last executing test programs: 40m52.302864229s ago: executing program 0 (id=995): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000340)={0x8, 0x8169, 0x6}) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000000100)={0x10020004, r5}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r8 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r8, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x808, 0xfd, 0x7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x49, 0x7fff, 0x4}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000140)={0x7, 0x1000, 0x800}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x32) r9 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r9, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x10000, 0x180) close_range(r0, 0xffffffffffffffff, 0x0) 40m49.292702295s ago: executing program 0 (id=1003): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r0 = getpgid(0x0) syz_pidfd_open(r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$inet_sctp(0x2, 0x5, 0x84) socket$netlink(0x10, 0x3, 0x2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$vbi(&(0x7f000000c600), 0x1, 0x2) creat(&(0x7f00000001c0)='./file0\x00', 0x12) r2 = getpid() openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000030000000000008957af760000006e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x4, 0x24, &(0x7f0000000980)=ANY=[], 0x0) syz_pidfd_open(r2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x111, 0x6}}, 0x20) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r4, 0x4236}], 0x200003be, 0x0, 0x0, 0x6) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300), 0x2, 0x3}}, 0x20) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 40m48.604984449s ago: executing program 0 (id=1006): syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003f3fdc20221802324a130102030109021b0001000010000904cdf100d3"], 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) lsm_get_self_attr(0x64, 0x0, &(0x7f0000000000)=0x5b, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r2) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r5, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'pim6reg1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001600)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=@newqdisc={0x38, 0x24, 0x800, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0xa, 0xc}, {0xf, 0xf}, {0x3, 0xf}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}, @qdisc_kind_options=@q_ingress={0xc}]}, 0x38}, 0x1, 0x0, 0x0, 0x20042000}, 0x4010801) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x20, r3, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x4}, @ETHTOOL_A_STRSET_HEADER={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x20040041}, 0x40) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000380)="2190", 0x2}], 0x1}, 0x1) bind$unix(r1, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x10, &(0x7f0000000000), 0x4) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f00000001c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x10, 0x582, 0x145, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xca, 0x3, 0x1, 0x8, 0x20, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1, 0x3d}, [@input_terminal={0xc, 0x24, 0x2, 0x2, 0x206, 0x4, 0xa4, 0x4, 0x50}, @processing_unit={0xa, 0x24, 0x7, 0x3, 0x6, 0x0, "ed14d6"}, @input_terminal={0xc, 0x24, 0x2, 0x4, 0x405, 0x4, 0x9, 0x3, 0x0, 0xb}, @mixer_unit={0xa, 0x24, 0x4, 0x6, 0x2, "284583e326"}, @selector_unit={0x7, 0x24, 0x5, 0x4, 0x9, "34cd"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x81, 0x7, 0x1}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x16, 0x2, 0x4, 0x7, "54c0c27cba"}]}, {{0x9, 0x5, 0x1, 0x9, 0x290, 0x20, 0x8, 0x5, {0x7, 0x25, 0x1, 0x255fbf4e1d06e20a, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x6, 0xca, 0x6}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x0, 0x6, 0x8, 0x83, 0x2}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x10, 0xa, 0x6, 0xd, 0x8}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x7, 0x6, 0x9, 0x7}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x0, 0xff, 0xeb, {0x7, 0x25, 0x1, 0xc, 0x4, 0x7}}}}}}}}]}}, &(0x7f0000001900)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x770, 0x2, 0xe, 0x3d, 0x20, 0x3}, 0x56, &(0x7f0000001d80)=ANY=[@ANYBLOB="050f560005141004034a615cf61bf9c0c13352577c95d1b15c27f6f8ea9046141004065de9e58b5f834d1a30f78ff6f8847cb010100a02c10000000087962118beff000b1001020700053f040071f590bee6ad4fbc9540f3aafe6f1d9950a977a582788f73245d057035c4a418c34350e96f6e80f7955b75c5eb76e01bc4329d00af89863073561e9dad5d18b2e5e45b41aa6a933679"], 0x8, [{0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x81a}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x441}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x816}}, {0xdd, &(0x7f0000001980)=ANY=[@ANYBLOB="dd03804672122864a2aa4af888ad6117835bdf81aae8ea6e9119ca943392ad315eadda6cc3bb7774da947c697d0dd7afa13202a457b23c6ae0e8de800c2eac8813d004907b9e300a816f5ecb9abe40b7071883642e3fb8badeceec79a5a5ef8161bb6b7c2e12d6c91a78c33fc2cdb5ea15f650e51dd5ce94e27cd7412d518b515b03f37f043cf084e0a2f98fc5a0b0020029642b4ce0801f43b508d0f72c06e3487ebd18d7bbea99d03c970e3f42b95f9e2e11983ae0461de3f7bb07a63f13ae0b8535f39975b7b80524fd739737c4a4b1b62f84ff367affcb2f95e1503b4321f31221c14a13995c3a6a92c77ef4dd5a99979e41bdc395ea37bfafef2f15a5c61c7bb330852593daa8c55e67463f6b0ce01566d976108c7ae54b00d1a30000000000220cb8ae7f833e0cd3115353287611ccadfd5fbb6408b03f0fb32a554a3f1e54bba4ba7fe60cb5afdd41eb282eb599940fab6ab4e9f4bb841c1c910ea805ff476fbe6c7f872bf16571fe84b9df2c01b14bc139a4bfe43068f9e4afbfec342ca6a018303e5529106b69f647d14f102d20dbf43a6d47d0a84ad1583af26854dfcc7a8125307316ef82892749da692ab8133be2c4b1e8e16aa88c275e82872a119ba2da90b835342af63b4cf6c3d7d17e7b7d636afd49f971864e66a6c0f715396d9f6c121dc96d8bc39b27bcd773167ade2eb19cb3f872509e32b7ce7b67aa298cfd1305b4544fea59b70714e262385f49f9c2847009ba0fb9709c70b97a3730500b69bb6566add89b28c8655f24d0611638e8f21dd6d3fada82aeda5522720d468dbbd42c3dcc976a2f91dfdd98374de4458139028112d7baf8a29790627a484bfdec54f54832e02d65c8cffb12671b29660c75398617139f9c8efe5ad71116d6ecab8ae47fd3837fb7a551be07857e29006da3329e36c1a59fb6898bc415adf7fefd88966b27bdad3a0d8624c3c0d34a7e4e46fc592a243803936cb2435616208be71282918bb708633ff7efb70f35f00633a23d9fb570a0315508afb82c30bf890958a1fbcc5f699c0d984729bebf59a76eae70e90ef1cf295b14b00df254a9cbafd7b5604f395627a87071aba3caa0701dcccb27c8eda0de0aa05950771a325af13ae71f7f200f8182e16008202f99839ac17307d5fde154fff66d704c2781b929e77a6fb8491f9faeb8172c5255adb41bf6b39fba9d1b28c7ce3cf928079c8508a477957df971227f32174b84ecb16d5edfbae3b9ff9190fde2a15a68f43441126d6c178e621005a7fb4103451dffb2dba43509837300b8c90f9361166ebbf416f253ae12ab0c0bdea2ecd5fcc90f80a1180e54a0fc771b722f8b42c72cff43c1e6b5c774cd353ec1061f6210e128ddabe78619eb02ae42"]}, {0x4, &(0x7f0000001700)=@lang_id={0x4}}, {0x59, &(0x7f0000001740)=@string={0x59, 0x3, "4343cad6efa9a6a620adfd71eeb21a58daa116876ae22128ff6a817a7da81abb65af24e816622b01adef7ce30723a66e48e8f636b2df3bd118cf495673587499ad214cc29a52445015ec878bcf084e18b52f9f88a1df64"}}, {0xf0, &(0x7f00000017c0)=@string={0xf0, 0x3, "2ee7e60b1a0a6559936948dc2568257faa688acbe27a48e22017fd50c2e4c07b0b0926fc7bc74ad2a5e3635a1b3871940ee811f3b0ac066b7ae2019bad0f1f2facec29cc363d326e46fcf6ba28eaf992901a9d7401cead08779413706ff94848cf2002aa2ae252950d8565c8de62e93e76a7a81df13ceb9e7f1d72439fa244298d95e554113eaddaef408357a9fb545ece0d3eb96bdbbb8faa1dbb1cea028c39241e049a9c76f9e1549532c17765734f2228c4251bf8949861d577dfb6fbfed32f1500b36b18711834b527bf3c4b735737e3823a632fe259e349618bc25fc0fd8af0cfda9efa2332eb973b596f30"}}, {0x4, &(0x7f00000018c0)=@lang_id={0x4, 0x3, 0xf8ff}}]}) recvmsg$unix(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x2) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='X', 0x1}], 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="183f0000000000000000000003000000950000000000000095"], &(0x7f00000003c0)='GPL\x00', 0x2, 0x1007, &(0x7f00000005c0)=""/4103, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0xc0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000001640)='./binderfs/custom1\x00', 0x800, 0x0) 40m46.497975889s ago: executing program 0 (id=1010): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f0000000080)=ANY=[], 0x8) recvfrom(r2, 0x0, 0x0, 0x40000100, 0x0, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newtfilter={0x34, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xfff3, 0xffe0}, {}, {0x5, 0x8}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8848}, 0x4000010) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x4) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x104000, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r8, 0xc4c85512, &(0x7f0000000280)={{0xc, 0x0, 0x0, 0x0, '\x00', 0xffffffff}, 0x0, [0x40000000, 0x0, 0x4, 0x3, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x2, 0x3, 0x4, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x4829d, 0x0, 0xe, 0x0, 0x0, 0x1000008000, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0xc, 0x2, 0xfffffffffffffffc, 0x4, 0x0, 0x10000, 0x4, 0xfdfffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20040000000, 0x0, 0x8, 0x80000000, 0xc20, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x4, 0x0, 0xfffffffffffffffd, 0x7, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1075, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x3, 0x7, 0x7, 0x20, 0x6, 0xffffffff80000001, 0x2, 0x0, 0xfffffffffffffffc, 0x4]}) 40m45.328350669s ago: executing program 0 (id=1011): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) getsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000001c0)=""/3, &(0x7f0000000200)=0x3) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) r2 = dup2(r0, r0) read$FUSE(r2, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000c2c0000000b0a0101000000000000000c070000000900020073797a31000000000900010073797a300000000014000000100001db93000000000000000084000a"], 0xc0}}, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f00000002c0)={0x0, 0x0, 0x0, &(0x7f0000000240)=""/108, 0x0, 0xeeee0000}) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000002540), 0x2, 0x0) read$FUSE(r4, &(0x7f0000002580)={0x2020}, 0x21b) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = io_uring_setup(0x185d, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x1, 0x800000c1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000002500)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000024c0)={&(0x7f0000000400)=ANY=[@ANYBLOB], 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x4000004) write$vhost_msg_v2(r2, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/116, 0xfccf, 0x0, 0x1, 0x2}}, 0x48) 40m44.78107062s ago: executing program 0 (id=1013): r0 = socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) fremovexattr(r3, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f0000000200)={0x48, 0x17}) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r5 = fsopen(&(0x7f0000000180)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='gid', &(0x7f00000005c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) r6 = socket(0x1e, 0x1, 0x0) connect$tipc(r6, &(0x7f0000000000)=@name={0x1e, 0x2, 0x2, {{0x1, 0x1}}}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) socket$netlink(0x10, 0x3, 0x4) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f00000000c0)={0x0, r0, 0x6d1b, 0x2, 0x93d1, 0x80000000}) 40m44.515225191s ago: executing program 32 (id=1013): r0 = socket$inet(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) fremovexattr(r3, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f0000000200)={0x48, 0x17}) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) r5 = fsopen(&(0x7f0000000180)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000ac0)='gid', &(0x7f00000005c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) r6 = socket(0x1e, 0x1, 0x0) connect$tipc(r6, &(0x7f0000000000)=@name={0x1e, 0x2, 0x2, {{0x1, 0x1}}}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r7) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200) openat$cgroup_ro(r7, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) socket$netlink(0x10, 0x3, 0x4) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f00000000c0)={0x0, r0, 0x6d1b, 0x2, 0x93d1, 0x80000000}) 28m49.668094952s ago: executing program 1 (id=3030): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$unix(0x1, 0x5, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0) close(r7) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xa0000, {0x0, 0x0, 0x0, r10, {0x0, 0x9}, {0x5, 0xb}, {0x0, 0xa858712265c6c23}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x6}, @TCA_FQ_CODEL_FLOWS={0x8, 0x5, 0x1}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240000a0}, 0x4028040) ioctl$SIOCSIFHWADDR(r7, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 28m49.475085629s ago: executing program 1 (id=3031): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket(0x18, 0x2, 0x1) socket$packet(0x11, 0x2, 0x300) sendmsg$key(0xffffffffffffffff, 0x0, 0x2000c804) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x14, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x40}}, 0x14}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x2}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x2}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) 28m43.82668049s ago: executing program 1 (id=3047): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="91100418ce8ffbe187a9066a00010000"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1002}]}) pipe2$watch_queue(0x0, 0x80) r2 = syz_usb_connect$uac1(0x2, 0xa5, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io(r2, &(0x7f00000009c0)={0x2c, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x816}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r2, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000540)={0x0, 0x3, 0x53, @string={0x53, 0x3, "ff42d712420421c36adec8aebb68562b83f43bbc812964a5bf7ff03a2a2c4384cab107859b1950da984a232ca2df9772e166c52e22967fd64ff0e3bd2268c25e416db7decdb185167caa52e6c9d6d212ce"}}}, 0x0) syz_usb_control_io$rtl8150(r2, &(0x7f00000000c0)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0xe, @string={0xe, 0x3, "76386af26fb591739f7c0025"}}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) r4 = socket$inet6(0xa, 0x6, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="b4050000ffe0f50571103f00000000006700000000800080950000000000000072c2f98cb7333011f1cf97f165ac0dc8c84c1ed04a84f6243cec3706bd2d671c2c28c7a0bd13871d815bbc06c2fa221f1a91d63e4bdbf3cbdd4ff4738d969857122ea180b8b25ad6c006c3e4e86dd319c92d683f6d593cb860187c7640045af58adcfc943a215f12b50493e62b5a127771fc659f39d1470e7d85"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) socket(0x2d, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000000080)={@private2, 0x29}) shmctl$IPC_RMID(r3, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x20, &(0x7f0000000000), 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/fib_triestat\x00') preadv(r5, &(0x7f0000000640)=[{&(0x7f0000000140)=""/134, 0x86}], 0x1, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r5, 0xc0105303, &(0x7f00000001c0)={0x6, 0xb0, 0x8}) r6 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x28182, 0x0) ioctl$AUTOFS_IOC_FAIL(r6, 0x4c80, 0xffffffffffffffb6) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000340)='net/sctp\x00') lseek(r7, 0xa3d2, 0x0) 28m31.883549367s ago: executing program 1 (id=3072): syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x8401) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x0) socket$packet(0x11, 0x2, 0x300) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f742f5f62726964676500140001007767320000000000000000000000000014000100766574683069746f5f7465616d00000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x4040895}, 0x20000080) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a2c000000180a01030000000000000000020000000900020073797a30000000000900010073797a300000000014000000110001b2a712df4a0000000000000000"], 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'team_slave_1\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x24040084) syz_genetlink_get_family_id$mptcp(&(0x7f0000000340), 0xffffffffffffffff) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) process_mrelease(0xffffffffffffffff, 0x0) request_key(&(0x7f00000011c0)='big_key\x00', &(0x7f0000001200)={'syz', 0x1}, &(0x7f0000001240)='\x00', 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_clone(0x900000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) 28m30.68645233s ago: executing program 1 (id=3076): bpf$PROG_LOAD(0x5, 0x0, 0xfe3f) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = openat$nullb(0xffffffffffffff9c, 0x0, 0x282, 0x0) sendfile(r0, r0, 0x0, 0x40008) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141101) dup(r1) r2 = syz_usb_connect(0x5, 0x239, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e388d640697a01006ba8010203010902270201020010000904"], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x103a, 0x1000, 0x103a, 0xfffffffc, 0xff, 0x80000000}, 0x1c) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r4, &(0x7f0000000140)=[{&(0x7f0000000400)="3a4a0ae358207daac9", 0x9}], 0x1) r5 = fspick(0xffffffffffffff9c, 0x0, 0x0) fsmount(r5, 0x1, 0xc) 28m28.345727906s ago: executing program 1 (id=3081): r0 = fsopen(&(0x7f0000000580)='overlay\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0xd8a, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000440)=ANY=[@ANYBLOB="400000000000000002004e22ac14142c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000002004e20ac141410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926320b038d86508e357382df0ef843f4e54db3499da6b27804817314b8d7417d43022821b7f126af441"], 0x110) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r5, 0x4611, 0x3) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = dup(r6) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r9, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0xff, "810000cc2b000000000000fa25ffff00ffffff"}) r10 = syz_open_pts(r9, 0x141601) fcntl$setstatus(r10, 0x4, 0x102800) write(r10, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000100)=0x19) close_range(r8, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 28m13.047225727s ago: executing program 33 (id=3081): r0 = fsopen(&(0x7f0000000580)='overlay\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0xd8a, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x348, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0xf}}, @common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xb8, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}, {0xf, 0x2}}, @common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3a8) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r4, 0x0, 0x30, &(0x7f0000000440)=ANY=[@ANYBLOB="400000000000000002004e22ac14142c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000002004e20ac141410000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000926320b038d86508e357382df0ef843f4e54db3499da6b27804817314b8d7417d43022821b7f126af441"], 0x110) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r5, 0x4611, 0x3) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) r7 = dup(r6) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r9, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0xff, "810000cc2b000000000000fa25ffff00ffffff"}) r10 = syz_open_pts(r9, 0x141601) fcntl$setstatus(r10, 0x4, 0x102800) write(r10, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000100)=0x19) close_range(r8, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 9.953098405s ago: executing program 5 (id=6694): socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x5, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000380)={0x38, 0x9, 0xc, 0x8001, 0x0, 0x7, 0x6, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0x2f) sendmmsg$sock(0xffffffffffffffff, &(0x7f00000044c0), 0x4000000000001c0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCGPGRP(r2, 0x540f, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7ff, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x3231564e, 0x0, 0x0, [{}, {0x8}]}}) recvfrom(0xffffffffffffffff, &(0x7f0000000040)=""/60, 0x3c, 0x40, 0x0, 0x0) syz_usb_connect$uac1(0x2, 0x7b, &(0x7f0000000440)=ANY=[@ANYBLOB="1201100300000020630701204000010203010902690003010f207f0904000000010100000a240102000a00020102090401000001020000090401010101020000092402010180070cc30905010940000701030725010009a4de080402000001618df602000009040201010102000009058209000200f5b907250100445ae8a8385497b2c0333a72293d8cef7f5b4aea9575ad0c0c8f0938edcad4b5e8cf61c22d4f1733a427e70646ad72d53890217ae9852b8fd3df930e2365cdfdec2c9e6add6d4764e674b3e71a84a88a1b8e9569f3589e56b4730edacf7b12eba069972f5a579dee49672030382bba4b2908a30cb9a0941479e8dc4d77e6ed2dc141cb8eb0183f3fb20f53fa205b1e13ff5ffb561851e56060a9fa21758b06d5d68d0c888588bcef9903f20c5ff84ddc408f540f9166f5898058210e032653ccf2486b1960e1a932b55c57d1904cdf6f01272037e71125e71be77078"], &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x4001}}]}) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000180)={0x10002, 0x4, 0x4000, 0x2000, &(0x7f0000ffc000/0x2000)=nil, 0x0, r4}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)=ANY=[]) ioctl$KVM_PRE_FAULT_MEMORY(r5, 0xc040aed5, &(0x7f00000000c0)={0xd000, 0x7000}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xfffffffffffffffc) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000240), 0x408900) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r6, 0xc0a85322, &(0x7f00000002c0)) io_uring_register$IORING_UNREGISTER_NAPI(0xffffffffffffffff, 0x1c, &(0x7f00000003c0), 0x1) 7.935960349s ago: executing program 3 (id=6703): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1002, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000080)=0x2) r1 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000180)={0x7, 0x5, 0x7, 0x80}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pwritev(r2, &(0x7f0000000280)=[{&(0x7f0000000100)}, {&(0x7f0000000140)="a0500bce9f3a01d0a5ce6a6fa976f672dd320321c882f6c5", 0x18}, {&(0x7f00000001c0)="749f9db1a63e943e8b557899a2b637c114db51c51ea3d4c9f5c8c112e6494c22b2b8a7c98ce257104a380f097c24a8cf829fed7becfefc9b16f9c450c287179129466188235380ce6773120318b2fd72180db421833029108effcdbc918d6edbb0386f292f9e3d96cd0030dc5050748b31fe32aa6dbe567aac5233f08d00c85b2701e3beabb43b3fe1756a0c9eae8d6825ab058eaa23", 0x96}], 0x3, 0x42e, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) request_key(0x0, 0x0, 0x0, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f", 0xe) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000180)=0x2, 0x4) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x0, @private1, 0x200000}, 0x1c) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r6, &(0x7f0000000000)={0x2, 0x3, @multicast1}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0xc2400, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) 7.210974308s ago: executing program 6 (id=6705): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) (async) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r0, 0xc0105500, &(0x7f0000000000)=ANY=[@ANYBLOB="a1"]) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x2000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_ALPHA={0x8}]}}]}, 0x38}}, 0x4000010) (async) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000780)=@raw={'raw\x00', 0x3c1, 0x3, 0x398, 0x0, 0x4c, 0x1a, 0xc000486, 0x73, 0x2c8, 0x258, 0x258, 0x2c8, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @local, [], [], 'wg2\x00', 'macvlan1\x00'}, 0x0, 0x168, 0x198, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x0, 0x0, 0x10}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00', @dev}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@icmp6={{0x28}, {0x0, "e1f6"}}]}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) (async) r3 = syz_open_procfs(0x0, &(0x7f0000000480)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0xc0686611, &(0x7f0000000180)={0x68, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) (async) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}, 0x3}) write$binfmt_script(r3, &(0x7f00000001c0)={'#! ', './file0', [{0x20, ']'}, {0x20, 'rpfilter\x00'}, {0x20, 'macvlan1\x00'}, {0x20, ' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x20, '['}, {0x20, ':.