004000000300001800800010007000000060002002e000000050002000000000004000300050002000000000008000100000200001400018008000100000800000800010001000000bc0003800c00018004000300040003001c000180080001000100000004000300040003000800010001000000300001800d0002006d61746368616c6c00000000040003000f0002002e2b2e7b5c5d272d2840000005000200000000002000018008000100360f000008000100010100000800020064727200040003002000018008000100060000000800010001000000040003000800020064727200200001800800010004000000040003000800020064727200060002005b0000004800038014000180080001000300000008000100070000002000018009000200626f6e6400000000080001000700000008000200647272001000018004000300070002002d40000008000200030000007c00018008000100", @ANYRES32=r2, @ANYBLOB="14000200626f6e645f736c6176655f310000000014000200736974300000000000000000000000001400020064756d6d793000000000000000000000140002007465616d5f736c6176655f3000000000080003000200000008000100", @ANYRES32=r2, @ANYBLOB="08000300020000000800030000000000c8000280b50004003e724544fefa65c21bea52fcc2b967fb59466d4da3bfb3efc8950bb5fd0380872a6a042fe5fcf57994e8c6d46566ac287f689d47161afcbe9243c2eee5c0204e1a618dbb40ff1de1f0102a911b27c336bd42e5e92d32f7bb8dcab0e7344b31bc35b0c402311b70f46da12fe96c8401b9a606d13c801cbc03cf7abbe1c61637d4447f3d4f21c0efb1220a1fd51d06996ef7b0ef444054258e8c8c2b594ebfb2fafa9699c697dc69b6855aee1765045bc1c5000000040001000400010004000100180001801400020064756d6d7930000000000000000000002401028098000400110c2689203abd5cff83fa83d1cf454303017d871188f581043cc543a01b1cb19525d47b5d10150b4d256dfa2b0d430b186738312fa6d2b1747dd7d468fc8f9c2e708f60e727611b3d360f8628ecc820cd9fbda8affeff762005ab1407d935a74ec049a8c4483430ea50d695ad13c3ccce26886adb0fa48b63b450595bb8d4b703f0c69d995957ce77b0fb67c6c6a5771198708604000100830005005e337f3e3fa8128c29158dfdbe621cfedf0ab949a8423ba289cae24e4b219a564e471dd7a8dbc84135191f162c2d380d61079d4b5167b5462df91bd9e617ac294863425c5b3f6fc0ca92b640d401110018ac9ab3b20662d9fbce0a1d70c4a6a0dd692fcb5a1d13fc9ec5d72cc11aa5c7acfced2ac66b30c876eeb30956ee4f002800014f81de32e155849aea801400020076657468305f746f5f6873720000000008000100", @ANYRES32=r2, @ANYBLOB="0800030001000000"], 0x510}}, 0x20000000) openat$urandom(0xffffffffffffff9c, 0x0, 0x103902, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = dup(r10) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800450e003c0064000007069078ac1414bbac1414bb4e224e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a0c26075907800e71312c33659d0fee4cc0bfa5ae3953236afed0000"], 0x0) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r11, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x6a, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r12, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r12, 0xae80, 0x0) 7.671510629s ago: executing program 1 (id=4215): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) sendfile(r3, r4, 0x0, 0x20fffe82) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) writev(r4, &(0x7f0000001200)=[{&(0x7f0000001140)="08a3c8f542ccae37ee381116dbd79fa7ed80c1b250b5d638a89a49ec9ec1cd8f8fb24701819a26766c48a9bf9b38e284ac680bb4bddfad977175eef215d1fae3a21ce67271c4bc3a3e9f03158ac0f74f52bacf3a333b2055f62a5af94aff45cff341586eeaf42afae292adfc2da16752d6d4ebaa6b7d997b3d74bc9edaa9aee4465dfcef8ce80d1be7aaf719b934b9983b7437ab816d09d68763b7fa09e4f8ba0446a13203f73442f2787c09d8e674e9e9b1e650bc3be5ba03c4dd7d1d78", 0xbe}], 0x1) syz_emit_ethernet(0x4e, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "081200", 0x18, 0x2b, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @local, {[@srh={0x3a, 0x0, 0x2}], {0x0, 0x0, 0x10, 0x0, @gue={{0x2, 0x0, 0x0, 0x0, 0x100}}}}}}}}, 0x0) syz_usb_connect(0x5, 0x559, &(0x7f00000008c0)={{0x12, 0x1, 0x201, 0x32, 0xcd, 0x10, 0xff, 0x19d2, 0x12, 0x6be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x547, 0x2, 0xf0, 0x1e, 0x40, 0xbd, [{{0x9, 0x4, 0xb8, 0xfc, 0x10, 0xff, 0xff, 0xff, 0xd, [@uac_control={{0xa, 0x24, 0x1, 0x8, 0x8}, [@extension_unit={0x9, 0x24, 0x8, 0x4, 0x101, 0x9, "e8d9"}, @processing_unit={0xd, 0x24, 0x7, 0x6, 0x1, 0x0, "12ecd3c62919"}, @mixer_unit={0x7, 0x24, 0x4, 0x4, 0xf7, '?%'}]}, @generic={0xc4, 0x23, "98e5e1a46abecdd43d1fdd36c51e971542812748a48a49d1e7f2a6c54c2e90dd9edf00b8a12686f5bb38e3a67787f1c8e77ca4dd8d3ad97f0dcdddc7cd8a18000957d9c46cd1fa8c01aa7930c0872a22cd97a712acf9385581db9335b75167f3d940e44898063f3ffd59a4b163ef875b8e837f8808109ed0747b86f4dc4db36d74f5a7f03955805751ab5a41c614d5600a1afd268febebfdb246a7bc884757a51b2b92869e2729f190dfcf3655ba562dd12c86724e0660ca6203b19ab678d9382ed7"}], [{{0x9, 0x5, 0x8, 0x1, 0x3ff, 0x1, 0x9, 0xee, [@generic={0x14, 0xd, "11a14b4db6c72f908aa7340c43c986c49d55"}, @generic={0x71, 0x1, "837d30e98bc944ab298a2c413ce8a13e08e2294ef137164c2aef20226cc29d432468780632b3495903ca1bec2af3ce5585d4f4aa3abda52599d5154d08d178cbbde648caa90f1d0973ad0c3e1ba57b0fc89570432529b5988da384e881099ae8e77ae73e0b36792d07a7e5a7e1ac77"}]}}, {{0x9, 0x5, 0x80, 0xc, 0x40, 0x7, 0x5, 0xc1, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x4, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x1, 0x8}]}}, {{0x9, 0x5, 0xb, 0x10, 0x10, 0xd1, 0x9, 0x3}}, {{0x9, 0x5, 0xf, 0xc, 0x8, 0x9, 0x4}}, {{0x9, 0x5, 0xa, 0x10, 0x20, 0x2, 0x5, 0x18}}, {{0x9, 0x5, 0xa, 0x2, 0x10, 0x5, 0xc, 0x1}}, {{0x9, 0x5, 0xa, 0x1, 0x3ff, 0x0, 0x2, 0x70, [@generic={0x78, 0x4, "e2866349e405b44e79ea484caecf24ac312694e4bace6d8d0458640a0ba586e55f83d2fed633c98479778f08a34e8295bb24fb348e32e09d7b2c08687c380836048fc817f84b52b1f9a4625e733fad2a13ce1705a6ebc739ea330fc0726e975f993253ce42ecf114c822b4c0c2a5da77717679df16a9"}]}}, {{0x9, 0x5, 0x5, 0x14, 0x10, 0x4, 0xe7, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x0, 0xf}]}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0xcf, 0x81, 0xfd, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x1, 0x7d1}, @generic={0x2, 0xf}]}}, {{0x9, 0x5, 0x7, 0x0, 0x400, 0x1, 0x80, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xfc, 0x7}, @generic={0x80, 0xf, "f3794166e77fe1ccef50b270e922832b3e4ad227a8a833e424e6481a2ef5288d5f6ec8474b15f0aa5b8ce5ded86bd7bbd938b84415d690fdc7310e00f9fca13102730596ff39e0b7e8cec841d99c4d9dc72aa1e1d4f72bde5c1eae3d0b2dec4f7d68828fc0f46fcd217f4fe47d0170739a688d910dbe1d587309a7f3021c"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x8, 0x0, 0x2, 0x4, [@generic={0x14, 0x4, "d46e6cbded3d75fddd0fe8ff29673869ade7"}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x9, 0x81}]}}, {{0x9, 0x5, 0x3, 0x10, 0x8, 0x0, 0x40, 0x0, [@generic={0x62, 0x22, "2b7733ae2367f39036af54be4185f26fd2fd356f24a6269ea0736220908190ad99d6b6a72b0aaca03bd3188c42705682b989a78f5dd14fe9868a87b65015c7db88e2f225949dd5c27c9e65751363d6be5455b544fbc95f27168478d78b50670b"}, @generic={0x84, 0x5, "184f0f1b42db8c35d6764ddd6eacf591eb083c98989638bab1b61429be81e0a4a18d5c7cdc3c43924f9e16a4d635e1b2dd2da95707d6c55c07d2b17385ed1cebcd5d2270c5533d322088411f939055d5fbf45f5d6cb7cdb90a80fea10af50783581861be1dcbaf639ceb6d495f8863f2de0a2a765b6ddbe43c12c5073eb717945f9c"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x8, 0x2, 0xf3, 0x15}}, {{0x9, 0x5, 0xe, 0x12, 0x400, 0x3, 0x2, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x8, 0x4}]}}, {{0x9, 0x5, 0x80, 0x1, 0x3ff, 0x6, 0xe, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x3}]}}, {{0x9, 0x5, 0x3, 0x3, 0x400, 0x10, 0x3, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x877a}]}}]}}, {{0x9, 0x4, 0xc2, 0x0, 0x0, 0xe3, 0x20, 0x4, 0x7, [@cdc_ncm={{0x7, 0x24, 0x6, 0x0, 0x1, "67e1"}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x2, 0xfffd, 0x0, 0x1}, {0x6, 0x24, 0x1a, 0xf558}, [@mdlm={0x15, 0x24, 0x12, 0x9}, @mbim_extended={0x8, 0x24, 0x1c, 0x7, 0x80, 0x1}, @mdlm={0x15, 0x24, 0x12, 0x9}, @acm={0x4}, @mbim_extended={0x8, 0x24, 0x1c, 0x9, 0x3, 0x1000}]}, @generic={0x9d, 0xc, "db2f2fe21ebda48a6483b2ace09d6c86671cff11949c6c8a75a5f8f6cd9bbf5b0ded9473cdb39fd581155c01d482ddf2b05bb0c306900d861b07b36fdc51f8f9889b60034797968d68f9f4f4319aa3677ceb9a9a1ce43184fd8f5f4ff323003e14349b25d27a55673b9cd6fd3cabf9a119a026902ca65cace485bb4646735469f07372fb14112a594482fd8124e81154e3ec3b2b26302f00f17219"}]}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x200, 0x35, 0x6, 0x2, 0x20, 0xec}, 0x2d, &(0x7f00000003c0)={0x5, 0xf, 0x2d, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x6, 0xe0, 0xfa, 0x7}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x12, 0x4, 0x4, 0x1}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "b0226c29089a404900597b0b6ab76ae1"}]}, 0x5, [{0xee, &(0x7f0000000f40)=@string={0xee, 0x3, "7289cb171937fca4153c62e162f74ad55f78662720dccdd44ebb1ddd19ac7b4d0557327a03973abf6f5c00aaf91e784c464d48379feaf83180527faf47dd1e472217ec6d31f6559298cf93b6077beaa8e3587516d2999888089cd0ce55f028d1774a59fcf6b69d88afeba7fbeef0d62eafa84b63007c2ade839fdef0c28270a56f3511450333c8f06698b38bed649d67336e37105061fc2a51a28057c528f77dea4b2a4504b9c13f902c93a1643d1a0828b8cecdd1779b2c8ccd00325124cc7db392af83db4e95c730368d37fc65d517f6a25f0faa810e1e0c00d75df5854e257ef44a84f6b8a475a1ad43de"}}, {0xed, &(0x7f0000001040)=@string={0xed, 0x3, "8a15f0b7b33dac5bd76924f9ca26e1bd6fc5a852835df3a27319dd547eb9612459012f7f17d4d5b7280becd720d325048e5b85e4c56632570067fd7a8532e26a0569c7166f22af656853ce46b87a853adac015ea3fc07947dc54533225cfcea3d2daf3fe3e7c71994b3f700700747343445cbcae68260181fc900268f857a5bd12e576e1283b9a180f3b9a1fef2eea634acd1edd55e3657b599c1a9bbc24894695c63eec5fdfad7522def9ff41cd8ddba6694c227abb41ac4e23a540d77cda692677507533b9b3b1a99f38d3314ed3f1360a0a5ab4979fef61187136ee4328097e44e20781cdffc18a40df"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x43f}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x820}}]}) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000300000a50000000060a010400000000000000000a0000010900010073797a310000000024000480200001800700010063740000140002800800024000000013080001400000000a0900020073797a3200000000140000001100010000000000000000000200000a00000000000000"], 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000780)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000005000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffef023cabb31284280485683cc48feeffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000080000000000000000000000000000000044000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff00000000000000000000000000000000000300"/195], 0xfc}}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b00100002100010000000000fefffffffc020000000000000000000000000000fc020000000000000000000000000001fffc0000000000000a00e08000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="020000000000000034011100fe80000000000000000000000000001100000000000000000000000000000000ac1414aa000000000000000000000000fe8000000000000000000000000000bb3c000000000000000a000a00fc020000000000000000000000000001e0000002000000000000000000000000fe880000000000000000000000000101200100000000000000000000000000022b030000043500000a0002000a010102000000000000000000000000fc000000000000000000000000000000fe8000000000000000000000000000bbffffffff0000000000000000000000006c010000000000000a000a00ac1414aa000000000000000000000000fc010000000000000000000000000001fe8000000000000000000000000000aa200100000000000000000000000000016c0200000735000000000a002c001300fc010000000000000000000000000000fe8800000000000000000000000001010000000002000000"], 0x1b0}, 0x1, 0x0, 0x0, 0x800}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) 7.376068604s ago: executing program 4 (id=4216): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000500)=[{0x0}, {0x0}, {&(0x7f0000000900)='^', 0x1}], 0x3}}], 0x1, 0x4004) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x635c, 0x1f480, 0x0, 0x399}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 7.268721438s ago: executing program 4 (id=4217): ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) r3 = dup(r2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r6) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x3a9e9908}) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r7, &(0x7f0000000780)=ANY=[@ANYRES8=r3, @ANYRES16=r4, @ANYRES8=r0, @ANYRES32=r1], 0x2c2) r8 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000200), 0x4) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_GET_ENDIAN(0x13, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r11, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x40) r12 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) 5.463659468s ago: executing program 3 (id=4221): socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) r2 = syz_io_uring_setup(0x498, &(0x7f0000000540)={0x0, 0x465e, 0x400, 0x3, 0x285}, &(0x7f00000004c0)=0x0, &(0x7f0000000480)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r1, 0x0, 0x0}) io_uring_enter(r2, 0x3498, 0x969, 0x0, 0x0, 0x0) 5.205007319s ago: executing program 0 (id=4222): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x2102, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0xa440) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000400)=[@nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @control_nat=0x6004, 0xff9c, 0x38000, 0x7}}, @nested_vmresume={0x130, 0x18, 0x3}, @set_irq_handler={0xc8, 0x20, {0x7d, 0x1}}, @code={0xa, 0x55, {"46f442e501c74424007eef6313c7442402be32c8d2c7442406000000000f011424440f07660f136d32670f7984030068000066ba6100ed2e40d9e8450f001a420f005d42"}}, @rdmsr={0x66, 0x18, {0x1ae}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x2, @host_nat=0x6c04, 0x7, 0x7fff, 0x800000000000}}, @wr_crn={0x67, 0x20, {0x3, 0x4}}, @wr_drn={0x68, 0x20, {0x2, 0x2d}}, @in_dx={0x69, 0x20, {0xd155, 0x5}}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x3, @control64=0x202d, 0x8, 0x1, 0xffff}}, @set_irq_handler={0xc8, 0x20, {0x22}}], 0x1cd}) ioctl$TIOCL_BLANKSCREEN(r0, 0x541c, &(0x7f0000000640)) ioctl$KVM_GET_VCPU_EVENTS(r4, 0x8040ae9f, &(0x7f0000000600)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000300)={0xb, @sdr={0x34565559, 0x2}}) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000001280), 0x0) r5 = socket(0x40000000015, 0x5, 0x0) connect$inet(r5, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) sendto(0xffffffffffffffff, &(0x7f0000000100)="51bf7336f6cdf0ca6c13c866d6bc7b55f2d501845841bb2c078a988b7eb38f11a326083cf884920013fbae4a3a5d9c8ea7ea86669fb6212da0b5c82136d9519daeb17c9f96ad78cccef50ab4eabcafbc1a18735359cd7329816984d180735476f901401079349dfbe2e614f51a07c00544d90a594972ba60e1b497f88dcdc1e45dd28c0678d803638e7bd70a8638136e52c5e932c4111d3c917fb22583198b00707e3a2e001260cbc206759c245451686164eff751e4df8995", 0xb9, 0x20000000, &(0x7f0000000280)=@l2tp={0x2, 0x0, @broadcast, 0x2}, 0x80) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000300)={'vxcan1\x00'}) setsockopt$CAN_RAW_FILTER(r6, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r6, &(0x7f0000000080), 0x10) sendto$inet(r5, 0x0, 0x0, 0x0, 0x0, 0x0) 5.185036171s ago: executing program 4 (id=4223): fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom0\x00', 0x800, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000040), 0xffffffff, 0x10080) sendmsg$can_bcm(r1, &(0x7f0000000180)={&(0x7f0000000080), 0x10, &(0x7f0000000140)={&(0x7f00000000c0)={0x6, 0x110, 0x1689, {0x77359400}, {0x77359400}, {0x3, 0x0, 0x1, 0x1}, 0x1, @can={{0x4, 0x0, 0x0, 0x1}, 0x1, 0x0, 0x0, 0x0, "a8981a2867318a70"}}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) (async) sendmsg$can_bcm(r1, &(0x7f0000000180)={&(0x7f0000000080), 0x10, &(0x7f0000000140)={&(0x7f00000000c0)={0x6, 0x110, 0x1689, {0x77359400}, {0x77359400}, {0x3, 0x0, 0x1, 0x1}, 0x1, @can={{0x4, 0x0, 0x0, 0x1}, 0x1, 0x0, 0x0, 0x0, "a8981a2867318a70"}}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x20000010) fcntl$dupfd(r1, 0x406, r1) (async) r2 = fcntl$dupfd(r1, 0x406, r1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f00000001c0)={{0x0, 0x1, 0x90, 0x3, 0x7ff}}) sendmsg$NL80211_CMD_GET_POWER_SAVE(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x3, 0x79}}}}, ["", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x58001}, 0x0) (async) sendmsg$NL80211_CMD_GET_POWER_SAVE(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, 0x0, 0x100, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x3, 0x79}}}}, ["", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x58001}, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000300)={'\x00', 0x81, 0xfa, 0x401, 0x3ff, 0x7, 0x0}) timer_create(0x6, &(0x7f0000000380)={0x0, 0x3f, 0x2, @tid=r3}, &(0x7f00000003c0)) (async) timer_create(0x6, &(0x7f0000000380)={0x0, 0x3f, 0x2, @tid=r3}, &(0x7f00000003c0)) ioctl$sock_ifreq(r1, 0x8947, &(0x7f0000000400)={'ip6erspan0\x00', @ifru_map={0x200, 0x8, 0x7fff, 0xc, 0x9, 0x7}}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r2) sendmsg$NL80211_CMD_SET_BSS(r1, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x30, r4, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffff8, 0x79}}}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x40800}, 0x20040000) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, &(0x7f0000000580)=0x4000000) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f00000005c0)) syz_genetlink_get_family_id$team(&(0x7f0000000640), r1) (async) r5 = syz_genetlink_get_family_id$team(&(0x7f0000000640), r1) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000740)={'syztnl0\x00', &(0x7f0000000680)={'gretap0\x00', 0x0, 0x7800, 0x700, 0x5, 0x5, {{0x25, 0x4, 0x3, 0x29, 0x94, 0x67, 0x0, 0x7, 0x2f, 0x0, @private=0xa010101, @broadcast, {[@cipso={0x86, 0x14, 0x0, [{0x1, 0xe, "db061b99b9b41d2d52902007"}]}, @ssrr={0x89, 0x7, 0x30, [@initdev={0xac, 0x1e, 0x0, 0x0}]}, @noop, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x8, 0x82, 0x0, 0x8, [0xfffffffb]}, @timestamp_addr={0x44, 0x3c, 0x98, 0x1, 0x9, [{@private=0xa010101, 0x1}, {@multicast1, 0x4}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}, {@empty, 0x6}, {@loopback, 0x2}, {@initdev={0xac, 0x1e, 0x81, 0x0}, 0x5}, {@broadcast, 0x9}]}, @timestamp_addr={0x44, 0xc, 0xdf, 0x1, 0xa, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}]}, @noop, @timestamp_prespec={0x44, 0xc, 0x5a, 0x3, 0x9, [{@private=0xa010102, 0xc}]}]}}}}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000780)={'wg0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000008c0)={'erspan0\x00', &(0x7f00000007c0)={'syztnl0\x00', 0x0, 0x20, 0x10, 0x10001, 0x10, {{0x2a, 0x4, 0x3, 0x1, 0xa8, 0x68, 0x0, 0x3, 0x29, 0x0, @multicast1, @loopback, {[@timestamp_addr={0x44, 0xc, 0x8d, 0x1, 0x7, [{@remote}]}, @ssrr={0x89, 0xf, 0xe4, [@remote, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @rr={0x7, 0x23, 0xf7, [@empty, @rand_addr=0x64010101, @multicast1, @dev={0xac, 0x14, 0x14, 0xd}, @private=0xa010100, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x19}, @multicast2]}, @rr={0x7, 0x13, 0x42, [@initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x13}, @broadcast, @broadcast]}, @timestamp_addr={0x44, 0x34, 0x26, 0x1, 0x8, [{@multicast1, 0x6}, {@empty, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3}, {@loopback, 0x200}, {@multicast2}, {@remote, 0x7}]}, @generic={0x44, 0xb, "e7aed92bc4f3ad979f"}, @end]}}}}}) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000000900)={@multicast2, @remote, 0x0}, &(0x7f0000000940)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000a00)={'syztnl2\x00', &(0x7f0000000980)={'syztnl2\x00', 0x0, 0x2f, 0x0, 0xd, 0x3, 0x4, @loopback, @empty, 0x7800, 0x8000, 0x10000, 0x4}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000a00)={'syztnl2\x00', &(0x7f0000000980)={'syztnl2\x00', 0x0, 0x2f, 0x0, 0xd, 0x3, 0x4, @loopback, @empty, 0x7800, 0x8000, 0x10000, 0x4}}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000a40)={'team0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000bc0)={'erspan0\x00', &(0x7f0000000a80)={'sit0\x00', 0x0, 0x8000, 0x0, 0x6, 0xff, {{0x44, 0x4, 0x2, 0x1f, 0x110, 0x68, 0x0, 0x6, 0x2f, 0x0, @empty, @local, {[@timestamp_prespec={0x44, 0x34, 0xed, 0x3, 0xb, [{@dev={0xac, 0x14, 0x14, 0xb}, 0x9}, {@local, 0xfffffffd}, {@empty, 0x8000}, {@multicast1, 0x1}, {@multicast2, 0xa4a5}, {@multicast2, 0x1ff}]}, @rr={0x7, 0x7, 0xcf, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp_addr={0x44, 0x2c, 0x9b, 0x1, 0xa, [{@local, 0x6}, {@loopback, 0x4}, {@private=0xa010102, 0x8}, {@broadcast, 0xffffffff}, {@dev={0xac, 0x14, 0x14, 0x3e}, 0x7}]}, @generic={0x86, 0x9, "56f943638359fb"}, @cipso={0x86, 0x6c, 0x1, [{0x0, 0xa, "9842b49930ac0d67"}, {0x0, 0xb, "bc054716a581ccb7c6"}, {0x2, 0x2}, {0x7, 0xb, "e0cab2a9d108959408"}, {0x0, 0x7, "7c5c727296"}, {0x7, 0xd, "0d4f2e737b9aca0e877284"}, {0x7, 0xf, "070468614db06fd0c7e01147f4"}, {0x2, 0x12, "4e6eeec51efbfb555366c5bfbe2ec632"}, {0x2, 0xf, "236f5c795a10ac38b33bf3ac5f"}]}, @generic={0x82, 0x8, "8673a2f094e2"}, @noop, @lsrr={0x83, 0x17, 0x8, [@loopback, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x22}, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000c80)={'gretap0\x00', &(0x7f0000000c00)={'syztnl1\x00', 0x0, 0x700, 0x700, 0x2, 0x6, {{0x12, 0x4, 0x1, 0x11, 0x48, 0x64, 0x0, 0xa3, 0x4, 0x0, @private=0xa010101, @multicast2, {[@end, @cipso={0x86, 0x1f, 0x3, [{0x6, 0xb, "76302289898130e7df"}, {0x1, 0xe, "6ab079c78667402bb0287003"}]}, @generic={0x88, 0x12, "cb3663bc02a8a5f931e7666dd7ec0723"}, @end, @noop]}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000d40)={'syztnl1\x00', &(0x7f0000000cc0)={'syztnl2\x00', 0x0, 0x2f, 0x1, 0x5c, 0x1, 0x0, @local, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xa}}, 0x20, 0x20, 0x80000001, 0xd}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000d80)={'wg1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000dc0)={'wg2\x00', 0x0}) getsockopt$inet6_mreq(r2, 0x29, 0x14, &(0x7f0000000e00)={@private2}, &(0x7f0000000e40)=0x14) (async) getsockopt$inet6_mreq(r2, 0x29, 0x14, &(0x7f0000000e00)={@private2, 0x0}, &(0x7f0000000e40)=0x14) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) (async) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000e80)={@rand_addr, 0x0}, &(0x7f0000000ec0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000f00)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000f00)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000001600)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001040)={0x56c, r5, 0x1, 0x70bd25, 0x25dfdbfb, {}, [{{0x8}, {0x80, 0x2, 0x0, 0x1, [{0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8218}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r8}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x10ed}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0x90, 0x2, 0x0, 0x1, [{0x4c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x1c, 0x4, [{0x2, 0x3, 0xc6, 0xad7}, {0xbd, 0x1, 0x0, 0x3}, {0x1ff, 0x8, 0x8, 0x1}]}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xa}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x1ec, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r14}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x44, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x14, 0x4, [{0x1, 0x6, 0x5, 0xcde}, {0x6, 0x9d, 0xd, 0xc3a7}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r15}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r16}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xe9e}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0xb4, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xbc9a}}}]}}, {{0x8}, {0xf4, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1ff}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}]}}]}, 0x56c}, 0x1, 0x0, 0x0, 0x48084}, 0x4) 4.671467546s ago: executing program 4 (id=4225): r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f00000001c0)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1b}}}, 0x24) r1 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r1, &(0x7f00000004c0)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{0x0}, {&(0x7f00000005c0)="f2b314c96d500b66f7", 0x9}], 0x2}}], 0x1, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffd}}, @dstopts_2292={{0xe0, 0x29, 0x4, {0x4, 0x18, '\x00', [@calipso={0x7, 0x10, {0x1, 0x2, 0x9, 0x9f, [0x8]}}, @generic={0xfe, 0x58, "f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc1cf3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f683"}, @calipso={0x7, 0x38, {0x1, 0xc, 0x7a, 0x8001, [0x5, 0x9, 0x4, 0x6, 0x4, 0xb]}}, @ra={0x5, 0x2, 0xa7e}, @pad1, @ra={0x5, 0x2, 0xbf4}, @hao={0xc9, 0x10, @private2}, @generic={0x93}]}}}, @hoplimit={{0x14}}, @hopopts={{0x110, 0x29, 0x36, {0x5e, 0x1e, '\x00', [@generic={0xff, 0x34, "50d650847249ad288702ebd0d654b985e8908defb7ec6c5ff115c58e128b9e3a21c34b45ef9de99984e143ca7c3509a971b2ec42"}, @pad1, @pad1, @padn={0x1, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @calipso={0x7, 0x38, {0x3, 0xc, 0x0, 0xfff, [0x2, 0x966, 0x7, 0xfffffffffffffff7, 0x1, 0x1]}}, @generic={0x8, 