last executing test programs: 14.921753507s ago: executing program 4 (id=2658): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000580)='net/icmp\x00') ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000600)=r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fanotify_init(0x10, 0x400) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_netdev_private(r2, 0x89f8, &(0x7f0000000140)="4e6a106d0103a9f1ef1bd2d08e33610b226f5a0237ccfb2d91866182b2d688a219bbe96e170c9db53b8cc13c6384db08336648be95a44ac11e312d83ea0042064d1246575e3c53038fc7c3f1ed5ba5db77b86ba68ca85c2d1fb48dfc4513b812d38a1fb9cc07bd357e1dc2bea09b2dd95f5410d28f7b1523a16a46896ccfd596038506") r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x200880, 0x0) ioctl$TCSETSF(r5, 0x5404, &(0x7f0000000000)={0x9, 0x3ff, 0xfffffffb, 0x8001, 0x1a, "08400000c38eaad6a4540ad9455fb5031af800"}) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000100)=0x9) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000480)={0x408, 0x3, 0x0, 0xfffc, 0x1a, "4415264a100046001113fb235902af2556c6b6"}) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r6 = socket(0x2, 0x80805, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r8, &(0x7f0000000200)={0xa, 0x4e23, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}, 0x1c) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000100)={r9, 0x7fff}, 0xc) r10 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r10, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) connect$rose(r10, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@null, @null, @null, @default, @bcast, @default]}, 0x40) 13.902076067s ago: executing program 3 (id=2659): r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000020000000000000f9ffff0b85000000ae000000850000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r2}, 0x90) statx(0xffffffffffffffff, 0x0, 0x48e0cdf8471afff4, 0x54663aafb2d54055, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYRES64=r3], 0x31, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) syncfs(0xffffffffffffffff) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='cpuhp_enter\x00', r4, 0x0, 0xfffffffffffffffd}, 0x18) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000900000000000000213f0000c50000000e800000850000000e00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='mmap_lock_acquire_returned\x00', r5}, 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x17) r6 = userfaultfd(0x80801) r7 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$6lowpan_enable(r7, &(0x7f00000002c0)='1', 0x1) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) ioctl$UFFDIO_UNREGISTER(r6, 0x8010aa01, &(0x7f0000000100)={&(0x7f0000ffb000/0x1000)=nil, 0x1000}) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000580)={0x2, 0x3, 0x1, {0xc0020002, 0x23, 0x5, 0x8}}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000f40)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) 13.224764926s ago: executing program 4 (id=2664): r0 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0xc1, 0x9a, 0x0) mq_timedreceive(r0, 0x0, 0x44, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000200), 0x4) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x3, 0x7, 0x2, 0x17d, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x5, 0x6, 0x8001, 0xbdb], 0xffff1001, 0x120182}) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000100"/16], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c643c, &(0x7f0000000300)) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000045000000040000000fa2"], 0x45}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) 12.245359911s ago: executing program 3 (id=2667): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20004015}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000"], 0x4c}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$overlay(0xf6ffffff, 0x0, 0x0, 0xd4, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioprio_set$uid(0x3, 0x0, 0x6007) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000280)="1a000000", 0x4) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f00000000c0), 0x1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) sendto$inet6(r3, &(0x7f0000000180)="e2b82dbb186a643303afda978ae5bfc8908f0ddcfab0927d489bf92155c0f483bc991750b32f7ceee6938aeb1f1a510b1728f6d589d55ca31a1f0c2118f305a9feb7325d35b52041d7416384238426592831dff4a36529d07618ee481843f11a407f67834555695eda8993098fd39990c6573680dd7186a23143864d9a6030600b2a0529aa2b", 0x86, 0x4000, 0x0, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0), 0x40880, 0x0) ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f0000000200)) socket$inet_sctp(0x2, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000040)={0xffff, 0x8001, 0x8, 0x5}, &(0x7f0000000100)=0x10) write$UHID_SET_REPORT_REPLY(r3, &(0x7f00000007c0)=ANY=[], 0xffe0) socket$nl_route(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 10.759954551s ago: executing program 3 (id=2670): bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) link(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x19}, 0x94) r0 = syz_io_uring_setup(0x53f, &(0x7f0000000440)={0x0, 0x807734, 0x400, 0x8, 0xfe}, &(0x7f00000000c0)=0x0, &(0x7f00000002c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x0, 0x0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x8, 0x88}, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) 10.240882007s ago: executing program 4 (id=2671): openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000020000000000000f9ffff0b85000000ae000000850000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r1}, 0x90) statx(0xffffffffffffffff, 0x0, 0x48e0cdf8471afff4, 0x54663aafb2d54055, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYRES64=r2], 0x31, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) syncfs(0xffffffffffffffff) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='cpuhp_enter\x00', r3, 0x0, 0xfffffffffffffffd}, 0x18) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000900000000000000213f0000c50000000e800000850000000e00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='mmap_lock_acquire_returned\x00', r4}, 0x10) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x17) userfaultfd(0x80801) r5 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$6lowpan_enable(r5, &(0x7f00000002c0)='1', 0x1) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) 9.083614703s ago: executing program 3 (id=2673): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/protocols\x00') r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) connect$unix(0xffffffffffffffff, &(0x7f000001a300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) read$FUSE(r0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x248, 0x98, 0x8, 0xfa04, 0x98, 0x6c02, 0x1f0, 0x194, 0x194, 0x1f0, 0x194, 0x3, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'veth0_to_hsr\x00', 'dvmrp1\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x74020000}}, @common=@inet=@TCPMSS={0x28}}, {{@ip={@multicast2, @dev, 0x0, 0x0, '\x00', 'vlan0\x00', {}, {}, 0x0, 0x1, 0x44}, 0x0, 0xb0, 0x118, 0x0, {}, [@common=@set={{0x40}, {{0x3, [0x4, 0x5, 0x3, 0x1, 0x2, 0x4], 0x4}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1b, 0x5, 0x1, 0x9, 'syz0\x00', 'syz1\x00', {0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2a8) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) 8.785873857s ago: executing program 3 (id=2674): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000580)='net/icmp\x00') ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000600)=r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) fanotify_init(0x10, 0x400) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_netdev_private(r2, 0x89f8, &(0x7f0000000140)="4e6a106d0103a9f1ef1bd2d08e33610b226f5a0237ccfb2d91866182b2d688a219bbe96e170c9db53b8cc13c6384db08336648be95a44ac11e312d83ea0042064d1246575e3c53038fc7c3f1ed5ba5db77b86ba68ca85c2d1fb48dfc4513b812d38a1fb9cc07bd357e1dc2bea09b2dd95f5410d28f7b1523a16a46896ccfd596038506") r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x200880, 0x0) ioctl$TCSETSF(r5, 0x5404, &(0x7f0000000000)={0x9, 0x3ff, 0xfffffffb, 0x8001, 0x1a, "08400000c38eaad6a4540ad9455fb5031af800"}) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000100)=0x9) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000480)={0x408, 0x3, 0x0, 0xfffc, 0x1a, "4415264a100046001113fb235902af2556c6b6"}) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r6 = socket(0x2, 0x80805, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r8, &(0x7f0000000200)={0xa, 0x4e23, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}, 0x1c) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000100)={r9, 0x7fff}, 0xc) r10 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r10, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) connect$rose(r10, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@null, @null, @null, @default, @bcast, @default]}, 0x40) 8.779673737s ago: executing program 1 (id=2675): r0 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0xc1, 0x9a, 0x0) mq_timedreceive(r0, 0x0, 0x44, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x3, 0x7, 0x2, 0x17d, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x5, 0x6, 0x8001, 0xbdb], 0xffff1001, 0x120182}) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c643c, &(0x7f0000000300)) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000045"], 0x45}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) 8.078513435s ago: executing program 4 (id=2677): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = socket$alg(0x26, 0x5, 0x0) ustat(0x801, &(0x7f0000000300)) bind$alg(r1, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) sendmsg(r3, &(0x7f0000000740)={&(0x7f0000000100)=@nfc_llcp={0x27, r4, 0xffffffffffffffff, 0x3, 0x5, 0x7, "e643fb11aa8027cc4f883d241f1634415f36d819eb6ad4a3ee874908f4500d652fd038fe020e0c2be01f91e2dd4a9dd0507458b74fed408440687ac2671f51", 0x1d}, 0x80, &(0x7f00000006c0)=[{&(0x7f00000002c0)="907103e739e4fbf9ac6236aa2a072d46d6b6553014a010b5ec7d426418fdc7fe748eccb1f7fc244f7a39e44e8388e5af14461fa4e8ff80bb597012bd6f7c9ee17f4b69aa0b99a2393755aafeced6d06d43eede85261db60991c1f3b1f0db8ac011c290dfb6336afbfe97484f413dc45541d0f1542fa90aa6a9e99b96336b58d921376f9860150ed1092344c2c99f8bc51e5b81961634c7340196944908b1f5d4ec57554a81cc16b6ed6368442c71a019db52a8469aec9d92a11708ae733ab20910621f5f4501a03f02b798420234f25168b02a497492647354ec4b8dd4a2f7994f6a4b896e42dc3d", 0xe8}, {&(0x7f00000003c0)="04ce8f00aa875f7bad8ce36f327cbc327058a4370f011b3b0f55d074354cc876df0c6ae5850b32be3cff8b5d595535444ba5d94f3daa048b5fe85037f0cb671141a25539707b116b79c71a81175fc9917c08f12a7b06d05961b07af8b616c62aa5030055d87a5768e927b7185a13848ed3d741e13485300b714beb41a1aa92aa83449f497bd8e763333290008968b8", 0x8f}, {&(0x7f0000000480)="9f8487d08d982788f3a1d0d85ff69e1a2d18f1dc8c788d3c21b183ba7d9b92c51370e8aed1386d17cc4be0b072a1265356ffd201c2568baa2c92f15f3ce618514933a007509d1ec592e82babe064f267deb27fc4009b4178cada29820c9660540054d36212dee1a15840b5230484511fdb59e4090894055b9a128991f82dee06d0815452431b9476c43cddb776ea677ae78068a99d45ea753b136f46f6489dac5cf222aa2a49f37d5fc13673419f18ef946198459e5599c418206feece751e6d8274cb52585b0849188fdacfaeb7d101495aa53e6ef0abbb8982eae6e56a5c1ffae9e6497d3ea2ce23b0c4bc4a2eb9da0487b8eada611f12", 0xf8}, {&(0x7f0000000580)="1eedf6c3800b9dbd0aa4985b2f57df7bc34d06c868dd4e99cdf032802709affb41ea1c661bb80f973d45368426", 0x2d}, {&(0x7f00000005c0)="d9657c69689680b4d68d565e8bcdd5dda1a3249202dd16109592a20cbf15289089a88b2855169f7471f8a4ccc8d03892144776975dc0b8d4b73398fb56869ce34cc6cf60ffe0c5732ee3a8f416688c424bb84d8d0314af453c5f5316d2715000edfa3d5a5fa6e95da7fb89b6801456def4c0255ea22cf190cac8fc8beb167b1626de384bd29eae5bd3d474bd85e2d21522bfcf73bbe72db0029028c3dba05511bf7ed343ad6e2dfc2bcd05e8ebb94b0c97011f107638585bc1797e457b2fbeceb25cc577c60580f41808b93e2d2c7c05fa0195d4932a4131bc76394970494b6c94302f9818ba7b18", 0xe8}], 0x5}, 0x0) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f00000033c0)={0x53, 0x0, 0x6, 0xfa, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="1c3513000000", 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r6, 0x0, 0x0) r7 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r7, 0x707, &(0x7f0000000180)={&(0x7f0000000040)=[{0x2, 0x10, 0x1, &(0x7f00000001c0)='W'}], 0x1}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r8 = accept(r1, 0x0, 0x0) sendmmsg$alg(r8, &(0x7f0000000740)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6e12edf1767f157", 0x33a77c20f21f5ff8}], 0x1, &(0x7f0000000480)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r8, &(0x7f000000b680)={0x0, 0xfffffe58, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x4}, {&(0x7f000000b500)=""/153, 0xfb7b}], 0x2}, 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="043e1f0a0100"], 0xf) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000000000203000000092100000801220700ea0481674f2b261fc8bcfc000000000000000000000097963164842281c9dcd72b7cc4061a926835f5009465"], 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000cc0f00000000e40004950000ba000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r9}, 0x10) 7.521998791s ago: executing program 0 (id=2678): r0 = syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x38a8, 0x80, 0x4, 0x1e3}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0x0, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x0, r3, 0x0, 0x0, 0x0, 0x322, 0x1, {0x1}}) io_uring_enter(r0, 0x3516, 0x0, 0x0, 0x0, 0x0) openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x40100, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) dup(0xffffffffffffffff) socket(0xa, 0x3, 0x3a) r5 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x80) io_uring_setup(0x1073, &(0x7f0000000240)={0x0, 0x32b6, 0x4000, 0x2, 0xdb}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x104}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = dup(r6) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206030000000000fffff0000000000016000300686173683a6e65742c706f72742c6e6574000000050004000000000005000500020000000900020073797a3200000000050001000700000014000780080013400000000008001240"], 0x64}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)={0x28, 0x3, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x40841}, 0x4) readv(0xffffffffffffffff, &(0x7f0000000140), 0x62) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x61, 0x11, 0x8c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x70) 7.266227102s ago: executing program 1 (id=2679): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket(0x2, 0x2, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f00000000c0)=0x2) writev(0xffffffffffffffff, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$clear(0x3, 0xfffffffffffffffd) bind$unix(r1, &(0x7f00000003c0)=@abs, 0x6e) ioctl$FBIOBLANK(0xffffffffffffffff, 0x4611, 0x4) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='cifs\x00', 0x0, &(0x7f00000001c0)='=\n\x9b\xa1Q\x83\xe9\n@\xf6\"2a\xd7\x1fch\x1a}#\xfa\xe4`\xdc[\x03\x97\xcd\xf1\xa6b\x9a\x1f\xff\xff\xffIT\xe4\x8c&\xac\xe6:\xc5\xe8\xd9\"\x82\xd5\xeb\x90\xef1:\xba\xc3\xc3\xd3\xad\'\xc44\x17,,\x8dZz\x04\x17-#F\xc7<\xe6\xf5]%gC\x9e\xca\nS\xc3\xc8\x98\xd8\xc8\x9eZ\xa76\x9f\xc2=\xaa\xcet7\xb9\xbd\xd47\xe3\xc8@$8\v\x9f\xfd\xe1!\x11\x19Y\x06J\x8f\x80\xef9Tw8\x1b\xe2\xf3\x85\xd5}\xa5\xb7\xd5|') 7.175872126s ago: executing program 3 (id=2681): r0 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0xc1, 0x9a, 0x0) mq_timedreceive(r0, 0x0, 0x44, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000200), 0x4) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x3, 0x7, 0x2, 0x17d, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x5, 0x6, 0x8001, 0xbdb], 0xffff1001, 0x120182}) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000100"/16], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c643c, &(0x7f0000000300)) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000045000000040000000fa2"], 0x45}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) 6.230420667s ago: executing program 1 (id=2682): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4080c}, 0x2000c845) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[], 0x17) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, &(0x7f0000000540)) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000400)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000001580)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) read(r6, 0x0, 0x0) 5.017634301s ago: executing program 1 (id=2683): openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000020000000000000f9ffff0b85000000ae000000850000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r1}, 0x90) statx(0xffffffffffffffff, 0x0, 0x48e0cdf8471afff4, 0x54663aafb2d54055, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYRES64=r2], 0x31, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) syncfs(0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='cpuhp_enter\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffd}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='mmap_lock_acquire_returned\x00'}, 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x17) r3 = userfaultfd(0x80801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x20}) r4 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$6lowpan_enable(r4, &(0x7f00000002c0)='1', 0x1) ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f0000000100)={&(0x7f0000ffb000/0x1000)=nil, 0x1000}) 4.960313789s ago: executing program 0 (id=2684): r0 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x0, 0x0) r1 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r3, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000000)={0xa0000001}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) epoll_pwait(r4, &(0x7f0000000040)=[{}], 0x1, 0xff, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r5, 0x0, 0x0) ioctl$RTC_PLL_SET(r5, 0x40207012, &(0x7f00000000c0)={0x1, 0xc834, 0x0, 0x7fff8, 0x400, 0x5, 0x2}) 4.176652935s ago: executing program 2 (id=2685): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/protocols\x00') r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) connect$unix(0xffffffffffffffff, &(0x7f000001a300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) read$FUSE(r0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x248, 0x98, 0x8, 0xfa04, 0x98, 0x6c02, 0x1f0, 0x194, 0x194, 0x1f0, 0x194, 0x3, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x16}, 0x0, 0x0, 'veth0_to_hsr\x00', 'dvmrp1\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x74020000}}, @common=@inet=@TCPMSS={0x28}}, {{@ip={@multicast2, @dev, 0x0, 0x0, '\x00', 'vlan0\x00', {}, {}, 0x0, 0x1, 0x44}, 0x0, 0xb0, 0x118, 0x0, {}, [@common=@set={{0x40}, {{0x3, [0x4, 0x5, 0x3, 0x1, 0x2, 0x4], 0x4}}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1b, 0x5, 0x1, 0x9, 'syz0\x00', 'syz1\x00', {0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2a8) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) mkdir(&(0x7f00000003c0)='./file0\x00', 0x21) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) 3.533275766s ago: executing program 1 (id=2686): ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) rseq(&(0x7f0000000240)={0x0, 0x0, 0x0, 0x6}, 0x20, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x84) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioperm(0x0, 0x6, 0x2da3b9f3) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000e80)={'filter\x00', 0xb001, 0x4, 0x3ac, 0x10c, 0x0, 0x1ec, 0x2cc, 0x2cc, 0x2cc, 0x7fffffe, 0x0, {[{{@arp={@empty, @local, 0xff000000, 0xff000000, 0xd, 0x6, {@mac=@broadcast, {[0xff, 0xff]}}, {@mac=@remote, {[0x0, 0xff, 0xff, 0x0, 0xff]}}, 0x1, 0x2, 0x7ff, 0x2, 0xfffb, 0x7f6, 'wlan1\x00', 'veth0_vlan\x00', {0xff}, {}, 0x0, 0x28}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010111, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}}}, {{@uncond, 0xbc, 0xe0, 0x0, {0x0, 0x1e03}}, @unspec=@STANDARD={0x24, '\x00', 0x0, 0x10c}}, {{@uncond, 0xbc, 0xe0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0x31caf518}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3fc) r2 = openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) fchown(r2, 0x0, 0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32={[0x2600, 0x0, 0x2000]}}], 0xffc8) 3.513933355s ago: executing program 2 (id=2687): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newtaction={0x78, 0x30, 0x309, 0x0, 0x2, {}, [{0x64, 0x1, [@m_tunnel_key={0x60, 0x1, 0x0, 0x0, {{0xf}, {0x30, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0xbabd, 0x81, 0x5, 0x1, 0xfff}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @empty}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @remote}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) bind$alg(r0, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x4, 0x3}, {}, {0x5, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x40004) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454da, &(0x7f00000001c0)={'bond_slave_0\x00'}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f0000000140)={'bond0\x00'}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f00000001c0)={0x1, 