last executing test programs: 4m0.987601093s ago: executing program 3 (id=76): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x24, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000840)={0x2c, &(0x7f0000000640)={0x20, 0xe}, 0x0, 0x0, 0x0, 0x0}) 3m57.871865495s ago: executing program 3 (id=80): r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYRES32=r0], 0xdc}}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x3, 0x0, 0x0, 0x0, {0xa, 0x4e24, 0x9, @empty, 0x3}}}, 0x3a) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000180)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000191"], 0xfdef) r6 = socket$inet6(0xa, 0x2, 0x494) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x6e21, 0xb, @empty, 0xffffffff}, 0x1c) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000140)="ad76b6c5", 0x4) r8 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_int(r8, &(0x7f0000000340)=0x4, 0x12) syz_genetlink_get_family_id$team(&(0x7f0000000100), r1) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x38}}}, 0x1c) lsm_get_self_attr(0x68, &(0x7f0000000580)={0x0, 0x0, 0xb2, 0x92, ""/146}, &(0x7f0000000400)=0xfffffffffffffd96, 0x1) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x0) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f00000000c0)={0x806, 0x0, 0x4, 0x7}, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000520001000000000000000000020000000c00", @ANYRES16=r9], 0x20}}, 0x0) ioctl$sock_inet6_SIOCDELRT(r9, 0x890c, &(0x7f0000000280)={@local, @empty, @private0, 0xff, 0x8, 0x2, 0x0, 0xc4}) 3m56.976843672s ago: executing program 3 (id=82): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x23, &(0x7f0000000040)=""/40, &(0x7f0000000080)=0x28) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) r2 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f00000000c0)={0x2, 0x4e21, @private=0xa010101}, 0x10) ioctl$sock_netdev_private(r2, 0x89f4, &(0x7f00000001c0)="980a7687774a1a3efc49a27425a693a44f5bd8c713a74500000000e64096fbb7dc87f022ac9c6c025ba86fad826bcec467784d508f81a23a922e306115d908bce75fd1a6ee6ae5ba8b7300bb3da1751f3f9618b5883a1b4f15bb563c0da80dfbbe466ba46eab21b10dd6dd734ecad7c0bcfee5666af4f75b855a38d2dc4a104874355139accfe9498a82abc3a629d0237ae4dd13b34c20b0db2c33314df3116ee4d6333f1a4ce77c0297807e636ae2b7f3b1d93c348525b411478cd6d8d3bb9565e66c10732cdddb6ea1d2a028ac725554546154990bc55ced39919c5b00058c430f6bc2c26b8170131ebd297b1ca2353487e2255a812f0400a40e96004ec595f11f9951efcfcdaf9bd913982ea3da4ffc431efbd8eb09010000") r3 = syz_io_uring_complete(0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r3, 0x89e1, &(0x7f0000000100)={r1}) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000000)=0x86, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r5, 0x6, 0xd, 0x0, &(0x7f0000000100)) sendto$inet6(r4, 0x0, 0x0, 0x4ff00, &(0x7f0000000180)={0xa, 0x4e22, 0x8001, @loopback, 0x627bcafb}, 0x1c) r6 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) ioctl$sock_rose_SIOCADDRT(r6, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) 3m56.751858803s ago: executing program 3 (id=83): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp256-generic\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$sock(r1, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000000340)="8224aca5f41b9e0ec5e7a706c919e7c0e343f0cd0a779c17e7f992396b09252009d2d12e9475a57e", 0x28}], 0x1}}], 0x1, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffd}}, @dstopts_2292={{0x90, 0x29, 0x4, {0x4, 0xf, '\x00', [@calipso={0x7, 0x10, {0x1, 0x2, 0x9, 0x9f, [0x8]}}, @generic={0x80, 0x14, "09e12e5f0b6bdcf72f2ec7008a15fa88b025e0ad"}, @calipso={0x7, 0x30, {0x1, 0xa, 0x7a, 0x8001, [0x5, 0x9, 0x6, 0x400, 0xb]}}, @ra={0x5, 0x2, 0xa7e}, @pad1, @ra={0x5, 0x2, 0xbf4}, @generic={0x93, 0x11, "e80ee304ecb784ec4655260cecea14e498"}]}}}, @hoplimit={{0x14}}, @hopopts={{0x18, 0x29, 0x36, {0x5e}}}, @rthdrdstopts={{0x20, 0x29, 0x37, {0x73, 0x0, '\x00', [@pad1]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @rthdr={{0x18}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x178}}], 0x1, 0x810) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (fail_nth: 1) 3m56.233155464s ago: executing program 3 (id=84): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x94) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x803400, 0x0) setpgid(0x0, r3) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xe, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r7) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r13, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r14, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r9, @ANYBLOB="05005b"], 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r6, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x10000, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000480)=[@textreal={0x8, 0x0}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000000000008004000000000000d07ee511"]) 3m55.863655156s ago: executing program 3 (id=87): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0), 0x30080, 0x0) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000100)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newsa={0x1a0, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, {@in, 0x0, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x2c}, {}, {0x0, 0x0, 0x8000000, 0x200}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x70bd28}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}, 0x0, 0x18}}]}, 0x1a0}}, 0x0) (fail_nth: 1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r3 = syz_open_dev$radio(&(0x7f00000004c0), 0x2, 0x2) ioctl$VIDIOC_S_TUNER(r3, 0x4054561e, &(0x7f0000000500)={0x2, "8ad11c74233261c07f5f0200238e7246938e5801cc3dcafe826eea7d3c137c03"}) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000140)={0x33, 0x5, 0x8, 0x2be, 0x1, 0x1}) write$cgroup_devices(r2, &(0x7f0000000080)={'a', ' *:* ', 'rwm\x00'}, 0xa) 3m48.254448812s ago: executing program 32 (id=62): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r1) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000500)="e98314d58ce4b24ee137cea9c243c233bfa2f5fee778bbfc", 0x18}], 0x1) 3m40.572337819s ago: executing program 33 (id=87): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0), 0x30080, 0x0) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000100)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newsa={0x1a0, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64}, {@in, 0x0, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x2c}, {}, {0x0, 0x0, 0x8000000, 0x200}, {0x0, 0x0, 0x2}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x70bd28}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}, 0x0, 0x18}}]}, 0x1a0}}, 0x0) (fail_nth: 1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) r3 = syz_open_dev$radio(&(0x7f00000004c0), 0x2, 0x2) ioctl$VIDIOC_S_TUNER(r3, 0x4054561e, &(0x7f0000000500)={0x2, "8ad11c74233261c07f5f0200238e7246938e5801cc3dcafe826eea7d3c137c03"}) ioctl$EXT4_IOC_GROUP_ADD(r3, 0x40286608, &(0x7f0000000140)={0x33, 0x5, 0x8, 0x2be, 0x1, 0x1}) write$cgroup_devices(r2, &(0x7f0000000080)={'a', ' *:* ', 'rwm\x00'}, 0xa) 3m1.973784189s ago: executing program 4 (id=326): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x20, 0xa, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x9}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x900000000000000, 0x4000}, 0x2000c000) 3m1.831991166s ago: executing program 4 (id=327): openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x13c, 0x19, 0x1, 0x0, 0x0, {{@in=@private, @in=@remote, 0x0, 0xfffd, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, [@tmpl={0x84, 0x5, [{{@in6=@remote, 0x0, 0x3c}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x7}, {{@in=@loopback, 0x0, 0x6c}, 0x0, @in=@local, 0x4000}]}]}, 0x13c}}, 0x4040000) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f00000041c0)={0x2020}, 0x2020) 3m1.771729853s ago: executing program 4 (id=328): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) r2 = syz_open_procfs(r1, &(0x7f0000000080)='children\x00') sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}}, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r2, 0xc0884123, &(0x7f0000000180)={0x4, "84952d0f429ad193680ec2c725bf36f505f10234450d4c62047603e3ca666ac1d5e3ba6a11eefcb5bdd76a10d2094ce7e260e96ce349a1ffb156d51f29d1add8", {0xa000000000, 0x4b69}}) 3m1.653005061s ago: executing program 4 (id=329): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) (async) mount$bind(&(0x7f0000000480)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x12c5008, 0x0) (async) open(&(0x7f0000000080)='./file0/file0\x00', 0x0, 0x0) (async) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) (async) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) (async) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) unshare(0x6020400) (async) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 3m1.546111673s ago: executing program 4 (id=331): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f0000000b40)={0x0, 0xf0, &(0x7f0000000080)={&(0x7f00000008c0)=ANY=[@ANYBLOB="28010000", @ANYRES16=r1, @ANYBLOB="0100030000000000000001000000dc0008804c0000800400098024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c200004000a004e210000000700000000000000000000000000000001d20600003c00008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b1400040002004e230a01010100000000000000005000008024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922200004000a0000ee0ef749d259ddff0000000000000000000000000003000000060005000400000024000300b08073e8d44e7ff0bfca0f771dbe44bb885c69e269c8e9d835b114293a4ddc6e14000200776732"], 0x128}, 0x1, 0x0, 0x0, 0x4004040}, 0x40884) 3m1.363444598s ago: executing program 4 (id=334): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a80)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x239, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x4, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_DEV_DESTROY(r0, 0x5502) 3m1.02614733s ago: executing program 34 (id=334): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a80)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x239, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x4, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x45c) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$UI_DEV_DESTROY(r0, 0x5502) 2m39.971882143s ago: executing program 2 (id=432): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000180)={0xcc, 0x0, 0x8001}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x7, 0x0, 0x180, 0x200000004, 0x10, 0xf1, 0x2000, 0x7fffffffffffe, 0x800000a2a, 0x0, 0x5, 0xf0, 0x80000001, 0xb, 0xbdb], 0xeeee8000, 0x3c4210}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x161283, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYBLOB="cf000002000000000000000200"]) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@set_irq_handler={0xbe, 0x20, {0x78}}, @out_dx={0xaa, 0x28, {0x2fe5, 0x4, 0xffffffffbf4bdd4c}}], 0x48}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_JOIN_FILTERS(r2, 0x65, 0x6, &(0x7f0000000140), 0x4) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000100), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_HARDIF(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002abd7000fddbdf250500000008000600", @ANYRES32=r7, @ANYBLOB="08002c0001000000080039000700000008000300", @ANYRES32=r8], 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x40040) sendmmsg$sock(r0, &(0x7f0000000dc0)=[{{&(0x7f00000002c0)=@ll={0x11, 0x15, r8, 0x1, 0x9, 0x6, @random="10029695b63d"}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000380)="dd2dc423756ae1493183109e538871eebf94c688be3c526e8d6584592e8f94de8546ad9ac579235769ab994c3b60475d3e7ba8cbfeb80ad69b8eda061367464ec8552551e52c3a03c10fee5d021accc2744c37c6b66a69f7220b2bad7a016586f477f9420a3cc1238cebc81be7d28b0c33be98bb128f95", 0x77}, {&(0x7f0000000440)="860e731c7f6cfdd0bb697916c1e6d0f2dfe551f63fcc63ba740f72a7d2551122e9991ab449242e356cf22d8e26bc5fb7db9024e5cfb26b2b49aba18809a06b4c705e6509ba121943bfa3ee0ff48b089d992decac70835da4605573a045221903883c92c0e41013c4444f88511aa572e9f1f02276725e3e458c74c470f724058c86e953285c8b409d36424fa9560a5a5409b7cd5cb129e51a0ccca1ae8ca808e85bb8a3f88eb76082dd5ab926267ec2d0bf252bed869f63f2d58a3c5d070e4d2680769cfc9ad99666dee95c", 0xcb}, {&(0x7f0000000540)="c8eba7bb563f719e20397075afc9ef92ce91ab911c7a2820598a1c6918965de171ec3a89970e2ff48e5acfdb7f35ef38a214df2d29f9895c71f1779d621f5c3d536e3a02da3cb0118493c1ee42bd646261f22f7d2f61e23eebf64670033f4cb9cc4ea1f84d5b55a0d07d02c4a8bd47a8f412fcbce37facc3e989c2b62fea036ca0a5f1c314de4985b48626dfe762d0b8c6040cffe57de585f501ee71f333d09e8a522bfe6e0c9756", 0xa8}, {&(0x7f0000000600)="99f730caa5c2d3c3354a58d6cccf37d4b6895b8d59110d163265c1397fda38ecc67b3704ae0625821cde7b", 0x2b}], 0x4, &(0x7f0000000680)=[@timestamping={{0x14, 0x1, 0x25, 0x7}}, @mark={{0x14, 0x1, 0x24, 0xbb5}}, @txtime={{0x18, 0x1, 0x3d, 0xc}}, @timestamping={{0x14, 0x1, 0x25, 0x6}}, @mark={{0x14, 0x1, 0x24, 0x290d}}], 0x78}}, {{&(0x7f0000000700)=@xdp={0x2c, 0x8, 0x0, 0x21}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000780)="4fcce55ce5df90132116df30fe1a8d69e8b51f12dba66b04eb46f64669192bedb53a3cf49454a38d58e33b601b8d7056c7d819bc76566df6f8cb2d744e6a208a7966aae5a61b7dc12671504f3298fb24568a23bcfcda6d376fc4f7fb1cf9b2e24a18c9c00c016ae1d494bc2de38e6e8cdf818144d445c42f183826b365e0934a465670f09ff6a849a0aba5ea5ef5254a493f6a106119c688e1c174eb45b3b731c58ba9d858271dec2a5d9e63e71a190a41f718e2753e93", 0xb7}, {&(0x7f0000000840)="826c7c3b20d353c39adcdad570c30c4ca0526fc94effc60c6272a8b3ba42904af902662f0f1a06e1b0256161998e76ee54f78d20d14154bee6550efe1223aedbc73426564687fc6ed85d6e9842fcd489efccaf8eaf859c69d8b1fe946c381c0a7198d3f7a944ca6b9279cb01cce9c7bb061b71579fca51a70fc631f25cb1da7f63b2fd18274aed2eb603195ad515bee372e9ca8edbbfabb2d71f94700b0f8fb81ce26bacc1", 0xa5}, {&(0x7f0000000900)="a78dd493384ea85cff81922b29a771a5e7a54042f1a283e974ea57dc18cafdd1f81fa6f4a202828673288ea191a5cfd9175f325d5b0aab92da2319c0d863363f85db14a0667f542f626d39a1095702438d6e80166fc6e03c595a4667c7ddf3cabacf116042ff9c9e9745805a84a588dae979c33da5298911589f38edafd3f5c8fbd465db8359cde375f87072c66556ec0d491c922c3f5049b18a42e5f69d118b929cde6a8c6c34bcf2f99ae890c661345b9ed9a69cf103f90b0caa2bf71788b99feb271d0bb3a9e2dddfc2ddeac6b0a044a2f8b305d14ccf26b07a556c182532", 0xe0}, {&(0x7f0000000a00)="309baaf22552919cf9d3f9eb084da5f00cd50afbd3c5a4e726452b8b910fbdff25842d256ee81bfdf816a9d19df38333409723959fa2689abe18dee1ad997cf9e3cf4a85bf4a9078c733e0a2178e6f7613eb9aceb0fbc192af2c0a0b79bfbe7aaf1e817cfbe20dbb14e42eee59fb82b682d7d6444c2b7f67eb84536fcb039970eaf7445b9d6a3de9b5f3a65f750f8f14d68f5a38c352fc2614a5cafcf8ca89706b8646d42ffbb6955d37f8125fd95cee2c64651a42cfbbab27a48cf000c566713a7e569cefad99a55cef3795296e08db71668411b7296e35bbbbe489fb10367449", 0xe1}, {&(0x7f0000000b00)="a34c7bd5f82abe24eb2b479fe1609cfda2e4430ed1f8f1a760c5a60392417cc0a1c7b3d04c96c1d70b88009cf4534986ba5a79e7e280d068c465bb3d32", 0x3d}, {&(0x7f0000000b40)="eb9f743397abe19564430d526c5ea0379706bb13a63de0146416bf85ff295fdf9cba14c039896986f174cb6e5594a9c9e97147a8a012200f591aa7c94b29aa7e419ac64f6e6ed8bde399532f85bfae3999dd4db97c31620f96e6d015eed1803243cdbeaa9092f6f8577143dc618d7a2ed087c11a027ff1785895b583b7d912e1abece09eb7b974a41357fde6cb7631d8af5214", 0x93}, {&(0x7f0000000c00)="6e37983beefd54abb9957daf085cb47fa6cf7e6e457ce1005f92f64af4006c39e3024ff87f681d710222a9fda9c8b96043be7375d4731a72f3ba9643846884cc1f861fbf9123233a2e7f739a55b6d5374fddb5a9e13830d192c6722c0999c6e9a84c6aa7676a2860880678b4f56178a8e205c3623e61d9240ca39ff7499f2aaf349b344f6a2b5d1f07831477c999fd6ced8159060f738bd1762e064c35692d52ae9c778f56fb090087cf1c7a0e407c9afd295cfe0bb39e55257d44e681ed949a", 0xc0}], 0x7, &(0x7f0000000d40)=[@timestamping={{0x14, 0x1, 0x25, 0x8}}, @mark={{0x14, 0x1, 0x24, 0x200}}, @txtime={{0x18, 0x1, 0x3d, 0x7f}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}], 0x60}}], 0x2, 0x4004800) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) 2m39.612052378s ago: executing program 2 (id=435): r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000000140)=[{{&(0x7f00000000c0)=@phonet, 0x80, &(0x7f0000000040)=[{&(0x7f0000000fc0)=""/4096, 0x1000}], 0x1, &(0x7f00000001c0)=""/218, 0xda}, 0xfffffff7}], 0x1, 0x1cc489d83550d583, &(0x7f00000002c0)={0x77359400}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000004c0)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000400)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r4, 0xc01864b1, &(0x7f0000000580)={r6, 0x3, 0x1002a, 0x2, &(0x7f0000000080)=[{0xd4f9, 0x1ff, 0x1ff, 0x7}, {0x7, 0xc899, 0x2}]}) read$FUSE(r3, &(0x7f00000034c0)={0x2020}, 0xcac) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000008c0)={0x30, r2, 0xb97534d5fe9704cf, 0x70bd26, 0x25dfdbfb, {{0x12}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0x6, 0xbe, "e380"}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x8008) 2m39.466343146s ago: executing program 2 (id=437): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_usb_connect$printer(0x3, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0xff, 0x4b8, 0x202, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0xd3, 0xb0, 0xd, [{{0x9, 0x4, 0x0, 0xe, 0x1, 0x7, 0x1, 0x2, 0xe, "", {{{0x9, 0x5, 0x1, 0x2, 0x8, 0x3f, 0x1, 0x1}}}}}]}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x200, 0x7, 0xa, 0x7, 0xff, 0x3}, 0x1a, &(0x7f00000000c0)={0x5, 0xf, 0x1a, 0x3, [@wireless={0xb, 0x10, 0x1, 0xc, 0x81, 0x7, 0x7, 0x7, 0xe}, @ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x6, 0x5, 0x10}]}, 0x5, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x1c09}}, {0xea, &(0x7f0000000380)=@string={0xea, 0x3, "576f25dfd6119ebcb36f751cb195b5738145fb76341e79d7a6ec7080b340771eddd15682bda8012a0b94e0aff604d2d25bfb981abf12a3a64a2536afd253038631f6c2c9e163b13035d3aa84d8a5a21306250839713767e4b92c417b5f2fed07e6d962e3acde050c57be3feaeac7b7f8b0b36d33138bf14d65b9abdb575db69df3f21ad9c8da17fb02638b82fe09afe5e756ddc57f2aa2c130d23b6708a9957c72d97ed6e658cded93e82dda1a878781db40eef4103640e25c2e44ce20ad8a8f018e05f7f46d58550021fa637ff73fae17a9c566f7a8b38b873a37ea04b6509c15be1859f4a48190"}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x406}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x2801}}, {0x75, &(0x7f0000000200)=@string={0x75, 0x3, "2e96c44bfac2466152b2edce50186c7419f009f79a58843152b9a147f7ecd16b4a0a6cff10eff436d6f5449a10f9f5170715fd6720b75ef3e90fc9ea5344d8b1af2ccf24d617546b0d3baa24931acdf7f0a5d752bdfc2b8ec0a97cda9a2a222997fa42761a6aa2946ca1cac7514ee5a3a63ef0"}}]}) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r1, &(0x7f0000000000)=[{&(0x7f00000004c0)='4', 0x1}], 0x1) write$char_usb(r1, &(0x7f0000000300)="47d7ee49bf7f07e193446f202f5484a360f6b70ce7205ba2b1f16bd89ac77545ff03811d2480a9058723acf6d90f620e219295ed5e7355b9c54d2a4142985d217337be217c4b7abddd5753648eae002432b340fbf1414fca6b35365984c84626f0d09c55fb3a39f20caed28cdfcd4e30393de78f9c532ce8d9dee695f9ff1df0", 0x80) write$char_usb(r0, 0x0, 0x0) 2m37.820151085s ago: executing program 2 (id=440): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x44, r2, 0x1, 0x1000000, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x42}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_TDLS_ACTION={0x5}, @NL80211_ATTR_IE={0x4}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}]}, 0x44}}, 0x0) 2m37.790084597s ago: executing program 2 (id=441): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="d63a055080c15a7548ae0000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2m36.052313295s ago: executing program 2 (id=444): r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x4) ioctl$NBD_DO_IT(r0, 0xab03) ioctl$NBD_CLEAR_SOCK(r0, 0x301) 2m20.987740081s ago: executing program 35 (id=444): r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r0, 0xab00, r1) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x4) ioctl$NBD_DO_IT(r0, 0xab03) ioctl$NBD_CLEAR_SOCK(r0, 0x301) 2m2.540059495s ago: executing program 0 (id=586): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) mlockall(0x7) brk(0x689d80000000) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x12, 0x80801) ioctl$USBDEVFS_CONNECTINFO(r1, 0x8004550f, 0x0) sendmmsg$inet(r0, &(0x7f0000000480)=[{{&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x36}}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)="fa", 0x1}], 0x1}}], 0x1, 0x24040890) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$cgroup2(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100), 0x203, &(0x7f0000000240)={[{@memory_recursiveprot}]}) r3 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="24000000000000008400000001"], 0x30}], 0x1, 0x0) write$cgroup_subtree(r2, &(0x7f0000001a40)=ANY=[], 0x17) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r2, 0x0) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000140)=0xffff0000, 0x4) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000180), 0x3) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000010f40d010100000000000109022400010000800009040002010300010009210000000122f804090581034000040000"], 0x0) r5 = syz_usb_connect(0x5, 0x0, 0x0, &(0x7f0000001500)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x23, &(0x7f0000000200)=ANY=[@ANYBLOB="2303160d5093c7b6a6c05248472dafb4a855bea9398f020000000000000032429d276041c5c0190000000000000008000000000054067b86f7642bc3ea97ab0a86eed252980248ade0f9e8e3a6c34070e1dfe8e96926de4997d92446c7bfbeff12912a603c25f94611c5c6fbbb6c9373f7d5d789c5c38d6e6189c5ab408997"]}]}) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_connect$hid(0x4, 0x3f, &(0x7f00000002c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x458, 0x501a, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0xd6, 0x48, 0x1, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x1, 0x1, 0x1, {0x9, 0x21, 0x7, 0x3, 0x1, {0x22, 0xc3f}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x6, 0x6, 0x6}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x0, 0x1, 0x9}}]}}}]}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x0, 0xc, 0x3e, 0x1, 0xff, 0x9}, 0x2f, &(0x7f0000000380)=ANY=[@ANYBLOB="050f2f0003071002020a810020100a7b050001000000f8c300c032d0000000000000c0000000c00000000000000003"], 0x5, [{0xc6, &(0x7f00000004c0)=@string={0xc6, 0x3, "a64d1770c234e1f2ada6dba6a675ba3138ce8825e9f4da52f78a869d6d1a68ce7a172d0c38731ba0d56ccb238512ec17efa0b9643b9863d88aafcaa041bec2cda49b7360dd226961296a3a5555336f2306c65f46f88497e4d03b1e34d8e72741ff97b9bdb8686bad919f6217dbe3c1b4848d8fbd064530f7c339d60fb96995581666151302d6bdf0bafffdb9f7bffaa9dd89b3412f94b430c62657d4e861ec4a3395ea2de449b37643e7583ad9127fc5c283bbc4ae021b276bf083290157d4323791ee45"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0xc0a}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x2001}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x436}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0xc0c}}]}) syz_usb_control_io$hid(r5, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYRESHEX=r4], 0x0}, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r2, 0x8934, &(0x7f0000000280)={'gretap0\x00', 0xf3}) 1m59.310181974s ago: executing program 0 (id=614): syz_open_dev$vcsa(&(0x7f0000000040), 0xf1, 0x4e8242) socket$kcm(0x11, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'virt_wifi0\x00', 0x11}) r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r0, &(0x7f0000000540)={0x0, 0xc027, &(0x7f0000000340)=[{&(0x7f00000000c0)="97eb000014006bcd9e", 0xeb98}], 0x1, 0x0, 0x0, 0x1f000000}, 0x600) recvmsg$kcm(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x40000022) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x3}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xa}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000640)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$sock_buf(r1, 0x1, 0x3b, &(0x7f0000002780)=""/146, &(0x7f0000002840)=0x92) shutdown(r1, 0x0) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace(0x10, r6) ptrace$getsig(0x4202, r6, 0x9, 0x0) syz_usb_connect(0x2, 0x4a, &(0x7f0000000080)=ANY=[@ANYRESDEC=r6, @ANYRESOCT], 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB="2b696f202d72646d6120e1555613ddbff12c3ca337de97fca462486fb70dc1f1ec982f0bc9222ca455e689225151dc2bbef5dfa029856a608aeb5eed20e45507e67c9b3b4770ede7ab283032f3c5cc668bc491d7141313b268377b918a2a62b8973c5f0e28b2c434e986b2c8c6009f6eefb10bc382f71099cd690940cd7a375d7cd1e6a7053fe8dcbafe0500fa9fafa46e05213aa0458c838a54711515f08a719491deb55da3ef90f530b7a00c993a76aa4a83876a2c8544a4c1a8ef8c02f56bfafdfff5373d673b9eab32a7ea6e4ecf09a304374f96a7aa7731c9cf9e6a37b8d5593fffb530e3d9dc9a477668ba15060a3ec1f36e2d3b6c7e66c0d77607ee248f2343d2ff5bfdaee509997c54965c097beb57a30c2c00a8589308524ba614f5f3cda42d3163f21799ac88551e99db5c"], 