0x55, "c8a110995d439fbfac9716a99c357bcb2d59a850490739734f6b321d19b3754df39cc2dc26cf263cbebbddb9a7f17b6771f74c46623f9e38bd23e6f0a2fd3a9a017f66738394aca44d1a9f0b35d9df0a964360ab09"}, @calipso={0x7, 0x18, {0x3, 0x4, 0x3, 0x7, [0x0, 0x8000]}}, @generic={0x1}]}}}, @rthdrdstopts={{0x20, 0x29, 0x37, {0x73, 0x0, '\x00', [@pad1]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr={{0x18}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x2c0}}], 0x1, 0x810) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000000080)=0x80000003) r4 = dup2(r3, r3) read$FUSE(r4, &(0x7f00000063c0)={0x2020}, 0x2020) syz_fuse_handle_req(r4, &(0x7f0000000280)="0d1c409c14b8ddbbe2423ac75d732f3d0e9cd37b375b9673cb39c6b35cbb85c4ba83de9d23bbcdd53a9f0d7c92b66f6d87e096b32f4bdac32a6136c86365cfd42c3b0a25fac76123b6d700d3ba70cc138bc435d3b1fcee2545c3a421119087bddbbfd0418488219343819cf0a6780d54166d2769a719b207136357ff3f505fc1d6144239ba630b15e7f8aeef7be5cb8c9e738faec0d1ab79d34b994e098323b94d32926bc3b0fd88c13cc781a0fc3da7c4d83fbaf3288fabe01685a3422570fa4cba7e840bd0a01e995c91c5aba51ca15461dc1916bde9e70c66f3aae48475e95aea1f8e6c6f10104d64f767b7f9b7909f5caa5fd61ec7bc7392bfb7fe4f1d1d0528601a87f9248693f31a0f2ea07a0f33e670bad3ba0c648266195c6d9a76cd973a9da6016d1f5e0d49122f64da8933cfcf6a970d11767279a9e8e37a30a007e6ea473e146069e72894fcd378e17d4fa761999c128492a0321c3153edf7b28d0cddd78758f5192a924fbe2e8c594cf35aeffc635b14903d134fc5f7857218f99266c64be16e5f4ad76a8b5f6d39ca2451afcdcb0cf42322a5166becc90621f99f28e42bb2cb610039c45e54cc4bb8e8210e612a3f1ac93366b7bd77410af8b4b3eb03085354c9f8d12cc62da82eff96a006dab656c10e1bf210124b0ed6841158ec70981a399ba7c406f3014bf77553be6197d79dc1d31ac4c598bdbd007578d50f00ce85810e0759e91505549c70005a5f923aba20d8e05d0b764680b9ea259c8fa71f1ee36b71da662b825019c07aade7db363662103887079dea43ca30c32e4f0d9ff043720541633157a3ff1dc055ac1db5b25765b7ef2e338c104db28b6be7fdae54f04075e26ce38ec71d35c029df580ee3ef68e46359031aea121d0776398d1f1e28e9cbdc20cb58adf5dfa01a2819f697bb3189ac0d32eec43c0ef75f5bd4c7926d18daf9a6e9265c961aadbed4fb9627a1f0a6c3dde66fe5530993a7f150e5b361ad0db403a864ef4f5e0f21db55aa22055bdc5b282b057d07efd6abe23f941a62d6f613a1ff8d31da632284e89a3069c6b26ef35e55fc846fb1c28651cc5a879a4994568c4639b9fba8395014c9f4f6152cee1ddf8d582bc496bcbad8e39e0a5a3e713deed021eb9d5b3f8679a8bddc08ca77d7cd101006c5021b65cc7648a646735d9d7f6e54e4fb5bcf1fd9aee4beb700e597011a2fa6c01d22e9b6c7a5afd7def8ab0a3e612d8a5ce571dba2d0696155c3dbfcc851293eebccfac6855a7b024d762e768867f57446ecd6e1d09a31959a6374c50445884dfcc68a62662e5701a25a1da8e0abd0428bb558f9f7e74c250d4af62afad71e0f23268a955c548b41cc83f6810c72c832476383a355abfa449fc05c7afa2ed70849f175e826361882503246e688983f472c418578ae4c893d847c0c7f8ec99352d3024a69134dfccbc6ec3351b321483c57d2d1e77c0c7551cdaf4c14038844b1b05c25541d1d48bf0dfd1ae40c35872a5b37c2958e3a60187531814f3adff870aeb42cf611c3f777b08f7dcacf5c087b19c17dfca413097a603823363c2c55597330de20a73465ccbe5acfad066fcb17c177827cf081c588b73c042150bf1a18aff97518fbc1b4d5d22f29077e186ae9b998b4d6fdbcbc8c3bd57dcc61cc322537743ce480c1dea39adcc6a51da745a60e5272a7181986bcb992895035f0f882cdf79c56a84cd88c9bf0b7dab9c1f453cf4c05e2a33f43f4252fdcf99cf785e639bd9d11c374d4e3107ce128d2a823b6a8631a8fdebdf14a0bfc3f79d44cd54d3e8b9c5a3f41b9a1187e23f5a5eb5fadff92d746ff3befec7189ca19c1987551d0fec321cc306d235f82b3f479f3d7a3c1d2377afe3f22a49c682646e9893d7700061a0229a99d360f89d281dc6bb95b92329cc7277b89a9e6a3edd3c753cbb93e9f1249572bae520fb7c46970f527fd93c445a8159d4992badc395c05313462d37c4f651afbdb04f9f42ad4433c5c765735731ed6d8c97e4ca9fd3a1885de6c051e652a1ea40230e9d854ec2145c78ef5574deac83e78df8932dde1d5c46862c9f808394dc7f064b5649cc7b2627a55683ed33f2712ad2d4f77ec7f2be200e01fca138b3d1f42916a54a66561916bcbd3109f6eacf5096e478442e56e5af61f7c32c681bd35bf94a429a52024a48f6002978594418b66c6eb0fa91dccc4fa83d48927349b8a7cbb70670bd78b8acbbcb554a219cdc6740de4bbfcad2250fc219436ba5db017c172d6e24eaedf29d169b8867fc84eb2e721b31b08604a6fbd8d5edd9bb0152346509619f4a0f41090228b10868f56cd7d7c025cccc8f2b4a7d85ab91862c65d5d578fd5c046928c5c8f999611dea07a1451357b4365b33bac0a2a842b84e2cd4f790dca74cc962000f72d821b093e271e63680c0e9019769f3abed377f51f2e0a373958dfe351a1db29da4b74f9ba1250a8a0b985ed86cd7a2a4ede57ce00dbe77f5c797e6b9896ccb978d3a01047f9ac7d66e820073193b6a3400ff41f2f8a98a44a0d2a608db3000571efdade9a44f278272e7ada101d275c589fed2ee0191801b7a2ea62dec117c9cfd96ccb73de7fa2eb4d60a7ce1170047a5266668da1aa8489c6e4ce564607a485afc6991ba262cd6f155c23fbb47610f555e0be090854ffa0d610ae4baa1dbd1f36249beb0510b8d96132b6396a6261214f3153bfc4f0dcfeb55046bcca5868aa913316a2e802f9bfb51caacfd0045d96b3983b883db123da07fc20d06c973e3dc74c53006c77361cfa9d3b2062da3f9740cc7335ec792d1b2c767e86417433fe047c8d9368c0c51373b5e5158503afa52ab08ef49616499ccb8dc829e343d25fc1fc2ea6c95933295ab397f07703d1d8defebeb44a2a9556bbd5414cf921abfa8df9bc5ea76922d728ef0024f516c9fd7a2927a68ba9a7dcc4f52c3d8b72909b2bde14408e476778a3221644dfa13794e365a9ebb670eaf691b3c2393adc441519c1125b960ff109ccab52294c6584d74b3084cfda3707f7153681c88a1578a77be9224a70ce400f4af3dd72452df147476abf2668c1801fe538be40042717b6c468fe1a33d1d597fb637396b8ebed9f64eee42e645bd8dc0e63fbd3a139bce3157ce7ed6f5f643ee26847908efaf61cd977627647bc0e4f119b924bb185664f1dcf2240b2697c89e8f569332d19ceec176642ebf0bf509bd3b9477272159d45b708510908e74cc5e0304104d5ed6e578b46dffcf64367fe9d274ab8f16f3154f3e83ce6d3ae92a2644ceeb8ec33e07f728319eb69dfa37bb70b40a1001ff0157173e33af633496062b17cfab8b5c06ef2fadfef280da4e1f70fbbac10981a0b35f3ada39733d7d31798e455f0dd1c530939f09df43b5aff342c39052a51d773b22acbc8c1525f3572ef469eefe66d1895a9ca3c637286e3f9acd29e890ffccbb313dd9da50aacce808d06d0b109a16a1c2bf69fc4b85b9b7cc9b9ba9e5d709c65fd0a879032caee38315eb049b12f11c4d485ef426fff3a4f91b4f1ad4c192c4074636787ff966f82c8d4fcad13a7b581718ee7318f6731da2eb1338c95c35f1f2e082bedea7f05b87d891876cfab51ddf2908ebb2bc153c20001ae9c142b35a3de474b732c5f629bd948ac9230067120671d296001cabe19e3d2302c1f32e4fcff1681ab2ef216309c21c6a5afc51ac500687a5140d015ee2bda5f3d8a15826a21a0a9495b36fe958fff32afe270f809f3a8f8cd2d8992a859e5de779bd8aa4dc6979807171282ef34502f1bf34f529cdad15671692f232a9f2dd2107f8198f7a9ea5883cbeb2a060ff1b13fc1a4df315dff940e8f013e8142c640acf51ebb2b2f878dafb6c12747cef3061f2235bccceacce4bf9829df24b9f9e9c5c259aafbe61ff6be827e492e2c03fa1e9f936196ff9acb28081f7ca74109d823c5c96b1e808bc2b8072763954ec5691f7935284e045c6d86c5c68d69b4502a5132b3c1cdc5e000ed1f6aa4bc0a9090a8923004ac05558e08827c71fd2e24f931f880244143a8d092dc8bb2b48317ff49fa0b494b3fea0741fbcac6cf780f93db42f47d23170a70619d06b0462f2fb04dabe2a0c94a1d97ecb159d426df47f0a1e13764e045d97ba75fd0eede9711d112581b4a2e66b10077aa92c98e30d6504f0c08c0c68015c88abbc991d5a799e588d1ee7492d699126627ace339c1bb024a59ccd9d3df0197c8e56219d76698b61ec94927f41ccc7bc80ab6f65380d31d58f796e7e697b28e371ecd9ccf6b58e9cf32daee54c5228268446677f600ca8d091b6a4774749d40d6d4d6a009ae12bae1c530e6961420507a13a2a32c4f0863c790159a26588bed9f50b4ffbfc8649adc8144779653b4226fed5ab93570fb3edcc1be70780f6ddc8d9ef1ff39d22bd20cd8ae0195d02ada60fa0d65e065b7a3950d5a2b77546ad8f1c1018344589085638793d26fb4a5c59c23f1c9b148ddcbc478e1867e109590c44c14f5ad6e8cda21a75358cbfe6f397c711eead2b1c73df1453d184a44e85c2f6ac0c266b0f67b001426cec02efb66085bd1b8bcaf06d6709d545895337fe36e9d26417238f36be5ba51d5cd7cd7cec452780b72bc441052f67496ed8bb4d393db8da52aa3b0ef10a74a33c2b7ee24f76642f83bfc3e686951cbd1983f1ea54d536f6c86e8b20a4eaefb9ca57308abcfd81357e3d0eebeb0ff805c151ea1d0063c3bea7120562886fc4ce284f33d4a85c830d8b9b9b1295c352c3f5db54973a5ed3788e5396a1add7022546f13db95e4ad1a994142aa4f98d644cd822192e3e1875da3b4a6cfd61cca36a82fd4c1f09db84f6b379483e2b81749609750b493e406c8add341d8855ef47d8e8cd49e9d1340be1223d268bed3a2cc949b74cf01160723d26de9b11138fd8e8957354c2a58fa30903b7544d2bdf49249e5ca9f5d030f0c17e7ec605482523d1da3b3ca6c94c8724c20b929954c1c1f321ba7f77e2e954056a2838e57696e40a2fc9f8c2b7e25a41cd500f4fffb196810b3d77f79dfc1f7179fd4e2c63957c65da8325185cdfa37a82d42ebfc631a87ce7ba60ad09132f1eabe7b870c88fa277578e19a6adabd328e6b453dae201ce4327a378174695264ff4411a3815c362480058038b1b70b652e89b0c7743548b897c80c53b16aba4d244753fd8c14c8bcdbe2a2710df7842a8af2bd0a966632655c01bbc2604151b80e349b2f5f63fc8fdfb34c7223803fc0fd1dcf7fb5471c65f59ef9b02c3c0440f7e44fa4759782a46165c64e2ffc246d0438248c461e932806ddc20d3eeb597d74e9cbfba85951c601fd8b903c80f5d8bd5fc5b824cd63d9bc2d38438eb8a8bd1fbbad944b3ca074eb318ae074ef4d7f12076ac1809ca6868be7e5fcbb953ee70bcccb7cf51422e8293faf3e88d4b179b4c7a6ab53638eb05c902715c023f33ba9e121aed0b7b5f0544b5275cf22093e64a7038cda03fc9014002cb52d4568625d321b344e566b50a7e9695c79daab4aa0fc82790cd32708bdc0242686052677eb163cba152231e45d0ad1b8238a7d1230f43612ae8b9525d1f98372774a326e9baa48e69093b215ea503e054729722a71c7e6c58b958f3cec95fdbf1811b7c8a53787e95d266a70d408798e94d9579e813a8e9e3d4bdb4f2682f7aa30b659c722aa07faa911543c57db9fb3abf73ac5b4096cadb4bfa2b25e51b11e754348a2abff384a16194af26590ccd657cf76bae1f1246b67ee0834105f008cf77b1320ecfcb87bfa7d2b2fdec1330f54b6c6cf2280119e39e9a66ccef3df0c4297e1c861a027fa2ea5a1ab530f5b94a98895405c620bb6faecd7e80bfb42d1a4646360e0e8355af548439f8db48d583352ea84385e271b3067bf7b047e69e23c3bd2c3ea74df48b3649985b0ef12a9f3803ccfa52e01381d30a9005f0415a149557b67d0ac7c439ba8b20a9eb293ee4d357cc1d9e1e7f707ad77e58f22d2b26f9a8e726e826b6722c2b910416dcdaf772476e55256fefb1fa5de0139e15c2bf84e267be5d5381bb30607b731c8f305a1b4e1e4bae0b59e61dc77b13d129dfff4fdaf48f95038cc11b14e8266aac4d59fb40346c07a7fee92327e40905e40f8135b0f6e9e31969902e9926a99d7ae30891be917581189ff998ea5310da0cf72faae333ab8ee7cb9f78bb0a8695a841b8d37709e2826594cc8927f5dd98c53ea4c5246b5fc09f756f29b61c21996dcb6c0f1e476674aa9b6f69ccfcf8672b048ee723af55104da1c2f5250e8bbb3bdf2b7edb4878a902032ab4115f516d804d2cde7bce6b0c6dcd1f0d321fe4bb279e4c45294df0fd33956469839c70bcb68c033b597daf3f515354e72fd1ecff87e4b8d1ae52e6ef0fc773a49ca76d0659454b59e9c62fc8e10131e50893c0c0a997fb5766157701ce8e6a6482bd8b0b53a6b4fd4227d8e02c6453114f161017b18e52867282010df15c361a0ed3b17636adce6567ca97d4864dc15fca353490aecd5d26af991a92dcfd3e4dd38b8ed9181dee7e2e20cc2600c3211eecafd0dac537a693573e843259c30789a3d0ef91b78f95ed5da1c9e61716f651284e4eea663aab9c30d28a620745e44fbcf71221a23d332d411d17220c5a43321cbae90ba8104ffb4415d7563a21406d6be1fdc9abfff8998b51628b28b4ed84ded6804726cae5b62281949bb7cd7bec7bb2dfa8d831d4928b274c7452d2e9f8a37c67c98239b121d3acf381a10469d0dee019d38dbba865fdecfa34e39b0dcd4cf7a66e30f87d4f26d4190fdc62d44c850e94121ace3d531de3204ed5f838f5953c98b44a387a0cc95fc5e76facdf3a9f98183d32d887fb7d997a37b4737861bb12ea8e412e1015d3cceff7b448381f3fedd35a535e524f9e6df67e14882d9ec956a81e1972392c8c79cec77fe6d0f88a00710aaab4878187d6c387cf1ade1c61ca3b9bef117ad621c9a971d4f04a2e45314422f9f7606c932ab593db97747d7666948d04aacee1ceb6ae2fb205f32d953d94e5f2c7cb332eefa4bf11c999fb67e287960b64c36fa37de3c81fe53e057abc6f5575cb900a117242340126f721f8ad4c3d744440f2d9e1abf71fb24ca6f5abd392ce1110d4d138cd312373f99eef5a9b55a2a92a73be76860c380e5f2f1c9e5526ab5dc6f91d81d086dcfb70165c69b9bba0670366910ed053d43a61bc8215e95f304d73d38a689f174ac4940f1c7c87a011fbaa364e54887a0f38281509282943c38c77f9dbf385d0f8f62d30b300ae7ce24eb5b855057fc4fc8efcb05c4451fbc4de6f8b545559fb2bd2f8200eaa2822990d4afa0398e4c4d40534ece023306239bd86e2a0b9ae2fbfa640046379c1e2f0471e0005bdbd929119e54808f53fbc9ae318fd128aecaee2e314efcd76085a1da95b1261a321fe8229434dcc57844f15914221116d53faef06466643b996d5802167c0dcabe44979e576b4290aceee7aa771820fe113b85162e45961dea78ba31e0c54faa89ef75263d15580dd144745ab42b5d510f1beb115832df59ce57be19113f97aa21d984448e7fbc92c1291fd84f98e9ddd832336be330528e9df7b88f17f47708dfa401ba49562ef3650155bca61a81348896c151d05651caf865a3c40dbaecde5036233dd42a23f5712c93b2fa1c3ab754445bd258491fcf508ac344eeb38db1a4cb9980b1d97b826d76b0b10f8b8937dd0a9385c66ffffdab1819049c35aaf90b15267f7c58ff236c425414286bc7dfc3bd22abea8aeaeb113592ed41fa566d1426c85c3db9ef04e70b31ea52ae2f9352ae1195035b517f7e36350906773fabaef38fb29348b9797ec90cce08e0afb923fcfe0fe62ed2abd97d39949993048ae10c5be54808986f6c4aa437e413b449f57b0b0fc6f393808631fac191af623b8e90193ef2b0dda64f26b4771ab256bccd61ebf4b7ad099156986d64e77d37039d4a2e5836528a10c8c9d9ca9c640804dbf2db4154384cd8a8c02ce863e102ea944c17a643c120361d631b7f349f920ae6bd06db3e3af1bf902c3204e8632d27bd928701ee206a7d64448f9a81265a17a31878e3c1a2a044fc6f956b557471d1bf7dfe160716028191e851e18439f4e3561aa589528889090a3b673f70aebc1edb12861277f04f300acd8278e5f640ac0dc7e4f8df3ea39186119b0599f3e7bedfa0ee65e4d25d8586a2d10e773182d98ea9eef3b3d9805697adce7daf083b8a934c0d9c6467be25a6a22b6b246abcb355d03b8c3345dff9f40e253ae80a2de668dd9da044a2b90bc5788b0fe3a2c6387b3c817ea456eb7713a728caf4287d15006500435ff93eb6803e42e57c087c483e23605d9dcd6f758883fbb990eb0f91f351191956ac451e1c1d1ae113c03311057f5e70d8231bef8edb7c2cbecc4ab3e46b02945afbcdb2e8b005819dd141055af1fd6a3240af08751cd3a78ff92e39bba4d3c23aef960646512b3b86d6a8fa6880cfce6d58e1fbe734ac5f9b7018451a7a5879b3767dfb359eee615bab65116237e5de5b96bf9fbacd11702c73a8e478a64895d15ac0110737c3ab91222bc4c87326b5d5e3cf089da0a76d43222a8eeeb5286a4cb2fced98ebc2f6e876e8ff48b6f8f8264e52cf5b38906d657bd8d0d91e2d7846224ac60526f878e8189d80957a73a0fb95223842fb819286234d742c0aee14c75ed069411f7631aaa3e2a011fe75e67131a51733b9d2dc7981935d559a08a965363cdbc02dbadfcc4435040cff61df0cea2dcc5017deab9076fcc1a11ebe5020b6c96a16425397df15881815cf60b942648c234a5614ecffd4d5de50884934bdbd5177d24ee76f0c97fd0a2b97e527fa86c73ec672398f1d88c03d467f2712908d8fff5e02b4e1fe2d7bff02205597b3a5360e2767a3d7c488d222a3ea39d3fec61423e349689297868a4bfcf08a0938729fbc819ca2181f03f4ea42c7892dccd76560f1ef812ba7380681a8943e7bf2d6bb0729002a33a4a595c411cec870e8757e5d9cddb17563a627e598bd170cb6eab4d0d8a02c926bd0d67d2084df5873591ba8da1309f9c309fcdb1e1afea2ed48b467170f9d2539e62e75ed1e9ad94e2f574bba5e25f7473534e82e91263cef442f31e9e568a3eafa2b9de2a99fa681c6f6f245db26c24d56ae77fe239c63a70c2edd113f0d48bf5c2a887e1512bfb2801a0c628d3b91f57b1d1401b0e5e6012d32dafacd08775b1b28f15c44b03cd340a4e45be0534c4f5099c5bda5ef0035ab7d1ddbdb2e73ad49e15f6a04b5b09280581ebe2ce940a8058e2d14a0556c14adce8a40b6f0f78cc6bf46f0d0b2c4f9ce79e60eadd828eec8fd5c6b1196f685add24c959d4f1c9cbf7d21fb010df2f26fd1f1a5186186de0ab6f7fbf7ac2406a815382aad4edde90c8aa08ce053e86777fcbb089b4cbeb596949ff04739b53c4262b84881814c1cee97eb9147854b54ea354d53d906869c21e5772be517c127a0feb3844acb8b721f060e065b096d5f390b3557e25d50bb887ac018564a9b3ca3fe38eec76dace59bcadb81ed3764c177766ffc8770b7eca1fd3c87f3fc84f157974dc6356ab41388d973ae0a5a4a1d3d08f207b4add5bb902034f0be23bd27010cf5fb3a8ce4c34b123be47bf50fb6ff1593602e720d893561f72fcabdf7141ea4a274d319e9157ee4deb55dd412296525a1d82726fc8e8ad1ebddd6f7ac4ac10d3f59473cf5b0ae0644db9224268415ad314e4a7f4e4a17be80425198c097287ef95948ef260eb02d59e235caabeb1bcbf8829240e5637358879016ea8b5b06337d58aab36bc1a981d7667974068ca1a353a8caad2885236f407fcfc277210ff15f4d7d0caa2b31e5f745f455ff36a5fd9a9036c02f319a049ecb1d67c057130ae3d68374c82191059b44f8aebdf4574cd84cf7c031b6e177e8f5808f25ac76df8d7f9aada99e1a16ea5b22cc4bb349a352aceb2cb1ea47710704d446498f4d6ff2d8705797cfe62e03de9064a5831df451d021fcd93a71c3105f81df9d1ce5dc27d26d77326ab4bedf0c428a70772f2b0630b0640f643292e68e9b44d53f5c401f6ee09f8217b77b2d308e13cbedefa56920ad948b464a74c3e9ca9259d10132880d7dbd2c972c772985f7022a41ef473c254289982b9cde41f937a1de59b9a50caf728accac23ba485842dae35ad4ed412a31d2a134bf05ede9fc70fab45fee38f1f7e749e803446b418cc1b5e7f2019777ae03eab5e129e1eef2195ca84cde2848df14a93bbc3a917f1e06ce3753cf127f2241295fb630f6e27eadeaff570f955ace44dd204dcc082f7bcbe310e2c33267852049cb839142d072e3f3ebb1fc289c78769fd0f05578630e42a5829b82c6d535c012204aa74659282ba0498156e2183ecee174054d45fd97e5a0159255d8af432563d367f045d209c67cc70f7cf13b9a6578983ea640f0e8e66113484f48d41cb65b1338eb6cec534b3acdf9e5a1a3ac9157d75986583edfda4958e79593b6808b4762f823a6f442ee1749e592bc103f2b9e16107b939ece49cb447e5a7d34d66f18567d0e981f4fef25a467144689662783503a03e1800d22f40f61903d8270453161a68386bdd94d59dd66eb5ae067d4129be23a0b17b89d0478734460bb88c5771d9444caa769aa62d56bd128bc328e03d2e18d966f5784398ca2aab86007f7ca00908d4bd7f2f3ecf3024110b073304c7bb17bd73725721a99e94c8d5e5da7a839d58f2196cace99b98d7f584a49fee2a426e6ec3f08e520f7965aa2dad97084c2ebed43c58dbc9116f420d4735decc47dea514b689f5479c56b6128dd684c4fbf0945aa15363276af833b27b82cb48541413bc9fc51f9ce57c14bb6c39f86cbc99b69e5d91e7cf72f340f67012eb2f5fb21d830e97eb3664674ecc36c754f90d1a8f6092fe3a48827849ec95ed35887cfd2ab3f26331bdc154ad034f31ef26ecec5feedac1367f4f642e99ebb409ddd5dd8d0087ebf048e4924a2119c69ff00af79233443b897f7bd1d80f4d34555719bd8dd9c0d824d0437c2adfc598fd4c2c2d8cf7693e05238987bdb9bb04751dfcd44fbced899a7dadef499b9bfb45ee52ea59369c950821a667712946c7207e36473660f3f9c9906ed889ffe7a8c735e98d41cc96aecf3e577072cb4711eb690d28ff41dbe9070cd73da26875994a7b8480f2d21bd4b92402bc293fea154071c401581a9b858dcb4113149105d793fd4d0e98894f228f24250ada364f49180fbd116e0677cbfbe928a840dbfab2791865cec67ab39affa7b76c266285ed2ede7ce77e9e6f21545b8d177cc73e5142e6bbfbb3e9793716de8d6faeb74e18475cac7541e3ccd875cc0dc8bd5a01e468700d5817fc44b6dd64d74dbe0b351c80815102a0dc2038c83dc75189bb4ca425eabeeaa70fcebfda8f16c4b083762811325fdc6b94f84b6d4629929b85d0cf678b28651cab8a825f28440ca4e7a2193c6f9c769b0aa226754fa8eabd7cd1d31ea2478a83e0d79eaff6f72bfb05c31098f4640256b8c21ef25808821c08cbc68e8b6205fdbcb10b17d63cfb5ead7fb8ae1", 0x2000, &(0x7f0000002cc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BLKSSZGET(r4, 0x1268, &(0x7f0000000300)) syz_usb_connect$hid(0x1, 0x36, &(0x7f00000002c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x44f, 0xb654, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x9, 0x20, 0xd4, [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x1, 0x2, 0x1, {0x9, 0x21, 0x400, 0x6, 0x1, {0x22, 0xc63}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0xff, 0x8, 0x6}}}}}]}}]}}, &(0x7f00000006c0)={0x0, 0x0, 0xf, &(0x7f0000000500)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x8, 0xe, 0x0, 0x3}]}, 0x3, [{0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]}) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46", 0xb5}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 4.540443823s ago: executing program 3 (id=4226): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x2102, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0xa440) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TIOCL_BLANKSCREEN(r0, 0x541c, &(0x7f0000000640)) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000300)={0xb, @sdr={0x34565559, 0x2}}) sendto(0xffffffffffffffff, &(0x7f0000000100)="51bf7336f6cdf0ca6c13c866d6bc7b55f2d501845841bb2c078a988b7eb38f11a326083cf884920013fbae4a3a5d9c8ea7ea86669fb6212da0b5c82136d9519daeb17c9f96ad78cccef50ab4eabcafbc1a18735359cd7329816984d180735476f901401079349dfbe2e614f51a07c00544d90a594972ba60e1b497f88dcdc1e45dd28c0678d803638e7bd70a8638136e52c5e932c4111d3c917fb22583198b00707e3a2e001260cbc206759c245451686164eff751e4df8995", 0xb9, 0x20000000, &(0x7f0000000280)=@l2tp={0x2, 0x0, @broadcast, 0x2}, 0x80) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r4, &(0x7f0000000000)={0x1d, r5}, 0x10) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r4, &(0x7f0000000080), 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 4.321634035s ago: executing program 1 (id=4227): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000f40)=[{{0x0, 0x0, &(0x7f0000000500)=[{0x0}, {0x0}, {&(0x7f0000000900)='^', 0x1}], 0x3}}], 0x1, 0x4004) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x635c, 0x1f480, 0x0, 0x399}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 4.082902403s ago: executing program 2 (id=4228): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) shutdown(r1, 0x1) sendmsg$NL80211_CMD_DEL_KEY(r1, &(0x7f0000000480)={&(0x7f0000000300), 0xc, &(0x7f0000000440)={0x0}}, 0x20004804) 3.952712583s ago: executing program 0 (id=4229): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000015000100000000694f0000000a"], 0x14}}, 0x0) socket$nl_audit(0x10, 0x3, 0x9) socket(0x1e, 0x1, 0x0) pipe(&(0x7f00000045c0)) socket$inet(0x2, 0x3, 0x7f) r1 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f00000003c0)=""/4096, 0x1000}], 0x1) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00', @ANYRES32=r1], 0x28}}, 0x802) 3.840387016s ago: executing program 2 (id=4230): r0 = socket$inet_tcp(0x2, 0x1, 0x0) inotify_init() setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10) shutdown(r0, 0x1) recvfrom(r0, 0x0, 0x0, 0x2, 0x0, 0x0) 3.794696271s ago: executing program 2 (id=4231): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002540)={0x6, 0x1a, &(0x7f0000002200)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xbb03}, {}, {}, [@ldst={0x0, 0x0, 0x2, 0xb, 0x6, 0x0, 0xfffffffffffffff0}, @cb_func={0x18, 0x4, 0x4, 0x0, 0xfffffffffffffffa}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0xc, 0x0, 0x0, 0x0, 0x1e}, @map_fd={0x18, 0x0, 0x1, 0x0, 0x1}, @map_idx={0x18, 0x6, 0x5, 0x0, 0xe}, @map_val={0x18, 0x99a792d83e8a0440, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000002300)='GPL\x00', 0xc13, 0xf5, &(0x7f0000002340)=""/245, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000002480)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1], &(0x7f00000024c0)=[{0x1, 0x4, 0xa, 0x5}, {0x4, 0x3, 0xe, 0xc}, {0x5, 0x5, 0x0, 0x4}, {0x2, 0x2, 0xc, 0x8}, {0x0, 0x5, 0xf, 0xb}], 0x10, 0x10000}, 0x94) syz_open_dev$loop(&(0x7f0000002600), 0x0, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x102) write$cgroup_int(r1, &(0x7f00000000c0)=0x10001, 0x12) 3.620450379s ago: executing program 2 (id=4232): request_key(0x0, &(0x7f0000000300)={'syz', 0x1}, 0x0, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) syz_usb_connect(0x5, 0x255, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000670250404020014964680102030109024302010000000009042100021085d80009050402ff0300000007250180000500872266"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) getitimer(0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xb}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x44}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) utimes(0x0, &(0x7f0000000280)={{}, {0x0, 0xea60}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000002c0)={{0xd000, 0xeeef0000, 0xe, 0x0, 0x81, 0x4, 0xa, 0x4e, 0x0, 0x7, 0x6, 0x1}, {0x5000, 0xffff1000, 0x3, 0x5, 0x2, 0x8, 0xd, 0x3, 0x0, 0x81, 0x8, 0x1}, {0x5000, 0x0, 0x0, 0x7, 0x3, 0x1, 0x7, 0xf, 0x8, 0x6, 0x2}, {0xffff1000, 0xd5dd0000, 0xe, 0x2, 0x1, 0x3, 0x10, 0x0, 0x1, 0x6, 0x4, 0x9}, {0x100002, 0xeeee8000, 0x9, 0x0, 0x80, 0xee, 0x0, 0x7, 0x7c, 0x0, 0xe, 0x9}, {0x3000, 0x4, 0x8, 0x1, 0x5, 0x4, 0x1, 0x1, 0x6, 0x86, 0xb, 0x2}, {0xeeee8000, 0xeeee0000, 0xc, 0x7, 0x7, 0x3, 0x1d, 0x47, 0x30, 0x2, 0x8, 0xe1}, {0xf000, 0x2, 0xc, 0xf8, 0xfd, 0xa, 0x2, 0x4, 0x3, 0x8, 0x5, 0xce}, {0x4, 0x7}, {0x6000, 0x5}, 0x80000035, 0x0, 0x0, 0x40, 0x7, 0x1000, 0xeeef0000, [0x5, 0x8001, 0x8]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e60, 0x0, @mcast2, 0xd}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="82", 0x1}, {&(0x7f0000000280)="ca", 0x1}], 0x2}}], 0x1, 0x4400c800) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000140)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c00000010000907327f7c6919f500000000000056c4177c1034a53cd296bb4a62dc831764435dc22cce09466a2649c5b6e8a1e295f54dcf210f00da94b3067310384d513803716c279570ab2cece6fbe830f61c2243b23be4ce95b46d8e8cc5401e6273e8d57b97001d7ca95f378acb2b95fd718a7459bc14bc2122e436350e55a850d1673605bb58dacad3f62069f91850a4eef77c807a423a3448f50d94cb414ba42da44767ea117ce4ab36d235ccad7f4653c38c13512acfffba7b7a04546f4c6ce750e83beeb1311f559217a57afea02b6d3c3824fa552c47cfaee788c6ff7b4aa6b847b26ea956d7dae5acf93f7648909a72ad980a63b73fe45d7324", @ANYRES32=r6, @ANYBLOB="00000000000001001c0012800b00010069703667726500000c0005800600030003000000"], 0x3c}}, 0x0) sendto$inet6(r0, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) mmap$xdp(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2000007, 0x10010, 0xffffffffffffffff, 0x180000000) 3.32593311s ago: executing program 3 (id=4233): ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) r3 = dup(r2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r6) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x3a9e9908}) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r7, &(0x7f0000000780)=ANY=[@ANYRES8=r3, @ANYRES16=r4, @ANYRES8=r0, @ANYRES32=r1], 0x2c2) r8 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000200), 0x4) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_GET_ENDIAN(0x13, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r11, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r10, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x40) r12 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r12, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) 3.121817938s ago: executing program 1 (id=4234): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000c40)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) (async) r1 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000c40)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000080)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, &(0x7f0000000080)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000880)={0x34, &(0x7f00000006c0)={0x40, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000880)={0x34, &(0x7f00000006c0)={0x40, 0x9}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) (async) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f00000007c0)={0x84, &(0x7f0000000c40)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) (async) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000440)='\x00', 0x1) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWCHAIN={0x50, 0x3, 0xa, 0x76a9bba1a690db0f, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3cb140bb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_COUNTERS={0x10, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1ff}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x0) creat(&(0x7f0000000080)='./bus\x00', 0x0) (async) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000180)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) fsetxattr$system_posix_acl(r3, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f0000000400)={{}, {0x10}, [{0x2, 0x2, r4}], {0x4, 0x1}, [{0x8, 0x4, r5}, {0x8, 0x2, r5}, {0x8, 0x4, r5}, {0x8, 0x0, r5}, {0x8, 0x0, r5}]}, 0x54, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000380)='net/udplite6\x00') read$FUSE(r6, &(0x7f00000028c0)={0x2020}, 0x2020) syz_kvm_setup_cpu$x86(r3, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, &(0x7f0000000000)="0ff63bbaf80c66b82d66cd8466efbafc0cb00cee66b9800000c00f326635000800000f30440f20c066350e000000440f22c0660f383dea0f039300000fc73766b8200000000f23d00f21f866353000000c0f23f866b9800000c00f326635004000000f3066b8008000000f23d80f21f86635400000d00f23f8", 0x79}], 0x1, 0x48, &(0x7f0000000140), 0x0) 2.430155247s ago: executing program 4 (id=4235): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) (async, rerun: 64) r1 = socket$inet6(0xa, 0x3, 0x5) (rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) (async, rerun: 64) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 64) sendmsg$nl_xfrm(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001a40)=ANY=[@ANYBLOB="5801000010000100030000000000000000000000000000ac1414bb0000000000000000000000000000000000000000000000001600"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc0100000000000000000000000000000400000033000000ac1414bb00000000000000000000000000000000000000000000000000000000030000000000000004000000000000005700000000000000fdffffffffffffff000000000000010000000000000000007b00000000000000000080000000000000200000000000000000000000000000000000005cfd00000000000000000000000000000a000000aa0000000000000048000100686d616328736861312900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200017"], 0x158}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000002000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000003000000", 0xfe60) r6 = socket$inet6(0xa, 0x1, 0x0) (async, rerun: 32) r7 = socket$key(0xf, 0x3, 0x2) (async, rerun: 32) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) read$dsp(0xffffffffffffffff, &(0x7f0000000140)=""/21, 0x15) (async) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[], 0xa0}}, 0x0) (async, rerun: 32) socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$key(r7, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) (async, rerun: 32) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) (async, rerun: 32) syz_open_dev$dri(0x0, 0x666d, 0x6d1103) (async) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x80800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r9, 0xc04064a0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r9, 0xc05064a7, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)=[0x0], &(0x7f0000000340), 0x0, 0x1, 0x0, 0x0, r10}) socket$key(0xf, 0x3, 0x2) (async) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f00000013c0)=@raw={'raw\x00', 0x8, 0x3, 0x12e0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x12a0, 0xffffffff, 0xffffffff, 0x12a0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0x0, 0x62], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {0xff}, {0xff}, 0x0, 0xfd, 0x0, 0x13}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x7fff, 0x30, 0x1}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [0x0, 0x0, 0xff000000], [], 'wg1\x00', 'ip6gretap0\x00', {}, {}, 0x3b, 0x0, 0x0, 0x3}, 0x0, 0x1100, 0x1140, 0x0, {}, [@common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x0, 0x2, './cgroup.cpu/syz0\x00', 0x2, {0x8}}}, @inet=@rpfilter={{0x28}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x54, 0xffff42f2, 0x5, 0x5ee, 0x8, 0x1c, 0x8001, 0x7]}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x1340) (async) syz_usb_connect(0x5, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000202cd77100304ceb8bb30010203010902120001de0000080904000000d076d80eee47531c7b9a5bbdea316a4a9daf93ab5ac978d8d4f1ec208cf8140f35c0ec507344de370cb86b9227f17bdc3605820e871640cd066532f6afcc0f6d84f9178804cdb584754152beb99be572"], 0x0) 2.341198589s ago: executing program 3 (id=4236): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000180)=0x84000000) creat(0x0, 0xd931d3864d39ddd8) openat$ppp(0xffffffffffffff9c, 0x0, 0xc8902, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket(0xa, 0x5, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x620, 0x2c8, 0x1d0, 0x468, 0x468, 0x1d0, 0x550, 0x550, 0x550, 0x550, 0x550, 0x6, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [0xffffff00, 0x0, 0x0, 0x1f9814788dbf7ab2], 'veth1\x00', 'syz_tun\x00'}, 0x11e, 0xa8, 0x1d0, 0x1f000000, {0x0, 0x7}}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'unconfined\x00'}}}, {{@ipv6={@loopback, @dev, [], [], 'batadv_slave_0\x00', 'macvlan1\x00', {}, {}, 0x2b}, 0x0, 0xd0, 0xf8, 0x7400, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00', 0x0, {0x68}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x1, @ipv6=@mcast2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x680) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) syz_open_procfs(0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000680), 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x0, 0x0}) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)='net/fib_triestat\x00') r4 = fsopen(&(0x7f0000000240)='hugetlbfs\x00', 0x1) r5 = socket$rds(0x15, 0x5, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2035) bind$rds(r5, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r5, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @private=0xa010100}, 0x10, 0x0, 0x0, &(0x7f0000000c40)=[@cswp={0x58, 0x114, 0x7, {{0x6, 0xfffffff7}, 0x0, 0x0, 0x8, 0x1, 0x72b, 0x4, 0x9, 0x3}}], 0x58, 0xffffffff}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x69) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r7, 0x0, 0x48c, 0x0, 0x0) r8 = socket$inet6_sctp(0xa, 0x7, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) 2.188393217s ago: executing program 4 (id=4237): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1ff) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) sendfile(r3, r4, 0x0, 0x20fffe82) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) writev(r4, &(0x7f0000001200)=[{&(0x7f0000001140)="08a3c8f542ccae37ee381116dbd79fa7ed80c1b250b5d638a89a49ec9ec1cd8f8fb24701819a26766c48a9bf9b38e284ac680bb4bddfad977175eef215d1fae3a21ce67271c4bc3a3e9f03158ac0f74f52bacf3a333b2055f62a5af94aff45cff341586eeaf42afae292adfc2da16752d6d4ebaa6b7d997b3d74bc9edaa9aee4465dfcef8ce80d1be7aaf719b934b9983b7437ab816d09d68763b7fa09e4f8ba0446a13203f73442f2787c09d8e674e9e9b1e650bc3be5ba03c4dd7d1d78", 0xbe}], 0x1) syz_emit_ethernet(0x4e, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "081200", 0x18, 0x2b, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @local, {[@srh={0x3a, 0x0, 0x2}], {0x0, 0x0, 0x10, 0x0, @gue={{0x2, 0x0, 0x0, 0x0, 0x100}}}}}}}}, 0x0) syz_usb_connect(0x5, 0x559, &(0x7f00000008c0)={{0x12, 0x1, 0x201, 0x32, 0xcd, 0x10, 0xff, 0x19d2, 0x12, 0x6be9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x547, 0x2, 0xf0, 0x1e, 0x40, 0xbd, [{{0x9, 0x4, 0xb8, 0xfc, 0x10, 0xff, 0xff, 0xff, 0xd, [@uac_control={{0xa, 0x24, 0x1, 0x8, 0x8}, [@extension_unit={0x9, 0x24, 0x8, 0x4, 0x101, 0x9, "e8d9"}, @processing_unit={0xd, 0x24, 0x7, 0x6, 0x1, 0x0, "12ecd3c62919"}, @mixer_unit={0x7, 0x24, 0x4, 0x4, 0xf7, '?%'}]}, @generic={0xc4, 0x23, "98e5e1a46abecdd43d1fdd36c51e971542812748a48a49d1e7f2a6c54c2e90dd9edf00b8a12686f5bb38e3a67787f1c8e77ca4dd8d3ad97f0dcdddc7cd8a18000957d9c46cd1fa8c01aa7930c0872a22cd97a712acf9385581db9335b75167f3d940e44898063f3ffd59a4b163ef875b8e837f8808109ed0747b86f4dc4db36d74f5a7f03955805751ab5a41c614d5600a1afd268febebfdb246a7bc884757a51b2b92869e2729f190dfcf3655ba562dd12c86724e0660ca6203b19ab678d9382ed7"}], [{{0x9, 0x5, 0x8, 0x1, 0x3ff, 0x1, 0x9, 0xee, [@generic={0x14, 0xd, "11a14b4db6c72f908aa7340c43c986c49d55"}, @generic={0x71, 0x1, "837d30e98bc944ab298a2c413ce8a13e08e2294ef137164c2aef20226cc29d432468780632b3495903ca1bec2af3ce5585d4f4aa3abda52599d5154d08d178cbbde648caa90f1d0973ad0c3e1ba57b0fc89570432529b5988da384e881099ae8e77ae73e0b36792d07a7e5a7e1ac77"}]}}, {{0x9, 0x5, 0x80, 0xc, 0x40, 0x7, 0x5, 0xc1, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x4, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x1, 0x8}]}}, {{0x9, 0x5, 0xb, 0x10, 0x10, 0xd1, 0x9, 0x3}}, {{0x9, 0x5, 0xf, 0xc, 0x8, 0x9, 0x4}}, {{0x9, 0x5, 0xa, 0x10, 0x20, 0x2, 0x5, 0x18}}, {{0x9, 0x5, 0xa, 0x2, 0x10, 0x5, 0xc, 0x1}}, {{0x9, 0x5, 0xa, 0x1, 0x3ff, 0x0, 0x2, 0x70, [@generic={0x78, 0x4, "e2866349e405b44e79ea484caecf24ac312694e4bace6d8d0458640a0ba586e55f83d2fed633c98479778f08a34e8295bb24fb348e32e09d7b2c08687c380836048fc817f84b52b1f9a4625e733fad2a13ce1705a6ebc739ea330fc0726e975f993253ce42ecf114c822b4c0c2a5da77717679df16a9"}]}}, {{0x9, 0x5, 0x5, 0x14, 0x10, 0x4, 0xe7, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x0, 0xf}]}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0xcf, 0x81, 0xfd, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x1, 0x7d1}, @generic={0x2, 0xf}]}}, {{0x9, 0x5, 0x7, 0x0, 0x400, 0x1, 0x80, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xfc, 0x7}, @generic={0x80, 0xf, "f3794166e77fe1ccef50b270e922832b3e4ad227a8a833e424e6481a2ef5288d5f6ec8474b15f0aa5b8ce5ded86bd7bbd938b84415d690fdc7310e00f9fca13102730596ff39e0b7e8cec841d99c4d9dc72aa1e1d4f72bde5c1eae3d0b2dec4f7d68828fc0f46fcd217f4fe47d0170739a688d910dbe1d587309a7f3021c"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x8, 0x0, 0x2, 0x4, [@generic={0x14, 0x4, "d46e6cbded3d75fddd0fe8ff29673869ade7"}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x9, 0x81}]}}, {{0x9, 0x5, 0x3, 0x10, 0x8, 0x0, 0x40, 0x0, [@generic={0x62, 0x22, "2b7733ae2367f39036af54be4185f26fd2fd356f24a6269ea0736220908190ad99d6b6a72b0aaca03bd3188c42705682b989a78f5dd14fe9868a87b65015c7db88e2f225949dd5c27c9e65751363d6be5455b544fbc95f27168478d78b50670b"}, @generic={0x84, 0x5, "184f0f1b42db8c35d6764ddd6eacf591eb083c98989638bab1b61429be81e0a4a18d5c7cdc3c43924f9e16a4d635e1b2dd2da95707d6c55c07d2b17385ed1cebcd5d2270c5533d322088411f939055d5fbf45f5d6cb7cdb90a80fea10af50783581861be1dcbaf639ceb6d495f8863f2de0a2a765b6ddbe43c12c5073eb717945f9c"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x8, 0x2, 0xf3, 0x15}}, {{0x9, 0x5, 0xe, 0x12, 0x400, 0x3, 0x2, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x8, 0x4}]}}, {{0x9, 0x5, 0x80, 0x1, 0x3ff, 0x6, 0xe, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x3}]}}, {{0x9, 0x5, 0x3, 0x3, 0x400, 0x10, 0x3, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x877a}]}}]}}, {{0x9, 0x4, 0xc2, 0x0, 0x0, 0xe3, 0x20, 0x4, 0x7, [@cdc_ncm={{0x7, 0x24, 0x6, 0x0, 0x1, "67e1"}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x2, 0xfffd, 0x0, 0x1}, {0x6, 0x24, 0x1a, 0xf558}, [@mdlm={0x15, 0x24, 0x12, 0x9}, @mbim_extended={0x8, 0x24, 0x1c, 0x7, 0x80, 0x1}, @mdlm={0x15, 0x24, 0x12, 0x9}, @acm={0x4}, @mbim_extended={0x8, 0x24, 0x1c, 0x9, 0x3, 0x1000}]}, @generic={0x9d, 0xc, "db2f2fe21ebda48a6483b2ace09d6c86671cff11949c6c8a75a5f8f6cd9bbf5b0ded9473cdb39fd581155c01d482ddf2b05bb0c306900d861b07b36fdc51f8f9889b60034797968d68f9f4f4319aa3677ceb9a9a1ce43184fd8f5f4ff323003e14349b25d27a55673b9cd6fd3cabf9a119a026902ca65cace485bb4646735469f07372fb14112a594482fd8124e81154e3ec3b2b26302f00f17219"}]}}]}}]}}, &(0x7f0000000540)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x200, 0x35, 0x6, 0x2, 0x20, 0xec}, 0x2d, &(0x7f00000003c0)={0x5, 0xf, 0x2d, 0x3, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x6, 0xe0, 0xfa, 0x7}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x12, 0x4, 0x4, 0x1}, @ss_container_id={0x14, 0x10, 0x4, 0x1, "b0226c29089a404900597b0b6ab76ae1"}]}, 0x5, [{0xee, &(0x7f0000000f40)=@string={0xee, 0x3, "7289cb171937fca4153c62e162f74ad55f78662720dccdd44ebb1ddd19ac7b4d0557327a03973abf6f5c00aaf91e784c464d48379feaf83180527faf47dd1e472217ec6d31f6559298cf93b6077beaa8e3587516d2999888089cd0ce55f028d1774a59fcf6b69d88afeba7fbeef0d62eafa84b63007c2ade839fdef0c28270a56f3511450333c8f06698b38bed649d67336e37105061fc2a51a28057c528f77dea4b2a4504b9c13f902c93a1643d1a0828b8cecdd1779b2c8ccd00325124cc7db392af83db4e95c730368d37fc65d517f6a25f0faa810e1e0c00d75df5854e257ef44a84f6b8a475a1ad43de"}}, {0xed, &(0x7f0000001040)=@string={0xed, 0x3, "8a15f0b7b33dac5bd76924f9ca26e1bd6fc5a852835df3a27319dd547eb9612459012f7f17d4d5b7280becd720d325048e5b85e4c56632570067fd7a8532e26a0569c7166f22af656853ce46b87a853adac015ea3fc07947dc54533225cfcea3d2daf3fe3e7c71994b3f700700747343445cbcae68260181fc900268f857a5bd12e576e1283b9a180f3b9a1fef2eea634acd1edd55e3657b599c1a9bbc24894695c63eec5fdfad7522def9ff41cd8ddba6694c227abb41ac4e23a540d77cda692677507533b9b3b1a99f38d3314ed3f1360a0a5ab4979fef61187136ee4328097e44e20781cdffc18a40df"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x43f}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x820}}]}) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000300000a50000000060a010400000000000000000a0000010900010073797a310000000024000480200001800700010063740000140002800800024000000013080001400000000a0900020073797a3200000000140000001100010000000000000000000200000a00000000000000"], 0x78}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000780)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000005000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffef023cabb31284280485683cc48feeffffff000000000000000000000000000000000000000000000000000a000000000000000000000080400000000000000000080000000000000000000000000000000044000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff00000000000000000000000000000000000300"/195], 0xfc}}, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="b00100002100010000000000fefffffffc020000000000000000000000000000fc020000000000000000000000000001fffc0000000000000a00e08000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="020000000000000034011100fe80000000000000000000000000001100000000000000000000000000000000ac1414aa000000000000000000000000fe8000000000000000000000000000bb3c000000000000000a000a00fc020000000000000000000000000001e0000002000000000000000000000000fe880000000000000000000000000101200100000000000000000000000000022b030000043500000a0002000a010102000000000000000000000000fc000000000000000000000000000000fe8000000000000000000000000000bbffffffff0000000000000000000000006c010000000000000a000a00ac1414aa000000000000000000000000fc010000000000000000000000000001fe8000000000000000000000000000aa200100000000000000000000000000016c0200000735000000000a002c001300fc010000000000000000000000000000fe8800000000000000000000000001010000000002000000"], 0x1b0}, 0x1, 0x0, 0x0, 0x800}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) 1.139094568s ago: executing program 3 (id=4238): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x101042, 0x14) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) write$UHID_INPUT(r4, &(0x7f0000002100)={0x18, {"a2e3ad2119c752f91b5e09091bf70e0dd038e7ff7fc6e5539b324d078b089b3b0838721a0890e0878f0e1ac6e7049b3d63959b509a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31320d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70d998ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f0000000c558cdc0a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5af098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000108000e0a37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b2fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d3a6df40babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f794c9eee1198751adaa13d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f39a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60559516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d8872fe174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f980000000203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) r5 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x34, 0x70, 0x9d, 0x40, 0x55f, 0xc230, 0xb6ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf2, 0xa7, 0xcc}}]}}]}}, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000ac0)={0x0, 0x9, 0x1, "af"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r5, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000005c0)={0x20, 0x15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r5, 0x0, &(0x7f0000000000)={0x44, &(0x7f0000000640)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, &(0x7f00000003c0)={0x34, &(0x7f0000001800)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000380)={0x40, 0xc}, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000027c00000400c2800c000180060006008848"], 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) 812.265212ms ago: executing program 0 (id=4239): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e60, 0x0, @mcast2, 0xd}, 0x1c) sendto$inet6(r0, &(0x7f0000000180)="8394848cb0464de2053ca49a101754a9f274f98d8d3ce72a", 0x18, 0x0, 0x0, 0x0) 666.040979ms ago: executing program 0 (id=4240): r0 = syz_usb_connect$printer(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12011001000000402505a8a440000102030109021b000101ff8008000000fd01070101385e2f505546d8ca9872"], 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000380)={0x14, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) write$char_usb(r1, &(0x7f0000006800)="10", 0x1) timer_create(0x7, &(0x7f0000000080)={0x0, 0x111, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 520.497255ms ago: executing program 2 (id=4241): socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x4c27e, 0x2) socket$inet6_udp(0xa, 0x2, 0x0) pipe(&(0x7f00000007c0)) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) dup(r2) dup(r2) memfd_create(&(0x7f0000000100)='\x91\x7f\x00$\x00\x00\x00\x00\x00\xb8\xc9\x84*\xc0\xfeR\x01\x95\xceSc(\xa0\v\xde\x1b\xc4\xda\xb8q\xa2\xff\x15\xa59\x0e\xdf\xed\x00l\xba\x18\x13\x833_\xb8\xc9\xf3C\x88u5\x94\x95\x00yh\x9cE\xd0$)\x8eT\x8e\xe5\x00H\xab\x0e\x01!\x19^\xd8Z\t\x00\xef\xea:\x8c\x19\x833\x15\xc0\xcd\xa8', 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r1, 0x40045402, &(0x7f0000000240)) socket(0x10, 0x803, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(r0, 0x1, 0x53, &(0x7f0000000180)={0x7, 0x7, 0xffffffffffffffff}, &(0x7f0000000200)=0x28) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 487.73694ms ago: executing program 3 (id=4242): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x40, 0x37, 0xfc, 0x800}, {0x28, 0x3, 0xf7, 0xfffff038}, {0x6, 0x6, 0x0, 0x1057c}]}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x1, 0x0, @loopback, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x303, 0x3a}, "c4d65ab71f5ef2fe", "9e8ecc7bb5352776725e104757e7dc25c6519a85efb17b5508000018bb00", "0900b43f"}, 0x38) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x141a82, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x900, 0x12) ioctl$TUNSETNOCSUM(r3, 0x400454c8, 0x0) socket$tipc(0x1e, 0x5, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r4, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x7ffff000}], 0x1, 0x0) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x0, 0x2) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)={0x34, r7, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r8}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x912}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0xd}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}]]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) write$binfmt_aout(r0, &(0x7f0000000000)=ANY=[], 0xa052) 429.7331ms ago: executing program 2 (id=4243): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000001c0), 0x2102, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0xa440) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TIOCL_BLANKSCREEN(r0, 0x541c, &(0x7f0000000640)) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000300)={0xb, @sdr={0x34565559, 0x2}}) sendto(0xffffffffffffffff, &(0x7f0000000100)="51bf7336f6cdf0ca6c13c866d6bc7b55f2d501845841bb2c078a988b7eb38f11a326083cf884920013fbae4a3a5d9c8ea7ea86669fb6212da0b5c82136d9519daeb17c9f96ad78cccef50ab4eabcafbc1a18735359cd7329816984d180735476f901401079349dfbe2e614f51a07c00544d90a594972ba60e1b497f88dcdc1e45dd28c0678d803638e7bd70a8638136e52c5e932c4111d3c917fb22583198b00707e3a2e001260cbc206759c245451686164eff751e4df8995", 0xb9, 0x20000000, &(0x7f0000000280)=@l2tp={0x2, 0x0, @broadcast, 0x2}, 0x80) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r4, &(0x7f0000000000)={0x1d, r5}, 0x10) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r4, &(0x7f0000000080), 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 0s ago: executing program 1 (id=4244): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x549c, &(0x7f0000000480)={0x0, 0x7733, 0x80, 0x0, 0x283}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2e, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x11, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x2}}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socket$inet_mptcp(0x2, 0x1, 0x106) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f00000001c0)={'icmp6\x00'}, &(0x7f0000000200)=0x1e) kernel console output (not intermixed with test programs): yzkaller #0 PREEMPT(full) [ 1068.896773][ T847] Tainted: [L]=SOFTLOCKUP [ 1068.896780][ T847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1068.896791][ T847] Call Trace: [ 1068.896799][ T847] [ 1068.896808][ T847] dump_stack_lvl+0x189/0x250 [ 1068.896835][ T847] ? __pfx____ratelimit+0x10/0x10 [ 1068.896862][ T847] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1068.896883][ T847] ? __pfx__printk+0x10/0x10 [ 1068.896908][ T847] ? __might_fault+0xb0/0x130 [ 1068.896943][ T847] should_fail_ex+0x414/0x560 [ 1068.896975][ T847] _copy_from_user+0x2d/0xb0 [ 1068.896996][ T847] ___sys_sendmsg+0x158/0x2a0 [ 1068.897021][ T847] ? __pfx____sys_sendmsg+0x10/0x10 [ 1068.897047][ T847] ? rcu_read_lock_any_held+0xb3/0x120 [ 1068.897075][ T847] ? __fget_files+0x2a/0x420 [ 1068.897087][ T847] ? __fget_files+0x3a0/0x420 [ 1068.897112][ T847] __x64_sys_sendmsg+0x19b/0x260 [ 1068.897136][ T847] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1068.897166][ T847] ? __pfx_ksys_write+0x10/0x10 [ 1068.897188][ T847] ? do_syscall_64+0xbe/0xf80 [ 1068.897210][ T847] do_syscall_64+0xfa/0xf80 [ 1068.897226][ T847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1068.897236][ T847] ? clear_bhb_loop+0x60/0xb0 [ 1068.897248][ T847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1068.897257][ T847] RIP: 0033:0x7f86de98f749 [ 1068.897268][ T847] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1068.897276][ T847] RSP: 002b:00007f86df825038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1068.897294][ T847] RAX: ffffffffffffffda RBX: 00007f86debe5fa0 RCX: 00007f86de98f749 [ 1068.897308][ T847] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000011 [ 1068.897320][ T847] RBP: 00007f86df825090 R08: 0000000000000000 R09: 0000000000000000 [ 1068.897332][ T847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1068.897344][ T847] R13: 00007f86debe6038 R14: 00007f86debe5fa0 R15: 00007f86ded0fa28 [ 1068.897374][ T847] [ 1069.282536][ T827] syzkaller0: entered promiscuous mode [ 1069.289203][ T827] syzkaller0: entered allmulticast mode [ 1069.659329][ T5902] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 1069.676091][ T5922] usb 1-1: USB disconnect, device number 18 [ 1069.692959][ T5902] ath9k_htc: Failed to initialize the device [ 1069.737479][ T5922] usb 1-1: ath9k_htc: USB