0x0, [{0x40000108, 0x0, 0x1}]}) 3.017584152s ago: executing program 2 (id=2688): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000000b2ef5daa40bf85edaca8300000000"], 0x0}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000800)={0x0, 0x0, 0x1, "9d"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = syz_open_dev$hiddev(&(0x7f0000000540), 0xff, 0x2d80) readv(r0, &(0x7f0000000200), 0x0) syz_open_dev$video(&(0x7f0000000140), 0xd, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r1, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r1, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003300)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="71b4", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}}], 0x2, 0x400c404) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000003c0)=0x11) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 3.013252952s ago: executing program 0 (id=2689): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000780)={0x10c, 0x0, &(0x7f0000000800)=[@reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000300)={@fda={0x66646185, 0x1, 0x1, 0x34}, @flat=@weak_handle={0x77682a85, 0x1, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/242, 0xf2, 0x2, 0x10}}, &(0x7f0000000080)={0x0, 0x20, 0x38}}}, @dead_binder_done, @dead_binder_done, @request_death={0x400c630e, 0x3}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x58, 0x18, &(0x7f00000004c0)={@flat=@handle={0x73682a85, 0x1, 0x1}, @flat=@weak_handle={0x77682a85, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/164, 0xa4, 0x2, 0x8}}, &(0x7f0000000440)={0x0, 0x18, 0x30}}}, @exit_looper, @free_buffer, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000640)={@fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x100b}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000006c0)={0x0, 0x18, 0x30}}}, @release], 0x51, 0x0, &(0x7f0000000700)="bc921d77ae629c44cc1d07f41e828e25ffe260b72a3110d214ab3b709b7e76cab0dd18e52059ca775fa538005497ce83c124dad65f22e89d74c4655d02f6cf32ceeb25e830b6f2c4a8e7027494cec8ef24"}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20004015}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000"], 0x4c}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$overlay(0xf6ffffff, 0x0, 0x0, 0xd4, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioprio_set$uid(0x3, 0x0, 0x6007) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f0000000280)="1a000000", 0x4) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f00000000c0), 0x1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) sendto$inet6(r3, &(0x7f0000000180)="e2b82dbb186a643303afda978ae5bfc8908f0ddcfab0927d489bf92155c0f483bc991750b32f7ceee6938aeb1f1a510b1728f6d589d55ca31a1f0c2118f305a9feb7325d35b52041d7416384238426592831dff4a36529d07618ee481843f11a407f67834555695eda8993098fd39990c6573680dd7186a23143864d9a6030600b2a0529aa2b", 0x86, 0x4000, 0x0, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0), 0x40880, 0x0) ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f0000000200)) socket$inet_sctp(0x2, 0x0, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000040)={0xffff, 0x8001, 0x8, 0x5}, &(0x7f0000000100)=0x10) write$UHID_SET_REPORT_REPLY(r3, &(0x7f00000007c0)=ANY=[], 0xffe0) socket$nl_route(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.357662025s ago: executing program 4 (id=2690): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket(0x2, 0x2, 0x1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r2}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f00000000c0)=0x2) writev(0xffffffffffffffff, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$clear(0x3, 0xfffffffffffffffd) bind$unix(r1, &(0x7f00000003c0)=@abs, 0x6e) ioctl$FBIOBLANK(0xffffffffffffffff, 0x4611, 0x4) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000000)='cifs\x00', 0x0, &(0x7f00000001c0)='=\n\x9b\xa1Q\x83\xe9\n@\xf6\"2a\xd7\x1fch\x1a}#\xfa\xe4`\xdc[\x03\x97\xcd\xf1\xa6b\x9a\x1f\xff\xff\xffIT\xe4\x8c&\xac\xe6:\xc5\xe8\xd9\"\x82\xd5\xeb\x90\xef1:\xba\xc3\xc3\xd3\xad\'\xc44\x17,,\x8dZz\x04\x17-#F\xc7<\xe6\xf5]%gC\x9e\xca\nS\xc3\xc8\x98\xd8\xc8\x9eZ\xa76\x9f\xc2=\xaa\xcet7\xb9\xbd\xd47\xe3\xc8@$8\v\x9f\xfd\xe1!\x11\x19Y\x06J\x8f\x80\xef9Tw8\x1b\xe2\xf3\x85\xd5}\xa5\xb7\xd5|') 1.965697009s ago: executing program 1 (id=2691): r0 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0xc1, 0x9a, 0x0) mq_timedreceive(r0, 0x0, 0x44, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x3, 0x7, 0x2, 0x17d, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x5, 0x6, 0x8001, 0xbdb], 0xffff1001, 0x120182}) r1 = syz_open_dev$dri(0x0, 0xd21, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c643c, &(0x7f0000000300)) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000045000000040000000fa2"], 0x45}) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) 1.759439767s ago: executing program 0 (id=2692): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_stall_count', 0xc4100, 0x1a) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x100010, r0, 0xced68000) setsockopt$inet_buf(r0, 0x0, 0x2a, &(0x7f0000000040)="6b77af83ee951e7f874222d70cc58b1ea9b7eaaa971f979acd154e79399354b066b69d53dbfb8e91882d0c969467ce79ca1cb84237c2d5c5eff6c23aec8e905e19637ea16fce0e0df1495dbfc7940a303c8b971db04e4edf35283d264f3f840f1eefd37979e203346af163d3b71ffb3fb7c91c0c785df3dfd8a864b7a09c00ae891dc21530a0680c22907e7608595d4dd4c8b394c5154497bca72543f89df0863843eef26856a0a296788994b1bdd0fc898ba0d1573a1fbca21f16e25943b80d63169eeec1f87bdf5d502bf84899b6f91b56f934872a8681374ffba2b1850f3675363a63d80f498600991f384087c904738e370a611e52f727b64512b114a87450b833ece24a785f2f9e8c14752b1ce53b127d30213d4156a96cd14302e864888ca142f895c72b403d433c3e885e0816270e709050a350babf91a2285dd4a5c33ead579b603e6c865c6d14802f89c676a648b9274e023382885b0ad1c1ead2ec69e88c04e4b881607453819c23a18bd2211c5dec52f6893a6667b67b821a300cf9d267f2ef54b699e6bc546c5e51f3a130d76363e663fe33361fb4994153c145976b798b79d3ce87961c7ef78a8db51badc3245accc545808341fe6b0dd06b65a2687eb075e15c8214fcab5236427acf005d525cdf2ccb7a42b9ad2863bae8e21cc13295b43db2efb1c17961be69dd65fa12c83ff902c39db1eabf32cb8e89e2dcedb152bf030d5384c78946fc4bba7248cdbdd9fa8524270b3eb856b3f2e7132e03b3614083821f6d663531360360a2d93044d1ec9c8e24dd24dd4f7c37cad71a5828a105b7348923b030f510c67adce7a9dc6086e1ba7d1d858b6dad119c31ee55cba7bd6d82bac5aa3317964d087ca4539323247b524e76c3cdbb307751f189be7038e8e188126872fd4be25194fb28b1149fb4c419a68fa9f640fbefaf0c05ae78d332f570ef7c93df7c2d4c84fdd12e8929dac7b303afd443ce370f9dd30b813d9d3dcffaaf72e615b58a0910232ebf75f70e69c0352a78b44bee36f103edc37283fd4839ed0bc030b581c008bdaad056f7aaf8d46f96d60471feaeef16a8e804319699a45a153a7e70f09b8b126d7cbf088ddfbfb0729aaae289b4581d88e7bc7fd175658278373601f06aec036a27383b8cc704b96e6809e6b74539d5d814931de035238fbefc5c1dd7453c3e66526289c057af5c3f68c3e209b83acb951a95beabfe41e91ca9990099c9f7d7446c86ece5fec32c2696ee36fffad5951ee74b29eb4fbb9092b2015519388d7900fa4fc0dc389c47a30a9b5b1f8814d2a9804d74dd204b7613a42925c9c1665654bed6c7d66577f94b8764a1660038ede65d326de25b28275731706670c2e2bef0686d9094c70a6017286197d0ba1509f596b1644bc402a7f17fe4129ce1d821db502659e6fc7b6f0dbf5a720842069f29235bcfcb78806b8c15ce8fffb4ca9ddacd43d0f7db1a279c14a58b415b012d7bec2d34eae961d3ad1dece0250384587adb449bac9cefa73c255f9abcd94c08c49cbded783fb6b57be7cac74f94ab33e8a1538d1fa4d2d4797d2f27ac6028182b17a5218cceab3324c9afbf2dc42a829953f38f44cf264c28d5004df281dd26dbf8cec66f681d31925cc824395f9daec663b838c57a7499b46f027d8de410a8d1289c547811c1bff7d4ffab219a64fc7b85e0d356979e68fb9e11d63766f355ac2066933458203da47e9efbee6f7ddd40798156e835aa9eea24eca0ddc2b46c7c60a156711cd972d3157444e964b63dba0a356529656a9250e8bfdf024ceeddcf5324594e57ebf803ec3b87be8d3fd8cdb24d36977f7b303fcfe4059f9c87d51e176b81a0f18b8c0eb1ca3094517e30edf0e43b9eaa1f8c4b6169db171607711bed5f41e3e58afa686ddbe05bc496f7d81b9467e54daf4d8c7f59c9753fab541cecd3ea26c3fee80ff7ee1fc337739694ea2032014c7f1ececeac397486e1b36a56d2c504aa529e835fd6f0b8de84474d14335b8e73228c9a9b437f6a733575c25980996de8093296118dd9c3c92276fa34b25cac276e0128bab609635b66fa1611448cd29781bb12959eaba02e3e37c1320c4c92f88447d492b49ef5c3059bc58ca36ca6a4c63c51eb7a05d96b3bb566cb217e8e0e647d7c6e7093cdfd365fbe087f128675db7d367a0e89a168a2439ca61bfabfc651367f688da288f77a263600203091bfa6d361b03554c8815a783e8ca70048aa51a3b570499aeaaa5a74c69e552f00a051100b307405bcef38e2c24247453d5f5497bac2dfe4226264c01b34ea60e066b83b635a0e587d40dc86225fbdcac641eb9bfdb4832f7bc565ee82c21f0a1c631f2c3cbaafd13df8df5c8faef17e61f4528ec4e2f992ca05e649e40b01ac9a45299d736463931416a71d1716e6a03d40bd82b0c5393a3aebe14d8e9f563e2a575b92cad77ae4cd8edeff4d0aa1885bf8e4a99012e3902c7d541a3090f97cb5af2917a39cb7eefe9372cbfe7ec468e71a3e7bac536908e9e9130ddd021f999050cd5c517c19912d32fab2e59fdbd5aa25ded71b485145f095bd4f6303395052df03f5b51d637c1205d5ba9fb75708653b5e91f84d5012167cedd6d8dfe2191c211c25b829b432ffa1e7157efb047e956a33a2f8cb107652abcd0836e69b959d29575783f54a9e71623a3273686a82df5c96f80a475fadf40415fa9d8de05ebb51cdf94dc8e41780faf553de66fdbdb53bef6b8ea595c7e8446afa4aeeefd563ebeebafc9fc3555761fcbf647972e7f94992b51dcd2ed9d2c06bc30aeb010d633c29cc7a9fe4fd72ad817638aed2578aa97529617710ee6baf4248551fd0a633ae97680866039b6eb0c5a22f63eb87f0d73cc4b3e61c2261330935257f173251f04dd48c392d2cd20c600e41905fccc1fe52f61708867dec932c10c4292bad6d2be0f06cbaf3f1732fcd7f817050cb48d726d78869bb593f17a09a474224fead2b78af7c7253297d523254a1f95e7127819e999328bd82303600a61dfd0e8bf471e8691c0755b2dff5ee6aae51e15a5bee5fd6bf1198d296eb8870329399fc42862ff7a83f9c282f4f7c5386458d29080df482699662cfc1da6ebcf23496fe5e074cfb9c02aa52b720272d3d91342d35b883a87ddc83e6b7bb2117f44fda534db285f60f2c25ab19ae468d23c8b5c74e4ed72781fdce5fc2d79c043958b9efbaaad6b1e311484de74a0bd1f6479e319a853d5b4b02f9cea155f9aaad300f86cd1975af28167a31380950204c0b1f55730e73fe99c5736718b45aeeae97ce89231c911dce91ed540bcb93791b66b287a652d57103504a206fc74afd107bed057b72efca744058b9ecb2e39f180bab0b18eba62403e67b3c13915f1057c193efc2f5ddf015acbaeab42ae8e545f8d3b9b1d24804b26d4c46479c44516ee8a2333a5fe314f3228daad86ba628288a9cfe38a0172745f852b3a51d265533695faa4a2432acac1ec96170a9efedb7f6b22c6891a945c6ad79fdfd84285d13d927d2568c0f079ec87af549f1ed94805fd1b9afe4aa8f3e6fda1ab02ea8e41a042671181c4825ef65154f59b82b7b6b37166e2baa16645679d83192524556c0e61d011d894039fb0e57512f9d155e23201709d060ce927d56ef4cf2a3cd5b0b4d1983929cdbed9d7ec3e515992a929d80ef59339945f294df8058034e13e999eb0ce5353ebaded706ebb9d0356a7960fb03ddddb736a2b09162b9ecf5e7081e303dfdfc66c0335d30124d49749fa1a0b68d54ee14ebf5f89b2aa77ee03bad0f70a640e492c2b5bea65fc075151cc6c2beb4ea0b60366b7eaf7ccdc27906ed6b4c88492ab050949a9822d005d771c84f92da862be9bdc6d569a0fa9871500deac682a69d51fbc64c1c5f59f2ebefd7aff53383c0b663cf19379b11e1d1622027195b1340dfdb52cfda9709692d822f2aa82e2e7f0d9fb1bb5235d72ac8741daf0235747577a5b26701cb8f51b97f82e7f51352baa132be157ff50f0d50b509adfd7365bb5556debfa20209fa3931f123c11467d26ac45cea6cdd85bdb19e64eb566fa903094a2903dd2c68a20f200a31371da76b739a06e1d1d58c0fcadf17aa7082d0f752675fb92bc39bc33d1633143e86b00b6f6559f9d1972a01a3634d386e3fb1717f31ba87e6ef367212595713c2f84d93ba03c60509c6cf88c0122c41afc42f5dfa2aababd668687fa6181ef91658a135d1d4537a16d5366165e7c989e3819d7c09dad3738f54542580579505be7f3379e555ae339962a7f6363d5ebf51296de2a4ca57f2a7e2737c87fa8aaac41894b45706204b218d3c278f82b5998a527953b1ba4bcf85b4a6801ab52c13622e9e061fbd6c60e1fec9147a16935b0ec769dfcaa8d18690743e01fbe535697eb7224965e4944d99bcb238a31e4bf649322d831a8fb3c2ffbc373ee82d099b01c59a54196ea1a2dc0ebfbae865e0f04e393b31acac95153922042a25280337c2795230c5e5e4b6a977b53f909821812ec2184de75c02d7bcb7acc42c3600cd28c7734ab672c699083ef38486fbf24320a82d8b4d98dacdf1c39704f2397328448ca1e7939ddb3c0e90555d67af374f36135507f50432838d631eaa0006877f17386fb167ffd26f9d36d335612e6606acff64c63c9b14549359d7bd12fd001d733c34ce191049066e74a5ec827565d7330e424404eba1b96ef293139957d24773107e62107890b56f804c17d127a0f39609ccef02e50988c03af1b50352c5888f91871f4299c10821a15510631b0d4fc592f80125b8b36fe5a326dfbad349f42478b13b22cc4b06f7d6e600b205dc0cd0763b12f9ccd6a36e6b60783a6b4dd503a1f3dc636ac2150a482f55e02fd601aa2734a787a4a487b8b272ef7081bce2959694821143476fb542755e639021573dd2cb7d95df76a3c670e102a4902d2a60c713a0255379aca27dd261e409e4e3aa1584f44ef3560600a95393739bc476d5e71fc46c4ffe041bb765c10d4d3ff5bfc8a9efe32286b85fd3a8e58eb84129fefa921ec902a01e1a62e198cf3f3eafe1a3992ef8c4bc206ed7f44b05a16e7c2fd44314195866b78ea553f8fa62e1b5c9118c883ce4eb1f09c4a5cd6e662d5e72ca82b245b019a2ea683028f2621117b1fd742bea998b68ea941edd0aedc6d16759464f084504d5fd21cab662706cd3479dcb63f56e9bd1ba9e5700b5df193e3a6e7d5acf652cb7a2387fda8fcdc65c9d6c80bd8534f0528948492a3a159855b8cd719a8b1bf23e446aea150dbc770615c319af12c505462ced805d8b6c2c221dd826e5eb368252b1852bc96885807b639cf8bf4dbb69b3cea6a8f88ae741a65dfc464ad933a9ff7eb5e9e42b951cf238ee3406216f27babbc87c91f70e1b67bd32135f61a9bb8ff752582ee181fb61d12c85dfb7a4cf91e1b167d3d14367833c828a2dcbd401cab0c4355bfb3df0a59085dc39194cdcf31aac4f54ff82e1f9ed38c2f4870f538955dcf906fbd56dda5dd690be4d5a05acfcc2254325f37f8553e5cb8d3c339ffadd9081a05370c5f9dfaa9e4b3ba9fe72c89035640e34b8e0e3c5ffdcdb85230b5106b5282855d2b048075e7f40d9ededf293ed832c555556ee248bc356473d11f4df58ad4648655de7b1ce96523f8bd7e16a49a5e956b09b7ec7fe3c7b5dcbfd1d12ed33636878fc9958eb1fb1c2d9f1bd11fe6534b55b831d56795c290fd073fbfefc882760e8ebce92a3cdee7eba61b2f0a55965e878b288cc71464a68dfdcfc3027df221966", 0x1000) r1 = socket$caif_seqpacket(0x25, 0x5, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000001040)={'wg2\x00', {0x2, 0x4e24, @loopback}}) bind$inet6(r0, &(0x7f0000001080)={0xa, 0x4e23, 0xb3, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1}, 0x1c) ioctl$KVM_GET_LAPIC(r0, 0x8400ae8e, &(0x7f00000010c0)={"160ec8b25cfec288bf3dfe6bd4eff559c1ee781f0fdd5af58264a26028ec14c352f8530ed1d1db8641c2ecf5ce23beb8a3a1608d171b8930c6efe981f1704e3cc0c7a52dd0f7d3248f55b4447acab9a330597cd85523bce0e53e6c07536250765ce2af28a612bd639b0c19ccb62d00d6dc571588f9ac21ab15552af7384a2af4ab172e859b7513a3127da7b36b16b3bb85de797c293dec8d33fb11f8f09d14ff911a6259bc4528369ebfb5a1b83f2c2fe8e0bcfecb9d06b216ddee8d75a27c830c4faf0bca7d8eb34c4e3b8332606e9cdfc22aff072ba2bd823f8a0ef922a51a659ce41f18b8ac9e331e5c840edf0a500cc92258b75ee8833e12b1ebb5c1b66bb8b0d10dc02712656cbea635d3d5f68950d29ec004b42da40aba9ed09859cfadfe91805ad177b02c38eae8dfe3b21ae09754c304d2062dd7c432687c7aaa5dd70480947b39676f88b2a7e9d7b9b465d64c1450fb0ac9fecefafc2f111b0b8906fe3506789a7a66e1d365c3c0ed1ef08ca9fcdc8cb827b311d36006f97754793c80dbc9dd192f112fe0cd350ebd3827067acf237f8c519e3bf9e42eefbac995f39473cb6c0f17c119e38852ff1d7c616b46ce2b563914f26e7f031d9d5287d57f6f74b79e691542ef09c7786c5473dff7e0d74dcd1eb7b0f21bc54bd5dc1d7f205eb9b3e8110591d772dec2a765727ecf2a3510df1d1440d3ff1c092a16b2acf8cec62ad4495cb84e6bb7c439b8260801d3978dce3ee707347ed217e0be837d36609d549e9959b2ecb3b517c8b5650403de4e02900ee5c38ee25ffc819f5a8b3a03725638082aaf249677f9f52dc4f3e6ee56783ffca8c512c72a48ab6ee15a7ce515c6adf9cd52bd0cf968030111654af576541656f46fe94676c5ebad01e24385fd0bae5e94aef5d4c055d41d350d1cdee168e1f9a25fd71fca4e267e0c75e7cd1ffcf3765f762d91ad29a8ba746dc54d114b218fccf7a7584f90a5626ef2be4df5f7d169f7788d7b99d0d3cb535eb2d685fcb14a8ac1574433bfb1b77f688a0e0e5de942315bc370c378b6eb90d804fed835dd26fe93c4d384d7b345797110e98c8fcc25454bdf93b5bdc26943e195d98ac5f6724f0fce2b59453adc34a9145083a3574bcd9b5383ba5649402c1f5cf88b9c5cc93c17342b3dc410ea5a806a9fc36d1b48bb83f7ac3ee40a61a9aa980425cb0e96f1adee374863aeb7e42fab97c06338670e0d32d06e601c80646aaa4f83d5cb6127715c78aac9005dd0be63db75d0268d0721a7d32e55a89ec7e27a984802deb58b6b72273c3dcf7e7a0d119d725da249692b127f08a108dae4e2c1fc1e1a07bd742e702ac1bf45b4437b6bfa538ae59bf5aecb0c1b0f7dc452fb9cbb2a82aff91c094bee81924828448fdf8da06316e05bbaa1247a417deade85e259318ee93ae06d54a79eb2338081836d"}) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0xe) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r2, &(0x7f0000001640)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001600)={&(0x7f0000001500)={0xd0, 0x2, 0x9, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0xa8, 0x2, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @rand_addr=' \x01\x00'}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x5}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40c00c0}, 0x8020) quotactl_fd$Q_SYNC(r0, 0xffffffff80000100, 0x0, 0x0) symlinkat(&(0x7f0000001680)='./file0\x00', r0, &(0x7f00000016c0)='./file0\x00') syz_io_uring_setup(0x7ec9, &(0x7f0000001700)={0x0, 0x7c3a, 0x200, 0x1, 0xc4, 0x0, r0}, &(0x7f0000001780), &(0x7f00000017c0)) r3 = getpgid(0xffffffffffffffff) syz_pidfd_open(r3, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000001800), r0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r0, 0xc01064bd, &(0x7f0000001880)={&(0x7f0000001840)="372f7cc8d17b682238d179d33e9ea37c0324", 0x12, 0x0}) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(r0, 0xc01064ac, &(0x7f00000028c0)={r4, 0x1000, &(0x7f00000018c0)=""/4096}) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000002900)) clock_gettime(0x0, &(0x7f0000002a40)={0x0, 0x0}) mq_timedreceive(r0, &(0x7f0000002940)=""/235, 0xeb, 0x6b, &(0x7f0000002a80)={r5, r6+10000000}) syz_genetlink_get_family_id$nl80211(&(0x7f0000002ac0), r0) socket$pppl2tp(0x18, 0x1, 0x1) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x2) mknodat$loop(r0, &(0x7f0000002b00)='./file0\x00', 0x2000, 0x1) r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000002b40), 0x98900, 0x0) ioctl$IOMMU_HWPT_ALLOC$NONE(r7, 0x3b89, &(0x7f0000002c40)={0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9, &(0x7f0000002b80)="87c9bfb79b8bd65a8f395ebd1f5d3085e069caa594b1f6fbac62f3877f38391c22cf736f30fd8ed23f5c9ff99f6c2732c17360bf67ce2cc505fc46ac3d169a917d81c36c6c0c91e0d0d289ad58271bf95de085454cd38be2c31201efad0d2c533221a193b30e3884e4197c08bfd4d7a88bd62e73db94d78e984f983d713fc9936246bfc65c2e480123c602916b2303ab29d829135cf8abe7971f4126203605cc68653ccef8e3cc6aa4"}) ioctl$IOMMU_HWPT_ALLOC$NONE(r7, 0x3b89, &(0x7f0000002cc0)={0x28, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d, &(0x7f0000002c80)="b1055a4cb3a8458b88af149377e3d941d78f7b961e65b00533f8853c31"}) r8 = socket$inet(0x2, 0x2, 0x7f) ioctl$F2FS_IOC_DECOMPRESS_FILE(r8, 0xf517, 0x0) 1.353929728s ago: executing program 2 (id=2693): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000), &(0x7f0000000040)=0xc) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4080c}, 0x2000c845) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[], 0x17) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, 0x0, &(0x7f0000000540)) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000400)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000001580)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) read(r6, 0x0, 0x0) 515.592902ms ago: executing program 0 (id=2694): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xa0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="240000001900010028bd7000fbdbdf251d01020008000900", @ANYRES32, @ANYBLOB="08000a00e1"], 0x24}, 0x1, 0x0, 0x0, 0x4048855}, 0x30004016) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000235, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0x40405515, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x3, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ad, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000dfff75390000000000000000850000007d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000500000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000000c0)='mmap_lock_acquire_returned\x00', r2}, 0x10) fchdir(r1) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000d40)=[{{&(0x7f0000000080)=@abs={0x1, 0x30, 0x30}, 0x6e, 0x0}}], 0x1, 0x0) 418.246988ms ago: executing program 2 (id=2695): syz_emit_ethernet(0xf4, &(0x7f00000006c0)=ANY=[@ANYBLOB="0180c200000eaaaaaaaaaaaa88480000000000000000000000008c00000000000000ffaa8330a15825a45b2d6feb0951f8a38982ff34b87af7e9d322036f6390eb0ccca661805a107ce09eb09f5f1447fb3dc3095ab0a5b6e92af2b58a764db21b544edbd653d122f286bef52e04ef7504ff04e29b2a8a73def803218f22593fbbf8d3125dbfb2af5c2609f41c16dc5e9cc4ada1cee3b7091583898369a66e5f8cb9c29d51ce7f9fbf0253979e59761ebbce43b451ae273b04b6d7041959385ad95b301ea976dcf259001c53ecf942b8e9291dfe9577352c9b90839a4c77077c05ec4bab2e84d3dda6eac13e1978d498b2ef4f56b4b02cc4c02cf4efeaf5f70ef12fb5e1ce4ddf1b1f8d56bd1c977dd761da87c2e893182608bfd523c85cc7a479605b34f7465073e3fda1c97e20d437160adccea8792fccd1c0649f04eade670054dbcc51d8d4086c210093f440c25e44b5d8650bc11f7a9a31e7d49aa10dd62a48e54b30fd1029596fc1de216bed3eb6b31cd426b03e05059907dbd4585bc099ee80bbbed5"], 0x0) socket$packet(0x11, 0x0, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) fanotify_init(0x202, 0x400) setxattr$incfs_metadata(0x0, 0x0, 0x0, 0x0, 0x0) removexattr(&(0x7f0000000040)='./file0\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'crc32c-generic\x00'}, 0x7b) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg$inet(r2, &(0x7f0000001200)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000003c0)="ba", 0x1}], 0x1}}], 0x1, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x94) dup(r3) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x2c, r4, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}]}, 0x2c}}, 0xc800) 