$('}, {0x20, 'icmp6\x00'}, {0x20, ' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x20, ' \x01\x00'}], 0xa, "6566733327f88ed4c7daf16b9982361302153ba55d0d929b3ac36d1a5c3ed61fd1e822d56397c83d164394c52f1132837eabebc3dfb78869625bce88d04368a03d7cffe4337ed30f31bff622c06f15e168999ba67341f88034e7a209432dc3861898e706167d3f619c148e9df3c9a6ffa87c43a45c07b5f786e648c1ccb917175b006dcf173a72a69b40a1874dec4a3f03fa203b29ef79f0b192e062ff86e4b00721a4775e04c896f049ced78c59407aa0817d668db7d3f69f6d08d671659a02473b71a00115d2d87c454b377b84ed422264"}, 0x127) 7.161941546s ago: executing program 6 (id=6706): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e61, 0x2, @loopback, 0x7fffffff}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) writev(r0, &(0x7f0000000740)=[{&(0x7f0000000280)="581a17919cc77431510e7fc4ed9fb860505f1495ff92f16a44f8a13d58751d926def1f80b315bdc726cdd8b5d1a91f485854af8fc854b0da7a02522fe7b2c21db7a46c48473099d4a4654cfd97a67c9e79afc0d444e6c78b0216d2201b128df9d4ed5b4dbe676fe56a6354f819d997a6acb8595633cff6f77473b2b3abcc65b51cb3d3a30bf9b0b2ce59d568d3a89b49331904da2a37c89ea236f5d5640c32c3ac74e4bde1a60c560cb63836552f881c8a8305d2a1", 0xb5}], 0x1) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "369f1eae", "bb10000000000001"}, 0x28) readv(r0, &(0x7f0000000e40)=[{&(0x7f0000000f40)=""/250, 0xff1}], 0x1) 7.094122318s ago: executing program 6 (id=6707): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xa, {"a2e39b214fc752f91b2909094bf70e0dd038e7ff7fc6e5539b324d078b089b3b0838681a0890e0878f0e1ac6e7049b3d6d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b343b0d076c0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c30900004288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef7becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe505003d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6ae4effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d71eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d471c8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949d9a92587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15aa82000000000000a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000", 0x1000}}, 0x1006) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b29, &(0x7f0000000040)={'wlan1\x00'}) r1 = io_uring_setup(0x178e, &(0x7f0000000140)={0x0, 0x52c1, 0x8, 0xfffffffe, 0xc}) socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_MON_GET(r4, 0x0, 0x5) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x2, 0x0, 0x8, 0x2, 0xfffffffffffffffd, 0x1}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x4, 0x0, 0x1136f858, 0x0, 0xffffffffffffffff}, 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b00"], 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 6.832154711s ago: executing program 4 (id=6708): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000040)={0x80042, 0x1}, 0x10) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x1}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x50) r5 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e000000000000000700400009"], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x890b, &(0x7f0000000000)) r6 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r6, &(0x7f0000000b00)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x6}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000040)="6203b3fcd755af056510120800afbcf711e12b7f96e5521c8cf217300100000093c1cdf632dbb86770380e8ddd9aff775f8eff5b0b0bc283", 0x38}, {&(0x7f0000002300)="fb16656fa9b4bdc7cbe98fd90c4fe8405e1b233bfe248ce87873125788c8f84cdd6a907d0642fcd2fb131cfd03bb642fdac200385073782c51eb70432dd40adbe7ad9113035e7fa8c4bcc076243aad85074aadbf02802d6cb7525c164265e34747d82169fe6293736d02e9488bad013c72b51d303303bd4ed1865891f6cab78b54083b36ab3ec12f4e9fcbee4bd2e5ee3721b95494d5429b858b42d6b1eb1858cb655305d71463943fa47fad0bac0b80e79ec4e276cad1b3c55464d2912c6821592761e0fb9da72ee50b8fd9fc3462e1715549421af29c203abbe79d510bb4b60d40491af903d49c43d0a39ce733440a8171a7341e929ae1286fe721fdcf8be3e236a10449736e344ab1414eda4a964f1068ae7215596eff8e8720eb32bdcbe049867ea30918ea664770ce1e9f14f3f9d4f2ffdc8b0c7b8b59de9a6cd7d34d06471b9423c4d1974b15886d2917a7782b74d68f0342783ca90587b982e2df98fb19393fa4942d650d79812835352fe59fcd063b9439216a9adc28061f602440cc5924154a25774f81e1c3ce1bb29d78948e8da5855d2623080f45272d39de46ad5e193bda1c242e80c74841a8725367c74cb34838f96e2870e66cb243d31f9df582b1a33edc92af0d422fcf7715ad3eb748b38e089c6db34311aeded259c2fe4673cdfd2e0105be682f3291f13bdbf6ecf61b3a0a2606fcf51df1423a025719a9168916df934b976d86af2a5464e92203facc8c77614fb03b6f6b60a02cdcddd0fcf07b37a53a1f02f15203910be1b5a78b6e923d7bcd66d1d93b71f6672268d5a533919af8696bf49842fafffc2bdb1005fab6243785ee8ffe214ca8e3ec0a7441d94639b7003f08929560c6d1ca20f7163d743dc92116de808bd9b1fd2e7bc2095e8341d636f465adf8250adbc5541a8e5a5c65bdaea4a06c5106fcefbd78604220a1a8e3ddcee8c4cfbb4c68e6634df80bd83d5b4990e5d2245e840d569baea06d1d479b8de29672d0b43ef1d45c10aaa0e1d64299e181939bc1c541cc3992bf83ea39475e9d02e2dc9d29a43eb036682d22910343a143f4720843dc5334c2524a21111f8a9b3b999c9f4de60ed70048da6b8ca964ff5cc1ea82bb81cc0b7c2b5cad8715097e9646ff455cd58ebd4e254633962a415b59bdd9ef549cc098c3e7d4888b405069aaa27dd7592aac2cea464d68b02c924a94647f64f8ce880ebd46a6fe0097a6b938413f6f26f2793b1adcf04c5b932500ce90b28093839dab697e95e07e55b4875e4e4faa78c5f02750b5093a0f4e52c14d444764fddd28cc9b35237d213654f9b929d97a1da368e9ec37d223e4202086d46f7e529e2c01e17d8638b06d6bc0560a66fb5994b3f2f569b4db0257680527bebe79ef156331a1b534c0ea164e921ac24462b67462ba61c820640847606a66ac470a0ad608eaec0e50a3073eb631c4698b351a7b97441b80769b821a8048fa82a84ce0726d84035ab1eb19481f5972428c90619768bf83532fb96549f5c84c8f4525d19e1fd4d5311b2374349ce8a98a8c4fca2b3093ac8fde22dfaf913c45869be4b7dab0435642735c2cfbfbc3ffd1438ed4c9e1f18b0989d31e604f48e129a3a1e09b03cf4a370a5827f195b228f22094438c75384436d810d25c4bbc856199c045129a2ec5cc8446a43279b9475a903e476029b839d195ec47b5a625e4f8da76825e0aaedc2ac57d0bdbe460281969d04423684cf8f8bbfb76798f819ed7963fac56c22fb5ffc7381cd88d5c6bd5b6e484cadbb74c30109125a8c5f23387144a5fa531da1aa3e8c10dec242e522b7c035773bc6c38e51a29e162884716978deab927d232f2bbee93e21ea862de6d525d8ad147ca94aefa92c25be100da06dd4d56a363a15243d619f3aca793ca2f6ce24f75ddcf0b3d5e3db578783e2b9efc9493a77e6456fed90034fe392c78df233a329ee888449e1ddee9d560fb20c1bcc6495595ec6db666365a3369cdde2828e8feb52ac11d707e3dee5232f00be6cb10e8e04c0dfb2c0b609b13acb56627de701970bec6180c19ecf6d0c5c44dabdaf43716e83876807894ecdf5b605d2537499d75d845c8b81b12d89e01e52eb8cbea63c8c113b6768e9b7acc2e17dfec2641b87147ea7f6a0901486a2b4faaaf1d1be261f3a75382538eb25bfdbeab5c618f68030e1ac751750ba62d0cab03c2aacea183749ee9bf1dca964c22df527d92e77e6d1ac89ba796f0ea4a23cf219de64173ee02e880c86ee5a910edfcc31f6893c1b85dc46973a8df6153170e40123976b85760cade5be1667c6ba93ca7b7d316102aeb9ae5cc9a5c1bb54734af212c03ada022ebe3f58a3626082fd23dac521e5db215193f9d70cb8050fcb55d234dfa871d8a00f23994f2728b3adc7b9736953b1974f99dda4eeb0f2d50f23b020c964acab414088c6946e7f294c5959139aebd18077441005397f43c273d8901c717e5a044237dd31042036e5129d74f4c0f76d800054a8e8660f7c688b47878ad6c5352a00db703b0ad34c12472a93aee647b0b1a2d79e96e9a435981e1b786d2e4ed72b1eb458dcf80e68a8d35c46c93eff209d06c96a4bb934426cdc1b6e8bd3f3d419ccfc763e0b3c978a78ea5d8816a0c4ea54e18905a938d6e032084d769c739f39378675135b5cb86826a3abc1591e974c399aff884c2c904b2c0d435a18d3ee25dde55d3607c7ac31825a1017eb7d5f46ab79ade884d92080909d81afaa8c1c054675c16b7637728e3c7e4ca059c7065ec953d5176496aebc9667a772cc93cba7ecaf776da83ea4859c8d25f3d3e343352f8b3256a521c47edb587515783035305752ba837adcb5d0a0665b2eac5cd0f616294fb11ff94365f5c10a25f35f0c3e6fc3156ee2273a47befdb57e9c7dc1119b819d1f0a77efa85721d832f257a644390adf27e5b799eb9df07eecf7059c6b779a3619fa71fe770bc0a9056f6b7b31d86e32440355f733dadaddc2975b1852b1c3ad165281ef4c8513ec2f363cc00f6f9d06b1e0cef8a2dae7de666d1ca470e5ac9dd5ddbe3d831852ce48ab6145e13ad58ccc31b0eebe3053e661c20fa59abf985ecc34bc79e9239c28842f2a5d7dcea8008c3315e7f05cc2841adbc611e85bedb04f618b68f3723d91e40bef3d12fcaf01fb7f2b41428711d4e8e3cf42754639692d3f538317d08eafe63eadf561e35ed3e5c915b4b1a2b62da6fb436186c45129b73b7fdc7136729b2ac72e2580f549c28ee848bcf13daf446389b4f64bc83d78041fd4fc397b7f2e8ed3491912622458317d89a13c01b045731ed3e82d9859100897297a1db43e0ce06b5109ee9354cb4a4a2167111470b3b9fcdcfb8b967156a8538fbe827b6265b487cc85192e220eb7f9aea4266718c2c276f6fe72d70e33f066166706ce43450ca54447b3254e7995e4466710ef5f1bfd37dc0e5caa95213600841dcac99edfba65a619628725c669f8cc36e2d381144f34f404b26f57bda9c51a061a089a39208e6aff497ed0f10bac29e38f971dfeeaf2a32b76adec374e180f767d4fca6bfdbcc1f5105aa37f60e4eb950561f0a69b638de4a0eb814758bee9a6455f2455c8330758a80c95cc9feebdfe08ef8322f4f1dd7cfed4da51371586f54358e5221107455ce2eb4fab2032b46a98c6a162f272167e48ad948b0d5332088c8476c5bdb354043f7042dc8ad54d0a1a741f6cb93d3c572017d315eb439d976cd21e96a718f90b6b48d536fee331949410ea43f66ebbe038cf9dd76d8030d0f22258ee10aacb31093fd946fb484f5bb52a2d3b277da62619a80001f4f73d304c0231afbf5d6b587407d2bd62dfc8548b68b30dd6baece9249bf7b7f895a76177157df8cb36344c18fbd818bc06bfb04a7bf4f3745f76099e78cdbce101d700a64d32ebe4f61ca6dec9d9acfbd26566aa4c4884664c2ab868ff06cda6c1263c3dfd525ca4b8b96fa41d6ec4c8919a74d5b5b10bb348ec1d7a7e96e9f307e33f318e44ffa485cce52e2b57a1704671772ed43ee069add6d5c06256d97c653dce05e059caa32c546cda73b5cc4b276687a19067885197717a441317f3ab32a22dc10124dad8809a0a07fab1be409d1f4a33d762bd4c69da51fe23f08ec51c2682206c0f44d398c6bff01dbbc742dcaebfa43b3b7b4044f2fcbe82d10558ab8dc27a99025ad3708daebd43121dc633041d9bad0c20431428b592957ee3d1d383724168643e945801854cb44a8a335afb5bf933aa9726fd34ec35b7900e8fd4c98227316a77ca7283667fa4dfd48b3456d3a5ea84f611236fa28b1520ea8c5afe62ae765a953f0b7d60b8fd1cc19745a0e091d416c4e3da7f13687054519849b5d9a9c9ca637b1af695e28484b0e29d4103cdac8d9e7e7586d881480ed7388e355c69d20fa58e55d524eddfd8d41936d13b8ad7d57a25469bc551b618cb3e3bce01fb3f850863e2eeda392dc95d42df987a50d869dce76e5d39f8c5f8caadd3b0143c0144519226bb0167851943e7aa3e378965c8f2201343e6f2a488449de44fa121baa97418d4cff05ff09b5d99cf714b85ce9d41cb164d18840a5d3c91d5afbd5ad7f42c38262a03f9203cdbc5f07a3a9b4a73cf8d40384a44da8bb80a642bfd8e4211cb31e23e3e1c1f0e8b56cf208eac547c91e560a89d0e7fa6d4cbb864a2d5e79a44437c8bd3ba6dd293ca54af89db518421501be4a1fcb0b505674eb718061fcce1fb2826880f3089106857f9f055aebd3ec2e124950ea04165b2c99de751008862848b2c65926af50ab99df4efa8b26665f1a90e4e23e49d8fa54f630f38dd348a22eea64fe2c08ad15cc8a093b7ac4b485140005958d017cc55261ec9f8a5c81e62a4537b55406769011f4aeef87ae1bdff78fc7b63ce5e85a915784417d3306c1e84702e6abeb5e6fae1b48c8870c36c047bf13199330b1b9a5f041367e436903bfd325caaa975d26520550345b89dd9a11fd394bd95408612782827f9bef1f7fc729a96aa8f47684400286800a1de94b913d028b9cd620034eeecc0fd245736d4919b17beaf4002731f65e0208d7d07dfd5f04fe207ed687c222e792941a4775dd6f0e23f90287961a13156473ae86062aaa05bb0a6e3df20046c4faf4f08e521da2131c01687b146479439de74cc9a19ad43d1e5f69995f42da77ac3558165b800a365f34795616f09c73b30b634c5463004d34fa2186492021ec04712231b02a25a5d821fb65357d5e2eddd80fa59a629dc6686443693e97cd4c36427aff7467bb4c0f8107013d4adea5b4ca277cc7a50f31bfd4d65a2ba59d1e47373bf0f3a066720c691a6fdfa648831dcb5271628a64e0ab67790e42faf291b0c00666199b55be4e91f27673113efbd413d96ac26340c005f9cbf5aac2b02dcf0553fc2e45a458ad23dd646c0353eed5c5abe26b8201769b5007a665f8b93603d5d2f42b79d20d8341e400392802b5ea6051794f188624b55ff1d78a1abe", 0xfc85}], 0x2}, 0x0) 6.582754356s ago: executing program 4 (id=6709): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) open(&(0x7f0000000280)='./file0\x00', 0x2a000, 0x32) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0xb56e2e3f2d9728b3, 0x8, 0x8001, 0x0, 0x9, 0x100000003, 0xfffffe0000000001, 0xfa11, 0x65aa}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{}, {0x0, 0x100000000000000}]}, 0x68) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000f80)=@mangle={'mangle\x00', 0x2, 0x6, 0x5c0, 0x420, 0x0, 0x330, 0x260, 0x190, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {0xff}, 0x21}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0xff000000, 0xffffffff, 0xff000000, 0xffffff00], [], 0x0, 0x886}}, @common=@inet=@dccp={{0x30}, {[0x4e21, 0x4e24], [0x4e23, 0x4e24], 0xd, 0x0, 0x4, 0x7}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [0x0, 0x0, 0x0, 0xffffff00], 'veth0_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'sit0\x00', {0xff}}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@empty, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x50, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x620) r3 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0x1e) ioctl$TCSETSW2(r5, 0x80047437, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r3, 0xffffffffffffffff, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x4c00, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x0, 0x10000000, 0x7, 0x101, 0x7, 0x7, 0xc30, 0x6, 0x6b0}, 0x0) 6.285605613s ago: executing program 2 (id=6711): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x402, 0x0) ppoll(&(0x7f0000000200)=[{r0, 0x1, 0xa00}], 0x1, &(0x7f0000000240)={0x0, 0x3938700}, 0x0, 0x0) 6.235305668s ago: executing program 5 (id=6712): fsopen(&(0x7f0000000580)='overlay\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000102505a1a44000000001010902440001fd00000009040000ff0202ffff052406000005240000000d240f010000000000000000000905810320000000000905820220000000000905030208"], 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48}) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r4, 0x4611, 0x3) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r7, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000000c0)={[0x1, 0x3, 0x100000008, 0x7f, 0x1, 0x0, 0x2, 0xfffffffffffff804, 0x0, 0x0, 0x0, 0x2000000000000, 0x7, 0x7, 0x1, 0x8], 0xeeef0000, 0x4fb40}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x6, 'veth1_to_bridge\x00', {0x1}, 0x102}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$FBIO_WAITFORVSYNC(r4, 0x40044620, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) dup(r8) socket$netlink(0x10, 0x3, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r9, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0xff, "810000cc2b000000000000fa25ffff00ffffff"}) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x102800) 6.131413635s ago: executing program 3 (id=6713): setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r3, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000001200)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, 0x8, 0x0, 0x0}}, 0x10) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) r4 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f0000000040)={0x0, 0xfff, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0x489aa92e}, {0x5}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x3}}, 0xfffffffd}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0xd) write$binfmt_aout(r7, &(0x7f0000000280)=ANY=[], 0xff2e) ioctl$TCFLSH(r7, 0x540b, 0x1) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="e00000001500010028bd7000fddbdf25637279707464286563622d6165732d6e656f6e290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002000"/224], 0xe0}, 0x1, 0x0, 0x0, 0xc000}, 0x20040000) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x28182, 0x0) 6.103077055s ago: executing program 2 (id=6714): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) r2 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc4c85513, 0x0) r5 = epoll_create1(0x80000) io_setup(0x2dd8, &(0x7f00000000c0)=0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5}]}, &(0x7f0000000140)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r7, 0x84, 0x22, &(0x7f0000000080)={0x5, 0x1, 0x251, 0x80, r8}, 0x10) io_submit(r6, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x85, r5, 0x0, 0x0, 0x0, 0x0, 0x2}]) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000140)={0x2016}) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x2, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x20000091}, 0x10) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r2, 0x0, 0x0) r10 = openat$cgroup_pressure(r9, &(0x7f0000000800)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r10, &(0x7f0000000040)={'some', 0x20, 0x17e, 0x20, 0x100002}, 0x2f) io_submit(0x0, 0x0, &(0x7f00000000c0)) 5.840548909s ago: executing program 2 (id=6715): socket$can_raw(0x1d, 0x3, 0x1) r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$inet6(r0, 0x0, 0x8000) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000002, 0x40032, 0xffffffffffffffff, 0x40000000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e61, 0x2, @loopback, 0x7fffffff}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) writev(r1, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "369f1eae", "bb10000000000001"}, 0x28) readv(r1, &(0x7f0000000e40)=[{&(0x7f0000000f40)=""/250, 0xff1}], 0x1) 5.171071255s ago: executing program 4 (id=6716): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000080)={@mcast2={0xff, 0x5}, 0x2a4, 0x0, 0xff, 0x3, 0x0, 0x2}, 0x20) 5.131289957s ago: executing program 2 (id=6717): syz_usb_connect(0x3, 0x3f, &(0x7f00000003c0)={{0x12, 0x1, 0x310, 0x44, 0xb0, 0x69, 0x8, 0x1199, 0x6893, 0x16b7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x2, 0x3, 0x5f, 0x60, 0x5, "", [{{0x9, 0x4, 0x5c, 0x9, 0x0, 0x9f, 0x3a, 0xa5, 0x6}}, {{0x9, 0x4, 0x78, 0x8, 0x1, 0xc0, 0x22, 0x3b, 0x2, [], [{{0x9, 0x5, 0xe, 0x10, 0x0, 0x5, 0x6, 0x80, [@generic={0x9, 0x4, "5c040336c0ba6d"}]}}]}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x80800, 0x4) r0 = open_tree(0xffffffffffffff9c, 0x0, 0x1803) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-224\x00'}, 0x58) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) sendmsg$inet(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x8084) accept(r1, 0x0, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r4, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x2c, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x20, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'team_slave_0\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xa0}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000030900010073797a310000000018010000030a010400000000000000000100ffff0900030073797a31000000002000048008000140000000051400030076657468315f6d6163767461700000000900010073797a3100000000280008"], 0x160}}, 0x0) setsockopt$inet_int(r4, 0x0, 0x14, &(0x7f0000000140)=0x1, 0x4) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f00000002c0)=ANY=[@ANYBLOB="ffffffffffffffffffffffff0800450000200065000000119078000000000000950000084e20000c907801000000b9209cf45bad05e15e0e38ce0f72b3990884034a108159cc22dbb0cc561e5d766652569813eda466807def4c2755f2e9d4bbea49f40ae65d"], 0x0) bind$vsock_stream(r3, &(0x7f0000000440)={0x28, 0x0, 0x2711, @host}, 0x10) listen(r3, 0x7ff) socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @my=0x1}, 0x10) r7 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r7, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7}]}) 5.112323879s ago: executing program 4 (id=6718): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="120100007882b740422c0917b7ca010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000280)=ANY=[@ANYBLOB="000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x1ff, 0x1, 0x8004}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001300)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x3}, {0x9, 0xfff1}, {0x2, 0xb}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x0, 0x7, 0x8, 0x8, 0x0, 0xe09, 0x0, 0x9, 0x717a, 0x2, 0xd, 0x8, 0x5, 0x10a1, 0x80000001, 0x200, 0x3, 0xeeb, 0x81, 0xc, 0x3, 0xffffffff, 0xfff, 0x1, 0x99bd, 0xc, 0x10000, 0x9, 0xfc57c70, 0x3ff, 0x8, 0x6, 0xc, 0xa00, 0x1b, 0x8e, 0x4, 0x4, 0x9, 0x7, 0x6, 0xa160, 0xbee, 0x4, 0x100, 0xc2, 0x800, 0x3b1, 0x6, 0x100, 0x1000, 0x5, 0x9, 0xec4, 0x8000, 0x0, 0xedf, 0x5, 0xd, 0x2, 0x97, 0x7fffffff, 0x7, 0xd85, 0x81, 0x3, 0x6, 0x101, 0x6, 0x4, 0xbffffc00, 0x7, 0x9, 0x6, 0x4, 0x7c, 0x3, 0xd84e, 0x0, 0x1, 0x8, 0x7, 0xffffffff, 0xf8, 0x4, 0x5, 0x401, 0x440, 0xb3, 0x7fff, 0x400, 0x6, 0x7ff, 0x6, 0x3, 0x1, 0x5, 0x3, 0x9, 0x2, 0xffffffff, 0x7, 0x0, 0x375f, 0x8, 0x1, 0x4, 0x4, 0x0, 0x6, 0x0, 0xaa5, 0x9, 0x800, 0x2, 0x81, 0x4, 0x9, 0x4a20a1a8, 0x8, 0x80000001, 0x0, 0xfffffffa, 0x3, 0x7, 0x4, 0x5, 0xc, 0x36, 0xf, 0xff9b, 0x68, 0x80000001, 0x401, 0x4, 0xff, 0x2e3, 0xc, 0x9, 0x3, 0x2, 0x0, 0x2452, 0xab, 0x5, 0x8, 0x8, 0x9, 0x10000, 0x1000, 0x7, 0x9, 0x1ff, 0x4a0, 0x0, 0x3, 0xc0, 0xffffffff, 0x7, 0x1, 0xa94a, 0x4, 0x101, 0xffffffff, 0xd7, 0x5, 0x8, 0x395, 0x7, 0x8, 0x6, 0x7fff, 0x10000, 0x80000001, 0x0, 0x5, 0x18000, 0x5, 0x6, 0x5, 0x2, 0xd146, 0x8, 0x6, 0x1, 0xf17, 0x9, 0x7, 0xffffffff, 0x7, 0xff, 0x1, 0x7, 0x81, 0x2, 0x8, 0x6, 0xfff, 0x2, 0x6, 0xff, 0x5, 0xac000000, 0x8000, 0x9, 0xe, 0x9, 0xa39, 0x9, 0x25, 0x5, 0x7, 0x9, 0x928800, 0x7fffffff, 0x2, 0x0, 0x1, 0x1, 0x8ef1, 0x9, 0x4, 0x0, 0xffffffff, 0x2, 0x10, 0x1, 0x7fffffff, 0x6, 0x5, 0x7, 0x200, 0x80, 0x7, 0x1000, 0x9, 0x71, 0x6, 0x7, 0x7, 0x3, 0x1, 0x5, 0x4d0, 0x0, 0x9, 0x7f, 0x800, 0x8, 0x0, 0x1, 0xfffffffd, 0x4, 0x80000000, 0x4cd, 0x1fd]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x20008091}, 0x4000000) syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000002c0)=0x9, 0x4) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@deltclass={0x24, 0x29, 0x1, 0x6, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfffe}, {0x0, 0xffe0}, {0xb, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0xd1}, 0xc010) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000007c0)=@newqdisc={0x2b0, 0x24, 0x1, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff2}, {0xffff, 0xfff9}, {0x5, 0xfff1}}, [@TCA_STAB={0xc0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0x0, 0x0, 0x8, 0x2, 0xd8d3, 0x844, 0x1}}, {0x6, 0x2, [0x0]}}, {{0x1c, 0x1, {0x8, 0x2, 0x8, 0x0, 0x0, 0x4, 0x200, 0x9}}, {0x16, 0x2, [0x2, 0x8000, 0x101, 0x401, 0x9af, 0xde, 0x3, 0x9, 0xe9]}}, {{0x1c, 0x1, {0x3, 0x3, 0x6, 0xffffffff, 0x1, 0x7ff, 0x4, 0x7}}, {0x12, 0x2, [0x8, 0xc, 0x0, 0x81, 0x9, 0x1ff, 0x7]}}, {{0x1c, 0x1, {0x0, 0x1d, 0x7d, 0x7, 0x2, 0x8, 0x2, 0x9}}, {0x16, 0x2, [0x4, 0x7, 0x0, 0x6, 0xfff9, 0x3, 0x8e5, 0x8001, 0xe98]}}]}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x459}, @TCA_EGRESS_BLOCK={0x8}, @TCA_STAB={0x110, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xa, 