layer deinitialized [ 1069.833534][ T911] usb 5-1: USB disconnect, device number 4 [ 1070.215206][ T906] xt_hashlimit: size too large, truncated to 1048576 [ 1070.601182][ T917] binder: BINDER_SET_CONTEXT_MGR already set [ 1070.607518][ T917] binder: 907:917 ioctl 4018620d 200000004a80 returned -16 [ 1072.031783][ T950] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3497'. [ 1072.120064][ T952] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3497'. [ 1072.571219][ T961] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3500'. [ 1073.211542][ T1034] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3508'. [ 1073.229263][ T994] bond3: invalid ARP target 0.0.0.0 specified for addition [ 1073.242111][ T994] bond3: option arp_ip_target: invalid value (0) [ 1073.270988][ T994] bond3 (unregistering): Released all slaves [ 1073.385735][ T5922] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 1073.535823][ T5922] usb 5-1: Using ep0 maxpacket: 32 [ 1073.543151][ T5922] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1073.558670][ T5922] usb 5-1: config 8 has an invalid interface number: 143 but max is 3 [ 1073.578433][ T5922] usb 5-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1073.601060][ T5922] usb 5-1: config 8 has 1 interface, different from the descriptor's value: 4 [ 1073.646559][ T5922] usb 5-1: config 8 has no interface number 0 [ 1073.652861][ T5922] usb 5-1: config 8 interface 143 altsetting 193 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 1073.673756][ T5922] usb 5-1: config 8 interface 143 altsetting 193 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 1073.695791][ T5922] usb 5-1: config 8 interface 143 has no altsetting 0 [ 1073.739924][ T5922] usb 5-1: New USB device found, idVendor=1608, idProduct=021d, bcdDevice= 8.a4 [ 1073.756201][ T5922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1073.778569][ T5922] usb 5-1: Product: ⯦䊲ꍈ૨徽샼℀ﷲ疆忱 [ 1073.795730][ T5922] usb 5-1: Manufacturer: ы [ 1073.806185][ T5922] usb 5-1: SerialNumber: я [ 1073.908150][T14684] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 1073.953610][ T1092] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3512'. [ 1074.021870][ T995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1074.044672][ T995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1074.072809][ T995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1074.094548][ T995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1074.108723][T14684] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 64, changing to 10 [ 1074.137962][T14684] usb 4-1: New USB device found, idVendor=0c70, idProduct=f011, bcdDevice= 0.00 [ 1074.169729][T14684] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1074.220236][ T1118] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3507'. [ 1074.234342][T14684] usb 4-1: config 0 descriptor?? [ 1074.323173][ T995] bond2: option xmit_hash_policy: invalid value (14) [ 1074.398037][ T995] bond2 (unregistering): Released all slaves [ 1074.531867][ T1118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1074.584950][ T1118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1074.712381][T14684] aquacomputer_d5next 0003:0C70:F011.0023: hidraw0: USB HID v0.00 Device [HID 0c70:f011] on usb-dummy_hcd.3-1/input0 [ 1074.727753][ T5922] io_ti 5-1:8.143: required endpoints missing [ 1074.763980][ T5922] usb 5-1: USB disconnect, device number 5 [ 1075.995243][ T1240] program syz.1.3517 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1076.032214][ T1202] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3511'. [ 1076.044138][ T1202] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3511'. [ 1076.065067][ T1229] bridge_slave_0: left allmulticast mode [ 1076.071559][ T1229] bridge_slave_0: left promiscuous mode [ 1076.079976][ T1229] bridge0: port 1(bridge_slave_0) entered disabled state [ 1076.204731][ T1229] bridge_slave_1: left allmulticast mode [ 1076.305836][ T1229] bridge_slave_1: left promiscuous mode [ 1076.354222][ T1229] bridge0: port 2(bridge_slave_1) entered disabled state [ 1076.413535][ T1229] bond0: (slave bond_slave_0): Releasing backup interface [ 1076.429553][ T1229] bond0: (slave bond_slave_1): Releasing backup interface [ 1076.593675][ T1229] team0: Port device team_slave_0 removed [ 1076.619831][ T1229] team0: Port device team_slave_1 removed [ 1076.639453][ T1229] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1076.648002][ T1229] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1076.738677][ T1229] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1076.757127][ T1229] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1076.886492][ T1229] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1076.992339][ T1202] geneve2: entered promiscuous mode [ 1077.640019][ T1268] syzkaller0: entered promiscuous mode [ 1077.645844][ T1268] syzkaller0: entered allmulticast mode [ 1077.654554][ T3839] syzkaller0: tun_net_xmit 70 [ 1077.664194][ T1268] syzkaller0: tun_net_xmit 14 [ 1078.061062][T31715] usb 4-1: USB disconnect, device number 127 [ 1078.648248][ T5922] usb 1-1: new full-speed USB device number 19 using dummy_hcd [ 1078.847475][ T5922] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1078.859698][ T5922] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 1078.887912][ T5922] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 1078.908224][ T5922] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1078.927141][ T5922] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.947334][ T5922] usb 1-1: Product: syz [ 1078.956721][ T5922] usb 1-1: Manufacturer: syz [ 1078.967100][ T5922] usb 1-1: SerialNumber: syz [ 1079.195127][ T1307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1079.246781][ T1307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1079.292195][ T5922] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor [ 1079.306715][ T5922] usb 1-1: 2:1 : unknown format tag 0x0 is detected. processed as MPEG. [ 1079.332060][ T5922] usb 1-1: found format II with max.bitrate = 128, frame size=0 [ 1079.358461][ T5922] usb 1-1: 2:1: All rates were zero [ 1079.424022][ T5922] usb 1-1: USB disconnect, device number 19 [ 1079.490065][ T1353] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3534'. [ 1079.499873][ T1353] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3534'. [ 1079.596582][ T805] udevd[805]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1079.728846][ T1368] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3535'. [ 1079.890424][ T1375] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3536'. [ 1079.937620][ T1375] gretap0: entered promiscuous mode [ 1079.953219][ T1375] gretap0: left promiscuous mode [ 1080.127581][ T1389] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3542'. [ 1080.153741][ T1389] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 1080.161310][ T1389] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1081.578712][ T1427] xt_hashlimit: size too large, truncated to 1048576 [ 1082.226468][ T30] audit: type=1326 audit(1765894243.028:473): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1431 comm="syz.4.3550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1082.593205][ T30] audit: type=1326 audit(1765894243.028:474): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1431 comm="syz.4.3550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1082.692304][ T30] audit: type=1326 audit(1765894243.028:475): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1431 comm="syz.4.3550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1082.770665][ T30] audit: type=1326 audit(1765894243.028:476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1431 comm="syz.4.3550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1082.831313][ T30] audit: type=1326 audit(1765894243.028:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1431 comm="syz.4.3550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1082.865522][ T30] audit: type=1326 audit(1765894243.028:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1431 comm="syz.4.3550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1082.968439][ T30] audit: type=1326 audit(1765894243.028:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1431 comm="syz.4.3550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1083.074129][ T30] audit: type=1326 audit(1765894243.068:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1431 comm="syz.4.3550" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1083.608506][ T30] audit: type=1326 audit(1765894244.408:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1455 comm="syz.1.3557" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0ae38f749 code=0x7ffc0000 [ 1083.632251][ T5976] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 1083.734554][ T30] audit: type=1326 audit(1765894244.438:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=1455 comm="syz.1.3557" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb0ae38f749 code=0x7ffc0000 [ 1083.846711][ T5976] usb 4-1: config 0 has an invalid interface number: 255 but max is 0 [ 1083.855391][ T5976] usb 4-1: config 0 has no interface number 0 [ 1083.865180][ T5976] usb 4-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 1083.878067][ T5976] usb 4-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1083.899023][ T5976] usb 4-1: config 0 interface 255 has no altsetting 0 [ 1083.935262][ T5976] usb 4-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 1083.950797][ T5976] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1083.974257][ T1473] kvm: kvm [1472]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0xc1) = 0x1 [ 1084.022764][ T1473] kvm: kvm [1472]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0xc2) = 0x1 [ 1084.048327][ T1473] kvm: kvm [1472]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 1084.090389][ T1473] kvm: kvm [1472]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0x11e) = 0x1 [ 1084.124730][ T5976] usb 4-1: config 0 descriptor?? [ 1084.128648][ T1473] kvm: kvm [1472]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0x186) = 0x1 [ 1084.284024][ T1473] kvm: kvm [1472]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0x187) = 0x1 [ 1084.299469][ T1473] kvm_intel: kvm [1472]: vcpu0, guest rIP: 0x1bc Unhandled WRMSR(0x1d9) = 0x1 [ 1084.460520][ T5976] ums-realtek 4-1:0.255: USB Mass Storage device detected [ 1084.698671][ T5976] usb 4-1: USB disconnect, device number 2 [ 1085.587293][ T1518] FAULT_INJECTION: forcing a failure. [ 1085.587293][ T1518] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1085.601553][ T1518] CPU: 1 UID: 0 PID: 1518 Comm: syz.0.3564 Tainted: G L syzkaller #0 PREEMPT(full) [ 1085.601583][ T1518] Tainted: [L]=SOFTLOCKUP [ 1085.601591][ T1518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1085.601602][ T1518] Call Trace: [ 1085.601610][ T1518] [ 1085.601619][ T1518] dump_stack_lvl+0x189/0x250 [ 1085.601645][ T1518] ? __pfx____ratelimit+0x10/0x10 [ 1085.601672][ T1518] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1085.601693][ T1518] ? __pfx__printk+0x10/0x10 [ 1085.601719][ T1518] ? __might_fault+0xb0/0x130 [ 1085.601755][ T1518] should_fail_ex+0x414/0x560 [ 1085.601785][ T1518] _copy_from_user+0x2d/0xb0 [ 1085.601808][ T1518] ___sys_recvmsg+0x12e/0x510 [ 1085.601834][ T1518] ? __pfx____sys_recvmsg+0x10/0x10 [ 1085.601885][ T1518] ? __might_fault+0xb0/0x130 [ 1085.601910][ T1518] do_recvmmsg+0x307/0x770 [ 1085.601937][ T1518] ? __pfx_do_recvmmsg+0x10/0x10 [ 1085.601963][ T1518] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1085.601991][ T1518] __x64_sys_recvmmsg+0x190/0x240 [ 1085.602010][ T1518] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1085.602030][ T1518] ? do_syscall_64+0xbe/0xf80 [ 1085.602047][ T1518] do_syscall_64+0xfa/0xf80 [ 1085.602062][ T1518] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1085.602082][ T1518] ? clear_bhb_loop+0x60/0xb0 [ 1085.602098][ T1518] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1085.602111][ T1518] RIP: 0033:0x7fcae2d8f749 [ 1085.602125][ T1518] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1085.602137][ T1518] RSP: 002b:00007fcae3bbc038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1085.602152][ T1518] RAX: ffffffffffffffda RBX: 00007fcae2fe6180 RCX: 00007fcae2d8f749 [ 1085.602163][ T1518] RDX: 0000000000000847 RSI: 0000200000007900 RDI: 0000000000000003 [ 1085.602172][ T1518] RBP: 00007fcae3bbc090 R08: 0000000000000000 R09: 0000000000000000 [ 1085.602181][ T1518] R10: 0000000000010162 R11: 0000000000000246 R12: 0000000000000001 [ 1085.602189][ T1518] R13: 00007fcae2fe6218 R14: 00007fcae2fe6180 R15: 00007fcae310fa28 [ 1085.602211][ T1518] [ 1087.872543][ T1559] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3575'. [ 1088.122090][ T1564] xt_hashlimit: size too large, truncated to 1048576 [ 1089.695696][T14684] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1089.920958][T14684] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1089.953278][T14684] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1089.971647][T14684] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.021936][T14684] usb 5-1: Product: syz [ 1090.029503][T14684] usb 5-1: Manufacturer: syz [ 1090.041376][T14684] usb 5-1: SerialNumber: syz [ 1090.084167][T14684] usb 5-1: config 0 descriptor?? [ 1090.223687][ T1619] KVM: debugfs: duplicate directory 1619-5 [ 1090.537913][ T1602] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3582'. [ 1090.661981][ T1636] FAULT_INJECTION: forcing a failure. [ 1090.661981][ T1636] name failslab, interval 1, probability 0, space 0, times 0 [ 1090.775035][ T1636] CPU: 0 UID: 0 PID: 1636 Comm: syz.0.3586 Tainted: G L syzkaller #0 PREEMPT(full) [ 1090.775065][ T1636] Tainted: [L]=SOFTLOCKUP [ 1090.775069][ T1636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1090.775076][ T1636] Call Trace: [ 1090.775081][ T1636] [ 1090.775086][ T1636] dump_stack_lvl+0x189/0x250 [ 1090.775103][ T1636] ? __pfx____ratelimit+0x10/0x10 [ 1090.775119][ T1636] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1090.775130][ T1636] ? __pfx__printk+0x10/0x10 [ 1090.775152][ T1636] ? __pfx___might_resched+0x10/0x10 [ 1090.775166][ T1636] should_fail_ex+0x414/0x560 [ 1090.775184][ T1636] should_failslab+0xa8/0x100 [ 1090.775197][ T1636] __kmalloc_noprof+0xdf/0x800 [ 1090.775207][ T1636] ? kfree+0x4d/0x660 [ 1090.775218][ T1636] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1090.775234][ T1636] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1090.775247][ T1636] ? tomoyo_domain+0xd8/0x130 [ 1090.775262][ T1636] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1090.775273][ T1636] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1090.775285][ T1636] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1090.775304][ T1636] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1090.775324][ T1636] ? __fget_files+0x2a/0x420 [ 1090.775339][ T1636] ? __fget_files+0x3a0/0x420 [ 1090.775349][ T1636] ? __fget_files+0x2a/0x420 [ 1090.775363][ T1636] security_file_ioctl+0xcb/0x2d0 [ 1090.775374][ T1636] __se_sys_ioctl+0x47/0x170 [ 1090.775390][ T1636] do_syscall_64+0xfa/0xf80 [ 1090.775401][ T1636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1090.775411][ T1636] ? clear_bhb_loop+0x60/0xb0 [ 1090.775423][ T1636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1090.775432][ T1636] RIP: 0033:0x7fcae2d8f749 [ 1090.775442][ T1636] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1090.775453][ T1636] RSP: 002b:00007fcae3bfe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1090.775465][ T1636] RAX: ffffffffffffffda RBX: 00007fcae2fe5fa0 RCX: 00007fcae2d8f749 [ 1090.775473][ T1636] RDX: 0000200000000080 RSI: 00000000c020aa07 RDI: 0000000000000003 [ 1090.775479][ T1636] RBP: 00007fcae3bfe090 R08: 0000000000000000 R09: 0000000000000000 [ 1090.775485][ T1636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1090.775491][ T1636] R13: 00007fcae2fe6038 R14: 00007fcae2fe5fa0 R15: 00007fcae310fa28 [ 1090.775508][ T1636] [ 1090.775512][ T1636] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1092.555695][ T5922] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 1092.653481][ T5902] usb 5-1: USB disconnect, device number 6 [ 1092.760787][ T5922] usb 4-1: Using ep0 maxpacket: 8 [ 1092.783204][ T5922] usb 4-1: New USB device found, idVendor=07ca, idProduct=b800, bcdDevice=31.1f [ 1092.810296][ T5922] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1092.822284][ T5922] usb 4-1: Product: syz [ 1092.827076][ T5922] usb 4-1: Manufacturer: syz [ 1092.832109][ T5922] usb 4-1: SerialNumber: syz [ 1092.862125][ T5922] usb 4-1: config 0 descriptor?? [ 1093.638084][ T5922] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1093.676856][ T5922] usb 4-1: USB disconnect, device number 3 [ 1093.775150][ T1754] KVM: debugfs: duplicate directory 1754-5 [ 1093.934402][ T1742] xt_hashlimit: size too large, truncated to 1048576 [ 1096.885445][ T1821] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3622'. [ 1097.166686][ T1825] KVM: debugfs: duplicate directory 1825-5 [ 1097.635696][ T5976] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1097.835629][ T5976] usb 1-1: Using ep0 maxpacket: 32 [ 1097.852455][ T5976] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1097.929956][ T5976] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1097.999736][ T5976] usb 1-1: config 0 descriptor?? [ 1098.207940][ T5976] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1098.230497][ T5976] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1098.257606][ T5976] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1098.277889][ T5976] usb 1-1: media controller created [ 1098.371925][ T5976] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1098.868193][ T1888] netlink: 320 bytes leftover after parsing attributes in process `syz.3.3635'. [ 1098.945781][T31715] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 1099.118318][T31715] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1099.136534][T31715] usb 5-1: config 0 has no interface number 0 [ 1099.145488][T31715] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1099.156086][T31715] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1099.164087][T31715] usb 5-1: Product: syz [ 1099.169359][T31715] usb 5-1: Manufacturer: syz [ 1099.174078][T31715] usb 5-1: SerialNumber: syz [ 1099.181803][T31715] usb 5-1: config 0 descriptor?? [ 1099.336111][ T5976] stb0899_attach: Driver disabled by Kconfig [ 1099.342473][ T5976] az6027: no front-end attached [ 1099.342473][ T5976] [ 1099.354217][ T5976] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1099.364111][ T5976] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input70 [ 1099.376194][ T5919] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 1099.387370][ T5976] dvb-usb: schedule remote query interval to 400 msecs. [ 1099.396407][T31715] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 1099.405961][ T5976] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1099.418761][T31715] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1099.438281][T31715] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1099.447815][T31715] usb 5-1: media controller created [ 1099.468637][T31715] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1099.529358][ T1919] KVM: debugfs: duplicate directory 1919-5 [ 1099.545721][ T5919] usb 4-1: Using ep0 maxpacket: 32 [ 1099.552836][ T5919] usb 4-1: config 4 has an invalid interface number: 128 but max is 0 [ 1099.563130][ T5919] usb 4-1: config 4 has no interface number 0 [ 1099.569983][ T5919] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1099.584215][ T5902] usb 1-1: USB disconnect, device number 20 [ 1099.593400][ T5919] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1099.628852][ T5919] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1099.640287][ T1883] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1099.649095][ T5919] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1099.662644][ T1883] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1099.692419][ T5919] hub 4-1:4.128: USB hub found [ 1099.875813][ T1945] FAULT_INJECTION: forcing a failure. [ 1099.875813][ T1945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1099.889289][ T1945] CPU: 1 UID: 0 PID: 1945 Comm: syz.2.3640 Tainted: G L syzkaller #0 PREEMPT(full) [ 1099.889316][ T1945] Tainted: [L]=SOFTLOCKUP [ 1099.889323][ T1945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1099.889332][ T1945] Call Trace: [ 1099.889339][ T1945] [ 1099.889347][ T1945] dump_stack_lvl+0x189/0x250 [ 1099.889373][ T1945] ? __pfx____ratelimit+0x10/0x10 [ 1099.889398][ T1945] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1099.889418][ T1945] ? __pfx__printk+0x10/0x10 [ 1099.889442][ T1945] ? __might_fault+0xb0/0x130 [ 1099.889472][ T1945] should_fail_ex+0x414/0x560 [ 1099.889500][ T1945] _copy_from_iter+0x1cd/0x1630 [ 1099.889518][ T1945] ? __build_skb_around+0x22d/0x3c0 [ 1099.889538][ T1945] ? __pfx__copy_from_iter+0x10/0x10 [ 1099.889553][ T1945] ? __alloc_skb+0x2f1/0x430 [ 1099.889573][ T1945] ? __pfx___alloc_skb+0x10/0x10 [ 1099.889591][ T1945] ? netlink_sendmsg+0x642/0xb30 [ 1099.889609][ T1945] ? skb_put+0x11b/0x210 [ 1099.889627][ T1945] netlink_sendmsg+0x6b2/0xb30 [ 1099.889658][ T1945] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1099.889683][ T1945] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1099.889707][ T1945] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1099.889722][ T1945] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1099.889745][ T1945] __sock_sendmsg+0x21c/0x270 [ 1099.889772][ T1945] ____sys_sendmsg+0x505/0x820 [ 1099.889806][ T1945] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1099.889834][ T1945] ? import_iovec+0x74/0xa0 [ 1099.889858][ T1945] ___sys_sendmsg+0x21f/0x2a0 [ 1099.889883][ T1945] ? __pfx____sys_sendmsg+0x10/0x10 [ 1099.889912][ T1945] ? rcu_read_lock_any_held+0xb3/0x120 [ 1099.889959][ T1945] ? __fget_files+0x2a/0x420 [ 1099.889979][ T1945] ? __fget_files+0x3a0/0x420 [ 1099.890008][ T1945] __x64_sys_sendmsg+0x19b/0x260 [ 1099.890031][ T1945] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1099.890059][ T1945] ? __pfx_ksys_write+0x10/0x10 [ 1099.890080][ T1945] ? do_syscall_64+0xbe/0xf80 [ 1099.890100][ T1945] do_syscall_64+0xfa/0xf80 [ 1099.890120][ T1945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1099.890138][ T1945] ? clear_bhb_loop+0x60/0xb0 [ 1099.890158][ T1945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1099.890175][ T1945] RIP: 0033:0x7f86de98f749 [ 1099.890190][ T1945] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1099.890205][ T1945] RSP: 002b:00007f86df825038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1099.890225][ T1945] RAX: ffffffffffffffda RBX: 00007f86debe5fa0 RCX: 00007f86de98f749 [ 1099.890238][ T1945] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1099.890250][ T1945] RBP: 00007f86df825090 R08: 0000000000000000 R09: 0000000000000000 [ 1099.890262][ T1945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1099.890273][ T1945] R13: 00007f86debe6038 R14: 00007f86debe5fa0 R15: 00007f86ded0fa28 [ 1099.890302][ T1945] [ 1099.891099][ T5919] hub 4-1:4.128: 2 ports detected [ 1100.189306][ T1891] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1100.263889][ T5919] hub 4-1:4.128: Using single TT (err -22) [ 1100.271294][ T5919] hub 4-1:4.128: config failed, can't get hub status (err -5) [ 1100.368846][ T5919] usb 4-1: USB disconnect, device number 4 [ 1100.540025][T31715] i2c i2c-2: ec100: i2c rd failed=-110 reg=33 [ 1100.635513][ T1971] xt_hashlimit: size too large, truncated to 1048576 [ 1100.783091][ T1973] xt_hashlimit: size too large, truncated to 1048576 [ 1101.549647][ T1987] mmap: syz.3.3647 (1987): VmData 37593088 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 1101.742248][ T1998] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3648'. [ 1101.753035][ T1998] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3648'. [ 1102.112405][ T2007] syzkaller1: entered promiscuous mode [ 1102.119696][ T2007] syzkaller1: entered allmulticast mode [ 1102.133984][ T2011] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1102.161935][ T2012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1102.176252][ T2011] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1102.240868][ T2012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1102.273608][ T2012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1102.310834][ T2012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1102.534671][ T2029] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1102.553419][ T2034] delete_channel: no stack [ 1102.572348][ T2029] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1102.644460][ T2029] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1102.870819][ T2046] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3657'. [ 1103.220588][ T2049] tipc: Started in network mode [ 1103.225486][ T2049] tipc: Node identity 36d39e073793, cluster identity 4711 [ 1103.233529][ T2049] tipc: Enabled bearer , priority 0 [ 1103.241833][ T2049] syzkaller0: entered promiscuous mode [ 1103.247646][ T2049] syzkaller0: entered allmulticast mode [ 1103.292853][ T2049] tipc: Resetting bearer [ 1103.302613][ T2056] netlink: 'syz.0.3659': attribute type 3 has an invalid length. [ 1103.314541][ T2056] netlink: 666 bytes leftover after parsing attributes in process `syz.0.3659'. [ 1103.324458][ T2049] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3658'. [ 1103.337813][ T2048] tipc: Resetting bearer [ 1103.354365][ T2048] tipc: Disabling bearer [ 1103.650182][ T2064] xt_hashlimit: size too large, truncated to 1048576 [ 1104.279697][T14684] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 1104.435902][T14684] usb 4-1: Using ep0 maxpacket: 32 [ 1104.444283][T14684] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 1104.453481][T14684] usb 4-1: config 0 has no interface number 0 [ 1104.467861][T14684] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1104.479856][T14684] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1104.508501][T14684] usb 4-1: Product: syz [ 1104.512716][T14684] usb 4-1: Manufacturer: syz [ 1104.528989][T14684] usb 4-1: SerialNumber: syz [ 1104.556275][T14684] usb 4-1: config 0 descriptor?? [ 1104.578598][T14684] smsc95xx v2.0.0 [ 1104.990685][T14684] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1105.005242][T14684] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1105.287543][ T2096] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1105.422574][T14684] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 1105.442202][T14684] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 1105.493874][T14684] usb 4-1: USB disconnect, device number 5 [ 1105.610365][ T2110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1105.629762][ T2110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1105.672195][ T2110] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1107.667981][ T911] hid_parser_main: 1235 callbacks suppressed [ 1107.667997][ T911] hid-generic 0000:0000:0000.0024: unknown main item tag 0x0 [ 1107.816793][ T911] hid-generic 0000:0000:0000.0024: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1108.061729][ T2170] xt_hashlimit: size too large, truncated to 1048576 [ 1108.190232][ T2168] xt_hashlimit: size too large, truncated to 1048576 [ 1108.634091][ T2175] fido_id[2175]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1110.119934][ T2205] hub 9-0:1.0: USB hub found [ 1110.125342][ T2205] hub 9-0:1.0: 1 port detected [ 1110.405660][T31715] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1110.585625][T31715] usb 4-1: Using ep0 maxpacket: 32 [ 1110.597530][T31715] usb 4-1: config 4 has an invalid interface number: 128 but max is 0 [ 1110.610688][T31715] usb 4-1: config 4 has no interface number 0 [ 1110.619407][T31715] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1110.632382][T31715] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1110.643297][T31715] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1110.653382][T31715] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1111.405437][T31715] hub 4-1:4.128: USB hub found [ 1111.491850][ T30] kauditd_printk_skb: 42 callbacks suppressed [ 1111.493066][ T30] audit: type=1326 audit(1765894272.238:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2215 comm="syz.0.3684" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fcae2d8f749 code=0x0 [ 1111.607895][T31715] hub 4-1:4.128: 2 ports detected [ 1111.664986][T31715] hub 4-1:4.128: Using single TT (err -22) [ 1111.829222][ T2204] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1111.865037][T31715] hub 4-1:4.128: hub_hub_status failed (err = -71) [ 1111.873031][T31715] hub 4-1:4.128: config failed, can't get hub status (err -71) [ 1112.603093][T31715] usb 4-1: USB disconnect, device number 6 [ 1114.475706][ T5922] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 1114.490548][ T2290] netlink: 'syz.2.3696': attribute type 2 has an invalid length. [ 1114.625646][ T5922] usb 4-1: Using ep0 maxpacket: 32 [ 1114.636474][ T5922] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1114.655656][ T5922] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1114.679216][ T5922] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1114.703156][ T5922] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1114.740287][ T5922] usb 4-1: config 0 descriptor?? [ 1114.771967][ T5922] hub 4-1:0.0: USB hub found [ 1114.963021][ T5922] hub 4-1:0.0: 1 port detected [ 1115.690197][ T2322] netlink: 'syz.4.3700': attribute type 12 has an invalid length. [ 1115.906342][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.914642][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.980416][ T5922] hub 4-1:0.0: hub_hub_status failed (err = -32) [ 1115.998958][ T5922] hub 4-1:0.0: config failed, can't get hub status (err -32) [ 1116.020043][ T5922] usbhid 4-1:0.0: can't add hid device: -32 [ 1116.029180][ T5922] usbhid 4-1:0.0: probe with driver usbhid failed with error -32 [ 1117.306277][ T5920] usb 4-1: USB disconnect, device number 7 [ 1118.521437][ T2380] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 1120.649916][ T2407] xt_hashlimit: size too large, truncated to 1048576 [ 1121.275663][T31715] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1121.425653][T31715] usb 4-1: Using ep0 maxpacket: 32 [ 1121.433461][T31715] usb 4-1: config 4 has an invalid interface number: 128 but max is 0 [ 1121.454258][T31715] usb 4-1: config 4 has no interface number 0 [ 1121.466465][T31715] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1121.493214][T31715] usb 4-1: config 4 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1121.504690][T31715] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1121.534194][T31715] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1121.572828][T31715] hub 4-1:4.128: USB hub found [ 1121.770484][T31715] hub 4-1:4.128: 2 ports detected [ 1121.805734][T31715] hub 4-1:4.128: Using single TT (err -22) [ 1121.974098][ T2430] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1122.021325][T31715] hub 4-1:4.128: hub_hub_status failed (err = -71) [ 1122.059536][T31715] hub 4-1:4.128: config failed, can't get hub status (err -71) [ 1122.120618][T31715] usb 4-1: USB disconnect, device number 8 [ 1122.707253][ T2478] syzkaller0: entered promiscuous mode [ 1122.713041][ T2478] syzkaller0: entered allmulticast mode [ 1122.713454][ T2482] netlink: 'syz.3.3722': attribute type 11 has an invalid length. [ 1123.669757][ T2522] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3727'. [ 1124.627723][ T2542] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1124.638076][ T2542] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1125.037107][ T2561] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1126.406055][T31715] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 1126.587839][T31715] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 1126.612139][T31715] usb 4-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 1126.682195][T31715] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1126.716019][T31715] usb 4-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 1126.732857][T31715] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1126.757855][T31715] usb 4-1: Product: syz [ 1126.848761][ T2613] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3741'. [ 1126.860209][ T5919] hid (null): bogus close delimiter [ 1126.867338][ T2613] netlink: 'syz.1.3741': attribute type 29 has an invalid length. [ 1126.876197][ T5919] hid (null): report_id 58660 is invalid [ 1126.882514][ T2613] netlink: 'syz.1.3741': attribute type 29 has an invalid length. [ 1126.897113][ T5919] hid-generic 0001:0006:0009.0025: bogus close delimiter [ 1126.908270][ T2613] netlink: 148 bytes leftover after parsing attributes in process `syz.1.3741'. [ 1126.917581][ T5919] hid-generic 0001:0006:0009.0025: item 0 0 2 10 parsing failed [ 1126.925255][T31715] usb 4-1: Manufacturer: syz [ 1126.935459][ T5919] hid-generic 0001:0006:0009.0025: probe with driver hid-generic failed with error -22 [ 1126.947306][T31715] usb 4-1: SerialNumber: syz [ 1126.986614][ T2599] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 1126.998906][ T2599] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 1127.521428][ T2629] FAULT_INJECTION: forcing a failure. [ 1127.521428][ T2629] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1127.665675][ T2629] CPU: 1 UID: 0 PID: 2629 Comm: syz.1.3745 Tainted: G L syzkaller #0 PREEMPT(full) [ 1127.665706][ T2629] Tainted: [L]=SOFTLOCKUP [ 1127.665713][ T2629] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1127.665724][ T2629] Call Trace: [ 1127.665733][ T2629] [ 1127.665742][ T2629] dump_stack_lvl+0x189/0x250 [ 1127.665768][ T2629] ? __pfx____ratelimit+0x10/0x10 [ 1127.665802][ T2629] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1127.665821][ T2629] ? __pfx__printk+0x10/0x10 [ 1127.665844][ T2629] ? __might_fault+0xb0/0x130 [ 1127.665879][ T2629] should_fail_ex+0x414/0x560 [ 1127.665909][ T2629] _copy_from_iter+0x1cd/0x1630 [ 1127.665935][ T2629] ? txopt_get+0x7a/0x3f0 [ 1127.665956][ T2629] ? txopt_get+0x7a/0x3f0 [ 1127.665979][ T2629] ? __pfx__copy_from_iter+0x10/0x10 [ 1127.665996][ T2629] ? txopt_get+0x335/0x3f0 [ 1127.666019][ T2629] ? txopt_get+0x7a/0x3f0 [ 1127.666042][ T2629] ? __pfx_txopt_get+0x10/0x10 [ 1127.666074][ T2629] rawv6_sendmsg+0xb5f/0x1830 [ 1127.666113][ T2629] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 1127.666160][ T2629] ? __pfx_aa_sk_perm+0x10/0x10 [ 1127.666184][ T2629] ? sock_rps_record_flow+0x19/0x410 [ 1127.666210][ T2629] ? inet_sendmsg+0x2f4/0x370 [ 1127.666227][ T2629] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1127.666247][ T2629] __sock_sendmsg+0x19c/0x270 [ 1127.666276][ T2629] __sys_sendto+0x3bd/0x520 [ 1127.666297][ T2629] ? __pfx___sys_sendto+0x10/0x10 [ 1127.666313][ T2629] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1127.666345][ T2629] ? __fget_files+0x3a0/0x420 [ 1127.666377][ T2629] ? ksys_write+0x22a/0x250 [ 1127.666397][ T2629] ? __pfx_ksys_write+0x10/0x10 [ 1127.666418][ T2629] __x64_sys_sendto+0xde/0x100 [ 1127.666440][ T2629] do_syscall_64+0xfa/0xf80 [ 1127.666459][ T2629] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1127.666477][ T2629] ? clear_bhb_loop+0x60/0xb0 [ 1127.666499][ T2629] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1127.666517][ T2629] RIP: 0033:0x7fb0ae38f749 [ 1127.666533][ T2629] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1127.666549][ T2629] RSP: 002b:00007fb0af1d7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 1127.666568][ T2629] RAX: ffffffffffffffda RBX: 00007fb0ae5e5fa0 RCX: 00007fb0ae38f749 [ 1127.666582][ T2629] RDX: 0000000000000026 RSI: 0000200000000180 RDI: 0000000000000003 [ 1127.666593][ T2629] RBP: 00007fb0af1d7090 R08: 0000000000000000 R09: 0000000000000000 [ 1127.666605][ T2629] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1127.666616][ T2629] R13: 00007fb0ae5e6038 R14: 00007fb0ae5e5fa0 R15: 00007fb0ae70fa28 [ 1127.666647][ T2629] [ 1128.283707][ T2632] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3746'. [ 1128.719410][ T2645] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1128.870666][T31715] rtl8150 4-1:1.0: couldn't reset the device [ 1128.879574][T31715] rtl8150 4-1:1.0: probe with driver rtl8150 failed with error -5 [ 1128.905158][T31715] usb 4-1: USB disconnect, device number 9 [ 1129.420813][ T2675] xt_hashlimit: size too large, truncated to 1048576 [ 1129.572188][ T2678] xt_hashlimit: size too large, truncated to 1048576 [ 1130.715477][ T2704] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 1130.715477][ T2704] The task syz.2.3757 (2704) triggered the difference, watch for misbehavior. [ 1131.915979][ T2725] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3762'. [ 1131.944099][ T2729] FAULT_INJECTION: forcing a failure. [ 1131.944099][ T2729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1131.944427][ T2728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1131.965479][ T2729] CPU: 1 UID: 0 PID: 2729 Comm: syz.1.3763 Tainted: G L syzkaller #0 PREEMPT(full) [ 1131.965509][ T2729] Tainted: [L]=SOFTLOCKUP [ 1131.965515][ T2729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1131.965530][ T2729] Call Trace: [ 1131.965538][ T2729] [ 1131.965546][ T2729] dump_stack_lvl+0x189/0x250 [ 1131.965574][ T2729] ? __pfx____ratelimit+0x10/0x10 [ 1131.965601][ T2729] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1131.965623][ T2729] ? __pfx__printk+0x10/0x10 [ 1131.965659][ T2729] should_fail_ex+0x414/0x560 [ 1131.965690][ T2729] _copy_to_user+0x31/0xb0 [ 1131.965714][ T2729] simple_read_from_buffer+0xe1/0x170 [ 1131.965740][ T2729] proc_fail_nth_read+0x1b3/0x220 [ 1131.965762][ T2729] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1131.965784][ T2729] ? rw_verify_area+0x2a6/0x4d0 [ 1131.965809][ T2729] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1131.965828][ T2729] vfs_read+0x200/0xa30 [ 1131.965851][ T2729] ? fdget_pos+0x247/0x320 [ 1131.965876][ T2729] ? __pfx___mutex_lock+0x10/0x10 [ 1131.965895][ T2729] ? __pfx_vfs_read+0x10/0x10 [ 1131.965913][ T2729] ? __fget_files+0x2a/0x420 [ 1131.965938][ T2729] ? __fget_files+0x3a0/0x420 [ 1131.965957][ T2729] ? __fget_files+0x2a/0x420 [ 1131.965986][ T2729] ksys_read+0x145/0x250 [ 1131.966001][ T2729] ? __fget_files+0x2a/0x420 [ 1131.966023][ T2729] ? __pfx_ksys_read+0x10/0x10 [ 1131.966042][ T2729] ? do_syscall_64+0xbe/0xf80 [ 1131.966065][ T2729] do_syscall_64+0xfa/0xf80 [ 1131.966084][ T2729] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1131.966102][ T2729] ? clear_bhb_loop+0x60/0xb0 [ 1131.966122][ T2729] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1131.966139][ T2729] RIP: 0033:0x7fb0ae38e15c [ 1131.966155][ T2729] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1131.966170][ T2729] RSP: 002b:00007fb0af1d7030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1131.966190][ T2729] RAX: ffffffffffffffda RBX: 00007fb0ae5e5fa0 RCX: 00007fb0ae38e15c [ 1131.966204][ T2729] RDX: 000000000000000f RSI: 00007fb0af1d70a0 RDI: 0000000000000004 [ 1131.966215][ T2729] RBP: 00007fb0af1d7090 R08: 0000000000000000 R09: 0000000000000000 [ 1131.966227][ T2729] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1131.966237][ T2729] R13: 00007fb0ae5e6038 R14: 00007fb0ae5e5fa0 R15: 00007fb0ae70fa28 [ 1131.966267][ T2729] [ 1132.192186][ T2736] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1132.199219][ T2728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1132.505111][ T2741] netlink: 'syz.1.3765': attribute type 4 has an invalid length. [ 1132.532420][ T2741] netlink: 'syz.1.3765': attribute type 4 has an invalid length. [ 1132.967082][ T2761] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1132.979360][ T2761] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1134.119333][ T2774] xt_hashlimit: size too large, truncated to 1048576 [ 1134.653865][ T2794] set match dimension is over the limit! [ 1134.884098][ T2807] netlink: 'syz.3.3777': attribute type 1 has an invalid length. [ 1135.080441][ T2844] bond3: (slave ip6gretap1): making interface the new active one [ 1135.111604][ T2844] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link [ 1135.203747][ T2807] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1136.248758][ T2897] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3783'. [ 1136.361841][ T2903] netlink: 'syz.3.3783': attribute type 2 has an invalid length. [ 1136.562337][ T2903] : entered promiscuous mode [ 1137.506725][ T30] audit: type=1326 audit(1765894298.308:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.541563][ T2946] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1137.552338][ T2946] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1137.561229][ T30] audit: type=1326 audit(1765894298.308:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.590029][ T30] audit: type=1326 audit(1765894298.328:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.613507][ T30] audit: type=1326 audit(1765894298.328:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.638246][ T30] audit: type=1326 audit(1765894298.328:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.664711][ T30] audit: type=1326 audit(1765894298.328:531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.691745][ T30] audit: type=1326 audit(1765894298.328:532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.742165][ T30] audit: type=1326 audit(1765894298.328:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.766151][ T30] audit: type=1326 audit(1765894298.328:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1137.789117][ T30] audit: type=1326 audit(1765894298.328:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=2942 comm="syz.4.3786" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f362a58f749 code=0x7ffc0000 [ 1138.126517][ T2965] FAULT_INJECTION: forcing a failure. [ 1138.126517][ T2965] name failslab, interval 1, probability 0, space 0, times 0 [ 1138.274987][ T2965] CPU: 1 UID: 0 PID: 2965 Comm: syz.2.3789 Tainted: G L syzkaller #0 PREEMPT(full) [ 1138.275017][ T2965] Tainted: [L]=SOFTLOCKUP [ 1138.275024][ T2965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1138.275040][ T2965] Call Trace: [ 1138.275048][ T2965] [ 1138.275056][ T2965] dump_stack_lvl+0x189/0x250 [ 1138.275085][ T2965] ? __pfx____ratelimit+0x10/0x10 [ 1138.275111][ T2965] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1138.275139][ T2965] ? __pfx__printk+0x10/0x10 [ 1138.275169][ T2965] ? __pfx___might_resched+0x10/0x10 [ 1138.275193][ T2965] should_fail_ex+0x414/0x560 [ 1138.275224][ T2965] should_failslab+0xa8/0x100 [ 1138.275246][ T2965] kmem_cache_alloc_noprof+0x88/0x710 [ 1138.275273][ T2965] ? posix_lock_inode+0x355/0x3270 [ 1138.275297][ T2965] posix_lock_inode+0x355/0x3270 [ 1138.275337][ T2965] ? __pfx_posix_lock_inode+0x10/0x10 [ 1138.275365][ T2965] fcntl_setlk+0xad2/0x1070 [ 1138.275404][ T2965] ? __pfx_fcntl_setlk+0x10/0x10 [ 1138.275445][ T2965] do_fcntl+0x917/0x1a50 [ 1138.275479][ T2965] ? __pfx_do_fcntl+0x10/0x10 [ 1138.275516][ T2965] ? __fget_files+0x2a/0x420 [ 1138.275544][ T2965] ? tomoyo_file_fcntl+0x78/0x210 [ 1138.275568][ T2965] ? bpf_lsm_file_fcntl+0x9/0x20 [ 1138.275590][ T2965] __se_sys_fcntl+0xc8/0x150 [ 1138.275614][ T2965] do_syscall_64+0xfa/0xf80 [ 1138.275633][ T2965] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.275651][ T2965] ? clear_bhb_loop+0x60/0xb0 [ 1138.275670][ T2965] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.275685][ T2965] RIP: 0033:0x7f86de98f749 [ 1138.275701][ T2965] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1138.275717][ T2965] RSP: 002b:00007f86df804038 EFLAGS: 00000246 ORIG_RAX: 0000000000000048 [ 1138.275737][ T2965] RAX: ffffffffffffffda RBX: 00007f86debe6090 RCX: 00007f86de98f749 [ 1138.275751][ T2965] RDX: 0000200000000080 RSI: 0000000000000026 RDI: 0000000000000006 [ 1138.275762][ T2965] RBP: 00007f86df804090 R08: 0000000000000000 R09: 0000000000000000 [ 1138.275774][ T2965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1138.275795][ T2965] R13: 00007f86debe6128 R14: 00007f86debe6090 R15: 00007f86ded0fa28 [ 1138.275825][ T2965] [ 1138.509459][ T2969] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3790'. [ 1138.518900][ T2969] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3790'. [ 1138.884732][ T2979] FAULT_INJECTION: forcing a failure. [ 1138.884732][ T2979] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1138.904670][ T2979] CPU: 1 UID: 0 PID: 2979 Comm: syz.1.3791 Tainted: G L syzkaller #0 PREEMPT(full) [ 1138.904689][ T2979] Tainted: [L]=SOFTLOCKUP [ 1138.904693][ T2979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1138.904700][ T2979] Call Trace: [ 1138.904705][ T2979] [ 1138.904710][ T2979] dump_stack_lvl+0x189/0x250 [ 1138.904728][ T2979] ? __pfx____ratelimit+0x10/0x10 [ 1138.904743][ T2979] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1138.904755][ T2979] ? __pfx__printk+0x10/0x10 [ 1138.904768][ T2979] ? __might_fault+0xb0/0x130 [ 1138.904788][ T2979] should_fail_ex+0x414/0x560 [ 1138.904805][ T2979] _copy_from_iter+0x1cd/0x1630 [ 1138.904818][ T2979] ? __build_skb_around+0x22d/0x3c0 [ 1138.904832][ T2979] ? __pfx__copy_from_iter+0x10/0x10 [ 1138.904840][ T2979] ? __alloc_skb+0x2f1/0x430 [ 1138.904851][ T2979] ? __pfx___alloc_skb+0x10/0x10 [ 1138.904862][ T2979] ? netlink_sendmsg+0x642/0xb30 [ 1138.904877][ T2979] ? skb_put+0x11b/0x210 [ 1138.904889][ T2979] netlink_sendmsg+0x6b2/0xb30 [ 1138.904906][ T2979] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1138.904920][ T2979] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1138.904934][ T2979] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1138.904943][ T2979] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1138.904955][ T2979] __sock_sendmsg+0x21c/0x270 [ 1138.904971][ T2979] ____sys_sendmsg+0x505/0x820 [ 1138.904986][ T2979] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1138.905002][ T2979] ? import_iovec+0x74/0xa0 [ 1138.905019][ T2979] ___sys_sendmsg+0x21f/0x2a0 [ 1138.905032][ T2979] ? __pfx____sys_sendmsg+0x10/0x10 [ 1138.905047][ T2979] ? rcu_read_lock_any_held+0xb3/0x120 [ 1138.905080][ T2979] ? __fget_files+0x2a/0x420 [ 1138.905093][ T2979] ? __fget_files+0x3a0/0x420 [ 1138.905109][ T2979] __x64_sys_sendmsg+0x19b/0x260 [ 1138.905122][ T2979] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1138.905138][ T2979] ? __pfx_ksys_write+0x10/0x10 [ 1138.905150][ T2979] ? do_syscall_64+0xbe/0xf80 [ 1138.905162][ T2979] do_syscall_64+0xfa/0xf80 [ 1138.905172][ T2979] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.905182][ T2979] ? clear_bhb_loop+0x60/0xb0 [ 1138.905194][ T2979] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1138.905204][ T2979] RIP: 0033:0x7fb0ae38f749 [ 1138.905214][ T2979] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1138.905222][ T2979] RSP: 002b:00007fb0af1d7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1138.905234][ T2979] RAX: ffffffffffffffda RBX: 00007fb0ae5e5fa0 RCX: 00007fb0ae38f749 [ 1138.905241][ T2979] RDX: 0000000008000002 RSI: 0000200000000000 RDI: 0000000000000003 [ 1138.905248][ T2979] RBP: 00007fb0af1d7090 R08: 0000000000000000 R09: 0000000000000000 [ 1138.905254][ T2979] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1138.905260][ T2979] R13: 00007fb0ae5e6038 R14: 00007fb0ae5e5fa0 R15: 00007fb0ae70fa28 [ 1138.905276][ T2979] [ 1140.977846][ T3007] FAULT_INJECTION: forcing a failure. [ 1140.977846][ T3007] name failslab, interval 1, probability 0, space 0, times 0 [ 1140.999243][ T3007] CPU: 0 UID: 0 PID: 3007 Comm: syz.1.3800 Tainted: G L syzkaller #0 PREEMPT(full) [ 1140.999273][ T3007] Tainted: [L]=SOFTLOCKUP [ 1140.999279][ T3007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1140.999290][ T3007] Call Trace: [ 1140.999298][ T3007] [ 1140.999308][ T3007] dump_stack_lvl+0x189/0x250 [ 1140.999335][ T3007] ? __pfx____ratelimit+0x10/0x10 [ 1140.999362][ T3007] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1140.999383][ T3007] ? __pfx__printk+0x10/0x10 [ 1140.999411][ T3007] ? __pfx___might_resched+0x10/0x10 [ 1140.999431][ T3007] ? fs_reclaim_acquire+0x7d/0x100 [ 1140.999456][ T3007] should_fail_ex+0x414/0x560 [ 1140.999487][ T3007] should_failslab+0xa8/0x100 [ 1140.999509][ T3007] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1140.999535][ T3007] ? __alloc_skb+0x255/0x430 [ 1140.999552][ T3007] ? napi_skb_cache_get+0x4a5/0x780 [ 1140.999571][ T3007] ? napi_skb_cache_get+0x151/0x780 [ 1140.999594][ T3007] __alloc_skb+0x255/0x430 [ 1140.999616][ T3007] ? __pfx___alloc_skb+0x10/0x10 [ 1140.999637][ T3007] ? netlink_autobind+0xdb/0x300 [ 1140.999658][ T3007] ? netlink_autobind+0x2c2/0x300 [ 1140.999686][ T3007] netlink_sendmsg+0x5c6/0xb30 [ 1140.999717][ T3007] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1140.999743][ T3007] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1140.999768][ T3007] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1140.999786][ T3007] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1140.999809][ T3007] __sock_sendmsg+0x21c/0x270 [ 1140.999837][ T3007] ____sys_sendmsg+0x52d/0x820 [ 1140.999859][ T3007] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1140.999882][ T3007] ? import_iovec+0x74/0xa0 [ 1140.999902][ T3007] ___sys_sendmsg+0x21f/0x2a0 [ 1140.999924][ T3007] ? __pfx____sys_sendmsg+0x10/0x10 [ 1140.999979][ T3007] ? __fget_files+0x2a/0x420 [ 1140.999999][ T3007] ? __fget_files+0x3a0/0x420 [ 1141.000031][ T3007] __sys_sendmmsg+0x227/0x430 [ 1141.000058][ T3007] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1141.000097][ T3007] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1141.000134][ T3007] ? ksys_write+0x22a/0x250 [ 1141.000155][ T3007] ? __pfx_ksys_write+0x10/0x10 [ 1141.000178][ T3007] __x64_sys_sendmmsg+0xa0/0xc0 [ 1141.000201][ T3007] do_syscall_64+0xfa/0xf80 [ 1141.000221][ T3007] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1141.000240][ T3007] ? clear_bhb_loop+0x60/0xb0 [ 1141.000261][ T3007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1141.000279][ T3007] RIP: 0033:0x7fb0ae38f749 [ 1141.000296][ T3007] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1141.000321][ T3007] RSP: 002b:00007fb0af1d7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1141.000341][ T3007] RAX: ffffffffffffffda RBX: 00007fb0ae5e5fa0 RCX: 00007fb0ae38f749 [ 1141.000355][ T3007] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 1141.000368][ T3007] RBP: 00007fb0af1d7090 R08: 0000000000000000 R09: 0000000000000000 [ 1141.000380][ T3007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1141.000392][ T3007] R13: 00007fb0ae5e6038 R14: 00007fb0ae5e5fa0 R15: 00007fb0ae70fa28 [ 1141.000422][ T3007] [ 1141.509200][ T3033] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3801'. [ 1141.563907][ T3017] bond2: option ad_select: invalid value (253) [ 1141.607929][ T3017] bond2 (unregistering): Released all slaves [ 1141.670408][ T3080] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3804'. [ 1143.277211][ T3117] FAULT_INJECTION: forcing a failure. [ 1143.277211][ T3117] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1143.325725][ T3117] CPU: 0 UID: 0 PID: 3117 Comm: syz.4.3809 Tainted: G L syzkaller #0 PREEMPT(full) [ 1143.325756][ T3117] Tainted: [L]=SOFTLOCKUP [ 1143.325763][ T3117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1143.325773][ T3117] Call Trace: [ 1143.325781][ T3117] [ 1143.325788][ T3117] dump_stack_lvl+0x189/0x250 [ 1143.325815][ T3117] ? __pfx____ratelimit+0x10/0x10 [ 1143.325842][ T3117] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1143.325863][ T3117] ? __pfx__printk+0x10/0x10 [ 1143.325888][ T3117] ? __might_fault+0xb0/0x130 [ 1143.325923][ T3117] should_fail_ex+0x414/0x560 [ 1143.325958][ T3117] _copy_from_user+0x2d/0xb0 [ 1143.325984][ T3117] do_handle_open+0x53b/0x930 [ 1143.326010][ T3117] ? __pfx_do_handle_open+0x10/0x10 [ 1143.326039][ T3117] ? ksys_write+0x22a/0x250 [ 1143.326058][ T3117] ? __pfx_ksys_write+0x10/0x10 [ 1143.326080][ T3117] ? do_syscall_64+0xbe/0xf80 [ 1143.326103][ T3117] do_syscall_64+0xfa/0xf80 [ 1143.326122][ T3117] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1143.326140][ T3117] ? clear_bhb_loop+0x60/0xb0 [ 1143.326162][ T3117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1143.326180][ T3117] RIP: 0033:0x7f362a58f749 [ 1143.326198][ T3117] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1143.326213][ T3117] RSP: 002b:00007f362b47d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 1143.326234][ T3117] RAX: ffffffffffffffda RBX: 00007f362a7e5fa0 RCX: 00007f362a58f749 [ 1143.326248][ T3117] RDX: 0000000000111400 RSI: 00002000000006c0 RDI: 0000000000000003 [ 1143.326260][ T3117] RBP: 00007f362b47d090 R08: 0000000000000000 R09: 0000000000000000 [ 1143.326275][ T3117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1143.326287][ T3117] R13: 00007f362a7e6038 R14: 00007f362a7e5fa0 R15: 00007f362a90fa28 [ 1143.326319][ T3117] [ 1144.839664][ T3152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1144.852173][ T3152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1144.866135][T31263] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1145.027009][T31263] usb 4-1: Using ep0 maxpacket: 16 [ 1145.036272][T31263] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1145.051057][T31263] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1145.067525][T31263] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1145.086405][T31263] usb 4-1: config 0 descriptor?? [ 1145.529233][T31263] mcp2221 0003:04D8:00DD.0026: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 1145.636039][ T3165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1145.646742][ T3165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1145.696357][ T3165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1145.713811][ T3165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1145.733771][ T3141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1145.750126][ T3141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1145.753760][ T3165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1145.767900][ T3165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1145.889295][ T3141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1145.907563][ T3141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1145.941592][ T3141] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1145.953964][ T3141] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1145.971211][T14684] usb 4-1: USB disconnect, device number 10 [ 1146.413399][ T3215] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1146.424518][ T3215] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1146.433916][ T3215] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1146.658548][ T3230] binder: BINDER_SET_CONTEXT_MGR already set [ 1146.664716][ T3230] binder: 3228:3230 ioctl 4018620d 200000004a80 returned -16 [ 1147.209660][ T3259] openvswitch: netlink: Message has 4 unknown bytes. [ 1147.218207][ T3259] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1150.674484][T14684] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1150.816407][T14684] usb 4-1: device descriptor read/64, error -71 [ 1151.075049][T14684] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1151.285876][T14684] usb 4-1: device descriptor read/64, error -71 [ 1151.397754][T14684] usb usb4-port1: attempt power cycle [ 1151.736954][T14684] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1151.766426][T14684] usb 4-1: device descriptor read/8, error -71 [ 1151.901513][ T3341] FAULT_INJECTION: forcing a failure. [ 1151.901513][ T3341] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1151.916394][ T3341] CPU: 0 UID: 0 PID: 3341 Comm: syz.2.3843 Tainted: G L syzkaller #0 PREEMPT(full) [ 1151.916429][ T3341] Tainted: [L]=SOFTLOCKUP [ 1151.916437][ T3341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1151.916449][ T3341] Call Trace: [ 1151.916457][ T3341] [ 1151.916466][ T3341] dump_stack_lvl+0x189/0x250 [ 1151.916493][ T3341] ? __pfx____ratelimit+0x10/0x10 [ 1151.916521][ T3341] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1151.916542][ T3341] ? __pfx__printk+0x10/0x10 [ 1151.916573][ T3341] should_fail_ex+0x414/0x560 [ 1151.916603][ T3341] _copy_to_user+0x31/0xb0 [ 1151.916626][ T3341] simple_read_from_buffer+0xe1/0x170 [ 1151.916651][ T3341] proc_fail_nth_read+0x1b3/0x220 [ 1151.916672][ T3341] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1151.916694][ T3341] ? rw_verify_area+0x2a6/0x4d0 [ 1151.916719][ T3341] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1151.916739][ T3341] vfs_read+0x200/0xa30 [ 1151.916755][ T3341] ? fdget_pos+0x247/0x320 [ 1151.916780][ T3341] ? __pfx___mutex_lock+0x10/0x10 [ 1151.916799][ T3341] ? __pfx_vfs_read+0x10/0x10 [ 1151.916818][ T3341] ? __fget_files+0x2a/0x420 [ 1151.916843][ T3341] ? __fget_files+0x3a0/0x420 [ 1151.916863][ T3341] ? __fget_files+0x2a/0x420 [ 1151.916891][ T3341] ksys_read+0x145/0x250 [ 1151.916910][ T3341] ? __pfx_ksys_read+0x10/0x10 [ 1151.916931][ T3341] ? do_syscall_64+0xbe/0xf80 [ 1151.916954][ T3341] do_syscall_64+0xfa/0xf80 [ 1151.916974][ T3341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1151.916992][ T3341] ? clear_bhb_loop+0x60/0xb0 [ 1151.917013][ T3341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1151.917031][ T3341] RIP: 0033:0x7f86de98e15c [ 1151.917047][ T3341] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1151.917063][ T3341] RSP: 002b:00007f86df825030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1151.917091][ T3341] RAX: ffffffffffffffda RBX: 00007f86debe5fa0 RCX: 00007f86de98e15c [ 1151.917104][ T3341] RDX: 000000000000000f RSI: 00007f86df8250a0 RDI: 0000000000000003 [ 1151.917117][ T3341] RBP: 00007f86df825090 R08: 0000000000000000 R09: 0000000000000000 [ 1151.917128][ T3341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1151.917139][ T3341] R13: 00007f86debe6038 R14: 00007f86debe5fa0 R15: 00007f86ded0fa28 [ 1151.917171][ T3341] [ 1152.295941][T14684] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1152.316266][T14684] usb 4-1: device descriptor read/8, error -71 [ 1152.426063][T14684] usb usb4-port1: unable to enumerate USB device [ 1152.633137][ T3363] FAULT_INJECTION: forcing a failure. [ 1152.633137][ T3363] name failslab, interval 1, probability 0, space 0, times 0 [ 1152.727788][ T3363] CPU: 1 UID: 0 PID: 3363 Comm: syz.2.3849 Tainted: G L syzkaller #0 PREEMPT(full) [ 1152.727820][ T3363] Tainted: [L]=SOFTLOCKUP [ 1152.727828][ T3363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1152.727839][ T3363] Call Trace: [ 1152.727848][ T3363] [ 1152.727880][ T3363] dump_stack_lvl+0x189/0x250 [ 1152.727907][ T3363] ? __pfx____ratelimit+0x10/0x10 [ 1152.727934][ T3363] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1152.727956][ T3363] ? __pfx__printk+0x10/0x10 [ 1152.727987][ T3363] ? __pfx___might_resched+0x10/0x10 [ 1152.728006][ T3363] ? fs_reclaim_acquire+0x7d/0x100 [ 1152.728031][ T3363] should_fail_ex+0x414/0x560 [ 1152.728065][ T3363] should_failslab+0xa8/0x100 [ 1152.728087][ T3363] kmem_cache_alloc_noprof+0x88/0x710 [ 1152.728111][ T3363] ? alloc_vfsmnt+0x23/0x430 [ 1152.728130][ T3363] alloc_vfsmnt+0x23/0x430 [ 1152.728153][ T3363] clone_mnt+0x4b/0x9a0 [ 1152.728172][ T3363] copy_tree+0xde/0x930 [ 1152.728187][ T3363] ? __pfx_down_write+0x10/0x10 [ 1152.728213][ T3363] ? alloc_mnt_ns+0x218/0x2c0 [ 1152.728231][ T3363] copy_mnt_ns+0x11f/0x7c0 [ 1152.728247][ T3363] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 1152.728265][ T3363] ? kmem_cache_alloc_noprof+0x3ce/0x710 [ 1152.728285][ T3363] ? create_new_namespaces+0x33/0x6a0 [ 1152.728302][ T3363] create_new_namespaces+0xcf/0x6a0 [ 1152.728320][ T3363] ? bpf_lsm_capable+0x9/0x20 [ 1152.728336][ T3363] ? security_capable+0x7e/0x2e0 [ 1152.728357][ T3363] unshare_nsproxy_namespaces+0x11c/0x170 [ 1152.728373][ T3363] ksys_unshare+0x4c8/0x8c0 [ 1152.728396][ T3363] ? __pfx_ksys_unshare+0x10/0x10 [ 1152.728411][ T3363] ? ksys_write+0x1e1/0x250 [ 1152.728426][ T3363] ? __pfx_ksys_write+0x10/0x10 [ 1152.728445][ T3363] __x64_sys_unshare+0x38/0x50 [ 1152.728462][ T3363] do_syscall_64+0xfa/0xf80 [ 1152.728477][ T3363] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.728491][ T3363] ? clear_bhb_loop+0x60/0xb0 [ 1152.728507][ T3363] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1152.728521][ T3363] RIP: 0033:0x7f86de98f749 [ 1152.728534][ T3363] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1152.728547][ T3363] RSP: 002b:00007f86df7e3038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 1152.728562][ T3363] RAX: ffffffffffffffda RBX: 00007f86debe6180 RCX: 00007f86de98f749 [ 1152.728573][ T3363] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002a020480 [ 1152.728581][ T3363] RBP: 00007f86df7e3090 R08: 0000000000000000 R09: 0000000000000000 [ 1152.728590][ T3363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1152.728598][ T3363] R13: 00007f86debe6218 R14: 00007f86debe6180 R15: 00007f86ded0fa28 [ 1152.728621][ T3363] [ 1153.509843][ T3373] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3852'. [ 1153.608976][ T3382] FAULT_INJECTION: forcing a failure. [ 1153.608976][ T3382] name failslab, interval 1, probability 0, space 0, times 0 [ 1153.623112][ T3382] CPU: 1 UID: 0 PID: 3382 Comm: syz.0.3855 Tainted: G L syzkaller #0 PREEMPT(full) [ 1153.623141][ T3382] Tainted: [L]=SOFTLOCKUP [ 1153.623148][ T3382] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1153.623159][ T3382] Call Trace: [ 1153.623167][ T3382] [ 1153.623175][ T3382] dump_stack_lvl+0x189/0x250 [ 1153.623201][ T3382] ? __pfx____ratelimit+0x10/0x10 [ 1153.623228][ T3382] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1153.623248][ T3382] ? __pfx__printk+0x10/0x10 [ 1153.623277][ T3382] ? __pfx___might_resched+0x10/0x10 [ 1153.623294][ T3382] ? fs_reclaim_acquire+0x7d/0x100 [ 1153.623318][ T3382] should_fail_ex+0x414/0x560 [ 1153.623349][ T3382] should_failslab+0xa8/0x100 [ 1153.623372][ T3382] __kmalloc_noprof+0xdf/0x800 [ 1153.623389][ T3382] ? tomoyo_encode+0x28b/0x550 [ 1153.623417][ T3382] tomoyo_encode+0x28b/0x550 [ 1153.623445][ T3382] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1153.623478][ T3382] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1153.623497][ T3382] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1153.623520][ T3382] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1153.623556][ T3382] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1153.623594][ T3382] ? __fget_files+0x2a/0x420 [ 1153.623620][ T3382] ? __fget_files+0x3a0/0x420 [ 1153.623640][ T3382] ? __fget_files+0x2a/0x420 [ 1153.623665][ T3382] security_file_ioctl+0xcb/0x2d0 [ 1153.623684][ T3382] __se_sys_ioctl+0x47/0x170 [ 1153.623712][ T3382] do_syscall_64+0xfa/0xf80 [ 1153.623732][ T3382] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1153.623751][ T3382] ? clear_bhb_loop+0x60/0xb0 [ 1153.623772][ T3382] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1153.623788][ T3382] RIP: 0033:0x7fcae2d8f749 [ 1153.623805][ T3382] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1153.623820][ T3382] RSP: 002b:00007fcae3bfe038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1153.623839][ T3382] RAX: ffffffffffffffda RBX: 00007fcae2fe5fa0 RCX: 00007fcae2d8f749 [ 1153.623853][ T3382] RDX: 0000000000000000 RSI: 00000000c2604110 RDI: 0000000000000003 [ 1153.623864][ T3382] RBP: 00007fcae3bfe090 R08: 0000000000000000 R09: 0000000000000000 [ 1153.623879][ T3382] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1153.623890][ T3382] R13: 00007fcae2fe6038 R14: 00007fcae2fe5fa0 R15: 00007fcae310fa28 [ 1153.623920][ T3382] [ 1153.623963][ T3382] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1154.058809][ T3387] syzkaller0: entered promiscuous mode [ 1154.064347][ T3387] syzkaller0: entered allmulticast mode [ 1154.367403][ T3417] netlink: 'syz.1.3860': attribute type 10 has an invalid length. [ 1154.400408][ T3419] netlink: 'syz.4.3857': attribute type 10 has an invalid length. [ 1154.436493][ T3417] batman_adv: batadv0: Adding interface: netdevsim0 [ 1154.447944][ T3417] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1154.481532][ T3417] batman_adv: batadv0: Interface activated: netdevsim0 [ 1154.574518][ T3428] FAULT_INJECTION: forcing a failure. [ 1154.574518][ T3428] name failslab, interval 1, probability 0, space 0, times 0 [ 1154.603633][ T3428] CPU: 1 UID: 0 PID: 3428 Comm: syz.2.3861 Tainted: G L syzkaller #0 PREEMPT(full) [ 1154.603663][ T3428] Tainted: [L]=SOFTLOCKUP [ 1154.603670][ T3428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1154.603679][ T3428] Call Trace: [ 1154.603687][ T3428] [ 1154.603695][ T3428] dump_stack_lvl+0x189/0x250 [ 1154.603721][ T3428] ? __pfx____ratelimit+0x10/0x10 [ 1154.603747][ T3428] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1154.603766][ T3428] ? __pfx__printk+0x10/0x10 [ 1154.603792][ T3428] ? __pfx___might_resched+0x10/0x10 [ 1154.603810][ T3428] ? fs_reclaim_acquire+0x7d/0x100 [ 1154.603832][ T3428] should_fail_ex+0x414/0x560 [ 1154.603862][ T3428] should_failslab+0xa8/0x100 [ 1154.603888][ T3428] kmem_cache_alloc_noprof+0x88/0x710 [ 1154.603919][ T3428] ? vm_area_dup+0x2b/0x680 [ 1154.603940][ T3428] vm_area_dup+0x2b/0x680 [ 1154.603960][ T3428] copy_vma+0x4c5/0x920 [ 1154.603990][ T3428] ? __pfx_copy_vma+0x10/0x10 [ 1154.604014][ T3428] ? __vma_start_write+0x23/0x140 [ 1154.604036][ T3428] ? move_vma+0x689/0x1840 [ 1154.604056][ T3428] move_vma+0x814/0x1840 [ 1154.604081][ T3428] ? __pfx_move_vma+0x10/0x10 [ 1154.604097][ T3428] ? mm_get_unmapped_area+0xd4/0x100 [ 1154.604115][ T3428] ? cap_mmap_addr+0xb0/0x100 [ 1154.604127][ T3428] ? bpf_lsm_mmap_addr+0x9/0x20 [ 1154.604146][ T3428] mremap_to+0x6ce/0x790 [ 1154.604161][ T3428] ? mtree_load+0x101/0x6f0 [ 1154.604171][ T3428] ? __pfx_mremap_to+0x10/0x10 [ 1154.604182][ T3428] ? may_expand_vm+0x1af/0x2f0 [ 1154.604193][ T3428] ? check_prep_vma+0x8bb/0xb00 [ 1154.604210][ T3428] __se_sys_mremap+0xd45/0xfb0 [ 1154.604227][ T3428] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1154.604244][ T3428] ? __pfx___se_sys_mremap+0x10/0x10 [ 1154.604259][ T3428] ? fput+0xa0/0xd0 [ 1154.604271][ T3428] ? ksys_write+0x22a/0x250 [ 1154.604282][ T3428] ? __pfx_ksys_write+0x10/0x10 [ 1154.604293][ T3428] ? do_syscall_64+0xbe/0xf80 [ 1154.604302][ T3428] ? __x64_sys_mremap+0x20/0xc0 [ 1154.604315][ T3428] do_syscall_64+0xfa/0xf80 [ 1154.604325][ T3428] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1154.604335][ T3428] ? clear_bhb_loop+0x60/0xb0 [ 1154.604347][ T3428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1154.604356][ T3428] RIP: 0033:0x7f86de98f749 [ 1154.604367][ T3428] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1154.604376][ T3428] RSP: 002b:00007f86df825038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1154.604388][ T3428] RAX: ffffffffffffffda RBX: 00007f86debe5fa0 RCX: 00007f86de98f749 [ 1154.604396][ T3428] RDX: 0000000000003000 RSI: 0000000000001000 RDI: 0000200000b89000 [ 1154.604403][ T3428] RBP: 00007f86df825090 R08: 00002000006e6000 R09: 0000000000000000 [ 1154.604409][ T3428] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 1154.604416][ T3428] R13: 00007f86debe6038 R14: 00007f86debe5fa0 R15: 00007f86ded0fa28 [ 1154.604432][ T3428] [ 1155.262438][T31715] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1155.419360][T31715] usb 4-1: too many endpoints for config 4 interface 0 altsetting 0: 101, using maximum allowed: 30 [ 1155.430311][T31715] usb 4-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0x51, changing to 0x1 [ 1155.444528][T31715] usb 4-1: config 4 interface 0 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1155.464280][T31715] usb 4-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 101 [ 1155.635798][T31715] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1155.776141][T31715] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1155.993771][ T3433] futex_wake_op: syz.3.3863 tries to shift op by -1; fix this program [ 1156.036781][ T3458] futex_wake_op: syz.3.3863 tries to shift op by -1; fix this program [ 1156.083340][T31715] ath6kl: Failed to submit usb control message: -71 [ 1156.111168][T31715] ath6kl: unable to send the bmi data to the device: -71 [ 1156.123532][T31715] ath6kl: Unable to send get target info: -71 [ 1156.158952][T31715] ath6kl: Failed to init ath6kl core: -71 [ 1156.179930][T31715] ath6kl_usb 4-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 1156.258474][T31715] usb 4-1: USB disconnect, device number 15 [ 1156.578084][ T3471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1156.598158][ T3471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1158.109794][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 1158.110153][ T30] audit: type=1326 audit(1765894318.908:568): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729f98f749 code=0x7ffc0000 [ 1158.172427][ T30] audit: type=1326 audit(1765894318.938:569): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f729f98f749 code=0x7ffc0000 [ 1158.210235][T27291] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.221279][ T6242] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.233335][ T6242] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.284637][ T3507] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3875'. [ 1158.296251][ T30] audit: type=1326 audit(1765894318.938:570): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729f98f749 code=0x7ffc0000 [ 1158.337162][ T30] audit: type=1326 audit(1765894318.938:571): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f729f98f749 code=0x7ffc0000 [ 1158.355248][ T6242] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1158.603150][ T30] audit: type=1326 audit(1765894318.938:572): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729f98f749 code=0x7ffc0000 [ 1158.648689][ T30] audit: type=1326 audit(1765894318.938:573): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f729f98f749 code=0x7ffc0000 [ 1158.672844][ T30] audit: type=1326 audit(1765894318.938:574): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f729f98f749 code=0x7ffc0000 [ 1158.703891][ T30] audit: type=1326 audit(1765894318.938:575): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f729f9915dc code=0x7ffc0000 [ 1158.762810][ T30] audit: type=1326 audit(1765894318.938:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f729f991514 code=0x7ffc0000 [ 1158.805915][ T30] audit: type=1326 audit(1765894318.938:577): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3505 comm="syz.3.3876" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f729f991514 code=0x7ffc0000 [ 1158.897846][ T3521] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3879'. [ 1158.977416][ T3526] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3880'. [ 1159.483258][ C1] hrtimer: interrupt took 191377511 ns [ 1160.276454][ T3543] xt_hashlimit: size too large, truncated to 1048576 [ 1160.589544][ T3554] Cannot find add_set index 46338 as target [ 1162.776935][ T3623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1162.788801][ T3623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1165.709311][ T3677] xt_hashlimit: size too large, truncated to 1048576 [ 1167.121848][T27291] bridge_slave_1: left allmulticast mode [ 1167.129703][T27291] bridge_slave_1: left promiscuous mode [ 1167.140642][T27291] bridge0: port 2(bridge_slave_1) entered disabled state [ 1167.178996][T27291] bridge_slave_0: left allmulticast mode [ 1167.185016][T27291] bridge_slave_0: left promiscuous mode [ 1167.195684][T27291] bridge0: port 1(bridge_slave_0) entered disabled state [ 1167.900508][T20761] usb 4-1: new low-speed USB device number 16 using dummy_hcd [ 1168.034341][ T3740] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1168.077436][T20761] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1168.086185][ T3740] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1168.095756][T20761] usb 4-1: config 1 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1168.113697][T20761] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1168.140610][T20761] usb 4-1: string descriptor 0 read error: -22 [ 1168.167507][T20761] usb 4-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.40 [ 1168.222390][T20761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1168.462986][ T3755] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3918'. [ 1169.022526][T20761] usbhid 4-1:1.0: can't add hid device: -71 [ 1169.033465][T20761] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 1169.068084][T20761] usb 4-1: USB disconnect, device number 16 [ 1169.358097][ T3774] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3921'. [ 1169.583945][T27291] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1169.604707][T27291] bond_slave_0: left promiscuous mode [ 1169.614385][T27291] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1169.626711][T27291] bond_slave_1: left promiscuous mode [ 1169.634642][T27291] bond0 (unregistering): Released all slaves [ 1169.653779][T27291] bond1 (unregistering): Released all slaves [ 1169.737361][ T3775] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3921'. [ 1169.781673][T27291] tipc: Left network mode [ 1170.293605][ T3806] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1170.309743][ T3806] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1171.586950][ T3841] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3929'. [ 1171.600683][ T3841] bond0: entered promiscuous mode [ 1171.644284][ T3841] bond_slave_0: entered promiscuous mode [ 1171.821144][ T3841] bond_slave_1: entered promiscuous mode [ 1171.844418][ T3841] gretap0: entered promiscuous mode [ 1171.872087][ T3841] hsr1: entered promiscuous mode [ 1171.928112][T27291] hsr_slave_0: left promiscuous mode [ 1172.074404][T27291] veth1_macvtap: left promiscuous mode [ 1172.098317][T27291] veth0_macvtap: left promiscuous mode [ 1172.128250][T27291] veth1_vlan: left allmulticast mode [ 1172.159791][T27291] veth1_vlan: left promiscuous mode [ 1172.223172][T27291] veth0_vlan: left promiscuous mode [ 1172.830657][T27291] macvlan1 (unregistering): left promiscuous mode [ 1172.859817][T27291] team0 (unregistering): Port device macvlan1 removed [ 1174.169079][T27291] team_slave_1 (unregistering): left promiscuous mode [ 1174.189990][T27291] team0 (unregistering): Port device team_slave_1 removed [ 1174.310094][T27291] team_slave_0 (unregistering): left promiscuous mode [ 1174.322066][T27291] team0 (unregistering): Port device team_slave_0 removed [ 1175.461241][ T3901] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3939'. [ 1175.621005][ T3896] binder: BINDER_SET_CONTEXT_MGR already set [ 1175.628844][ T3896] binder: 3895:3896 ioctl 4018620d 200000000040 returned -16 [ 1175.638268][ T3896] binder: 3895:3896 ioctl 8933 200000000400 returned -22 [ 1175.687097][T20761] IPVS: starting estimator thread 0... [ 1175.692850][ T3498] IPVS: starting estimator thread 0... [ 1175.785899][ T3905] IPVS: using max 38 ests per chain, 91200 per kthread [ 1175.940086][ T3902] IPVS: using max 51 ests per chain, 122400 per kthread [ 1177.390026][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.406845][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.662615][ T3939] netlink: 72 bytes leftover after parsing attributes in process `syz.3.3949'. [ 1177.991670][T27291] IPVS: stop unused estimator thread 0... [ 1178.271397][ T3958] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3951'. [ 1178.283483][ T3958] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3951'. [ 1178.791655][ T3976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1178.802708][ T3976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1178.940144][ T3976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1179.000935][ T3976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1179.305847][ T911] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1179.467496][ T911] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1179.477694][ T911] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1179.488748][ T911] usb 4-1: New USB device found, idVendor=0471, idProduct=0329, bcdDevice=db.da [ 1179.506594][ T911] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1179.529239][ T911] usb 4-1: config 0 descriptor?? [ 1180.532032][ T4010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1180.554909][ T4010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1180.643361][ T4010] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1180.667765][ T4010] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3958'. [ 1181.510832][ T911] usb 4-1: USB disconnect, device number 17 [ 1181.682096][ T4038] fuse: Bad value for 'fd' [ 1181.749728][ T4044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1181.766725][ T4044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1181.785056][ T4044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1181.827216][ T4044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1181.894451][ T4044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1181.896510][ T911] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1181.944655][ T4044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1182.065667][ T911] usb 4-1: Using ep0 maxpacket: 8 [ 1182.102630][ T911] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1182.128966][ T911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1182.174436][ T911] usb 4-1: Product: syz [ 1182.191953][ T911] usb 4-1: Manufacturer: syz [ 1182.205227][ T4055] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3964'. [ 1182.218202][ T911] usb 4-1: SerialNumber: syz [ 1182.239766][ T911] usb 4-1: config 0 descriptor?? [ 1182.474224][ T911] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1183.100830][ T4032] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3960'. [ 1183.110128][ T911] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1183.166425][ T4032] macvlan2: entered promiscuous mode [ 1183.200633][ T4032] bond0: entered promiscuous mode [ 1183.218351][ T4032] bond_slave_0: entered promiscuous mode [ 1183.240662][ T4032] bond_slave_1: entered promiscuous mode [ 1183.262478][ T4032] mac80211_hwsim hwsim21 wlan1: entered promiscuous mode [ 1183.271767][ T4078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1183.318361][ T4032] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1183.358940][ T4078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1183.397152][ T911] usb 4-1: USB disconnect, device number 18 [ 1183.553527][ T4094] FAULT_INJECTION: forcing a failure. [ 1183.553527][ T4094] name failslab, interval 1, probability 0, space 0, times 0 [ 1183.610644][ T4094] CPU: 1 UID: 0 PID: 4094 Comm: syz.2.3971 Tainted: G L syzkaller #0 PREEMPT(full) [ 1183.610672][ T4094] Tainted: [L]=SOFTLOCKUP [ 1183.610678][ T4094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1183.610689][ T4094] Call Trace: [ 1183.610696][ T4094] [ 1183.610704][ T4094] dump_stack_lvl+0x189/0x250 [ 1183.610729][ T4094] ? __pfx____ratelimit+0x10/0x10 [ 1183.610754][ T4094] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1183.610774][ T4094] ? __pfx__printk+0x10/0x10 [ 1183.610799][ T4094] ? __pfx___might_resched+0x10/0x10 [ 1183.610813][ T4094] should_fail_ex+0x414/0x560 [ 1183.610831][ T4094] should_failslab+0xa8/0x100 [ 1183.610844][ T4094] __kmalloc_noprof+0xdf/0x800 [ 1183.610854][ T4094] ? kfree+0x4d/0x660 [ 1183.610869][ T4094] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1183.610885][ T4094] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1183.610898][ T4094] ? tomoyo_domain+0xd8/0x130 [ 1183.610913][ T4094] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1183.610924][ T4094] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1183.610936][ T4094] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1183.610955][ T4094] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 1183.610975][ T4094] ? __fget_files+0x2a/0x420 [ 1183.610990][ T4094] ? __fget_files+0x3a0/0x420 [ 1183.611000][ T4094] ? __fget_files+0x2a/0x420 [ 1183.611014][ T4094] security_file_ioctl+0xcb/0x2d0 [ 1183.611026][ T4094] __se_sys_ioctl+0x47/0x170 [ 1183.611044][ T4094] do_syscall_64+0xfa/0xf80 [ 1183.611055][ T4094] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1183.611066][ T4094] ? clear_bhb_loop+0x60/0xb0 [ 1183.611078][ T4094] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1183.611087][ T4094] RIP: 0033:0x7f86de98f749 [ 1183.611097][ T4094] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1183.611106][ T4094] RSP: 002b:00007f86df825038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1183.611119][ T4094] RAX: ffffffffffffffda RBX: 00007f86debe5fa0 RCX: 00007f86de98f749 [ 1183.611126][ T4094] RDX: 0000200000001cc0 RSI: 00000000000007ac RDI: 0000000000000003 [ 1183.611133][ T4094] RBP: 00007f86df825090 R08: 0000000000000000 R09: 0000000000000000 [ 1183.611139][ T4094] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1183.611145][ T4094] R13: 00007f86debe6038 R14: 00007f86debe5fa0 R15: 00007f86ded0fa28 [ 1183.611161][ T4094] [ 1183.611182][ T4094] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1184.485716][ T911] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1184.656525][ T911] usb 4-1: config 0 has no interfaces? [ 1184.677993][ T911] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1184.687427][ T911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1184.696076][ T911] usb 4-1: Product: syz [ 1184.700590][ T911] usb 4-1: Manufacturer: syz [ 1184.714999][ T911] usb 4-1: SerialNumber: syz [ 1184.830235][ T911] usb 4-1: config 0 descriptor?? [ 1185.387619][ T4133] xt_hashlimit: size too large, truncated to 1048576 [ 1186.004470][ T4146] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3980'. [ 1186.130992][ T4149] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3973'. [ 1187.093776][ T4165] loop6: detected capacity change from 0 to 2560 [ 1187.100735][ T4165] buffer_io_error: 10 callbacks suppressed [ 1187.100746][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.119536][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.128341][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.136538][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.147926][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.327692][ T4171] syzkaller0: entered promiscuous mode [ 1187.334861][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.385684][ T4171] syzkaller0: entered allmulticast mode [ 1187.395679][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.403653][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.422101][ T4165] ldm_validate_partition_table(): Disk read failed. [ 1187.429013][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.708383][ T4165] Buffer I/O error on dev loop6, logical block 0, async page read [ 1187.788540][ T4165] Dev loop6: unable to read RDB block 0 [ 1187.918055][ T4165] loop6: unable to read partition table [ 1187.969627][ T4165] loop_reread_partitions: partition scan of loop6 (3 ) failed (rc=-5) [ 1188.095596][T14684] usb 4-1: USB disconnect, device number 19 [ 1189.138024][ T4228] xt_hashlimit: size too large, truncated to 1048576 [ 1189.215368][ T4233] FAULT_INJECTION: forcing a failure. [ 1189.215368][ T4233] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1189.233725][ T4233] CPU: 0 UID: 0 PID: 4233 Comm: syz.4.3994 Tainted: G L syzkaller #0 PREEMPT(full) [ 1189.233756][ T4233] Tainted: [L]=SOFTLOCKUP [ 1189.233764][ T4233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1189.233775][ T4233] Call Trace: [ 1189.233783][ T4233] [ 1189.233791][ T4233] dump_stack_lvl+0x189/0x250 [ 1189.233818][ T4233] ? __pfx____ratelimit+0x10/0x10 [ 1189.233844][ T4233] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1189.233862][ T4233] ? __pfx__printk+0x10/0x10 [ 1189.233886][ T4233] ? __might_fault+0xb0/0x130 [ 1189.233918][ T4233] should_fail_ex+0x414/0x560 [ 1189.233947][ T4233] _copy_from_iter+0x1cd/0x1630 [ 1189.233970][ T4233] ? __build_skb_around+0x22d/0x3c0 [ 1189.233995][ T4233] ? __pfx__copy_from_iter+0x10/0x10 [ 1189.234011][ T4233] ? __alloc_skb+0x2f1/0x430 [ 1189.234031][ T4233] ? __pfx___alloc_skb+0x10/0x10 [ 1189.234051][ T4233] ? netlink_sendmsg+0x642/0xb30 [ 1189.234071][ T4233] ? skb_put+0x11b/0x210 [ 1189.234094][ T4233] netlink_sendmsg+0x6b2/0xb30 [ 1189.234124][ T4233] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1189.234149][ T4233] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1189.234174][ T4233] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1189.234191][ T4233] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1189.234214][ T4233] __sock_sendmsg+0x21c/0x270 [ 1189.234242][ T4233] ____sys_sendmsg+0x505/0x820 [ 1189.234269][ T4233] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1189.234298][ T4233] ? import_iovec+0x74/0xa0 [ 1189.234322][ T4233] ___sys_sendmsg+0x21f/0x2a0 [ 1189.234346][ T4233] ? __pfx____sys_sendmsg+0x10/0x10 [ 1189.234373][ T4233] ? rcu_read_lock_any_held+0xb3/0x120 [ 1189.234421][ T4233] ? __fget_files+0x2a/0x420 [ 1189.234442][ T4233] ? __fget_files+0x3a0/0x420 [ 1189.234484][ T4233] __x64_sys_sendmsg+0x19b/0x260 [ 1189.234508][ T4233] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1189.234538][ T4233] ? __pfx_ksys_write+0x10/0x10 [ 1189.234559][ T4233] ? do_syscall_64+0xbe/0xf80 [ 1189.234582][ T4233] do_syscall_64+0xfa/0xf80 [ 1189.234599][ T4233] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.234616][ T4233] ? clear_bhb_loop+0x60/0xb0 [ 1189.234637][ T4233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1189.234655][ T4233] RIP: 0033:0x7f362a58f749 [ 1189.234672][ T4233] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1189.234688][ T4233] RSP: 002b:00007f362b47d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1189.234712][ T4233] RAX: ffffffffffffffda RBX: 00007f362a7e5fa0 RCX: 00007f362a58f749 [ 1189.234725][ T4233] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1189.234738][ T4233] RBP: 00007f362b47d090 R08: 0000000000000000 R09: 0000000000000000 [ 1189.234750][ T4233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1189.234761][ T4233] R13: 00007f362a7e6038 R14: 00007f362a7e5fa0 R15: 00007f362a90fa28 [ 1189.234791][ T4233] [ 1189.659211][ T4240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1189.680285][ T4240] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1190.481085][ T4252] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1190.493262][ T4252] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1190.538494][ T4252] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3999'. [ 1192.834072][ T4294] fuse: Unknown parameter 'group_idB00000000000000000000' [ 1192.916654][ T4297] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4006'. [ 1192.940550][ T4297] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4006'. [ 1193.142258][ T4304] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4007'. [ 1193.531589][ T4308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1193.546840][ T4308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1193.970009][ T4313] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4009'. [ 1194.080898][ T4316] macvlan2: entered promiscuous mode [ 1194.100906][ T4316] macvlan2: entered allmulticast mode [ 1194.244680][ T4353] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1194.277572][ T4353] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1194.289558][ T4353] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1194.595863][T20761] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1194.624276][ T4383] netlink: 'syz.0.4017': attribute type 1 has an invalid length. [ 1194.682045][ T4383] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1194.719528][ T4418] vlan3: entered allmulticast mode [ 1194.724758][ T4418] veth0_to_bond: entered allmulticast mode [ 1194.765803][T20761] usb 4-1: Using ep0 maxpacket: 32 [ 1194.772375][ T4418] bond2: (slave vlan3): making interface the new active one [ 1194.774381][T20761] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 173, changing to 11 [ 1194.796476][T20761] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 49664, setting to 1024 [ 1194.808543][T20761] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1194.822175][T20761] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1194.827439][ T4418] bond2: (slave vlan3): Enslaving as an active interface with an up link [ 1194.841796][T20761] usb 4-1: config 0 descriptor?? [ 1195.411982][T20761] savu 0003:1E7D:2D5A.0027: unknown main item tag 0x0 [ 1195.419134][T20761] savu 0003:1E7D:2D5A.0027: unknown main item tag 0x0 [ 1195.426053][T20761] savu 0003:1E7D:2D5A.0027: unknown main item tag 0x0 [ 1195.433545][T20761] savu 0003:1E7D:2D5A.0027: unknown main item tag 0x0 [ 1195.443789][T20761] savu 0003:1E7D:2D5A.0027: unknown main item tag 0x2 [ 1195.450941][T20761] savu 0003:1E7D:2D5A.0027: unbalanced collection at end of report description [ 1195.490732][T20761] savu 0003:1E7D:2D5A.0027: parse failed [ 1195.499894][T20761] savu 0003:1E7D:2D5A.0027: probe with driver savu failed with error -22 [ 1196.354804][ T1027] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.370932][ T1027] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.407674][ T1027] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.420661][ T1027] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1196.452398][ T4455] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4022'. [ 1197.664483][ T5920] usb 4-1: USB disconnect, device number 20 [ 1198.215686][ T1330] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1198.235664][ T1330] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1198.313121][ T4510] FAULT_INJECTION: forcing a failure. [ 1198.313121][ T4510] name failslab, interval 1, probability 0, space 0, times 0 [ 1198.446425][ T4510] CPU: 0 UID: 0 PID: 4510 Comm: syz.2.4031 Tainted: G L syzkaller #0 PREEMPT(full) [ 1198.446447][ T4510] Tainted: [L]=SOFTLOCKUP [ 1198.446451][ T4510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1198.446457][ T4510] Call Trace: [ 1198.446463][ T4510] [ 1198.446468][ T4510] dump_stack_lvl+0x189/0x250 [ 1198.446485][ T4510] ? __pfx____ratelimit+0x10/0x10 [ 1198.446501][ T4510] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1198.446512][ T4510] ? __pfx__printk+0x10/0x10 [ 1198.446527][ T4510] ? __pfx___might_resched+0x10/0x10 [ 1198.446539][ T4510] ? fs_reclaim_acquire+0x7d/0x100 [ 1198.446559][ T4510] should_fail_ex+0x414/0x560 [ 1198.446589][ T4510] should_failslab+0xa8/0x100 [ 1198.446610][ T4510] kmem_cache_alloc_node_noprof+0x8c/0x720 [ 1198.446637][ T4510] ? __alloc_skb+0x255/0x430 [ 1198.446653][ T4510] ? napi_skb_cache_get+0x4a5/0x780 [ 1198.446669][ T4510] ? napi_skb_cache_get+0x151/0x780 [ 1198.446690][ T4510] __alloc_skb+0x255/0x430 [ 1198.446711][ T4510] ? __pfx___alloc_skb+0x10/0x10 [ 1198.446734][ T4510] ? netlink_ack_tlv_len+0x6c/0x210 [ 1198.446748][ T4510] netlink_ack+0x146/0xa50 [ 1198.446758][ T4510] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1198.446776][ T4510] ? ref_tracker_free+0x63a/0x7d0 [ 1198.446787][ T4510] ? __asan_memcpy+0x40/0x70 [ 1198.446795][ T4510] ? __pfx_ref_tracker_free+0x10/0x10 [ 1198.446810][ T4510] netlink_rcv_skb+0x28c/0x470 [ 1198.446822][ T4510] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1198.446833][ T4510] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1198.446851][ T4510] ? netlink_deliver_tap+0x2e/0x1b0 [ 1198.446867][ T4510] netlink_unicast+0x82f/0x9e0 [ 1198.446894][ T4510] ? __pfx_netlink_unicast+0x10/0x10 [ 1198.446916][ T4510] ? netlink_sendmsg+0x642/0xb30 [ 1198.446935][ T4510] ? skb_put+0x11b/0x210 [ 1198.446953][ T4510] netlink_sendmsg+0x805/0xb30 [ 1198.446969][ T4510] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1198.446983][ T4510] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1198.446997][ T4510] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1198.447007][ T4510] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1198.447021][ T4510] __sock_sendmsg+0x21c/0x270 [ 1198.447037][ T4510] ____sys_sendmsg+0x505/0x820 [ 1198.447052][ T4510] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1198.447068][ T4510] ? import_iovec+0x74/0xa0 [ 1198.447081][ T4510] ___sys_sendmsg+0x21f/0x2a0 [ 1198.447094][ T4510] ? __pfx____sys_sendmsg+0x10/0x10 [ 1198.447108][ T4510] ? rcu_read_lock_any_held+0xb3/0x120 [ 1198.447134][ T4510] ? __fget_files+0x2a/0x420 [ 1198.447146][ T4510] ? __fget_files+0x3a0/0x420 [ 1198.447163][ T4510] __x64_sys_sendmsg+0x19b/0x260 [ 1198.447175][ T4510] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1198.447191][ T4510] ? __pfx_ksys_write+0x10/0x10 [ 1198.447203][ T4510] ? do_syscall_64+0xbe/0xf80 [ 1198.447216][ T4510] do_syscall_64+0xfa/0xf80 [ 1198.447226][ T4510] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1198.447236][ T4510] ? clear_bhb_loop+0x60/0xb0 [ 1198.447248][ T4510] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1198.447257][ T4510] RIP: 0033:0x7f86de98f749 [ 1198.447268][ T4510] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1198.447277][ T4510] RSP: 002b:00007f86df825038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1198.447288][ T4510] RAX: ffffffffffffffda RBX: 00007f86debe5fa0 RCX: 00007f86de98f749 [ 1198.447299][ T4510] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 1198.447306][ T4510] RBP: 00007f86df825090 R08: 0000000000000000 R09: 0000000000000000 [ 1198.447312][ T4510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1198.447318][ T4510] R13: 00007f86debe6038 R14: 00007f86debe5fa0 R15: 00007f86ded0fa28 [ 1198.447334][ T4510] [ 1200.037165][ T4538] binder: 4537:4538 ioctl c0306201 200000000080 returned -14 [ 1200.103674][ T4541] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1200.119827][ T4541] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1200.960154][ T4559] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4040'. [ 1201.465677][ T911] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1201.637279][ T911] usb 4-1: Using ep0 maxpacket: 16 [ 1201.647246][ T911] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1201.683838][ T911] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1201.696175][ T911] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1201.714052][ T911] usb 4-1: config 0 descriptor?? [ 1202.135069][ T911] mcp2221 0003:04D8:00DD.0028: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 1202.339218][ T4573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1202.349206][ T4573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1202.383074][ T4573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1202.393056][ T4573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1202.401982][ T4573] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1202.409639][ T4573] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1202.422306][ T3499] usb 4-1: USB disconnect, device number 21 [ 1202.497615][ T4615] dlm: no locking on control device [ 1203.201413][ T4625] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4048'. [ 1203.245930][ T4627] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 1203.252482][ T4627] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1203.261067][ T4627] vhci_hcd vhci_hcd.0: Device attached [ 1203.454654][ T4637] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1203.480355][ T4637] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1203.566234][T20761] usb 40-1: SetAddress Request (2) to port 0 [ 1203.572637][T20761] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1203.813645][ T4628] vhci_hcd: connection reset by peer [ 1203.820048][T14106] vhci_hcd vhci_hcd.3: stop threads [ 1203.825470][T14106] vhci_hcd vhci_hcd.3: release socket [ 1203.831026][T14106] vhci_hcd vhci_hcd.3: disconnect device [ 1204.507640][ T4652] netlink: 'syz.3.4052': attribute type 1 has an invalid length. [ 1204.732794][ T4652] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1204.763388][ T4657] vlan2: entered allmulticast mode [ 1204.768639][ T4657] veth0_to_bond: entered allmulticast mode [ 1205.297134][ T4709] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4055'. [ 1205.329359][ T4709] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4055'. [ 1205.494368][ T4724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1205.521064][ T4724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1205.537308][ T4724] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1205.547439][ T4724] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1206.005792][ T5922] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1206.155799][ T5922] usb 4-1: Using ep0 maxpacket: 8 [ 1206.167896][ T5922] usb 4-1: config 0 has an invalid interface number: 122 but max is 0 [ 1206.186724][ T5922] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1206.336627][ T5922] usb 4-1: config 0 has no interface number 0 [ 1206.344127][ T5922] usb 4-1: config 0 interface 122 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 1206.348952][ T4776] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4060'. [ 1206.371220][ T5922] usb 4-1: config 0 interface 122 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 8 [ 1206.386029][ T4776] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4060'. [ 1206.395304][ T5922] usb 4-1: config 0 interface 122 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 8 [ 1206.422064][ T5922] usb 4-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 5.b7 [ 1206.440692][ T5922] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1206.449570][ T5922] usb 4-1: Product: syz [ 1206.457755][ T5922] usb 4-1: Manufacturer: syz [ 1206.465043][ T5922] usb 4-1: SerialNumber: syz [ 1206.482302][ T5922] usb 4-1: config 0 descriptor?? [ 1206.497618][ T4738] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 1206.710247][ T4738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1206.719846][ T4738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1206.757058][ T4784] input: syz0 as /devices/virtual/input/input71 [ 1207.241841][ T5922] usb 4-1: NFC: intf ffff88807a638000 id ffffffff8e93ede0 [ 1207.264541][ T5922] usb 4-1: USB disconnect, device number 22 [ 1207.500944][ T3657] syzkaller0: tun_net_xmit 76 [ 1207.506682][ T3657] syzkaller0: tun_net_xmit 48 [ 1207.512040][ T4805] syzkaller0: create flow: hash 1115177914 index 1 [ 1207.525946][ T3499] syzkaller0: tun_net_xmit 76 [ 1207.559616][ T4805] syzkaller0: delete flow: hash 1115177914 index 1 [ 1208.378517][ T4763] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1208.387155][T27612] Bluetooth: hci0: command 0x0c1a tx timeout [ 1208.403167][ T4763] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 1208.621086][T20761] usb 40-1: device descriptor read/8, error -110 [ 1209.028378][T20761] usb usb40-port1: attempt power cycle [ 1209.597387][T20761] usb usb40-port1: unable to enumerate USB device [ 1210.733366][ T4882] xt_hashlimit: size too large, truncated to 1048576 [ 1210.760812][ T4884] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 1210.767352][ T4884] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1210.780131][ T4884] vhci_hcd vhci_hcd.0: Device attached [ 1210.787009][ T4885] vhci_hcd: connection closed [ 1210.787226][ T436] vhci_hcd vhci_hcd.0: stop threads [ 1210.797678][ T436] vhci_hcd vhci_hcd.0: release socket [ 1210.803759][ T436] vhci_hcd vhci_hcd.0: disconnect device [ 1211.096386][ T4890] netlink: 'syz.4.4073': attribute type 1 has an invalid length. [ 1211.185205][ T4924] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1211.197815][ T4924] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 1211.227012][ T4890] bond2: (slave bridge1): Enslaving as an active interface with a down link [ 1211.237566][ T4890] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4073'. [ 1211.259272][ T4890] macvlan4: entered promiscuous mode [ 1211.264580][ T4890] macvlan4: entered allmulticast mode [ 1211.362627][ T4940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1211.372605][ T4940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1211.725718][ T5922] usb 4-1: new full-speed USB device number 23 using dummy_hcd [ 1211.888354][ T5922] usb 4-1: descriptor type invalid, skip [ 1211.894084][ T5922] usb 4-1: descriptor type invalid, skip [ 1211.910193][ T5922] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1211.920200][ T5922] usb 4-1: language id specifier not provided by device, defaulting to English [ 1211.931468][ T5922] usb 4-1: New USB device found, idVendor=056a, idProduct=0319, bcdDevice= 0.40 [ 1211.941159][ T5922] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1211.949511][ T5922] usb 4-1: Product: Г [ 1211.953755][ T5922] usb 4-1: SerialNumber: 榔ↈᝨ䁐躵޺鋜戾ॽ [ 1212.057318][ T4966] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4079'. [ 1212.070504][ T4966] netlink: 'syz.4.4079': attribute type 29 has an invalid length. [ 1212.078531][ T4966] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4079'. [ 1212.097130][ T4966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1212.106395][ T4966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1214.540519][ T5922] usbhid 4-1:1.0: can't add hid device: -71 [ 1214.550943][ T5922] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 1214.578992][ T5922] usb 4-1: USB disconnect, device number 23 [ 1215.977161][ T5030] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4091'. [ 1217.996817][ T5062] netlink: 'syz.1.4098': attribute type 3 has an invalid length. [ 1218.026154][ T5062] netlink: 666 bytes leftover after parsing attributes in process `syz.1.4098'. [ 1218.133817][ T5064] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1218.974648][ T5078] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4102'. [ 1219.698170][ T5106] netlink: 'syz.1.4106': attribute type 10 has an invalid length. [ 1219.738961][ T5106] 8021q: adding VLAN 0 to HW filter on device team0 [ 1219.764641][ T5106] bond0: (slave team0): Enslaving as an active interface with an up link [ 1219.976997][ T5110] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4107'. [ 1220.720743][ T5137] input: syz0 as /devices/virtual/input/input72 [ 1221.335686][ T911] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1221.340534][ T5161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1221.354802][ T5161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1221.510399][ T911] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1221.525698][ T911] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1221.556486][ T911] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1221.577764][ T911] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1221.625049][ T911] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1221.638031][ T911] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1221.650350][ T911] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1221.661431][ T911] usb 4-1: Product: syz [ 1221.666129][ T911] usb 4-1: Manufacturer: syz [ 1221.675416][ T911] cdc_wdm 4-1:1.0: skipping garbage [ 1221.685752][ T911] cdc_wdm 4-1:1.0: skipping garbage [ 1221.699561][ T911] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1221.705999][ T911] cdc_wdm 4-1:1.0: Unknown control protocol [ 1221.934792][ C0] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1221.940306][ T911] usb 4-1: USB disconnect, device number 24 [ 1221.941478][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1221.953484][ C0] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1221.966009][ T5154] cdc_wdm 4-1:1.0: Tx URB error: -19 [ 1222.868309][ T5213] set match dimension is over the limit! [ 1223.413901][ T5231] vim2m vim2m.0: vidioc_s_fmt queue busy [ 1223.450083][ T5229] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1223.533739][ T5229] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1224.755762][ T3498] usb 4-1: new low-speed USB device number 25 using dummy_hcd [ 1224.938679][ T3498] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1224.956758][ T3498] usb 4-1: config 7 has an invalid interface number: 29 but max is 0 [ 1224.967166][ T3498] usb 4-1: config 7 has no interface number 0 [ 1224.973277][ T3498] usb 4-1: config 7 interface 29 altsetting 1 endpoint 0x1 has invalid maxpacket 112, setting to 8 [ 1224.984163][ T3498] usb 4-1: config 7 interface 29 has no altsetting 0 [ 1224.993904][ T3498] usb 4-1: string descriptor 0 read error: -22 [ 1225.000427][ T3498] usb 4-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=a2.36 [ 1225.009558][ T3498] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1225.027613][ T3498] i2c-tiny-usb 4-1:7.29: version a2.36 found at bus 004 address 025 [ 1225.103146][ T5277] xt_hashlimit: size too large, truncated to 1048576 [ 1225.540676][ T5254] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1225.550534][ T5254] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1226.513097][ T5299] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4139'. [ 1227.369569][T20761] IPVS: starting estimator thread 0... [ 1227.428241][ T3498] (null): failure reading functionality [ 1227.451058][ T3498] i2c i2c-2: failure reading functionality [ 1227.457412][ T5316] IPVS: using max 32 ests per chain, 76800 per kthread [ 1227.486385][ T3498] i2c i2c-2: connected i2c-tiny-usb device [ 1227.570420][ T3498] usb 4-1: USB disconnect, device number 25 [ 1228.224251][ T5345] netlink: 'syz.1.4145': attribute type 9 has an invalid length. [ 1228.241425][ T5345] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4145'. [ 1228.319950][ T5345] hsr0: entered promiscuous mode [ 1228.332939][ T5345] macvlan3: entered promiscuous mode [ 1228.353381][ T5345] macvlan3: entered allmulticast mode [ 1228.370515][ T5345] hsr0: entered allmulticast mode [ 1228.388905][ T5345] hsr_slave_0: entered allmulticast mode [ 1228.404777][ T5345] hsr_slave_1: entered allmulticast mode [ 1229.082836][ T5369] netlink: 43 bytes leftover after parsing attributes in process `syz.0.4149'. [ 1229.349285][ T5376] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1229.370325][ T5376] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1229.395663][ T911] usb 4-1: new low-speed USB device number 26 using dummy_hcd [ 1229.548455][ T911] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1229.563969][ T911] usb 4-1: config 1 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1229.594823][ T911] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1229.622702][ T911] usb 4-1: string descriptor 0 read error: -22 [ 1229.629600][ T911] usb 4-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.40 [ 1229.659380][ T911] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1230.698548][ T5404] input: syz1 as /devices/virtual/input/input73 [ 1230.787974][ T911] usbhid 4-1:1.0: can't add hid device: -71 [ 1230.794622][ T911] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 1231.133197][ T911] usb 4-1: USB disconnect, device number 26 [ 1231.181662][ T5404] program syz.0.4154 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1233.582834][T20761] IPVS: starting estimator thread 0... [ 1233.686388][ T5459] IPVS: using max 49 ests per chain, 117600 per kthread [ 1233.890774][ T5463] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4165'. [ 1233.942901][ T5463] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4165'. [ 1233.972561][ T5465] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4164'. [ 1237.263807][ T5514] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4177'. [ 1237.296135][ T5514] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4177'. [ 1237.777186][T25076] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1237.786350][T20761] IPVS: starting estimator thread 0... [ 1237.803678][T25076] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1237.886590][ T5543] IPVS: using max 33 ests per chain, 79200 per kthread [ 1238.806603][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.812956][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.229728][ T5577] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4189'. [ 1239.928934][ T5592] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4191'. [ 1239.941110][ T5592] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4191'. [ 1240.115716][T20761] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1240.306017][T20761] usb 4-1: Using ep0 maxpacket: 16 [ 1240.319041][T20761] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1240.334396][T20761] usb 4-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1240.344118][T20761] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1240.364271][T20761] usb 4-1: config 0 descriptor?? [ 1240.465255][ T5603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1240.484619][ T5603] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1240.799404][T20761] mcp2221 0003:04D8:00DD.0029: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.3-1/input0 [ 1241.136386][ T5591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1241.147062][ T5591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1241.192899][ T5591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1241.202896][ T5591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1241.212617][ T5591] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1241.232812][ T5591] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1241.455489][ T5627] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4193'. [ 1241.477142][ T911] usb 4-1: USB disconnect, device number 27 [ 1242.378061][ T5654] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4195'. [ 1244.817538][ T5690] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4202'. [ 1244.846915][ T5690] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4202'. [ 1245.558792][ T5731] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1245.705374][ T5733] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1245.775834][ T5736] sctp: [Deprecated]: syz.4.4206 (pid 5736) Use of int in max_burst socket option deprecated. [ 1245.775834][ T5736] Use struct sctp_assoc_value instead [ 1246.036095][T31263] usb 4-1: new low-speed USB device number 28 using dummy_hcd [ 1246.185764][T31263] usb 4-1: Invalid ep0 maxpacket: 64 [ 1246.325954][T31263] usb 4-1: new low-speed USB device number 29 using dummy_hcd [ 1246.485749][T31263] usb 4-1: Invalid ep0 maxpacket: 64 [ 1246.493305][T31263] usb usb4-port1: attempt power cycle [ 1246.857564][T31263] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 1246.887077][T31263] usb 4-1: Invalid ep0 maxpacket: 64 [ 1246.973785][ T5754] netlink: 'syz.1.4211': attribute type 2 has an invalid length. [ 1247.001801][ T5754] @;: entered promiscuous mode [ 1247.025744][T31263] usb 4-1: new low-speed USB device number 31 using dummy_hcd [ 1247.056430][T31263] usb 4-1: Invalid ep0 maxpacket: 64 [ 1247.063285][T31263] usb usb4-port1: unable to enumerate USB device [ 1247.102297][ T5767] bridge0: port 3(bond0) entered blocking state [ 1247.109943][ T5767] bridge0: port 3(bond0) entered disabled state [ 1247.117916][ T5767] bond0: entered allmulticast mode [ 1247.123213][ T5767] bond_slave_0: entered allmulticast mode [ 1247.130276][ T5767] bond_slave_1: entered allmulticast mode [ 1247.136746][ T5767] team0: entered allmulticast mode [ 1247.146035][ T5767] team_slave_0: entered allmulticast mode [ 1247.152159][ T5767] team_slave_1: entered allmulticast mode [ 1247.171733][ T5767] bond0: entered promiscuous mode [ 1247.177237][ T5767] bond_slave_0: entered promiscuous mode [ 1247.185049][ T5767] bond_slave_1: entered promiscuous mode [ 1247.194442][ T5767] team0: entered promiscuous mode [ 1247.200951][ T5767] team_slave_0: entered promiscuous mode [ 1247.212517][ T5767] team_slave_1: entered promiscuous mode [ 1247.284925][ T5776] usb usb8: usbfs: process 5776 (syz.1.4214) did not claim interface 4 before use [ 1247.676034][ T5783] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4215'. [ 1248.250995][ T5789] xt_hashlimit: size too large, truncated to 1048576 [ 1248.906620][ T5821] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4218'. [ 1248.980043][ T5821] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4218'. [ 1250.586954][ T5857] fuse: Bad value for 'fd' [ 1250.730519][ T5866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1250.842103][ T5866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1252.198902][ T5905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1252.229860][ T5905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1252.286810][ T5901] xt_hashlimit: size too large, truncated to 1048576 [ 1253.091153][ T5931] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1253.351479][ T5934] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4237'. [ 1254.961025][ T5957] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1254.992049][ T5957] block device autoloading is deprecated and will be removed. [ 1255.416144][ T31] INFO: task kworker/1:4:5902 blocked for more than 143 seconds. [ 1255.433395][ T31] Tainted: G L syzkaller #0 [ 1255.449091][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1255.472994][ T31] task:kworker/1:4 state:D stack:15224 pid:5902 tgid:5902 ppid:2 task_flags:0x4288060 flags:0x00080000 [ 1255.532152][ T31] Workqueue: usb_hub_wq hub_event [ 1255.547181][ T31] Call Trace: [ 1255.555047][ T31] [ 1255.562977][ T31] __schedule+0x14bc/0x5000 [ 1255.575070][ T31] ? do_raw_spin_lock+0x121/0x290 [ 1255.589970][ T31] ? __pfx___schedule+0x10/0x10 [ 1255.604370][ T31] ? schedule+0x91/0x360 [ 1255.618313][ T31] schedule+0x165/0x360 [ 1255.631566][ T31] schedule_timeout+0x9a/0x270 [ 1255.644102][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1255.659413][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1255.675573][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1255.691633][ T31] ? wait_for_completion+0x267/0x5d0 [ 1255.709061][ T31] wait_for_completion+0x2bf/0x5d0 [ 1255.718111][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1255.730890][ T31] i2c_del_adapter+0x591/0x760 [ 1255.743191][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 1255.769133][ T31] ? rcu_is_watching+0x15/0xb0 [ 1255.802407][ T31] ? dvb_usb_adapter_exit+0xd7/0x240 [ 1255.850731][ T31] ? kfree+0x4d/0x660 [ 1255.867840][ T31] dvb_usb_i2c_exit+0x64/0xb0 [ 1255.876837][ T31] dvb_usb_device_exit+0x1be/0x350 [ 1255.898707][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1255.912169][ T31] ? __pfx_dvb_usb_device_exit+0x10/0x10 [ 1255.925573][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1255.940678][ T31] ? usb_disable_interface+0x31d/0x350 [ 1255.965066][ T31] usb_unbind_interface+0x26e/0x910 [ 1255.978385][ T31] ? __pfx_usb_unbind_interface+0x10/0x10 [ 1255.999125][ T31] device_release_driver_internal+0x4d9/0x800 [ 1256.012069][ T31] bus_remove_device+0x34d/0x440 [ 1256.023091][ T31] device_del+0x511/0x8e0 [ 1256.034430][ T31] ? __pm_runtime_barrier+0x212/0x460 [ 1256.046717][ T31] ? __pfx_device_del+0x10/0x10 [ 1256.065620][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1256.083047][ T31] usb_disable_device+0x3d4/0x8e0 [ 1256.109241][ T31] usb_disconnect+0x32f/0x990 [ 1256.124637][ T31] hub_event+0x1ca9/0x4ef0 [ 1256.141790][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1256.163925][ T31] ? __pfx_hub_event+0x10/0x10 [ 1256.181802][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1256.202661][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1256.218589][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1256.243463][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1256.256819][ T31] process_scheduled_works+0xad1/0x1770 [ 1256.272326][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1256.285612][ T31] worker_thread+0x8a0/0xda0 [ 1256.294606][ T31] kthread+0x711/0x8a0 [ 1256.305244][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1256.319124][ T31] ? __pfx_kthread+0x10/0x10 [ 1256.329436][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1256.340891][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1256.351837][ T5957] syz.3.4242 (5957): drop_caches: 2 [ 1256.357558][ T31] ? __pfx_kthread+0x10/0x10 [ 1256.363115][ T31] ret_from_fork+0x599/0xb30 [ 1256.370890][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1256.382004][ T31] ? __switch_to_asm+0x39/0x70 [ 1256.396371][ T31] ? __switch_to_asm+0x33/0x70 [ 1256.412267][ T31] ? __pfx_kthread+0x10/0x10 [ 1256.422394][ T31] ret_from_fork_asm+0x1a/0x30 [ 1256.432498][ T31] [ 1256.445667][ T31] [ 1256.445667][ T31] Showing all locks held in the system: [ 1256.453406][ T31] 1 lock held by khungtaskd/31: [ 1256.465751][ T31] #0: ffffffff8df419e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1256.476090][ T31] 2 locks held by getty/5597: [ 1256.480794][ T31] #0: ffff8880313c20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1256.491010][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 [ 1256.504378][ T31] 5 locks held by kworker/1:4/5902: [ 1256.509925][ T31] #0: ffff888141ee3548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1256.521613][ T31] #1: ffffc90004e4fb80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1256.537322][ T31] #2: ffff888142348198 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4ef0 [ 1256.546570][ T31] #3: ffff88807e787198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xf8/0x990 [ 1256.556357][ T31] #4: ffff88807a44d160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x800 [ 1256.568260][ T31] 4 locks held by kworker/u8:17/6007: [ 1256.573688][ T31] [ 1256.576564][ T31] ============================================= [ 1256.576564][ T31] [ 1256.585031][ T31] NMI backtrace for cpu 0 [ 1256.585052][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1256.585076][ T31] Tainted: [L]=SOFTLOCKUP [ 1256.585084][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1256.585095][ T31] Call Trace: [ 1256.585103][ T31] [ 1256.585113][ T31] dump_stack_lvl+0x189/0x250 [ 1256.585150][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1256.585172][ T31] ? __pfx__printk+0x10/0x10 [ 1256.585208][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1256.585235][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1256.585260][ T31] ? __pfx__printk+0x10/0x10 [ 1256.585288][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1256.585316][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1256.585341][ T31] sys_info+0x135/0x170 [ 1256.585361][ T31] watchdog+0xf95/0xfe0 [ 1256.585388][ T31] ? watchdog+0x20a/0xfe0 [ 1256.585417][ T31] kthread+0x711/0x8a0 [ 1256.585449][ T31] ? __pfx_watchdog+0x10/0x10 [ 1256.585469][ T31] ? __pfx_kthread+0x10/0x10 [ 1256.585493][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1256.585517][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1256.585536][ T31] ? __pfx_kthread+0x10/0x10 [ 1256.585600][ T31] ret_from_fork+0x599/0xb30 [ 1256.585652][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1256.585679][ T31] ? __switch_to_asm+0x39/0x70 [ 1256.585699][ T31] ? __switch_to_asm+0x33/0x70 [ 1256.585719][ T31] ? __pfx_kthread+0x10/0x10 [ 1256.585741][ T31] ret_from_fork_asm+0x1a/0x30 [ 1256.585778][ T31] [ 1256.735871][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1256.741101][ C1] NMI backtrace for cpu 1 [ 1256.741120][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1256.741141][ C1] Tainted: [L]=SOFTLOCKUP [ 1256.741148][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1256.741158][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1256.741179][ C1] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 93 a0 0c 00 f3 0f 1e fa fb f4 c8 ed 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1256.741194][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 [ 1256.741208][ C1] RAX: 7111faa11baaf800 RBX: ffffffff81978eba RCX: 7111faa11baaf800 [ 1256.741220][ C1] RDX: 0000000000000001 RSI: ffffffff8d792222 RDI: ffffffff8bc08360 [ 1256.741231][ C1] RBP: ffffc90000197f10 R08: ffff8880b87336db R09: 1ffff110170e66db [ 1256.741244][ C1] R10: dffffc0000000000 R11: ffffed10170e66dc R12: ffffffff8f821e70 [ 1256.741256][ C1] R13: 1ffff110038d9b70 R14: 0000000000000001 R15: 0000000000000001 [ 1256.741267][ C1] FS: 0000000000000000(0000) GS:ffff888125f35000(0000) knlGS:0000000000000000 [ 1256.741280][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1256.741291][ C1] CR2: 00007fb0ae5b7198 CR3: 0000000057ea0000 CR4: 00000000003526f0 [ 1256.741306][ C1] Call Trace: [ 1256.741314][ C1] [ 1256.741321][ C1] default_idle+0x13/0x20 [ 1256.741339][ C1] default_idle_call+0x73/0xb0 [ 1256.741358][ C1] do_idle+0x1ea/0x520 [ 1256.741375][ C1] ? irqentry_exit+0x5ba/0x660 [ 1256.741393][ C1] ? __pfx_do_idle+0x10/0x10 [ 1256.741423][ C1] cpu_startup_entry+0x44/0x60 [ 1256.741440][ C1] start_secondary+0x101/0x110 [ 1256.741462][ C1] common_startup_64+0x13e/0x147 [ 1256.741489][ C1] [ 1256.914644][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1256.921514][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1256.932204][ T31] Tainted: [L]=SOFTLOCKUP [ 1256.936529][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1256.946591][ T31] Call Trace: [ 1256.949879][ T31] [ 1256.952816][ T31] dump_stack_lvl+0x99/0x250 [ 1256.957493][ T31] ? __asan_memcpy+0x40/0x70 [ 1256.962095][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1256.967481][ T31] ? __pfx__printk+0x10/0x10 [ 1256.972091][ T31] vpanic+0x237/0x6d0 [ 1256.976073][ T31] ? __pfx_vpanic+0x10/0x10 [ 1256.980570][ T31] ? preempt_schedule_common+0x83/0xd0 [ 1256.986033][ T31] panic+0xb9/0xc0 [ 1256.989769][ T31] ? __pfx_panic+0x10/0x10 [ 1256.994186][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1256.999551][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1257.005701][ T31] watchdog+0xfdf/0xfe0 [ 1257.009871][ T31] ? watchdog+0x20a/0xfe0 [ 1257.014205][ T31] kthread+0x711/0x8a0 [ 1257.018281][ T31] ? __pfx_watchdog+0x10/0x10 [ 1257.022968][ T31] ? __pfx_kthread+0x10/0x10 [ 1257.027557][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1257.032753][ T31] ? lockdep_hardirqs_on+0x98/0x140 [ 1257.037938][ T31] ? __pfx_kthread+0x10/0x10 [ 1257.042553][ T31] ret_from_fork+0x599/0xb30 [ 1257.047135][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1257.052244][ T31] ? __switch_to_asm+0x39/0x70 [ 1257.056999][ T31] ? __switch_to_asm+0x33/0x70 [ 1257.061760][ T31] ? __pfx_kthread+0x10/0x10 [ 1257.066341][ T31] ret_from_fork_asm+0x1a/0x30 [ 1257.071107][ T31] [ 1257.074584][ T31] Kernel Offset: disabled [ 1257.078895][ T31] Rebooting in 86400 seconds..