0xa) 1m56.241530962s ago: executing program 0 (id=622): r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x7ffff000) 1m56.184212213s ago: executing program 0 (id=624): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x800) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[], 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={0x0, 0x70}}, 0x0) sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x68, r2, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x8, @media='ib\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x80d0}, 0x4000880) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r3, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$rds(r3, &(0x7f0000000680)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) close(r3) 1m56.104639091s ago: executing program 0 (id=625): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x94) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x803400, 0x0) setpgid(0x0, r3) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xe, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r7) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r13, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r11, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r12}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) r14 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r14, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r9, @ANYBLOB="05005b"], 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r6, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x10000, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000480)=[@textreal={0x8, 0x0}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000000000008004000000000000d07ee511"]) 1m55.911642503s ago: executing program 0 (id=626): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f0000000000)={0x4, 0x86}) (async) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f0000000000)={0x4, 0x86}) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 1m40.408955063s ago: executing program 36 (id=626): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r3, &(0x7f0000000000), 0xfffffecc) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f0000000000)={0x4, 0x86}) (async) ioctl$KVM_TPR_ACCESS_REPORTING(r3, 0xc028ae92, &(0x7f0000000000)={0x4, 0x86}) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) 1m26.992123894s ago: executing program 6 (id=793): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000008c0), r0) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b40)={0x0}, 0x1, 0x0, 0x0, 0x20004814}, 0x40) 1m26.949702228s ago: executing program 6 (id=794): r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') read$FUSE(r0, &(0x7f00000077c0)={0x2020}, 0x2020) 1m26.834021571s ago: executing program 6 (id=796): sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003"], 0x6c}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000380)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000500)={0x0, 0x21, &(0x7f00000004c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fcdbdf252100000008000300", @ANYRES32=r2, @ANYBLOB="24002d8005"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 1m26.757073628s ago: executing program 6 (id=798): mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000100)='autofs\x00', 0x0, &(0x7f0000000400)) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0, 0x0) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, 0x0) setpgid(0x0, r1) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002480)={0x24, 0x19, 0x1, 0x0, 0x25dfdbfb, {0xa, 0xd601, 0x9}, [@nested={0x10, 0x12, 0x0, 0x1, [@nested={0xc, 0xf8, 0x0, 0x1, [@typed={0x8, 0x12, 0x0, 0x0, @pid}]}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x5}, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r3, 0xc018937e, &(0x7f00000019c0)={{0x1, 0x1, 0x1018, r0}, './file1\x00'}) 1m26.662890408s ago: executing program 6 (id=799): pipe2$9p(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) writev(r0, &(0x7f0000000540)=[{&(0x7f0000000580)='.', 0x1}], 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$phonet(0x23, 0x2, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) write$tun(r2, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000000206030000000000000000000d0000000c000300686173683a6970000500040000"], 0x50}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) setfsgid(0xee01) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b1c, 0x1c1f, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}}}]}}]}}, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x5, 'WZ@|'}]}}, 0x0}, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) setsockopt$sock_int(r6, 0x1, 0xa, &(0x7f0000000100)=0x4, 0x4) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r6, &(0x7f0000000340)='\x00', 0x1, 0x4c001, 0x0, 0x0) recvfrom(r6, &(0x7f00000003c0)=""/240, 0xf0, 0x10060, 0x0, 0x0) get_robust_list(r4, 0x0, 0x0) r7 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x46d, 0xc293, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xa0}}, {{{0x9, 0x5, 0x81, 0x3, 0x408}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) r8 = syz_open_dev$video(&(0x7f00000001c0), 0x8, 0x10400) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x14, 0x3a, 0x1, 0x270bd24, 0x25dfdbf8, {0x11}}, 0x14}}, 0x4000000) ioctl$VIDIOC_S_HW_FREQ_SEEK(r8, 0x40305652, &(0x7f0000000200)={0x8001, 0x3, 0x7, 0xdf, 0x1, 0xe47, 0x20000000}) syz_usb_control_io(r7, &(0x7f0000000300)={0x2c, &(0x7f00000000c0)={0x20, 0x30, 0xa0, {0xa0, 0x0, "d8b3a31e585eaf67d632b544c268448a1297af424acf5e58bf9df64a69d39f4adba2d4c1139b3d973919348069ba2e95856394bc1681e2c13cbd93d042479495a5e0b9b735e3fa5d67d2143c6c7077a913b9ca5478b813bc093ead712216735284e43e0f64d5a0decb45f4ec9312f12ae803db7cd3ac44a904c963262e9891c354f0ce57f7e100d7f49b238229171ea1eb2da5b67b655370b9593d786648"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000080)={0x38, 0x9, 0x6, 0x201, 0x0, 0x0, {0xa}, [@IPSET_ATTR_DATA={0x4}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x8}, @IPSET_ATTR_PACKETS={0xc, 0x19, 0x1, 0x0, 0x8000}]}]}, 0x38}}, 0x4004084) 1m26.319976876s ago: executing program 6 (id=800): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f00000000c0)) ioprio_set$uid(0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x13c, 0x19, 0x1, 0x0, 0x0, {{@in=@private, @in=@remote, 0x0, 0xfffd, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, [@tmpl={0x84, 0x5, [{{@in6=@remote, 0x0, 0x3c}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x7}, {{@in=@loopback, 0x0, 0x6c}, 0x0, @in=@local, 0x4000}]}]}, 0x13c}}, 0x4040000) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f00000041c0)={0x2020}, 0x2020) 1m26.229386993s ago: executing program 37 (id=800): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080), 0x900, 0x0) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f00000000c0)) ioprio_set$uid(0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x13c, 0x19, 0x1, 0x0, 0x0, {{@in=@private, @in=@remote, 0x0, 0xfffd, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}}, [@tmpl={0x84, 0x5, [{{@in6=@remote, 0x0, 0x3c}, 0x0, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x7}, {{@in=@loopback, 0x0, 0x6c}, 0x0, @in=@local, 0x4000}]}]}, 0x13c}}, 0x4040000) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$fuse(0x0, 0x0, &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f00000041c0)={0x2020}, 0x2020) 46.656734286s ago: executing program 7 (id=1048): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = accept(r0, 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) write$UHID_INPUT(r3, &(0x7f0000004000)={0xf, {"a2e3ad21ed0d09f91b50090987f70906d038e7ff7fc6e5539b0d3d0e8b089b33356d63060890e0878f0e1ac6e7049b334a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xfffffffffffffe59}}, 0xfa) write$UHID_SET_REPORT_REPLY(r3, &(0x7f0000001100)={0xe, {0x3, 0xa, 0x8, 0xc8, "abafedcac3b3e4f01e31d076c2ef17872eed4f6d3472105caacc6626e776f50bf1556376a561ae5706efb37c1b7a58881cf35bae33dc83f5e0e72605ab95635ed9c8c6e1f2c19c23f2242c103296dd934203a888aa989bdab432d99a20b22ce782ce1bc030f8a54f620584cd8111457e65021a3c2c081e5844f526224ab1b336b45ef0987a9eba21a1749b4f9094af2eb8c6d18408f3752b576b5e04e18f0e4314c7b410aa8cf39874ea8bc2955ec3f8b367560eed76240ab3b09180d8c5c74ff825d8d2fde75845"}}, 0xd4) sendmmsg$alg(r1, &(0x7f0000000740)=[{0x0, 0x0, 0x0}], 0x1, 0x0) recvmsg(r1, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x5}], 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x40740}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) close(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) prctl$PR_CAP_AMBIENT(0x2f, 0x4, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000000f", @ANYRES8=r4], 0x3c}}, 0x10) 45.663937216s ago: executing program 7 (id=1055): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x3, 0x180, 0x4, 0x3, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0xfffffffffffffffd, 0x2, 0x9, 0x5], 0xffff1001, 0x120182}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x20) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, 0x0, 0x4) 45.468572346s ago: executing program 7 (id=1058): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r5 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) request_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)='keyring\x00', r5) keyctl$restrict_keyring(0xa, r5, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='id:cb2e') r6 = syz_open_dev$dri(&(0x7f00000004c0), 0xffff, 0x442100) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000540)={0x8, &(0x7f0000000500)=[{}, {}, {}, {0x0}, {}, {}, {}, {}]}) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x14) ioctl$DRM_IOCTL_GET_SAREA_CTX(r6, 0xc010641d, &(0x7f0000000640)={r7, &(0x7f0000000580)=""/180}) sendmsg$NL80211_CMD_AUTHENTICATE(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010026bd7000fedbdf252500000008000300", @ANYRES32=r4, @ANYBLOB="08002600851600000a000600ffffffffffff0000080001000000000004000700050008000000000008003500000000000a0034"], 0x58}, 0x1, 0x0, 0x0, 0x20040040}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r10 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r10, 0xc0184800, &(0x7f0000000100)={0x4, r9}) ioctl$DMA_HEAP_IOCTL_ALLOC(r10, 0xc0184800, &(0x7f0000000400)={0xbc34, r1}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="05000000e9fffffeffffffffff51ec57b7a3017fb729928212274bff7f000000746c81a26fdadb320195b9d025fc1f3b46e3a074148e53838f23175b", @ANYRES32=r11, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r15 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0), r3) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x74, r15, 0x200, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_BEARER={0x54, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x16, 0x1, @l2={'ib', 0x3a, 'batadv_slave_1\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x3, @mcast1, 0x9}}, {0x14, 0x2, @in={0x2, 0x4e22, @empty}}}}]}, @TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xbb1}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x880}, 0x80) sendmsg$NL80211_CMD_CONNECT(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x28, r13, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r14}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}]}, 0x28}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000280)=ANY=[@ANYBLOB="50e7ffff07021100000108021100000008021100000000000000000000000000640001000300ae7287030b0303030371070200ffff540c09"], 0x33) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000440)=ANY=[@ANYBLOB="80000000ffffffffffff080211000001080211"], 0x38) 44.79515546s ago: executing program 7 (id=1061): ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, 0x0) mmap(&(0x7f0000009000/0x4000)=nil, 0x4000, 0x3000000, 0x32, 0xffffffffffffffff, 0x1a326000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20-arm\x00'}, 0x58) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x34004000) write$cgroup_type(r0, &(0x7f0000000080), 0x11ffffce1) sendmsg$inet(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000005c0)="dfad", 0x2}], 0x1, &(0x7f00000006c0)=ANY=[], 0x7c}, 0x1) 44.651021347s ago: executing program 7 (id=1062): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f0000000040)=0x800005, 0x4) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) ioctl$PTP_SYS_OFFSET_EXTENDED(r1, 0xc4c03d09, &(0x7f0000000440)={0x5}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000000c0), 0x10) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYRES16=r2], 0x448}}, 0x0) sendmmsg$inet(r2, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}, {{0x0, 0x0, &(0x7f0000000100), 0x2}}], 0x40000000000003a, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r3, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x1}}, './file0\x00'}) prctl$PR_GET_DUMPABLE(0x3) 43.543676149s ago: executing program 7 (id=1064): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = accept(r0, 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) write$UHID_INPUT(r3, &(0x7f0000004000)={0xf, {"a2e3ad21ed0d09f91b50090987f70906d038e7ff7fc6e5539b0d3d0e8b089b33356d63060890e0878f0e1ac6e7049b334a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xfffffffffffffe59}}, 0xfa) write$UHID_SET_REPORT_REPLY(r3, &(0x7f0000001100)={0xe, {0x3, 0xa, 0x8, 0xc8, "abafedcac3b3e4f01e31d076c2ef17872eed4f6d3472105caacc6626e776f50bf1556376a561ae5706efb37c1b7a58881cf35bae33dc83f5e0e72605ab95635ed9c8c6e1f2c19c23f2242c103296dd934203a888aa989bdab432d99a20b22ce782ce1bc030f8a54f620584cd8111457e65021a3c2c081e5844f526224ab1b336b45ef0987a9eba21a1749b4f9094af2eb8c6d18408f3752b576b5e04e18f0e4314c7b410aa8cf39874ea8bc2955ec3f8b367560eed76240ab3b09180d8c5c74ff825d8d2fde75845"}}, 0xd4) sendmmsg$alg(r1, &(0x7f0000000740)=[{0x0, 0x0, 0x0}], 0x1, 0x0) recvmsg(r1, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x5}], 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x40740}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) close(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000000f", @ANYRES8=r4], 0x3c}}, 0x10) 28.419595227s ago: executing program 38 (id=1064): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = accept(r0, 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) write$UHID_INPUT(r3, &(0x7f0000004000)={0xf, {"a2e3ad21ed0d09f91b50090987f70906d038e7ff7fc6e5539b0d3d0e8b089b33356d63060890e0878f0e1ac6e7049b334a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0xfffffffffffffe59}}, 0xfa) write$UHID_SET_REPORT_REPLY(r3, &(0x7f0000001100)={0xe, {0x3, 0xa, 0x8, 0xc8, "abafedcac3b3e4f01e31d076c2ef17872eed4f6d3472105caacc6626e776f50bf1556376a561ae5706efb37c1b7a58881cf35bae33dc83f5e0e72605ab95635ed9c8c6e1f2c19c23f2242c103296dd934203a888aa989bdab432d99a20b22ce782ce1bc030f8a54f620584cd8111457e65021a3c2c081e5844f526224ab1b336b45ef0987a9eba21a1749b4f9094af2eb8c6d18408f3752b576b5e04e18f0e4314c7b410aa8cf39874ea8bc2955ec3f8b367560eed76240ab3b09180d8c5c74ff825d8d2fde75845"}}, 0xd4) sendmmsg$alg(r1, &(0x7f0000000740)=[{0x0, 0x0, 0x0}], 0x1, 0x0) recvmsg(r1, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x5}], 0x1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x40740}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) close(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000000f", @ANYRES8=r4], 0x3c}}, 0x10) 7.802968581s ago: executing program 5 (id=1193): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40050}, 0x0) r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfffffffffffffe9f}}]}}, 0x0) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100002439da20cd061201a2d20102030109021b0001000000000904000001717ffe000905a1"], 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000040), 0x10) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, 0x0, &(0x7f0000000040)) syz_usb_connect(0x0, 0xdd, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xc4, 0xb8, 0x68, 0x8, 0x2357, 0x109, 0xbdda, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0xf1, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0xff, 0xff, 0xff}}]}}]}}, 0x0) syz_usb_connect(0x0, 0x6d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100003cda2a200a111022"], 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x1, &(0x7f00000000c0)="cc") syz_usb_disconnect(r0) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000cc0)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000400)={0x34, &(0x7f00000002c0)=ANY=[@ANYBLOB="000801"], 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = fcntl$getown(0xffffffffffffffff, 0x9) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r4, 0x29, 0x6, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0x1a}}, 0x91e1516366f54ac2) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000100)={{0x100004, 0x6, 0x3, 0x2, '\x00', 0xfffffffc}, 0x4, 0x200, 0x5, r3, 0x0, 0x9, 'syz0\x00', 0x0}) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x27, 0x4c, 0x3, 0x40, 0x5ab, 0x60, 0x1106, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xd, 0x0, 0x0, [{{0x9, 0x4, 0xa8, 0x0, 0x0, 0xf4, 0x7, 0x50}}]}}]}}, 0x0) r5 = syz_open_dev$sndpcmp(&(0x7f0000000440), 0x8, 0x200000) mmap$snddsp_control(&(0x7f0000000000/0x4000)=nil, 0x1000, 0x2, 0x10, r5, 0x83000000) syz_usb_connect$cdc_ecm(0x4, 0x6b, &(0x7f0000000240)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x59, 0x1, 0x1, 0x3, 0x20, 0xff, [{{0x9, 0x4, 0x0, 0x79, 0x2, 0x2, 0x6, 0x0, 0x1, {{0x8, 0x24, 0x6, 0x0, 0x0, "7f5da0"}, {0x5, 0x24, 0x0, 0x10}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x4, 0x1, 0x4}, [@ncm={0x6, 0x24, 0x1a, 0x1ff, 0x28}, @mbim={0xc, 0x24, 0x1b, 0x5, 0xfffb, 0x9, 0x9, 0x7, 0x3}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x400, 0x9, 0x0, 0x2}}], {{0x9, 0x5, 0x82, 0x2, 0x10, 0xc0, 0x52, 0x7}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x5, 0x2, 0x28}}}}}]}}]}}, &(0x7f00000003c0)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x250, 0x7, 0x0, 0x8, 0x40}, 0xf, &(0x7f0000000340)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0xf, 0x5, 0x4}]}, 0x1, [{0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x827}}]}) fsopen(&(0x7f0000000480)='openpromfs\x00', 0x0) r6 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x0) setreuid(0x0, 0xee00) ioctl$SCSI_IOCTL_SEND_COMMAND(r6, 0x1, &(0x7f0000000100)={0x0, 0x4, 0xa5b}) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) socket$unix(0x1, 0x2, 0x0) 5.359200154s ago: executing program 1 (id=1203): r0 = syz_usbip_server_init(0x3) write$usbip_server(r0, 0x0, 0x0) 4.768542807s ago: executing program 1 (id=1204): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x88fd537e5e114b6f, 0x12, r0, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000000)={0x0, 0x200}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000080)={r1, 0x0, 0x1}, 0x8) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$inet(0x2, 0x80001, 0x84) r3 = socket$inet(0x2, 0x80001, 0x84) ioctl$VFAT_IOCTL_READDIR_BOTH(r2, 0x82307201, &(0x7f00000002c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000280)=0x3, 0x4) bind$inet(r3, &(0x7f0000000180)={0x2, 0xce20, @empty}, 0x10) listen(r3, 0x3) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000280)=0x3, 0x4) bind$inet(r2, &(0x7f0000000180)={0x2, 0xce20, @local}, 0x10) listen(r2, 0x3) listen(r2, 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e1f0a"], 0x22) 4.642262315s ago: executing program 1 (id=1205): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x41, &(0x7f0000000180)={&(0x7f0000000340)={0x3c, 0x40, 0x119, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x20, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @nested={0x14, 0x1a, 0x0, 0x1, [@nested={0x10, 0x47, 0x0, 0x1, [@nested={0x4, 0x146}, @nested={0x4, 0xb5}, @nested={0x4, 0x7e}]}]}]}, @nested={0x4, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 4.603701419s ago: executing program 1 (id=1206): r0 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000034709d405f0530bbacb6010203010902120001000000000904000000f28acc004fa63d79234964d9edc5589d6113b23aca8c8d0ab18477cb69452655e7c0"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)={0x40, 0x21, 0x1, 0x9}}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000480)={0x34, &(0x7f0000000200)={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000640)={0x34, &(0x7f0000000500)={0x0, 0x12}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000dc0)={0x2c, &(0x7f0000000ac0)={0x0, 0x9}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000004c0)={0x1c, &(0x7f00000003c0)={0x40, 0xe}, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000340)={0x2c, &(0x7f00000000c0)={0x0, 0x5}, 0x0, 0x0, &(0x7f00000002c0), 0x0}) 4.048073613s ago: executing program 8 (id=1208): r0 = socket(0x21, 0x4, 0x10000000000002) connect$rxrpc(r0, &(0x7f0000000140)=@in4={0x21, 0x100, 0x2, 0x10, {0x2, 0xfffc, @local}}, 0x24) sendmmsg(r0, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000002d40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 4.027926394s ago: executing program 8 (id=1209): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000810}, 0x4044005) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg$inet(r0, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000004c0)='\f', 0x1}], 0x1, 0x0, 0x0, 0x2000000}}], 0xfdef, 0x0) (fail_nth: 5) 3.777967175s ago: executing program 8 (id=1210): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x1) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000002c0)={0x0, 0x0, 0x4, r2, 0xb}) r3 = dup(r1) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) mount$overlay(0x0, 0x0, &(0x7f0000000000), 0x8, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) statx(r3, &(0x7f0000000140)='./file0\x00', 0x2000, 0x100, &(0x7f00000001c0)) ioctl$BTRFS_IOC_SEND(r2, 0x40489426, &(0x7f00000000c0)={{r5}, 0x4, &(0x7f0000000080)=[0xd2, 0x53d, 0x10000, 0x8000000000000000], 0xfe, 0x6}) sendmmsg$inet(r5, &(0x7f0000000c80)=[{{0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000001540)="5823766e1ca1e9e052", 0x9}], 0x1}}], 0x1, 0x8800) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000003000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3.576009635s ago: executing program 8 (id=1211): sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003"], 0x6c}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000380)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fcdbdf252100000008000300", @ANYRES32=r2, @ANYBLOB="24002d8005"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) (fail_nth: 6) 3.415881454s ago: executing program 5 (id=1212): r0 = syz_usbip_server_init(0x3) write$usbip_server(r0, 0x0, 0x0) 2.773542156s ago: executing program 5 (id=1213): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100008ddfb240490b4f06fdd4010203010902120001000000000904de0000e6f65200760c82aff396758dcd51ecf6c7e1c0a0c67f33a67ef14aa42bd567a2a848bfa0c607a82b648bc6d2c0b7e0651a925e37092e65412bc100"/106], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000810}, 0x4044005) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000240)={{0x0, 0x3}}) ioctl$SNDRV_TIMER_IOCTL_STATUS64(0xffffffffffffffff, 0x80605414, &(0x7f0000000540)) close(0xffffffffffffffff) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg$inet(r0, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000004c0)='\f', 0x1}], 0x1, 0x0, 0x0, 0x2000000}}], 0xfdef, 0x0) 2.223530285s ago: executing program 8 (id=1216): openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) r1 = openat$cgroup_ro(r0, &(0x7f00000002c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x80002, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) write(r2, &(0x7f0000000180)="2400000021002551241c0165ff00fc020200000003180f000ee1000c08000f0000080000", 0x24) clock_adjtime(0x0, &(0x7f00000001c0)={0x8b8d, 0x1000000000000, 0x512, 0x9, 0x0, 0xfffffffffffffffd, 0xe00, 0x0, 0x80, 0xffc99a3b, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10007f, 0x0, 0x0, 0x0, 0x60d2, 0x0, 0x5, 0x1, 0x2}) socket$igmp(0x2, 0x3, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r0, @ANYBLOB="05", @ANYRES16=r0, @ANYRES8, @ANYRES16=r1, @ANYRES16=r3], 0x0) 1.480014475s ago: executing program 1 (id=1223): add_key(&(0x7f0000000140)='dns_resolver\x00', 0x0, &(0x7f00000001c0)="bcfdc195f8b8fff0d7d38cebc3ab0a281077b472f633f263e6cec7a46ae5a30d3b4a34df3f57560217ec82ad86f90bcdc0538fb8d3974e4345d3653747b5e8e4effd9e38b7d65a6e70ead21cf7dfda1f078866875d57cfd0e398fea002ae797187ebfa9f216c998eb937235458bcf702c6ae803dfa6793c87e4471f181c01ac16cb88a61517b028928a8d3768eb6c7ffe91ec60acba2e36b0f517bc3469e9ab5a000c95300c7e59dfa32e844a00ababe920de9e0700a7a15450d9c090d2d2dff7170fd51617a78ca00", 0xfffff, 0xfffffffffffffffe) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r1 