348.759543ms ago: executing program 4 (id=2696): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0x1006) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a000090400000103010100", @ANYRES64], 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, 0x0, 0x0) setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, &(0x7f00000003c0)='wg1\x00', 0x4) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @rand_addr=0x64010103}, 0x10) sendmmsg(r1, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000200)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x70, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0xffff}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x0, 0x100, 0x3}, {0x6, 0x24, 0x1a, 0x0, 0x10}}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x8, 0x2, 0xfa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x56, 0x5, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x4, 0x48, 0x9}}}}}}}]}}, &(0x7f00000005c0)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x310, 0x0, 0x0, 0xbc, 0x10, 0x3}, 0xc, &(0x7f0000000300)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x4, 0x8, 0x9, 0x3}]}, 0x4, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x2401}}, {0xcb, &(0x7f0000000380)=@string={0xcb, 0x3, "bf220a1f179c633f2cdc2e3086136e37daeb99a13d349f027883be3b5bfe21bd7971c0a087e363ade5ec596a3148688bac04ac8524b48009fddfdefae21f918bf52c24d95079c7add25c1b2c592bdfb1d35d8e93a33313db8ee76a12f08ea5304d03c88a443b7d53185c1eef89e8022b07de67271051d0970e4a44c2ac2f47f83d8f35f6e25b4d1fb7b05a3aec3de0ddd9ea1ef81827b562b810876ee73ef2d55fd0f03c5aa47741379711eb8785dfa4d115031b828077656af9faeb635b8c61ecdc5be97e9d92925a"}}, {0xcb, &(0x7f0000000480)=@string={0xcb, 0x3, "5305ffa25774d58896e750670d0975bface8bdf7b1116a05955fc3c1e121dc7a382d6ebd3fb51a98f948b8e79d52dd7e3f355e93b790e7e6170fc81c5fa601974296db55d2437db30e2415a3b7019ac28d82db73091eac18630081ed88121a1fccbab7a419de078ac57e581aeb9b96c1cb59f1cf2af2349e7d2ed117ea700248ffa9e97b00bbd2ba9a92ce0ac11d9a46ee6ff3a1eff8e08627b9881d5d855f1358b74c2326ef3fbddd486aa6725da3918bf9eedb81c7b19cd38a610a89dee083b44cf10a485a84c813"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x402}}]}) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[], 0x0, 0x0, 0x0}, 0x0) fchdir(0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="00a5020000000000280012800b0001006272696467650000"], 0x48}}, 0x0) 14.410593ms ago: executing program 0 (id=2697): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0x1006) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a000090400000103010100", @ANYRES64], 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, 0x0, 0x0) setsockopt$SO_BINDTODEVICE_wg(r1, 0x1, 0x19, &(0x7f00000003c0)='wg1\x00', 0x4) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e23, @rand_addr=0x64010103}, 0x10) sendmmsg(r1, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000200)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x70, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0xffff}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x0, 0x100, 0x3}, {0x6, 0x24, 0x1a, 0x0, 0x10}}, {{0x9, 0x5, 0x81, 0x3, 0x400, 0x8, 0x2, 0xfa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x40, 0x56, 0x5, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x4, 0x48, 0x9}}}}}}}]}}, &(0x7f00000005c0)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x310, 0x0, 0x0, 0xbc, 0x10, 0x3}, 0xc, &(0x7f0000000300)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x4, 0x8, 0x9, 0x3}]}, 0x4, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x2401}}, {0xcb, &(0x7f0000000380)=@string={0xcb, 0x3, "bf220a1f179c633f2cdc2e3086136e37daeb99a13d349f027883be3b5bfe21bd7971c0a087e363ade5ec596a3148688bac04ac8524b48009fddfdefae21f918bf52c24d95079c7add25c1b2c592bdfb1d35d8e93a33313db8ee76a12f08ea5304d03c88a443b7d53185c1eef89e8022b07de67271051d0970e4a44c2ac2f47f83d8f35f6e25b4d1fb7b05a3aec3de0ddd9ea1ef81827b562b810876ee73ef2d55fd0f03c5aa47741379711eb8785dfa4d115031b828077656af9faeb635b8c61ecdc5be97e9d92925a"}}, {0xcb, &(0x7f0000000480)=@string={0xcb, 0x3, "5305ffa25774d58896e750670d0975bface8bdf7b1116a05955fc3c1e121dc7a382d6ebd3fb51a98f948b8e79d52dd7e3f355e93b790e7e6170fc81c5fa601974296db55d2437db30e2415a3b7019ac28d82db73091eac18630081ed88121a1fccbab7a419de078ac57e581aeb9b96c1cb59f1cf2af2349e7d2ed117ea700248ffa9e97b00bbd2ba9a92ce0ac11d9a46ee6ff3a1eff8e08627b9881d5d855f1358b74c2326ef3fbddd486aa6725da3918bf9eedb81c7b19cd38a610a89dee083b44cf10a485a84c813"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x402}}]}) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[], 0x0, 0x0, 0x0}, 0x0) fchdir(0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000010000d0400"/20, @ANYRES32=0x0, @ANYBLOB="00a5020000000000280012800b0001006272696467650000"], 0x48}}, 0x0) 0s ago: executing program 2 (id=2698): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r1 = syz_io_uring_setup(0x10b, &(0x7f0000000580)={0x0, 0x9736, 0x220, 0x3, 0xbffffff9}, &(0x7f0000000540)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f00000002c0)=0x9, 0x0, 0x4) io_uring_enter(r1, 0x1c3a, 0xe176, 0x22, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x1b, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000901fefffffffffffffd58c7b196995d61", @ANYRES32=r3, @ANYRESHEX=r3, @ANYRES32=r3, @ANYBLOB="0000000000000000b70200000200000085000000860000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000010000008500000006000000bf91000000000000b70200000200000085000000850000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r5 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x802) ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000100)={0xc0b2, 0x5, 0x1, 0xd, 0x1, 0x44e, "586f9bb5a781fdee0b851ce91bf49570", 0x7, 0x5, 0x1, 0x6, 0x8, 0x6, 0x9}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xff43, &(0x7f00000002c0)=0x2) socket$rds(0x15, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYRES64=r3, @ANYRESHEX=0x0, @ANYRES64, @ANYRES16=r8, @ANYRESOCT], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xd, &(0x7f0000000500)=ANY=[@ANYRES32=r4], &(0x7f00000004c0)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000000c0)) read$dsp(r9, &(0x7f0000000440)=""/102, 0x66) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x18, 0x3, r6, r7, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000280)}) syz_io_uring_setup(0x891, &(0x7f0000000140)={0x0, 0xaee2, 0x80, 0x3, 0x8b6}, 0x0, 0x0) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) kernel console output (not intermixed with test programs): ] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 754.785838][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 754.884248][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 754.912048][T14127] xt_TPROXY: Can be used only with -p tcp or -p udp [ 755.085094][ T5893] HID 045e:07da: Invalid code 65791 type 1 [ 755.091044][ T30] audit: type=1400 audit(1751877385.842:835): avc: denied { bind } for pid=14125 comm="syz.2.2012" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 755.115662][ T5893] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0091/input/input171 [ 755.211230][ T9] usb 4-1: config 0 descriptor?? [ 755.300225][ T9] hub 4-1:0.0: bad descriptor, ignoring hub [ 755.705273][T14118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 755.729565][ T9] hub 4-1:0.0: probe with driver hub failed with error -5 [ 755.794635][ T5893] microsoft 0003:045E:07DA.0091: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 755.807972][ T9] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 755.824284][T14118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 755.898407][ T30] audit: type=1326 audit(1751877386.692:836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 755.943260][ T5893] usb 1-1: USB disconnect, device number 82 [ 755.997647][T14118] bridge6: entered promiscuous mode [ 755.998447][ T30] audit: type=1326 audit(1751877386.692:837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.105357][ T30] audit: type=1326 audit(1751877386.692:838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.131087][ T30] audit: type=1326 audit(1751877386.692:839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.168596][ T9] usb 4-1: USB disconnect, device number 65 [ 756.256376][ T30] audit: type=1326 audit(1751877386.692:840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.268555][T14144] fido_id[14144]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 756.493148][ T30] audit: type=1326 audit(1751877386.692:841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.518294][ T30] audit: type=1326 audit(1751877386.692:842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.541952][ T30] audit: type=1326 audit(1751877386.692:843): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.565711][ T30] audit: type=1326 audit(1751877386.692:844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.589258][ T30] audit: type=1326 audit(1751877386.692:845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.613175][ T30] audit: type=1326 audit(1751877386.692:846): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.637699][ T30] audit: type=1326 audit(1751877386.692:847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 756.662412][ T30] audit: type=1326 audit(1751877386.692:848): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14130 comm="syz.1.2015" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7eff0998e929 code=0x7ffc0000 [ 758.665571][T14186] overlayfs: failed to resolve './file1': -2 [ 759.409375][T14194] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.2026'. [ 760.359126][T14203] netlink: 'syz.2.2030': attribute type 12 has an invalid length. [ 760.367044][T14203] netlink: 'syz.2.2030': attribute type 29 has an invalid length. [ 760.374923][T14203] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2030'. [ 763.024629][ T30] kauditd_printk_skb: 4 callbacks suppressed [ 763.024649][ T30] audit: type=1326 audit(1751877393.832:853): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 763.155446][ T30] audit: type=1326 audit(1751877393.832:854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 763.191172][ T30] audit: type=1326 audit(1751877393.832:855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 763.217805][ T30] audit: type=1326 audit(1751877393.832:856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 763.253928][ T30] audit: type=1326 audit(1751877393.832:857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 763.280842][ T30] audit: type=1326 audit(1751877393.832:858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 763.336082][ T30] audit: type=1326 audit(1751877393.832:859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 763.432170][ T30] audit: type=1326 audit(1751877393.832:860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 763.770929][ T30] audit: type=1326 audit(1751877393.832:861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 764.002160][T14245] CIFS mount error: No usable UNC path provided in device string! [ 764.002160][T14245] [ 764.012437][T14245] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 764.384157][ T30] audit: type=1326 audit(1751877393.832:862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14218 comm="syz.4.2034" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 767.893123][ T5893] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 768.039409][T14287] CIFS mount error: No usable UNC path provided in device string! [ 768.039409][T14287] [ 768.049565][T14287] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 768.063689][ T973] usb 3-1: new full-speed USB device number 79 using dummy_hcd [ 768.095499][ T5893] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 768.133479][ T5893] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 768.166802][ T5893] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 768.193766][ T5893] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 768.229469][T14282] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 768.267096][ T973] usb 3-1: config 0 has an invalid interface number: 238 but max is 0 [ 768.353679][ T5893] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 768.368838][ T973] usb 3-1: config 0 has no interface number 0 [ 768.379447][ T973] usb 3-1: config 0 interface 238 altsetting 2 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 768.458048][ T973] usb 3-1: config 0 interface 238 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 768.520235][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 768.520252][ T30] audit: type=1400 audit(1751877399.342:871): avc: denied { getopt } for pid=14280 comm="syz.0.2046" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 768.526265][ T973] usb 3-1: config 0 interface 238 has no altsetting 0 [ 768.528462][ T973] usb 3-1: New USB device found, idVendor=0742, idProduct=2009, bcdDevice=44.ca [ 768.587749][ T973] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 768.597677][ T973] usb 3-1: Product: syz [ 768.598980][ T30] audit: type=1400 audit(1751877399.402:872): avc: denied { read } for pid=14280 comm="syz.0.2046" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 768.669958][ T973] usb 3-1: Manufacturer: syz [ 768.674718][ T973] usb 3-1: SerialNumber: syz [ 768.743432][ T973] usb 3-1: config 0 descriptor?? [ 768.756136][T14261] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 768.775821][ T973] HFC-S_USB 3-1:0.238: probe with driver HFC-S_USB failed with error -5 [ 768.841259][ T5893] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 768.882857][ T9] usb 3-1: USB disconnect, device number 79 [ 769.011251][ T5893] usb 2-1: Using ep0 maxpacket: 32 [ 769.034595][T14290] Process accounting resumed [ 769.078734][ T5893] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 769.087437][ T43] usb 1-1: USB disconnect, device number 83 [ 769.089339][ T5893] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 769.125404][ T5893] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 769.137379][ T5893] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 769.148705][ T5893] usb 2-1: config 0 descriptor?? [ 769.177084][ T5893] hub 2-1:0.0: bad descriptor, ignoring hub [ 769.254723][ T5893] hub 2-1:0.0: probe with driver hub failed with error -5 [ 769.295898][ T5893] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 769.368157][ T9] libceph: connect (1)[c::]:6789 error -101 [ 769.402486][T14289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.552441][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 769.641195][T14289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.670381][ T9] libceph: connect (1)[c::]:6789 error -101 [ 769.685762][T14304] ceph: No mds server is up or the cluster is laggy [ 769.707188][ T9] libceph: mon0 (1)[c::]:6789 connect error [ 769.769683][T14314] CIFS mount error: No usable UNC path provided in device string! [ 769.769683][T14314] [ 769.779838][T14314] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 770.202175][T14289] bridge4: entered promiscuous mode [ 770.384576][ T9] usb 2-1: USB disconnect, device number 69 [ 773.064179][ T43] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 773.088930][T14353] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2064'. [ 773.840620][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 773.858318][ T43] usb 3-1: config 0 has an invalid interface number: 125 but max is 0 [ 773.867572][ T43] usb 3-1: config 0 has no interface number 0 [ 773.874937][ T43] usb 3-1: config 0 interface 125 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 773.887925][ T43] usb 3-1: config 0 interface 125 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 773.899867][ T43] usb 3-1: config 0 interface 125 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 773.918064][ T43] usb 3-1: New USB device found, idVendor=3277, idProduct=009e, bcdDevice=2e.0f [ 774.023262][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 774.048650][ T43] usb 3-1: Product: syz [ 774.077798][ T43] usb 3-1: Manufacturer: syz [ 774.207717][ T43] usb 3-1: SerialNumber: syz [ 774.233101][ T43] usb 3-1: config 0 descriptor?? [ 774.346693][T14364] can0: slcan on ttyS3. [ 774.717487][T14345] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 774.730767][ T43] usb 3-1: Found UVC 0.00 device syz (3277:009e) [ 774.788045][ T43] usb 3-1: No valid video chain found. [ 775.122216][T14360] can0 (unregistered): slcan off ttyS3. [ 775.317527][T14381] input input172: cannot allocate more than FF_MAX_EFFECTS effects [ 776.059139][ T43] usb 3-1: USB disconnect, device number 80 [ 776.472337][ T5893] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 776.674948][T14405] hsr0: entered promiscuous mode [ 776.713261][T14405] hsr0: left promiscuous mode [ 777.154954][ T5893] usb 5-1: Using ep0 maxpacket: 32 [ 777.161792][ T5893] usb 5-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 777.179254][ T5893] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 777.254103][ T5893] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 777.347188][ T5893] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 777.370077][ T5893] usb 5-1: config 0 descriptor?? [ 777.582579][ T5893] hub 5-1:0.0: bad descriptor, ignoring hub [ 777.601481][ T5893] hub 5-1:0.0: probe with driver hub failed with error -5 [ 777.749734][ T5893] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 777.786243][T14393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 777.822969][T14393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 777.863141][T14393] bridge7: entered promiscuous mode [ 778.179633][ T5893] usb 5-1: USB disconnect, device number 67 [ 778.718799][T14428] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2075'. [ 781.010680][T14451] can0: slcan on ttyS3. [ 781.541199][T14442] can0 (unregistered): slcan off ttyS3. [ 781.572617][T14452] PKCS7: Unknown OID: [4] 0.38.107.1697900.285475 [ 781.579208][T14452] PKCS7: Only support pkcs7_signedData type [ 781.872151][T14459] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2082'. [ 782.755494][T14468] CIFS mount error: No usable UNC path provided in device string! [ 782.755494][T14468] [ 782.765642][T14468] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 783.600697][ T43] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 784.510691][ T43] usb 1-1: Using ep0 maxpacket: 32 [ 784.643504][ T43] usb 1-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8 [ 784.661082][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 784.677840][ T43] usb 1-1: Product: syz [ 784.682147][ T43] usb 1-1: Manufacturer: syz [ 784.686760][ T43] usb 1-1: SerialNumber: syz [ 784.726764][ T43] empeg 1-1:1.0: empeg converter detected [ 784.783030][T14491] can0: slcan on ttyS3. [ 785.553317][ T43] usb 1-1: empeg converter now attached to ttyUSB0 [ 789.470729][T14486] can0 (unregistered): slcan off ttyS3. [ 789.699110][ T24] usb 1-1: USB disconnect, device number 84 [ 789.735331][ T24] empeg ttyUSB0: empeg converter now disconnected from ttyUSB0 [ 789.781518][ T24] empeg 1-1:1.0: device disconnected [ 789.942592][T14514] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2096'. [ 790.944150][T14532] mkiss: ax0: crc mode is auto. [ 791.161512][T14533] sg_write: data in/out 124/1 bytes for SCSI command 0x1c-- guessing data in; [ 791.161512][T14533] program syz.4.2100 not setting count and/or reply_len properly [ 793.073563][T14559] CIFS mount error: No usable UNC path provided in device string! [ 793.073563][T14559] [ 793.083742][T14559] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 793.474661][T14562] can0: slcan on ttyS3. [ 794.954267][T14554] can0 (unregistered): slcan off ttyS3. [ 795.257628][T14581] trusted_key: encrypted_key: insufficient parameters specified [ 797.258267][T14607] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2116'. [ 798.261633][T14620] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.2119'. [ 798.806547][T14626] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 798.827807][T14628] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2121'. [ 798.845187][T14628] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2121'. [ 798.875910][T14629] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2121'. [ 798.895347][T14629] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2121'. [ 798.933784][T14626] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 798.960817][ T5941] usb 3-1: new full-speed USB device number 81 using dummy_hcd [ 798.998454][ T30] audit: type=1400 audit(1751877429.822:873): avc: denied { write } for pid=14630 comm="syz.4.2122" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 799.023738][T14626] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.036823][T14635] random: crng reseeded on system resumption [ 799.113205][ T5941] usb 3-1: unable to get BOS descriptor or descriptor too short [ 799.184815][T14626] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 799.214467][ T5941] usb 3-1: not running at top speed; connect to a high speed hub [ 799.310550][T14642] can0: slcan on ttyS3. [ 799.664586][ T5941] usb 3-1: config 8 has an invalid interface number: 24 but max