0xa, 0x6, 0x0, 0x1, 0x8, 0xb58, 0x3}}, {0xa, 0x2, [0x5, 0x9, 0x957]}}, {{0x1c, 0x1, {0x2, 0x5, 0x6, 0x3, 0x1, 0x7, 0xc, 0x9}}, {0x16, 0x2, [0x377, 0x9, 0xf001, 0x6, 0x7, 0xfffe, 0xa25b, 0x6, 0x6]}}, {{0x1c, 0x1, {0xfe, 0x6, 0x5, 0x3, 0x2, 0x5, 0x8}}, {0x4}}, {{0x1c, 0x1, {0x7f, 0xff, 0x7fff, 0x8, 0x1, 0x0, 0x5, 0x7}}, {0x12, 0x2, [0x4, 0x9, 0x9, 0xf7, 0x8, 0x78fa, 0x4]}}, {{0x1c, 0x1, {0x77, 0x4d, 0x0, 0x6, 0x1, 0x0, 0xffffffff, 0x7}}, {0x12, 0x2, [0x1, 0x7, 0x60, 0x3, 0x4, 0xc, 0x1]}}, {{0x1c, 0x1, {0x4, 0x6, 0x80, 0x6aa5, 0x0, 0x6, 0x0, 0x7}}, {0x12, 0x2, [0x657b, 0x5, 0x9, 0x1, 0xc, 0x5, 0x8]}}]}, @qdisc_kind_options=@q_hhf={{0x8}, {0x34, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x8, 0x3, 0x265bfeb9}, @TCA_HHF_BACKLOG_LIMIT={0x8, 0x1, 0x80000000}, @TCA_HHF_HH_FLOWS_LIMIT={0x8, 0x3, 0x1}, @TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x2}, @TCA_HHF_BACKLOG_LIMIT={0x8, 0x1, 0x6}, @TCA_HHF_QUANTUM={0x8, 0x2, 0x1}]}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0xe5}, @TCA_STAB={0x68, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0xc, 0x0, 0x4, 0x0, 0x9, 0xab0, 0x1}}, {0x6, 0x2, [0xeb]}}, {{0x1c, 0x1, {0x6, 0x6, 0x8000, 0x8, 0x0, 0x146}}, {0x4}}, {{0x1c, 0x1, {0xb9, 0x5, 0x7, 0x7, 0x2, 0x10, 0x80000000}}, {0x4}}]}]}, 0x2b0}, 0x1, 0x0, 0x0, 0x41}, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x0, 0x800, 0x0, 0x4, 0x10000000}, 0x0, &(0x7f0000001340)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x6, 0xfffffffffffffffe}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1800000098fc8b70eab0cf6f7e4cffffffff1a3b1254b4bf13ed18d5280000000000fcffffff556707a799", @ANYRES16=r6, @ANYBLOB="05072ebd7000ffdbdf250100000004000280"], 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x0, 0x800, 0xbbba, 0x0, 0xf, 0x0, {}, {0x0, 0xfffffffd, 0xfffffffe}, {0xffffffff, 0xffff0000}, {0x1000000}, 0x0, 0x3f0, 0x0, 0xd611, 0x0, 0x2, 0x0, 0x6, 0xcd0, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x7}) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = ioctl$KVM_CREATE_GUEST_MEMFD(r11, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION2(r11, 0x40a0ae49, &(0x7f0000000180)={0x4, 0x4, 0x6000, 0xa7000, &(0x7f0000ffc000/0x2000)=nil, 0x0, r12}) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r13, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000001140)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r14, @ANYBLOB="01002abd7000000000001a0000000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x4040880}, 0xd0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000200)={0x1ff, 0x4, 0xa000, 0x2000, &(0x7f0000ffc000/0x2000)=nil}) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000800)=ANY=[@ANYBLOB="04010000", @ANYRES16=r8, @ANYBLOB="0100000000000000000001000000060006000000000024000300a0cb879a47f5bc644c0e693fa6d031c74a1553b6e901b9ff2f518c78042fb542b0000880ac000080060005000000000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff200004000a00fffc00000000ff020000000000000000000000000001000000001400040002000000ac1414aa00000000000000004800098028000080060001000a0000001400020000000000000000000000ffffe000000205000300000000001cbcb47def472350ce00000008000200e0000002050003000000000014000200776730"], 0x104}}, 0x0) 4.911252019s ago: executing program 6 (id=6719): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) open(&(0x7f0000000280)='./file0\x00', 0x2a000, 0x32) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0xb56e2e3f2d9728b3, 0x8, 0x8001, 0x0, 0x9, 0x100000003, 0xfffffe0000000001, 0xfa11, 0x65aa}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x60, &(0x7f0000000080)={'filter\x00', 0x1058, [{}, {0x0, 0x100000000000000}]}, 0x68) execveat(0xffffffffffffff9c, 0x0, 0x0, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000f80)=@mangle={'mangle\x00', 0x2, 0x6, 0x5c0, 0x420, 0x0, 0x330, 0x260, 0x190, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x4f0, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {0xff}, 0x21}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0xff000000, 0xffffffff, 0xff000000, 0xffffff00], [], 0x0, 0x886}}, @common=@inet=@dccp={{0x30}, {[0x4e21, 0x4e24], [0x4e23, 0x4e24], 0xd, 0x0, 0x4, 0x7}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [0x0, 0x0, 0x0, 0xffffff00], 'veth0_macvtap\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x5}, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'bridge0\x00', 'sit0\x00', {0xff}}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@ipv6={@empty, @local, [0xff, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x50, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x620) r3 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x80045440, &(0x7f00000000c0)=0xe) ioctl$TCSETSW2(r5, 0x80047437, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r3, 0xffffffffffffffff, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x4c00, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x0, 0x10000000, 0x7, 0x101, 0x7, 0x7, 0xc30, 0x6, 0x6b0}, 0x0) 4.621941118s ago: executing program 3 (id=6720): r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r1 = eventfd(0x6) r2 = memfd_create(&(0x7f0000000180)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aWpA\xd4\x98\x85K\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/m\xdf\xb6]\xc2\xaa\x86\xec(\xf7\xcd\xa6\xd9n^.\x13*\xd4\xb8\xe8\xc4\xefb\x14Vx\xc6\xfe\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97$\xee\x84\x14n,B\xd5?\xe5E:+Pm\x1d\xb4\xb8\xeb\xe8Op2\x82\xc7\x0e\x97\x03\xef\x1a\xa5\x00.\x89\b!m\f\xd9\x8b$}\x9f\fX\x81\xa8\xf6\x94\xbc\xed\x80|l]\xe9\xca\xd3\xc9\xa3\x9e\x9cJI\xf1\xa2\xa0\xc4:\x00\x00\x00\x00\x00\x00\b\x00\x00', 0x0) pipe2(&(0x7f00000002c0)={0xffffffffffffffff}, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r4, 0xaf02, 0x0) splice(r3, 0x0, r2, &(0x7f0000000140)=0x8008, 0x7ffffffffffffffc, 0x3) ioctl$KVM_IRQFD(r0, 0x4020ae76, &(0x7f0000000040)={r1, 0x8, 0x2, r3}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r6, 0x89b0, &(0x7f00000001c0)={'macvtap0\x00', &(0x7f0000000740)=@ethtool_pauseparam={0x0, 0x114, 0x17f, 0x989a}}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r5, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f0000000000)=[{0x6, 0xfd, 0xc, 0x43}]}, 0x10) getsockopt$sock_buf(r8, 0x1, 0x1a, 0x0, &(0x7f00000003c0)=0x4d) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16, @ANYBLOB="ff83"], 0x4}}, 0x0) sendfile(r9, r5, 0x0, 0x100000000) socket$nl_netfilter(0x10, 0x3, 0xc) 4.512908985s ago: executing program 3 (id=6721): mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000002, 0x40032, 0xffffffffffffffff, 0x40000000) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = msgget$private(0x0, 0x7fc) msgrcv(r0, 0xffffffffffffffff, 0x0, 0xf07f7a83ffffffff, 0x1000) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000040)=0x1, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bridge0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) r5 = openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r5) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0) clock_adjtime(0x0, &(0x7f0000000e00)={0xe62b, 0x80000000000000, 0x309, 0x0, 0x8000, 0x9f69, 0x0, 0x200000000002000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x30, 0x80000001, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$VIDIOC_S_CROP(r5, 0x4014563c, &(0x7f0000000100)={0x2, {0x2, 0x401, 0x1, 0xff}}) syz_open_procfs(0x0, &(0x7f00000002c0)='net/igmp6\x00') r6 = socket(0x10, 0x3, 0x0) write(r6, &(0x7f0000000000)="240000001a005f0314f9f407000904000200000001000000000000000800040001000000", 0x24) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r7, 0x0, 0x0) 2.895773295s ago: executing program 6 (id=6722): r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32}}}}}}]}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000006d0001002dbd7000fadbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0a0000000028000018003480140035006d6163766c61ee310000000000000000140035006d6163767461703000"], 0x4c}, 0x1, 0x0, 0x0, 0x4000005}, 0x40000) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x20, 0x21, 0x8, {0x8, 0x11, "e4ff14eca81f"}}, 0x0}, 0x0) 2.88024546s ago: executing program 5 (id=6723): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="12010000e3ddef20501da1604fa1010203010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000140), 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000540)={0x34, &(0x7f00000005c0)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000380)={0x44, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.556201869s ago: executing program 4 (id=6724): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x7, 0xe0942) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000500)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x14, 0x14, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd0000000000f9ff00", [0x7, 0x400]}}) fallocate(r1, 0x11, 0x0, 0x5345) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000080)={0x20, 0x2, 0xdb, {0xdb, 0x0, "dd7de198e61f6ccd01a0060f499468f710cce155df924699727e20c1d3e789b23816c522a33749e3943dbf25d42fcdab488a9af9ca44de65831fc33ce799865d5b5332edbe031f0ad94b18328414d740a1d75d7922576e6f9d13645ca24816aec78c4479173708dcae66ebe882e4731cdfefad39362ce02f0a2bc8ff3c17d51cad325ef1533d6a425693ab4f83fd3bec85d99d9c0dce69d24657d7ace51daedaa7ee2bbb87265114abda196497ebf5be4e1b01ef6ce8356ef1ef6b128c23c41851bf79792765b8cd0945a544b391bfb2777667b9c7b009950c"}}, &(0x7f0000000180)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000480)={0x44, &(0x7f0000000200)={0x0, 0x6, 0x9f, "14e3669ddf62f1d69a64ac1747beef507de227a0bca43d2f9c19e82fd906d9a239f4171f829835f1fb1111ee4e7fc90c5ed267a8d3c2f7fe99f5858c877df57e2f1493bd3ed4b2929403a36675efcf2be21b4c4acf0b2bdf4515f2b8786089e786cba6606ae2b01ace38fad11b4415c2c9a48ccaeb8e8b8f3b7bbba12a33a1876037841e02bf18d25cf9b3723a5e0b2f4610dcec5a5c34fc48452aded43804"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000000340)={0x20, 0x80, 0x1c, {0x8, 0x3, 0x8811, 0x800, 0xfff, 0x7556, 0x800, 0xfffffff9, 0x9, 0x0, 0x2, 0xb}}, &(0x7f0000000380)={0x20, 0x85, 0x4, 0x5}, &(0x7f00000003c0)={0x20, 0x83, 0x2}, &(0x7f0000000400)={0x20, 0x87, 0x2, 0x3e4}, &(0x7f0000000440)={0x20, 0x89, 0x2, 0x1}}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000006c0)={{r2}, &(0x7f0000000000), &(0x7f0000000680)='%-5lx \x00'}, 0x20) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000035ffaa20cd0caf104a380102030109021b0001000010000904590201801e2a00090582"], 0x0) (async) syz_open_dev$loop(&(0x7f00000000c0), 0x7, 0xe0942) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a00)='blkio.bfq.empty_time\x00', 0x275a, 0x0) (async) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) (async) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000000500)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x14, 0x14, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd0000000000f9ff00", [0x7, 0x400]}}) (async) fallocate(r1, 0x11, 0x0, 0x5345) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000080)={0x20, 0x2, 0xdb, {0xdb, 0x0, "dd7de198e61f6ccd01a0060f499468f710cce155df924699727e20c1d3e789b23816c522a33749e3943dbf25d42fcdab488a9af9ca44de65831fc33ce799865d5b5332edbe031f0ad94b18328414d740a1d75d7922576e6f9d13645ca24816aec78c4479173708dcae66ebe882e4731cdfefad39362ce02f0a2bc8ff3c17d51cad325ef1533d6a425693ab4f83fd3bec85d99d9c0dce69d24657d7ace51daedaa7ee2bbb87265114abda196497ebf5be4e1b01ef6ce8356ef1ef6b128c23c41851bf79792765b8cd0945a544b391bfb2777667b9c7b009950c"}}, &(0x7f0000000180)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000480)={0x44, &(0x7f0000000200)={0x0, 0x6, 0x9f, "14e3669ddf62f1d69a64ac1747beef507de227a0bca43d2f9c19e82fd906d9a239f4171f829835f1fb1111ee4e7fc90c5ed267a8d3c2f7fe99f5858c877df57e2f1493bd3ed4b2929403a36675efcf2be21b4c4acf0b2bdf4515f2b8786089e786cba6606ae2b01ace38fad11b4415c2c9a48ccaeb8e8b8f3b7bbba12a33a1876037841e02bf18d25cf9b3723a5e0b2f4610dcec5a5c34fc48452aded43804"}, &(0x7f00000002c0)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000300)={0x0, 0x8, 0x1, 0xb}, &(0x7f0000000340)={0x20, 0x80, 0x1c, {0x8, 0x3, 0x8811, 0x800, 0xfff, 0x7556, 0x800, 0xfffffff9, 0x9, 0x0, 0x2, 0xb}}, &(0x7f0000000380)={0x20, 0x85, 0x4, 0x5}, &(0x7f00000003c0)={0x20, 0x83, 0x2}, &(0x7f0000000400)={0x20, 0x87, 0x2, 0x3e4}, &(0x7f0000000440)={0x20, 0x89, 0x2, 0x1}}) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000006c0)={{r2}, &(0x7f0000000000), &(0x7f0000000680)='%-5lx \x00'}, 0x20) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000640)={0x3, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) 2.198663318s ago: executing program 3 (id=6725): unshare(0x20000400) r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYRESDEC=r2, @ANYRES8, @ANYRESHEX], 0x2c}, 0x1, 0x0, 0x0, 0x8060}, 0x20000000) setsockopt$sock_timeval(r0, 0x1, 0x14, 0x0, 0x0) timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000b80)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r4 = eventfd2(0x0, 0x1) read$eventfd(r4, &(0x7f0000000040), 0x8) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x2c, &(0x7f0000000000)=ANY=[@ANYRES32=0x0], 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r7, &(0x7f0000000180)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e24, @rand_addr=0x64010101}}, 0x24) bind$rxrpc(0xffffffffffffffff, &(0x7f00000004c0)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e24, @broadcast}}, 0x24) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) socket$inet_smc(0x2b, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 2.176905132s ago: executing program 5 (id=6726): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC2(r2, 0x4068aea3, &(0x7f0000000140)) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [{0x400000b0, 0x0, 0xbc7d}, {0x400000b1, 0x0, 0x800000006}]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) add_key(&(0x7f0000000100)='rxrpc\x00', 0x0, &(0x7f0000000140)="0000000000000004ff6943b8fe00000800000014f200000000861f4104bfeacd", 0x20, 0xfffffffffffffffb) 2.030080564s ago: executing program 2 (id=6727): socket$can_raw(0x1d, 0x3, 0x1) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000002, 0x40032, 0xffffffffffffffff, 0x40000000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e61, 0x2, @loopback, 0x7fffffff}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) writev(r0, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "369f1eae", "bb10000000000001"}, 0x28) readv(r0, &(0x7f0000000e40)=[{&(0x7f0000000f40)=""/250, 0xff1}], 0x1) 1.878485427s ago: executing program 5 (id=6728): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x20008000) (fail_nth: 7) 1.545287246s ago: executing program 5 (id=6729): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipv6_route\x00') ioctl$vim2m_VIDIOC_DQBUF(r5, 0xc0585611, &(0x7f0000000100)=@mmap={0x8, 0x1, 0x4, 0x2000, 0x1, {}, {0x1, 0x1, 0x7, 0x78, 0xd2, 0xf, "bc2d4ca6"}, 0x9, 0x1, {}, 0x9}) sendmsg$nl_xfrm(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0x1d0, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x180, 0x11, [{@in6=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00', @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2b, 0x2, 0x0, 0x3501, 0x2, 0x2}, {@in=@multicast1, @in=@local, @in6=@private2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x33, 0x4, 0x0, 0x34ff, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x35}, @in=@local, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3c, 0x0, 0x0, 0x0, 0xa, 0x8}, {@in=@private=0xa010102, @in6=@empty, @in=@local, @in6=@dev={0xfe, 0x80, '\x00', 0x3f}, 0x3c, 0x0, 0x0, 0x3505, 0x2, 0xa}, {@in=@loopback, @in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x33, 0x4, 0x0, 0x3503, 0xa, 0x2}]}]}, 0x1d0}}, 0x0) bind$tipc(r2, 0x0, 0x0) r6 = socket$tipc(0x1e, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x21, &(0x7f00000005c0)=ANY=[@ANYBLOB="183f000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000030000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000018110000", @ANYRES32, @ANYBLOB="0000000000000000d5080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r7, 0x407, 0x8000b) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r8, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000b2"], 0x5b0}, 0x20008001) sendmsg$inet6(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)="ef38df273fc935b005d380e9f6696d255b9514052a1b756b91083e499f7bb421796c44b950615f6f7d41", 0x2a}, {&(0x7f0000000600)="7e2f13319f5ba68052aecbc9e8faf501d6f209417f73bd29f751b420bf51f813683947e8e63f1888593969adf3913a215e5e150d309dbfd15334631756e76059d86e0d42c918f0bcb4cbc28a3d71a52285fd9045e3853cd3c0cfc76f71de7f2474c4c4bb6c201b43d80a509c9d0f1365b026ab41e2140695903b86e1d5a27a27fced6360709c662712c37ba3dd86d3a8ace3ffeeb108497f87b94cafd91d50956ba86714090c6bb902e9187a201fdf2b7034cc064d3bf4e40876b9acab7687258f6407e1d8613b8be94684f68cb76f202873fff97008614b2c110eebc8f4090480fbfe0361e1e65b97f19d6078ea6ec03c5ee3aaf8f0cc5300895134ab81087cc55161abc527331c03ecfa01ac01319d9ba949d4519c2b46a7dcaa9e87cc2b28181a9549b5bdc7192cb2a9398720ed1f01509561767f2d11ed4f52cbc6012dca85fbc6739a54562ede8ff2886adc1ba78363ba4528223e0e4977c5471383c8748e0afd2a4e65dd9584cbb7adc0678404c1e9c15e37c25ad4d5c9ddffabe101eb82321b79c36329e5ef9d783afb0add226b74a1e39b6d2cce3504411513e89e94612db022606db2af33b387bea85b317f803bf18e3ae361890ad1fabdb03d4e942d1dd623b649ced2c518e6a906f3c5c176fcb6cb7439a88fe77d828944edf63ca179412f7d91d636b69e0147cbf033d2393100d2844bd84fc8bc4d32757d158935a7efebe8419048082103be7864d16adc35cfa3b25d5bf6889f16b94e5745e24626ae4bea76684f93420ef4243d6ac80ef86088da3f59c64d776659fc4fedaccc02f51dc05db81e387c18766bd5dd3fe703d6a91f12406388e990e8c919f49ad7969459a0cfa291bd1440ae4208849e67984c7d9e0c8ed5e639eb77feb87bed3d08d2a89d504ab40e3f76d090e602604a973f4b1683347d1a53b4ce215b63b69079b76afc8b2ae199f88f7f87b90b2392f27293a79c40737ffa23f99c2880a64445f65dae56263a945a6e98ccc4a3febbd85fb837bdde5e0d4bf9bc4c801ac2afda5c2668da61ba526321600f1795a31fa067f337c7115eef024edb641c859f7ba1460adeef04da39e1376d5255a885bd01ae3c27dd2699bfc1ceae35008a61cee317a704eee9443d0d95a371be776e5646201e544bc19561a22ed7e82d41eac30dfbc26ac19af1b7ead8de446a0f290aafaced0d8db1b9a88ab0c3f77352a39149ae9bd1532f435083eb3deafbb78f43216be6f5cc164a6d67b2c87b6d319db9fce2023b6525ba888f727398ecd77c3dd36a4828cb613803600a3dd2beb0885b100bda9f6db1130c0cdc1faa3d03e6194abfe08d3b9a73585f40a2024f2e9a2e901dc1f88532c43e36a7e361212c419006a42e20092afc03715a1979ceaf2530d651231b61a2cefc8585f4c629a2853750bdf79495a896bf94793549aeacf6d0d0c2c860e976451177c0f736969b06da6c2f80ed40790fac339ee8aba0e9d6a394246486f5b0ebb1a66bd4a2fac1015e84af8be1ad7dd1c2bf96da9067fb18e798759eb02a81773462eaf9c71c007b1cc4df7f0e421063ad041c4d5b59f444d0fa9a952f9ed5b9dbab482928c9dd2ed960ed61f92c4ab7e3673c3a9430defdb6f16d555c5e1baa8d7c5bd705e53640951a84bc41942b7232eee96ec28599a37e32f02aa6e1e99ab41bd77613b0fd988b32ba2aecdfd03afc9df5a5389ed7db7cada460b02fcc5788990d82ab87ed95337b0dbbcd875a19fd2aaea69bdc0e6a4a62ae417e6abd393b7a42ebff7c2ef9bd702168a64fdebd22b154a75029e033ffeebbba83bf76428f4e1400ee54d13ee842646965a15cf63f34705d1fb63ddf4bd1caded6147b0d6a1acc6bac4e9ea4ae024d5c226554be37ab62b754bcbd71dbbaab17664267d035e31fa6f1260b1bb94f8bad65c289717a833d4e164dbc7c1d62cfbd6e121d4944e4716ea304dfb2457f36c2725537947ba9597d29b22bac11f008f24fe37187c4780aaef80b9e3444d610c1a01ef37c4dbc53440547d0f94d90ddef7ddc86e35c0bcc2dd9d2aea4532b20feb8579a922464dfcfe965538ee13ace8c7e1b2321bde8dae0a0ef2e1bfce793992cc67a39be3b6189f0dc24a791157d4821f242e2a9709d469272584b3db4abd60ce0a2c09a46b715aab0048a0ac84ac0d55763ebcafed1ffe45310f97ebecf48f61e33cfa1cff0164f1def00ce05045dee97669b2de718d17e4cf8cee5f000eae701117f7fc43445395b73cf7a002568bdc5345143bda028e0f742f4c299b23fac0ed92665ae1968549d1cdbeb7c17eb96dc079be83a7a74e5b15497e94de3bdfee822ca7de3cd1d0e8cda82476ae4bdb72341e93be67efb78ebb38930c07ce99fccb433465b539b16f32486ccb975c0ec219528df37b61b6105c3ecbe2c0feb328e4034e778592887ce167f9eeec04f9c8d11753d6d8e0798c7932cefcf9bc7b8c9d30688fa226e107eede50d6a3ceff7477107b61a12676e261cb9c216d2bfdd4c6475d192df60cc2c16d77e2ddf51b7f67b57dc71bccbc6a84890bcc5f337a0a6915f88bfa40a9dbc2f8ca7221e7f78c375bb68af519b9d3db2227bdcc1d1e449b164c5db8db3ae8db6423194317e55a43b4df9c2b034c26855303f9c68ccb89c8256029864f052c02b41e27d5336ff2350697579ae08bd25dc051e50e67c8df3d247cf59979a2b2291a069b32bbad17af58ce5494f796bad30898594c606220ce178949d9dd2b8355d8e43dbd7e22c069de917660244c1210fded55766da83759310ab1c86cc691d82e04f8dea7efe50d8841959e7fc2d66805cfed5b033a5d3228c1f97ebb8bac373a41df7c1eaaa2a50987f93a81a7aafb331bc1d2bdd0eebc4bec4095e17af3e206a499f054f9c632fc1809ec0b8327bd069039e2b97a951889fbcbc40a63019362aca8a517153c4c74f47629f45faccd72b743abc4a46f3fd34f6ca384278c2e44337f824e2c4272c5ad46322202606d8f4f7dc6a3e5ff865d593b1d75ae4c7f260f98a5d3e231b884c55d497494462baa9ffb2c64a5432f2f238658ffd25ac26ab0b22add514f38fff2ee82b16e623f17690699e12bce3f974511a8f89d5df7cab89abfc84cb565d253535c67ecafb291f27f61b84f1062d029831ce56e2defcfb5aed43fdb68a107b4a25916b7dbdb56b2e324be966201a5668e676f68808e8c7c6e2926857e6bd5d729d9364a46e4ca4659ae160b65f5d97f3d22ebe0e9f357feb31de17ffa313a3f67a25c01d722ade96598a37dedc97173ad9c7478748fa6e57c3edc825bac7c60d4ac4d96ec34626f965510a3b26ca4f4969d1b0c3e8b1e495b12ab392b7fbb34f0932a768957ba6590ab8022f299cfdecb3c3ee4c3cde5722d62e2235da4f4146507d9e022d57ae25ecc1fde4b57b100cfade350673ee61cc1e313f0dcaed5aa18a012d3ad7cea187cdf4921ec55755dbbc9bd9a39d66220bc1e8f4b6f730f337014e52f12a10bc47f277b5214dad60bd9925183ef53c0c9c7b2c1aa7416fa27b46398b7cbee31a4b416ad0f189d2e0d5e2bfbd8e0e5e1e1f59ec1c635cac00a0b75fe2a3b9916e5c8de9b574385e51fb10704b9901fd90803d7d0e67544975fdf516f0df1d7d0bd7520b618d92b3bfc07c468edd9f53796c80d78987b761b07021d5f4ad07a5f94307f7939c4747e65df8037e9ce268641dba4ffc348bbe4ae3f1844c5f761a6d02c18e389f5776bfbcae20e2e588ffc5465f5954665fea1c9cac6cf5691ca6e1f54e6dd774be7a0bfe87f6adb839572138765e14c2ab04c373ab3fd801dd9f639c886977320affe425dacc7aef1f1b069aacb0b9b94b202bb8fddcc2e07c925dfe750047ec1bccc3a50e5c3319e38b0946a4309bd1a99a033454e36a7af99f3cbf63c6804c9933a8080b445e38a269ef3cf8167ec4818800c800f8a6e17f85ee87bd6ca8005cd1fe1a304034c11f641b195811b40bd15d9386c18e3a47c32025869bc16e149456e1a6cc4cf9cedc18d8f81b50c2ec9e0efee451e8c44c920a81acb7693ea9a20dc996e7185dfd96cf6bdcd66f4e7959a5ba83f05ca7ece986cdfffe1a065b9223b21c11b093eb95f6", 0xb5f}], 0x2}, 0x20008004) r9 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_ENUMINPUT(r9, 0xc050561a, &(0x7f0000000540)={0x3, "2a123b084c1295533fd0a4bb9ad6ca7be3ced96f00000000000100", 0x0, 0xfffffffe, 0x1, 0x7, 0x4000200}) 1.173712103s ago: executing program 2 (id=6730): setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={r3, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000001200)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13, 0x8, 0x0, 0x0}}, 0x10) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) ioctl$PAGEMAP_SCAN(0xffffffffffffffff, 0xc0606610, 0x0) r4 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, 0x0) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc100565c, &(0x7f0000000040)={0x0, 0xfff, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0x489aa92e}, {0x5}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x3}}, 0xfffffffd}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x123f41, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0xd) write$binfmt_aout(r7, &(0x7f0000000280)=ANY=[], 