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$binfmt_register(r1, &(0x7f0000000380)={0x3a, 'syz1', 0x3a, 'E', 0x3a, 0x2, 0x3a, '\\', 0x3a, '@', 0x3a, './file0', 0x3a, [0x4f]}, 0x2a) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) close_range(r0, r0, 0x2) r2 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000009b80)=ANY=[@ANYBLOB="3c0000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a3100000000100003800c000080080003"], 0x3c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) lseek(r2, 0xfffffffffffffff9, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x802}, 0xe) 1.307744202s ago: executing program 1 (id=1224): r0 = syz_usb_connect$cdc_ncm(0x2, 0x76, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904010001020d0000052406000105240000000d240f0100000000000000000006241a00000008241c00000008000905810300020000000904010000020d00000904010102020d0000090582020002000000090503"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_usb_connect$sierra_net(0x6, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x7, 0x2, 0x8, 0x2, 0x7}, {0x9, 0x5, 0x9, 0x2, 0x3ff, 0x6, 0x12, 0x36}, {0x9, 0x5, 0x0, 0x3, 0x10, 0x80, 0x8, 0x1}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r1, &(0x7f0000000140)={0x14, &(0x7f0000000040)={0x0, 0x7, 0xac, {0xac, 0x2, "b44417d936e58e151df6ac70d7c239d7d4820f95072f8499b5d04aafe34300767361da1f0590bdc03d3526c11cc40508a2ced9d51082248c3fd7c86217c6384b0b286d16f893d8643efd6153ae72434f70ca89e68a3f099fbca9997b9f351d29f13cdbb7de6750a0ce173e57e20dc9d61d334b676951252e3c433e7f1f61b1be9665c23cf3eaf3b89f6f011630fc165642c4aeffc416cedfa0ee19927d622e81ed5323d60a1c02d6f620"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x458}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00'], &(0x7f0000000840)={0xa1, 0x1, 0x400, "e37bb196f2b47725cda3b5c6452bac22720d0fddb8562c1a02b3f7b324bae0ba0e2f2b1525519c96797d8329c4fd1fe92bbbc2845f9cf2fb26a457056021047b2f0a2a0ec341f7ce1a00d4f3fbccc742edf099cd6c3670f5dbb9795f609c78783afdfb7c406c15c9c84b5c6ef5143a25dfdd440cebcc9193150dcc3cf1726c5714e58e5d6673ae30cdbd92910125ce360baf5dfc84e0318fe6888c0075bad78efa79e40d8626535441fb20a6d989e15f67434bae5b3dfeefc7a59de8f37693738e52ab5aea2f23e135e3fc2aa8ac18c10e1f20a71812dc2bbf8d4520a9647c97754d4aa7aac39581131b897a59e7b2f94799cdad9bd8993e9921eb73d047aefec490751549ebeaa501a0b52c2fa5dee01725bdbf2ce28b5ce9d03d08a62b2eef3d1c54008401ad88534867140e0d91396e6054b7ca58ce485ae3cbe5a222a33a11ce036bf1d4b3ee41436481b3378a4ab36efa92e896803919a0f62e8cfa2e98f7ce5b80106971f9867362a552c9fdde712aafac7702895bc0f2fc6af85bdc822e25408f92bfff286a2159e0f5b16224795f9cec362cda6375e496c876903beb2db71f34bfbdb70612f51d9430fa538d5f4429c751879dc7b51b1b2536974a1f958d0467726146a0bea07aae6b1703d34b56b5c220237a2e0aa3faf5bd801056be6f72cf195c614df54973cf5fb30438410ec9e9dcc8ed87bdeed267e1aa87801086f1b0ba64aeb771e48855c5f675ea42020f9577faa9810bc3dca917225d7d50193bedbc4338ce2097cf021e750bcfde56afd162b2829bdb771f723011e4875aa550cfdc3e5b754b96e91c7f9cc3d682f7f956b005aaec7bcbd7bcaef2f36ec56404ec465fbb4eddcf673c5a381da0a506ac14d63c8374ac7d26876033840c0e9c3fd5fe149803d9441cc0671845083ef0aa9f2b85ba26cdc127b902fa2c922fa46e602e2efaf46349d892953ed228dcc6858c6a2fb393bf8b547e30a8728e8a5ac1693466506612128a103a71bc29fdd99af03304f45cae8bdd6b20d76f17b8dab31b35cf5347eb9c35fb1a8cb61c051c6cf7af4beb47d58249e9893741ffb2251c4f10301c2f82de94acf1c309eec45c344ceeb954765c0fcd7bcc5969043ded5df9c49adcdf6408ed84562fe46c9d70c054ff986ef85b66b879669b0d801c28fe5a95f83495b665f17959e30b2b212753eba7757cf497370aba642d9b8767f70d42419babac8d31f807628dd30b93822430cfd1bca51e1bd80e6888275bbdf906301584c5d6bd13923594f16cf26c62540a2ecd5df3e7a42abee30b5356d6415b9b74de73fc6a3242daf08c44e000293656f7ae6714955a78648dc3d7c9f6374696f5dc293a072231a7472e87e4b83a07386bbdc211580f7c836c16f4ea4f3e682daf332d5e7d076bd31d83fce87755c6ea481033c82c8265ac8c5577e3"}, &(0x7f00000001c0)}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000007c0)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x0, 0x0, 0xb, 0x72, 0x1, 0x4, 0x7, 0x40, 0x6, 0xe, 0x0, 0x1004}}, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000180)=""/235, 0xeb}], 0x1) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 1.048106867s ago: executing program 9 (id=1226): r0 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x6e22, 0x9, @empty, 0x6}, 0x1c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) listen(r2, 0x0) listen(r1, 0x0) read$FUSE(r0, &(0x7f00000077c0)={0x2020}, 0x2020) 1.034876527s ago: executing program 9 (id=1227): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000006580)={0x0, 0x0, &(0x7f0000006540)={&(0x7f0000006480)={0x20, 0x0, 0x7, 0x401, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x24040004) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x3, 0x7, 0x101, 0x0, 0x0, {0x3, 0x0, 0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x40) (fail_nth: 6) 731.327079ms ago: executing program 9 (id=1228): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async, rerun: 64) setsockopt(0xffffffffffffffff, 0x3, 0x6, &(0x7f0000000700)="37557bf476e57e3ff487bcca92e2688783c7ffb106450c5928c0b26a8e08fbb2e3deb24243c76131fc4f72dde26ecc0546cfbd3462c851695a0cdcf274b4a1ea364f1b1a5645d744", 0x48) (async, rerun: 64) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRESOCT=r0], 0xbb8}, 0x1, 0x0, 0x0, 0x2000}, 0x4004840) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x97, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x9, 0x2}, 0xe) (async) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000005c0), 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="0500000067cf"], 0x80}}, 0x3c83f4ba09aac8e3) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000280)={r2, r2, 0x1, 0x0, 0x0, 0x48, 0x41, 0x1000, 0x8, 0x8, 0x1, 0x12e, 'syz0\x00'}) (async) r4 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r4, 0x84, 0x6c, &(0x7f0000001100)=""/4107, &(0x7f0000000080)=0x100b) 668.155702ms ago: executing program 5 (id=1229): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x60000009, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket(0x8, 0x3, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x6180, 0x0) close(0x4) 582.728537ms ago: executing program 9 (id=1230): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000d00)={0x28, r1, 0x4c1dad3e3d6a7499, 0x70bd2b, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000080}, 0x20000000) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r2) tkill(r2, 0x12) tkill(r2, 0x12) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000140)="24000000010006", 0x7) ptrace(0x4208, r2) sched_getparam(r2, &(0x7f00000000c0)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0xb, 0x1, 'TPROXY\x00'}, @NFTA_TARGET_INFO={0x4}, @NFTA_TARGET_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x84}}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x34, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x2}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x5c}, 0x1, 0x0, 0x0, 0x64050}, 0x0) 516.584287ms ago: executing program 8 (id=1231): mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f00000001c0)='./file0\x00', 0xc4000001) r1 = open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) ftruncate(r2, 0x2000009) sendfile(r1, r2, 0x0, 0x20000000000006) vmsplice(r2, &(0x7f0000000200)=[{&(0x7f00000002c0)="0200", 0x2}], 0x1, 0x3) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000000000407dd74e2c0000000000010902240001000000000904000001030000000921000000011407000905810300"], 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201100194deaa404c05c1063e67010203010902240001000000070904"], 0x0) 407.894755ms ago: executing program 9 (id=1232): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="88010000170a0101"], 0x188}}, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRES32=r0, @ANYRESDEC=0x0], 0x6c}}, 0x24044081) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) r2 = socket$alg(0x26, 0x5, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="3f9d00000000000000001700000008000300", @ANYRES32=r5, @ANYBLOB="60003080050002000000000014000400403a050c5bae9c544ef2b6d713459a7a1c00018005000200000000000800040005000000080001000200"], 0x7c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000180)='>n', 0x20) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010029bd7000fcdbdf252100000008000300", @ANYRES32=r6, @ANYBLOB="24002d8005"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 284.268241ms ago: executing program 5 (id=1233): r0 = socket(0x10, 0x800, 0xfffdffff) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="840100001900010000000000000000001d01090050001180"], 0x184}, 0x1, 0x0, 0x0, 0x5}, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0xe2}, @hci_ev_le_advertising_info={{}, {0xa, [{0x0, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x17, "8100f870640395c5b90ff6daf06fa113da25fe7b81a02b", 0x1}, {0x5, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x6, "53a2d896fa77", 0xd8}, {0x0, 0x1, @none, 0x9, "934854d0e3197c97be", 0x4}, {0x4, 0x1, @any, 0x9, "22c29c9e261f8118b5", 0x4}, {0x4, 0x0, @none, 0x17, "640b5fa90107913ba0432aa20b8244cd574cdb6878001b", 0xb7}, {0x1, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x7}, 0xf, "032c1f69acf9fc616f189ae836d23d", 0x8}, {0x3, 0x0, @any, 0x17, "dcf6b6e333e88e90e1f3e0be00f85952ee32306870110d", 0xc}, {0x1, 0x0, @any, 0x7, "91aad5269f02ed", 0x6}, {0x1, 0x1, @none, 0x9, "62e649affbfad0e15f", 0x6}, {0x0, 0x1, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}, 0x0, "", 0x4}]}}}}, 0xe5) 77.731177ms ago: executing program 5 (id=1234): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x22080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000040)="8ee8c936660f3881beff018ed8660f3801b2d6352ed9ff660f3882040f01cf0fc72d2626652e0f01ca0fc7386635002000000f22e0", 0x35}], 0x1, 0x50, 0x0, 0x0) write$binfmt_script(r2, &(0x7f0000000180)={'#! ', '', [{0x20, 'blkio.bfq.io_wait_time_recursive\x00'}, {0x20, '-&*)/&-]+,:(,[\\'}]}, 0x36) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000100)={0xfffffbff, 0x2000004, 0x84e, 0x0, 0x6, "47bb00", 0xfffffffe, 0x6}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 0s ago: executing program 9 (id=1235): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_SET_BEACON(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001ac0)={0xe0, 0x0, 0x300, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x42}}}}, [@NL80211_ATTR_BEACON_HEAD={0xb5, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, {0x3}, @device_a, @device_a, @from_mac, {0x0, 0xd1}}, 0xb, @random=0xa, 0x4019, @val={0x0, 0x10, @random="c0ce754aa2229e59d24d19ae79c70321"}, @val, @void, @void, @void, @val={0x5, 0x3, {0x4, 0xed, 0x1}}, @void, @void, @val={0x3c, 0x4, {0x1, 0xb, 0xd, 0x8}}, @void, @void, @void, @val={0x76, 0x6, {0x0, 0x8, 0x2d, 0x6}}, [{0xdd, 0x64, "569a0508d8b428d7f526cf677ba5739d8f4587e85e5ac206c234bc8c06901ee2c8b63f09453d1afda890dd4c791df917ae88c22d0a2adba7ae92cf4f036f65785df1d0fe61316758f45d9c891a31c8df926cac58b175a605297f74b6ec5d725e9fb440e1"}]}}]}, 0xe0}}, 0x400c020) recvmsg$can_raw(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000ac0)=""/4096, 0x1000}], 0x1}, 0x40) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x3c, 0x40, 0x119, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x20, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @nested={0x14, 0x1a, 0x0, 0x1, [@nested={0x10, 0x47, 0x0, 0x1, [@nested={0x4, 0x146}, @nested={0x4, 0xb5}, @nested={0x4, 0x7e}]}]}]}, @nested={0x4, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) kernel console output (not intermixed with test programs): usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 305.512074][ T794] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 305.525318][ T5893] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 305.535071][ T794] usb 9-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 305.544406][ T794] usb 9-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 305.552472][ T794] usb 9-1: Manufacturer: syz [ 305.561233][ T794] usb 9-1: config 0 descriptor?? [ 305.976250][ T794] hid_parser_main: 5 callbacks suppressed [ 305.976276][ T794] appleir 0003:05AC:8243.0019: unknown main item tag 0x0 [ 305.993539][ T794] appleir 0003:05AC:8243.0019: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 306.940978][ T5893] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 306.951767][ T5893] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 306.960029][ T5893] usb 6-1: media controller created [ 306.972826][ T5893] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 307.019138][ T5893] i2c i2c-1: Added multiplexed i2c bus 2 [ 307.025346][ T5893] rtl2832 1-0010: Realtek RTL2832 successfully attached [ 307.033592][ T5893] usb 6-1: DVB: registering adapter 1 frontend 0 (Realtek RTL2832 (DVB-T))... [ 307.042809][ T5893] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 307.171531][ T5893] usb 6-1: USB disconnect, device number 59 [ 307.832062][ T9476] netlink: 'syz.5.1072': attribute type 46 has an invalid length. [ 308.084808][ T24] usb 9-1: USB disconnect, device number 19 [ 309.327762][ T9490] FAULT_INJECTION: forcing a failure. [ 309.327762][ T9490] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 309.343305][ T9490] CPU: 1 UID: 0 PID: 9490 Comm: syz.8.1076 Not tainted syzkaller #0 PREEMPT(full) [ 309.343340][ T9490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 309.343352][ T9490] Call Trace: [ 309.343361][ T9490] [ 309.343369][ T9490] dump_stack_lvl+0x189/0x250 [ 309.343399][ T9490] ? __pfx____ratelimit+0x10/0x10 [ 309.343424][ T9490] ? __pfx_dump_stack_lvl+0x10/0x10 [ 309.343448][ T9490] ? __pfx__printk+0x10/0x10 [ 309.343487][ T9490] should_fail_ex+0x414/0x560 [ 309.343516][ T9490] _copy_to_user+0x31/0xb0 [ 309.343546][ T9490] simple_read_from_buffer+0xe1/0x170 [ 309.343576][ T9490] proc_fail_nth_read+0x1b3/0x220 [ 309.343601][ T9490] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 309.343626][ T9490] ? rw_verify_area+0x2a6/0x4d0 [ 309.343646][ T9490] ? __lock_acquire+0xab9/0xd20 [ 309.343664][ T9490] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 309.343687][ T9490] vfs_read+0x200/0xa30 [ 309.343707][ T9490] ? fdget_pos+0x247/0x320 [ 309.343737][ T9490] ? __pfx___mutex_lock+0x10/0x10 [ 309.343764][ T9490] ? __pfx_vfs_read+0x10/0x10 [ 309.343787][ T9490] ? __fget_files+0x2a/0x420 [ 309.343817][ T9490] ? __fget_files+0x3a0/0x420 [ 309.343844][ T9490] ? __fget_files+0x2a/0x420 [ 309.343876][ T9490] ksys_read+0x145/0x250 [ 309.343894][ T9490] ? do_raw_spin_unlock+0x122/0x240 [ 309.343923][ T9490] ? __pfx_ksys_read+0x10/0x10 [ 309.343948][ T9490] ? do_syscall_64+0xbe/0xfa0 [ 309.343978][ T9490] do_syscall_64+0xfa/0xfa0 [ 309.344004][ T9490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 309.344024][ T9490] ? clear_bhb_loop+0x60/0xb0 [ 309.344049][ T9490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 309.344068][ T9490] RIP: 0033:0x7fe85c78e0dc [ 309.344086][ T9490] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 309.344103][ T9490] RSP: 002b:00007fe85a9f6030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 309.344125][ T9490] RAX: ffffffffffffffda RBX: 00007fe85c9e5fa0 RCX: 00007fe85c78e0dc [ 309.344140][ T9490] RDX: 000000000000000f RSI: 00007fe85a9f60a0 RDI: 0000000000000005 [ 309.344153][ T9490] RBP: 00007fe85a9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 309.344165][ T9490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 309.344177][ T9490] R13: 00007fe85c9e6038 R14: 00007fe85c9e5fa0 R15: 00007ffd89662058 [ 309.344213][ T9490] [ 309.778197][ T9504] binder: 9501:9504 ioctl c0306201 0 returned -14 [ 310.144073][ T5873] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 310.304011][ T5873] usb 9-1: Using ep0 maxpacket: 8 [ 310.312703][ T5873] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 310.321812][ T5873] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.329945][ T5873] usb 9-1: Product: syz [ 310.334142][ T5873] usb 9-1: Manufacturer: syz [ 310.338747][ T5873] usb 9-1: SerialNumber: syz [ 310.347536][ T5873] usb 9-1: config 0 descriptor?? [ 310.557439][ T5873] usb 9-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 311.043993][ T794] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 311.204682][ T794] usb 6-1: too many configurations: 120, using maximum allowed: 8 [ 311.223652][ T794] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 311.233064][ T794] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.241134][ T794] usb 6-1: Product: syz [ 311.246326][ T794] usb 6-1: Manufacturer: syz [ 311.250957][ T794] usb 6-1: SerialNumber: syz [ 311.261038][ T794] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 311.301463][ T5893] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 311.511367][ T9521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 311.520589][ T9521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 311.529432][ T9521] netlink: 'syz.5.1085': attribute type 6 has an invalid length. [ 311.537248][ T9521] netlink: 76 bytes leftover after parsing attributes in process `syz.5.1085'. [ 311.549538][ T9521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 311.558972][ T9521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 311.569164][ T9521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 311.578169][ T9521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 311.590172][ T24] usb 6-1: USB disconnect, device number 60 [ 311.975727][ T5873] usb 9-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 311.986303][ T5873] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 311.995147][ T5873] usb 9-1: media controller created [ 312.012918][ T5873] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 312.060354][ T5873] i2c i2c-1: Added multiplexed i2c bus 2 [ 312.066074][ T5873] rtl2832 1-0010: Realtek RTL2832 successfully attached [ 312.073347][ T5873] usb 9-1: DVB: registering adapter 1 frontend 0 (Realtek RTL2832 (DVB-T))... [ 312.084883][ T5873] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 312.209804][ T5873] usb 9-1: USB disconnect, device number 20 [ 312.344183][ T5893] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 312.351489][ T5893] ath9k_htc: Failed to initialize the device [ 312.360755][ T24] usb 6-1: ath9k_htc: USB layer deinitialized [ 312.705637][ T24] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 312.854982][ T56] block nbd2: Possible stuck request ffff888025a60000: control (read@0,4096B). Runtime 120 seconds [ 312.873943][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 312.885649][ T24] usb 6-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 312.895747][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.905538][ T24] usb 6-1: Product: syz [ 312.909852][ T24] usb 6-1: Manufacturer: syz [ 312.914918][ T24] usb 6-1: SerialNumber: syz [ 312.924531][ T24] usb 6-1: config 0 descriptor?? [ 312.935975][ T24] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 313.223945][ T794] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 313.343709][ T9528] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.352575][ T9528] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 313.385945][ T794] usb 9-1: config index 0 descriptor too short (expected 39, got 27) [ 313.394247][ T794] usb 9-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 48, changing to 9 [ 313.405479][ T794] usb 9-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 8192, setting to 1024 [ 313.416886][ T794] usb 9-1: config 0 interface 0 has no altsetting 0 [ 313.426099][ T794] usb 9-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 313.435850][ T794] usb 9-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 313.444135][ T794] usb 9-1: Product: syz [ 313.448959][ T794] usb 9-1: Manufacturer: syz [ 313.453598][ T794] usb 9-1: SerialNumber: syz [ 313.461034][ T794] usb 9-1: config 0 descriptor?? [ 313.471342][ T794] hub 9-1:0.0: bad descriptor, ignoring hub [ 313.477906][ T794] hub 9-1:0.0: probe with driver hub failed with error -5 [ 313.488142][ T794] usb 9-1: selecting invalid altsetting 0 [ 313.774313][ T794] usb 9-1: USB disconnect, device number 21 [ 314.032722][ T794] usb 6-1: USB disconnect, device number 61 [ 314.535838][ T794] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 314.646363][ T9557] netlink: 14556 bytes leftover after parsing attributes in process `syz.5.1096'. [ 314.695737][ T794] usb 9-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 314.706917][ T794] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 314.717892][ T794] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 314.727656][ T794] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 314.741752][ T794] usb 9-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 314.751296][ T794] usb 9-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 314.760346][ T794] usb 9-1: Manufacturer: syz [ 314.767061][ T794] usb 9-1: config 0 descriptor?? [ 315.179628][ T794] appleir 0003:05AC:8243.001A: unknown main item tag 0x0 [ 315.191741][ T794] appleir 0003:05AC:8243.001A: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.8-1/input0 [ 315.465763][ T9559] FAULT_INJECTION: forcing a failure. [ 315.465763][ T9559] name failslab, interval 1, probability 0, space 0, times 0 [ 315.481208][ T9559] CPU: 0 UID: 0 PID: 9559 Comm: syz.5.1097 Not tainted syzkaller #0 PREEMPT(full) [ 315.481236][ T9559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 315.481248][ T9559] Call Trace: [ 315.481256][ T9559] [ 315.481265][ T9559] dump_stack_lvl+0x189/0x250 [ 315.481296][ T9559] ? __pfx____ratelimit+0x10/0x10 [ 315.481321][ T9559] ? __pfx_dump_stack_lvl+0x10/0x10 [ 315.481345][ T9559] ? __pfx__printk+0x10/0x10 [ 315.481375][ T9559] ? __pfx___might_resched+0x10/0x10 [ 315.481393][ T9559] ? fs_reclaim_acquire+0x7d/0x100 [ 315.481425][ T9559] should_fail_ex+0x414/0x560 [ 315.481452][ T9559] should_failslab+0xa8/0x100 [ 315.481474][ T9559] kmem_cache_alloc_noprof+0x88/0x700 [ 315.481500][ T9559] ? security_file_alloc+0x34/0x330 [ 315.481527][ T9559] security_file_alloc+0x34/0x330 [ 315.481548][ T9559] init_file+0x93/0x2f0 [ 315.481579][ T9559] alloc_empty_file+0x6e/0x1d0 [ 315.481606][ T9559] alloc_file_pseudo+0x13d/0x210 [ 315.481637][ T9559] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 315.481661][ T9559] ? evm_inode_alloc_security+0x40/0xb0 [ 315.481682][ T9559] ? security_inode_alloc+0xd5/0x330 [ 315.481721][ T9559] sock_alloc_file+0xb8/0x2e0 [ 315.481751][ T9559] do_accept+0x34b/0x680 [ 315.481784][ T9559] ? __pfx_do_accept+0x10/0x10 [ 315.481835][ T9559] __sys_accept4+0x11c/0x1c0 [ 315.481863][ T9559] ? __pfx___sys_accept4+0x10/0x10 [ 315.481887][ T9559] ? ksys_write+0x22a/0x250 [ 315.481908][ T9559] ? __pfx_ksys_write+0x10/0x10 [ 315.481934][ T9559] __x64_sys_accept4+0x9a/0xb0 [ 315.481954][ T9559] do_syscall_64+0xfa/0xfa0 [ 315.481978][ T9559] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.481997][ T9559] ? clear_bhb_loop+0x60/0xb0 [ 315.482020][ T9559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.482038][ T9559] RIP: 0033:0x7fd16c98f6c9 [ 315.482056][ T9559] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 315.482073][ T9559] RSP: 002b:00007fd16d85a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 315.482095][ T9559] RAX: ffffffffffffffda RBX: 00007fd16cbe5fa0 RCX: 00007fd16c98f6c9 [ 315.482108][ T9559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 315.482119][ T9559] RBP: 00007fd16d85a090 R08: 0000000000000000 R09: 0000000000000000 [ 315.482132][ T9559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 315.482143][ T9559] R13: 00007fd16cbe6038 R14: 00007fd16cbe5fa0 R15: 00007ffcfdb055e8 [ 315.482177][ T9559] [ 315.942571][ T794] usb 9-1: USB disconnect, device number 22 [ 316.024148][ T5873] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 316.174030][ T5873] usb 6-1: Using ep0 maxpacket: 8 [ 316.186473][ T5873] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 316.196019][ T5873] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 316.204105][ T5873] usb 6-1: Product: syz [ 316.208334][ T5873] usb 6-1: Manufacturer: syz [ 316.213467][ T5873] usb 6-1: SerialNumber: syz [ 316.220178][ T5873] usb 6-1: config 0 descriptor?? [ 316.430224][ T5873] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 316.825935][ T794] usb 9-1: new full-speed USB device number 23 using dummy_hcd [ 316.995844][ T794] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 317.007020][ T794] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 317.017683][ T794] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xAC, changing