is 0 [ 799.673519][ T5941] usb 3-1: config 8 has no interface number 0 [ 799.683178][ T5941] usb 3-1: config 8 interface 24 altsetting 2 endpoint 0xE has invalid maxpacket 1535, setting to 64 [ 799.769027][ T5941] usb 3-1: config 8 interface 24 has no altsetting 0 [ 799.804145][ T5941] usb 3-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=75.af [ 799.876307][ T5941] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 799.960682][ T30] audit: type=1326 audit(1751877430.772:874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 799.995425][ T5941] usb 3-1: Product: syz [ 800.001073][T14634] can0 (unregistered): slcan off ttyS3. [ 800.027398][ T5941] usb 3-1: Manufacturer: syz [ 800.037538][ T5941] usb 3-1: SerialNumber: syz [ 800.048642][T14626] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.065655][T14626] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.101844][T14626] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.115968][T14621] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 800.135686][ T30] audit: type=1326 audit(1751877430.782:875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 800.147280][T14626] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.230315][ T30] audit: type=1326 audit(1751877430.782:876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 800.366946][ T5941] comedi comedi5: driver 'vmk80xx' has successfully auto-configured 'K8055 (VM110)'. [ 800.420681][ T30] audit: type=1326 audit(1751877430.782:877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 800.480862][ T5941] usb 3-1: USB disconnect, device number 81 [ 800.635417][ T30] audit: type=1326 audit(1751877430.782:878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 801.870722][ T30] audit: type=1326 audit(1751877430.782:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 801.870767][ T30] audit: type=1326 audit(1751877430.782:880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 801.870804][ T30] audit: type=1326 audit(1751877430.782:881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 801.870842][ T30] audit: type=1326 audit(1751877430.782:882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14639 comm="syz.3.2125" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7ffc0000 [ 802.102637][T14677] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 802.104476][T14677] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 802.902187][T14690] input input174: cannot allocate more than FF_MAX_EFFECTS effects [ 803.840553][ T43] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 804.176741][T14703] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.2135'. [ 804.190829][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 804.412602][ T43] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 804.444593][ T43] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 804.797697][ T43] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 804.849817][ T43] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 804.920603][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 804.949205][ T43] usb 2-1: Product: syz [ 804.956575][ T43] usb 2-1: Manufacturer: syz [ 804.985624][ T43] usb 2-1: SerialNumber: syz [ 805.327721][T14720] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2138'. [ 806.249128][ T43] usb 2-1: 0:2 : does not exist [ 806.260635][ T24] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 806.284577][T14725] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 806.387458][T14727] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.2140'. [ 806.420945][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 806.447627][ T24] usb 1-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 806.461633][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 806.566115][ T24] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 806.645066][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 806.709827][ T43] usb 2-1: USB disconnect, device number 70 [ 806.783419][ T24] usb 1-1: config 0 descriptor?? [ 806.845481][ T24] hub 1-1:0.0: bad descriptor, ignoring hub [ 806.869678][ T24] hub 1-1:0.0: probe with driver hub failed with error -5 [ 806.968036][ T24] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 807.039814][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 807.039847][ T30] audit: type=1400 audit(1751877437.862:895): avc: denied { connect } for pid=14729 comm="syz.2.2142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 807.943933][T14715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 807.982693][T14715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 807.996477][T14735] pim6reg1: entered allmulticast mode [ 808.008922][T14736] pim6reg1: left allmulticast mode [ 808.058176][ T30] audit: type=1400 audit(1751877437.862:896): avc: denied { read } for pid=14729 comm="syz.2.2142" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 808.391320][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.397672][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.880395][T14715] bridge4: entered promiscuous mode [ 808.930118][T14741] ref_ctr_offset mismatch. inode: 0x87d offset: 0x0 ref_ctr_offset(old): 0xe ref_ctr_offset(new): 0x2000000003c0 [ 809.055128][ T24] usb 1-1: USB disconnect, device number 85 [ 809.177655][T14750] input input175: cannot allocate more than FF_MAX_EFFECTS effects [ 809.837982][T14753] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.2145'. [ 809.997116][T14756] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 810.361032][T14766] can0: slcan on ttyS3. [ 811.371266][T14759] can0 (unregistered): slcan off ttyS3. [ 811.703468][T14781] SELinux: security_context_str_to_sid (user_u) failed with errno=-22 [ 811.721058][ T30] audit: type=1326 audit(1751877442.532:897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14778 comm="syz.3.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7fc00000 [ 812.491560][ T30] audit: type=1326 audit(1751877442.532:898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14778 comm="syz.3.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7fc00000 [ 812.514952][ C0] vkms_vblank_simulate: vblank timer overrun [ 812.676858][T14789] FAULT_INJECTION: forcing a failure. [ 812.676858][T14789] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 812.714084][T14789] CPU: 1 UID: 0 PID: 14789 Comm: syz.2.2155 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 812.714113][T14789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 812.714123][T14789] Call Trace: [ 812.714129][T14789] [ 812.714136][T14789] dump_stack_lvl+0x16c/0x1f0 [ 812.714167][T14789] should_fail_ex+0x512/0x640 [ 812.714195][T14789] _copy_from_user+0x2e/0xd0 [ 812.714221][T14789] memdup_user+0x6b/0xe0 [ 812.714245][T14789] strndup_user+0x78/0xe0 [ 812.714269][T14789] __x64_sys_mount+0x137/0x310 [ 812.714296][T14789] ? __pfx___x64_sys_mount+0x10/0x10 [ 812.714329][T14789] do_syscall_64+0xcd/0x4c0 [ 812.714356][T14789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.714374][T14789] RIP: 0033:0x7ff712b8e929 [ 812.714388][T14789] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 812.714404][T14789] RSP: 002b:00007ff713945038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 812.714421][T14789] RAX: ffffffffffffffda RBX: 00007ff712db5fa0 RCX: 00007ff712b8e929 [ 812.714433][T14789] RDX: 0000200000000b80 RSI: 0000200000000040 RDI: 0000000000000000 [ 812.714443][T14789] RBP: 00007ff713945090 R08: 0000200000000000 R09: 0000000000000000 [ 812.714454][T14789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 812.714463][T14789] R13: 0000000000000000 R14: 00007ff712db5fa0 R15: 00007fff5a9af1c8 [ 812.714487][T14789] [ 812.715955][ T30] audit: type=1400 audit(1751877442.532:899): avc: denied { mounton } for pid=14778 comm="syz.3.2152" path="/440/file0/file0" dev="ramfs" ino=45360 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 812.810767][ C0] vkms_vblank_simulate: vblank timer overrun [ 812.974114][ T5945] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 813.593917][ T30] audit: type=1326 audit(1751877442.632:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14778 comm="syz.3.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7fc00000 [ 813.681911][ T5945] usb 5-1: Using ep0 maxpacket: 16 [ 813.692803][ T30] audit: type=1326 audit(1751877442.642:901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14778 comm="syz.3.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7fc00000 [ 813.736425][ T5945] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 813.746522][ T30] audit: type=1326 audit(1751877443.272:902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14778 comm="syz.3.2152" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f267478e929 code=0x7fc00000 [ 813.780083][ T5945] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 813.827033][ T5945] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 813.916095][ T973] usb 3-1: new full-speed USB device number 82 using dummy_hcd [ 813.976953][ T5945] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 813.983705][ T5941] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 814.000575][ T5945] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 814.008602][ T5945] usb 5-1: Product: syz [ 814.020700][ T5945] usb 5-1: Manufacturer: syz [ 814.030627][ T5945] usb 5-1: SerialNumber: syz [ 814.048529][T14808] wg0 speed is unknown, defaulting to 1000 [ 814.056659][T14808] wg0 speed is unknown, defaulting to 1000 [ 814.064902][T14808] wg0 speed is unknown, defaulting to 1000 [ 814.072245][ T973] usb 3-1: config 9 has an invalid interface number: 96 but max is 0 [ 814.085313][ T973] usb 3-1: config 9 has no interface number 0 [ 814.098957][ T973] usb 3-1: config 9 interface 96 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 814.126191][ T973] usb 3-1: config 9 interface 96 altsetting 2 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 814.178197][T14808] infiniband syz2: set active [ 814.183140][T14808] infiniband syz2: added wg0 [ 814.193309][ T43] wg0 speed is unknown, defaulting to 1000 [ 814.209919][ T5941] usb 2-1: Using ep0 maxpacket: 32 [ 814.244481][T14808] RDS/IB: syz2: added [ 814.249571][T14808] smc: adding ib device syz2 with port count 1 [ 814.256096][T14808] smc: ib device syz2 port 1 has pnetid SYZ2 (user defined) [ 814.266590][T14808] wg0 speed is unknown, defaulting to 1000 [ 814.277387][ T43] wg0 speed is unknown, defaulting to 1000 [ 814.413837][T14808] wg0 speed is unknown, defaulting to 1000 [ 814.508889][T14808] wg0 speed is unknown, defaulting to 1000 [ 814.604385][T14808] wg0 speed is unknown, defaulting to 1000 [ 814.698292][T14808] wg0 speed is unknown, defaulting to 1000 [ 814.856987][ T5941] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 814.880585][ T973] usb 3-1: config 9 interface 96 altsetting 2 has an invalid descriptor for endpoint zero, skipping [ 814.880949][ T5945] usb 5-1: 0:2 : does not exist [ 814.913852][ T5941] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 814.916732][ T5945] usb 5-1: USB disconnect, device number 68 [ 814.952995][ T973] usb 3-1: config 9 interface 96 has no altsetting 0 [ 814.984374][ T6209] udevd[6209]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 815.062240][ T5941] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 815.072735][ T5941] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 815.082165][ T973] usb 3-1: New USB device found, idVendor=0bfd, idProduct=000c, bcdDevice= 8.cf [ 815.100818][ T973] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 815.108968][ T973] usb 3-1: Product: syz [ 815.119111][ T973] usb 3-1: Manufacturer: syz [ 815.127866][ T5941] usb 2-1: config 0 descriptor?? [ 815.136680][ T973] usb 3-1: SerialNumber: syz [ 815.190961][T14819] input input176: cannot allocate more than FF_MAX_EFFECTS effects [ 815.603469][ T5941] hub 2-1:0.0: bad descriptor, ignoring hub [ 815.625657][ T973] kvaser_usb 3-1:9.96: error -ENODEV: Cannot get usb endpoint(s) [ 815.637797][ T5941] hub 2-1:0.0: probe with driver hub failed with error -5 [ 815.696459][ T5941] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 815.755232][ T30] audit: type=1400 audit(1751877446.582:903): avc: denied { read } for pid=14826 comm="syz.0.2162" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 815.804464][T14804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 815.845975][T14804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 816.097111][T14835] CIFS mount error: No usable UNC path provided in device string! [ 816.097111][T14835] [ 816.107434][T14835] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 816.567777][T14804] bridge5: entered promiscuous mode [ 816.639528][T14841] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2157'. [ 816.802763][ T5945] usb 2-1: USB disconnect, device number 71 [ 817.414503][T14849] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 817.539583][ T973] usb 3-1: USB disconnect, device number 82 [ 819.590878][ T973] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 819.820827][ T973] usb 3-1: Using ep0 maxpacket: 16 [ 819.828993][ T973] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 819.838317][ T973] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 819.912471][T14879] input input177: cannot allocate more than FF_MAX_EFFECTS effects [ 820.377476][ T973] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 820.396697][ T973] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 820.406332][ T973] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 820.415550][ T973] usb 3-1: Product: syz [ 820.421932][ T973] usb 3-1: Manufacturer: syz [ 820.430039][ T973] usb 3-1: SerialNumber: syz [ 820.705296][ T973] usb 3-1: 0:2 : does not exist [ 820.739127][ T973] usb 3-1: USB disconnect, device number 83 [ 820.850735][ T2147] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 821.010678][ T2147] usb 5-1: Using ep0 maxpacket: 16 [ 821.018161][ T2147] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 821.064781][ T2147] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 821.124951][ T2147] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 821.156416][ T2147] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 821.183532][ T2147] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 821.226316][ T2147] usb 5-1: config 0 descriptor?? [ 821.495933][T14893] netlink: 'syz.2.2178': attribute type 7 has an invalid length. [ 821.650824][ T5945] usb 4-1: new full-speed USB device number 66 using dummy_hcd [ 821.800743][T14900] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2181'. [ 821.823312][ T5945] usb 4-1: unable to get BOS descriptor or descriptor too short [ 821.892457][T14902] loop8: detected capacity change from 0 to 79 [ 821.937634][ T2147] HID 045e:07da: Invalid code 65791 type 1 [ 821.982098][ T5945] usb 4-1: not running at top speed; connect to a high speed hub [ 822.000475][ T2147] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.0092/input/input178 [ 822.017975][ T5945] usb 4-1: config 8 has an invalid interface number: 24 but max is 0 [ 822.032787][ T5945] usb 4-1: config 8 has no interface number 0 [ 822.053508][T14901] loop8: detected capacity change from 79 to 78 [ 822.270580][ T5945] usb 4-1: config 8 interface 24 altsetting 2 endpoint 0xE has invalid maxpacket 1535, setting to 64 [ 822.372039][ T2147] microsoft 0003:045E:07DA.0092: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 822.434366][ T5945] usb 4-1: config 8 interface 24 has no altsetting 0 [ 822.517957][ T5945] usb 4-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=75.af [ 822.552107][ T5945] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 822.599288][ T5945] usb 4-1: Product: syz [ 822.618657][ T5945] usb 4-1: Manufacturer: syz [ 822.634190][ T5945] usb 4-1: SerialNumber: syz [ 822.736411][T14891] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 823.343439][ T2147] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 823.522553][ T2147] usb 3-1: config index 0 descriptor too short (expected 126, got 72) [ 823.599616][ T2147] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 823.618808][ T2147] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 823.644627][ T2147] usb 3-1: Product: syz [ 823.648864][ T2147] usb 3-1: Manufacturer: syz [ 823.656153][ T2147] usb 3-1: SerialNumber: syz [ 823.669651][ T2147] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 823.720018][T10048] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 823.969029][T14924] CIFS mount error: No usable UNC path provided in device string! [ 823.969029][T14924] [ 823.979279][T14924] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 824.113350][ T43] usb 5-1: USB disconnect, device number 69 [ 824.635153][T14928] input input179: cannot allocate more than FF_MAX_EFFECTS effects [ 824.773954][ T5941] usb 3-1: USB disconnect, device number 84 [ 825.135266][T10048] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 825.142339][T10048] ath9k_htc: Failed to initialize the device [ 825.161242][ T5941] usb 3-1: ath9k_htc: USB layer deinitialized [ 825.408660][ T5945] comedi comedi5: driver 'vmk80xx' has successfully auto-configured 'K8055 (VM110)'. [ 825.523655][ T973] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 825.560138][ T5945] usb 4-1: USB disconnect, device number 66 [ 825.697793][T14937] can0: slcan on ttyS3. [ 826.366417][ T973] usb 1-1: Using ep0 maxpacket: 16 [ 826.452390][ T973] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 826.532558][ T973] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 826.570685][ T973] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 826.610658][T14933] can0 (unregistered): slcan off ttyS3. [ 826.702016][ T973] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 826.731598][ T973] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 826.739629][ T973] usb 1-1: Product: syz [ 826.782360][ T973] usb 1-1: Manufacturer: syz [ 826.786996][ T973] usb 1-1: SerialNumber: syz [ 827.057901][ T973] usb 1-1: 0:2 : does not exist [ 827.121997][ T973] usb 1-1: USB disconnect, device number 86 [ 827.253003][ T6209] udevd[6209]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 827.542220][ T5916] usb 5-1: new low-speed USB device number 70 using dummy_hcd [ 827.670565][ T5941] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 827.902863][T14970] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2196'. [ 827.940672][ T5916] usb 5-1: device descriptor read/64, error -71 [ 827.980648][ T5941] usb 4-1: Using ep0 maxpacket: 32 [ 828.066669][ T5941] usb 4-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8 [ 828.071957][T14978] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2198'. [ 828.076108][ T5941] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 828.094023][ T5941] usb 4-1: Product: syz [ 828.098271][ T5941] usb 4-1: Manufacturer: syz [ 828.106266][ T5941] usb 4-1: SerialNumber: syz [ 828.330865][ T5916] usb 5-1: new low-speed USB device number 71 using dummy_hcd [ 828.506845][ T5941] empeg 4-1:1.0: empeg converter detected [ 828.682640][ T5916] usb 5-1: device descriptor read/64, error -71 [ 828.744143][ T5941] usb 4-1: empeg converter now attached to ttyUSB0 [ 828.801467][ T5916] usb usb5-port1: attempt power cycle [ 829.211365][ T5916] usb 5-1: new low-speed USB device number 72 using dummy_hcd [ 829.242333][ T5916] usb 5-1: device descriptor read/8, error -71 [ 829.250628][ T30] audit: type=1400 audit(1751877460.072:904): avc: denied { create } for pid=14986 comm="syz.1.2199" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 829.270275][ C0] vkms_vblank_simulate: vblank timer overrun [ 829.530878][ T5916] usb 5-1: new low-speed USB device number 73 using dummy_hcd [ 829.628313][ T5916] usb 5-1: device descriptor read/8, error -71 [ 829.953471][ T5916] usb usb5-port1: unable to enumerate USB device [ 830.188300][ T30] audit: type=1326 audit(1751877461.012:905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15008 comm="syz.2.2202" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff712b8e929 code=0x0 [ 831.078111][T15019] lo speed is unknown, defaulting to 1000 [ 831.100124][T15019] wg0 speed is unknown, defaulting to 1000 [ 831.252601][T10048] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 831.423591][T10048] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 831.443671][T10048] usb 1-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 831.512306][T10048] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 831.565992][T10048] usb 1-1: config 0 descriptor?? [ 831.606241][T10048] hdpvr 1-1:0.0: Could not find bulk-in endpoint [ 831.625863][T10048] hdpvr 1-1:0.0: probe with driver hdpvr failed with error -12 [ 831.802275][T10048] usb 1-1: USB disconnect, device number 87 [ 831.838900][ T5916] usb 4-1: USB disconnect, device number 67 [ 831.855679][ T5916] empeg ttyUSB0: empeg converter now disconnected from ttyUSB0 [ 831.882120][ T5916] empeg 4-1:1.0: device disconnected [ 832.490887][ T5916] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 832.680663][ T5916] usb 4-1: Using ep0 maxpacket: 16 [ 832.722656][ T5916] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 832.741293][ T5916] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 832.963402][ T5916] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 833.006154][ T5916] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 833.021785][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 833.030017][ T5916] usb 4-1: Product: syz [ 833.034706][ T5916] usb 4-1: Manufacturer: syz [ 833.039374][ T5916] usb 4-1: SerialNumber: syz [ 834.226116][T15047] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.2211'. [ 834.355991][ T5916] usb 4-1: 0:2 : does not exist [ 834.431512][ T5916] usb 4-1: USB disconnect, device number 68 [ 834.501050][ T6209] udevd[6209]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 835.479480][ T2147] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 835.487228][T15062] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 835.591736][T15073] overlayfs: failed to resolve './file1': -2 [ 836.030634][ T2147] usb 3-1: Using ep0 maxpacket: 16 [ 836.044103][ T2147] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 836.080333][ T2147] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 836.096494][ T2147] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 836.157841][ T2147] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 836.169186][ T2147] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 836.260893][ T2147] usb 3-1: config 0 descriptor?? [ 836.764321][ T2147] HID 045e:07da: Invalid code 65791 type 1 [ 836.811542][ T2147] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0093/input/input180 [ 837.300960][ T2147] microsoft 0003:045E:07DA.0093: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 837.367706][ T5916] usb 3-1: USB disconnect, device number 85 [ 837.519578][T15093] fido_id[15093]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 839.144564][T15117] trusted_key: encrypted_key: insufficient parameters specified [ 839.698626][T15125] overlayfs: failed to resolve './file1': -2 [ 840.102073][T15129] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 840.508050][ T30] audit: type=1400 audit(1751877471.322:906): avc: denied { write } for pid=15132 comm="syz.2.2234" name="mouse0" dev="devtmpfs" ino=981 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 840.810710][ T43] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 841.063572][ T43] usb 3-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 841.426099][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 841.459126][ T43] usb 3-1: Product: syz [ 841.464710][ T43] usb 3-1: Manufacturer: syz [ 841.482048][ T43] usb 3-1: SerialNumber: syz [ 841.540827][ T43] r8152-cfgselector 3-1: Unknown version 0x0000 [ 841.560571][ T43] r8152-cfgselector 3-1: config 0 descriptor?? [ 841.972229][T15150] overlayfs: failed to resolve './file1': -2 [ 843.189477][T15167] CIFS mount error: No usable UNC path provided in device string! [ 843.189477][T15167] [ 843.199602][T15167] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 843.591095][T15168] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.2242'. [ 843.639773][ T43] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 843.913338][T10048] r8152-cfgselector 3-1: USB disconnect, device number 86 [ 844.560700][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 844.567564][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 844.578973][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 844.589355][ T43] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 844.602671][ T43] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 844.612086][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 844.635262][ T43] usb 2-1: config 0 descriptor?? [ 844.980691][ T5893] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 845.054672][ T43] HID 045e:07da: Invalid code 65791 type 1 [ 845.065669][ T43] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.0094/input/input181 [ 845.228983][T15190] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 845.403892][ T5893] usb 3-1: config 4 has an invalid interface number: 95 but max is 0 [ 845.552867][ T5893] usb 3-1: config 4 has no interface number 0 [ 845.559135][ T5893] usb 3-1: config 4 interface 95 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 845.571918][ T5893] usb 3-1: New USB device found, idVendor=7725, idProduct=b0a8, bcdDevice= 7.46 [ 845.581310][ T5893] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 845.594128][ T43] microsoft 0003:045E:07DA.0094: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 845.597222][ T5893] usb 3-1: Product: syz [ 845.621367][ T5893] usb 3-1: Manufacturer: syz [ 845.629805][ T5893] usb 3-1: SerialNumber: syz [ 845.904297][T15177] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 846.069265][ T43] usb 2-1: USB disconnect, device number 72 [ 846.191353][ T5893] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 846.198394][ T5893] usb 3-1: MIDIStreaming interface descriptor not found [ 847.048238][ T5893] usb 3-1: USB disconnect, device number 87 [ 847.691358][T15221] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.2253'. [ 848.486160][T10048] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 848.804644][T10048] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 848.860571][T10048] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 849.309530][T10048] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 849.380579][T10048] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 849.410169][T10048] usb 2-1: config 0 descriptor?? [ 850.095876][T10048] usbhid 2-1:0.0: can't add hid device: -32 [ 850.102246][T10048] usbhid 2-1:0.0: probe with driver usbhid failed with error -32 [ 850.627148][ T5893] usb 2-1: USB disconnect, device number 73 [ 851.250979][T10048] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 851.647248][T10048] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 7 [ 851.700543][T10048] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 9272, setting to 1024 [ 851.828033][T10048] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 852.040581][T10048] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 852.084247][T10048] usb 2-1: config 0 descriptor?? [ 852.803505][T15290] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 852.967317][T15291] lo speed is unknown, defaulting to 1000 [ 853.015468][T15291] wg0 speed is unknown, defaulting to 1000 [ 853.671195][T10048] ath6kl: Failed to submit usb control message: -110 [ 853.720218][T10048] ath6kl: unable to send the bmi data to the device: -110 [ 853.803888][T10048] ath6kl: Unable to send get target info: -110 [ 853.842583][T10048] ath6kl: Failed to init ath6kl core: -110 [ 853.917850][T10048] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 854.093930][T10048] usb 2-1: USB disconnect, device number 74 [ 854.165857][T15315] CIFS mount error: No usable UNC path provided in device string! [ 854.165857][T15315] [ 854.175957][T15315] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 854.471789][ T30] audit: type=1400 audit(1751877485.162:907): avc: denied { write } for pid=15313 comm="syz.0.2272" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=key permissive=1 [ 854.580648][T10048] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 854.790788][T10048] usb 2-1: Using ep0 maxpacket: 16 [ 854.805457][T10048] usb 2-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 854.824408][T10048] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 854.864714][T10048] usb 2-1: config 0 descriptor?? [ 854.865302][T15318] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 854.899217][T10048] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 858.737194][ T973] usb 2-1: USB disconnect, device number 75 [ 859.292970][ T973] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 859.854714][ T973] usb 2-1: Using ep0 maxpacket: 16 [ 859.890748][ T5941] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 859.906743][T15373] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 859.917604][ T973] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 859.959110][ T973] usb 2-1: config 0 interface 0 has no altsetting 0 [ 859.968907][ T973] usb 2-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 859.989453][ T973] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 860.016142][ T973] usb 2-1: Product: syz [ 860.325316][ T973] usb 2-1: Manufacturer: syz [ 860.335290][ T5941] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 52, changing to 7 [ 860.365965][ T973] usb 2-1: SerialNumber: syz [ 860.392509][ T973] usb 2-1: config 0 descriptor?? [ 860.397708][ T5941] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 9272, setting to 1024 [ 860.427178][ T5941] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 860.474408][ T5941] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.491310][ T5941] usb 1-1: config 0 descriptor?? [ 860.952521][T15385] PKCS7: Unknown OID: [4] 0.38.107.1697900.285475 [ 860.959128][T15385] PKCS7: Only support pkcs7_signedData type [ 861.283446][T15362] bond1: entered allmulticast mode [ 861.466143][T15395] program syz.2.2286 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 861.477562][ T5916] usb 2-1: USB disconnect, device number 76 [ 861.532436][ T5941] ath6kl: Failed to submit usb control message: -110 [ 861.545488][ T5941] ath6kl: unable to send the bmi data to the device: -110 [ 861.576581][ T5941] ath6kl: Unable to send get target info: -110 [ 861.630223][ T5941] ath6kl: Failed to init ath6kl core: -110 [ 861.655917][ T5941] ath6kl_usb 1-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 861.998723][ T24] usb 1-1: USB disconnect, device number 88 [ 862.171263][T15407] trusted_key: encrypted_key: insufficient parameters specified [ 863.148136][T15417] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 864.120632][ T973] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 864.370339][ T973] usb 3-1: Using ep0 maxpacket: 16 [ 864.379749][ T973] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 864.393510][ T973] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 864.404100][ T973] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 864.421660][ T973] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 864.434432][ T973] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 864.457306][ T973] usb 3-1: config 0 descriptor?? [ 864.958441][T15439] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.2296'. [ 864.988083][ T973] HID 045e:07da: Invalid code 65791 type 1 [ 865.017582][ T973] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0095/input/input182 [ 865.280227][ T973] microsoft 0003:045E:07DA.0095: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0 [ 865.323109][ T30] audit: type=1400 audit(1751877496.132:908): avc: denied { read } for pid=15441 comm="syz.1.2298" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 865.723306][T15453] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2299'. [ 866.174981][ T5900] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 866.345203][ T24] usb 3-1: USB disconnect, device number 88 [ 866.513315][ T5900] usb 4-1: Using ep0 maxpacket: 16 [ 866.542515][ T5900] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 866.723602][ T5900] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 866.734187][ T5900] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 866.745292][ T5900] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 867.114911][ T5900] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 867.137986][ T5900] usb 4-1: Product: syz [ 867.171504][ T5900] usb 4-1: Manufacturer: syz [ 867.241576][ T5900] usb 4-1: SerialNumber: syz [ 867.701836][ T5941] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 867.760446][ T5900] usb 4-1: 0:2 : does not exist [ 867.950631][ T5941] usb 1-1: Using ep0 maxpacket: 32 [ 868.430362][ T5900] usb 4-1: USB disconnect, device number 69 [ 868.705199][ T5941] usb 1-1: config 0 interface 0 has no altsetting 0 [ 868.722789][ T5941] usb 1-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 868.734931][ T5941] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 868.744023][ T5941] usb 1-1: Product: syz [ 868.750677][ T5941] usb 1-1: Manufacturer: syz [ 868.784286][ T5941] usb 1-1: SerialNumber: syz [ 868.912903][ T5941] usb 1-1: config 0 descriptor?? [ 869.413438][ T5941] gs_usb 1-1:0.0: Configuring for 1 interfaces [ 869.459975][T15484] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 869.798098][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.804482][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 869.859624][T15491] trusted_key: encrypted_key: insufficient parameters specified [ 869.891753][T15493] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2311'. [ 870.170572][ T24] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 870.239793][ T30] audit: type=1400 audit(1751877501.042:909): avc: denied { map } for pid=15494 comm="syz.1.2312" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 870.382269][ T30] audit: type=1400 audit(1751877501.042:910): avc: denied { execute } for pid=15494 comm="syz.1.2312" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 870.392261][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 870.486837][ T5941] gs_usb 1-1:0.0: Disabling termination support for channel 0 (-EPROTO) [ 870.509678][ T24] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 870.524570][ T24] usb 5-1: config 0 has no interface number 0 [ 870.533737][ T24] usb 5-1: config 0 interface 12 has no altsetting 0 [ 870.856534][ T24] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 870.871393][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 870.879592][ T24] usb 5-1: Product: syz [ 870.882587][ T5941] usb 1-1: USB disconnect, device number 89 [ 870.915745][ T24] usb 5-1: Manufacturer: syz [ 870.934719][ T24] usb 5-1: SerialNumber: syz [ 870.983238][ T24] usb 5-1: config 0 descriptor?? [ 871.580743][ T973] usb 4-1: new full-speed USB device number 70 using dummy_hcd [ 871.736844][T15512] trusted_key: encrypted_key: insufficient parameters specified [ 871.804047][ T973] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 871.814146][ T973] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 871.869903][ T973] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 872.075023][ T973] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 872.346953][ T973] usb 4-1: GET_CAPABILITIES returned 0 [ 872.354362][ T973] usbtmc 4-1:16.0: can't read capabilities [ 872.838612][ T30] audit: type=1400 audit(1751877503.652:911): avc: denied { accept } for pid=15487 comm="syz.4.2311" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 872.875631][ T24] f81534 5-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 872.899168][ T24] f81534 5-1:0.12: f81534_find_config_idx: read failed: -71 [ 872.907772][ T24] f81534 5-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 872.943479][ T24] f81534 5-1:0.12: probe with driver f81534 failed with error -71 [ 872.979890][ T24] usb 5-1: USB disconnect, device number 74 [ 873.184088][T10048] usb 4-1: USB disconnect, device number 70 [ 873.854698][ T30] audit: type=1326 audit(1751877504.682:912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15525 comm="syz.2.2319" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff712b8e929 code=0x0 [ 874.190731][ T24] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 874.215456][T15279] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 874.351539][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 874.361272][ T24] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 874.370349][ T24] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 874.392721][ T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 874.404130][T15279] usb 3-1: Using ep0 maxpacket: 32 [ 874.415338][T15279] usb 3-1: config 0 interface 0 has no altsetting 0 [ 874.426051][T15279] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 874.439431][T15279] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.449252][ T24] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 874.462384][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 874.512504][T15279] usb 3-1: Product: syz [ 874.528888][ T24] usb 1-1: Product: syz [ 874.533414][T15279] usb 3-1: Manufacturer: syz [ 874.538991][T15279] usb 3-1: SerialNumber: syz [ 874.545224][ T24] usb 1-1: Manufacturer: syz [ 874.549901][ T24] usb 1-1: SerialNumber: syz [ 874.739951][T15279] usb 3-1: config 0 descriptor?? [ 874.955031][ T24] usb 1-1: 0:2 : does not exist [ 875.016805][ T24] usb 1-1: USB disconnect, device number 90 [ 875.107549][ T5828] udevd[5828]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 875.218091][T15279] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 877.480040][T15577] trusted_key: encrypted_key: insufficient parameters specified [ 878.363214][T15586] can1: slcan on ttyS3. [ 878.459880][T15279] usb 3-1: USB disconnect, device number 89 [ 878.747619][ T30] audit: type=1400 audit(1751877509.552:913): avc: denied { append } for pid=15589 comm="syz.2.2332" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 878.812295][T15579] can1 (unregistered): slcan off ttyS3. [ 879.956212][T15606] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 880.409737][T15608] can0: slcan on ttyS3. [ 883.673378][T15599] can0 (unregistered): slcan off ttyS3. [ 884.270700][T15279] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 884.546857][T15279] usb 1-1: Using ep0 maxpacket: 16 [ 884.571868][T15279] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 885.133508][T15640] PKCS7: Unknown OID: [4] 0.38.107.1697900.285475 [ 885.269867][T15279] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 885.280108][T15279] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 885.291904][T15279] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 885.301127][T15279] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 885.309115][T15279] usb 1-1: Product: syz [ 885.317574][T15640] PKCS7: Only support pkcs7_signedData type [ 885.323561][T15279] usb 1-1: Manufacturer: syz [ 885.323582][T15279] usb 1-1: SerialNumber: syz [ 886.156319][T15279] usb 1-1: 0:2 : does not exist [ 886.226809][T15643] sctp: failed to load transform for md5: -2 [ 886.241502][T15279] usb 1-1: USB disconnect, device number 91 [ 886.385507][ T6209] udevd[6209]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 887.149777][T15664] can0: slcan on ttyS3. [ 887.761359][T15660] can0 (unregistered): slcan off ttyS3. [ 888.858631][T15674] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 890.284632][T15691] CIFS mount error: No usable UNC path provided in device string! [ 890.284632][T15691] [ 890.294826][T15691] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 891.430706][ T5941] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 891.613490][T15703] trusted_key: encrypted_key: insufficient parameters specified [ 891.801900][ T5941] usb 2-1: Using ep0 maxpacket: 16 [ 891.926953][ T5941] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 891.935793][ T5941] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 892.042905][T15707] hub 9-0:1.0: USB hub found [ 892.049682][T15707] hub 9-0:1.0: 1 port detected [ 892.410891][ T5941] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 892.438190][ T5941] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 892.449491][ T5941] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 892.458423][ T5941] usb 2-1: Product: syz [ 892.469571][ T5941] usb 2-1: Manufacturer: syz [ 892.475562][ T5941] usb 2-1: SerialNumber: syz [ 893.480955][ T5941] usb 2-1: 0:2 : does not exist [ 893.518878][ T5941] usb 2-1: USB disconnect, device number 77 [ 893.552219][ T6209] udevd[6209]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 893.617966][T15714] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2360'. [ 893.725100][T15718] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.2361'. [ 894.735010][ T30] audit: type=1400 audit(1751877525.562:914): avc: denied { mounton } for pid=15730 comm="syz.3.2365" path="/proc/1720/task" dev="proc" ino=49026 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 894.840251][T15733] overlayfs: failed to resolve './file1': -2 [ 896.498557][T15740] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 896.943256][T15743] trusted_key: encrypted_key: insufficient parameters specified [ 898.328693][ T30] audit: type=1400 audit(1751877529.152:915): avc: denied { bind } for pid=15759 comm="syz.1.2372" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 899.205599][T15764] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 899.289339][T15765] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2374'. [ 899.599746][T15772] CIFS mount error: No usable UNC path provided in device string! [ 899.599746][T15772] [ 899.609890][T15772] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 903.736308][T15803] trusted_key: encrypted_key: insufficient parameters specified [ 904.167318][T15809] netlink: 'syz.0.2385': attribute type 2 has an invalid length. [ 904.194366][T15809] netlink: 1184 bytes leftover after