0xff2e) ioctl$TCFLSH(r7, 0x540b, 0x1) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="e00000001500010028bd7000fddbdf25637279707464286563622d6165732d6e656f6e290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002000"/224], 0xe0}, 0x1, 0x0, 0x0, 0xc000}, 0x20040000) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x28182, 0x0) 824.020221ms ago: executing program 6 (id=6731): syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x40182, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x10, 0x0, 0x1, 0x0, 0x0, 0x20004090}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x5, 0x8, 0x8005, 0x0, 0x9, 0x1000000000, 0x7, 0xfa11, 0x6}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x10, r0, 0x4000) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x14, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x8000) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, 0xffffffffffffffff, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x16ba82, 0x10) write$cgroup_int(r5, &(0x7f0000000180)=0xfe5f, 0x12) ioctl$VIDIOC_SUBDEV_G_FMT(r5, 0xc0585604, &(0x7f00000001c0)={0x0, 0x0, {0x4d39580f, 0x2, 0x3008, 0x3, 0xb, 0x6, 0x1}}) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000fe857108480b0730644f0102030109021200"], 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r6 = syz_open_dev$I2C(0x0, 0x1, 0x402) pwrite64(r6, 0x0, 0x0, 0x26c) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) sync() modify_ldt$write(0x1, &(0x7f0000000040)={0x806, 0xffffffffffffffff}, 0x10) r7 = gettid() rt_sigqueueinfo(r7, 0x14, &(0x7f0000000380)={0x6, 0x8, 0x10}) 227.258307ms ago: executing program 3 (id=6732): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) syz_usb_connect(0x5, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010102a2913a086307151033390102030109022d00010919301b0904a00603ff7cec090905d6011000840a0709050c02200008090909050e100002027f00"], &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in=@rand_addr=0x64010102, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4e20, 0x0, 0x4e22, 0xc, 0x2, 0x0, 0x0, 0x89, 0x0, 0xee01}, {0x2e6, 0xfffffffffffffffe, 0xfffffffffffffffe, 0x0, 0x4, 0x2, 0x101, 0x1}, {0x1, 0x0, 0xf, 0x1ffffffffe}, 0x20, 0x0, 0x1, 0x0, 0x2}, {{@in=@loopback, 0x0, 0x33}, 0x0, @in=@broadcast, 0x0, 0x3, 0x0, 0x0, 0xff7ffc01, 0xfd3, 0x86}}, 0xe8) listen(r0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @empty}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0x2a401) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f00000001c0)={0xa1, 0x0, 0xdff, 0x3f, 0x0, 0xffffffff, 0x0}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet_sctp(0x2, 0x5, 0x84) close(r3) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x20a00) ioctl$SG_IO(r5, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffe, 0x5, 0x2, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000240)="1e126500a9", 0x0, 0xfffffe00, 0x0, 0x3, 0x0}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x1}], 0x1, &(0x7f00000000c0)=[@sndinfo={0x20, 0x84, 0x2, {0xa, 0x4, 0x28, 0x8, r6}}], 0x20, 0x2400e044}, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000000)={r6, 0x5}, &(0x7f0000000080)=0x8) 0s ago: executing program 4 (id=6733): mprotect(&(0x7f00001b9000/0x2000)=nil, 0x2000, 0x8) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) preadv2(r0, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rpc\x00') fstat(r1, &(0x7f0000002f00)) kernel console output (not intermixed with test programs): h=c000003e syscall=16 compat=0 ip=0x7fc72c79c4ab code=0x7ffc0000 [ 2708.177805][ T3304] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2708.319889][ T5901] usb 5-1: 0:2 : does not exist [ 2709.229976][ T5901] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 2709.439774][ T5901] usb 6-1: Using ep0 maxpacket: 32 [ 2709.462976][ T5901] usb 6-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 2709.482983][ T5901] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2709.541662][ T5901] usb 6-1: config 0 descriptor?? [ 2709.573882][ T5901] gspca_main: sunplus-2.14.0 probing 041e:400b [ 2710.230022][T32329] usb 3-1: new full-speed USB device number 98 using dummy_hcd [ 2710.382683][ T3321] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2710.392995][T32329] usb 3-1: config 5 has an invalid interface number: 123 but max is 0 [ 2710.401518][ T3321] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2710.414710][T32329] usb 3-1: config 5 has no interface number 0 [ 2710.433571][T32329] usb 3-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 2710.458139][T32329] usb 3-1: config 5 interface 123 altsetting 7 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 2710.472221][ T3321] macsec0: entered promiscuous mode [ 2710.487226][ T3321] macsec0: entered allmulticast mode [ 2710.498674][T32329] usb 3-1: config 5 interface 123 altsetting 7 endpoint 0x86 has invalid wMaxPacketSize 0 [ 2710.510181][ T3321] veth1_macvtap: entered allmulticast mode [ 2710.533541][T32329] usb 3-1: config 5 interface 123 has no altsetting 0 [ 2710.545850][T32329] usb 3-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 2710.559141][T32329] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2710.578856][T32329] usb 3-1: Product: syz [ 2710.587606][T32329] usb 3-1: Manufacturer: syz [ 2710.599634][T32329] usb 3-1: SerialNumber: syz [ 2710.857989][T32329] ni6501 3-1:5.123: driver 'ni6501' failed to auto-configure device. [ 2710.894252][T32329] usb 3-1: USB disconnect, device number 98 [ 2711.174442][ T5949] usb 5-1: USB disconnect, device number 116 [ 2711.259747][T31318] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 2711.425818][T31318] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2711.459242][T31318] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2711.468662][ T5901] gspca_sunplus: reg_w_riv err -110 [ 2711.481679][ T5901] sunplus 6-1:0.0: probe with driver sunplus failed with error -110 [ 2711.502945][T31318] usb 4-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 2711.528996][T31318] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2711.547305][T31318] usb 4-1: Product: syz [ 2711.566378][T31318] usb 4-1: Manufacturer: syz [ 2711.574685][T31318] usb 4-1: SerialNumber: syz [ 2711.892494][T31318] usb 4-1: 0:1 : does not exist [ 2711.913898][T31318] usb 4-1: BAAD SPEAKER p_chmask mismatch [ 2712.031201][T31318] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 2712.066349][T31318] usb 4-1: USB disconnect, device number 78 [ 2712.094501][T31654] udevd[31654]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2713.065728][ T3372] kAFS: unable to lookup cell '' [ 2713.091807][ T3372] kAFS: unable to lookup cell '(,c' [ 2713.233084][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2713.239522][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2714.883178][ T3403] FAULT_INJECTION: forcing a failure. [ 2714.883178][ T3403] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 2714.908944][ T3403] CPU: 0 UID: 0 PID: 3403 Comm: syz.6.6475 Tainted: G L syzkaller #0 PREEMPT(full) [ 2714.908963][ T3403] Tainted: [L]=SOFTLOCKUP [ 2714.908967][ T3403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2714.908976][ T3403] Call Trace: [ 2714.908981][ T3403] [ 2714.908987][ T3403] dump_stack_lvl+0xe8/0x150 [ 2714.909045][ T3403] should_fail_ex+0x412/0x560 [ 2714.909153][ T3403] _copy_from_user+0x2d/0xb0 [ 2714.909186][ T3403] __sys_sendto+0x2b0/0x710 [ 2714.909255][ T3403] ? __pfx___sys_sendto+0x10/0x10 [ 2714.909266][ T3403] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 2714.909349][ T3403] ? __fget_files+0x3a0/0x420 [ 2714.909380][ T3403] ? ksys_write+0x242/0x270 [ 2714.909397][ T3403] ? __pfx_ksys_write+0x10/0x10 [ 2714.909411][ T3403] __x64_sys_sendto+0xde/0x100 [ 2714.909425][ T3403] do_syscall_64+0x14d/0xf80 [ 2714.909458][ T3403] ? trace_irq_disable+0x3b/0x150 [ 2714.909473][ T3403] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2714.909496][ T3403] ? clear_bhb_loop+0x40/0x90 [ 2714.909509][ T3403] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2714.909522][ T3403] RIP: 0033:0x7f63f0b9c819 [ 2714.909535][ T3403] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2714.909553][ T3403] RSP: 002b:00007f63f1b42028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 2714.909569][ T3403] RAX: ffffffffffffffda RBX: 00007f63f0e15fa0 RCX: 00007f63f0b9c819 [ 2714.909582][ T3403] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 2714.909591][ T3403] RBP: 00007f63f1b42090 R08: 00002000000003c0 R09: 0000000000000080 [ 2714.909601][ T3403] R10: 0000000000008010 R11: 0000000000000246 R12: 0000000000000001 [ 2714.909611][ T3403] R13: 00007f63f0e16038 R14: 00007f63f0e15fa0 R15: 00007f63f0f3fa48 [ 2714.909635][ T3403] [ 2715.172870][ T3405] FAULT_INJECTION: forcing a failure. [ 2715.172870][ T3405] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2715.197958][ T3405] CPU: 1 UID: 0 PID: 3405 Comm: syz.3.6476 Tainted: G L syzkaller #0 PREEMPT(full) [ 2715.197979][ T3405] Tainted: [L]=SOFTLOCKUP [ 2715.197983][ T3405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2715.197989][ T3405] Call Trace: [ 2715.197994][ T3405] [ 2715.197999][ T3405] dump_stack_lvl+0xe8/0x150 [ 2715.198024][ T3405] should_fail_ex+0x412/0x560 [ 2715.198043][ T3405] _copy_to_user+0x31/0xb0 [ 2715.198058][ T3405] simple_read_from_buffer+0xe1/0x170 [ 2715.198077][ T3405] proc_fail_nth_read+0x1bb/0x230 [ 2715.198132][ T3405] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2715.198148][ T3405] ? rw_verify_area+0x2a6/0x4d0 [ 2715.198159][ T3405] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2715.198174][ T3405] vfs_read+0x20c/0xa70 [ 2715.198185][ T3405] ? fdget_pos+0x246/0x320 [ 2715.198197][ T3405] ? __pfx___mutex_lock+0x10/0x10 [ 2715.198212][ T3405] ? __pfx_vfs_read+0x10/0x10 [ 2715.198224][ T3405] ? __fget_files+0x2a/0x420 [ 2715.198236][ T3405] ? __fget_files+0x3a0/0x420 [ 2715.198245][ T3405] ? __fget_files+0x2a/0x420 [ 2715.198258][ T3405] ksys_read+0x150/0x270 [ 2715.198271][ T3405] ? __pfx_ksys_read+0x10/0x10 [ 2715.198287][ T3405] do_syscall_64+0x14d/0xf80 [ 2715.198300][ T3405] ? trace_irq_disable+0x3b/0x150 [ 2715.198310][ T3405] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2715.198320][ T3405] ? clear_bhb_loop+0x40/0x90 [ 2715.198333][ T3405] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2715.198344][ T3405] RIP: 0033:0x7ff43755d04e [ 2715.198355][ T3405] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2715.198363][ T3405] RSP: 002b:00007ff4383f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2715.198376][ T3405] RAX: ffffffffffffffda RBX: 00007ff4383f56c0 RCX: 00007ff43755d04e [ 2715.198383][ T3405] RDX: 000000000000000f RSI: 00007ff4383f50a0 RDI: 0000000000000004 [ 2715.198389][ T3405] RBP: 00007ff4383f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2715.198396][ T3405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2715.198402][ T3405] R13: 00007ff437816038 R14: 00007ff437815fa0 R15: 00007ff43793fa48 [ 2715.198418][ T3405] [ 2715.533455][ T3410] FAULT_INJECTION: forcing a failure. [ 2715.533455][ T3410] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2715.554771][ T3410] CPU: 0 UID: 0 PID: 3410 Comm: syz.4.6478 Tainted: G L syzkaller #0 PREEMPT(full) [ 2715.554790][ T3410] Tainted: [L]=SOFTLOCKUP [ 2715.554794][ T3410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2715.554800][ T3410] Call Trace: [ 2715.554805][ T3410] [ 2715.554810][ T3410] dump_stack_lvl+0xe8/0x150 [ 2715.554830][ T3410] should_fail_ex+0x412/0x560 [ 2715.554849][ T3410] _copy_from_user+0x2d/0xb0 [ 2715.554863][ T3410] ___sys_sendmsg+0x1c6/0x360 [ 2715.554880][ T3410] ? __pfx____sys_sendmsg+0x10/0x10 [ 2715.554908][ T3410] ? __fget_files+0x2a/0x420 [ 2715.554918][ T3410] ? __fget_files+0x3a0/0x420 [ 2715.554932][ T3410] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2715.554947][ T3410] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2715.554964][ T3410] ? __pfx_ksys_write+0x10/0x10 [ 2715.554982][ T3410] do_syscall_64+0x14d/0xf80 [ 2715.554995][ T3410] ? trace_irq_disable+0x3b/0x150 [ 2715.555005][ T3410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2715.555016][ T3410] ? clear_bhb_loop+0x40/0x90 [ 2715.555029][ T3410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2715.555038][ T3410] RIP: 0033:0x7fc72c79c819 [ 2715.555049][ T3410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2715.555061][ T3410] RSP: 002b:00007fc72d629028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2715.555073][ T3410] RAX: ffffffffffffffda RBX: 00007fc72ca15fa0 RCX: 00007fc72c79c819 [ 2715.555080][ T3410] RDX: 0000000000000020 RSI: 00002000000000c0 RDI: 0000000000000003 [ 2715.555086][ T3410] RBP: 00007fc72d629090 R08: 0000000000000000 R09: 0000000000000000 [ 2715.555092][ T3410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2715.555098][ T3410] R13: 00007fc72ca16038 R14: 00007fc72ca15fa0 R15: 00007fc72cb3fa48 [ 2715.555113][ T3410] [ 2715.929695][ T5901] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 2716.081369][ T5901] usb 7-1: config 171 has an invalid interface number: 109 but max is 0 [ 2716.091437][ T5901] usb 7-1: config 171 has an invalid descriptor of length 0, skipping remainder of the config [ 2716.121562][ T5901] usb 7-1: config 171 has no interface number 0 [ 2716.136323][ T5901] usb 7-1: config 171 interface 109 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1023 [ 2716.147387][ T5901] usb 7-1: config 171 interface 109 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 2716.172648][ T5901] usb 7-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=fd.2e [ 2716.190706][ T5901] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2716.198813][ T5901] usb 7-1: Product: syz [ 2716.203645][ T5901] usb 7-1: Manufacturer: syz [ 2716.211243][ T5901] usb 7-1: SerialNumber: syz [ 2716.233740][ T3411] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 2716.264081][ T3418] bond11: entered allmulticast mode [ 2716.381272][ T3418] 8021q: adding VLAN 0 to HW filter on device bond11 [ 2716.471250][T31318] usb 5-1: new full-speed USB device number 117 using dummy_hcd [ 2716.652008][T31318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 2716.679953][T31318] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2716.774937][T31318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 2716.859662][T31318] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2716.971356][T31318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 2717.007994][T31318] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2717.061326][ T3439] netlink: 'syz.2.6484': attribute type 1 has an invalid length. [ 2717.102461][T31318] usb 5-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 2717.102481][T31318] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2717.102508][T31318] usb 5-1: Product: syz [ 2717.102517][T31318] usb 5-1: Manufacturer: syz [ 2717.102526][T31318] usb 5-1: SerialNumber: syz [ 2717.104372][T31318] usb 5-1: config 0 descriptor?? [ 2717.107194][T31318] ti_usb_3410_5052 5-1:0.0: required endpoints missing [ 2717.168133][ T3439] 8021q: adding VLAN 0 to HW filter on device bond9 [ 2717.224358][ T3441] bond9: (slave geneve3): making interface the new active one [ 2717.230743][ T3441] bond9: (slave geneve3): Enslaving as an active interface with an up link [ 2717.259403][ T49] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2717.261199][ T49] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2717.261401][ T49] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2717.261446][ T49] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2717.327866][ T5901] ath6kl: Failed to submit usb control message: -110 [ 2717.327918][ T5901] ath6kl: unable to send the bmi data to the device: -110 [ 2717.327934][ T5901] ath6kl: Unable to send get target info: -110 [ 2717.450347][ T5901] ath6kl: Failed to init ath6kl core: -110 [ 2717.678769][ T5901] ath6kl_usb 7-1:171.109: probe with driver ath6kl_usb failed with error -110 [ 2718.623872][ T3456] FAULT_INJECTION: forcing a failure. [ 2718.623872][ T3456] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2718.686518][ T3456] CPU: 1 UID: 0 PID: 3456 Comm: syz.2.6488 Tainted: G L syzkaller #0 PREEMPT(full) [ 2718.686548][ T3456] Tainted: [L]=SOFTLOCKUP [ 2718.686555][ T3456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2718.686566][ T3456] Call Trace: [ 2718.686574][ T3456] [ 2718.686582][ T3456] dump_stack_lvl+0xe8/0x150 [ 2718.686603][ T3456] should_fail_ex+0x412/0x560 [ 2718.686623][ T3456] _copy_from_user+0x2d/0xb0 [ 2718.686637][ T3456] do_tcp_setsockopt+0x4f3/0x2060 [ 2718.686734][ T3456] ? __lock_acquire+0x6b5/0x2cf0 [ 2718.686755][ T3456] ? __pfx_do_tcp_setsockopt+0x10/0x10 [ 2718.686766][ T3456] ? __pfx___mutex_lock+0x10/0x10 [ 2718.686785][ T3456] ? aa_sk_perm+0x6d5/0x900 [ 2718.686857][ T3456] ? sock_common_setsockopt+0x36/0xc0 [ 2718.686888][ T3456] ? tcp_setsockopt+0x3d/0xe0 [ 2718.686898][ T3456] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 2718.686909][ T3456] smc_setsockopt+0x249/0xac0 [ 2718.686967][ T3456] ? __pfx_smc_setsockopt+0x10/0x10 [ 2718.686978][ T3456] ? aa_sock_opt_perm+0xff/0x1a0 [ 2718.686990][ T3456] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 2718.687011][ T3456] ? __pfx_smc_setsockopt+0x10/0x10 [ 2718.687023][ T3456] do_sock_setsockopt+0x17c/0x1b0 [ 2718.687039][ T3456] __x64_sys_setsockopt+0x13d/0x1b0 [ 2718.687054][ T3456] do_syscall_64+0x14d/0xf80 [ 2718.687071][ T3456] ? trace_irq_disable+0x3b/0x150 [ 2718.687084][ T3456] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2718.687102][ T3456] ? clear_bhb_loop+0x40/0x90 [ 2718.687123][ T3456] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2718.687140][ T3456] RIP: 0033:0x7f55abb9c819 [ 2718.687156][ T3456] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2718.687178][ T3456] RSP: 002b:00007f55aca86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 2718.687197][ T3456] RAX: ffffffffffffffda RBX: 00007f55abe15fa0 RCX: 00007f55abb9c819 [ 2718.687211][ T3456] RDX: 0000000000000005 RSI: 0000000000000006 RDI: 0000000000000003 [ 2718.687222][ T3456] RBP: 00007f55aca86090 R08: 0000000000000004 R09: 0000000000000000 [ 2718.687233][ T3456] R10: 0000200000000540 R11: 0000000000000246 R12: 0000000000000001 [ 2718.687245][ T3456] R13: 00007f55abe16038 R14: 00007f55abe15fa0 R15: 00007f55abf3fa48 [ 2718.687274][ T3456] [ 2719.349185][ T5901] usb 7-1: USB disconnect, device number 64 [ 2719.529961][T32329] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 2719.564191][T26362] usb 5-1: USB disconnect, device number 117 [ 2719.696344][T32329] usb 3-1: config 1 has an invalid interface number: 7 but max is 0 [ 2719.719995][T32329] usb 3-1: config 1 has no interface number 0 [ 2719.726229][T32329] usb 3-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 2719.747053][T32329] usb 3-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 2719.768963][T32329] usb 3-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2719.820385][T32329] usb 3-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 2719.840746][T32329] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2719.866335][T32329] usb 3-1: Product: syz [ 2719.889973][T32329] usb 3-1: Manufacturer: syz [ 2719.915014][T32329] usb 3-1: SerialNumber: syz [ 2719.956958][ T3462] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 2720.194773][ T3462] raw-gadget.4 gadget.2: fail, usb_ep_enable returned -22 [ 2720.462106][T32329] sierra_net 3-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.2-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 2720.614391][T32329] sierra_net 3-1:1.7 wwan0: Submit SYNC failed -71 [ 2720.629515][T32329] sierra_net 3-1:1.7 wwan0: Send SYNC failed, status -71 [ 2720.652640][T32329] sierra_net 3-1:1.7 wwan0: Submit SYNC failed -71 [ 2720.677987][T32329] sierra_net 3-1:1.7 wwan0: Send SYNC failed, status -71 [ 2720.710457][T32329] usb 3-1: USB disconnect, device number 99 [ 2720.745445][T32329] sierra_net 3-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.2-1, Sierra Wireless USB-to-WWAN Modem [ 2720.831235][T32329] sierra_net 3-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 2721.220268][ T3504] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6503'. [ 2721.298373][ T3511] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2721.307480][ T3511] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2721.512575][ T3521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2721.526523][ T3521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2721.583073][ T3521] kvm: kvm [3519]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010003) = 0xffffffffffffffff [ 2721.621755][ T3524] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2721.628924][ T3522] kvm: kvm [3519]: vcpu2, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010003) = 0xffffffffffffffff [ 2721.726938][ T3521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2721.741027][ T3521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2721.749829][T32329] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 2721.879900][T32329] usb 4-1: device descriptor read/64, error -71 [ 2722.028203][ T3534] loop5: detected capacity change from 0 to 7 [ 2722.069261][ T3534] Dev loop5: unable to read RDB block 7 [ 2722.083570][ T3534] loop5: AHDI p1 p2 p3 [ 2722.098384][ T3534] loop5: partition table partially beyond EOD, truncated [ 2722.116193][ T3534] loop5: p1 start 1818582900 is beyond EOD, truncated [ 2722.137863][ T3534] loop5: p3 start 335544320 is beyond EOD, truncated [ 2722.690938][ T3544] FAULT_INJECTION: forcing a failure. [ 2722.690938][ T3544] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2722.705627][ T3544] CPU: 1 UID: 0 PID: 3544 Comm: syz.2.6513 Tainted: G L syzkaller #0 PREEMPT(full) [ 2722.705655][ T3544] Tainted: [L]=SOFTLOCKUP [ 2722.705661][ T3544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2722.705671][ T3544] Call Trace: [ 2722.705679][ T3544] [ 2722.705687][ T3544] dump_stack_lvl+0xe8/0x150 [ 2722.705724][ T3544] should_fail_ex+0x412/0x560 [ 2722.705757][ T3544] _copy_to_user+0x31/0xb0 [ 2722.705781][ T3544] simple_read_from_buffer+0xe1/0x170 [ 2722.705812][ T3544] proc_fail_nth_read+0x1bb/0x230 [ 2722.705842][ T3544] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2722.705871][ T3544] ? rw_verify_area+0x2a6/0x4d0 [ 2722.705891][ T3544] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2722.705917][ T3544] vfs_read+0x20c/0xa70 [ 2722.705934][ T3544] ? fdget_pos+0x246/0x320 [ 2722.705954][ T3544] ? __pfx___mutex_lock+0x10/0x10 [ 2722.705978][ T3544] ? __pfx_vfs_read+0x10/0x10 [ 2722.705999][ T3544] ? __fget_files+0x2a/0x420 [ 2722.706020][ T3544] ? __fget_files+0x3a0/0x420 [ 2722.706036][ T3544] ? __fget_files+0x2a/0x420 [ 2722.706061][ T3544] ksys_read+0x150/0x270 [ 2722.706083][ T3544] ? __pfx_ksys_read+0x10/0x10 [ 2722.706114][ T3544] do_syscall_64+0x14d/0xf80 [ 2722.706137][ T3544] ? trace_irq_disable+0x3b/0x150 [ 2722.706152][ T3544] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2722.706171][ T3544] ? clear_bhb_loop+0x40/0x90 [ 2722.706194][ T3544] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2722.706212][ T3544] RIP: 0033:0x7f55abb5d04e [ 2722.706229][ T3544] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2722.706243][ T3544] RSP: 002b:00007f55aca64fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2722.706262][ T3544] RAX: ffffffffffffffda RBX: 00007f55aca656c0 RCX: 00007f55abb5d04e [ 2722.706274][ T3544] RDX: 000000000000000f RSI: 00007f55aca650a0 RDI: 0000000000000005 [ 2722.706285][ T3544] RBP: 00007f55aca65090 R08: 0000000000000000 R09: 0000000000000000 [ 2722.706296][ T3544] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2722.706307][ T3544] R13: 00007f55abe16128 R14: 00007f55abe16090 R15: 00007f55abf3fa48 [ 2722.706337][ T3544] [ 2723.429733][ T5901] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 2723.603270][ T5901] usb 3-1: config 171 has an invalid interface number: 109 but max is 0 [ 2723.621358][ T5901] usb 3-1: config 171 has an invalid descriptor of length 0, skipping remainder of the config [ 2723.657024][ T5901] usb 3-1: config 171 has no interface number 0 [ 2723.673791][ T5901] usb 3-1: config 171 interface 109 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1023 [ 2723.690763][ T5901] usb 3-1: config 171 interface 109 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 2723.707029][ T5901] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=fd.2e [ 2723.718998][ T5901] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2723.729424][ T5901] usb 3-1: Product: syz [ 2723.733920][ T5901] usb 3-1: Manufacturer: syz [ 2723.738748][ T5901] usb 3-1: SerialNumber: syz [ 2723.750269][ T3560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2723.761938][ T3553] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 2723.777619][ T3560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2723.791583][ T30] kauditd_printk_skb: 111 callbacks suppressed [ 2723.791598][ T30] audit: type=1326 audit(1775521501.137:13797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3556 comm="syz.6.6517" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f63f0b9c819 code=0x0 [ 2724.197502][ T3568] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6520'. [ 2724.252228][ T3568] ip6tnl1: entered allmulticast mode [ 2724.675498][ T3585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6524'. [ 2724.689038][ T3585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6524'. [ 2724.698680][ T3585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6524'. [ 2724.711432][ T3585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6524'. [ 2724.731071][ T3585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6524'. [ 2724.832788][ T5901] ath6kl: Failed to submit usb control message: -110 [ 2724.863560][ T5901] ath6kl: unable to send the bmi data to the device: -110 [ 2724.883801][ T5901] ath6kl: Unable to send get target info: -110 [ 2724.914557][ T5901] ath6kl: Failed to init ath6kl core: -110 [ 2724.932253][ T5901] ath6kl_usb 3-1:171.109: probe with driver ath6kl_usb failed with error -110 [ 2725.724928][ T3593] FAULT_INJECTION: forcing a failure. [ 2725.724928][ T3593] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2725.753495][ T3593] CPU: 0 UID: 0 PID: 3593 Comm: syz.4.6526 Tainted: G L syzkaller #0 PREEMPT(full) [ 2725.753514][ T3593] Tainted: [L]=SOFTLOCKUP [ 2725.753518][ T3593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2725.753525][ T3593] Call Trace: [ 2725.753530][ T3593] [ 2725.753535][ T3593] dump_stack_lvl+0xe8/0x150 [ 2725.753557][ T3593] should_fail_ex+0x412/0x560 [ 2725.753576][ T3593] _copy_from_user+0x2d/0xb0 [ 2725.753590][ T3593] ucma_write+0x15d/0x2f0 [ 2725.753712][ T3593] ? __pfx_ucma_write+0x10/0x10 [ 2725.753727][ T3593] ? security_file_permission+0x75/0x260 [ 2725.753794][ T3593] ? rw_verify_area+0x255/0x4d0 [ 2725.753808][ T3593] vfs_writev+0x4bd/0x990 [ 2725.753828][ T3593] ? __pfx_ucma_write+0x10/0x10 [ 2725.753844][ T3593] ? __pfx_vfs_writev+0x10/0x10 [ 2725.753864][ T3593] ? __fget_files+0x2a/0x420 [ 2725.753875][ T3593] ? __fget_files+0x3a0/0x420 [ 2725.753884][ T3593] ? __fget_files+0x2a/0x420 [ 2725.753897][ T3593] do_writev+0x154/0x2e0 [ 2725.753912][ T3593] ? __pfx_do_writev+0x10/0x10 [ 2725.753931][ T3593] do_syscall_64+0x14d/0xf80 [ 2725.753945][ T3593] ? trace_irq_disable+0x3b/0x150 [ 2725.753955][ T3593] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2725.753965][ T3593] ? clear_bhb_loop+0x40/0x90 [ 2725.753978][ T3593] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2725.753988][ T3593] RIP: 0033:0x7fc72c79c819 [ 2725.754000][ T3593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2725.754009][ T3593] RSP: 002b:00007fc72d629028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 2725.754021][ T3593] RAX: ffffffffffffffda RBX: 00007fc72ca15fa0 RCX: 00007fc72c79c819 [ 2725.754028][ T3593] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000013 [ 2725.754035][ T3593] RBP: 00007fc72d629090 R08: 0000000000000000 R09: 0000000000000000 [ 2725.754041][ T3593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2725.754047][ T3593] R13: 00007fc72ca16038 R14: 00007fc72ca15fa0 R15: 00007fc72cb3fa48 [ 2725.754062][ T3593] [ 2726.203855][ T30] audit: type=1326 audit(1775521503.537:13798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.228837][ T30] audit: type=1326 audit(1775521503.537:13799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.285079][ T30] audit: type=1326 audit(1775521503.537:13800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.369985][T32329] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 2726.379317][ T30] audit: type=1326 audit(1775521503.537:13801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.449021][ T30] audit: type=1326 audit(1775521503.537:13802): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.525500][ T30] audit: type=1326 audit(1775521503.547:13803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.553891][ T30] audit: type=1326 audit(1775521503.547:13804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.597904][T32329] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2726.619363][T22131] usb 3-1: USB disconnect, device number 100 [ 2726.663541][T32329] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2726.680237][ T30] audit: type=1326 audit(1775521503.547:13805): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.696458][T32329] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2726.743482][ T3604] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2726.762343][T32329] usb 4-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e1.c5 [ 2726.790402][T32329] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2726.807653][T32329] usb 4-1: Product: syz [ 2726.817343][T32329] usb 4-1: Manufacturer: syz [ 2726.827485][T32329] usb 4-1: SerialNumber: syz [ 2726.846523][T32329] usb 4-1: config 0 descriptor?? [ 2726.877194][ T30] audit: type=1326 audit(1775521503.547:13806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=3597 comm="syz.5.6528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1bb019c819 code=0x7ffc0000 [ 2726.996733][T32329] uvcvideo 4-1:0.0: probe with driver uvcvideo failed with error -22 [ 2727.720457][T28874] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2727.733148][T28874] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2727.756743][T28874] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2727.779835][T28874] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2727.838486][T28874] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2727.854792][T28874] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2727.880280][T28874] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 2727.892149][T28874] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2728.275090][ T3633] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 2728.283864][ T3633] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 2728.438709][ T3636] FAULT_INJECTION: forcing a failure. [ 2728.438709][ T3636] name failslab, interval 1, probability 0, space 0, times 1 [ 2728.485650][ T3636] CPU: 0 UID: 0 PID: 3636 Comm: syz.6.6539 Tainted: G L syzkaller #0 PREEMPT(full) [ 2728.485678][ T3636] Tainted: [L]=SOFTLOCKUP [ 2728.485684][ T3636] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2728.485694][ T3636] Call Trace: [ 2728.485702][ T3636] [ 2728.485710][ T3636] dump_stack_lvl+0xe8/0x150 [ 2728.485738][ T3636] should_fail_ex+0x412/0x560 [ 2728.485768][ T3636] should_failslab+0xa8/0x100 [ 2728.485834][ T3636] __kmalloc_noprof+0xe8/0x760 [ 2728.485855][ T3636] ? tomoyo_encode+0x28b/0x550 [ 2728.485958][ T3636] tomoyo_encode+0x28b/0x550 [ 2728.485979][ T3636] tomoyo_realpath_from_path+0x58d/0x5d0 [ 2728.486005][ T3636] ? tomoyo_path_number_perm+0x219/0x630 [ 2728.486059][ T3636] tomoyo_path_number_perm+0x246/0x630 [ 2728.486087][ T3636] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2728.486115][ T3636] ? __lock_acquire+0x6b5/0x2cf0 [ 2728.486146][ T3636] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 2728.486191][ T3636] ? __fget_files+0x2a/0x420 [ 2728.486210][ T3636] ? __fget_files+0x2a/0x420 [ 2728.486224][ T3636] ? __fget_files+0x3a0/0x420 [ 2728.486238][ T3636] ? __fget_files+0x2a/0x420 [ 2728.486257][ T3636] security_file_ioctl+0xc3/0x2a0 [ 2728.486282][ T3636] __se_sys_ioctl+0x47/0x170 [ 2728.486307][ T3636] do_syscall_64+0x14d/0xf80 [ 2728.486327][ T3636] ? trace_irq_disable+0x3b/0x150 [ 2728.486342][ T3636] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2728.486360][ T3636] ? clear_bhb_loop+0x40/0x90 [ 2728.486381][ T3636] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2728.486406][ T3636] RIP: 0033:0x7f63f0b9c819 [ 2728.486423][ T3636] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2728.486436][ T3636] RSP: 002b:00007f63f1b42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2728.486456][ T3636] RAX: ffffffffffffffda RBX: 00007f63f0e15fa0 RCX: 00007f63f0b9c819 [ 2728.486468][ T3636] RDX: 0000200000000040 RSI: 00000000c02c563a RDI: 0000000000000003 [ 2728.486480][ T3636] RBP: 00007f63f1b42090 R08: 0000000000000000 R09: 0000000000000000 [ 2728.486490][ T3636] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2728.486499][ T3636] R13: 00007f63f0e16038 R14: 00007f63f0e15fa0 R15: 00007f63f0f3fa48 [ 2728.486524][ T3636] [ 2728.486625][ T3636] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2728.809705][ T7713] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 2728.971850][ T7713] usb 5-1: Using ep0 maxpacket: 32 [ 2728.981267][ T3648] FAULT_INJECTION: forcing a failure. [ 2728.981267][ T3648] name failslab, interval 1, probability 0, space 0, times 0 [ 2729.000669][ T3648] CPU: 0 UID: 0 PID: 3648 Comm: syz.5.6544 Tainted: G L syzkaller #0 PREEMPT(full) [ 2729.000695][ T3648] Tainted: [L]=SOFTLOCKUP [ 2729.000701][ T3648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2729.000712][ T3648] Call Trace: [ 2729.000719][ T3648] [ 2729.000727][ T3648] dump_stack_lvl+0xe8/0x150 [ 2729.000754][ T3648] should_fail_ex+0x412/0x560 [ 2729.000785][ T3648] should_failslab+0xa8/0x100 [ 2729.000808][ T3648] ? io_submit_one+0x130/0x14c0 [ 2729.000856][ T3648] kmem_cache_alloc_noprof+0x87/0x650 [ 2729.000882][ T3648] io_submit_one+0x130/0x14c0 [ 2729.000905][ T3648] ? irqentry_exit+0x59e/0x620 [ 2729.000928][ T3648] ? lockdep_hardirqs_on+0x7a/0x110 [ 2729.000950][ T3648] ? irqentry_exit+0x59e/0x620 [ 2729.000970][ T3648] ? trace_irq_disable+0x3b/0x150 [ 2729.000989][ T3648] ? __pfx_io_submit_one+0x10/0x10 [ 2729.001022][ T3648] ? __might_fault+0xaf/0x130 [ 2729.001074][ T3648] __se_sys_io_submit+0x195/0x340 [ 2729.001094][ T3648] ? __pfx___se_sys_io_submit+0x10/0x10 [ 2729.001111][ T3648] ? ksys_write+0x242/0x270 [ 2729.001144][ T3648] do_syscall_64+0x14d/0xf80 [ 2729.001167][ T3648] ? trace_irq_disable+0x3b/0x150 [ 2729.001182][ T3648] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2729.001199][ T3648] ? clear_bhb_loop+0x40/0x90 [ 2729.001221][ T3648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2729.001238][ T3648] RIP: 0033:0x7f1bb019c819 [ 2729.001256][ T3648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2729.001270][ T3648] RSP: 002b:00007f1bb0fab028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 2729.001289][ T3648] RAX: ffffffffffffffda RBX: 00007f1bb0415fa0 RCX: 00007f1bb019c819 [ 2729.001302][ T3648] RDX: 0000200000004540 RSI: 0000000000000001 RDI: 00007f1bb0f8a000 [ 2729.001314][ T3648] RBP: 00007f1bb0fab090 R08: 0000000000000000 R09: 0000000000000000 [ 2729.001325][ T3648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2729.001335][ T3648] R13: 00007f1bb0416038 R14: 00007f1bb0415fa0 R15: 00007f1bb053fa48 [ 2729.001362][ T3648] [ 2729.002172][ T7713] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 2729.371141][ T7713] usb 5-1: config 0 has no interface number 0 [ 2729.384759][ T7713] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 2729.416488][ T7713] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 2729.445478][T26362] usb 4-1: USB disconnect, device number 81 [ 2729.634851][ T7713] usb 5-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 2729.672940][ T7713] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2729.741641][ T7713] usb 5-1: Product: syz [ 2729.804616][ T7713] usb 5-1: Manufacturer: syz [ 2729.819192][ T7713] usb 5-1: SerialNumber: syz [ 2729.829310][ T7713] usb 5-1: config 0 descriptor?? [ 2729.847630][ T3650] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 2730.248343][ T7713] radio-si470x 5-1:0.35: DeviceID=0x9242 ChipID=0x0000 [ 2730.248362][ T7713] radio-si470x 5-1:0.35: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 2730.336956][ T49] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 2730.355195][ T49] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 2730.372734][ T49] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 2730.381962][ T49] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 2730.406985][ T3669] FAULT_INJECTION: forcing a failure. [ 2730.406985][ T3669] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2730.449059][ T7713] radio-si470x 5-1:0.35: software version 146, hardware version 66 [ 2730.458445][ T3669] CPU: 0 UID: 0 PID: 3669 Comm: syz.5.6550 Tainted: G L syzkaller #0 PREEMPT(full) [ 2730.458474][ T3669] Tainted: [L]=SOFTLOCKUP [ 2730.458480][ T3669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2730.458489][ T3669] Call Trace: [ 2730.458496][ T3669] [ 2730.458504][ T3669] dump_stack_lvl+0xe8/0x150 [ 2730.458532][ T3669] should_fail_ex+0x412/0x560 [ 2730.458564][ T3669] _copy_from_user+0x2d/0xb0 [ 2730.458586][ T3669] tls_setsockopt+0x678/0x15c0 [ 2730.458713][ T3669] ? __pfx_tls_setsockopt+0x10/0x10 [ 2730.458740][ T3669] ? __fget_files+0x2a/0x420 [ 2730.458755][ T3669] ? aa_sock_opt_perm+0xff/0x1a0 [ 2730.458774][ T3669] ? sock_common_setsockopt+0x36/0xc0 [ 2730.458793][ T3669] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 2730.458813][ T3669] do_sock_setsockopt+0x17c/0x1b0 [ 2730.458840][ T3669] __x64_sys_setsockopt+0x13d/0x1b0 [ 2730.458868][ T3669] do_syscall_64+0x14d/0xf80 [ 2730.458890][ T3669] ? trace_irq_disable+0x3b/0x150 [ 2730.458906][ T3669] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2730.458925][ T3669] ? clear_bhb_loop+0x40/0x90 [ 2730.458947][ T3669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2730.458965][ T3669] RIP: 0033:0x7f1bb019c819 [ 2730.458982][ T3669] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2730.458997][ T3669] RSP: 002b:00007f1bae3f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 2730.459016][ T3669] RAX: ffffffffffffffda RBX: 00007f1bb0416180 RCX: 00007f1bb019c819 [ 2730.459029][ T3669] RDX: 0000000000000001 RSI: 000000000000011a RDI: 0000000000000009 [ 2730.459040][ T3669] RBP: 00007f1bae3f6090 R08: 0000000000000028 R09: 0000000000000000 [ 2730.459051][ T3669] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 2730.459062][ T3669] R13: 00007f1bb0416218 R14: 00007f1bb0416180 R15: 00007f1bb053fa48 [ 2730.459091][ T3669] [ 2730.833818][ T7713] radio-si470x 5-1:0.35: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 2730.937560][ T7713] radio-si470x 5-1:0.35: si470x_set_report: usb_control_msg returned -71 [ 2730.946984][ T7713] radio-si470x 5-1:0.35: submitting int urb failed (-90) [ 2730.957929][ T3679] FAULT_INJECTION: forcing a failure. [ 2730.957929][ T3679] name failslab, interval 1, probability 0, space 0, times 0 [ 2730.970946][ T7713] radio-si470x 5-1:0.35: si470x_set_report: usb_control_msg returned -71 [ 2730.979543][ T7713] radio-si470x 5-1:0.35: probe with driver radio-si470x failed with error -22 [ 2730.988725][ T3679] CPU: 1 UID: 0 PID: 3679 Comm: syz.3.6555 Tainted: G L syzkaller #0 PREEMPT(full) [ 2730.988741][ T3679] Tainted: [L]=SOFTLOCKUP [ 2730.988745][ T3679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2730.988751][ T3679] Call Trace: [ 2730.988757][ T3679] [ 2730.988762][ T3679] dump_stack_lvl+0xe8/0x150 [ 2730.988782][ T3679] should_fail_ex+0x412/0x560 [ 2730.988801][ T3679] should_failslab+0xa8/0x100 [ 2730.988816][ T3679] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 2730.988828][ T3679] ? __alloc_skb+0x186/0x7d0 [ 2730.988847][ T3679] ? __alloc_skb+0x1d0/0x7d0 [ 2730.988857][ T3679] ? __local_bh_enable_ip+0xd0/0x130 [ 2730.988900][ T3679] __alloc_skb+0x1d0/0x7d0 [ 2730.988914][ T3679] netlink_sendmsg+0x5d4/0xb40 [ 2730.989056][ T3679] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2730.989069][ T3679] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2730.989113][ T3679] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2730.989127][ T3679] ____sys_sendmsg+0x972/0x9f0 [ 2730.989145][ T3679] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2730.989162][ T3679] ? import_iovec+0x73/0xa0 [ 2730.989197][ T3679] ___sys_sendmsg+0x2a5/0x360 [ 2730.989212][ T3679] ? __pfx____sys_sendmsg+0x10/0x10 [ 2730.989240][ T3679] ? __fget_files+0x2a/0x420 [ 2730.989249][ T3679] ? __fget_files+0x3a0/0x420 [ 2730.989263][ T3679] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2730.989277][ T3679] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2730.989294][ T3679] ? __pfx_ksys_write+0x10/0x10 [ 2730.989311][ T3679] do_syscall_64+0x14d/0xf80 [ 2730.989325][ T3679] ? trace_irq_disable+0x3b/0x150 [ 2730.989334][ T3679] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2730.989345][ T3679] ? clear_bhb_loop+0x40/0x90 [ 2730.989357][ T3679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2730.989367][ T3679] RIP: 0033:0x7ff43759c819 [ 2730.989379][ T3679] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2730.989387][ T3679] RSP: 002b:00007ff4383f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2730.989399][ T3679] RAX: ffffffffffffffda RBX: 00007ff437815fa0 RCX: 00007ff43759c819 [ 2730.989406][ T3679] RDX: 00000000000040c0 RSI: 0000200000000240 RDI: 0000000000000003 [ 2730.989413][ T3679] RBP: 00007ff4383f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2730.989419][ T3679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2730.989425][ T3679] R13: 00007ff437816038 R14: 00007ff437815fa0 R15: 00007ff43793fa48 [ 2730.989440][ T3679] [ 2731.341283][ T3681] x_tables: duplicate underflow at hook 4 [ 2731.441311][ T7713] radio-raremono 5-1:0.35: this is not Thanko's Raremono. [ 2731.489692][T31318] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 2731.526084][ T7713] usb 5-1: USB disconnect, device number 118 [ 2731.653658][T31318] usb 7-1: config 1 has an invalid interface number: 7 but max is 0 [ 2731.661844][T31318] usb 7-1: config 1 has no interface number 0 [ 2731.667921][T31318] usb 7-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 2731.686355][T31318] usb 7-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 2731.706694][T31318] usb 7-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2731.733540][T31318] usb 7-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 2731.751784][T31318] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2731.771409][T31318] usb 7-1: Product: syz [ 2731.780122][T31318] usb 7-1: Manufacturer: syz [ 2731.789084][T31318] usb 7-1: SerialNumber: syz [ 2731.820433][ T3674] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 2732.045414][ T3674] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 2732.158832][ T3702] FAULT_INJECTION: forcing a failure. [ 2732.158832][ T3702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2732.173020][ T3702] CPU: 0 UID: 0 PID: 3702 Comm: syz.5.6562 Tainted: G L syzkaller #0 PREEMPT(full) [ 2732.173045][ T3702] Tainted: [L]=SOFTLOCKUP [ 2732.173051][ T3702] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2732.173061][ T3702] Call Trace: [ 2732.173068][ T3702] [ 2732.173075][ T3702] dump_stack_lvl+0xe8/0x150 [ 2732.173103][ T3702] should_fail_ex+0x412/0x560 [ 2732.173138][ T3702] _copy_to_user+0x31/0xb0 [ 2732.173160][ T3702] simple_read_from_buffer+0xe1/0x170 [ 2732.173188][ T3702] proc_fail_nth_read+0x1bb/0x230 [ 2732.173215][ T3702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2732.173240][ T3702] ? rw_verify_area+0x2a6/0x4d0 [ 2732.173259][ T3702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2732.173284][ T3702] vfs_read+0x20c/0xa70 [ 2732.173302][ T3702] ? rawv6_bind+0x5e7/0x7d0 [ 2732.173442][ T3702] ? fdget_pos+0x246/0x320 [ 2732.173464][ T3702] ? __pfx___mutex_lock+0x10/0x10 [ 2732.173489][ T3702] ? __pfx_vfs_read+0x10/0x10 [ 2732.173511][ T3702] ? __fget_files+0x2a/0x420 [ 2732.173531][ T3702] ? __fget_files+0x3a0/0x420 [ 2732.173547][ T3702] ? __fget_files+0x2a/0x420 [ 2732.173571][ T3702] ksys_read+0x150/0x270 [ 2732.173595][ T3702] ? __pfx_ksys_read+0x10/0x10 [ 2732.173625][ T3702] do_syscall_64+0x14d/0xf80 [ 2732.173649][ T3702] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2732.173667][ T3702] ? clear_bhb_loop+0x40/0x90 [ 2732.173690][ T3702] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2732.173708][ T3702] RIP: 0033:0x7f1bb015d04e [ 2732.173725][ T3702] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2732.173741][ T3702] RSP: 002b:00007f1bb0faafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2732.173760][ T3702] RAX: ffffffffffffffda RBX: 00007f1bb0fab6c0 RCX: 00007f1bb015d04e [ 2732.173773][ T3702] RDX: 000000000000000f RSI: 00007f1bb0fab0a0 RDI: 0000000000000005 [ 2732.173784][ T3702] RBP: 00007f1bb0fab090 R08: 0000000000000000 R09: 0000000000000000 [ 2732.173796][ T3702] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2732.173806][ T3702] R13: 00007f1bb0416038 R14: 00007f1bb0415fa0 R15: 00007f1bb053fa48 [ 2732.173835][ T3702] [ 2732.416668][T31318] sierra_net 7-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.6-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:02:07 [ 2732.581423][ T3707] loop2: detected capacity change from 0 to 7 [ 2732.591785][ T3711] FAULT_INJECTION: forcing a failure. [ 2732.591785][ T3711] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2732.612715][T31318] sierra_net 7-1:1.7 wwan0: Submit SYNC failed -71 [ 2732.616055][ T3707] Dev loop2: unable to read RDB block 7 [ 2732.619422][T31318] sierra_net 7-1:1.7 wwan0: Send SYNC failed, status -71 [ 2732.632771][T31318] sierra_net 7-1:1.7 wwan0: Submit SYNC failed -71 [ 2732.639932][T31318] sierra_net 7-1:1.7 wwan0: Send SYNC failed, status -71 [ 2732.651186][T31318] usb 