to 0x8C [ 317.030035][ T794] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 10 [ 317.041351][ T794] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 317.051234][ T794] usb 9-1: New USB device found, idVendor=10c4, idProduct=8acf, bcdDevice= 0.00 [ 317.060570][ T794] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 317.072099][ T794] usb 9-1: config 0 descriptor?? [ 317.310763][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.488774][ T794] hid-u2fzero 0003:10C4:8ACF.001B: unknown main item tag 0x0 [ 317.496886][ T794] hid-u2fzero 0003:10C4:8ACF.001B: unknown main item tag 0x0 [ 317.504438][ T794] hid-u2fzero 0003:10C4:8ACF.001B: unknown main item tag 0x0 [ 317.511890][ T794] hid-u2fzero 0003:10C4:8ACF.001B: unknown main item tag 0x0 [ 317.519546][ T794] hid-u2fzero 0003:10C4:8ACF.001B: unknown main item tag 0x0 [ 317.533105][ T794] hid-u2fzero 0003:10C4:8ACF.001B: hidraw0: USB HID v0.00 Device [HID 10c4:8acf] on usb-dummy_hcd.8-1/input0 [ 317.548600][ T794] hid-u2fzero 0003:10C4:8ACF.001B: U2F Zero LED initialised [ 317.556366][ T794] hid-u2fzero 0003:10C4:8ACF.001B: U2F Zero RNG initialised [ 317.632864][ T9570] vhci_hcd vhci_hcd.0: pdev(9) rhport(0) sockfd(5) [ 317.639416][ T9570] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 317.649403][ T9570] vhci_hcd vhci_hcd.0: Device attached [ 317.656332][ T9571] vhci_hcd: cannot find the pending unlink 7 [ 317.689983][ T6997] usb 9-1: USB disconnect, device number 23 [ 317.863046][ T5873] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 317.874519][ T5873] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 317.882379][ T5873] usb 6-1: media controller created [ 317.893937][ T794] usb 51-1: new high-speed USB device number 4 using vhci_hcd [ 317.905097][ T5873] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 317.957982][ T5873] i2c i2c-1: Added multiplexed i2c bus 2 [ 317.963644][ T5873] rtl2832 1-0010: Realtek RTL2832 successfully attached [ 317.971161][ T5873] usb 6-1: DVB: registering adapter 1 frontend 0 (Realtek RTL2832 (DVB-T))... [ 317.980707][ T5873] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 318.095523][ T5873] usb 6-1: USB disconnect, device number 62 [ 318.233477][ T5838] Bluetooth: hci0: sending frame failed (-49) [ 318.241165][ T5828] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 318.302654][ T9578] netlink: 'syz.8.1103': attribute type 21 has an invalid length. [ 318.311102][ T9578] netlink: 164 bytes leftover after parsing attributes in process `syz.8.1103'. [ 318.409751][ T9571] vhci_hcd: connection reset by peer [ 318.415807][ T3547] vhci_hcd vhci_hcd.9: stop threads [ 318.421094][ T3547] vhci_hcd vhci_hcd.9: release socket [ 318.426927][ T3547] vhci_hcd vhci_hcd.9: disconnect device [ 318.617960][ T5838] Bluetooth: hci0: sending frame failed (-49) [ 318.625468][ T5828] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 318.632018][ T5911] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 318.774748][ T9587] FAULT_INJECTION: forcing a failure. [ 318.774748][ T9587] name failslab, interval 1, probability 0, space 0, times 0 [ 318.788746][ T9587] CPU: 0 UID: 0 PID: 9587 Comm: syz.5.1107 Not tainted syzkaller #0 PREEMPT(full) [ 318.788773][ T9587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 318.788785][ T9587] Call Trace: [ 318.788795][ T9587] [ 318.788804][ T9587] dump_stack_lvl+0x189/0x250 [ 318.788834][ T9587] ? __pfx____ratelimit+0x10/0x10 [ 318.788859][ T9587] ? __pfx_dump_stack_lvl+0x10/0x10 [ 318.788883][ T9587] ? __pfx__printk+0x10/0x10 [ 318.788909][ T9587] ? __pfx___might_resched+0x10/0x10 [ 318.788932][ T9587] ? fs_reclaim_acquire+0x7d/0x100 [ 318.788967][ T9587] should_fail_ex+0x414/0x560 [ 318.788994][ T9587] should_failslab+0xa8/0x100 [ 318.789016][ T9587] __kmalloc_cache_noprof+0x84/0x700 [ 318.789045][ T9587] ? binder_transaction+0x69c/0x6450 [ 318.789064][ T9587] ? do_raw_spin_unlock+0x122/0x240 [ 318.789097][ T9587] binder_transaction+0x69c/0x6450 [ 318.789121][ T9587] ? register_lock_class+0x51/0x320 [ 318.789172][ T9587] ? process_measurement+0x3d8/0x1a40 [ 318.789195][ T9587] ? ima_match_policy+0x115/0x21e0 [ 318.789228][ T9587] ? __pfx_binder_transaction+0x10/0x10 [ 318.789256][ T9587] ? __lock_acquire+0xab9/0xd20 [ 318.789289][ T9587] ? __might_fault+0xb0/0x130 [ 318.789340][ T9587] binder_ioctl_write_read+0xd5a/0xa070 [ 318.789395][ T9587] ? __kernel_text_address+0xd/0x40 [ 318.789426][ T9587] ? arch_stack_walk+0xfc/0x150 [ 318.789462][ T9587] ? __pfx_binder_ioctl_write_read+0x10/0x10 [ 318.789489][ T9587] ? stack_trace_save+0x9c/0xe0 [ 318.789518][ T9587] ? __pfx_stack_trace_save+0x10/0x10 [ 318.789549][ T9587] ? stack_depot_save_flags+0x40/0x860 [ 318.789580][ T9587] ? kasan_save_track+0x4f/0x80 [ 318.789603][ T9587] ? kasan_save_track+0x3e/0x80 [ 318.789627][ T9587] ? kasan_save_free_info+0x46/0x50 [ 318.789648][ T9587] ? __kasan_slab_free+0x5c/0x80 [ 318.789674][ T9587] ? kfree+0x191/0x6e0 [ 318.789694][ T9587] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 318.789716][ T9587] ? security_file_ioctl+0xcb/0x2d0 [ 318.789735][ T9587] ? __se_sys_ioctl+0x47/0x170 [ 318.789761][ T9587] ? do_syscall_64+0xfa/0xfa0 [ 318.789783][ T9587] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.789824][ T9587] ? __pfx_binder_debug+0x10/0x10 [ 318.789848][ T5911] usb 9-1: device descriptor read/64, error -71 [ 318.789850][ T9587] ? do_raw_spin_lock+0x121/0x290 [ 318.789894][ T9587] ? _raw_spin_unlock+0x28/0x50 [ 318.789913][ T9587] ? binder_get_thread+0x178/0x6d0 [ 318.789943][ T9587] binder_ioctl+0x3d0/0x19c0 [ 318.789963][ T9587] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 318.789988][ T9587] ? do_vfs_ioctl+0xbe8/0x1430 [ 318.790004][ T9587] ? __pfx_binder_ioctl+0x10/0x10 [ 318.790020][ T9587] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 318.790075][ T9587] ? __fget_files+0x2a/0x420 [ 318.790101][ T9587] ? __fget_files+0x3a0/0x420 [ 318.790120][ T9587] ? __fget_files+0x2a/0x420 [ 318.790152][ T9587] ? bpf_lsm_file_ioctl+0x9/0x20 [ 318.790168][ T9587] ? __pfx_binder_ioctl+0x10/0x10 [ 318.790185][ T9587] __se_sys_ioctl+0xfc/0x170 [ 318.790213][ T9587] do_syscall_64+0xfa/0xfa0 [ 318.790235][ T9587] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.790252][ T9587] ? clear_bhb_loop+0x60/0xb0 [ 318.790273][ T9587] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.790290][ T9587] RIP: 0033:0x7fd16c98f6c9 [ 318.790307][ T9587] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 318.790323][ T9587] RSP: 002b:00007fd16d85a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 318.790343][ T9587] RAX: ffffffffffffffda RBX: 00007fd16cbe5fa0 RCX: 00007fd16c98f6c9 [ 318.790356][ T9587] RDX: 00002000000001c0 RSI: 00000000c0306201 RDI: 0000000000000003 [ 318.790368][ T9587] RBP: 00007fd16d85a090 R08: 0000000000000000 R09: 0000000000000000 [ 318.790379][ T9587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 318.790390][ T9587] R13: 00007fd16cbe6038 R14: 00007fd16cbe5fa0 R15: 00007ffcfdb055e8 [ 318.790420][ T9587] [ 319.022492][ T9596] FAULT_INJECTION: forcing a failure. [ 319.022492][ T9596] name failslab, interval 1, probability 0, space 0, times 0 [ 319.195060][ T9596] CPU: 0 UID: 0 PID: 9596 Comm: syz.9.1109 Not tainted syzkaller #0 PREEMPT(full) [ 319.195088][ T9596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 319.195101][ T9596] Call Trace: [ 319.195108][ T9596] [ 319.195116][ T9596] dump_stack_lvl+0x189/0x250 [ 319.195145][ T9596] ? __pfx____ratelimit+0x10/0x10 [ 319.195167][ T9596] ? __pfx_dump_stack_lvl+0x10/0x10 [ 319.195189][ T9596] ? __pfx__printk+0x10/0x10 [ 319.195208][ T9596] ? save_netdev_trace_buffer+0x4b5/0x5a0 [ 319.195253][ T9596] should_fail_ex+0x414/0x560 [ 319.195281][ T9596] should_failslab+0xa8/0x100 [ 319.195302][ T9596] kmem_cache_alloc_noprof+0x88/0x700 [ 319.195325][ T9596] ? skb_clone+0x212/0x3a0 [ 319.195354][ T9596] skb_clone+0x212/0x3a0 [ 319.195382][ T9596] __netlink_deliver_tap+0x424/0x8b0 [ 319.195416][ T9596] ? netlink_deliver_tap+0x2e/0x1b0 [ 319.195438][ T9596] netlink_deliver_tap+0x19c/0x1b0 [ 319.195459][ T9596] netlink_unicast+0x7fa/0x9e0 [ 319.195487][ T9596] ? __pfx_netlink_unicast+0x10/0x10 [ 319.195510][ T9596] ? netlink_sendmsg+0x642/0xb30 [ 319.195531][ T9596] ? skb_put+0x11b/0x210 [ 319.195555][ T9596] netlink_sendmsg+0x805/0xb30 [ 319.195589][ T9596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 319.195615][ T9596] ? aa_sock_msg_perm+0xf1/0x1d0 [ 319.195641][ T9596] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 319.195663][ T9596] ? __pfx_netlink_sendmsg+0x10/0x10 [ 319.195684][ T9596] __sock_sendmsg+0x21c/0x270 [ 319.195711][ T9596] ____sys_sendmsg+0x505/0x870 [ 319.195739][ T9596] ? __pfx_____sys_sendmsg+0x10/0x10 [ 319.195771][ T9596] ? import_iovec+0x74/0xa0 [ 319.195800][ T9596] ___sys_sendmsg+0x21f/0x2a0 [ 319.195826][ T9596] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.195892][ T9596] ? __fget_files+0x2a/0x420 [ 319.195915][ T9596] ? __fget_files+0x3a0/0x420 [ 319.195958][ T9596] __x64_sys_sendmsg+0x19b/0x260 [ 319.195983][ T9596] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 319.196015][ T9596] ? __pfx_ksys_write+0x10/0x10 [ 319.196040][ T9596] ? do_syscall_64+0xbe/0xfa0 [ 319.196067][ T9596] do_syscall_64+0xfa/0xfa0 [ 319.196090][ T9596] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.196110][ T9596] ? clear_bhb_loop+0x60/0xb0 [ 319.196132][ T9596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.196150][ T9596] RIP: 0033:0x7f037518f6c9 [ 319.196168][ T9596] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 319.196185][ T9596] RSP: 002b:00007f0376050038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.196207][ T9596] RAX: ffffffffffffffda RBX: 00007f03753e5fa0 RCX: 00007f037518f6c9 [ 319.196221][ T9596] RDX: 0000000000040004 RSI: 0000200000000180 RDI: 0000000000000003 [ 319.196234][ T9596] RBP: 00007f0376050090 R08: 0000000000000000 R09: 0000000000000000 [ 319.196247][ T9596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 319.196259][ T9596] R13: 00007f03753e6038 R14: 00007f03753e5fa0 R15: 00007ffc536d4748 [ 319.196293][ T9596] [ 319.354028][ T5911] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 319.626140][ T9605] binder: 9604:9605 unknown command 0 [ 319.631707][ T9605] binder: 9604:9605 ioctl c0306201 200000000180 returned -22 [ 319.694012][ T5911] usb 9-1: device descriptor read/64, error -71 [ 319.779691][ T5838] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 319.790434][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 319.800001][ T5838] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 319.808090][ T5911] usb usb9-port1: attempt power cycle [ 319.813975][ T5838] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 319.825302][ T5838] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 320.015568][ T5893] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 320.073512][ T9607] chnl_net:caif_netlink_parms(): no params data found [ 320.156702][ T5911] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 320.169122][ T3547] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.187321][ T5911] usb 9-1: device descriptor read/8, error -71 [ 320.203947][ T5893] usb 6-1: Using ep0 maxpacket: 8 [ 320.213226][ T5893] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 320.222471][ T5893] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.230533][ T5893] usb 6-1: Product: syz [ 320.234842][ T5893] usb 6-1: Manufacturer: syz [ 320.239464][ T5893] usb 6-1: SerialNumber: syz [ 320.247556][ T5893] usb 6-1: config 0 descriptor?? [ 320.275951][ T3547] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.293640][ T9607] bridge0: port 1(bridge_slave_0) entered blocking state [ 320.301514][ T9607] bridge0: port 1(bridge_slave_0) entered disabled state [ 320.311427][ T9607] bridge_slave_0: entered allmulticast mode [ 320.321812][ T9607] bridge_slave_0: entered promiscuous mode [ 320.343609][ T3547] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.358377][ T9607] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.366181][ T9607] bridge0: port 2(bridge_slave_1) entered disabled state [ 320.373432][ T9607] bridge_slave_1: entered allmulticast mode [ 320.381221][ T9607] bridge_slave_1: entered promiscuous mode [ 320.424627][ T5911] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 320.427743][ T3547] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 320.449438][ T5911] usb 9-1: device descriptor read/8, error -71 [ 320.458774][ T5893] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 320.478742][ T9607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 320.491300][ T9607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 320.557984][ T9607] team0: Port device team_slave_0 added [ 320.565736][ T5911] usb usb9-port1: unable to enumerate USB device [ 320.575824][ T9607] team0: Port device team_slave_1 added [ 320.644623][ T9607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 320.651606][ T9607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 320.677998][ T9607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 320.693228][ T9607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 320.701062][ T9607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 320.727967][ T9607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 320.806374][ T3547] bridge_slave_1: left allmulticast mode [ 320.812171][ T3547] bridge_slave_1: left promiscuous mode [ 320.818794][ T3547] bridge0: port 2(bridge_slave_1) entered disabled state [ 320.829030][ T3547] bridge_slave_0: left allmulticast mode [ 320.835145][ T3547] bridge_slave_0: left promiscuous mode [ 320.840959][ T3547] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.220248][ T3547] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 321.232288][ T3547] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 321.242763][ T3547] bond0 (unregistering): Released all slaves [ 321.262951][ T9607] hsr_slave_0: entered promiscuous mode [ 321.270107][ T9607] hsr_slave_1: entered promiscuous mode [ 321.279743][ T9607] debugfs: 'hsr0' already exists in 'hsr' [ 321.286110][ T9607] Cannot create hsr debugfs directory [ 321.568635][ T3547] hsr_slave_0: left promiscuous mode [ 321.575693][ T3547] hsr_slave_1: left promiscuous mode [ 321.581781][ T3547] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 321.589812][ T3547] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 321.598316][ T3547] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 321.606586][ T3547] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 321.625183][ T3547] veth1_macvtap: left promiscuous mode [ 321.630713][ T3547] veth0_macvtap: left promiscuous mode [ 321.639402][ T3547] veth1_vlan: left promiscuous mode [ 321.644904][ T3547] veth0_vlan: left promiscuous mode [ 321.740123][ T3547] pimreg (unregistering): left allmulticast mode [ 321.866954][ T9] usb 9-1: new high-speed USB device number 28 using dummy_hcd [ 321.867000][ T5828] Bluetooth: hci0: command tx timeout [ 321.924359][ T5893] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 321.938359][ T5893] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 321.947746][ T5893] usb 6-1: media controller created [ 321.966931][ T5893] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 322.016939][ T9] usb 9-1: Using ep0 maxpacket: 16 [ 322.032490][ T9] usb 9-1: config 254 has an invalid interface number: 235 but max is 0 [ 322.055805][ T9] usb 9-1: config 254 has an invalid descriptor of length 0, skipping remainder of the config [ 322.070342][ T5893] i2c i2c-1: Added multiplexed i2c bus 2 [ 322.076118][ T9] usb 9-1: config 254 has no interface number 0 [ 322.082516][ T9] usb 9-1: config 254 interface 235 altsetting 2 endpoint 0x6 has invalid wMaxPacketSize 0 [ 322.092729][ T5893] rtl2832 1-0010: Realtek RTL2832 successfully attached [ 322.100579][ T5893] usb 6-1: DVB: registering adapter 1 frontend 0 (Realtek RTL2832 (DVB-T))... [ 322.110656][ T9] usb 9-1: config 254 interface 235 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 322.125767][ T5893] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 322.136742][ T9] usb 9-1: config 254 interface 235 has no altsetting 0 [ 322.156052][ T9] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 322.165479][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 322.173522][ T9] usb 9-1: Product: syz [ 322.178434][ T9] usb 9-1: Manufacturer: syz [ 322.183080][ T9] usb 9-1: SerialNumber: syz [ 322.195435][ T9] usbtest 9-1:254.235: couldn't get endpoints, -22 [ 322.202191][ T9] usbtest 9-1:254.235: probe with driver usbtest failed with error -22 [ 322.287590][ T3547] team0 (unregistering): Port device team_slave_1 removed [ 322.290550][ T5893] usb 6-1: USB disconnect, device number 63 [ 322.332477][ T3547] team0 (unregistering): Port device team_slave_0 removed [ 322.543701][ T9626] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 322.570815][ T9626] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 322.917185][ T9637] FAULT_INJECTION: forcing a failure. [ 322.917185][ T9637] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 322.930365][ T9637] CPU: 1 UID: 0 PID: 9637 Comm: syz.5.1118 Not tainted syzkaller #0 PREEMPT(full) [ 322.930391][ T9637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 322.930403][ T9637] Call Trace: [ 322.930412][ T9637] [ 322.930422][ T9637] dump_stack_lvl+0x189/0x250 [ 322.930451][ T9637] ? __pfx____ratelimit+0x10/0x10 [ 322.930475][ T9637] ? __pfx_dump_stack_lvl+0x10/0x10 [ 322.930499][ T9637] ? __pfx__printk+0x10/0x10 [ 322.930523][ T9637] ? __might_fault+0xb0/0x130 [ 322.930559][ T9637] should_fail_ex+0x414/0x560 [ 322.930586][ T9637] _copy_from_user+0x2d/0xb0 [ 322.930613][ T9637] memdup_user+0x5e/0xd0 [ 322.930632][ T9637] ? __pfx_do_set_msr+0x10/0x10 [ 322.930652][ T9637] msr_io+0x125/0x8d0 [ 322.930675][ T9637] ? __pfx_do_set_msr+0x10/0x10 [ 322.930693][ T9637] ? kvm_arch_vcpu_ioctl+0x6bd/0x2a70 [ 322.930714][ T9637] ? __pfx_msr_io+0x10/0x10 [ 322.930737][ T9637] ? __srcu_check_read_flavor+0x106/0x260 [ 322.930762][ T9637] kvm_arch_vcpu_ioctl+0x6f7/0x2a70 [ 322.930784][ T9637] ? kvm_arch_vcpu_ioctl+0x6bd/0x2a70 [ 322.930807][ T9637] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 322.930829][ T9637] ? __lock_acquire+0xab9/0xd20 [ 322.930872][ T9637] ? is_bpf_text_address+0x26/0x2b0 [ 322.930905][ T9637] ? is_bpf_text_address+0x292/0x2b0 [ 322.930930][ T9637] ? is_bpf_text_address+0x26/0x2b0 [ 322.930960][ T9637] ? kernel_text_address+0xa5/0xe0 [ 322.930987][ T9637] ? __kernel_text_address+0xd/0x40 [ 322.931012][ T9637] ? unwind_get_return_address+0x4d/0x90 [ 322.931034][ T9637] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 322.931062][ T9637] ? arch_stack_walk+0xfc/0x150 [ 322.931109][ T9637] ? __pfx_stack_trace_save+0x10/0x10 [ 322.931139][ T9637] ? stack_depot_save_flags+0x40/0x860 [ 322.931180][ T9637] ? __lock_acquire+0xab9/0xd20 [ 322.931211][ T9637] ? __mutex_trylock_common+0x153/0x260 [ 322.931238][ T9637] ? __pfx___mutex_trylock_common+0x10/0x10 [ 322.931267][ T9637] ? rcu_is_watching+0x15/0xb0 [ 322.931291][ T9637] ? trace_contention_end+0x39/0x120 [ 322.931316][ T9637] ? __mutex_lock+0x335/0x1350 [ 322.931349][ T9637] ? kasan_quarantine_put+0xdd/0x220 [ 322.931374][ T9637] ? lockdep_hardirqs_on+0x9c/0x150 [ 322.931398][ T9637] ? kvm_vcpu_ioctl+0x269/0xed0 [ 322.931426][ T9637] ? __pfx___mutex_lock+0x10/0x10 [ 322.931451][ T9637] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 322.931480][ T9637] ? do_vfs_ioctl+0xbe8/0x1430 [ 322.931498][ T9637] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 322.931523][ T9637] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 322.931545][ T9637] kvm_vcpu_ioctl+0x78b/0xed0 [ 322.931578][ T9637] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 322.931629][ T9637] ? __fget_files+0x2a/0x420 [ 322.931658][ T9637] ? __fget_files+0x3a0/0x420 [ 322.931680][ T9637] ? __fget_files+0x2a/0x420 [ 322.931708][ T9637] ? bpf_lsm_file_ioctl+0x9/0x20 [ 322.931727][ T9637] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 322.931752][ T9637] __se_sys_ioctl+0xfc/0x170 [ 322.931782][ T9637] do_syscall_64+0xfa/0xfa0 [ 322.931804][ T9637] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.931820][ T9637] ? clear_bhb_loop+0x60/0xb0 [ 322.931840][ T9637] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 322.931855][ T9637] RIP: 0033:0x7fd16c98f6c9 [ 322.931870][ T9637] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 322.931883][ T9637] RSP: 002b:00007fd16d85a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 322.931902][ T9637] RAX: ffffffffffffffda RBX: 00007fd16cbe5fa0 RCX: 00007fd16c98f6c9 [ 322.931914][ T9637] RDX: 0000200000000280 RSI: 000000004008ae89 RDI: 0000000000000005 [ 322.931924][ T9637] RBP: 00007fd16d85a090 R08: 0000000000000000 R09: 0000000000000000 [ 322.931933][ T9637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 322.931943][ T9637] R13: 00007fd16cbe6038 R14: 00007fd16cbe5fa0 R15: 00007ffcfdb055e8 [ 322.931971][ T9637] [ 322.984309][ T794] vhci_hcd vhci_hcd.9: vhci_device speed not set [ 323.487754][ T5893] usb 9-1: USB disconnect, device number 28 [ 323.947523][ T5828] Bluetooth: hci0: command tx timeout [ 324.051387][ T9607] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 324.063488][ T9607] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 324.074416][ T9607] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 324.091669][ T9607] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 324.326073][ T9607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 324.365323][ T9607] 8021q: adding VLAN 0 to HW filter on device team0 [ 324.382253][ T1090] bridge0: port 1(bridge_slave_0) entered blocking state [ 324.389502][ T1090] bridge0: port 1(bridge_slave_0) entered forwarding state [ 324.413501][ T3547] bridge0: port 2(bridge_slave_1) entered blocking state [ 324.420756][ T3547] bridge0: port 2(bridge_slave_1) entered forwarding state [ 324.473929][ T5893] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 324.494386][ T794] usb 9-1: new high-speed USB device number 29 using dummy_hcd [ 324.644000][ T5893] usb 6-1: Using ep0 maxpacket: 8 [ 324.657156][ T794] usb 9-1: Using ep0 maxpacket: 8 [ 324.670917][ T5893] usb 6-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 324.689195][ T794] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 324.703962][ T5893] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.718137][ T794] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.734124][ T5893] usb 6-1: Product: syz [ 324.738396][ T794] usb 9-1: Product: syz [ 324.742581][ T794] usb 9-1: Manufacturer: syz [ 324.748526][ T5893] usb 6-1: Manufacturer: syz [ 324.753153][ T5893] usb 6-1: SerialNumber: syz [ 324.776204][ T794] usb 9-1: SerialNumber: syz [ 324.791987][ T5893] usb 6-1: config 0 descriptor?? [ 324.805044][ T794] usb 9-1: config 0 descriptor?? [ 324.816696][ T5893] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 324.852201][ T9607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 324.936884][ T9607] veth0_vlan: entered promiscuous mode [ 324.956248][ T9607] veth1_vlan: entered promiscuous mode [ 325.030082][ T794] usb 9-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 325.043483][ T9607] veth0_macvtap: entered promiscuous mode [ 325.058436][ T9607] veth1_macvtap: entered promiscuous mode [ 325.109880][ T9607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 325.132248][ T9607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 325.154550][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.163572][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.176831][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.186006][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.251517][ T9668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 325.272717][ T9668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 325.366816][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 325.383921][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 325.453603][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 325.462509][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 325.800465][ T9710] FAULT_INJECTION: forcing a failure. [ 325.800465][ T9710] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 325.814469][ T9710] CPU: 0 UID: 0 PID: 9710 Comm: syz.1.1126 Not tainted syzkaller #0 PREEMPT(full) [ 325.814497][ T9710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 325.814510][ T9710] Call Trace: [ 325.814519][ T9710] [ 325.814528][ T9710] dump_stack_lvl+0x189/0x250 [ 325.814557][ T9710] ? __pfx____ratelimit+0x10/0x10 [ 325.814581][ T9710] ? __pfx_dump_stack_lvl+0x10/0x10 [ 325.814606][ T9710] ? __pfx__printk+0x10/0x10 [ 325.814630][ T9710] ? __might_fault+0xb0/0x130 [ 325.814667][ T9710] should_fail_ex+0x414/0x560 [ 325.814696][ T9710] _copy_from_iter+0x1de/0x1790 [ 325.814726][ T9710] ? rcu_is_watching+0x15/0xb0 [ 325.814758][ T9710] ? __pfx__copy_from_iter+0x10/0x10 [ 325.814781][ T9710] ? __build_skb_around+0x22d/0x3f0 [ 325.814808][ T9710] ? netlink_sendmsg+0x642/0xb30 [ 325.814838][ T9710] ? skb_put+0x11b/0x210 [ 325.814863][ T9710] netlink_sendmsg+0x6b2/0xb30 [ 325.814895][ T9710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 325.814923][ T9710] ? aa_sock_msg_perm+0xf1/0x1d0 [ 325.814953][ T9710] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 325.814980][ T9710] ? __pfx_netlink_sendmsg+0x10/0x10 [ 325.815003][ T9710] __sock_sendmsg+0x21c/0x270 [ 325.815034][ T9710] ____sys_sendmsg+0x505/0x870 [ 325.815064][ T9710] ? __pfx_____sys_sendmsg+0x10/0x10 [ 325.815096][ T9710] ? import_iovec+0x74/0xa0 [ 325.815126][ T9710] ___sys_sendmsg+0x21f/0x2a0 [ 325.815152][ T9710] ? __pfx____sys_sendmsg+0x10/0x10 [ 325.815214][ T9710] ? __fget_files+0x2a/0x420 [ 325.815238][ T9710] ? __fget_files+0x3a0/0x420 [ 325.815273][ T9710] __x64_sys_sendmsg+0x19b/0x260 [ 325.815298][ T9710] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 325.815331][ T9710] ? __pfx_ksys_write+0x10/0x10 [ 325.815356][ T9710] ? do_syscall_64+0xbe/0xfa0 [ 325.815385][ T9710] do_syscall_64+0xfa/0xfa0 [ 325.815410][ T9710] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.815431][ T9710] ? clear_bhb_loop+0x60/0xb0 [ 325.815454][ T9710] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 325.815472][ T9710] RIP: 0033:0x7f02bdb8f6c9 [ 325.815492][ T9710] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 325.815508][ T9710] RSP: 002b:00007f02beaea038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 325.815530][ T9710] RAX: ffffffffffffffda RBX: 00007f02bdde5fa0 RCX: 00007f02bdb8f6c9 [ 325.815544][ T9710] RDX: 0000000024000840 RSI: 0000200000009b40 RDI: 0000000000000003 [ 325.815557][ T9710] RBP: 00007f02beaea090 R08: 0000000000000000 R09: 0000000000000000 [ 325.815570][ T9710] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 325.815582][ T9710] R13: 00007f02bdde6038 R14: 00007f02bdde5fa0 R15: 00007ffe52231dd8 [ 325.815616][ T9710] [ 326.129894][ T5828] Bluetooth: hci0: command tx timeout [ 326.159533][ T43] usb 6-1: USB disconnect, device number 64 [ 326.234002][ T9719] binder: 9718:9719 ioctl c0306201 200000000080 returned -14 [ 326.247418][ T9719] binder: 9718:9719 ioctl c0306201 2000000003c0 returned -14 [ 326.257990][ T9719] binder: 9718:9719 ioctl c0306201 200000000180 returned -14 [ 326.583972][ T9] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 326.714411][ T9] usb 2-1: device descriptor read/64, error -71 [ 326.791160][ T794] usb 9-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 326.811393][ T794] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 326.820616][ T794] usb 9-1: media controller created [ 326.856641][ T794] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 326.958163][ T794] i2c i2c-1: Added multiplexed i2c bus 2 [ 326.967673][ T794] rtl2832 1-0010: Realtek RTL2832 successfully attached [ 326.982779][ T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 326.992488][ T794] usb 9-1: DVB: registering adapter 1 frontend 0 (Realtek RTL2832 (DVB-T))... [ 327.006246][ T794] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 327.044891][ T43] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 327.134033][ T9] usb 2-1: device descriptor read/64, error -71 [ 327.156978][ T794] usb 9-1: USB disconnect, device number 29 [ 327.208894][ T43] usb 6-1: config 0 has an invalid interface number: 74 but max is 0 [ 327.226782][ T43] usb 6-1: config 0 has no interface number 0 [ 327.238159][ T43] usb 6-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice= 9.99 [ 327.247717][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.255715][ T9] usb usb2-port1: attempt power cycle [ 327.262296][ T43] usb 6-1: Product: syz [ 327.266730][ T43] usb 6-1: Manufacturer: syz [ 327.272239][ T43] usb 6-1: SerialNumber: syz [ 327.289019][ T43] usb 6-1: config 0 descriptor?? [ 327.551669][ T7086] usb 10-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-terratec-h7-az6007.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 327.574580][ T7086] dvb_usb_az6007 10-1:0.0: probe with driver dvb_usb_az6007 failed with error -110 [ 327.593748][ T7086] usb 10-1: USB disconnect, device number 2 [ 327.604147][ T9] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 327.634721][ T9] usb 2-1: device descriptor read/8, error -71 [ 327.723029][ T5828] Bluetooth: hci5: unexpected event for opcode 0x1005 [ 327.784555][ T5911] usb 6-1: USB disconnect, device number 65 [ 327.791538][ T5911] f81534a_ctrl 6-1:0.74: failed to set register 0x116: -19 [ 327.800963][ T5911] f81534a_ctrl 6-1:0.74: failed to enable ports: -19 [ 327.884151][ T9] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 327.915145][ T7086] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 327.924637][ T9] usb 2-1: device descriptor read/8, error -71 [ 328.044333][ T9] usb usb2-port1: unable to enumerate USB device [ 328.096117][ T7086] usb 10-1: config index 0 descriptor too short (expected 65183, got 72) [ 328.109881][ T7086] usb 10-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 328.123239][ T7086] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.135285][ T7086] usb 10-1: Product: syz [ 328.139645][ T7086] usb 10-1: Manufacturer: syz [ 328.145260][ T7086] usb 10-1: SerialNumber: syz [ 328.159514][ T7086] usb 10-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 328.180192][ T9] usb 10-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 328.190361][ T5828] Bluetooth: hci0: command tx timeout [ 328.429649][ T9742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.441856][ T9788] loop4: detected capacity change from 0 to 2559 [ 328.449372][ T9742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.460330][ T9788] buffer_io_error: 40 callbacks suppressed [ 328.460347][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.482189][ T9742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.492352][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.502972][ T9742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.511715][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.522624][ T9742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 328.532627][ T9742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 328.541099][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.586364][ T5893] usb 10-1: USB disconnect, device number 3 [ 328.594259][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.594422][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.594572][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.594690][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.594772][ T9788] ldm_validate_partition_table(): Disk read failed. [ 328.594825][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.594943][ T9788] Buffer I/O error on dev loop4, logical block 0, async page read [ 328.595299][ T9788] Dev loop4: unable to read RDB block 0 [ 328.595883][ T9788] loop4: unable to read partition table [ 328.596123][ T9788] loop_reread_partitions: partition scan of loop4 (3Ÿ ¾‚³˜) failed (rc=-5) [ 328.773305][ T9798] FAULT_INJECTION: forcing a failure. [ 328.773305][ T9798] name failslab, interval 1, probability 0, space 0, times 0 [ 328.804452][ T9798] CPU: 1 UID: 0 PID: 9798 Comm: syz.5.1135 Not tainted syzkaller #0 PREEMPT(full) [ 328.804481][ T9798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 328.804494][ T9798] Call Trace: [ 328.804502][ T9798] [ 328.804512][ T9798] dump_stack_lvl+0x189/0x250 [ 328.804548][ T9798] ? __pfx____ratelimit+0x10/0x10 [ 328.804573][ T9798] ? __pfx_dump_stack_lvl+0x10/0x10 [ 328.804597][ T9798] ? __pfx__printk+0x10/0x10 [ 328.804623][ T9798] ? __pfx___might_resched+0x10/0x10 [ 328.804646][ T9798] ? fs_reclaim_acquire+0x7d/0x100 [ 328.804680][ T9798] should_fail_ex+0x414/0x560 [ 328.804708][ T9798] should_failslab+0xa8/0x100 [ 328.804729][ T9798] kmem_cache_alloc_lru_noprof+0x8d/0x6e0 [ 328.804755][ T9798] ? __d_alloc+0x37/0x6f0 [ 328.804787][ T9798] __d_alloc+0x37/0x6f0 [ 328.804821][ T9798] d_alloc_parallel+0xe1/0x1610 [ 328.804850][ T9798] ? __lock_acquire+0xab9/0xd20 [ 328.804883][ T9798] ? __lock_acquire+0xab9/0xd20 [ 328.804910][ T9798] ? __pfx_d_alloc_parallel+0x10/0x10 [ 328.804944][ T9798] ? __raw_spin_lock_init+0x45/0x100 [ 328.804973][ T9798] ? __init_waitqueue_head+0xa9/0x150 [ 328.805007][ T9798] __lookup_slow+0x116/0x3d0 [ 328.805038][ T9798] ? __pfx___lookup_slow+0x10/0x10 [ 328.805077][ T9798] ? d_lookup+0x8a/0xa0 [ 328.805105][ T9798] ? lookup_noperm+0x112/0x220 [ 328.805142][ T9798] simple_start_creating+0xfd/0x1e0 [ 328.805168][ T9798] ? __pfx_simple_start_creating+0x10/0x10 [ 328.805207][ T9798] debugfs_start_creating+0xea/0x1b0 [ 328.805235][ T9798] __debugfs_create_file+0x79/0x4f0 [ 328.805267][ T9798] debugfs_create_file_full+0x3f/0x60 [ 328.805297][ T9798] ref_tracker_dir_debugfs+0x14e/0x2d0 [ 328.805320][ T9798] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 328.805374][ T9798] ? trace_kmalloc+0x1f/0xd0 [ 328.805396][ T9798] ? __kvmalloc_node_noprof+0x5f9/0x910 [ 328.805429][ T9798] ? __raw_spin_lock_init+0x45/0x100 [ 328.805459][ T9798] alloc_netdev_mqs+0x2b9/0x1200 [ 328.805484][ T9798] ? __pfx_bnep_net_setup+0x10/0x10 [ 328.805520][ T9798] bnep_add_connection+0x20f/0xc70 [ 328.805558][ T9798] ? __pfx_bnep_add_connection+0x10/0x10 [ 328.805586][ T9798] ? __fget_files+0x3a0/0x420 [ 328.805623][ T9798] do_bnep_sock_ioctl+0x40e/0x670 [ 328.805649][ T9798] ? kasan_quarantine_put+0xdd/0x220 [ 328.805678][ T9798] ? __pfx_do_bnep_sock_ioctl+0x10/0x10 [ 328.805715][ T9798] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 328.805746][ T9798] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 328.805783][ T9798] sock_do_ioctl+0xdc/0x300 [ 328.805812][ T9798] ? __pfx_sock_do_ioctl+0x10/0x10 [ 328.805858][ T9798] sock_ioctl+0x576/0x790 [ 328.805886][ T9798] ? __pfx_sock_ioctl+0x10/0x10 [ 328.805915][ T9798] ? __fget_files+0x3a0/0x420 [ 328.805937][ T9798] ? __fget_files+0x2a/0x420 [ 328.805967][ T9798] ? bpf_lsm_file_ioctl+0x9/0x20 [ 328.805986][ T9798] ? __pfx_sock_ioctl+0x10/0x10 [ 328.806021][ T9798] __se_sys_ioctl+0xfc/0x170 [ 328.806054][ T9798] do_syscall_64+0xfa/0xfa0 [ 328.806081][ T9798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.806101][ T9798] ? clear_bhb_loop+0x60/0xb0 [ 328.806126][ T9798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.806152][ T9798] RIP: 0033:0x7fd16c98f6c9 [ 328.806171][ T9798] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 328.806188][ T9798] RSP: 002b:00007fd16d85a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 328.806209][ T9798] RAX: ffffffffffffffda RBX: 00007fd16cbe5fa0 RCX: 00007fd16c98f6c9 [ 328.806224][ T9798] RDX: 0000200000000080 RSI: 00000000400442c8 RDI: 0000000000000005 [ 328.806237][ T9798] RBP: 00007fd16d85a090 R08: 0000000000000000 R09: 0000000000000000 [ 328.806250][ T9798] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 328.806262][ T9798] R13: 00007fd16cbe6038 R14: 00007fd16cbe5fa0 R15: 00007ffcfdb055e8 [ 328.806298][ T9798] [ 329.240610][ T9] ath9k_htc 10-1:1.0: ath9k_htc: Target is unresponsive [ 329.254871][ T9805] FAULT_INJECTION: forcing a failure. [ 329.254871][ T9805] name failslab, interval 1, probability 0, space 0, times 0 [ 329.255742][ T9] ath9k_htc: Failed to initialize the device [ 329.298019][ T5893] usb 10-1: ath9k_htc: USB layer deinitialized [ 329.308397][ T9805] CPU: 0 UID: 0 PID: 9805 Comm: syz.8.1136 Not tainted syzkaller #0 PREEMPT(full) [ 329.308422][ T9805] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 329.308434][ T9805] Call Trace: [ 329.308443][ T9805] [ 329.308451][ T9805] dump_stack_lvl+0x189/0x250 [ 329.308480][ T9805] ? __pfx____ratelimit+0x10/0x10 [ 329.308505][ T9805] ? __pfx_dump_stack_lvl+0x10/0x10 [ 329.308529][ T9805] ? __pfx__printk+0x10/0x10 [ 329.308554][ T9805] ? __pfx___might_resched+0x10/0x10 [ 329.308577][ T9805] ? fs_reclaim_acquire+0x7d/0x100 [ 329.308609][ T9805] should_fail_ex+0x414/0x560 [ 329.308635][ T9805] should_failslab+0xa8/0x100 [ 329.308657][ T9805] __kmalloc_cache_noprof+0x84/0x700 [ 329.308685][ T9805] ? dev_ethtool+0x126/0x19c0 [ 329.308715][ T9805] dev_ethtool+0x126/0x19c0 [ 329.308745][ T9805] ? __lock_acquire+0xab9/0xd20 [ 329.308772][ T9805] ? __pfx_dev_ethtool+0x10/0x10 [ 329.308809][ T9805] ? dev_load+0x21/0x1f0 [ 329.308831][ T9805] ? dev_load+0x21/0x1f0 [ 329.308853][ T9805] dev_ioctl+0x392/0x1150 [ 329.308878][ T9805] sock_do_ioctl+0x22c/0x300 [ 329.308908][ T9805] ? __pfx_sock_do_ioctl+0x10/0x10 [ 329.308951][ T9805] sock_ioctl+0x576/0x790 [ 329.308980][ T9805] ? __pfx_sock_ioctl+0x10/0x10 [ 329.309009][ T9805] ? __fget_files+0x3a0/0x420 [ 329.309031][ T9805] ? __fget_files+0x2a/0x420 [ 329.309068][ T9805] ? bpf_lsm_file_ioctl+0x9/0x20 [ 329.309088][ T9805] ? __pfx_sock_ioctl+0x10/0x10 [ 329.309112][ T9805] __se_sys_ioctl+0xfc/0x170 [ 329.309146][ T9805] do_syscall_64+0xfa/0xfa0 [ 329.309171][ T9805] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.309189][ T9805] ? clear_bhb_loop+0x60/0xb0 [ 329.309211][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.309229][ T9805] RIP: 0033:0x7fe85c78f6c9 [ 329.309248][ T9805] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 329.309264][ T9805] RSP: 002b:00007fe85a9f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 329.309288][ T9805] RAX: ffffffffffffffda RBX: 00007fe85c9e5fa0 RCX: 00007fe85c78f6c9 [ 329.309303][ T9805] RDX: 0000200000000f00 RSI: 0000000000008946 RDI: 0000000000000004 [ 329.309316][ T9805] RBP: 00007fe85a9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 329.309329][ T9805] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 329.309340][ T9805] R13: 00007fe85c9e6038 R14: 00007fe85c9e5fa0 R15: 00007ffd89662058 [ 329.309374][ T9805] [ 329.904387][ T7086] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 329.943963][ T5893] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 330.024758][ T794] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 330.053906][ T7086] usb 6-1: Using ep0 maxpacket: 8 [ 330.063551][ T7086] usb 6-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 330.072890][ T7086] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.082465][ T7086] usb 6-1: Product: syz [ 330.086861][ T7086] usb 6-1: Manufacturer: syz [ 330.091526][ T7086] usb 6-1: SerialNumber: syz [ 330.100004][ T7086] usb 6-1: config 0 descriptor?? [ 330.111549][ T7086] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 330.195987][ T794] usb 2-1: Using ep0 maxpacket: 8 [ 330.217269][ T794] usb 2-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 330.229085][ T794] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.247269][ T794] usb 2-1: Product: syz [ 330.251504][ T794] usb 2-1: Manufacturer: syz [ 330.256385][ T794] usb 2-1: SerialNumber: syz [ 330.266153][ T794] usb 2-1: config 0 descriptor?? [ 330.274723][ T5873] usb 9-1: new full-speed USB device number 30 using dummy_hcd [ 330.295962][ T794] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 330.314043][ T5893] usb 10-1: device descriptor read/64, error -71 [ 330.450397][ T5873] usb 9-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 330.468123][ T5873] usb 9-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 330.482547][ T5873] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.490742][ T5873] usb 9-1: Product: syz [ 330.495941][ T5873] usb 9-1: Manufacturer: syz [ 330.500644][ T5873] usb 9-1: SerialNumber: syz [ 330.515543][ T9815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 330.525450][ T9815] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.555261][ T5893] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 330.690711][ T9814] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 330.706658][ T9814] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 330.715955][ T5873] usb 9-1: selecting invalid altsetting 1 [ 330.724426][ T5893] usb 10-1: Using ep0 maxpacket: 16 [ 330.738088][ T5893] usb 10-1: config 254 has an invalid interface number: 235 but max is 0 [ 330.755170][ T5893] usb 10-1: config 254 has an invalid descriptor of length 0, skipping remainder of the config [ 330.767043][ T5893] usb 10-1: config 254 has no interface number 0 [ 330.773483][ T5893] usb 10-1: config 254 interface 235 altsetting 2 endpoint 0x6 has invalid wMaxPacketSize 0 [ 330.785210][ T5893] usb 10-1: config 254 interface 235 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 330.799555][ T5893] usb 10-1: config 254 interface 235 has no altsetting 0 [ 330.812226][ T5893] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=2b.f1 [ 330.822994][ T5893] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.831993][ T5893] usb 10-1: Product: syz [ 330.838172][ T5893] usb 10-1: Manufacturer: syz [ 330.842987][ T5893] usb 10-1: SerialNumber: syz [ 330.859100][ T5893] usbtest 10-1:254.235: couldn't get endpoints, -22 [ 330.866415][ T5893] usbtest 10-1:254.235: probe with driver usbtest failed with error -22 [ 330.924450][ T5873] LME2510(C): Firmware Status: 00 00 d9 3c 5b 17 [ 330.924585][ T5873] dvb_usb_lmedm04 9-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 331.101518][ T9828] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.110823][ T9828] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.162573][ T5911] usb 9-1: USB disconnect, device number 30 [ 331.177010][ T6997] usb 10-1: USB disconnect, device number 5 [ 331.295296][ T794] usb 6-1: USB disconnect, device number 66 [ 331.393535][ T6997] usb 2-1: USB disconnect, device number 10 [ 332.064536][ T6997] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 332.096487][ T9880] netlink: 'syz.8.1146': attribute type 16 has an invalid length. [ 332.104555][ T9880] netlink: 'syz.8.1146': attribute type 3 has an invalid length. [ 332.112371][ T9880] netlink: 64066 bytes leftover after parsing attributes in process `syz.8.1146'. [ 332.124104][ T5911] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 332.223984][ T43] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 332.231650][ T6997] usb 10-1: Using ep0 maxpacket: 8 [ 332.241143][ T6997] usb 10-1: unable to get BOS descriptor or descriptor too short [ 332.250101][ T6997] usb 10-1: config 1 interface 0 altsetting 13 bulk endpoint 0x1 has invalid maxpacket 1023 [ 332.260238][ T6997] usb 10-1: config 1 interface 0 altsetting 13 bulk endpoint 0x82 has invalid maxpacket 8 [ 332.270461][ T5911] usb 6-1: device descriptor read/64, error -71 [ 332.276900][ T6997] usb 10-1: config 1 interface 0 has no altsetting 0 [ 332.287701][ T6997] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 332.297165][ T6997] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.305884][ T6997] usb 10-1: Product: syz [ 332.310218][ T6997] usb 10-1: Manufacturer: syz [ 332.315208][ T6997] usb 10-1: SerialNumber: syz [ 332.322746][ T9868] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 332.330156][ T9868] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 332.388096][ T43] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 332.397745][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 332.405840][ T43] usb 2-1: Product: syz [ 332.410030][ T43] usb 2-1: Manufacturer: syz [ 332.414904][ T43] usb 2-1: SerialNumber: syz [ 332.513930][ T5911] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 332.551819][ T6997] usblp 10-1:1.0: usblp0: USB Bidirectional printer dev 6 if 0 alt 13 proto 2 vid 0x0525 pid 0xA4A8 [ 332.567299][ T6997] usb 10-1: USB disconnect, device number 6 [ 332.577127][ T6997] usblp0: removed [ 332.644024][ T5911] usb 6-1: device descriptor read/64, error -71 [ 332.754704][ T5911] usb usb6-port1: attempt power cycle [ 332.835654][ T43] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 332.848208][ T43] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 333.104087][ T5911] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 333.137766][ T5911] usb 6-1: device descriptor read/8, error -71 [ 333.248588][ T9894] netlink: 52 bytes leftover after parsing attributes in process `syz.8.1152'. [ 333.384159][ T5911] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 333.414439][ T5911] usb 6-1: device descriptor read/8, error -71 [ 333.523929][ T794] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 333.524338][ T5911] usb usb6-port1: unable to enumerate USB device [ 333.553951][ T6997] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 333.674230][ T794] usb 10-1: Using ep0 maxpacket: 8 [ 333.686519][ T794] usb 10-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 333.695751][ T794] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.708008][ T794] usb 10-1: Product: syz [ 333.712310][ T794] usb 10-1: Manufacturer: syz [ 333.714410][ T6997] usb 9-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 333.717056][ T794] usb 10-1: SerialNumber: syz [ 333.727322][ T6997] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 333.735878][ T794] usb 10-1: config 0 descriptor?? [ 333.740229][ T6997] usb 9-1: Product: syz [ 333.748167][ T794] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 333.749248][ T6997] usb 9-1: Manufacturer: syz [ 333.760011][ T6997] usb 9-1: SerialNumber: syz [ 333.769508][ T6997] r8152-cfgselector 9-1: Unknown version 0x0000 [ 333.776092][ T6997] r8152-cfgselector 9-1: config 0 descriptor?? [ 334.066850][ T43] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 334.152720][ T9896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.161856][ T9896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 334.187093][ T9899] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1154'. [ 334.221488][ T7086] r8152-cfgselector 9-1: USB disconnect, device number 31 [ 334.281243][ T9878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.290460][ T9878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 334.338191][ T43] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001000. ret = -EPROTO [ 334.354237][ T43] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 334.367958][ T43] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 334.379134][ T43] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 334.396054][ T43] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 334.410362][ T43] usb 2-1: USB disconnect, device number 11 [ 334.595349][ T7086] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 334.753939][ T7086] usb 9-1: Using ep0 maxpacket: 8 [ 334.762433][ T7086] usb 9-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 334.771542][ T7086] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.779573][ T7086] usb 9-1: Product: syz [ 334.783730][ T7086] usb 9-1: Manufacturer: syz [ 334.788726][ T7086] usb 9-1: SerialNumber: syz [ 334.798297][ T7086] usb 9-1: config 0 descriptor?? [ 334.805663][ T7086] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 334.884626][ T794] usb 10-1: USB disconnect, device number 7 [ 334.941581][ T9918] unsupported nlmsg_type 40 [ 335.134120][ T43] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 335.212569][ T9903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.221602][ T9903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.283893][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 335.292664][ T43] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 335.301808][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.309942][ T6997] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 335.317569][ T43] usb 2-1: Product: syz [ 335.321746][ T43] usb 2-1: Manufacturer: syz [ 335.326534][ T43] usb 2-1: SerialNumber: syz [ 335.334693][ T43] usb 2-1: config 0 descriptor?? [ 335.476655][ T6997] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 335.487310][ T6997] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 335.501830][ T6997] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 335.513485][ T6997] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 335.522189][ T6997] usb 6-1: SerialNumber: syz [ 335.547742][ T43] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 335.746144][ T6997] usb 6-1: 0:2 : does not exist [ 335.752308][ T6997] usb 6-1: unit 255 not found! [ 335.759182][ T9914] netlink: 'syz.1.1158': attribute type 13 has an invalid length. [ 335.801059][ T6997] usb 6-1: USB disconnect, device number 71 [ 335.807702][ T43] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 335.827402][ T43] usb 2-1: USB disconnect, device number 12 [ 335.878127][ T794] usb 9-1: USB disconnect, device number 32 [ 336.091475][ T9939] usb usb8: usbfs: process 9939 (syz.9.1168) did not claim interface 0 before use [ 336.320490][ T9946] input: syz1 as /devices/virtual/input/input37 [ 336.336053][ T9948] FAULT_INJECTION: forcing a failure. [ 336.336053][ T9948] name failslab, interval 1, probability 0, space 0, times 0 [ 336.358360][ T9946] FAULT_INJECTION: forcing a failure. [ 336.358360][ T9946] name failslab, interval 1, probability 0, space 0, times 0 [ 336.372665][ T9948] CPU: 0 UID: 0 PID: 9948 Comm: syz.9.1172 Not tainted syzkaller #0 PREEMPT(full) [ 336.372691][ T9948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 336.372704][ T9948] Call Trace: [ 336.372712][ T9948] [ 336.372722][ T9948] dump_stack_lvl+0x189/0x250 [ 336.372753][ T9948] ? __pfx____ratelimit+0x10/0x10 [ 336.372779][ T9948] ? __pfx_dump_stack_lvl+0x10/0x10 [ 336.372803][ T9948] ? __pfx__printk+0x10/0x10 [ 336.372835][ T9948] ? __pfx___might_resched+0x10/0x10 [ 336.372863][ T9948] should_fail_ex+0x414/0x560 [ 336.372891][ T9948] should_failslab+0xa8/0x100 [ 336.372914][ T9948] kmem_cache_alloc_node_noprof+0x8c/0x710 [ 336.372941][ T9948] ? __alloc_skb+0x112/0x2d0 [ 336.372976][ T9948] __alloc_skb+0x112/0x2d0 [ 336.373002][ T9948] netlink_ack+0x146/0xa50 [ 336.373022][ T9948] ? __pfx_genl_rcv_msg+0x10/0x10 [ 336.373047][ T9948] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 336.373072][ T9948] ? __pfx_nl802154_post_doit+0x10/0x10 [ 336.373113][ T9948] netlink_rcv_skb+0x28c/0x470 [ 336.373133][ T9948] ? __lock_acquire+0xab9/0xd20 [ 336.373154][ T9948] ? __pfx_genl_rcv_msg+0x10/0x10 [ 336.373183][ T9948] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 336.373229][ T9948] ? down_read+0x1ad/0x2e0 [ 336.373260][ T9948] genl_rcv+0x28/0x40 [ 336.373285][ T9948] netlink_unicast+0x82f/0x9e0 [ 336.373316][ T9948] ? __pfx_netlink_unicast+0x10/0x10 [ 336.373339][ T9948] ? netlink_sendmsg+0x642/0xb30 [ 336.373359][ T9948] ? skb_put+0x11b/0x210 [ 336.373384][ T9948] netlink_sendmsg+0x805/0xb30 [ 336.373419][ T9948] ? __pfx_netlink_sendmsg+0x10/0x10 [ 336.373446][ T9948] ? aa_sock_msg_perm+0xf1/0x1d0 [ 336.373477][ T9948] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 336.373504][ T9948] ? __pfx_netlink_sendmsg+0x10/0x10 [ 336.373528][ T9948] __sock_sendmsg+0x21c/0x270 [ 336.373560][ T9948] ____sys_sendmsg+0x505/0x870 [ 336.373590][ T9948] ? __pfx_____sys_sendmsg+0x10/0x10 [ 336.373624][ T9948] ? import_iovec+0x74/0xa0 [ 336.373656][ T9948] ___sys_sendmsg+0x21f/0x2a0 [ 336.373682][ T9948] ? __pfx____sys_sendmsg+0x10/0x10 [ 336.373747][ T9948] ? __fget_files+0x2a/0x420 [ 336.373771][ T9948] ? __fget_files+0x3a0/0x420 [ 336.373814][ T9948] __x64_sys_sendmsg+0x19b/0x260 [ 336.373840][ T9948] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 336.373873][ T9948] ? __pfx_ksys_write+0x10/0x10 [ 336.373899][ T9948] ? do_syscall_64+0xbe/0xfa0 [ 336.373928][ T9948] do_syscall_64+0xfa/0xfa0 [ 336.373953][ T9948] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.373982][ T9948] ? clear_bhb_loop+0x60/0xb0 [ 336.374007][ T9948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.374026][ T9948] RIP: 0033:0x7f037518f6c9 [ 336.374044][ T9948] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 336.374061][ T9948] RSP: 002b:00007f0376050038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 336.374083][ T9948] RAX: ffffffffffffffda RBX: 00007f03753e5fa0 RCX: 00007f037518f6c9 [ 336.374098][ T9948] RDX: 0000000004000000 RSI: 0000200000000b00 RDI: 0000000000000004 [ 336.374112][ T9948] RBP: 00007f0376050090 R08: 0000000000000000 R09: 0000000000000000 [ 336.374125][ T9948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 336.374138][ T9948] R13: 00007f03753e6038 R14: 00007f03753e5fa0 R15: 00007ffc536d4748 [ 336.374174][ T9948] [ 336.701052][ T9946] CPU: 0 UID: 0 PID: 9946 Comm: syz.5.1171 Not tainted syzkaller #0 PREEMPT(full) [ 336.701081][ T9946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 336.701093][ T9946] Call Trace: [ 336.701101][ T9946] [ 336.701110][ T9946] dump_stack_lvl+0x189/0x250 [ 336.701141][ T9946] ? __pfx____ratelimit+0x10/0x10 [ 336.701166][ T9946] ? __pfx_dump_stack_lvl+0x10/0x10 [ 336.701191][ T9946] ? __pfx__printk+0x10/0x10 [ 336.701223][ T9946] ? __pfx___might_resched+0x10/0x10 [ 336.701245][ T9946] ? fs_reclaim_acquire+0x7d/0x100 [ 336.701280][ T9946] should_fail_ex+0x414/0x560 [ 336.701308][ T9946] should_failslab+0xa8/0x100 [ 336.701331][ T9946] __kmalloc_noprof+0xdf/0x800 [ 336.701358][ T9946] ? kobject_get_path+0xc5/0x2f0 [ 336.701384][ T9946] ? __kasan_kmalloc+0x93/0xb0 [ 336.701416][ T9946] kobject_get_path+0xc5/0x2f0 [ 336.701440][ T9946] ? kobject_uevent_env+0x28c/0x9f0 [ 336.701476][ T9946] kobject_uevent_env+0x2a1/0x9f0 [ 336.701517][ T9946] device_del+0x73a/0x8e0 [ 336.701550][ T9946] ? __pfx_device_del+0x10/0x10 [ 336.701583][ T9946] cdev_device_del+0x27/0xf0 [ 336.701611][ T9946] mousedev_disconnect+0x203/0x2f0 [ 336.701635][ T9946] __input_unregister_device+0x3a3/0x640 [ 336.701672][ T9946] input_unregister_device+0x9b/0x100 [ 336.701703][ T9946] uinput_destroy_device+0x6c1/0x8c0 [ 336.701735][ T9946] uinput_ioctl_handler+0x758/0x1570 [ 336.701765][ T9946] ? __pfx_uinput_ioctl_handler+0x10/0x10 [ 336.701809][ T9946] ? __fget_files+0x2a/0x420 [ 336.701839][ T9946] ? bpf_lsm_file_ioctl+0x9/0x20 [ 336.701858][ T9946] ? __pfx_uinput_ioctl+0x10/0x10 [ 336.701883][ T9946] __se_sys_ioctl+0xfc/0x170 [ 336.701917][ T9946] do_syscall_64+0xfa/0xfa0 [ 336.701943][ T9946] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.701972][ T9946] ? clear_bhb_loop+0x60/0xb0 [ 336.701996][ T9946] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.702015][ T9946] RIP: 0033:0x7fd16c98f6c9 [ 336.702033][ T9946] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 336.702050][ T9946] RSP: 002b:00007fd16d85a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 336.702070][ T9946] RAX: ffffffffffffffda RBX: 00007fd16cbe5fa0 RCX: 00007fd16c98f6c9 [ 336.702091][ T9946] RDX: 0000000000000000 RSI: 0000000000005502 RDI: 0000000000000003 [ 336.702103][ T9946] RBP: 00007fd16d85a090 R08: 0000000000000000 R09: 0000000000000000 [ 336.702116][ T9946] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 336.702128][ T9946] R13: 00007fd16cbe6038 R14: 00007fd16cbe5fa0 R15: 00007ffcfdb055e8 [ 336.702164][ T9946] [ 336.982263][ T9950] netlink: 212 bytes leftover after parsing attributes in process `syz.1.1173'. [ 337.112298][ T9954] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 337.136685][ T9954] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 337.180078][ T9954] FAULT_INJECTION: forcing a failure. [ 337.180078][ T9954] name failslab, interval 1, probability 0, space 0, times 0 [ 337.194701][ T9954] CPU: 0 UID: 0 PID: 9954 Comm: syz.5.1175 Not tainted syzkaller #0 PREEMPT(full) [ 337.194727][ T9954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 337.194741][ T9954] Call Trace: [ 337.194750][ T9954] [ 337.194760][ T9954] dump_stack_lvl+0x189/0x250 [ 337.194790][ T9954] ? __pfx____ratelimit+0x10/0x10 [ 337.194815][ T9954] ? __pfx_dump_stack_lvl+0x10/0x10 [ 337.194840][ T9954] ? __pfx__printk+0x10/0x10 [ 337.194882][ T9954] should_fail_ex+0x414/0x560 [ 337.194911][ T9954] should_failslab+0xa8/0x100 [ 337.194934][ T9954] kmem_cache_alloc_node_noprof+0x8c/0x710 [ 337.194961][ T9954] ? __alloc_skb+0x112/0x2d0 [ 337.194997][ T9954] __alloc_skb+0x112/0x2d0 [ 337.195023][ T9954] arp_create+0x189/0x990 [ 337.195054][ T9954] ? __pfx_arp_create+0x10/0x10 [ 337.195072][ T9954] ? batadv_primary_if_get_selected+0x7a/0x410 [ 337.195108][ T9954] ? batadv_bla_send_claim+0xdd/0xeb0 [ 337.195133][ T9954] batadv_bla_send_claim+0x17d/0xeb0 [ 337.195170][ T9954] ? __pfx_batadv_bla_send_claim+0x10/0x10 [ 337.195194][ T9954] ? batadv_bla_update_orig_address+0x534/0x880 [ 337.195231][ T9954] batadv_bla_update_orig_address+0x56c/0x880 [ 337.195267][ T9954] ? batadv_bla_update_orig_address+0x24e/0x880 [ 337.195300][ T9954] ? __pfx_batadv_bla_update_orig_address+0x10/0x10 [ 337.195328][ T9954] ? batadv_primary_if_get_selected+0x7a/0x410 [ 337.195354][ T9954] ? __pfx_batadv_primary_if_get_selected+0x10/0x10 [ 337.195392][ T9954] batadv_primary_if_update_addr+0x1e8/0x2b0 [ 337.195426][ T9954] batadv_primary_if_select+0x12a/0x1b0 [ 337.195456][ T9954] batadv_hardif_disable_interface+0x67d/0xab0 [ 337.195488][ T9954] ? batadv_hardif_disable_interface+0x328/0xab0 [ 337.195517][ T9954] ? __pfx_batadv_hardif_disable_interface+0x10/0x10 [ 337.195539][ T9954] ? __netlink_deliver_tap+0x5d9/0x8b0 [ 337.195561][ T9954] ? netlink_deliver_tap+0x19c/0x1b0 [ 337.195579][ T9954] ? netlink_unicast+0x7fa/0x9e0 [ 337.195599][ T9954] ? do_syscall_64+0xfa/0xfa0 [ 337.195638][ T9954] batadv_meshif_destroy_netlink+0x68/0x250 [ 337.195673][ T9954] ? __pfx_batadv_meshif_destroy_netlink+0x10/0x10 [ 337.195699][ T9954] rtnl_dellink+0x502/0x720 [ 337.195724][ T9954] ? __pfx_rtnl_dellink+0x10/0x10 [ 337.195758][ T9954] ? __lock_acquire+0xab9/0xd20 [ 337.195870][ T9954] ? __pfx_rtnl_dellink+0x10/0x10 [ 337.195890][ T9954] rtnetlink_rcv_msg+0x7cf/0xb70 [ 337.195915][ T9954] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 337.195934][ T9954] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 337.195951][ T9954] ? netlink_sendmsg+0x805/0xb30 [ 337.195979][ T9954] ? __sock_sendmsg+0x21c/0x270 [ 337.196001][ T9954] ? ____sys_sendmsg+0x505/0x870 [ 337.196022][ T9954] ? ___sys_sendmsg+0x21f/0x2a0 [ 337.196039][ T9954] ? __x64_sys_sendmsg+0x19b/0x260 [ 337.196057][ T9954] ? do_syscall_64+0xfa/0xfa0 [ 337.196080][ T9954] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.196114][ T9954] netlink_rcv_skb+0x208/0x470 [ 337.196138][ T9954] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 337.196159][ T9954] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 337.196196][ T9954] ? netlink_deliver_tap+0x2e/0x1b0 [ 337.196227][ T9954] netlink_unicast+0x82f/0x9e0 [ 337.196257][ T9954] ? __pfx_netlink_unicast+0x10/0x10 [ 337.196282][ T9954] ? netlink_sendmsg+0x642/0xb30 [ 337.196300][ T9954] ? skb_put+0x11b/0x210 [ 337.196325][ T9954] netlink_sendmsg+0x805/0xb30 [ 337.196356][ T9954] ? __pfx_netlink_sendmsg+0x10/0x10 [ 337.196385][ T9954] ? aa_sock_msg_perm+0xf1/0x1d0 [ 337.196412][ T9954] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 337.196440][ T9954] ? __pfx_netlink_sendmsg+0x10/0x10 [ 337.196462][ T9954] __sock_sendmsg+0x21c/0x270 [ 337.196493][ T9954] ____sys_sendmsg+0x505/0x870 [ 337.196522][ T9954] ? __pfx_____sys_sendmsg+0x10/0x10 [ 337.196555][ T9954] ? import_iovec+0x74/0xa0 [ 337.196587][ T9954] ___sys_sendmsg+0x21f/0x2a0 [ 337.196611][ T9954] ? __pfx____sys_sendmsg+0x10/0x10 [ 337.196677][ T9954] ? __fget_files+0x2a/0x420 [ 337.196700][ T9954] ? __fget_files+0x3a0/0x420 [ 337.196735][ T9954] __x64_sys_sendmsg+0x19b/0x260 [ 337.196760][ T9954] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 337.196795][ T9954] ? __pfx_ksys_write+0x10/0x10 [ 337.196821][ T9954] ? do_syscall_64+0xbe/0xfa0 [ 337.196849][ T9954] do_syscall_64+0xfa/0xfa0 [ 337.196875][ T9954] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.196893][ T9954] ? clear_bhb_loop+0x60/0xb0 [ 337.196916][ T9954] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.196937][ T9954] RIP: 0033:0x7fd16c98f6c9 [ 337.196955][ T9954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 337.196982][ T9954] RSP: 002b:00007fd16d85a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 337.197004][ T9954] RAX: ffffffffffffffda RBX: 00007fd16cbe5fa0 RCX: 00007fd16c98f6c9 [ 337.197017][ T9954] RDX: 0000000000048000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 337.197033][ T9954] RBP: 00007fd16d85a090 R08: 0000000000000000 R09: 0000000000000000 [ 337.197044][ T9954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 337.197056][ T9954] R13: 00007fd16cbe6038 R14: 00007fd16cbe5fa0 R15: 00007ffcfdb055e8 [ 337.197091][ T9954] [ 337.198141][ T9954] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 337.476145][ T43] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 337.481899][ T9954] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 337.639503][ T43] usb 10-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice=ca.fd [ 337.810256][ T43] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 337.819224][ T43] usb 10-1: Product: syz [ 337.823571][ T43] usb 10-1: Manufacturer: syz [ 337.834142][ T43] usb 10-1: SerialNumber: syz [ 337.855207][ T43] usb 10-1: config 0 descriptor?? [ 337.862691][ T9966] FAULT_INJECTION: forcing a failure. [ 337.862691][ T9966] name failslab, interval 1, probability 0, space 0, times 0 [ 337.902702][ T9966] CPU: 0 UID: 0 PID: 9966 Comm: syz.8.1179 Not tainted syzkaller #0 PREEMPT(full) [ 337.902729][ T9966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 337.902742][ T9966] Call Trace: [ 337.902751][ T9966] [ 337.902760][ T9966] dump_stack_lvl+0x189/0x250 [ 337.902791][ T9966] ? __pfx____ratelimit+0x10/0x10 [ 337.902816][ T9966] ? __pfx_dump_stack_lvl+0x10/0x10 [ 337.902840][ T9966] ? __pfx__printk+0x10/0x10 [ 337.902871][ T9966] ? __pfx___might_resched+0x10/0x10 [ 337.902892][ T9966] ? fs_reclaim_acquire+0x7d/0x100 [ 337.902934][ T9966] should_fail_ex+0x414/0x560 [ 337.902961][ T9966] should_failslab+0xa8/0x100 [ 337.902984][ T9966] __kmalloc_noprof+0xdf/0x800 [ 337.903010][ T9966] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 337.903047][ T9966] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 337.903083][ T9966] genl_family_rcv_msg_doit+0xb8/0x300 [ 337.903119][ T9966] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 337.903157][ T9966] ? apparmor_capable+0x137/0x1b0 [ 337.903181][ T9966] ? bpf_lsm_capable+0x9/0x20 [ 337.903201][ T9966] ? security_capable+0x7e/0x2e0 [ 337.903234][ T9966] genl_rcv_msg+0x60e/0x790 [ 337.903270][ T9966] ? __pfx_genl_rcv_msg+0x10/0x10 [ 337.903294][ T9966] ? ref_tracker_free+0x63a/0x7d0 [ 337.903315][ T9966] ? __pfx_ethnl_rss_create_doit+0x10/0x10 [ 337.903344][ T9966] ? ____sys_sendmsg+0x505/0x870 [ 337.903364][ T9966] ? ___sys_sendmsg+0x21f/0x2a0 [ 337.903383][ T9966] ? __x64_sys_sendmsg+0x19b/0x260 [ 337.903402][ T9966] ? do_syscall_64+0xfa/0xfa0 [ 337.903425][ T9966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.903457][ T9966] netlink_rcv_skb+0x208/0x470 [ 337.903477][ T9966] ? __lock_acquire+0xab9/0xd20 [ 337.903498][ T9966] ? __pfx_genl_rcv_msg+0x10/0x10 [ 337.903526][ T9966] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 337.903571][ T9966] ? down_read+0x1ad/0x2e0 [ 337.903601][ T9966] genl_rcv+0x28/0x40 [ 337.903625][ T9966] netlink_unicast+0x82f/0x9e0 [ 337.903655][ T9966] ? __pfx_netlink_unicast+0x10/0x10 [ 337.903677][ T9966] ? netlink_sendmsg+0x642/0xb30 [ 337.903696][ T9966] ? skb_put+0x11b/0x210 [ 337.903720][ T9966] netlink_sendmsg+0x805/0xb30 [ 337.903753][ T9966] ? __pfx_netlink_sendmsg+0x10/0x10 [ 337.903781][ T9966] ? aa_sock_msg_perm+0xf1/0x1d0 [ 337.903816][ T9966] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 337.903842][ T9966] ? __pfx_netlink_sendmsg+0x10/0x10 [ 337.903864][ T9966] __sock_sendmsg+0x21c/0x270 [ 337.903895][ T9966] ____sys_sendmsg+0x505/0x870 [ 337.903931][ T9966] ? __pfx_____sys_sendmsg+0x10/0x10 [ 337.903964][ T9966] ? import_iovec+0x74/0xa0 [ 337.903996][ T9966] ___sys_sendmsg+0x21f/0x2a0 [ 337.904020][ T9966] ? __pfx____sys_sendmsg+0x10/0x10 [ 337.904086][ T9966] ? __fget_files+0x2a/0x420 [ 337.904110][ T9966] ? __fget_files+0x3a0/0x420 [ 337.904147][ T9966] __x64_sys_sendmsg+0x19b/0x260 [ 337.904173][ T9966] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 337.904209][ T9966] ? __pfx_ksys_write+0x10/0x10 [ 337.904236][ T9966] ? do_syscall_64+0xbe/0xfa0 [ 337.904266][ T9966] do_syscall_64+0xfa/0xfa0 [ 337.904292][ T9966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.904311][ T9966] ? clear_bhb_loop+0x60/0xb0 [ 337.904336][ T9966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.904355][ T9966] RIP: 0033:0x7fe85c78f6c9 [ 337.904373][ T9966] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 337.904391][ T9966] RSP: 002b:00007fe85a9f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 337.904413][ T9966] RAX: ffffffffffffffda RBX: 00007fe85c9e5fa0 RCX: 00007fe85c78f6c9 [ 337.904428][ T9966] RDX: 0000000020008810 RSI: 0000200000000380 RDI: 0000000000000003 [ 337.904441][ T9966] RBP: 00007fe85a9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 337.904454][ T9966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 337.904467][ T9966] R13: 00007fe85c9e6038 R14: 00007fe85c9e5fa0 R15: 00007ffd89662058 [ 337.904501][ T9966] [ 337.985183][ T5828] Bluetooth: hci4: urb ffff888028941800 submission failed (2) [ 338.220867][ T9975] FAULT_INJECTION: forcing a failure. [ 338.220867][ T9975] name failslab, interval 1, probability 0, space 0, times 0 [ 338.330686][ T9975] CPU: 1 UID: 0 PID: 9975 Comm: syz.1.1182 Not tainted syzkaller #0 PREEMPT(full) [ 338.330715][ T9975] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 338.330728][ T9975] Call Trace: [ 338.330737][ T9975] [ 338.330746][ T9975] dump_stack_lvl+0x189/0x250 [ 338.330788][ T9975] ? __pfx____ratelimit+0x10/0x10 [ 338.330813][ T9975] ? __pfx_dump_stack_lvl+0x10/0x10 [ 338.330838][ T9975] ? __pfx__printk+0x10/0x10 [ 338.330859][ T9975] ? save_netdev_trace_buffer+0x4b5/0x5a0 [ 338.330907][ T9975] should_fail_ex+0x414/0x560 [ 338.330935][ T9975] should_failslab+0xa8/0x100 [ 338.330958][ T9975] kmem_cache_alloc_noprof+0x88/0x700 [ 338.330985][ T9975] ? skb_clone+0x212/0x3a0 [ 338.331013][ T9975] skb_clone+0x212/0x3a0 [ 338.331040][ T9975] __netlink_deliver_tap+0x424/0x8b0 [ 338.331079][ T9975] ? netlink_deliver_tap+0x2e/0x1b0 [ 338.331104][ T9975] netlink_deliver_tap+0x19c/0x1b0 [ 338.331128][ T9975] netlink_unicast+0x7fa/0x9e0 [ 338.331160][ T9975] ? __pfx_netlink_unicast+0x10/0x10 [ 338.331183][ T9975] ? netlink_sendmsg+0x642/0xb30 [ 338.331204][ T9975] ? skb_put+0x11b/0x210 [ 338.331229][ T9975] netlink_sendmsg+0x805/0xb30 [ 338.331264][ T9975] ? __pfx_netlink_sendmsg+0x10/0x10 [ 338.331292][ T9975] ? aa_sock_msg_perm+0xf1/0x1d0 [ 338.331322][ T9975] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 338.331350][ T9975] ? __pfx_netlink_sendmsg+0x10/0x10 [ 338.331374][ T9975] __sock_sendmsg+0x21c/0x270 [ 338.331406][ T9975] ____sys_sendmsg+0x505/0x870 [ 338.331436][ T9975] ? __pfx_____sys_sendmsg+0x10/0x10 [ 338.331471][ T9975] ? import_iovec+0x74/0xa0 [ 338.331501][ T9975] ___sys_sendmsg+0x21f/0x2a0 [ 338.331527][ T9975] ? __pfx____sys_sendmsg+0x10/0x10 [ 338.331595][ T9975] ? __fget_files+0x2a/0x420 [ 338.331618][ T9975] ? __fget_files+0x3a0/0x420 [ 338.331656][ T9975] __x64_sys_sendmsg+0x19b/0x260 [ 338.331683][ T9975] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 338.331724][ T9975] ? __pfx_ksys_write+0x10/0x10 [ 338.331751][ T9975] ? do_syscall_64+0xbe/0xfa0 [ 338.331790][ T9975] do_syscall_64+0xfa/0xfa0 [ 338.331816][ T9975] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.331837][ T9975] ? clear_bhb_loop+0x60/0xb0 [ 338.331862][ T9975] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.331881][ T9975] RIP: 0033:0x7f02bdb8f6c9 [ 338.331899][ T9975] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 338.331918][ T9975] RSP: 002b:00007f02beaea038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 338.331942][ T9975] RAX: ffffffffffffffda RBX: 00007f02bdde5fa0 RCX: 00007f02bdb8f6c9 [ 338.331957][ T9975] RDX: 0000000000000080 RSI: 00002000000002c0 RDI: 0000000000000003 [ 338.331970][ T9975] RBP: 00007f02beaea090 R08: 0000000000000000 R09: 0000000000000000 [ 338.331983][ T9975] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 338.331996][ T9975] R13: 00007f02bdde6038 R14: 00007f02bdde5fa0 R15: 00007ffe52231dd8 [ 338.332031][ T9975] [ 338.384603][ T5873] usb 10-1: USB disconnect, device number 8 [ 338.529482][ T9982] FAULT_INJECTION: forcing a failure. [ 338.529482][ T9982] name failslab, interval 1, probability 0, space 0, times 0 [ 338.644181][ T7086] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 338.666609][ T9982] CPU: 1 UID: 0 PID: 9982 Comm: syz.1.1184 Not tainted syzkaller #0 PREEMPT(full) [ 338.666636][ T9982] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 338.666648][ T9982] Call Trace: [ 338.666657][ T9982] [ 338.666666][ T9982] dump_stack_lvl+0x189/0x250 [ 338.666696][ T9982] ? __pfx____ratelimit+0x10/0x10 [ 338.666722][ T9982] ? __pfx_dump_stack_lvl+0x10/0x10 [ 338.666746][ T9982] ? __pfx__printk+0x10/0x10 [ 338.666781][ T9982] ? __local_bh_enable_ip+0x12d/0x1c0 [ 338.666803][ T9982] ? lockdep_hardirqs_on+0x9c/0x150 [ 338.666827][ T9982] ? __local_bh_enable_ip+0x12d/0x1c0 [ 338.666852][ T9982] should_fail_ex+0x414/0x560 [ 338.666879][ T9982] should_failslab+0xa8/0x100 [ 338.666900][ T9982] __kmalloc_noprof+0xdf/0x800 [ 338.666926][ T9982] ? ___neigh_create+0x6d5/0x2260 [ 338.666960][ T9982] ___neigh_create+0x6d5/0x2260 [ 338.667013][ T9982] ip_neigh_gw4+0x289/0x3b0 [ 338.667037][ T9982] ? __pfx_ip_neigh_gw4+0x10/0x10 [ 338.667058][ T9982] ? __lock_acquire+0xab9/0xd20 [ 338.667089][ T9982] ip_finish_output2+0x57a/0x1160 [ 338.667115][ T9982] ? ip_finish_output2+0x452/0x1160 [ 338.667134][ T9982] ? ip_skb_dst_mtu+0x18d/0xb70 [ 338.667154][ T9982] ? __pfx_ip_finish_output2+0x10/0x10 [ 338.667175][ T9982] ? ip_skb_dst_mtu+0x18d/0xb70 [ 338.667191][ T9982] ? ip_skb_dst_mtu+0x917/0xb70 [ 338.667210][ T9982] ? ip_finish_output+0x33a/0x3f0 [ 338.667241][ T9982] ip_output+0x29f/0x450 [ 338.667268][ T9982] ? ip_output+0x5b/0x450 [ 338.667297][ T9982] ip_send_skb+0x74/0x100 [ 338.667319][ T9982] udp_send_skb+0xaf1/0x14c0 [ 338.667364][ T9982] udp_sendmsg+0x195a/0x2170 [ 338.667383][ T9982] ? count_memcg_event_mm+0x21/0x260 [ 338.667420][ T9982] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 338.667441][ T9982] ? __pfx_udp_sendmsg+0x10/0x10 [ 338.667507][ T9982] ? sock_rps_record_flow+0x19/0x410 [ 338.667533][ T9982] ? inet_sendmsg+0x29c/0x370 [ 338.667554][ T9982] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 338.667583][ T9982] __sock_sendmsg+0x19c/0x270 [ 338.667614][ T9982] ____sys_sendmsg+0x52d/0x870 [ 338.667642][ T9982] ? __pfx_____sys_sendmsg+0x10/0x10 [ 338.667676][ T9982] ? import_iovec+0x74/0xa0 [ 338.667707][ T9982] ___sys_sendmsg+0x21f/0x2a0 [ 338.667732][ T9982] ? __pfx____sys_sendmsg+0x10/0x10 [ 338.667806][ T9982] ? __fget_files+0x2a/0x420 [ 338.667825][ T794] IPVS: starting estimator thread 0... [ 338.667829][ T9982] ? __fget_files+0x3a0/0x420 [ 338.667863][ T9982] __sys_sendmmsg+0x227/0x430 [ 338.667890][ T9982] ? __pfx___sys_sendmmsg+0x10/0x10 [ 338.667921][ T9982] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 338.667963][ T9982] ? ksys_write+0x22a/0x250 [ 338.667984][ T9982] ? __pfx_ksys_write+0x10/0x10 [ 338.668009][ T9982] __x64_sys_sendmmsg+0xa0/0xc0 [ 338.668031][ T9982] do_syscall_64+0xfa/0xfa0 [ 338.668054][ T9982] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.668071][ T9982] ? clear_bhb_loop+0x60/0xb0 [ 338.668093][ T9982] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 338.668110][ T9982] RIP: 0033:0x7f02bdb8f6c9 [ 338.668126][ T9982] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 338.668141][ T9982] RSP: 002b:00007f02beaea038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 338.668161][ T9982] RAX: ffffffffffffffda RBX: 00007f02bdde5fa0 RCX: 00007f02bdb8f6c9 [ 338.668174][ T9982] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000003 [ 338.668186][ T9982] RBP: 00007f02beaea090 R08: 0000000000000000 R09: 0000000000000000 [ 338.668197][ T9982] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 338.668208][ T9982] R13: 00007f02bdde6038 R14: 00007f02bdde5fa0 R15: 00007ffe52231dd8 [ 338.668241][ T9982] [ 338.921056][ T9991] netlink: 'syz.1.1186': attribute type 21 has an invalid length. [ 338.941252][ T9992] netlink: 'syz.1.1186': attribute type 21 has an invalid length. [ 339.033969][ T9984] IPVS: using max 26 ests per chain, 62400 per kthread [ 339.126356][ T7086] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 339.140234][ T7086] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 339.159268][ T7086] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 339.170551][ T7086] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 339.180202][ T7086] usb 6-1: SerialNumber: syz [ 339.210283][ T9999] FAULT_INJECTION: forcing a failure. [ 339.210283][ T9999] name failslab, interval 1, probability 0, space 0, times 