parsing attributes in process `syz.0.2385'. [ 904.471019][T15815] trusted_key: encrypted_key: insufficient parameters specified [ 905.211360][T15825] trusted_key: encrypted_key: insufficient parameters specified [ 907.362734][T15279] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 907.398405][T15831] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 907.924060][T15279] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 907.948448][T15279] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 908.148345][T15279] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 908.187463][T15279] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 908.368597][T15279] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 908.446959][T15867] input input183: cannot allocate more than FF_MAX_EFFECTS effects [ 908.857142][ T5941] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 908.871773][T15869] PKCS7: Unknown OID: [4] 0.38.107.1697900.285475 [ 908.878315][T15869] PKCS7: Only support pkcs7_signedData type [ 908.929838][T15279] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 908.948932][T15279] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 909.123719][ T5941] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 909.136413][T15279] usb 5-1: Product: syz [ 909.214316][ T5941] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 909.226695][T15279] usb 5-1: Manufacturer: syz [ 909.323068][ T5941] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 909.332857][ T5941] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 909.355679][ T5941] usb 3-1: config 0 descriptor?? [ 909.459242][T15876] input input184: cannot allocate more than FF_MAX_EFFECTS effects [ 909.877994][T15279] usb 5-1: can't set config #1, error -71 [ 909.888174][T15279] usb 5-1: USB disconnect, device number 75 [ 910.044980][T15878] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2404'. [ 910.738161][ T5941] cp2112 0003:10C4:EA90.0096: unknown main item tag 0x0 [ 910.756353][ T5941] cp2112 0003:10C4:EA90.0096: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.2-1/input0 [ 910.851067][ T5941] cp2112 0003:10C4:EA90.0096: Part Number: 0x82 Device Version: 0xFE [ 910.859694][ T5941] cp2112 0003:10C4:EA90.0096: error requesting SMBus config [ 910.899861][ T5941] cp2112 0003:10C4:EA90.0096: probe with driver cp2112 failed with error -5 [ 911.221631][T15889] PKCS7: Unknown OID: [4] 0.38.107.1697900.285475 [ 911.228116][T15889] PKCS7: Only support pkcs7_signedData type [ 911.468748][ T5916] usb 3-1: USB disconnect, device number 90 [ 911.897151][T15896] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 911.933061][T15898] FAULT_INJECTION: forcing a failure. [ 911.933061][T15898] name failslab, interval 1, probability 0, space 0, times 0 [ 911.945950][T15898] CPU: 0 UID: 0 PID: 15898 Comm: syz.0.2410 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 911.945965][T15898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 911.945972][T15898] Call Trace: [ 911.945976][T15898] [ 911.945980][T15898] dump_stack_lvl+0x16c/0x1f0 [ 911.946000][T15898] should_fail_ex+0x512/0x640 [ 911.946016][T15898] ? fs_reclaim_acquire+0xae/0x150 [ 911.946029][T15898] ? tomoyo_encode2+0x100/0x3e0 [ 911.946044][T15898] should_failslab+0xc2/0x120 [ 911.946060][T15898] __kmalloc_noprof+0xd2/0x510 [ 911.946078][T15898] tomoyo_encode2+0x100/0x3e0 [ 911.946095][T15898] tomoyo_encode+0x29/0x50 [ 911.946110][T15898] tomoyo_mount_acl+0x314/0x850 [ 911.946123][T15898] ? kernel_text_address+0x8d/0x100 [ 911.946137][T15898] ? __kernel_text_address+0xd/0x40 [ 911.946152][T15898] ? __pfx_tomoyo_mount_acl+0x10/0x10 [ 911.946170][T15898] ? stack_trace_save+0x8e/0xc0 [ 911.946196][T15898] ? tomoyo_domain+0xbb/0x150 [ 911.946206][T15898] ? tomoyo_profile+0x47/0x60 [ 911.946225][T15898] tomoyo_mount_permission+0x16d/0x420 [ 911.946240][T15898] ? tomoyo_mount_permission+0x14f/0x420 [ 911.946255][T15898] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 911.946278][T15898] security_sb_mount+0x9b/0x260 [ 911.946294][T15898] path_mount+0x128/0x2020 [ 911.946312][T15898] ? kmem_cache_free+0x2d1/0x4d0 [ 911.946326][T15898] ? __pfx_path_mount+0x10/0x10 [ 911.946345][T15898] ? putname+0x154/0x1a0 [ 911.946364][T15898] __x64_sys_mount+0x28d/0x310 [ 911.946381][T15898] ? __pfx___x64_sys_mount+0x10/0x10 [ 911.946403][T15898] do_syscall_64+0xcd/0x4c0 [ 911.946421][T15898] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 911.946432][T15898] RIP: 0033:0x7fd7e2b8e929 [ 911.946442][T15898] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 911.946453][T15898] RSP: 002b:00007fd7e39fe038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 911.946464][T15898] RAX: ffffffffffffffda RBX: 00007fd7e2db5fa0 RCX: 00007fd7e2b8e929 [ 911.946471][T15898] RDX: 0000200000002100 RSI: 00002000000020c0 RDI: 0000000000000000 [ 911.946478][T15898] RBP: 00007fd7e39fe090 R08: 0000200000002140 R09: 0000000000000000 [ 911.946485][T15898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 911.946492][T15898] R13: 0000000000000000 R14: 00007fd7e2db5fa0 R15: 00007fff6c43c8e8 [ 911.946506][T15898] [ 912.184905][ C0] vkms_vblank_simulate: vblank timer overrun [ 914.863668][T15912] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2416'. [ 914.906290][T15912] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2416'. [ 915.118291][T15925] syz.0.2421: attempt to access beyond end of device [ 915.118291][T15925] loop0: rw=0, sector=64, nr_sectors = 1 limit=0 [ 915.167802][T15925] syz.0.2421: attempt to access beyond end of device [ 915.167802][T15925] loop0: rw=0, sector=256, nr_sectors = 1 limit=0 [ 915.219442][T15925] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 915.351152][T15925] syz.0.2421: attempt to access beyond end of device [ 915.351152][T15925] loop0: rw=0, sector=512, nr_sectors = 1 limit=0 [ 915.392019][T15925] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 915.434253][T15925] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 915.448949][T15925] UDF-fs: Scanning with blocksize 512 failed [ 915.462939][T15925] syz.0.2421: attempt to access beyond end of device [ 915.462939][T15925] loop0: rw=0, sector=64, nr_sectors = 2 limit=0 [ 915.478688][T15925] syz.0.2421: attempt to access beyond end of device [ 915.478688][T15925] loop0: rw=0, sector=512, nr_sectors = 2 limit=0 [ 915.492406][T15925] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 915.503669][T15925] syz.0.2421: attempt to access beyond end of device [ 915.503669][T15925] loop0: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 915.837759][ T5916] usb 1-1: new full-speed USB device number 92 using dummy_hcd [ 915.890599][T15925] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 915.905418][T15925] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 915.915725][T15925] UDF-fs: Scanning with blocksize 1024 failed [ 915.942122][T15925] syz.0.2421: attempt to access beyond end of device [ 915.942122][T15925] loop0: rw=0, sector=64, nr_sectors = 4 limit=0 [ 915.955264][T15925] syz.0.2421: attempt to access beyond end of device [ 915.955264][T15925] loop0: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 915.972520][T15925] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 916.031648][T15925] syz.0.2421: attempt to access beyond end of device [ 916.031648][T15925] loop0: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 916.435365][T15925] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 916.476055][T15925] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 916.483900][T15925] UDF-fs: Scanning with blocksize 2048 failed [ 916.491063][T15925] syz.0.2421: attempt to access beyond end of device [ 916.491063][T15925] loop0: rw=0, sector=64, nr_sectors = 8 limit=0 [ 916.508700][T15925] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 916.518816][T15925] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=512, location=512 [ 916.528987][ T5916] usb 1-1: New USB device found, idVendor=0545, idProduct=808b, bcdDevice=31.ad [ 916.538258][ T5916] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 916.550691][T15925] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found [ 916.558353][T15925] UDF-fs: Scanning with blocksize 4096 failed [ 916.559561][ T5916] usb 1-1: config 0 descriptor?? [ 916.594553][ T5916] gspca_main: tv8532-2.14.0 probing 0545:808b [ 916.627185][T15925] UDF-fs: warning (device loop0): udf_fill_super: No partition found (1) [ 918.100641][ T5916] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 918.303416][ T5916] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 918.319764][ T5916] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 918.331347][ T5916] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 918.610121][ T5916] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 918.619751][ T5916] usb 4-1: Manufacturer: syz [ 918.637298][ T5916] usb 4-1: config 0 descriptor?? [ 918.720699][ T5916] rc_core: IR keymap rc-hauppauge not found [ 918.726802][ T5916] Registered IR keymap rc-empty [ 918.735187][ T5916] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 918.747701][ T5916] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input185 [ 918.870113][T10048] usb 1-1: USB disconnect, device number 92 [ 919.187294][T15971] rc rc0: two consecutive events of type space [ 919.547114][T15977] CIFS mount error: No usable UNC path provided in device string! [ 919.547114][T15977] [ 919.557256][T15977] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 921.128681][T15984] trusted_key: encrypted_key: insufficient parameters specified [ 921.649615][T10048] usb 4-1: USB disconnect, device number 71 [ 922.169621][T16002] input input186: cannot allocate more than FF_MAX_EFFECTS effects [ 922.306605][T10048] usb 1-1: new full-speed USB device number 93 using dummy_hcd [ 922.723771][ T30] audit: type=1400 audit(1751877553.552:916): avc: denied { ioctl } for pid=16006 comm="syz.2.2442" path="socket:[51526]" dev="sockfs" ino=51526 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 922.822180][T10048] usb 1-1: config index 0 descriptor too short (expected 13649, got 18) [ 922.852395][T10048] usb 1-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=a3.c0 [ 923.059869][T10048] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.068617][T10048] usb 1-1: Product: syz [ 923.073084][T10048] usb 1-1: Manufacturer: syz [ 923.077697][T10048] usb 1-1: SerialNumber: syz [ 923.508891][T16017] netlink: 'syz.4.2445': attribute type 2 has an invalid length. [ 923.842699][ T5916] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 924.373907][T16027] input: syz1 as /devices/virtual/input/input187 [ 924.398413][T10048] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 924.544670][T16033] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.2450'. [ 924.694984][T16027] input: failed to attach handler leds to device input187, error: -6 [ 924.734688][T10048] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 924.761677][T10048] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) error while loading driver (-19) [ 924.774403][ T5916] usb 3-1: Using ep0 maxpacket: 8 [ 924.789485][ T5916] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 924.790401][T10048] usb 1-1: USB disconnect, device number 93 [ 924.864982][ T5916] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 924.922512][T16039] trusted_key: encrypted_key: insufficient parameters specified [ 924.984456][ T30] audit: type=1400 audit(1751877555.782:917): avc: denied { read } for pid=16028 comm="syz.1.2448" name="usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 925.012698][ T30] audit: type=1400 audit(1751877555.782:918): avc: denied { open } for pid=16028 comm="syz.1.2448" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 925.277581][T16040] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2448'. [ 925.302635][ T5916] pvrusb2: Hardware description: Terratec Grabster AV400 [ 925.314860][T16040] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2448'. [ 925.378896][ T5916] pvrusb2: ********** [ 925.396218][ T5916] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 925.422265][ T5916] pvrusb2: Important functionality might not be entirely working. [ 925.430166][ T5916] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 925.446179][ T5916] pvrusb2: ********** [ 925.498175][ T2335] pvrusb2: Invalid write control endpoint [ 925.754998][T16047] trusted_key: encrypted_key: insufficient parameters specified [ 925.831944][T16015] pvrusb2: Invalid write control endpoint [ 926.135602][T16018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 926.153932][T16018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 926.391540][ T2335] pvrusb2: Invalid write control endpoint [ 926.414039][ T2335] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 926.460564][ T2335] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 926.520171][ T2335] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 926.574799][ T2335] pvrusb2: Device being rendered inoperable [ 926.593135][ T2335] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 926.807740][T16057] can0: slcan on ttyS3. [ 927.558231][ T24] usb 3-1: USB disconnect, device number 91 [ 927.560523][ T30] audit: type=1400 audit(1751877558.022:919): avc: denied { map } for pid=16054 comm="syz.3.2454" path="socket:[51568]" dev="sockfs" ino=51568 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 927.643624][ T2335] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 927.730839][T16052] can0 (unregistered): slcan off ttyS3. [ 927.738372][ T2335] pvrusb2: Attached sub-driver cx25840 [ 927.858290][ T2335] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 928.298435][T16068] trusted_key: encrypted_key: insufficient parameters specified [ 928.666020][ T2335] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 928.926626][T16073] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 929.430667][ T24] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 930.072772][ T24] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 930.081062][ T24] usb 3-1: config 0 has no interface number 0 [ 930.185215][ T24] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 930.894757][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 930.903568][ T24] usb 3-1: Product: syz [ 930.907749][ T24] usb 3-1: Manufacturer: syz [ 930.912724][ T24] usb 3-1: SerialNumber: syz [ 930.997103][ T24] usb 3-1: config 0 descriptor?? [ 931.200257][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.206763][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.289931][T16113] trusted_key: encrypted_key: insufficient parameters specified [ 931.449475][T16076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 931.489562][T16115] netlink: 212376 bytes leftover after parsing attributes in process `syz.4.2465'. [ 931.605016][T16076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 931.808495][ T24] usb 3-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 931.900135][ T24] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 931.970911][ T24] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 931.978989][ T24] usb 3-1: media controller created [ 932.085728][T16123] input: syz1 as /devices/virtual/input/input188 [ 932.354384][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 932.745402][T16133] can0: slcan on ttyS3. [ 933.259676][ T24] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 933.367734][ T24] usb 3-1: USB disconnect, device number 92 [ 933.595534][T16127] can0 (unregistered): slcan off ttyS3. [ 933.685527][T16141] overlayfs: missing 'lowerdir' [ 935.350669][ T5916] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 935.914585][T16163] o2cb: This node has not been configured. [ 935.920445][T16163] o2cb: Cluster check failed. Fix errors before retrying. [ 935.927661][T16163] (syz.0.2476,16163,1):user_dlm_register:674 ERROR: status = -22 [ 935.935487][T16163] (syz.0.2476,16163,1):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "file1" [ 936.384441][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 936.621540][ T5916] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 936.631579][ T5916] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 936.640773][ T5916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 936.672523][ T5916] usb 2-1: config 0 descriptor?? [ 936.884588][T16173] trusted_key: encrypted_key: insufficient parameters specified [ 937.445611][T16177] trusted_key: encrypted_key: insufficient parameters specified [ 937.790396][ T30] audit: type=1400 audit(1751877568.612:920): avc: denied { mount } for pid=16148 comm="syz.1.2473" name="/" dev="devpts" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 937.795532][T16183] input: syz1 as /devices/virtual/input/input189 [ 937.830749][T16183] input: failed to attach handler leds to device input189, error: -6 [ 937.870692][ T5916] uclogic 0003:256C:006D.0097: failed retrieving Huion firmware version: -71 [ 937.888115][ T5916] uclogic 0003:256C:006D.0097: failed probing parameters: -71 [ 937.897112][ T30] audit: type=1400 audit(1751877568.652:921): avc: denied { unmount } for pid=16148 comm="syz.1.2473" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:devpts_t tclass=filesystem permissive=1 [ 937.925864][ T5916] uclogic 0003:256C:006D.0097: probe with driver uclogic failed with error -71 [ 937.970806][ T5916] usb 2-1: USB disconnect, device number 78 [ 938.313863][T16194] CIFS mount error: No usable UNC path provided in device string! [ 938.313863][T16194] [ 938.324092][T16194] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 939.542282][T16207] can0: slcan on ttyS3. [ 940.152398][T16201] can0 (unregistered): slcan off ttyS3. [ 941.061747][T16231] trusted_key: encrypted_key: insufficient parameters specified [ 941.379743][T16235] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2495'. [ 944.695557][T16258] trusted_key: encrypted_key: insufficient parameters specified [ 945.103276][T16267] CIFS mount error: No usable UNC path provided in device string! [ 945.103276][T16267] [ 945.113551][T16267] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 945.588012][T16271] CIFS mount error: No usable UNC path provided in device string! [ 945.588012][T16271] [ 945.598177][T16271] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 946.027659][ T30] audit: type=1326 audit(1751877576.852:922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16272 comm="syz.4.2501" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x0 [ 946.312274][T16284] PKCS7: Unknown OID: [4] 0.38.107.1697900.285475 [ 946.406800][ T43] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 946.414998][T10048] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 946.423327][T16284] PKCS7: Only support pkcs7_signedData type [ 946.480548][ T24] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 946.567597][T16287] can0: slcan on ttyS3. [ 946.606508][T10048] usb 2-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 946.615927][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 946.622398][T10048] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.636176][ T43] usb 5-1: config 0 interface 0 has no altsetting 0 [ 946.670701][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 946.882310][ T24] usb 1-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 946.903981][T10048] usb 2-1: config 0 descriptor?? [ 946.911670][ T43] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 946.929093][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 946.942159][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 946.967468][ T43] usb 5-1: Product: syz [ 946.981953][ T43] usb 5-1: Manufacturer: syz [ 946.987755][ T24] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 946.997318][ T43] usb 5-1: SerialNumber: syz [ 947.022817][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 947.034250][ T43] usb 5-1: config 0 descriptor?? [ 947.077473][ T24] usb 1-1: config 0 descriptor?? [ 947.133220][T10048] hackrf 2-1:0.0: usb_control_msg() failed -71 request 0e [ 947.163163][T10048] hackrf 2-1:0.0: Could not detect board [ 947.177272][ T24] hub 1-1:0.0: bad descriptor, ignoring hub [ 947.206586][T10048] hackrf 2-1:0.0: probe with driver hackrf failed with error -71 [ 947.219649][T16282] can0 (unregistered): slcan off ttyS3. [ 947.225801][ T24] hub 1-1:0.0: probe with driver hub failed with error -5 [ 947.296924][ T24] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 947.304704][T10048] usb 2-1: USB disconnect, device number 79 [ 947.329877][T16279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 947.338588][T16279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 947.471875][ T24] usb 1-1: USB disconnect, device number 94 [ 947.493573][ T43] gs_usb 5-1:0.0: Configuring for 44 interfaces [ 947.500014][ T43] gs_usb 5-1:0.0: Driver cannot handle more that 3 CAN interfaces [ 947.554665][ T43] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -22 [ 948.449974][ T5941] usb 5-1: USB disconnect, device number 76 [ 948.458807][T16314] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 