0 [ 339.223385][ T9999] CPU: 1 UID: 0 PID: 9999 Comm: syz.1.1190 Not tainted syzkaller #0 PREEMPT(full) [ 339.223411][ T9999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 339.223423][ T9999] Call Trace: [ 339.223433][ T9999] [ 339.223441][ T9999] dump_stack_lvl+0x189/0x250 [ 339.223470][ T9999] ? __pfx____ratelimit+0x10/0x10 [ 339.223494][ T9999] ? __pfx_dump_stack_lvl+0x10/0x10 [ 339.223516][ T9999] ? __pfx__printk+0x10/0x10 [ 339.223546][ T9999] ? __pfx___might_resched+0x10/0x10 [ 339.223565][ T9999] ? fs_reclaim_acquire+0x7d/0x100 [ 339.223597][ T9999] should_fail_ex+0x414/0x560 [ 339.223617][ T9999] should_failslab+0xa8/0x100 [ 339.223630][ T9999] __kmalloc_noprof+0xdf/0x800 [ 339.223645][ T9999] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 339.223683][ T9999] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 339.223718][ T9999] genl_family_rcv_msg_doit+0xb8/0x300 [ 339.223751][ T9999] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 339.223775][ T9999] ? apparmor_capable+0x137/0x1b0 [ 339.223789][ T9999] ? bpf_lsm_capable+0x9/0x20 [ 339.223800][ T9999] ? security_capable+0x7e/0x2e0 [ 339.223832][ T9999] genl_rcv_msg+0x60e/0x790 [ 339.223867][ T9999] ? __pfx_genl_rcv_msg+0x10/0x10 [ 339.223889][ T9999] ? ref_tracker_free+0x63a/0x7d0 [ 339.223908][ T9999] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 339.223932][ T9999] ? __pfx_nl80211_set_station+0x10/0x10 [ 339.223944][ T9999] ? __pfx_nl80211_post_doit+0x10/0x10 [ 339.223960][ T9999] ? ____sys_sendmsg+0x505/0x870 [ 339.223972][ T9999] ? ___sys_sendmsg+0x21f/0x2a0 [ 339.223983][ T9999] ? __x64_sys_sendmsg+0x19b/0x260 [ 339.223999][ T9999] ? do_syscall_64+0xfa/0xfa0 [ 339.224021][ T9999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.224050][ T9999] netlink_rcv_skb+0x208/0x470 [ 339.224068][ T9999] ? __lock_acquire+0xab9/0xd20 [ 339.224087][ T9999] ? __pfx_genl_rcv_msg+0x10/0x10 [ 339.224104][ T9999] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 339.224129][ T9999] ? down_read+0x1ad/0x2e0 [ 339.224151][ T9999] genl_rcv+0x28/0x40 [ 339.224174][ T9999] netlink_unicast+0x82f/0x9e0 [ 339.224203][ T9999] ? __pfx_netlink_unicast+0x10/0x10 [ 339.224224][ T9999] ? netlink_sendmsg+0x642/0xb30 [ 339.224242][ T9999] ? skb_put+0x11b/0x210 [ 339.224257][ T9999] netlink_sendmsg+0x805/0xb30 [ 339.224276][ T9999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 339.224291][ T9999] ? aa_sock_msg_perm+0xf1/0x1d0 [ 339.224316][ T9999] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 339.224342][ T9999] ? __pfx_netlink_sendmsg+0x10/0x10 [ 339.224364][ T9999] __sock_sendmsg+0x21c/0x270 [ 339.224393][ T9999] ____sys_sendmsg+0x505/0x870 [ 339.224410][ T9999] ? __pfx_____sys_sendmsg+0x10/0x10 [ 339.224429][ T9999] ? import_iovec+0x74/0xa0 [ 339.224447][ T9999] ___sys_sendmsg+0x21f/0x2a0 [ 339.224471][ T9999] ? __pfx____sys_sendmsg+0x10/0x10 [ 339.224534][ T9999] ? __fget_files+0x2a/0x420 [ 339.224553][ T9999] ? __fget_files+0x3a0/0x420 [ 339.224574][ T9999] __x64_sys_sendmsg+0x19b/0x260 [ 339.224588][ T9999] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 339.224612][ T9999] ? __pfx_ksys_write+0x10/0x10 [ 339.224638][ T9999] ? do_syscall_64+0xbe/0xfa0 [ 339.224673][ T9999] do_syscall_64+0xfa/0xfa0 [ 339.224696][ T9999] ? irqentry_exit+0x10f/0x640 [ 339.224712][ T9999] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.224723][ T9999] ? clear_bhb_loop+0x60/0xb0 [ 339.224736][ T9999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.224747][ T9999] RIP: 0033:0x7f02bdb8f6c9 [ 339.224761][ T9999] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 339.224777][ T9999] RSP: 002b:00007f02beaea038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 339.224800][ T9999] RAX: ffffffffffffffda RBX: 00007f02bdde5fa0 RCX: 00007f02bdb8f6c9 [ 339.224813][ T9999] RDX: 0000000000008008 RSI: 0000200000000000 RDI: 0000000000000003 [ 339.224826][ T9999] RBP: 00007f02beaea090 R08: 0000000000000000 R09: 0000000000000000 [ 339.224838][ T9999] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 339.224849][ T9999] R13: 00007f02bdde6038 R14: 00007f02bdde5fa0 R15: 00007ffe52231dd8 [ 339.224873][ T9999] [ 339.636361][ T5911] usb 9-1: new full-speed USB device number 33 using dummy_hcd [ 339.653074][ T7086] usb 6-1: 0:2 : does not exist [ 339.658354][ T7086] usb 6-1: unit 255 not found! [ 339.682555][ T7086] usb 6-1: USB disconnect, device number 72 [ 339.700684][T10001] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 339.707225][T10001] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 339.719409][T10001] vhci_hcd vhci_hcd.0: Device attached [ 339.729348][T10002] vhci_hcd: connection closed [ 339.729624][ T1163] vhci_hcd vhci_hcd.1: stop threads [ 339.741767][ T1163] vhci_hcd vhci_hcd.1: release socket [ 339.748989][ T1163] vhci_hcd vhci_hcd.1: disconnect device [ 339.795636][ T5911] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 339.805841][ T5911] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 339.814877][ T5911] usb 9-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 339.823971][ T5911] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.833777][ T5911] usb 9-1: config 0 descriptor?? [ 339.987475][T10005] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 339.995032][T10005] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 340.003225][T10005] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 340.010765][T10005] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 340.043168][ T9994] binder: 9993:9994 ioctl c0306201 200000000480 returned -14 [ 340.263579][T10013] netlink: 'syz.1.1194': attribute type 27 has an invalid length. [ 340.271631][T10013] netlink: 'syz.1.1194': attribute type 1 has an invalid length. [ 340.282044][T10013] bridge0: port 1(bridge_slave_0) entered learning state [ 340.291671][T10013] team_slave_0: entered promiscuous mode [ 340.297540][T10013] team_slave_1: entered promiscuous mode [ 340.454016][ T5911] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 340.553925][ T43] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 340.605318][ T5911] usb 6-1: config index 0 descriptor too short (expected 65183, got 72) [ 340.617071][ T5911] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 340.626291][ T5911] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.635858][ T5911] usb 6-1: Product: syz [ 340.640071][ T5911] usb 6-1: Manufacturer: syz [ 340.644871][ T5911] usb 6-1: SerialNumber: syz [ 340.653700][ T5911] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 340.673470][ T5894] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 340.714512][ T43] usb 2-1: Using ep0 maxpacket: 32 [ 340.721162][ T43] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 340.731494][ T43] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 340.742558][ T43] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 340.752804][ T43] usb 2-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 340.765819][ T43] usb 2-1: config 0 interface 0 has no altsetting 0 [ 340.772543][ T43] usb 2-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 340.783357][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.795289][ T43] usb 2-1: config 0 descriptor?? [ 340.895068][T10010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 340.904129][T10010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 340.918119][T10010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 340.927050][T10010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 340.938017][T10010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 340.947061][T10010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 340.960963][ T5873] usb 6-1: USB disconnect, device number 73 [ 341.207221][ T43] hid-thrustmaster 0003:044F:B65D.001C: unknown main item tag 0x0 [ 341.215591][ T43] hid-thrustmaster 0003:044F:B65D.001C: unknown main item tag 0x0 [ 341.223428][ T43] hid-thrustmaster 0003:044F:B65D.001C: unknown main item tag 0x0 [ 341.232616][ T43] hid-thrustmaster 0003:044F:B65D.001C: unknown main item tag 0x0 [ 341.240679][ T43] hid-thrustmaster 0003:044F:B65D.001C: unknown main item tag 0x0 [ 341.252781][ T43] hid-thrustmaster 0003:044F:B65D.001C: hidraw0: USB HID v0.00 Device [HID 044f:b65d] on usb-dummy_hcd.1-1/input0 [ 341.265012][ T43] hid-thrustmaster 0003:044F:B65D.001C: Wrong number of endpoints? [ 341.374008][ T5911] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 341.408227][ C1] hid-thrustmaster 0003:044F:B65D.001C: Unknown packet type 0x0, unable to proceed further with wheel init [ 341.524009][ T5911] usb 10-1: device descriptor read/64, error -71 [ 341.609356][T10013] binder: 10012:10013 ioctl 400c620e 2000000014c0 returned -22 [ 341.621976][T10013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 341.631076][T10013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 341.641771][T10012] team_slave_0: left promiscuous mode [ 341.647362][T10012] team_slave_1: left promiscuous mode [ 341.653500][ T7086] usb 2-1: USB disconnect, device number 13 [ 341.707644][ T5894] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 341.715016][ T5894] ath9k_htc: Failed to initialize the device [ 341.721514][ T5873] usb 6-1: ath9k_htc: USB layer deinitialized [ 341.764127][ T5911] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 341.894003][ T5911] usb 10-1: device descriptor read/64, error -71 [ 341.956256][ T9] usb 9-1: USB disconnect, device number 33 [ 342.016793][ T5911] usb usb10-port1: attempt power cycle [ 342.033950][ T5873] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 342.063796][T10022] FAULT_INJECTION: forcing a failure. [ 342.063796][T10022] name failslab, interval 1, probability 0, space 0, times 0 [ 342.076917][T10022] CPU: 1 UID: 0 PID: 10022 Comm: syz.8.1198 Not tainted syzkaller #0 PREEMPT(full) [ 342.076943][T10022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 342.076955][T10022] Call Trace: [ 342.076964][T10022] [ 342.076973][T10022] dump_stack_lvl+0x189/0x250 [ 342.076997][T10022] ? __pfx____ratelimit+0x10/0x10 [ 342.077012][T10022] ? __pfx_dump_stack_lvl+0x10/0x10 [ 342.077027][T10022] ? __pfx__printk+0x10/0x10 [ 342.077044][T10022] ? __pfx___might_resched+0x10/0x10 [ 342.077057][T10022] ? fs_reclaim_acquire+0x7d/0x100 [ 342.077076][T10022] should_fail_ex+0x414/0x560 [ 342.077093][T10022] should_failslab+0xa8/0x100 [ 342.077105][T10022] __kvmalloc_node_noprof+0x175/0x910 [ 342.077123][T10022] ? seq_read_iter+0x202/0xe20 [ 342.077139][T10022] seq_read_iter+0x202/0xe20 [ 342.077152][T10022] ? _parse_integer_limit+0x1ae/0x1f0 [ 342.077167][T10022] ? __asan_memset+0x22/0x50 [ 342.077186][T10022] seq_read+0x369/0x480 [ 342.077203][T10022] ? __pfx_seq_read+0x10/0x10 [ 342.077214][T10022] ? __debugfs_file_get+0x5dd/0x710 [ 342.077233][T10022] ? __pfx___debugfs_file_get+0x10/0x10 [ 342.077256][T10022] full_proxy_read+0x127/0x1f0 [ 342.077273][T10022] ? __pfx_full_proxy_read+0x10/0x10 [ 342.077295][T10022] vfs_read+0x200/0xa30 [ 342.077306][T10022] ? fdget_pos+0x247/0x320 [ 342.077323][T10022] ? __pfx___mutex_lock+0x10/0x10 [ 342.077338][T10022] ? __pfx_vfs_read+0x10/0x10 [ 342.077351][T10022] ? __fget_files+0x2a/0x420 [ 342.077368][T10022] ? __fget_files+0x3a0/0x420 [ 342.077381][T10022] ? __fget_files+0x2a/0x420 [ 342.077401][T10022] ksys_read+0x145/0x250 [ 342.077414][T10022] ? __pfx_ksys_read+0x10/0x10 [ 342.077428][T10022] ? do_syscall_64+0xbe/0xfa0 [ 342.077446][T10022] do_syscall_64+0xfa/0xfa0 [ 342.077461][T10022] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.077473][T10022] ? clear_bhb_loop+0x60/0xb0 [ 342.077487][T10022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.077498][T10022] RIP: 0033:0x7fe85c78f6c9 [ 342.077509][T10022] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 342.077519][T10022] RSP: 002b:00007fe85a9f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 342.077534][T10022] RAX: ffffffffffffffda RBX: 00007fe85c9e5fa0 RCX: 00007fe85c78f6c9 [ 342.077542][T10022] RDX: 0000000000002020 RSI: 0000200000000440 RDI: 0000000000000003 [ 342.077550][T10022] RBP: 00007fe85a9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 342.077557][T10022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.077565][T10022] R13: 00007fe85c9e6038 R14: 00007fe85c9e5fa0 R15: 00007ffd89662058 [ 342.077584][T10022] [ 342.373948][ T5873] usb 6-1: Using ep0 maxpacket: 32 [ 342.394105][ T5873] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA1, changing to 0x81 [ 342.429010][ T5873] usb 6-1: New USB device found, idVendor=06cd, idProduct=0112, bcdDevice=d2.a2 [ 342.438267][ T5873] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 342.451022][ T5873] usb 6-1: Product: syz [ 342.462454][ T5873] usb 6-1: Manufacturer: syz [ 342.469912][ T5873] usb 6-1: SerialNumber: syz [ 342.485484][ T5873] usb 6-1: config 0 descriptor?? [ 342.497250][ T5873] keyspan 6-1:0.0: Keyspan 1 port adapter converter detected [ 342.518291][ T5873] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 87 [ 342.535770][ T5873] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 7 [ 342.547194][ T5873] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 1 [ 342.556294][ T5873] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 2 [ 342.571436][ T5873] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 85 [ 342.582143][ T5873] keyspan 6-1:0.0: found no endpoint descriptor for endpoint 5 [ 342.593526][ T5873] usb 6-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 342.651432][T10034] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 342.657954][T10034] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 342.667143][T10034] vhci_hcd vhci_hcd.0: Device attached [ 342.678272][ T5911] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 342.682779][T10035] vhci_hcd: connection closed [ 342.687466][ T13] vhci_hcd vhci_hcd.1: stop threads [ 342.699944][ T13] vhci_hcd vhci_hcd.1: release socket [ 342.706067][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 342.712424][ T5911] usb 10-1: device descriptor read/8, error -71 [ 342.773981][ T24] usb 9-1: new high-speed USB device number 34 using dummy_hcd [ 342.912942][ T56] block nbd2: Possible stuck request ffff888025a60000: control (read@0,4096B). Runtime 150 seconds [ 342.932613][ T24] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 342.943639][ T24] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 342.954146][ T5911] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 342.958564][ T49] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.962112][ T24] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 342.983082][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 342.991412][ T24] usb 9-1: SerialNumber: syz [ 342.998896][ T5911] usb 10-1: device descriptor read/8, error -71 [ 343.028941][ T49] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.110175][ T49] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.121126][ T5911] usb usb10-port1: unable to enumerate USB device [ 343.181694][ T49] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.216193][ T24] usb 9-1: 0:2 : does not exist [ 343.221181][ T24] usb 9-1: unit 255 not found! [ 343.263932][ T24] usb 9-1: USB disconnect, device number 34 [ 343.331874][T10041] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 343.359462][ T49] bridge_slave_1: left allmulticast mode [ 343.365651][ T49] bridge_slave_1: left promiscuous mode [ 343.371475][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.393171][ T49] bridge_slave_0: left allmulticast mode [ 343.399045][ T49] bridge_slave_0: left promiscuous mode [ 343.405407][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.426247][T10044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 343.437029][T10044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.645679][ T9] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 343.751440][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 343.764607][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 343.777367][ T49] bond0 (unregistering): Released all slaves [ 343.807868][T10047] ieee802154 phy1 wpan1: encryption failed: -22 [ 343.808717][ T9] usb 2-1: New USB device found, idVendor=055f, idProduct=bb30, bcdDevice=b6.ac [ 343.823543][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.832127][ T9] usb 2-1: Product: syz [ 343.837308][ T9] usb 2-1: Manufacturer: syz [ 343.843298][ T9] usb 2-1: SerialNumber: syz [ 343.871966][ T9] usb 2-1: config 0 descriptor?? [ 343.980807][T10051] ieee802154 phy1 wpan1: encryption failed: -22 [ 343.987288][T10051] FAULT_INJECTION: forcing a failure. [ 343.987288][T10051] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 344.001916][T10051] CPU: 0 UID: 0 PID: 10051 Comm: syz.8.1209 Not tainted syzkaller #0 PREEMPT(full) [ 344.001942][T10051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 344.001954][T10051] Call Trace: [ 344.001962][T10051] [ 344.001971][T10051] dump_stack_lvl+0x189/0x250 [ 344.002002][T10051] ? __pfx____ratelimit+0x10/0x10 [ 344.002026][T10051] ? __pfx_dump_stack_lvl+0x10/0x10 [ 344.002051][T10051] ? __pfx__printk+0x10/0x10 [ 344.002075][T10051] ? __might_fault+0xb0/0x130 [ 344.002114][T10051] should_fail_ex+0x414/0x560 [ 344.002142][T10051] _copy_from_user+0x2d/0xb0 [ 344.002169][T10051] ___sys_sendmsg+0x158/0x2a0 [ 344.002196][T10051] ? __pfx____sys_sendmsg+0x10/0x10 [ 344.002270][T10051] ? __might_fault+0xb0/0x130 [ 344.002298][T10051] __sys_sendmmsg+0x227/0x430 [ 344.002328][T10051] ? __pfx___sys_sendmmsg+0x10/0x10 [ 344.002362][T10051] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 344.002409][T10051] ? ksys_write+0x22a/0x250 [ 344.002433][T10051] ? __pfx_ksys_write+0x10/0x10 [ 344.002459][T10051] __x64_sys_sendmmsg+0xa0/0xc0 [ 344.002484][T10051] do_syscall_64+0xfa/0xfa0 [ 344.002511][T10051] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.002530][T10051] ? clear_bhb_loop+0x60/0xb0 [ 344.002554][T10051] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.002573][T10051] RIP: 0033:0x7fe85c78f6c9 [ 344.002591][T10051] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 344.002608][T10051] RSP: 002b:00007fe85a9f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 344.002630][T10051] RAX: ffffffffffffffda RBX: 00007fe85c9e5fa0 RCX: 00007fe85c78f6c9 [ 344.002645][T10051] RDX: 000000000000fdef RSI: 00002000000020c0 RDI: 0000000000000004 [ 344.002658][T10051] RBP: 00007fe85a9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 344.002670][T10051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 344.002689][T10051] R13: 00007fe85c9e6038 R14: 00007fe85c9e5fa0 R15: 00007ffd89662058 [ 344.002724][T10051] [ 344.206496][T10052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 344.215670][T10052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 344.276185][T10054] ieee802154 phy1 wpan1: encryption failed: -22 [ 344.305003][ T49] hsr_slave_0: left promiscuous mode [ 344.311021][ T49] hsr_slave_1: left promiscuous mode [ 344.331040][ T49] veth1_macvtap: left promiscuous mode [ 344.338776][ T49] veth0_macvtap: left promiscuous mode [ 344.345524][ T49] veth1_vlan: left promiscuous mode [ 344.350947][ T49] veth0_vlan: left promiscuous mode [ 344.470066][ T49] pimreg (unregistering): left allmulticast mode [ 344.548953][ T5911] usb 6-1: USB disconnect, device number 74 [ 344.567366][ T5911] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 344.582705][ T5911] keyspan 6-1:0.0: device disconnected [ 344.636333][T10060] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 344.642889][T10060] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 344.655023][T10060] vhci_hcd vhci_hcd.0: Device attached [ 344.671322][T10061] vhci_hcd: connection closed [ 344.671786][ T1163] vhci_hcd vhci_hcd.5: stop threads [ 344.683072][ T1163] vhci_hcd vhci_hcd.5: release socket [ 344.689773][ T1163] vhci_hcd vhci_hcd.5: disconnect device [ 344.889520][ T49] team0 (unregistering): Port device team_slave_1 removed [ 344.930020][ T49] team0 (unregistering): Port device team_slave_0 removed [ 345.316352][ T5828] Bluetooth: hci0: command tx timeout [ 345.380236][T10057] netlink: 'syz.8.1211': attribute type 3 has an invalid length. [ 345.390365][T10057] FAULT_INJECTION: forcing a failure. [ 345.390365][T10057] name failslab, interval 1, probability 0, space 0, times 0 [ 345.398326][T10070] netlink: 40 bytes leftover after parsing attributes in process `syz.9.1215'. [ 345.416356][T10057] CPU: 1 UID: 0 PID: 10057 Comm: syz.8.1211 Not tainted syzkaller #0 PREEMPT(full) [ 345.416380][T10057] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 345.416392][T10057] Call Trace: [ 345.416401][T10057] [ 345.416411][T10057] dump_stack_lvl+0x189/0x250 [ 345.416441][T10057] ? __pfx____ratelimit+0x10/0x10 [ 345.416465][T10057] ? __pfx_dump_stack_lvl+0x10/0x10 [ 345.416489][T10057] ? __pfx__printk+0x10/0x10 [ 345.416519][T10057] ? __pfx___might_resched+0x10/0x10 [ 345.416548][T10057] should_fail_ex+0x414/0x560 [ 345.416575][T10057] should_failslab+0xa8/0x100 [ 345.416608][T10057] kmem_cache_alloc_node_noprof+0x8c/0x710 [ 345.416635][T10057] ? __alloc_skb+0x112/0x2d0 [ 345.416661][T10057] __alloc_skb+0x112/0x2d0 [ 345.416685][T10057] netlink_ack+0x146/0xa50 [ 345.416704][T10057] ? __pfx_genl_rcv_msg+0x10/0x10 [ 345.416729][T10057] ? __pfx_nl802154_pre_doit+0x10/0x10 [ 345.416752][T10057] ? __pfx_nl802154_post_doit+0x10/0x10 [ 345.416793][T10057] netlink_rcv_skb+0x28c/0x470 [ 345.416813][T10057] ? __lock_acquire+0xab9/0xd20 [ 345.416834][T10057] ? __pfx_genl_rcv_msg+0x10/0x10 [ 345.416861][T10057] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 345.416905][T10057] ? down_read+0x1ad/0x2e0 [ 345.416934][T10057] genl_rcv+0x28/0x40 [ 345.416958][T10057] netlink_unicast+0x82f/0x9e0 [ 345.416988][T10057] ? __pfx_netlink_unicast+0x10/0x10 [ 345.417010][T10057] ? netlink_sendmsg+0x642/0xb30 [ 345.417030][T10057] ? skb_put+0x11b/0x210 [ 345.417054][T10057] netlink_sendmsg+0x805/0xb30 [ 345.417088][T10057] ? __pfx_netlink_sendmsg+0x10/0x10 [ 345.417114][T10057] ? aa_sock_msg_perm+0xf1/0x1d0 [ 345.417143][T10057] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 345.417170][T10057] ? __pfx_netlink_sendmsg+0x10/0x10 [ 345.417193][T10057] __sock_sendmsg+0x21c/0x270 [ 345.417224][T10057] ____sys_sendmsg+0x505/0x870 [ 345.417253][T10057] ? __pfx_____sys_sendmsg+0x10/0x10 [ 345.417287][T10057] ? import_iovec+0x74/0xa0 [ 345.417318][T10057] ___sys_sendmsg+0x21f/0x2a0 [ 345.417344][T10057] ? __pfx____sys_sendmsg+0x10/0x10 [ 345.417410][T10057] ? __fget_files+0x2a/0x420 [ 345.417433][T10057] ? __fget_files+0x3a0/0x420 [ 345.417470][T10057] __x64_sys_sendmsg+0x19b/0x260 [ 345.417496][T10057] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 345.417531][T10057] ? __pfx_ksys_write+0x10/0x10 [ 345.417558][T10057] ? do_syscall_64+0xbe/0xfa0 [ 345.417588][T10057] do_syscall_64+0xfa/0xfa0 [ 345.417622][T10057] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.417642][T10057] ? clear_bhb_loop+0x60/0xb0 [ 345.417667][T10057] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.417686][T10057] RIP: 0033:0x7fe85c78f6c9 [ 345.417705][T10057] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 345.417722][T10057] RSP: 002b:00007fe85a9f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 345.417744][T10057] RAX: ffffffffffffffda RBX: 00007fe85c9e5fa0 RCX: 00007fe85c78f6c9 [ 345.417760][T10057] RDX: 0000000000004000 RSI: 0000200000000500 RDI: 0000000000000004 [ 345.417774][T10057] RBP: 00007fe85a9f6090 R08: 0000000000000000 R09: 0000000000000000 [ 345.417787][T10057] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 345.417799][T10057] R13: 00007fe85c9e6038 R14: 00007fe85c9e5fa0 R15: 00007ffd89662058 [ 345.417836][T10057] [ 345.811587][ T5911] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 345.939791][T10082] FAULT_INJECTION: forcing a failure. [ 345.939791][T10082] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 345.953161][T10082] CPU: 0 UID: 0 PID: 10082 Comm: syz.9.1219 Not tainted syzkaller #0 PREEMPT(full) [ 345.953178][T10082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 345.953186][T10082] Call Trace: [ 345.953191][T10082] [ 345.953197][T10082] dump_stack_lvl+0x189/0x250 [ 345.953216][T10082] ? __pfx____ratelimit+0x10/0x10 [ 345.953231][T10082] ? __pfx_dump_stack_lvl+0x10/0x10 [ 345.953246][T10082] ? __pfx__printk+0x10/0x10 [ 345.953259][T10082] ? __might_fault+0xb0/0x130 [ 345.953280][T10082] should_fail_ex+0x414/0x560 [ 345.953296][T10082] _copy_from_user+0x2d/0xb0 [ 345.953312][T10082] ___sys_sendmsg+0x158/0x2a0 [ 345.953327][T10082] ? __pfx____sys_sendmsg+0x10/0x10 [ 