948.581195][T16314] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 949.794138][T16332] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2511'. [ 950.405576][ T30] audit: type=1400 audit(1751877581.232:923): avc: denied { read } for pid=16341 comm="syz.2.2513" name="file0" dev="tmpfs" ino=2626 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 950.607410][ T5893] usb 1-1: new high-speed USB device number 95 using dummy_hcd [ 950.628464][ T30] audit: type=1400 audit(1751877581.232:924): avc: denied { open } for pid=16341 comm="syz.2.2513" path="/487/file0" dev="tmpfs" ino=2626 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 951.058845][ T5893] usb 1-1: New USB device found, idVendor=1645, idProduct=0008, bcdDevice=cf.36 [ 951.077660][ T5893] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 951.114359][ T5893] usb 1-1: config 0 descriptor?? [ 951.377894][ T5893] kaweth 1-1:0.0: Firmware present in device. [ 951.563368][ T5893] kaweth 1-1:0.0: Statistics collection: 0 [ 951.598625][ T5893] kaweth 1-1:0.0: Multicast filter limit: 0 [ 951.674757][ T5893] kaweth 1-1:0.0: MTU: 0 [ 951.706566][ T5893] kaweth 1-1:0.0: Read MAC address 00:00:00:00:00:00 [ 952.243993][ T30] audit: type=1326 audit(1751877582.972:925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 952.371811][ T30] audit: type=1326 audit(1751877582.972:926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 952.426308][ T30] audit: type=1326 audit(1751877582.982:927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 952.455394][T16369] trusted_key: encrypted_key: insufficient parameters specified [ 952.468034][ T30] audit: type=1326 audit(1751877582.982:928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 953.065365][ T30] audit: type=1326 audit(1751877582.982:929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 953.153532][ T5916] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 953.251910][ T30] audit: type=1326 audit(1751877582.982:930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 953.321767][ T5916] usb 2-1: Using ep0 maxpacket: 32 [ 953.328910][ T5916] usb 2-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 953.340382][ T5916] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 953.365455][ T5916] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 953.396017][ T30] audit: type=1326 audit(1751877582.992:931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 953.420120][ T5916] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 953.456171][ T5916] usb 2-1: config 0 descriptor?? [ 953.475748][ T5916] hub 2-1:0.0: bad descriptor, ignoring hub [ 953.503547][ T5916] hub 2-1:0.0: probe with driver hub failed with error -5 [ 953.534153][ T5916] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 953.560009][ T30] audit: type=1326 audit(1751877582.992:932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 953.640256][ T30] audit: type=1326 audit(1751877582.992:933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 953.674376][ T30] audit: type=1326 audit(1751877582.992:934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16359 comm="syz.2.2517" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7ff712b8e929 code=0x7ffc0000 [ 953.705690][T16372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 953.719198][T16372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 953.930902][T10048] usb 2-1: USB disconnect, device number 80 [ 954.113342][T16380] nbd0: detected capacity change from 0 to 127 [ 954.149060][ T5893] kaweth 1-1:0.0: probe with driver kaweth failed with error -5 [ 954.174297][ T5893] usb 1-1: USB disconnect, device number 95 [ 954.650584][T16383] block nbd0: Receive control failed (result -104) [ 954.651555][T16379] block nbd3: shutting down sockets [ 956.000551][ T5893] usb 1-1: new high-speed USB device number 96 using dummy_hcd [ 956.191705][T16410] input input190: cannot allocate more than FF_MAX_EFFECTS effects [ 956.630529][ T5893] usb 1-1: Using ep0 maxpacket: 16 [ 956.943774][ T5893] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 956.952951][ T5893] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 956.963147][ T5893] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 956.974612][ T5893] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 956.984105][ T5893] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 956.992329][ T5893] usb 1-1: Product: syz [ 956.996735][ T5893] usb 1-1: Manufacturer: syz [ 957.001733][ T5893] usb 1-1: SerialNumber: syz [ 957.787484][T16425] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 957.824305][ T5893] usb 1-1: 0:2 : does not exist [ 958.253846][ T5893] usb 1-1: USB disconnect, device number 96 [ 958.295830][ T5828] udevd[5828]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 958.330675][ T24] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 958.520849][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 958.529358][ T24] usb 4-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 958.546068][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 958.793328][ T24] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 958.802606][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 958.873355][ T24] usb 4-1: config 0 descriptor?? [ 958.880664][ T24] hub 4-1:0.0: bad descriptor, ignoring hub [ 958.986451][ T24] hub 4-1:0.0: probe with driver hub failed with error -5 [ 959.257281][T16426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 959.266246][T16426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 959.275445][ T24] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 959.287570][T16437] FAULT_INJECTION: forcing a failure. [ 959.287570][T16437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 959.301182][T16437] CPU: 1 UID: 0 PID: 16437 Comm: syz.4.2537 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 959.301209][T16437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 959.301220][T16437] Call Trace: [ 959.301227][T16437] [ 959.301234][T16437] dump_stack_lvl+0x16c/0x1f0 [ 959.301264][T16437] should_fail_ex+0x512/0x640 [ 959.301292][T16437] strncpy_from_user+0x3b/0x2e0 [ 959.301323][T16437] getname_flags.part.0+0x8f/0x550 [ 959.301347][T16437] __x64_sys_mkdir+0xd8/0x140 [ 959.301372][T16437] do_syscall_64+0xcd/0x4c0 [ 959.301400][T16437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 959.301418][T16437] RIP: 0033:0x7fd7fbd8e929 [ 959.301434][T16437] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 959.301450][T16437] RSP: 002b:00007fd7fcce0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 959.301468][T16437] RAX: ffffffffffffffda RBX: 00007fd7fbfb5fa0 RCX: 00007fd7fbd8e929 [ 959.301480][T16437] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000300 [ 959.301491][T16437] RBP: 00007fd7fcce0090 R08: 0000000000000000 R09: 0000000000000000 [ 959.301502][T16437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 959.301513][T16437] R13: 0000000000000000 R14: 00007fd7fbfb5fa0 R15: 00007ffdadcb0038 [ 959.301538][T16437] [ 959.461977][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 959.461995][ T30] audit: type=1400 audit(1751877590.282:941): avc: denied { watch watch_reads } for pid=16436 comm="syz.4.2537" path="/530/file1" dev="autofs" ino=53295 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=dir permissive=1 [ 959.522130][ T24] usb 4-1: USB disconnect, device number 72 [ 959.721400][T16438] sctp: failed to load transform for md5: -2 [ 959.749916][ T30] audit: type=1400 audit(1751877590.462:942): avc: denied { accept } for pid=16442 comm="syz.0.2538" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 960.476563][ T30] audit: type=1326 audit(1751877591.262:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16448 comm="syz.4.2540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 960.523667][T16455] trusted_key: encrypted_key: insufficient parameters specified [ 960.566254][ T30] audit: type=1326 audit(1751877591.262:944): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16448 comm="syz.4.2540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 960.596273][ T30] audit: type=1326 audit(1751877591.272:945): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16448 comm="syz.4.2540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 960.857057][ T30] audit: type=1326 audit(1751877591.272:946): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16448 comm="syz.4.2540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 960.881809][ T30] audit: type=1326 audit(1751877591.272:947): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16448 comm="syz.4.2540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 960.978077][T10048] usb 1-1: new high-speed USB device number 97 using dummy_hcd [ 961.410750][ T30] audit: type=1326 audit(1751877591.272:948): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16448 comm="syz.4.2540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 961.438654][ T30] audit: type=1326 audit(1751877591.272:949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16448 comm="syz.4.2540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 961.580617][T10048] usb 1-1: Using ep0 maxpacket: 16 [ 961.594205][T10048] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 961.604934][ T30] audit: type=1326 audit(1751877591.282:950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16448 comm="syz.4.2540" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 961.682702][T10048] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 961.700660][T10048] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 961.958885][T10048] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 962.021268][T10048] usb 1-1: config 0 descriptor?? [ 964.597643][T16492] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.2548'. [ 965.115975][ T24] usb 5-1: new full-speed USB device number 77 using dummy_hcd [ 965.302638][ T5893] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 965.312082][ T24] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 965.322095][ T24] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 965.343738][ T24] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 965.353372][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 965.464514][ T5893] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 965.474324][ T5893] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 965.483462][ T5893] usb 3-1: Product: syz [ 965.494718][ T5893] usb 3-1: Manufacturer: syz [ 965.500068][ T5893] usb 3-1: SerialNumber: syz [ 965.607702][ T24] usb 5-1: GET_CAPABILITIES returned 0 [ 965.607955][ T5893] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 965.628394][ T24] usbtmc 5-1:16.0: can't read capabilities [ 965.867654][ T5916] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 965.896737][ T5941] usb 1-1: USB disconnect, device number 97 [ 966.077240][ C0] usb 3-1: ath: unknown panic pattern! [ 966.705908][T16521] lo speed is unknown, defaulting to 1000 [ 966.712862][T16521] wg0 speed is unknown, defaulting to 1000 [ 967.751279][ T5916] usb 3-1: Service connection timeout for: 256 [ 967.853703][ T5916] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 968.174897][ T24] usb 5-1: USB disconnect, device number 77 [ 968.830687][ T5941] usb 3-1: USB disconnect, device number 93 [ 968.971665][ T5916] ath9k_htc: Failed to initialize the device [ 969.030896][ T5941] usb 3-1: ath9k_htc: USB layer deinitialized [ 969.893709][T16566] trusted_key: encrypted_key: insufficient parameters specified [ 970.509235][T16574] pimreg: entered allmulticast mode [ 970.649619][T16574] netlink: 'syz.2.2563': attribute type 15 has an invalid length. [ 970.675196][T16574] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2563'. [ 970.714780][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 970.714798][ T30] audit: type=1400 audit(1751877601.542:961): avc: denied { accept } for pid=16573 comm="syz.2.2563" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 970.715091][T16574] sctp: [Deprecated]: syz.2.2563 (pid 16574) Use of int in max_burst socket option. [ 970.715091][T16574] Use struct sctp_assoc_value instead [ 971.129303][ T43] usb 1-1: new high-speed USB device number 98 using dummy_hcd [ 971.170706][ T5941] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 971.270270][T16589] trusted_key: encrypted_key: insufficient parameters specified [ 971.280797][ T43] usb 1-1: Using ep0 maxpacket: 16 [ 971.282815][ T43] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 971.339254][ T43] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 971.387372][ T43] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 971.491821][ T5941] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 971.506094][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 971.506529][ T5941] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 971.539453][ T5941] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 971.591081][ T43] usb 1-1: config 0 descriptor?? [ 971.623909][ T5941] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 971.825216][ T5941] usb 2-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 971.958254][ T5941] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.978383][ T5941] usb 2-1: Product: syz [ 971.987048][ T5941] usb 2-1: Manufacturer: syz [ 972.006833][ T5941] usb 2-1: SerialNumber: syz [ 972.127459][ T5941] usb 2-1: config 0 descriptor?? [ 972.168168][ T5941] ums-isd200 2-1:0.0: USB Mass Storage device detected [ 972.405092][T16602] policy can only be matched on NF_INET_PRE_ROUTING [ 972.405113][T16602] unable to load match [ 972.529851][T16602] trusted_key: encrypted_key: insufficient parameters specified [ 974.422565][ T43] usb 1-1: USB disconnect, device number 98 [ 974.461671][ T5941] scsi host1: usb-storage 2-1:0.0 [ 974.580180][ T5941] usb 2-1: USB disconnect, device number 81 [ 974.732477][T16623] trusted_key: encrypted_key: insufficient parameters specified [ 975.500713][ T5893] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 976.055975][T16635] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2579'. [ 976.110562][ T5893] usb 3-1: Using ep0 maxpacket: 32 [ 976.124179][ T5893] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 976.142116][T16635] smc: removing ib device syz2 [ 976.161758][ T5893] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 976.175485][ T30] audit: type=1400 audit(1751877607.002:962): avc: denied { getopt } for pid=16634 comm="syz.3.2579" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 976.184053][ T5893] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 976.212757][ T5893] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 976.251682][ T5893] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 976.267651][ T5893] usb 3-1: config 0 descriptor?? [ 976.306812][T16642] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2581'. [ 976.316613][T16519] usb 1-1: new high-speed USB device number 99 using dummy_hcd [ 976.480054][T16519] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 977.096318][T16627] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 977.110303][T16519] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 977.343771][ T5893] hub 3-1:0.0: USB hub found [ 977.349151][T16519] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 977.387880][T16519] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 977.459523][T16519] usb 1-1: config 0 descriptor?? [ 977.549056][ T5893] hub 3-1:0.0: 2 ports detected [ 978.116755][T16519] usbhid 1-1:0.0: can't add hid device: -71 [ 978.122895][T16519] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 978.146973][T16519] usb 1-1: USB disconnect, device number 99 [ 979.903636][ T5893] usb 3-1: USB disconnect, device number 94 [ 980.738464][T16678] CIFS mount error: No usable UNC path provided in device string! [ 980.738464][T16678] [ 980.748584][T16678] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 980.889034][T16680] CIFS mount error: No usable UNC path provided in device string! [ 980.889034][T16680] [ 980.899244][T16680] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 981.005333][ T30] audit: type=1326 audit(1751877611.822:963): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16673 comm="syz.4.2590" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x0 [ 981.125586][T16677] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 981.410554][T16519] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 981.559023][T16686] bio_check_eod: 2 callbacks suppressed [ 981.559041][T16686] syz.2.2593: attempt to access beyond end of device [ 981.559041][T16686] nbd2: rw=0, sector=2, nr_sectors = 2 limit=0 [ 981.584349][T16686] MINIX-fs: unable to read superblock [ 981.588842][T16687] lo speed is unknown, defaulting to 1000 [ 981.640626][T16519] usb 5-1: Using ep0 maxpacket: 32 [ 981.774459][T16519] usb 5-1: config 0 interface 0 has no altsetting 0 [ 981.882057][T16519] usb 5-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 981.906407][T16519] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.934870][T16519] usb 5-1: Product: syz [ 981.946136][T16519] usb 5-1: Manufacturer: syz [ 981.972227][ T3461] Bluetooth: (null): Invalid header checksum [ 982.260638][T16519] usb 5-1: SerialNumber: syz [ 982.288993][T16519] usb 5-1: config 0 descriptor?? [ 982.304298][ T3461] Bluetooth: (null): Invalid header checksum [ 982.450685][ T3461] Bluetooth: (null): Invalid header checksum [ 982.457478][ T3461] Bluetooth: (null): Invalid header checksum [ 982.723787][T16519] gs_usb 5-1:0.0: Configuring for 44 interfaces [ 982.731751][T16519] gs_usb 5-1:0.0: Driver cannot handle more that 3 CAN interfaces [ 982.748061][T16519] gs_usb 5-1:0.0: probe with driver gs_usb failed with error -22 [ 984.240739][T16707] trusted_key: encrypted_key: insufficient parameters specified [ 984.418743][T13510] block nbd0: Possible stuck request ffff888026cf0000: control (read@0,1024B). Runtime 30 seconds [ 984.422089][T16697] syzkaller1: entered promiscuous mode [ 984.430313][T13510] block nbd0: Possible stuck request ffff888026cf01c0: control (read@1024,1024B). Runtime 30 seconds [ 984.469852][T13510] block nbd0: Possible stuck request ffff888026cf0380: control (read@2048,1024B). Runtime 30 seconds [ 984.480932][T13510] block nbd0: Possible stuck request ffff888026cf0540: control (read@3072,1024B). Runtime 30 seconds [ 984.500962][ T43] usb 5-1: USB disconnect, device number 78 [ 984.872419][T16697] syzkaller1: entered allmulticast mode [ 985.436874][T16727] CIFS mount error: No usable UNC path provided in device string! [ 985.436874][T16727] [ 985.447013][T16727] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 985.936200][T16724] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.2603'. [ 986.428492][T16733] netlink: 4400 bytes leftover after parsing attributes in process `syz.0.2606'. [ 986.505557][T16735] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 986.520926][T16733] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ç`]Š •Iöq¯!¾>Ýsó³Îú*Š®!)\Ç+` [ 988.422801][T16758] trusted_key: encrypted_key: insufficient parameters specified [ 989.605490][T16752] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 990.954811][ T30] audit: type=1326 audit(1751877621.782:964): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 991.102138][ T30] audit: type=1326 audit(1751877621.782:965): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 991.610943][ T30] audit: type=1326 audit(1751877621.802:966): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=132 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 991.681678][T16779] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2615'. [ 992.340610][ T30] audit: type=1326 audit(1751877621.802:967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 992.364354][ T30] audit: type=1326 audit(1751877621.802:968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 992.388865][ T30] audit: type=1326 audit(1751877621.802:969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 992.420577][ T30] audit: type=1326 audit(1751877621.892:970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 992.450533][ T30] audit: type=1326 audit(1751877621.892:971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 992.474384][ T30] audit: type=1326 audit(1751877621.912:972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 992.544537][ T30] audit: type=1326 audit(1751877621.912:973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16773 comm="syz.4.2618" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7fbd8e929 code=0x7ffc0000 [ 992.638274][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.884630][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.682560][T16791] trusted_key: encrypted_key: insufficient parameters specified [ 994.050714][T16797] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 995.523201][T16807] overlayfs: missing 'lowerdir' [ 995.557681][T16807] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 995.909640][T16822] trusted_key: encrypted_key: insufficient parameters specified [ 996.740857][T16831] trusted_key: encrypted_key: insufficient parameters specified [ 1001.230372][T16873] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.2642'. [ 1001.410963][ T43] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1001.632383][ T43] usb 4-1: Using ep0 maxpacket: 32 [ 1002.015166][ T43] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1002.039954][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1002.120486][ T43] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1002.182582][ T43] usb 4-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1002.190593][ T973] usb 1-1: new high-speed USB device number 100 using dummy_hcd [ 1002.192031][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.230142][ T43] usb 4-1: config 0 descriptor?? [ 1002.237124][T16869] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1002.262528][ T43] hub 4-1:0.0: USB hub found [ 1002.410713][ T973] usb 1-1: Using ep0 maxpacket: 32 [ 1002.423093][ T973] usb 1-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 1002.441570][ T973] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1002.462581][ T973] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1002.475336][ T973] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.508218][T16885] input input191: cannot allocate more than FF_MAX_EFFECTS effects [ 1002.626518][ T973] usb 1-1: config 0 descriptor?? [ 1002.743401][ T973] hub 1-1:0.0: bad descriptor, ignoring hub [ 1002.789326][ T973] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1002.915195][ T43] hub 4-1:0.0: 2 ports detected [ 1002.923321][ T973] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1002.945023][T16877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1002.963819][T16877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1003.086825][T16877] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2643'. [ 1003.470856][T10048] usb 1-1: USB disconnect, device number 100 [ 1003.560584][ T973] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1003.863229][ T973] usb 5-1: Using ep0 maxpacket: 32 [ 1003.966721][ T973] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1004.006978][ T973] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1004.039415][ T973] usb 5-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8 [ 1004.065910][ T973] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1004.089335][ T973] usb 5-1: Product: syz [ 1004.097669][ T973] usb 5-1: Manufacturer: syz [ 1004.104520][ T973] usb 5-1: SerialNumber: syz [ 1004.718975][T16905] overlayfs: missing 'workdir' [ 1004.728920][T16905] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1004.892303][ T43] hub 4-1:0.0: hub_ext_port_status failed (err = -71) [ 1004.892532][ T973] usb 4-1: USB disconnect, device number 73 [ 1007.442667][ T973] usb 5-1: USB disconnect, device number 79 [ 1007.505864][T16931] CIFS mount error: No usable UNC path provided in device string! [ 1007.505864][T16931] [ 1007.515987][T16931] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1009.259562][T16944] input input192: cannot allocate more than FF_MAX_EFFECTS effects [ 1009.956318][T16955] overlay: filesystem on ./bus not supported as upperdir [ 1010.029359][T16949] trusted_key: encrypted_key: insufficient parameters specified [ 1010.382752][T16966] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.2663'. [ 1013.972209][T16999] trusted_key: encrypted_key: insufficient parameters specified [ 1014.404247][T17004] overlay: filesystem on ./bus not supported as upperdir [ 1015.053742][T16973] block nbd0: Possible stuck request ffff888026cf0000: control (read@0,1024B). Runtime 60 seconds [ 1015.065091][T16973] block nbd0: Possible stuck request ffff888026cf01c0: control (read@1024,1024B). Runtime 60 seconds [ 1015.077582][T16973] block nbd0: Possible stuck request ffff888026cf0380: control (read@2048,1024B). Runtime 60 seconds [ 1015.088756][T16973] block nbd0: Possible stuck request ffff888026cf0540: control (read@3072,1024B). Runtime 60 seconds [ 1016.190571][T16519] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1016.389589][T17036] CIFS mount error: No usable UNC path provided in device string! [ 1016.389589][T17036] [ 1016.399827][T17036] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1016.747727][T17032] trusted_key: encrypted_key: insufficient parameters specified [ 1017.281083][T16519] usb 5-1: Using ep0 maxpacket: 8 [ 1017.333237][T16519] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1017.721121][T16519] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1018.278679][T16519] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1018.399044][T17048] trusted_key: encrypted_key: insufficient parameters specified [ 1018.562183][T16519] pvrusb2: ********** [ 1018.698979][T16519] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1018.740931][T16519] pvrusb2: Important functionality might not be entirely working. [ 1018.781085][T16519] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1019.074646][T16519] pvrusb2: ********** [ 1019.184951][ T2335] pvrusb2: Invalid write control endpoint [ 1019.287686][T17022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1019.296292][T17022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1019.427502][T17057] overlay: filesystem on ./bus not supported as upperdir [ 1019.452614][ T2335] pvrusb2: Invalid write control endpoint [ 1019.465574][ T2335] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1019.475243][ T2335] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1019.482920][ T2335] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1019.493217][ T2335] pvrusb2: Device being rendered inoperable [ 1019.499248][ T2335] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1019.506549][ T2335] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 1019.631436][ T2335] pvrusb2: Attached sub-driver cx25840 [ 1019.637032][ T2335] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1019.647517][ T2335] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1019.999914][T17064] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2686'. [ 1020.408876][ T5893] usb 5-1: USB disconnect, device number 80 [ 1020.534820][T17069] can0: slcan on ttyS3. [ 1021.323264][T17066] can0 (unregistered): slcan off ttyS3. [ 1021.569283][T17080] CIFS mount error: No usable UNC path provided in device string! [ 1021.569283][T17080] [ 1021.579415][T17080] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1021.782967][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 1021.782983][ T30] audit: type=1400 audit(1751877652.612:981): avc: denied { ioctl } for pid=17089 comm="syz.0.2692" path="socket:[55210]" dev="sockfs" ino=55210 ioctlcmd=0x8918 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1021.885520][T17090] netlink: 'syz.0.2692': attribute type 1 has an invalid length. [ 1021.925025][T17090] netlink: 'syz.0.2692': attribute type 1 has an invalid length. [ 1021.933263][T17090] netlink: 'syz.0.2692': attribute type 2 has an invalid length. [ 1021.943893][T17090] netlink: 'syz.0.2692': attribute type 1 has an invalid length. [ 1022.661646][T17090] netlink: 'syz.0.2692': attribute type 2 has an invalid length. [ 1023.350465][ C1] ================================================================== [ 1023.354201][T17117] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1023.358543][ C1] BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x45a/0x4d0 [ 1023.358578][ C1] Read of size 2 at addr ffff88803246202a by task rm/17107 [ 1023.358592][ C1] [ 1023.358602][ C1] CPU: 1 UID: 0 PID: 17107 Comm: rm Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 1023.358622][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1023.358632][ C1] Call Trace: [ 1023.358639][ C1] [ 1023.358647][ C1] dump_stack_lvl+0x116/0x1f0 [ 1023.358670][ C1] print_report+0xcd/0x680 [ 1023.358693][ C1] ? __virt_addr_valid+0x81/0x610 [ 1023.358713][ C1] ? __phys_addr+0xe8/0x180 [ 1023.358732][ C1] ? rose_timer_expiry+0x45a/0x4d0 [ 1023.358751][ C1] kasan_report+0xe0/0x110 [ 1023.358773][ C1] ? rose_timer_expiry+0x45a/0x4d0 [ 1023.358795][ C1] rose_timer_expiry+0x45a/0x4d0 [ 1023.358817][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 1023.358837][ C1] call_timer_fn+0x197/0x620 [ 1023.358860][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1023.358885][ C1] ? mark_held_locks+0x49/0x80 [ 1023.358909][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 1023.358931][ C1] __run_timers+0x6ef/0x960 [ 1023.358957][ C1] ? __pfx___run_timers+0x10/0x10 [ 1023.358988][ C1] run_timer_base+0x114/0x190 [ 1023.359011][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 1023.359036][ C1] run_timer_softirq+0x1a/0x40 [ 1023.359058][ C1] handle_softirqs+0x219/0x8e0 [ 1023.359079][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 1023.359101][ C1] __irq_exit_rcu+0x109/0x170 [ 1023.359120][ C1] irq_exit_rcu+0x9/0x30 [ 1023.359138][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1023.359160][ C1] [ 1023.359166][ C1] [ 1023.359172][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1023.359192][ C1] RIP: 0010:kmem_cache_free+0x12f/0x4d0 [ 1023.359213][ C1] Code: 00 48 8b 55 08 48 89 de 4c 89 e7 e8 fb 94 0a 00 84 c0 75 54 44 89 e9 81 e1 00 02 00 00 0f 84 89 01 00 00 48 8b 3d e9 fd db 0b 18 00 00 00 be 00 28 00 00 89 4c 24 18 e8 ee be ff ff 8b 4c 24 [ 1023.359229][ C1] RSP: 0018:ffffc9000403f9c0 EFLAGS: 00000206 [ 1023.359243][ C1] RAX: 0000000000000000 RBX: ffff888043a18dd0 RCX: 0000000000000200 [ 1023.359255][ C1] RDX: 0000000000000001 RSI: ffff888043a18dd0 RDI: ffff88801b841780 [ 1023.359266][ C1] RBP: ffffc9000403fa20 R08: 0000000000000110 R09: 0000000000000000 [ 1023.359276][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88814040a140 [ 1023.359287][ C1] R13: 000000000021a300 R14: ffffea00010e8600 R15: 0000000000000000 [ 1023.359304][ C1] ? __pfx___might_resched+0x10/0x10 [ 1023.359323][ C1] ? __put_anon_vma+0x114/0x3a0 [ 1023.359345][ C1] __put_anon_vma+0x114/0x3a0 [ 1023.359364][ C1] unlink_anon_vmas+0x58a/0x820 [ 1023.359389][ C1] free_pgtables+0x373/0xcb0 [ 1023.359415][ C1] ? __pfx_free_pgtables+0x10/0x10 [ 1023.359437][ C1] ? mas_next_slot+0x12d3/0x21b0 [ 1023.359462][ C1] ? __pfx_down_write+0x10/0x10 [ 1023.359487][ C1] exit_mmap+0x3fb/0xb90 [ 1023.359505][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 1023.359531][ C1] __mmput+0x12a/0x410 [ 1023.359552][ C1] mmput+0x62/0x70 [ 1023.359571][ C1] do_exit+0x7c4/0x2bd0 [ 1023.359595][ C1] ? do_raw_spin_lock+0x12c/0x2b0 [ 1023.359612][ C1] ? __pfx_do_exit+0x10/0x10 [ 1023.359635][ C1] ? rcu_is_watching+0x12/0xc0 [ 1023.359658][ C1] do_group_exit+0xd3/0x2a0 [ 1023.359681][ C1] __x64_sys_exit_group+0x3e/0x50 [ 1023.359704][ C1] x64_sys_call+0x1530/0x1730 [ 1023.359722][ C1] do_syscall_64+0xcd/0x4c0 [ 1023.359745][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1023.359762][ C1] RIP: 0033:0x7fecca6cd6c5 [ 1023.359775][ C1] Code: Unable to access opcode bytes at 0x7fecca6cd69b. [ 1023.359782][ C1] RSP: 002b:00007ffc0a34f4f8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 [ 1023.359798][ C1] RAX: ffffffffffffffda RBX: 00007fecca7cefe8 RCX: 00007fecca6cd6c5 [ 1023.359809][ C1] RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000000 [ 1023.359819][ C1] RBP: 0000000000000001 R08: 00007ffc0a34f488 R09: 0000000000000000 [ 1023.359829][ C1] R10: 00007ffc0a34f320 R11: 0000000000000202 R12: 0000000000000000 [ 1023.359840][ C1] R13: 0000000000000000 R14: 00007fecca7cd680 R15: 00007fecca7cf000 [ 1023.359855][ C1] [ 1023.359861][ C1] [ 1023.766051][ C1] Allocated by task 12891: [ 1023.770458][ C1] kasan_save_stack+0x33/0x60 [ 1023.775131][ C1] kasan_save_track+0x14/0x30 [ 1023.779793][ C1] __kasan_kmalloc+0xaa/0xb0 [ 1023.784370][ C1] rose_rt_ioctl+0x87e/0x1d40 [ 1023.789033][ C1] rose_ioctl+0x64d/0x7d0 [ 1023.793357][ C1] sock_do_ioctl+0x115/0x280 [ 1023.797947][ C1] sock_ioctl+0x227/0x6b0 [ 1023.802259][ C1] __x64_sys_ioctl+0x18e/0x210 [ 1023.807008][ C1] do_syscall_64+0xcd/0x4c0 [ 1023.811502][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1023.817380][ C1] [ 1023.819685][ C1] Freed by task 16879: [ 1023.823733][ C1] kasan_save_stack+0x33/0x60 [ 1023.828394][ C1] kasan_save_track+0x14/0x30 [ 1023.833060][ C1] kasan_save_free_info+0x3b/0x60 [ 1023.838074][ C1] __kasan_slab_free+0x51/0x70 [ 1023.842840][ C1] kfree+0x2b4/0x4d0 [ 1023.846718][ C1] rose_remove_neigh+0x25e/0x370 [ 1023.851649][ C1] rose_rt_device_down+0x2dc/0x430 [ 1023.856747][ C1] rose_device_event+0xfc/0x120 [ 1023.861588][ C1] notifier_call_chain+0xbc/0x410 [ 1023.866602][ C1] call_netdevice_notifiers_info+0xbe/0x140 [ 1023.872479][ C1] __dev_notify_flags+0x1f7/0x2e0 [ 1023.877490][ C1] netif_change_flags+0x108/0x160 [ 1023.882506][ C1] dev_change_flags+0xba/0x250 [ 1023.887258][ C1] dev_ifsioc+0x1498/0x1f70 [ 1023.891749][ C1] dev_ioctl+0x223/0x10e0 [ 1023.896067][ C1] sock_do_ioctl+0x19d/0x280 [ 1023.900639][ C1] sock_ioctl+0x227/0x6b0 [ 1023.904952][ C1] __x64_sys_ioctl+0x18e/0x210 [ 1023.909699][ C1] do_syscall_64+0xcd/0x4c0 [ 1023.914191][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1023.920066][ C1] [ 1023.922371][ C1] The buggy address belongs to the object at ffff888032462000 [ 1023.922371][ C1] which belongs to the cache kmalloc-512 of size 512 [ 1023.936407][ C1] The buggy address is located 42 bytes inside of [ 1023.936407][ C1] freed 512-byte region [ffff888032462000, ffff888032462200) [ 1023.950103][ C1] [ 1023.952413][ C1] The buggy address belongs to the physical page: [ 1023.958803][ C1] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032461000 pfn:0x32460 [ 1023.968848][ C1] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1023.977331][ C1] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 1023.985814][ C1] page_type: f5(slab) [ 1023.989779][ C1] raw: 00fff00000000240 ffff88801b841c80 ffffea0001620410 ffffea000167cc10 [ 1023.998349][ C1] raw: ffff888032461000 000000000010000f 00000000f5000000 0000000000000000 [ 1024.006917][ C1] head: 00fff00000000240 ffff88801b841c80 ffffea0001620410 ffffea000167cc10 [ 1024.015569][ C1] head: ffff888032461000 000000000010000f 00000000f5000000 0000000000000000 [ 1024.024312][ C1] head: 00fff00000000002 ffffea0000c91801 00000000ffffffff 00000000ffffffff [ 1024.032966][ C1] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 1024.041615][ C1] page dumped because: kasan: bad access detected [ 1024.048007][ C1] page_owner tracks the page as allocated [ 1024.053700][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6209, tgid 6209 (udevd), ts 180504747077, free_ts 180472126435 [ 1024.074607][ C1] post_alloc_hook+0x1c0/0x230 [ 1024.079357][ C1] get_page_from_freelist+0x1321/0x3890 [ 1024.084888][ C1] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 1024.090768][ C1] alloc_pages_mpol+0x1fb/0x550 [ 1024.095606][ C1] new_slab+0x23b/0x330 [ 1024.099743][ C1] ___slab_alloc+0xd9c/0x1940 [ 1024.104403][ C1] __slab_alloc.constprop.0+0x56/0xb0 [ 1024.109767][ C1] __kmalloc_cache_noprof+0xfb/0x3e0 [ 1024.115044][ C1] kernfs_fop_open+0x244/0xda0 [ 1024.119803][ C1] do_dentry_open+0x744/0x1c10 [ 1024.124557][ C1] vfs_open+0x82/0x3f0 [ 1024.128608][ C1] path_openat+0x1de4/0x2cb0 [ 1024.133198][ C1] do_filp_open+0x20b/0x470 [ 1024.137688][ C1] do_sys_openat2+0x11b/0x1d0 [ 1024.142345][ C1] __x64_sys_openat+0x174/0x210 [ 1024.147178][ C1] do_syscall_64+0xcd/0x4c0 [ 1024.151673][ C1] page last free pid 7480 tgid 7479 stack trace: [ 1024.157978][ C1] __free_frozen_pages+0x7fe/0x1180 [ 1024.163180][ C1] stack_depot_save_flags+0x354/0xa40 [ 1024.168557][ C1] kasan_save_stack+0x42/0x60 [ 1024.173232][ C1] kasan_save_track+0x14/0x30 [ 1024.177914][ C1] __kasan_slab_alloc+0x89/0x90 [ 1024.182789][ C1] kmem_cache_alloc_noprof+0x1cb/0x3b0 [ 1024.188247][ C1] radix_tree_node_alloc.constprop.0+0x7c/0x350 [ 1024.194495][ C1] idr_get_free+0x528/0xa30 [ 1024.198985][ C1] idr_alloc_u32+0x190/0x2f0 [ 1024.203576][ C1] tcf_idr_check_alloc+0x136/0x770 [ 1024.208672][ C1] tcf_mirred_init+0x1fc/0xee0 [ 1024.213426][ C1] tcf_action_init_1+0x460/0x6c0 [ 1024.218348][ C1] tcf_action_init+0x432/0xa50 [ 1024.223095][ C1] tcf_action_add+0xee/0x5c0 [ 1024.227674][ C1] tc_ctl_action+0x35b/0x470 [ 1024.232249][ C1] rtnetlink_rcv_msg+0x3c9/0xe90 [ 1024.237176][ C1] [ 1024.239481][ C1] Memory state around the buggy address: [ 1024.245098][ C1] ffff888032461f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1024.253142][ C1] ffff888032461f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1024.261185][ C1] >ffff888032462000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1024.269224][ C1] ^ [ 1024.274572][ C1] ffff888032462080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1024.282613][ C1] ffff888032462100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1024.290654][ C1] ================================================================== [ 1024.298795][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1024.306002][ C1] CPU: 1 UID: 0 PID: 17107 Comm: rm Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 1024.315681][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1024.325728][ C1] Call Trace: [ 1024.328993][ C1] [ 1024.331823][ C1] dump_stack_lvl+0x3d/0x1f0 [ 1024.336411][ C1] panic+0x71c/0x800 [ 1024.340299][ C1] ? __pfx_panic+0x10/0x10 [ 1024.344724][ C1] ? mark_held_locks+0x49/0x80 [ 1024.349482][ C1] ? rose_timer_expiry+0x45a/0x4d0 [ 1024.354582][ C1] ? check_panic_on_warn+0x1f/0xb0 [ 1024.359690][ C1] ? rose_timer_expiry+0x45a/0x4d0 [ 1024.364789][ C1] check_panic_on_warn+0xab/0xb0 [ 1024.369717][ C1] end_report+0x107/0x170 [ 1024.374072][ C1] kasan_report+0xee/0x110 [ 1024.378497][ C1] ? rose_timer_expiry+0x45a/0x4d0 [ 1024.383609][ C1] rose_timer_expiry+0x45a/0x4d0 [ 1024.388538][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 1024.393999][ C1] call_timer_fn+0x197/0x620 [ 1024.398582][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1024.403687][ C1] ? mark_held_locks+0x49/0x80 [ 1024.408441][ C1] ? __pfx_rose_timer_expiry+0x10/0x10 [ 1024.413889][ C1] __run_timers+0x6ef/0x960 [ 1024.418383][ C1] ? __pfx___run_timers+0x10/0x10 [ 1024.423406][ C1] run_timer_base+0x114/0x190 [ 1024.428076][ C1] ? __pfx_run_timer_base+0x10/0x10 [ 1024.433265][ C1] run_timer_softirq+0x1a/0x40 [ 1024.438018][ C1] handle_softirqs+0x219/0x8e0 [ 1024.442790][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 1024.448082][ C1] __irq_exit_rcu+0x109/0x170 [ 1024.452744][ C1] irq_exit_rcu+0x9/0x30 [ 1024.456975][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 1024.462612][ C1] [ 1024.465533][ C1] [ 1024.468450][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1024.474419][ C1] RIP: 0010:kmem_cache_free+0x12f/0x4d0 [ 1024.479954][ C1] Code: 00 48 8b 55 08 48 89 de 4c 89 e7 e8 fb 94 0a 00 84 c0 75 54 44 89 e9 81 e1 00 02 00 00 0f 84 89 01 00 00 48 8b 3d e9 fd db 0b 18 00 00 00 be 00 28 00 00 89 4c 24 18 e8 ee be ff ff 8b 4c 24 [ 1024.499548][ C1] RSP: 0018:ffffc9000403f9c0 EFLAGS: 00000206 [ 1024.505611][ C1] RAX: 0000000000000000 RBX: ffff888043a18dd0 RCX: 0000000000000200 [ 1024.513570][ C1] RDX: 0000000000000001 RSI: ffff888043a18dd0 RDI: ffff88801b841780 [ 1024.521526][ C1] RBP: ffffc9000403fa20 R08: 0000000000000110 R09: 0000000000000000 [ 1024.529481][ C1] R10: 0000000000000000 R11: 0000000000000001 R12: ffff88814040a140 [ 1024.537439][ C1] R13: 000000000021a300 R14: ffffea00010e8600 R15: 0000000000000000 [ 1024.545401][ C1] ? __pfx___might_resched+0x10/0x10 [ 1024.550678][ C1] ? __put_anon_vma+0x114/0x3a0 [ 1024.555534][ C1] __put_anon_vma+0x114/0x3a0 [ 1024.560198][ C1] unlink_anon_vmas+0x58a/0x820 [ 1024.565035][ C1] free_pgtables+0x373/0xcb0 [ 1024.569622][ C1] ? __pfx_free_pgtables+0x10/0x10 [ 1024.574721][ C1] ? mas_next_slot+0x12d3/0x21b0 [ 1024.579652][ C1] ? __pfx_down_write+0x10/0x10 [ 1024.584498][ C1] exit_mmap+0x3fb/0xb90 [ 1024.588734][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 1024.593494][ C1] __mmput+0x12a/0x410 [ 1024.597554][ C1] mmput+0x62/0x70 [ 1024.601264][ C1] do_exit+0x7c4/0x2bd0 [ 1024.605415][ C1] ? do_raw_spin_lock+0x12c/0x2b0 [ 1024.610429][ C1] ? __pfx_do_exit+0x10/0x10 [ 1024.615017][ C1] ? rcu_is_watching+0x12/0xc0 [ 1024.619769][ C1] do_group_exit+0xd3/0x2a0 [ 1024.624263][ C1] __x64_sys_exit_group+0x3e/0x50 [ 1024.629279][ C1] x64_sys_call+0x1530/0x1730 [ 1024.633943][ C1] do_syscall_64+0xcd/0x4c0 [ 1024.638452][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1024.644420][ C1] RIP: 0033:0x7fecca6cd6c5 [ 1024.648824][ C1] Code: Unable to access opcode bytes at 0x7fecca6cd69b. [ 1024.655825][ C1] RSP: 002b:00007ffc0a34f4f8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 [ 1024.664233][ C1] RAX: ffffffffffffffda RBX: 00007fecca7cefe8 RCX: 00007fecca6cd6c5 [ 1024.672206][ C1] RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000000 [ 1024.680162][ C1] RBP: 0000000000000001 R08: 00007ffc0a34f488 R09: 0000000000000000 [ 1024.688118][ C1] R10: 00007ffc0a34f320 R11: 0000000000000202 R12: 0000000000000000 [ 1024.696078][ C1] R13: 0000000000000000 R14: 00007fecca7cd680 R15: 00007fecca7cf000 [ 1024.704040][ C1] [ 1024.707263][ C1] Kernel Offset: disabled [ 1024.711578][ C1] Rebooting in 86400 seconds..