345.953360][T10082] ? __fget_files+0x2a/0x420 [ 345.953374][T10082] ? __fget_files+0x3a0/0x420 [ 345.953393][T10082] __x64_sys_sendmsg+0x19b/0x260 [ 345.953408][T10082] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 345.953427][T10082] ? __pfx_ksys_write+0x10/0x10 [ 345.953442][T10082] ? do_syscall_64+0xbe/0xfa0 [ 345.953458][T10082] do_syscall_64+0xfa/0xfa0 [ 345.953473][T10082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.953484][T10082] ? clear_bhb_loop+0x60/0xb0 [ 345.953498][T10082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.953509][T10082] RIP: 0033:0x7f037518f6c9 [ 345.953520][T10082] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 345.953531][T10082] RSP: 002b:00007f0376050038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 345.953545][T10082] RAX: ffffffffffffffda RBX: 00007f03753e5fa0 RCX: 00007f037518f6c9 [ 345.953554][T10082] RDX: 0000000020000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 345.953562][T10082] RBP: 00007f0376050090 R08: 0000000000000000 R09: 0000000000000000 [ 345.953569][T10082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 345.953576][T10082] R13: 00007f03753e6038 R14: 00007f03753e5fa0 R15: 00007ffc536d4748 [ 345.953595][T10082] [ 345.965945][ T5911] usb 6-1: config 0 has an invalid interface number: 222 but max is 0 [ 346.160034][ T5911] usb 6-1: config 0 has no interface number 0 [ 346.171311][ T49] IPVS: stop unused estimator thread 0... [ 346.184549][ T5911] usb 6-1: New USB device found, idVendor=0b49, idProduct=064f, bcdDevice=d4.fd [ 346.193618][ T5911] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.214588][ T5894] usb 9-1: new high-speed USB device number 35 using dummy_hcd [ 346.226664][ T5911] usb 6-1: Product: syz [ 346.230857][ T5911] usb 6-1: Manufacturer: syz [ 346.235568][ T5911] usb 6-1: SerialNumber: syz [ 346.243299][ T5911] usb 6-1: config 0 descriptor?? [ 346.367503][ T5894] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 346.378301][ T5894] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 346.388272][ T5894] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 346.397515][ T5894] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 346.405710][ T5894] usb 9-1: SerialNumber: syz [ 346.440810][ T5911] usb 2-1: USB disconnect, device number 14 [ 346.470790][T10065] ieee802154 phy1 wpan1: encryption failed: -22 [ 346.512620][ T43] usb 6-1: USB disconnect, device number 75 [ 346.536796][T10090] Invalid option length (1048467) for dns_resolver key [ 346.658156][ T5894] usb 9-1: 0:2 : does not exist [ 346.663269][ T5894] usb 9-1: unit 255 not found! [ 346.675603][ T5894] usb 9-1: 5:0: cannot get min/max values for control 6 (id 5) [ 346.696574][ T5894] usb 9-1: 5:0: cannot get min/max values for control 7 (id 5) [ 346.715716][ T5894] usb 9-1: 5:0: cannot get min/max values for control 15 (id 5) [ 346.740503][ T5894] usb 9-1: USB disconnect, device number 35 [ 346.883937][ T6997] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 346.968930][T10101] FAULT_INJECTION: forcing a failure. [ 346.968930][T10101] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 346.982398][T10101] CPU: 0 UID: 0 PID: 10101 Comm: syz.9.1227 Not tainted syzkaller #0 PREEMPT(full) [ 346.982415][T10101] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 346.982423][T10101] Call Trace: [ 346.982428][T10101] [ 346.982433][T10101] dump_stack_lvl+0x189/0x250 [ 346.982452][T10101] ? __pfx____ratelimit+0x10/0x10 [ 346.982467][T10101] ? __pfx_dump_stack_lvl+0x10/0x10 [ 346.982481][T10101] ? __pfx__printk+0x10/0x10 [ 346.982502][T10101] should_fail_ex+0x414/0x560 [ 346.982518][T10101] _copy_to_user+0x31/0xb0 [ 346.982535][T10101] simple_read_from_buffer+0xe1/0x170 [ 346.982551][T10101] proc_fail_nth_read+0x1b3/0x220 [ 346.982566][T10101] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 346.982579][T10101] ? rw_verify_area+0x2a6/0x4d0 [ 346.982591][T10101] ? __lock_acquire+0xab9/0xd20 [ 346.982601][T10101] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 346.982614][T10101] vfs_read+0x200/0xa30 [ 346.982625][T10101] ? fdget_pos+0x247/0x320 [ 346.982641][T10101] ? __pfx___mutex_lock+0x10/0x10 [ 346.982663][T10101] ? __pfx_vfs_read+0x10/0x10 [ 346.982676][T10101] ? __fget_files+0x2a/0x420 [ 346.982692][T10101] ? __fget_files+0x3a0/0x420 [ 346.982705][T10101] ? __fget_files+0x2a/0x420 [ 346.982724][T10101] ksys_read+0x145/0x250 [ 346.982737][T10101] ? __pfx_ksys_read+0x10/0x10 [ 346.982751][T10101] ? do_syscall_64+0xbe/0xfa0 [ 346.982769][T10101] do_syscall_64+0xfa/0xfa0 [ 346.982783][T10101] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.982795][T10101] ? clear_bhb_loop+0x60/0xb0 [ 346.982808][T10101] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.982819][T10101] RIP: 0033:0x7f037518e0dc [ 346.982831][T10101] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 346.982841][T10101] RSP: 002b:00007f0376050030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 346.982855][T10101] RAX: ffffffffffffffda RBX: 00007f03753e5fa0 RCX: 00007f037518e0dc [ 346.982864][T10101] RDX: 000000000000000f RSI: 00007f03760500a0 RDI: 0000000000000004 [ 346.982871][T10101] RBP: 00007f0376050090 R08: 0000000000000000 R09: 0000000000000000 [ 346.982878][T10101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 346.982885][T10101] R13: 00007f03753e6038 R14: 00007f03753e5fa0 R15: 00007ffc536d4748 [ 346.982909][T10101] [ 347.212498][ T6997] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 347.223193][ T6997] usb 2-1: config 1 has no interface number 0 [ 347.263915][ T6997] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 347.275654][ T6997] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 347.286763][ T6997] usb 2-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 347.302477][ T6997] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 347.314030][ T6997] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 347.332575][ T6997] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 347.342521][ T6997] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.361381][ T6997] usb 2-1: Product: syz [ 347.366071][ T6997] usb 2-1: Manufacturer: syz [ 347.370682][ T6997] usb 2-1: SerialNumber: syz [ 347.379958][T10094] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 347.472197][T10111] Bluetooth: MGMT ver 1.23 [ 347.638199][T10094] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 347.713504][T10119] netlink: 372 bytes leftover after parsing attributes in process `syz.9.1232'. [ 347.841786][ T5828] Bluetooth: hci3: unknown advertising packet type: 0x05 [ 347.859614][T10094] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 347.875482][ T5818] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 348.025847][ T31] INFO: task udevd:5196 blocked for more than 143 seconds. [ 348.033263][ T31] Not tainted syzkaller #0 [ 348.040457][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 348.049670][ T31] task:udevd state:D stack:22216 pid:5196 tgid:5196 ppid:1 task_flags:0x400140 flags:0x00080000 [ 348.062689][T10128] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 348.078961][ T5818] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 348.094012][ T5818] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 348.103790][ T5818] usb 9-1: New USB device found, idVendor=d77d, idProduct=2c4e, bcdDevice= 0.00 [ 348.130115][ T31] Call Trace: [ 348.133494][ T31] [ 348.142695][ T31] __schedule+0x1836/0x4ed0 [ 348.147397][ T5818] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 348.157520][ T31] ? tomoyo_check_open_permission+0x2c2/0x3b0 [ 348.166696][ T31] ? do_sys_openat2+0x121/0x1c0 [ 348.172786][ T5818] usb 9-1: config 0 descriptor?? [ 348.178932][ T31] ? __lock_acquire+0xab9/0xd20 [ 348.215535][ T5818] usbhid 9-1:0.0: can't add hid device: -22 [ 348.221579][ T5818] usbhid 9-1:0.0: probe with driver usbhid failed with error -22 [ 348.230390][ T31] ? __pfx___schedule+0x10/0x10 [ 348.249811][ T31] ? schedule+0x91/0x360 [ 348.261862][ T31] schedule+0x165/0x360 [ 348.287525][ T31] schedule_preempt_disabled+0x13/0x30 [ 348.293052][ T31] __mutex_lock+0x7e6/0x1350 [ 348.315191][T10094] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 348.333911][ T31] ? __mutex_lock+0x5bb/0x1350 [ 348.336979][ T6997] cdc_ncm 2-1:1.1: bind() failure [ 348.338741][ T31] ? bdev_open+0xe0/0xd30 [ 348.370166][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 348.375627][ T31] ? disk_block_events+0xab/0x120 [ 348.380709][ T31] ? bdev_open+0xaf/0xd30 [ 348.394986][ T31] bdev_open+0xe0/0xd30 [ 348.399204][ T31] blkdev_open+0x457/0x600 [ 348.403647][ T31] ? __pfx_blkdev_open+0x10/0x10 [ 348.427987][ T31] do_dentry_open+0x7e4/0x1430 [ 348.432824][ T31] vfs_open+0x3b/0x340 [ 348.437445][ T31] ? path_openat+0x2ede/0x3860 [ 348.442243][ T31] path_openat+0x2efb/0x3860 [ 348.451830][ T31] ? kasan_save_stack+0x3e/0x60 [ 348.457293][ T31] ? call_rcu+0x157/0x9c0 [ 348.461693][ T31] ? __pfx_path_openat+0x10/0x10 [ 348.468249][ T31] do_filp_open+0x1fa/0x410 [ 348.472787][ T31] ? __lock_acquire+0xab9/0xd20 [ 348.478253][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 348.483338][ T31] ? _raw_spin_unlock+0x28/0x50 [ 348.488632][ T31] ? alloc_fd+0x64c/0x6c0 [ 348.493006][ T31] do_sys_openat2+0x121/0x1c0 [ 348.498145][ T31] ? fput_close_sync+0x113/0x220 [ 348.503118][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 348.509835][ T31] ? fput_close_sync+0x113/0x220 [ 348.519304][ T31] ? __pfx_fput_close_sync+0x10/0x10 [ 348.524947][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 348.530522][ T31] __x64_sys_openat+0x138/0x170 [ 348.538090][ T31] do_syscall_64+0xfa/0xfa0 [ 348.542636][ T31] ? irqentry_exit+0x10f/0x640 [ 348.547869][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.557766][ T31] ? clear_bhb_loop+0x60/0xb0 [ 348.562506][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.570105][ T31] RIP: 0033:0x7f7205ca7407 [ 348.574823][ T31] RSP: 002b:00007fff70f9c750 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 348.583590][ T31] RAX: ffffffffffffffda RBX: 00007f720637c880 RCX: 00007f7205ca7407 [ 348.598950][ T31] RDX: 00000000000a0800 RSI: 00005578208252d0 RDI: ffffffffffffff9c [ 348.607655][ T31] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 348.616989][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 348.629753][ T31] R13: 00005578173cf100 R14: 0000000000000000 R15: 00007fff70f9c9e0 [ 348.637920][ T31] [ 348.640999][ T31] INFO: task syz.2.444:7666 blocked for more than 143 seconds. [ 348.648843][ T31] Not tainted syzkaller #0 [ 348.655896][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 348.664871][ T31] task:syz.2.444 state:D stack:28296 pid:7666 tgid:7664 ppid:5832 task_flags:0x400140 flags:0x00080002 [ 348.677728][ T31] Call Trace: [ 348.681030][ T31] [ 348.684277][ T31] __schedule+0x1836/0x4ed0 [ 348.688820][ T31] ? __lock_acquire+0xab9/0xd20 [ 348.693678][ T31] ? __pfx___schedule+0x10/0x10 [ 348.698736][ T31] ? schedule+0x91/0x360 [ 348.703006][ T31] schedule+0x165/0x360 [ 348.707240][ T31] schedule_preempt_disabled+0x13/0x30 [ 348.712732][ T31] __mutex_lock+0x7e6/0x1350 [ 348.717382][ T31] ? __mutex_lock+0x5bb/0x1350 [ 348.722170][ T31] ? bdev_release+0x1a9/0x650 [ 348.726945][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 348.731990][ T31] ? dput+0x80/0x2b0 [ 348.736087][ T31] ? __pfx___fsnotify_parent+0x10/0x10 [ 348.741570][ T31] ? do_raw_spin_lock+0x121/0x290 [ 348.746798][ T31] bdev_release+0x1a9/0x650 [ 348.751329][ T31] ? __pfx_blkdev_release+0x10/0x10 [ 348.757703][ T31] blkdev_release+0x15/0x20 [ 348.762229][ T31] __fput+0x44c/0xa70 [ 348.766381][ T31] task_work_run+0x1d4/0x260 [ 348.771009][ T31] ? __pfx_task_work_run+0x10/0x10 [ 348.777606][ T31] ? __fput_deferred+0x215/0x390 [ 348.782578][ T31] ? exit_to_user_mode_loop+0x55/0x4f0 [ 348.788381][ T31] exit_to_user_mode_loop+0xff/0x4f0 [ 348.793882][ T31] ? rcu_is_watching+0x15/0xb0 [ 348.798671][ T31] do_syscall_64+0x2e9/0xfa0 [ 348.803254][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.809342][ T31] ? clear_bhb_loop+0x60/0xb0 [ 348.814062][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 348.820188][ T31] RIP: 0033:0x7f43dd98f6c9 [ 348.824694][ T31] RSP: 002b:00007f43de8d2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 348.833138][ T31] RAX: 0000000000000000 RBX: 00007f43ddbe5fa0 RCX: 00007f43dd98f6c9 [ 348.841145][ T31] RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003 [ 348.849168][ T31] RBP: 00007f43dda11f91 R08: 0000000000000000 R09: 0000000000000000 [ 348.857213][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 348.866608][ T31] R13: 00007f43ddbe6038 R14: 00007f43ddbe5fa0 R15: 00007ffe6802f2d8 [ 348.874908][ T31] [ 348.878111][ T31] [ 348.878111][ T31] Showing all locks held in the system: [ 348.886034][ T31] 1 lock held by khungtaskd/31: [ 348.890905][ T31] #0: ffffffff8e33d560 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 348.943954][ T31] 3 locks held by kworker/u8:8/3547: [ 348.949278][ T31] #0: ffff88801badf148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x841/0x15e0 [ 348.994011][ T31] #1: ffffc9000bb97b80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x868/0x15e0 [ 349.004603][ T31] #2: ffffffff8e342f00 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 [ 349.024181][ T31] 1 lock held by udevd/5196: [ 349.028836][ T31] #0: ffff888141fae358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 349.053908][ T31] 1 lock held by udevd/5840: [ 349.058535][ T31] #0: ffff888141fae358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 349.083865][ T31] 3 locks held by kworker/1:6/6997: [ 349.089103][ T31] #0: ffff88813fe55948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x841/0x15e0 [ 349.123861][ T31] #1: ffffc9000490fb80 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x868/0x15e0 [ 349.133629][ T31] #2: ffffffff8e343038 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 349.163858][ T31] 1 lock held by syz.2.444/7666: [ 349.170125][ T31] #0: ffff888141fae358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1a9/0x650 [ 349.203870][ T31] 2 locks held by getty/8068: [ 349.209565][ T31] #0: ffff88814dcdc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 349.233873][ T31] #1: ffffc90003efb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 349.254366][ T31] 1 lock held by syz.9.976/9206: [ 349.259337][ T31] 1 lock held by syz.8.1231/10116: [ 349.273950][ T31] 1 lock held by syz.5.1234/10125: [ 349.280444][ T31] #0: ffffffff8e343038 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 349.313927][ T31] [ 349.316293][ T31] ============================================= [ 349.316293][ T31] [ 349.340274][ T31] NMI backtrace for cpu 0 [ 349.340293][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 349.340317][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 349.340328][ T31] Call Trace: [ 349.340337][ T31] [ 349.340346][ T31] dump_stack_lvl+0x189/0x250 [ 349.340380][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 349.340406][ T31] ? __pfx__printk+0x10/0x10 [ 349.340444][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 349.340469][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 349.340492][ T31] ? __pfx__printk+0x10/0x10 [ 349.340520][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 349.340570][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 349.340594][ T31] watchdog+0xfa8/0xff0 [ 349.340624][ T31] ? watchdog+0x1f4/0xff0 [ 349.340657][ T31] kthread+0x711/0x8a0 [ 349.340687][ T31] ? __pfx_watchdog+0x10/0x10 [ 349.340712][ T31] ? __pfx_kthread+0x10/0x10 [ 349.340739][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 349.340762][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 349.340785][ T31] ? __pfx_kthread+0x10/0x10 [ 349.340819][ T31] ret_from_fork+0x599/0xb30 [ 349.340842][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 349.340873][ T31] ? __switch_to_asm+0x39/0x70 [ 349.340899][ T31] ? __switch_to_asm+0x33/0x70 [ 349.340923][ T31] ? __pfx_kthread+0x10/0x10 [ 349.340949][ T31] ret_from_fork_asm+0x1a/0x30 [ 349.340994][ T31] [ 349.341002][ T31] Sending NMI from CPU 0 to CPUs 1: [ 349.496936][ C1] NMI backtrace for cpu 1 [ 349.496954][ C1] CPU: 1 UID: 0 PID: 1163 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT(full) [ 349.496974][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 349.496984][ C1] Workqueue: events_unbound cfg80211_wiphy_work [ 349.497008][ C1] RIP: 0010:__lock_acquire+0xa4f/0xd20 [ 349.497027][ C1] Code: e5 ff 90 0f 0b 90 90 90 31 c0 48 8b 3c 24 48 83 78 40 00 0f 84 8c 02 00 00 41 8b 46 20 25 ff 1f 00 00 48 0f a3 05 a1 ef 23 12 <73> 10 48 69 c0 c8 00 00 00 48 8d 80 70 53 63 93 eb 40 83 3d 28 7f [ 349.497040][ C1] RSP: 0018:ffffc90003b1f028 EFLAGS: 00000003 [ 349.497055][ C1] RAX: 0000000000000007 RBX: 0000000000000003 RCX: 00000000106bc235 [ 349.497066][ C1] RDX: 000000001595f31a RSI: 000000000678ecc1 RDI: ffff8880270e5b80 [ 349.497078][ C1] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff81741fd5 [ 349.497089][ C1] R10: ffffc90003b1f2d8 R11: fffff52000763e5d R12: 00000000d1e3f82a [ 349.497101][ C1] R13: ffff8880270e66b0 R14: ffff8880270e6728 R15: 9dbb69ff106bc235 [ 349.497113][ C1] FS: 0000000000000000(0000) GS:ffff888125b76000(0000) knlGS:0000000000000000 [ 349.497126][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 349.497138][ C1] CR2: 000000110c2a6033 CR3: 000000007f67e000 CR4: 00000000003526f0 [ 349.497155][ C1] Call Trace: [ 349.497161][ C1] [ 349.497171][ C1] ? unwind_next_frame+0xa5/0x2390 [ 349.497189][ C1] lock_acquire+0x117/0x350 [ 349.497204][ C1] ? unwind_next_frame+0xa5/0x2390 [ 349.497224][ C1] ? unwind_next_frame+0xa5/0x2390 [ 349.497240][ C1] ? arch_stack_walk+0xe4/0x150 [ 349.497257][ C1] ? unwind_next_frame+0xa5/0x2390 [ 349.497274][ C1] unwind_next_frame+0xc2/0x2390 [ 349.497291][ C1] ? unwind_next_frame+0xa5/0x2390 [ 349.497309][ C1] ? unwind_next_frame+0xa5/0x2390 [ 349.497327][ C1] ? __unwind_start+0xf8/0x760 [ 349.497346][ C1] __unwind_start+0x5b9/0x760 [ 349.497364][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 349.497387][ C1] arch_stack_walk+0xe4/0x150 [ 349.497406][ C1] ? arch_stack_walk+0xe4/0x150 [ 349.497423][ C1] stack_trace_save+0x9c/0xe0 [ 349.497444][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 349.497468][ C1] ? __lock_acquire+0xab9/0xd20 [ 349.497484][ C1] kasan_save_track+0x3e/0x80 [ 349.497522][ C1] kasan_save_free_info+0x46/0x50 [ 349.497540][ C1] __kasan_slab_free+0x5c/0x80 [ 349.497568][ C1] ? ieee80211_ibss_rx_queued_mgmt+0x1206/0x2b10 [ 349.497590][ C1] kfree+0x191/0x6e0 [ 349.497610][ C1] ieee80211_ibss_rx_queued_mgmt+0x1206/0x2b10 [ 349.497639][ C1] ? ieee80211_ibss_rx_queued_mgmt+0xfaa/0x2b10 [ 349.497661][ C1] ? __pfx_ieee80211_ibss_rx_queued_mgmt+0x10/0x10 [ 349.497683][ C1] ? __lock_acquire+0xab9/0xd20 [ 349.497701][ C1] ? __lock_acquire+0xab9/0xd20 [ 349.497723][ C1] ? kcov_remote_start+0x18e/0x810 [ 349.497745][ C1] ieee80211_iface_work+0x85f/0x12d0 [ 349.497765][ C1] cfg80211_wiphy_work+0x2ab/0x470 [ 349.497783][ C1] ? process_one_work+0x868/0x15e0 [ 349.497799][ C1] process_one_work+0x93a/0x15e0 [ 349.497813][ C1] ? __lock_acquire+0xab9/0xd20 [ 349.497835][ C1] ? __pfx_process_one_work+0x10/0x10 [ 349.497853][ C1] ? assign_work+0x3a1/0x410 [ 349.497870][ C1] worker_thread+0x9b0/0xee0 [ 349.497894][ C1] kthread+0x711/0x8a0 [ 349.497913][ C1] ? __pfx_worker_thread+0x10/0x10 [ 349.497929][ C1] ? __pfx_kthread+0x10/0x10 [ 349.497948][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 349.497966][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 349.497984][ C1] ? __pfx_kthread+0x10/0x10 [ 349.498003][ C1] ret_from_fork+0x599/0xb30 [ 349.498018][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 349.498036][ C1] ? __switch_to_asm+0x39/0x70 [ 349.498056][ C1] ? __switch_to_asm+0x33/0x70 [ 349.498074][ C1] ? __pfx_kthread+0x10/0x10 [ 349.498093][ C1] ret_from_fork_asm+0x1a/0x30 [ 349.498118][ C1] [ 350.127657][ T5873] usb 2-1: USB disconnect, device number 15 [ 350.149826][ T5818] usb 9-1: USB disconnect, device number 36 [ 350.178634][ T3547] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.279342][ T3547] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.350816][ T3547] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.438132][ T3547] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 350.559299][ T3547] bridge_slave_1: left allmulticast mode [ 350.566115][ T3547] bridge_slave_1: left promiscuous mode [ 350.571839][ T3547] bridge0: port 2(bridge_slave_1) entered disabled state [ 350.581287][ T3547] bridge_slave_0: left allmulticast mode [ 350.587881][ T3547] bridge_slave_0: left promiscuous mode [ 350.593589][ T3547] bridge0: port 1(bridge_slave_0) entered disabled state [ 350.908697][ T3547] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 350.919810][ T3547] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 350.929802][ T3547] bond0 (unregistering): Released all slaves [ 351.160944][ T3547] hsr_slave_0: left promiscuous mode [ 351.166977][ T3547] hsr_slave_1: left promiscuous mode [ 351.172889][ T3547] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 351.180374][ T3547] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 351.188845][ T3547] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 351.196863][ T3547] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 351.218853][ T3547] veth1_macvtap: left promiscuous mode [ 351.224720][ T3547] veth0_macvtap: left promiscuous mode [ 351.230457][ T3547] veth1_vlan: left promiscuous mode [ 351.236088][ T3547] veth0_vlan: left promiscuous mode [ 351.635352][ T3547] team0 (unregistering): Port device team_slave_1 removed [ 351.672472][ T3547] team0 (unregistering): Port device team_slave_0 removed [ 352.286443][ T3547] IPVS: stop unused estimator thread 0... [ 352.353713][ T3547] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.411923][ T3547] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.469790][ T3547] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.537555][ T3547] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.656966][ T3547] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.729976][ T3547] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.799758][ T3547] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.848589][ T3547] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.950883][ T3547] bridge_slave_1: left allmulticast mode [ 352.956852][ T3547] bridge_slave_1: left promiscuous mode [ 352.962543][ T3547] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.973444][ T3547] bridge_slave_0: left promiscuous mode [ 352.979357][ T3547] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.989569][ T3547] bridge_slave_1: left allmulticast mode [ 352.995331][ T3547] bridge_slave_1: left promiscuous mode [ 353.000995][ T3547] bridge0: port 2(bridge_slave_1) entered disabled state [ 353.011350][ T3547] bridge_slave_0: left allmulticast mode [ 353.017056][ T3547] bridge_slave_0: left promiscuous mode [ 353.022722][ T3547] bridge0: port 1(bridge_slave_0) entered disabled state [ 353.370707][ T3547] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 353.381972][ T3547] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 353.392040][ T3547] bond0 (unregistering): Released all slaves [ 353.648658][ T3547] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 353.659347][ T3547] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 353.669350][ T3547] bond0 (unregistering): Released all slaves [ 353.765590][ T3547] tipc: Left network mode [ 354.079344][ T3547] hsr_slave_0: left promiscuous mode [ 354.086264][ T3547] hsr_slave_1: left promiscuous mode [ 354.097209][ T3547] hsr_slave_0: left promiscuous mode [ 354.103084][ T3547] hsr_slave_1: left promiscuous mode [ 354.130456][ T3547] veth1_macvtap: left promiscuous mode [ 354.136168][ T3547] veth0_macvtap: left promiscuous mode [ 354.141760][ T3547] veth1_vlan: left promiscuous mode [ 354.147167][ T3547] veth0_vlan: left promiscuous mode [ 354.154617][ T3547] veth1_macvtap: left promiscuous mode [ 354.160112][ T3547] veth0_macvtap: left promiscuous mode [ 354.166469][ T3547] veth1_vlan: left promiscuous mode [ 354.171763][ T3547] veth0_vlan: left promiscuous mode [ 354.621947][ T3547] team0 (unregistering): Port device team_slave_1 removed [ 354.657709][ T3547] team0 (unregistering): Port device team_slave_0 removed [ 355.313421][ T3547] team0 (unregistering): Port device team_slave_1 removed [ 355.356273][ T3547] team0 (unregistering): Port device team_slave_0 removed [ 356.052607][ T3547] IPVS: stop unused estimator thread 0...