7-1: USB disconnect, device number 65 [ 2732.657411][ T3707] loop2: AHDI p1 p2 p3 [ 2732.661898][ T3711] CPU: 1 UID: 0 PID: 3711 Comm: syz.2.6566 Tainted: G L syzkaller #0 PREEMPT(full) [ 2732.661923][ T3711] Tainted: [L]=SOFTLOCKUP [ 2732.661930][ T3711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2732.661940][ T3711] Call Trace: [ 2732.661947][ T3711] [ 2732.661955][ T3711] dump_stack_lvl+0xe8/0x150 [ 2732.661979][ T3711] should_fail_ex+0x412/0x560 [ 2732.661998][ T3711] _copy_from_user+0x2d/0xb0 [ 2732.662012][ T3711] ucma_create_id+0xe9/0x380 [ 2732.662096][ T3711] ? __pfx_ucma_create_id+0x10/0x10 [ 2732.662117][ T3711] ucma_write+0x24e/0x2f0 [ 2732.662133][ T3711] ? __pfx_ucma_write+0x10/0x10 [ 2732.662147][ T3711] ? security_file_permission+0x75/0x260 [ 2732.662162][ T3711] ? rw_verify_area+0x255/0x4d0 [ 2732.662176][ T3711] vfs_writev+0x4bd/0x990 [ 2732.662190][ T3711] ? __pfx_ucma_write+0x10/0x10 [ 2732.662206][ T3711] ? __pfx_vfs_writev+0x10/0x10 [ 2732.662226][ T3711] ? __fget_files+0x2a/0x420 [ 2732.662238][ T3711] ? __fget_files+0x3a0/0x420 [ 2732.662246][ T3711] ? __fget_files+0x2a/0x420 [ 2732.662259][ T3711] do_writev+0x154/0x2e0 [ 2732.662274][ T3711] ? __pfx_do_writev+0x10/0x10 [ 2732.662292][ T3711] do_syscall_64+0x14d/0xf80 [ 2732.662306][ T3711] ? trace_irq_disable+0x3b/0x150 [ 2732.662315][ T3711] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2732.662326][ T3711] ? clear_bhb_loop+0x40/0x90 [ 2732.662338][ T3711] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2732.662348][ T3711] RIP: 0033:0x7f55abb9c819 [ 2732.662360][ T3711] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2732.662368][ T3711] RSP: 002b:00007f55aca86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 2732.662380][ T3711] RAX: ffffffffffffffda RBX: 00007f55abe15fa0 RCX: 00007f55abb9c819 [ 2732.662387][ T3711] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000003 [ 2732.662393][ T3711] RBP: 00007f55aca86090 R08: 0000000000000000 R09: 0000000000000000 [ 2732.662399][ T3711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2732.662405][ T3711] R13: 00007f55abe16038 R14: 00007f55abe15fa0 R15: 00007f55abf3fa48 [ 2732.662420][ T3711] [ 2732.664636][T31318] sierra_net 7-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.6-1, Sierra Wireless USB-to-WWAN Modem [ 2732.694671][ T3707] loop2: partition table partially beyond EOD, [ 2732.848870][ T3709] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2732.879669][ T3707] truncated [ 2732.879828][ T3707] loop2: p1 start 1601398130 is beyond EOD, truncated [ 2732.921467][ T3707] loop2: p2 start 1702059890 is beyond EOD, truncated [ 2732.951836][T31318] sierra_net 7-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 2732.997089][ T3709] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2733.004948][ T3712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2733.017152][ T3712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2733.047486][ T3714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2733.063673][ T3714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2733.073097][ T3712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2733.081538][T25488] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 2733.118250][ T3712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2733.203194][ T3723] x_tables: duplicate underflow at hook 4 [ 2733.574322][ T3737] FAULT_INJECTION: forcing a failure. [ 2733.574322][ T3737] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2733.643498][ T3737] CPU: 0 UID: 0 PID: 3737 Comm: syz.2.6572 Tainted: G L syzkaller #0 PREEMPT(full) [ 2733.643522][ T3737] Tainted: [L]=SOFTLOCKUP [ 2733.643527][ T3737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2733.643533][ T3737] Call Trace: [ 2733.643538][ T3737] [ 2733.643543][ T3737] dump_stack_lvl+0xe8/0x150 [ 2733.643563][ T3737] should_fail_ex+0x412/0x560 [ 2733.643582][ T3737] _copy_to_user+0x31/0xb0 [ 2733.643596][ T3737] simple_read_from_buffer+0xe1/0x170 [ 2733.643621][ T3737] proc_fail_nth_read+0x1bb/0x230 [ 2733.643638][ T3737] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2733.643654][ T3737] ? rw_verify_area+0x2a6/0x4d0 [ 2733.643666][ T3737] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2733.643681][ T3737] vfs_read+0x20c/0xa70 [ 2733.643695][ T3737] ? fdget_pos+0x246/0x320 [ 2733.643715][ T3737] ? __pfx___mutex_lock+0x10/0x10 [ 2733.643740][ T3737] ? __pfx_vfs_read+0x10/0x10 [ 2733.643759][ T3737] ? __fget_files+0x2a/0x420 [ 2733.643778][ T3737] ? __fget_files+0x3a0/0x420 [ 2733.643794][ T3737] ? __fget_files+0x2a/0x420 [ 2733.643809][ T3737] ksys_read+0x150/0x270 [ 2733.643822][ T3737] ? __pfx_ksys_read+0x10/0x10 [ 2733.643839][ T3737] do_syscall_64+0x14d/0xf80 [ 2733.643853][ T3737] ? trace_irq_disable+0x3b/0x150 [ 2733.643864][ T3737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2733.643876][ T3737] ? clear_bhb_loop+0x40/0x90 [ 2733.643889][ T3737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2733.643899][ T3737] RIP: 0033:0x7f55abb5d04e [ 2733.643910][ T3737] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2733.643919][ T3737] RSP: 002b:00007f55aca64fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2733.643931][ T3737] RAX: ffffffffffffffda RBX: 00007f55aca656c0 RCX: 00007f55abb5d04e [ 2733.643938][ T3737] RDX: 000000000000000f RSI: 00007f55aca650a0 RDI: 0000000000000005 [ 2733.643945][ T3737] RBP: 00007f55aca65090 R08: 0000000000000000 R09: 0000000000000000 [ 2733.643951][ T3737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2733.643957][ T3737] R13: 00007f55abe16128 R14: 00007f55abe16090 R15: 00007f55abf3fa48 [ 2733.643972][ T3737] [ 2735.029703][T32329] usb 5-1: new full-speed USB device number 120 using dummy_hcd [ 2735.109701][ T3756] FAULT_INJECTION: forcing a failure. [ 2735.109701][ T3756] name failslab, interval 1, probability 0, space 0, times 0 [ 2735.168754][ T3756] CPU: 0 UID: 0 PID: 3756 Comm: syz.6.6578 Tainted: G L syzkaller #0 PREEMPT(full) [ 2735.168774][ T3756] Tainted: [L]=SOFTLOCKUP [ 2735.168777][ T3756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2735.168784][ T3756] Call Trace: [ 2735.168789][ T3756] [ 2735.168793][ T3756] dump_stack_lvl+0xe8/0x150 [ 2735.168814][ T3756] should_fail_ex+0x412/0x560 [ 2735.168833][ T3756] should_failslab+0xa8/0x100 [ 2735.168848][ T3756] __kmalloc_cache_noprof+0x88/0x660 [ 2735.168861][ T3756] ? ipv6_flowlabel_opt+0xf1e/0x28e0 [ 2735.168941][ T3756] ipv6_flowlabel_opt+0xf1e/0x28e0 [ 2735.168955][ T3756] ? look_up_lock_class+0x57/0x110 [ 2735.168973][ T3756] ? __pfx_ipv6_flowlabel_opt+0x10/0x10 [ 2735.168988][ T3756] ? irqentry_exit+0x59e/0x620 [ 2735.169001][ T3756] ? lockdep_hardirqs_on+0x7a/0x110 [ 2735.169014][ T3756] ? irqentry_exit+0x59e/0x620 [ 2735.169026][ T3756] ? trace_irq_disable+0x3b/0x150 [ 2735.169041][ T3756] ? do_raw_spin_lock+0x12b/0x2f0 [ 2735.169053][ T3756] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2735.169068][ T3756] ? __local_bh_enable_ip+0xd0/0x130 [ 2735.169084][ T3756] do_ipv6_setsockopt+0xda7/0x31c0 [ 2735.169125][ T3756] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 2735.169138][ T3756] ? get_pid_task+0x20/0x1f0 [ 2735.169149][ T3756] ? get_pid_task+0x20/0x1f0 [ 2735.169157][ T3756] ? get_pid_task+0x20/0x1f0 [ 2735.169173][ T3756] ? __lock_acquire+0x6b5/0x2cf0 [ 2735.169193][ T3756] ? aa_sk_perm+0x6d5/0x900 [ 2735.169213][ T3756] ? __pfx_aa_sk_perm+0x10/0x10 [ 2735.169229][ T3756] ? __fget_files+0x2a/0x420 [ 2735.169238][ T3756] ? aa_sock_opt_perm+0xff/0x1a0 [ 2735.169250][ T3756] ipv6_setsockopt+0x59/0x170 [ 2735.169262][ T3756] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 2735.169274][ T3756] do_sock_setsockopt+0x17c/0x1b0 [ 2735.169289][ T3756] __x64_sys_setsockopt+0x13d/0x1b0 [ 2735.169305][ T3756] do_syscall_64+0x14d/0xf80 [ 2735.169317][ T3756] ? trace_irq_disable+0x3b/0x150 [ 2735.169326][ T3756] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2735.169336][ T3756] ? clear_bhb_loop+0x40/0x90 [ 2735.169349][ T3756] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2735.169359][ T3756] RIP: 0033:0x7f63f0b9c819 [ 2735.169370][ T3756] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2735.169378][ T3756] RSP: 002b:00007f63f1b42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 2735.169390][ T3756] RAX: ffffffffffffffda RBX: 00007f63f0e15fa0 RCX: 00007f63f0b9c819 [ 2735.169399][ T3756] RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000003 [ 2735.169409][ T3756] RBP: 00007f63f1b42090 R08: 0000000000000020 R09: 0000000000000000 [ 2735.169418][ T3756] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 2735.169427][ T3756] R13: 00007f63f0e16038 R14: 00007f63f0e15fa0 R15: 00007f63f0f3fa48 [ 2735.169453][ T3756] [ 2735.465615][T32329] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2735.742876][T32329] usb 5-1: config 0 has no interfaces? [ 2735.800239][T32329] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2735.815230][T32329] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2735.836344][T32329] usb 5-1: Product: syz [ 2735.846425][T32329] usb 5-1: Manufacturer: syz [ 2735.857465][T32329] usb 5-1: SerialNumber: syz [ 2735.885079][T32329] usb 5-1: config 0 descriptor?? [ 2736.125763][ T3765] FAULT_INJECTION: forcing a failure. [ 2736.125763][ T3765] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2736.141142][ T3765] CPU: 1 UID: 0 PID: 3765 Comm: syz.3.6581 Tainted: G L syzkaller #0 PREEMPT(full) [ 2736.141170][ T3765] Tainted: [L]=SOFTLOCKUP [ 2736.141176][ T3765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2736.141185][ T3765] Call Trace: [ 2736.141193][ T3765] [ 2736.141200][ T3765] dump_stack_lvl+0xe8/0x150 [ 2736.141230][ T3765] should_fail_ex+0x412/0x560 [ 2736.141260][ T3765] _copy_from_user+0x2d/0xb0 [ 2736.141279][ T3765] vmemdup_user+0x5e/0xd0 [ 2736.141301][ T3765] path_setxattrat+0x2c3/0x440 [ 2736.141328][ T3765] ? __pfx_path_setxattrat+0x10/0x10 [ 2736.141373][ T3765] ? __pfx_ksys_write+0x10/0x10 [ 2736.141397][ T3765] __x64_sys_fsetxattr+0xbc/0xe0 [ 2736.141419][ T3765] do_syscall_64+0x14d/0xf80 [ 2736.141443][ T3765] ? trace_irq_disable+0x3b/0x150 [ 2736.141460][ T3765] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2736.141477][ T3765] ? clear_bhb_loop+0x40/0x90 [ 2736.141498][ T3765] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2736.141515][ T3765] RIP: 0033:0x7ff43759c819 [ 2736.141532][ T3765] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2736.141547][ T3765] RSP: 002b:00007ff4383f5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000be [ 2736.141565][ T3765] RAX: ffffffffffffffda RBX: 00007ff437815fa0 RCX: 00007ff43759c819 [ 2736.141583][ T3765] RDX: 0000200000000780 RSI: 0000200000000280 RDI: 0000000000000000 [ 2736.141595][ T3765] RBP: 00007ff4383f5090 R08: 0000000000000001 R09: 0000000000000000 [ 2736.141606][ T3765] R10: 0000000000000024 R11: 0000000000000246 R12: 0000000000000001 [ 2736.141614][ T3765] R13: 00007ff437816038 R14: 00007ff437815fa0 R15: 00007ff43793fa48 [ 2736.141641][ T3765] [ 2736.143123][T32329] usb 5-1: USB disconnect, device number 120 [ 2736.669004][ T3775] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2737.491950][ T3788] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6588'. [ 2737.550968][ T3788] x_tables: duplicate underflow at hook 4 [ 2737.879719][T31318] usb 7-1: new high-speed USB device number 66 using dummy_hcd [ 2738.072332][T31318] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2738.080628][ T3796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6592'. [ 2738.082906][T31318] usb 7-1: config 63 has an invalid interface number: 66 but max is 0 [ 2738.098124][ T3796] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6592'. [ 2738.116027][T31318] usb 7-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 2738.128069][T31318] usb 7-1: config 63 has no interface number 0 [ 2738.137990][T31318] usb 7-1: config 63 interface 66 has no altsetting 0 [ 2738.150199][ T3796] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6592'. [ 2738.150971][T28874] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 2738.187045][ T3796] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6592'. [ 2738.187208][T28874] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 2738.207096][T28874] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 2738.217677][T31318] usb 7-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 2738.227007][T31318] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2738.242976][T31318] usb 7-1: Product: syz [ 2738.249931][T28874] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 2738.259044][T31318] usb 7-1: Manufacturer: syz [ 2738.264478][ T3800] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6594'. [ 2738.274216][T31318] usb 7-1: SerialNumber: syz [ 2738.509263][T31318] uvcvideo 7-1:63.66: Found UVC 0.07 device syz (174f:8acf) [ 2738.532119][ T3813] x_tables: duplicate underflow at hook 4 [ 2738.542056][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 6 on unit 1: -71 (exp. 1). [ 2738.554111][ T3808] bond5: entered allmulticast mode [ 2738.568441][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 9 on unit 1: -71 (exp. 1). [ 2738.584864][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 1 on unit 1: -71 (exp. 1). [ 2738.611867][ T3808] 8021q: adding VLAN 0 to HW filter on device bond5 [ 2738.632348][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 4 on unit 1: -71 (exp. 1). [ 2738.675819][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 17 on unit 1: -71 (exp. 1). [ 2738.689771][T31318] uvcvideo 7-1:63.66: No streaming interface found for terminal 29. [ 2738.697960][T31318] uvcvideo 7-1:63.66: Entity type for entity Output 32773 was not initialized! [ 2738.729995][ T7713] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 2738.789973][T31318] usb 7-1: USB disconnect, device number 66 [ 2738.919430][ T7713] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2738.954663][ T7713] usb 4-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 2738.995531][ T7713] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2739.023103][ T7713] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2739.071412][ T7713] usb 4-1: Product: syz [ 2739.092929][ T7713] usb 4-1: Manufacturer: syz [ 2739.114563][ T7713] usb 4-1: SerialNumber: syz [ 2739.149496][ T7713] cdc_mbim 4-1:1.0: skipping garbage [ 2739.160046][T31318] usb 7-1: new full-speed USB device number 67 using dummy_hcd [ 2739.364122][ T3812] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 2739.372132][T31318] usb 7-1: unable to get BOS descriptor or descriptor too short [ 2739.401476][T31318] usb 7-1: not running at top speed; connect to a high speed hub [ 2739.443493][T31318] usb 7-1: config 63 has an invalid interface number: 66 but max is 0 [ 2739.464065][T31318] usb 7-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 2739.529880][T31318] usb 7-1: config 63 has no interface number 0 [ 2739.551695][T31318] usb 7-1: config 63 interface 66 has no altsetting 0 [ 2739.583870][T31318] usb 7-1: string descriptor 0 read error: -22 [ 2739.592187][T31318] usb 7-1: New USB device found, idVendor=174f, idProduct=8acf, bcdDevice=39.f4 [ 2739.633591][T31318] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2739.686788][T31318] uvcvideo 7-1:63.66: Found UVC 0.07 device (174f:8acf) [ 2739.935121][ T3822] x_tables: duplicate underflow at hook 4 [ 2740.062738][ T3812] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 2740.104098][ T7713] cdc_mbim 4-1:1.0: cdc-wdm0: USB WDM device [ 2740.123130][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 9 on unit 1: -71 (exp. 1). [ 2740.143047][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 1 on unit 1: -71 (exp. 1). [ 2740.170065][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 4 on unit 1: -71 (exp. 1). [ 2740.189900][T31318] uvcvideo 7-1:63.66: Failed to query (GET_INFO) UVC control 17 on unit 1: -71 (exp. 1). [ 2740.206767][T31318] uvcvideo 7-1:63.66: No streaming interface found for terminal 29. [ 2740.219429][T31318] uvcvideo 7-1:63.66: Entity type for entity Output 32773 was not initialized! [ 2740.265540][T31318] usb 7-1: USB disconnect, device number 67 [ 2740.298793][ T7713] wwan wwan0: port wwan0mbim0 attached [ 2740.382313][ T7713] cdc_mbim 4-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.3-1, CDC MBIM, 06:e1:e1:6b:1e:8d [ 2740.456724][ T7713] usb 4-1: USB disconnect, device number 82 [ 2740.465003][ T7713] cdc_mbim 4-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.3-1, CDC MBIM [ 2740.551819][ T7713] wwan wwan0: port wwan0mbim0 disconnected [ 2740.978830][ T3839] FAULT_INJECTION: forcing a failure. [ 2740.978830][ T3839] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2740.992736][ T3839] CPU: 0 UID: 0 PID: 3839 Comm: syz.3.6604 Tainted: G L syzkaller #0 PREEMPT(full) [ 2740.992765][ T3839] Tainted: [L]=SOFTLOCKUP [ 2740.992772][ T3839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2740.992783][ T3839] Call Trace: [ 2740.992798][ T3839] [ 2740.992805][ T3839] dump_stack_lvl+0xe8/0x150 [ 2740.992837][ T3839] should_fail_ex+0x412/0x560 [ 2740.992866][ T3839] _copy_from_user+0x2d/0xb0 [ 2740.992889][ T3839] ___sys_recvmsg+0x175/0x590 [ 2740.992912][ T3839] ? __lock_acquire+0x6b5/0x2cf0 [ 2740.992936][ T3839] ? __pfx____sys_recvmsg+0x10/0x10 [ 2740.992991][ T3839] do_recvmmsg+0x334/0x800 [ 2740.993022][ T3839] ? __pfx_do_recvmmsg+0x10/0x10 [ 2740.993054][ T3839] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2740.993094][ T3839] __x64_sys_recvmmsg+0x198/0x250 [ 2740.993120][ T3839] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 2740.993154][ T3839] do_syscall_64+0x14d/0xf80 [ 2740.993174][ T3839] ? trace_irq_disable+0x3b/0x150 [ 2740.993191][ T3839] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2740.993210][ T3839] ? clear_bhb_loop+0x40/0x90 [ 2740.993231][ T3839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2740.993249][ T3839] RIP: 0033:0x7ff43759c819 [ 2740.993266][ T3839] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2740.993281][ T3839] RSP: 002b:00007ff4383f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 2740.993301][ T3839] RAX: ffffffffffffffda RBX: 00007ff437815fa0 RCX: 00007ff43759c819 [ 2740.993315][ T3839] RDX: 03ffffffffffff67 RSI: 0000200000002440 RDI: 0000000000000004 [ 2740.993327][ T3839] RBP: 00007ff4383f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2740.993338][ T3839] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2740.993349][ T3839] R13: 00007ff437816038 R14: 00007ff437815fa0 R15: 00007ff43793fa48 [ 2740.993376][ T3839] [ 2740.995185][ T3825] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 2741.241439][ T3825] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 2741.334226][ T7713] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 2741.459914][ C1] sd 0:0:1:0: [sda] tag#1181 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 2741.470337][ C1] sd 0:0:1:0: [sda] tag#1181 CDB: Read(6) 08 00 00 00 00 00 00 00 00 00 00 00 [ 2741.499886][ T7713] usb 5-1: Using ep0 maxpacket: 32 [ 2741.507809][ T7713] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2741.560559][ T7713] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 2741.590079][ T7713] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 2741.612603][ T7713] usb 5-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 2741.622860][ T7713] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2741.643514][ T7713] usb 5-1: config 0 descriptor?? [ 2741.650101][ T3837] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 2741.746967][ T7713] hub 5-1:0.0: USB hub found [ 2741.768421][ T3863] bond10: entered allmulticast mode [ 2741.822454][ T3863] 8021q: adding VLAN 0 to HW filter on device bond10 [ 2741.869899][ T3687] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 2741.897990][ T3837] misc userio: No port type given on /dev/userio [ 2741.958810][ T7713] hub 5-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 2742.023263][ T3687] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 2742.063257][ T3687] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2742.114931][ T3687] usb 4-1: config 0 descriptor?? [ 2742.158248][ T3687] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 2743.509835][T32329] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 2743.573058][ T3871] x_tables: duplicate underflow at hook 4 [ 2743.659726][T32329] usb 3-1: Using ep0 maxpacket: 8 [ 2743.672537][T32329] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2743.681911][ T3875] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2743.695891][ T3875] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2743.713342][T32329] usb 3-1: New USB device found, idVendor=10f5, idProduct=0200, bcdDevice= 0.40 [ 2743.742815][T32329] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2743.837040][T32329] usb 3-1: Product: syz [ 2743.878395][T32329] usb 3-1: Manufacturer: syz [ 2743.891537][T32329] usb 3-1: SerialNumber: syz [ 2744.038725][ T7713] usbhid 5-1:0.0: can't add hid device: -71 [ 2744.063008][ T7713] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2744.095006][ T7713] usb 5-1: USB disconnect, device number 121 [ 2744.172308][ T3867] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2744.216904][ T3867] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2744.279159][T32329] snd-usb-audio 3-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 2744.336595][T32329] usb 3-1: USB disconnect, device number 101 [ 2744.629821][T31318] usb 5-1: new full-speed USB device number 122 using dummy_hcd [ 2744.813730][T31318] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2744.835249][T31318] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2744.850249][T31318] usb 5-1: New USB device strings: Mfr=172, Product=0, SerialNumber=0 [ 2744.868701][T31318] usb 5-1: Manufacturer: syz [ 2744.897101][T31318] usb 5-1: config 0 descriptor?? [ 2744.911489][T31318] hub 5-1:0.0: USB hub found [ 2745.120461][T31318] hub 5-1:0.0: 1 port detected [ 2745.267853][ T3687] gspca_stv06xx: Photobit pb0100 sensor detected [ 2745.399034][ T3892] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2745.408653][ T3892] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2745.622482][ T3897] FAULT_INJECTION: forcing a failure. [ 2745.622482][ T3897] name failslab, interval 1, probability 0, space 0, times 0 [ 2745.649346][ T3897] CPU: 1 UID: 0 PID: 3897 Comm: syz.5.6620 Tainted: G L syzkaller #0 PREEMPT(full) [ 2745.649376][ T3897] Tainted: [L]=SOFTLOCKUP [ 2745.649384][ T3897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2745.649394][ T3897] Call Trace: [ 2745.649401][ T3897] [ 2745.649408][ T3897] dump_stack_lvl+0xe8/0x150 [ 2745.649435][ T3897] should_fail_ex+0x412/0x560 [ 2745.649467][ T3897] should_failslab+0xa8/0x100 [ 2745.649491][ T3897] __kmalloc_cache_noprof+0x88/0x660 [ 2745.649514][ T3897] ? ipv6_flowlabel_opt+0x1bc8/0x28e0 [ 2745.649542][ T3897] ipv6_flowlabel_opt+0x1bc8/0x28e0 [ 2745.649580][ T3897] ? __pfx_ipv6_flowlabel_opt+0x10/0x10 [ 2745.649613][ T3897] ? aa_file_perm+0x192/0x15e0 [ 2745.649637][ T3897] ? do_raw_spin_lock+0x12b/0x2f0 [ 2745.649659][ T3897] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2745.649686][ T3897] ? __local_bh_enable_ip+0xd0/0x130 [ 2745.649713][ T3897] do_ipv6_setsockopt+0xda7/0x31c0 [ 2745.649744][ T3897] ? __pfx_do_ipv6_setsockopt+0x10/0x10 [ 2745.649766][ T3897] ? get_pid_task+0x20/0x1f0 [ 2745.649783][ T3897] ? get_pid_task+0x20/0x1f0 [ 2745.649798][ T3897] ? get_pid_task+0x20/0x1f0 [ 2745.649827][ T3897] ? __lock_acquire+0x6b5/0x2cf0 [ 2745.649863][ T3897] ? aa_sk_perm+0x6d5/0x900 [ 2745.649896][ T3897] ? __pfx_aa_sk_perm+0x10/0x10 [ 2745.649923][ T3897] ? __fget_files+0x2a/0x420 [ 2745.649938][ T3897] ? aa_sock_opt_perm+0xff/0x1a0 [ 2745.649959][ T3897] ipv6_setsockopt+0x59/0x170 [ 2745.649980][ T3897] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 2745.650001][ T3897] do_sock_setsockopt+0x17c/0x1b0 [ 2745.650027][ T3897] __x64_sys_setsockopt+0x13d/0x1b0 [ 2745.650052][ T3897] do_syscall_64+0x14d/0xf80 [ 2745.650074][ T3897] ? trace_irq_disable+0x3b/0x150 [ 2745.650089][ T3897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2745.650107][ T3897] ? clear_bhb_loop+0x40/0x90 [ 2745.650128][ T3897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2745.650144][ T3897] RIP: 0033:0x7f1bb019c819 [ 2745.650161][ T3897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2745.650175][ T3897] RSP: 002b:00007f1bb0fab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 2745.650194][ T3897] RAX: ffffffffffffffda RBX: 00007f1bb0415fa0 RCX: 00007f1bb019c819 [ 2745.650207][ T3897] RDX: 0000000000000020 RSI: 0000000000000029 RDI: 0000000000000003 [ 2745.650219][ T3897] RBP: 00007f1bb0fab090 R08: 0000000000000020 R09: 0000000000000000 [ 2745.650230][ T3897] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 2745.650241][ T3897] R13: 00007f1bb0416038 R14: 00007f1bb0415fa0 R15: 00007f1bb053fa48 [ 2745.650266][ T3897] [ 2746.389890][T25488] usb 7-1: new full-speed USB device number 68 using dummy_hcd [ 2746.424435][ T3909] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2746.486696][T31318] hub 5-1:0.0: hub_ext_port_status failed (err = -71) [ 2746.494477][T30490] usb 5-1: USB disconnect, device number 122 [ 2746.545341][ T3909] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2746.623299][T25488] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2746.653026][T25488] usb 7-1: config 0 has no interfaces? [ 2746.678818][T25488] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2746.705036][T25488] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2746.735955][T25488] usb 7-1: Product: syz [ 2746.744847][T25488] usb 7-1: Manufacturer: syz [ 2746.759499][T25488] usb 7-1: SerialNumber: syz [ 2746.803448][T25488] usb 7-1: config 0 descriptor?? [ 2746.836426][ T3687] input: STV06xx as /devices/platform/dummy_hcd.3/usb4/4-1/input/input356 [ 2746.902706][ T3687] usb 4-1: USB disconnect, device number 83 [ 2747.024327][T25488] usb 7-1: USB disconnect, device number 68 [ 2747.492799][T30490] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 2747.669891][T32329] usb 3-1: new high-speed USB device number 102 using dummy_hcd [ 2747.710370][T30490] usb 4-1: Using ep0 maxpacket: 32 [ 2747.755171][T30490] usb 4-1: config 0 has no interfaces? [ 2747.796378][T30490] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 2747.829732][T32329] usb 3-1: Using ep0 maxpacket: 32 [ 2747.839417][T30490] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2747.859953][T32329] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 2747.879039][T32329] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2747.888675][T30490] usb 4-1: Product: syz [ 2747.906911][T30490] usb 4-1: Manufacturer: syz [ 2747.912686][T32329] usb 3-1: config 0 descriptor?? [ 2747.937941][T30490] usb 4-1: SerialNumber: syz [ 2747.982746][T30490] usb 4-1: config 0 descriptor?? [ 2748.154239][T32329] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 2748.187534][T32329] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2748.222203][T32329] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 2748.254719][T32329] usb 3-1: media controller created [ 2748.313316][T32329] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2748.374834][ T3924] netlink: 14 bytes leftover after parsing attributes in process `syz.2.6627'. [ 2748.956263][T32329] az6027: usb out operation failed. (-71) [ 2748.969148][T32329] az6027: usb out operation failed. (-71) [ 2748.983176][T32329] stb0899_attach: Driver disabled by Kconfig [ 2749.001273][ T3904] FAULT_INJECTION: forcing a failure. [ 2749.001273][ T3904] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2749.047234][T32329] az6027: no front-end attached [ 2749.047234][T32329] [ 2749.069104][ T3904] CPU: 0 UID: 0 PID: 3904 Comm: syz.6.6621 Tainted: G L syzkaller #0 PREEMPT(full) [ 2749.069122][ T3904] Tainted: [L]=SOFTLOCKUP [ 2749.069125][ T3904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2749.069132][ T3904] Call Trace: [ 2749.069136][ T3904] [ 2749.069141][ T3904] dump_stack_lvl+0xe8/0x150 [ 2749.069169][ T3904] should_fail_ex+0x412/0x560 [ 2749.069188][ T3904] core_sys_select+0x8dd/0xc30 [ 2749.069211][ T3904] ? __pfx_core_sys_select+0x10/0x10 [ 2749.069235][ T3904] ? __pfx_set_user_sigmask+0x10/0x10 [ 2749.069254][ T3904] __se_sys_pselect6+0x267/0x320 [ 2749.069271][ T3904] ? __pfx___se_sys_pselect6+0x10/0x10 [ 2749.069285][ T3904] ? __pfx_ksys_write+0x10/0x10 [ 2749.069300][ T3904] ? __x64_sys_pselect6+0x21/0xf0 [ 2749.069315][ T3904] do_syscall_64+0x14d/0xf80 [ 2749.069328][ T3904] ? trace_irq_disable+0x3b/0x150 [ 2749.069338][ T3904] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2749.069348][ T3904] ? clear_bhb_loop+0x40/0x90 [ 2749.069361][ T3904] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2749.069371][ T3904] RIP: 0033:0x7f63f0b9c819 [ 2749.069382][ T3904] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2749.069391][ T3904] RSP: 002b:00007f63f1b21028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 2749.069403][ T3904] RAX: ffffffffffffffda RBX: 00007f63f0e16090 RCX: 00007f63f0b9c819 [ 2749.069410][ T3904] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000040 [ 2749.069417][ T3904] RBP: 00007f63f1b21090 R08: 0000000000000000 R09: 0000000000000000 [ 2749.069423][ T3904] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000001 [ 2749.069429][ T3904] R13: 00007f63f0e16128 R14: 00007f63f0e16090 R15: 00007f63f0f3fa48 [ 2749.069443][ T3904] [ 2749.334297][T32329] az6027: usb out operation failed. (-71) [ 2749.352116][T32329] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 2749.424870][T32329] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input357 [ 2749.458664][T32329] dvb-usb: schedule remote query interval to 400 msecs. [ 2749.509212][T32329] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 2749.529270][T32329] usb 3-1: USB disconnect, device number 102 [ 2749.601196][T32329] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 2749.655249][ T30] kauditd_printk_skb: 65 callbacks suppressed [ 2749.655270][ T30] audit: type=1804 audit(1775521526.997:13872): pid=3940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.6633" name="/newroot/1311/file1" dev="fuse" ino=1 res=1 errno=0 [ 2750.230858][ T3948] netlink: 64 bytes leftover after parsing attributes in process `syz.5.6635'. [ 2750.266560][ T3948] syzkaller1: entered promiscuous mode [ 2750.273418][ T3948] syzkaller1: entered allmulticast mode [ 2750.275393][ T3951] FAULT_INJECTION: forcing a failure. [ 2750.275393][ T3951] name failslab, interval 1, probability 0, space 0, times 0 [ 2750.293482][ T3951] CPU: 0 UID: 0 PID: 3951 Comm: syz.2.6636 Tainted: G L syzkaller #0 PREEMPT(full) [ 2750.293506][ T3951] Tainted: [L]=SOFTLOCKUP [ 2750.293512][ T3951] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2750.293522][ T3951] Call Trace: [ 2750.293530][ T3951] [ 2750.293538][ T3951] dump_stack_lvl+0xe8/0x150 [ 2750.293566][ T3951] should_fail_ex+0x412/0x560 [ 2750.293597][ T3951] should_failslab+0xa8/0x100 [ 2750.293619][ T3951] ? ptlock_alloc+0x20/0x70 [ 2750.293636][ T3951] kmem_cache_alloc_noprof+0x87/0x650 [ 2750.293663][ T3951] ptlock_alloc+0x20/0x70 [ 2750.293680][ T3951] pte_alloc_one+0x7a/0x370 [ 2750.293740][ T3951] __pte_alloc+0x25/0x1a0 [ 2750.293766][ T3951] do_pte_missing+0x2c47/0x3490 [ 2750.293795][ T3951] ? mtree_range_walk+0x6a7/0x840 [ 2750.293888][ T3951] handle_mm_fault+0x1bec/0x3310 [ 2750.293915][ T3951] ? mt_find+0x186/0x630 [ 2750.293949][ T3951] ? handle_mm_fault+0xee/0x3310 [ 2750.293983][ T3951] ? __pfx_handle_mm_fault+0x10/0x10 [ 2750.294034][ T3951] __get_user_pages+0x165b/0x29d0 [ 2750.294095][ T3951] __gup_longterm_locked+0xdcf/0x1630 [ 2750.294131][ T3951] ? gup_fast_fallback+0x191/0x22e0 [ 2750.294167][ T3951] gup_fast_fallback+0x1d82/0x22e0 [ 2750.294201][ T3951] ? kasan_save_track+0x3e/0x80 [ 2750.294239][ T3951] ? __pfx_gup_fast_fallback+0x10/0x10 [ 2750.294268][ T3951] ? is_valid_gup_args+0x11f/0x200 [ 2750.294296][ T3951] ? get_user_pages_fast+0x4d/0xb0 [ 2750.294324][ T3951] iommufd_test+0x1b1f/0x5d10 [ 2750.294436][ T3951] ? __pfx_iommufd_test+0x10/0x10 [ 2750.294459][ T3951] ? __lock_acquire+0x6b5/0x2cf0 [ 2750.294487][ T3951] ? tomoyo_path_number_perm+0x219/0x630 [ 2750.294513][ T3951] ? tomoyo_path_number_perm+0x219/0x630 [ 2750.294540][ T3951] ? do_vfs_ioctl+0x1166/0x1530 [ 2750.294588][ T3951] iommufd_fops_ioctl+0x4b5/0x5d0 [ 2750.294611][ T3951] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 2750.294635][ T3951] ? __fget_files+0x2a/0x420 [ 2750.294657][ T3951] ? __fget_files+0x2a/0x420 [ 2750.294677][ T3951] ? bpf_lsm_file_ioctl+0x9/0x20 [ 2750.294700][ T3951] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 2750.294719][ T3951] __se_sys_ioctl+0xfc/0x170 [ 2750.294743][ T3951] do_syscall_64+0x14d/0xf80 [ 2750.294765][ T3951] ? trace_irq_disable+0x3b/0x150 [ 2750.294781][ T3951] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2750.294800][ T3951] ? clear_bhb_loop+0x40/0x90 [ 2750.294822][ T3951] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2750.294840][ T3951] RIP: 0033:0x7f55abb9c819 [ 2750.294857][ T3951] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2750.294872][ T3951] RSP: 002b:00007f55aca86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2750.294893][ T3951] RAX: ffffffffffffffda RBX: 00007f55abe15fa0 RCX: 00007f55abb9c819 [ 2750.294906][ T3951] RDX: 0000200000000880 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 2750.294917][ T3951] RBP: 00007f55aca86090 R08: 0000000000000000 R09: 0000000000000000 [ 2750.294928][ T3951] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2750.294939][ T3951] R13: 00007f55abe16038 R14: 00007f55abe15fa0 R15: 00007f55abf3fa48 [ 2750.294967][ T3951] [ 2750.694715][T30490] usb 4-1: USB disconnect, device number 84 [ 2751.032318][ T3966] kvm: kvm [3965]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x9c [ 2751.207137][ T3975] syzkaller0: entered promiscuous mode [ 2751.221182][ T3975] syzkaller0: entered allmulticast mode [ 2751.655495][ T3983] x_tables: duplicate underflow at hook 4 [ 2752.264768][ T3986] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6646'. [ 2752.389856][ T3989] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2752.614474][ T3994] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6649'. [ 2752.951910][T25488] usb 4-1: new full-speed USB device number 85 using dummy_hcd [ 2752.982446][ T4002] x_tables: duplicate underflow at hook 4 [ 2753.052389][ T4003] fuse: Unknown parameter '0x00000000000000050000000000000000000000600000000000000000000' [ 2753.165526][T25488] usb 4-1: not running at top speed; connect to a high speed hub [ 2753.198787][T25488] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 35, changing to 4 [ 2753.265799][T25488] usb 4-1: New USB device found, idVendor=0499, idProduct=103f, bcdDevice= 0.40 [ 2753.289753][T25488] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2753.328005][T25488] usb 4-1: Product: љ [ 2753.352704][T25488] usb 4-1: Manufacturer: 髎尢穃Ѭ쉆﫜Ő钀ﺈ厖參됻夨伞ᄧ꼉଀륤Ӱꍥ䄶㦸䃤⧔艎ၬ硾꼆赂嗑麵寿毗씄쾆龔记⇘봥涑驗Ὕ [ 2753.432848][ T30] audit: type=1800 audit(1775521530.767:13873): pid=4005 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.6653" name="SYSV00000000" dev="tmpfs" ino=5 res=0 errno=0 [ 2753.463529][T25488] usb 4-1: SerialNumber: 轷͘瞇뮽눙᦬Ṵņ㥘⯿艥錇蛈籙胨싋⅏騦鄠◼➷厐ꯙ鲇ꔮ甥␁碛蔻즤虨꩎쫼ᄦ﹧ሏ끡◬钇揍堏錁켫⨴ᗇ䉜礏䙈ẗ臀뱨龩㔹庶쑜 [ 2753.795595][T32329] usb 7-1: new full-speed USB device number 69 using dummy_hcd [ 2753.882425][ T4012] FAULT_INJECTION: forcing a failure. [ 2753.882425][ T4012] name failslab, interval 1, probability 0, space 0, times 0 [ 2753.919770][ T4012] CPU: 1 UID: 0 PID: 4012 Comm: syz.4.6654 Tainted: G L syzkaller #0 PREEMPT(full) [ 2753.919799][ T4012] Tainted: [L]=SOFTLOCKUP [ 2753.919806][ T4012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2753.919826][ T4012] Call Trace: [ 2753.919834][ T4012] [ 2753.919841][ T4012] dump_stack_lvl+0xe8/0x150 [ 2753.919872][ T4012] should_fail_ex+0x412/0x560 [ 2753.919903][ T4012] should_failslab+0xa8/0x100 [ 2753.919925][ T4012] ? skb_clone+0x212/0x3a0 [ 2753.919949][ T4012] kmem_cache_alloc_noprof+0x87/0x650 [ 2753.919969][ T4012] ? __netlink_lookup+0xc6/0x8b0 [ 2753.919996][ T4012] skb_clone+0x212/0x3a0 [ 2753.920022][ T4012] __netlink_deliver_tap+0x404/0x850 [ 2753.920052][ T4012] ? netlink_deliver_tap+0x2e/0x1b0 [ 2753.920073][ T4012] netlink_deliver_tap+0x19c/0x1b0 [ 2753.920093][ T4012] netlink_unicast+0x7e3/0x9b0 [ 2753.920125][ T4012] ? __pfx_netlink_unicast+0x10/0x10 [ 2753.920151][ T4012] ? netlink_sendmsg+0x650/0xb40 [ 2753.920169][ T4012] ? skb_put+0x11b/0x210 [ 2753.920190][ T4012] netlink_sendmsg+0x813/0xb40 [ 2753.920215][ T4012] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2753.920235][ T4012] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2753.920260][ T4012] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2753.920294][ T4012] ____sys_sendmsg+0x972/0x9f0 [ 2753.920326][ T4012] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2753.920355][ T4012] ? import_iovec+0x73/0xa0 [ 2753.920380][ T4012] ___sys_sendmsg+0x2a5/0x360 [ 2753.920408][ T4012] ? __pfx____sys_sendmsg+0x10/0x10 [ 2753.920461][ T4012] ? __fget_files+0x2a/0x420 [ 2753.920477][ T4012] ? __fget_files+0x3a0/0x420 [ 2753.920502][ T4012] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2753.920528][ T4012] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2753.920558][ T4012] ? __pfx_ksys_write+0x10/0x10 [ 2753.920590][ T4012] do_syscall_64+0x14d/0xf80 [ 2753.920614][ T4012] ? trace_irq_disable+0x3b/0x150 [ 2753.920630][ T4012] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2753.920649][ T4012] ? clear_bhb_loop+0x40/0x90 [ 2753.920671][ T4012] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2753.920689][ T4012] RIP: 0033:0x7fc72c79c819 [ 2753.920713][ T4012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2753.920728][ T4012] RSP: 002b:00007fc72d629028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2753.920748][ T4012] RAX: ffffffffffffffda RBX: 00007fc72ca15fa0 RCX: 00007fc72c79c819 [ 2753.920761][ T4012] RDX: 0000000000000020 RSI: 00002000000000c0 RDI: 0000000000000003 [ 2753.920773][ T4012] RBP: 00007fc72d629090 R08: 0000000000000000 R09: 0000000000000000 [ 2753.920784][ T4012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2753.920794][ T4012] R13: 00007fc72ca16038 R14: 00007fc72ca15fa0 R15: 00007fc72cb3fa48 [ 2753.920822][ T4012] [ 2754.240797][ T3994] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2754.250931][ T3994] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2754.270924][T32329] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0xC has invalid maxpacket 512, setting to 64 [ 2754.271180][ T4015] FAULT_INJECTION: forcing a failure. [ 2754.271180][ T4015] name failslab, interval 1, probability 0, space 0, times 0 [ 2754.285952][T32329] usb 7-1: New USB device found, idVendor=15ca, idProduct=1806, bcdDevice= 0.40 [ 2754.310415][T32329] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2754.318433][T32329] usb 7-1: Product: syz [ 2754.322769][T32329] usb 7-1: Manufacturer: syz [ 2754.323739][ T4015] CPU: 0 UID: 0 PID: 4015 Comm: syz.4.6656 Tainted: G L syzkaller #0 PREEMPT(full) [ 2754.323763][ T4015] Tainted: [L]=SOFTLOCKUP [ 2754.323770][ T4015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2754.323780][ T4015] Call Trace: [ 2754.323788][ T4015] [ 2754.323795][ T4015] dump_stack_lvl+0xe8/0x150 [ 2754.323828][ T4015] should_fail_ex+0x412/0x560 [ 2754.323858][ T4015] should_failslab+0xa8/0x100 [ 2754.323880][ T4015] ? dst_alloc+0x105/0x170 [ 2754.324016][ T4015] kmem_cache_alloc_noprof+0x87/0x650 [ 2754.324042][ T4015] dst_alloc+0x105/0x170 [ 2754.324069][ T4015] xfrm_lookup_with_ifid+0x7cf/0x1b90 [ 2754.324098][ T4015] ? __pfx_ip6_dst_lookup_tail+0x10/0x10 [ 2754.324154][ T4015] ? __pfx_xfrm_lookup_with_ifid+0x10/0x10 [ 2754.324179][ T4015] ? txopt_get+0x343/0x3f0 [ 2754.324205][ T4015] ? __pfx_txopt_get+0x10/0x10 [ 2754.324230][ T4015] xfrm_lookup_route+0x3c/0x1c0 [ 2754.324258][ T4015] rawv6_sendmsg+0xe1d/0x18e0 [ 2754.324291][ T4015] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 2754.324324][ T4015] ? aa_sk_perm+0x6d5/0x900 [ 2754.324355][ T4015] ? __pfx_aa_sk_perm+0x10/0x10 [ 2754.324381][ T4015] ? sock_rps_record_flow+0x19/0x400 [ 2754.324460][ T4015] ? inet_sendmsg+0x2f4/0x370 [ 2754.324480][ T4015] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2754.324503][ T4015] ____sys_sendmsg+0x80a/0x9f0 [ 2754.324533][ T4015] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2754.324563][ T4015] ? import_iovec+0x73/0xa0 [ 2754.324587][ T4015] ___sys_sendmsg+0x2a5/0x360 [ 2754.324613][ T4015] ? __pfx____sys_sendmsg+0x10/0x10 [ 2754.324640][ T4015] ? kstrtouint+0x6e/0xe0 [ 2754.324712][ T4015] ? __fget_files+0x2a/0x420 [ 2754.324728][ T4015] ? __fget_files+0x3a0/0x420 [ 2754.324752][ T4015] __sys_sendmmsg+0x27c/0x4e0 [ 2754.324779][ T4015] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2754.324799][ T4015] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 2754.324845][ T4015] ? ksys_write+0x242/0x270 [ 2754.324866][ T4015] ? __pfx_ksys_write+0x10/0x10 [ 2754.324891][ T4015] __x64_sys_sendmmsg+0xa0/0xc0 [ 2754.324914][ T4015] do_syscall_64+0x14d/0xf80 [ 2754.324936][ T4015] ? trace_irq_disable+0x3b/0x150 [ 2754.324950][ T4015] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2754.324968][ T4015] ? clear_bhb_loop+0x40/0x90 [ 2754.324989][ T4015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2754.325006][ T4015] RIP: 0033:0x7fc72c79c819 [ 2754.325022][ T4015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2754.325037][ T4015] RSP: 002b:00007fc72d629028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2754.325056][ T4015] RAX: ffffffffffffffda RBX: 00007fc72ca15fa0 RCX: 00007fc72c79c819 [ 2754.325069][ T4015] RDX: 0000000000000001 RSI: 0000200000004580 RDI: 0000000000000004 [ 2754.325079][ T4015] RBP: 00007fc72d629090 R08: 0000000000000000 R09: 0000000000000000 [ 2754.325090][ T4015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2754.325100][ T4015] R13: 00007fc72ca16038 R14: 00007fc72ca15fa0 R15: 00007fc72cb3fa48 [ 2754.325126][ T4015] [ 2754.641151][ T4021] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2754.650643][ T4021] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2754.696065][T32329] usb 7-1: SerialNumber: syz [ 2754.718185][ T4005] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 2754.745492][ T4023] batadv_slave_1: entered promiscuous mode [ 2754.816658][ T4023] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6657'. [ 2754.872491][ T4022] batadv_slave_1: left promiscuous mode [ 2755.341689][ T4033] tap0: tun_chr_ioctl cmd 1074025677 [ 2755.355645][ T4033] tap0: linktype set to 774 [ 2755.371042][ T4033] tap0: tun_chr_ioctl cmd 1074025672 [ 2755.382806][ T4033] tap0: ignored: set checksum enabled [ 2755.458644][ T4034] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6660'. [ 2755.977213][ T4041] program syz.2.6663 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 2756.149968][ T4043] loop7: detected capacity change from 0 to 16384 [ 2756.201026][ T4045] io-wq is not configured for unbound workers [ 2756.210389][ T4043] loop7: detected capacity change from 16384 to 16383 [ 2756.639735][ T7713] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 2756.720945][ T4051] bond8: entered allmulticast mode [ 2756.733506][ T4051] 8021q: adding VLAN 0 to HW filter on device bond8 [ 2756.814115][ T7713] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 2756.864861][ T7713] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2756.893683][ T7713] usb 3-1: Product: syz [ 2756.916955][ T7713] usb 3-1: Manufacturer: syz [ 2756.936435][ T7713] usb 3-1: SerialNumber: syz [ 2756.964327][ T7713] usb 3-1: config 0 descriptor?? [ 2757.196310][ T4047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2757.338747][ T4047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2757.480572][ T4047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2757.519549][ T4047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2758.010156][ T7713] usb 3-1: Firmware: major: 0, minor: 0, hardware type: ATUSB (0) [ 2758.040031][ T7713] usb 3-1: Firmware version (0.0) predates our first public release. [ 2758.070323][ T7713] usb 3-1: Please update to version 0.2 or newer [ 2758.224508][ T7713] usb 3-1: Firmware: build put/ [ 2758.637341][ T7713] usb 3-1: USB disconnect, device number 103 [ 2758.845618][T25488] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2758.890697][T25488] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 2758.904430][T32329] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 2758.945701][T32329] usb 7-1: MIDIStreaming interface descriptor not found [ 2758.981466][T32329] usb 7-1: too many endpoints [ 2759.149046][T25488] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2759.180821][T32329] usb 7-1: USB disconnect, device number 69 [ 2759.232507][T25488] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -2 [ 2759.304188][T25488] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 2759.356624][ T4081] FAULT_INJECTION: forcing a failure. [ 2759.356624][ T4081] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2759.422800][ T4081] CPU: 0 UID: 0 PID: 4081 Comm: syz.4.6674 Tainted: G L syzkaller #0 PREEMPT(full) [ 2759.422835][ T4081] Tainted: [L]=SOFTLOCKUP [ 2759.422842][ T4081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2759.422853][ T4081] Call Trace: [ 2759.422860][ T4081] [ 2759.422868][ T4081] dump_stack_lvl+0xe8/0x150 [ 2759.422899][ T4081] should_fail_ex+0x412/0x560 [ 2759.422930][ T4081] _copy_to_user+0x31/0xb0 [ 2759.422954][ T4081] simple_read_from_buffer+0xe1/0x170 [ 2759.422984][ T4081] proc_fail_nth_read+0x1bb/0x230 [ 2759.423013][ T4081] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2759.423040][ T4081] ? rw_verify_area+0x2a6/0x4d0 [ 2759.423060][ T4081] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2759.423086][ T4081] vfs_read+0x20c/0xa70 [ 2759.423104][ T4081] ? fdget_pos+0x246/0x320 [ 2759.423124][ T4081] ? __pfx___mutex_lock+0x10/0x10 [ 2759.423149][ T4081] ? __pfx_vfs_read+0x10/0x10 [ 2759.423170][ T4081] ? __fget_files+0x2a/0x420 [ 2759.423191][ T4081] ? __fget_files+0x3a0/0x420 [ 2759.423206][ T4081] ? __fget_files+0x2a/0x420 [ 2759.423230][ T4081] ksys_read+0x150/0x270 [ 2759.423251][ T4081] ? __pfx_ksys_read+0x10/0x10 [ 2759.423270][ T4081] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 2759.423299][ T4081] do_syscall_64+0x14d/0xf80 [ 2759.423320][ T4081] ? trace_irq_disable+0x3b/0x150 [ 2759.423335][ T4081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2759.423350][ T4081] ? clear_bhb_loop+0x40/0x90 [ 2759.423371][ T4081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2759.423387][ T4081] RIP: 0033:0x7fc72c75d04e [ 2759.423402][ T4081] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2759.423416][ T4081] RSP: 002b:00007fc72d628fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2759.423435][ T4081] RAX: ffffffffffffffda RBX: 00007fc72d6296c0 RCX: 00007fc72c75d04e [ 2759.423447][ T4081] RDX: 000000000000000f RSI: 00007fc72d6290a0 RDI: 0000000000000004 [ 2759.423458][ T4081] RBP: 00007fc72d629090 R08: 0000000000000000 R09: 0000000000000000 [ 2759.423468][ T4081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2759.423478][ T4081] R13: 00007fc72ca16038 R14: 00007fc72ca15fa0 R15: 00007fc72cb3fa48 [ 2759.423504][ T4081] [ 2759.966670][ T4084] FAULT_INJECTION: forcing a failure. [ 2759.966670][ T4084] name failslab, interval 1, probability 0, space 0, times 0 [ 2760.004562][ T4084] CPU: 1 UID: 0 PID: 4084 Comm: syz.4.6676 Tainted: G L syzkaller #0 PREEMPT(full) [ 2760.004590][ T4084] Tainted: [L]=SOFTLOCKUP [ 2760.004597][ T4084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2760.004607][ T4084] Call Trace: [ 2760.004614][ T4084] [ 2760.004622][ T4084] dump_stack_lvl+0xe8/0x150 [ 2760.004652][ T4084] should_fail_ex+0x412/0x560 [ 2760.004682][ T4084] should_failslab+0xa8/0x100 [ 2760.004703][ T4084] ? skb_clone+0x212/0x3a0 [ 2760.004726][ T4084] kmem_cache_alloc_noprof+0x87/0x650 [ 2760.004745][ T4084] ? __netlink_lookup+0xc6/0x8b0 [ 2760.004771][ T4084] skb_clone+0x212/0x3a0 [ 2760.004796][ T4084] __netlink_deliver_tap+0x404/0x850 [ 2760.004826][ T4084] ? netlink_deliver_tap+0x2e/0x1b0 [ 2760.004846][ T4084] netlink_deliver_tap+0x19c/0x1b0 [ 2760.004865][ T4084] netlink_unicast+0x7e3/0x9b0 [ 2760.004895][ T4084] ? __pfx_netlink_unicast+0x10/0x10 [ 2760.004922][ T4084] ? netlink_sendmsg+0x650/0xb40 [ 2760.004939][ T4084] ? skb_put+0x11b/0x210 [ 2760.004963][ T4084] netlink_sendmsg+0x813/0xb40 [ 2760.004988][ T4084] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2760.005009][ T4084] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2760.005040][ T4084] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2760.005060][ T4084] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2760.005080][ T4084] sock_sendmsg+0x3fb/0x450 [ 2760.005175][ T4084] ? is_bpf_text_address+0x292/0x2b0 [ 2760.005202][ T4084] ? __pfx_sock_sendmsg+0x10/0x10 [ 2760.005238][ T4084] ? __asan_memset+0x22/0x50 [ 2760.005256][ T4084] ? iov_iter_bvec+0xb8/0x180 [ 2760.005298][ T4084] splice_to_socket+0xae2/0x11f0 [ 2760.005344][ T4084] ? __pfx_splice_to_socket+0x10/0x10 [ 2760.005367][ T4084] ? current_time+0x22a/0x370 [ 2760.005408][ T4084] ? touch_atime+0xf1/0x6b0 [ 2760.005464][ T4084] ? __pfx_splice_to_socket+0x10/0x10 [ 2760.005488][ T4084] direct_splice_actor+0x101/0x160 [ 2760.005517][ T4084] splice_direct_to_actor+0x53a/0xc70 [ 2760.005551][ T4084] ? __pfx_direct_splice_actor+0x10/0x10 [ 2760.005584][ T4084] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 2760.005609][ T4084] ? get_pid_task+0x20/0x1f0 [ 2760.005634][ T4084] do_splice_direct+0x195/0x290 [ 2760.005662][ T4084] ? __pfx_do_splice_direct+0x10/0x10 [ 2760.005689][ T4084] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 2760.005707][ T4084] ? bpf_lsm_file_permission+0x9/0x20 [ 2760.005728][ T4084] ? security_file_permission+0x75/0x260 [ 2760.005753][ T4084] ? rw_verify_area+0x255/0x4d0 [ 2760.005777][ T4084] do_sendfile+0x535/0x7d0 [ 2760.005809][ T4084] ? __pfx_do_sendfile+0x10/0x10 [ 2760.005832][ T4084] ? __fget_files+0x3a0/0x420 [ 2760.005858][ T4084] __se_sys_sendfile64+0x144/0x1a0 [ 2760.005884][ T4084] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 2760.005916][ T4084] do_syscall_64+0x14d/0xf80 [ 2760.005938][ T4084] ? trace_irq_disable+0x3b/0x150 [ 2760.005953][ T4084] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2760.005972][ T4084] ? clear_bhb_loop+0x40/0x90 [ 2760.005994][ T4084] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2760.006012][ T4084] RIP: 0033:0x7fc72c79c819 [ 2760.006030][ T4084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2760.006050][ T4084] RSP: 002b:00007fc72d629028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2760.006070][ T4084] RAX: ffffffffffffffda RBX: 00007fc72ca15fa0 RCX: 00007fc72c79c819 [ 2760.006083][ T4084] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000005 [ 2760.006093][ T4084] RBP: 00007fc72d629090 R08: 0000000000000000 R09: 0000000000000000 [ 2760.006104][ T4084] R10: 0000000100000000 R11: 0000000000000246 R12: 0000000000000001 [ 2760.006115][ T4084] R13: 00007fc72ca16038 R14: 00007fc72ca15fa0 R15: 00007fc72cb3fa48 [ 2760.006144][ T4084] [ 2760.718435][T25488] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -2 [ 2760.774945][ T2055] udevd[2055]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2760.798132][ T4087] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6675'. [ 2760.860255][T25488] usb 4-1: USB disconnect, device number 85 [ 2760.890679][ T4087] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 2762.140002][ T7713] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 2762.165324][ T4113] openvswitch: netlink: Unexpected mask (mask=2200040, allowed=2010048) [ 2762.326939][ T7713] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF4, changing to 0x84 [ 2762.375129][ T7713] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1023 [ 2762.400359][ T7713] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 2762.412854][ T7713] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 2762.425912][ T7713] usb 5-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 2762.445072][ T7713] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2762.469903][ T7713] usb 5-1: Product: syz [ 2762.490172][ T7713] usb 5-1: Manufacturer: syz [ 2762.529912][ T7713] usb 5-1: SerialNumber: syz [ 2762.562256][ T7713] usb 5-1: config 0 descriptor?? [ 2762.593145][ T4101] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 2762.615338][ T7713] usb 5-1: ucan: probing device on interface #0 [ 2762.629958][ T7713] usb 5-1: ucan: invalid endpoint configuration [ 2762.674213][ T7713] usb 5-1: ucan: probe failed; try to update the device firmware [ 2762.842311][ T7713] usb 5-1: USB disconnect, device number 123 [ 2762.972049][ T4123] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6689'. [ 2763.660205][ T4127] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6691'. [ 2763.678865][ T4127] FAULT_INJECTION: forcing a failure. [ 2763.678865][ T4127] name failslab, interval 1, probability 0, space 0, times 0 [ 2763.718943][ T4127] CPU: 0 UID: 0 PID: 4127 Comm: syz.4.6691 Tainted: G L syzkaller #0 PREEMPT(full) [ 2763.718963][ T4127] Tainted: [L]=SOFTLOCKUP [ 2763.718966][ T4127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2763.718972][ T4127] Call Trace: [ 2763.718978][ T4127] [ 2763.718982][ T4127] dump_stack_lvl+0xe8/0x150 [ 2763.719003][ T4127] should_fail_ex+0x412/0x560 [ 2763.719022][ T4127] should_failslab+0xa8/0x100 [ 2763.719037][ T4127] ? skb_clone+0x212/0x3a0 [ 2763.719052][ T4127] kmem_cache_alloc_noprof+0x87/0x650 [ 2763.719068][ T4127] skb_clone+0x212/0x3a0 [ 2763.719083][ T4127] __netlink_deliver_tap+0x404/0x850 [ 2763.719101][ T4127] ? netlink_deliver_tap+0x2e/0x1b0 [ 2763.719113][ T4127] netlink_deliver_tap+0x19c/0x1b0 [ 2763.719125][ T4127] netlink_sendskb+0x68/0x140 [ 2763.719141][ T4127] netlink_unicast+0x3a3/0x9b0 [ 2763.719161][ T4127] ? __pfx_netlink_unicast+0x10/0x10 [ 2763.719175][ T4127] ? __asan_memcpy+0x40/0x70 [ 2763.719187][ T4127] ? nla_put+0xd0/0x150 [ 2763.719260][ T4127] xfrm_get_spdinfo+0x8a8/0xb40 [ 2763.719308][ T4127] ? __pfx_xfrm_get_spdinfo+0x10/0x10 [ 2763.719324][ T4127] ? apparmor_capable+0x126/0x170 [ 2763.719339][ T4127] ? __nla_parse+0x40/0x60 [ 2763.719353][ T4127] xfrm_user_rcv_msg+0x7ae/0xc40 [ 2763.719374][ T4127] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 2763.719405][ T4127] ? __pfx___mutex_trylock_common+0x10/0x10 [ 2763.719424][ T4127] ? rcu_is_watching+0x15/0xb0 [ 2763.719447][ T4127] ? trace_contention_end+0x3d/0x150 [ 2763.719463][ T4127] ? __mutex_lock+0x319/0x1300 [ 2763.719481][ T4127] netlink_rcv_skb+0x232/0x4b0 [ 2763.719493][ T4127] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 2763.719508][ T4127] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2763.719526][ T4127] ? netlink_deliver_tap+0x2e/0x1b0 [ 2763.719536][ T4127] ? netlink_deliver_tap+0x2e/0x1b0 [ 2763.719548][ T4127] xfrm_netlink_rcv+0x79/0x90 [ 2763.719563][ T4127] netlink_unicast+0x80f/0x9b0 [ 2763.719590][ T4127] ? __pfx_netlink_unicast+0x10/0x10 [ 2763.719619][ T4127] ? netlink_sendmsg+0x650/0xb40 [ 2763.719636][ T4127] ? skb_put+0x11b/0x210 [ 2763.719657][ T4127] netlink_sendmsg+0x813/0xb40 [ 2763.719683][ T4127] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2763.719704][ T4127] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2763.719731][ T4127] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2763.719753][ T4127] ____sys_sendmsg+0x972/0x9f0 [ 2763.719784][ T4127] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2763.719813][ T4127] ? import_iovec+0x73/0xa0 [ 2763.719837][ T4127] ___sys_sendmsg+0x2a5/0x360 [ 2763.719864][ T4127] ? __pfx____sys_sendmsg+0x10/0x10 [ 2763.719920][ T4127] ? __fget_files+0x2a/0x420 [ 2763.719935][ T4127] ? __fget_files+0x3a0/0x420 [ 2763.719959][ T4127] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2763.719983][ T4127] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2763.720011][ T4127] ? __pfx_ksys_write+0x10/0x10 [ 2763.720041][ T4127] do_syscall_64+0x14d/0xf80 [ 2763.720063][ T4127] ? trace_irq_disable+0x3b/0x150 [ 2763.720079][ T4127] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2763.720097][ T4127] ? clear_bhb_loop+0x40/0x90 [ 2763.720119][ T4127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2763.720137][ T4127] RIP: 0033:0x7fc72c79c819 [ 2763.720155][ T4127] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2763.720170][ T4127] RSP: 002b:00007fc72d629028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2763.720190][ T4127] RAX: ffffffffffffffda RBX: 00007fc72ca15fa0 RCX: 00007fc72c79c819 [ 2763.720203][ T4127] RDX: 00000000000040c0 RSI: 0000200000000240 RDI: 0000000000000003 [ 2763.720214][ T4127] RBP: 00007fc72d629090 R08: 0000000000000000 R09: 0000000000000000 [ 2763.720225][ T4127] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2763.720236][ T4127] R13: 00007fc72ca16038 R14: 00007fc72ca15fa0 R15: 00007fc72cb3fa48 [ 2763.720264][ T4127] [ 2764.144484][ T4129] ======================================================= [ 2764.144484][ T4129] WARNING: The mand mount option has been deprecated and [ 2764.144484][ T4129] and is ignored by this kernel. Remove the mand [ 2764.144484][ T4129] option from the mount to silence this warning. [ 2764.144484][ T4129] ======================================================= [ 2764.715792][ T4134] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2764.937594][ T4144] x_tables: duplicate underflow at hook 4 [ 2765.166830][ T4134] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2765.359731][T30490] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 2765.375695][ T4154] IPVS: Error connecting to the multicast addr [ 2765.531962][T30490] usb 3-1: Using ep0 maxpacket: 16 [ 2765.548991][T30490] usb 3-1: config 0 has no interfaces? [ 2765.566028][T30490] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=2b.29 [ 2765.583387][T30490] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2765.600873][T30490] usb 3-1: Product: syz [ 2765.611001][T30490] usb 3-1: Manufacturer: syz [ 2765.619989][ T7713] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 2765.627728][T30490] usb 3-1: SerialNumber: syz [ 2765.642054][T30490] usb 3-1: config 0 descriptor?? [ 2765.771380][ T7713] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 2765.789029][ T7713] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2765.823793][ T7713] usb 5-1: config 0 descriptor?? [ 2765.852956][ T7713] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 2765.955173][ T30] audit: type=1326 audit(1775521543.297:13874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.005879][ T30] audit: type=1326 audit(1775521543.297:13875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.047821][ T4138] netlink: 148 bytes leftover after parsing attributes in process `syz.2.6696'. [ 2766.068184][ T4138] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.6696'. [ 2766.087070][ T4138] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 2766.108172][ T30] audit: type=1326 audit(1775521543.297:13876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.169650][ T30] audit: type=1326 audit(1775521543.297:13877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.233931][ T30] audit: type=1326 audit(1775521543.297:13878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=259 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.266166][ T4153] loop5: detected capacity change from 0 to 7 [ 2766.279047][ T30] audit: type=1326 audit(1775521543.297:13879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.316788][ T30] audit: type=1326 audit(1775521543.297:13880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.343085][ T4153] Dev loop5: unable to read RDB block 7 [ 2766.350584][ T4153] loop5: unable to read partition table [ 2766.357078][ T4153] loop5: partition table beyond EOD, truncated [ 2766.364158][ T4153] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 2766.374819][ T30] audit: type=1326 audit(1775521543.317:13881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.400962][ T7713] cpia1 5-1:0.0: unexpected state after lo power cmd: 00 [ 2766.402213][ T30] audit: type=1326 audit(1775521543.327:13882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.436060][ T30] audit: type=1326 audit(1775521543.327:13883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4137 comm="syz.2.6696" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f55abb9c819 code=0x7ffc0000 [ 2766.826737][ T4140] netlink: 45 bytes leftover after parsing attributes in process `syz.2.6696'. [ 2767.004099][ T4153] vivid-004: disconnect [ 2767.015482][ T4153] vivid-004: reconnect [ 2767.024861][ T7713] gspca_cpia1: usb_control_msg 05, error -71 [ 2767.031073][ T7713] cpia1 5-1:0.0: unexpected systemstate: 00 [ 2767.038783][ T7713] usb 5-1: USB disconnect, device number 124 [ 2767.790113][T32329] usb 7-1: new full-speed USB device number 70 using dummy_hcd [ 2767.890545][ T7713] usb 3-1: USB disconnect, device number 104 [ 2767.973288][T32329] usb 7-1: config 247 has too many interfaces: 233, using maximum allowed: 32 [ 2767.992580][T32329] usb 7-1: config 247 has an invalid descriptor of length 200, skipping remainder of the config [ 2768.077962][T32329] usb 7-1: config 247 has 0 interfaces, different from the descriptor's value: 233 [ 2768.115473][ T4191] x_tables: duplicate underflow at hook 4 [ 2768.176146][T32329] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2768.327928][T32329] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2768.456618][T32329] usb 7-1: Product: syz [ 2768.498941][ T4202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2768.565992][T32329] usb 7-1: Manufacturer: syz [ 2768.594225][T32329] usb 7-1: SerialNumber: syz [ 2768.614308][ T4202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2768.893795][T32329] usb 7-1: USB disconnect, device number 70 [ 2768.980981][ T4202] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2769.669973][T32329] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 2769.679754][T25488] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 2769.702105][ T4224] x_tables: duplicate underflow at hook 4 [ 2769.850563][T25488] usb 3-1: Using ep0 maxpacket: 8 [ 2769.883660][T25488] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2769.898037][T32329] usb 5-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 2769.900546][T25488] usb 3-1: config 3 has an invalid interface number: 92 but max is 1 [ 2769.922377][T25488] usb 3-1: config 3 has an invalid interface number: 120 but max is 1 [ 2769.942468][T25488] usb 3-1: config 3 has an invalid interface number: 92 but max is 1 [ 2769.982371][T25488] usb 3-1: config 3 has no interface number 0 [ 2770.009684][T25488] usb 3-1: config 3 has no interface number 1 [ 2770.022950][T25488] usb 3-1: config 3 interface 120 altsetting 8 endpoint 0xE has invalid wMaxPacketSize 0 [ 2770.042220][T25488] usb 3-1: config 3 interface 92 altsetting 4 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 2770.056724][T25488] usb 3-1: config 3 interface 92 has no altsetting 0 [ 2770.066121][T32329] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2770.069383][T25488] usb 3-1: config 3 interface 92 has no altsetting 1 [ 2770.083478][T25488] usb 3-1: config 3 interface 120 has no altsetting 0 [ 2770.098283][T32329] usb 5-1: Product: syz [ 2770.104023][T32329] usb 5-1: Manufacturer: syz [ 2770.104766][T25488] usb 3-1: New USB device found, idVendor=1199, idProduct=6893, bcdDevice=16.b7 [ 2770.122285][T32329] usb 5-1: SerialNumber: syz [ 2770.127116][T25488] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2770.132458][T32329] usb 5-1: config 0 descriptor?? [ 2770.161882][T25488] usb 3-1: Product: syz [ 2770.167517][T25488] usb 3-1: Manufacturer: syz [ 2770.179464][T25488] usb 3-1: SerialNumber: syz [ 2770.570984][ T4232] netlink: 164 bytes leftover after parsing attributes in process `syz.2.6717'. [ 2770.842503][ T4220] dummy0: Caught tx_queue_len zero misconfig [ 2771.243877][T32329] usb 5-1: f81604_read: reg: 105 failed: -EPROTO [ 2771.269797][T32329] f81604 5-1:0.0: Setting termination of CH#1 failed: -EPROTO [ 2771.302758][T32329] f81604 5-1:0.0: probe with driver f81604 failed with error -71 [ 2771.366918][T32329] usb 5-1: USB disconnect, device number 125 [ 2771.689342][ T4239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2771.717028][ T4239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2771.909968][T32329] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 2772.074740][T32329] usb 7-1: config 1 has an invalid interface number: 7 but max is 0 [ 2772.093410][T32329] usb 7-1: config 1 has no interface number 0 [ 2772.119772][T32329] usb 7-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 2772.152872][T32329] usb 7-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 2772.173038][T32329] usb 7-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2772.192604][T32329] usb 7-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 2772.202697][T32329] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2772.212387][T32329] usb 7-1: Product: syz [ 2772.216710][T32329] usb 7-1: Manufacturer: syz [ 2772.222653][T32329] usb 7-1: SerialNumber: syz [ 2772.244889][ T4237] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 2772.269828][ T7713] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 2772.439657][ T7713] usb 5-1: Using ep0 maxpacket: 32 [ 2772.460387][ T7713] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 2772.470764][T25488] usb 3-1: selecting invalid altsetting 1 [ 2772.476555][T25488] sierra 3-1:3.92: Sierra USB modem converter detected [ 2772.517282][ T4237] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 2772.529637][ T7713] usb 5-1: config 0 has no interface number 0 [ 2772.535813][ T7713] usb 5-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2772.547080][T25488] usb 3-1: Sierra USB modem converter now attached to ttyUSB0 [ 2772.573585][ T7713] usb 5-1: config 0 interface 89 has no altsetting 0 [ 2772.602830][T25488] sierra 3-1:3.120: Sierra USB modem converter detected [ 2772.613070][ T7713] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 2772.630478][ T7713] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2772.642258][T25488] usb 3-1: Sierra USB modem converter now attached to ttyUSB1 [ 2772.644799][ T7713] usb 5-1: Product: syz [ 2772.655848][ T7713] usb 5-1: Manufacturer: syz [ 2772.661774][ T7713] usb 5-1: SerialNumber: syz [ 2772.671489][ T4248] FAULT_INJECTION: forcing a failure. [ 2772.671489][ T4248] name failslab, interval 1, probability 0, space 0, times 0 [ 2772.677325][ T7713] usb 5-1: config 0 descriptor?? [ 2772.700994][T25488] usb 3-1: USB disconnect, device number 105 [ 2772.724113][ T4248] CPU: 0 UID: 0 PID: 4248 Comm: syz.5.6728 Tainted: G L syzkaller #0 PREEMPT(full) [ 2772.724140][ T4248] Tainted: [L]=SOFTLOCKUP [ 2772.724146][ T4248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2772.724156][ T4248] Call Trace: [ 2772.724163][ T4248] [ 2772.724170][ T4248] dump_stack_lvl+0xe8/0x150 [ 2772.724201][ T4248] should_fail_ex+0x412/0x560 [ 2772.724232][ T4248] should_failslab+0xa8/0x100 [ 2772.724257][ T4248] __kmalloc_noprof+0xe8/0x760 [ 2772.724277][ T4248] ? ethnl_default_set_doit+0x16a/0xad0 [ 2772.724411][ T4248] ethnl_default_set_doit+0x16a/0xad0 [ 2772.724434][ T4248] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 2772.724456][ T4248] ? genl_family_rcv_msg_attrs_parse+0x212/0x2a0 [ 2772.724484][ T4248] genl_family_rcv_msg_doit+0x22a/0x330 [ 2772.724508][ T4248] ? __asan_memcpy+0x40/0x70 [ 2772.724529][ T4248] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 2772.724561][ T4248] ? bpf_lsm_capable+0x9/0x20 [ 2772.724585][ T4248] ? security_capable+0x7e/0x2c0 [ 2772.724616][ T4248] genl_rcv_msg+0x61c/0x7a0 [ 2772.724643][ T4248] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2772.724665][ T4248] ? __pfx_ethnl_default_set_doit+0x10/0x10 [ 2772.724686][ T4248] ? __lock_acquire+0x6b5/0x2cf0 [ 2772.724718][ T4248] netlink_rcv_skb+0x232/0x4b0 [ 2772.724738][ T4248] ? __pfx_genl_rcv_msg+0x10/0x10 [ 2772.724764][ T4248] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2772.724797][ T4248] ? down_read+0x272/0x2e0 [ 2772.724822][ T4248] ? genl_rcv+0xd/0x40 [ 2772.724846][ T4248] genl_rcv+0x28/0x40 [ 2772.724867][ T4248] netlink_unicast+0x80f/0x9b0 [ 2772.724901][ T4248] ? __pfx_netlink_unicast+0x10/0x10 [ 2772.724928][ T4248] ? netlink_sendmsg+0x650/0xb40 [ 2772.724946][ T4248] ? skb_put+0x11b/0x210 [ 2772.724970][ T4248] netlink_sendmsg+0x813/0xb40 [ 2772.724998][ T4248] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2772.725020][ T4248] ? aa_sock_msg_perm+0xf1/0x1b0 [ 2772.725049][ T4248] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 2772.725072][ T4248] ____sys_sendmsg+0x972/0x9f0 [ 2772.725103][ T4248] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2772.725135][ T4248] ? import_iovec+0x73/0xa0 [ 2772.725160][ T4248] ___sys_sendmsg+0x2a5/0x360 [ 2772.725189][ T4248] ? __pfx____sys_sendmsg+0x10/0x10 [ 2772.725243][ T4248] ? __fget_files+0x2a/0x420 [ 2772.725258][ T4248] ? __fget_files+0x3a0/0x420 [ 2772.725284][ T4248] __x64_sys_sendmsg+0x1bd/0x2a0 [ 2772.725309][ T4248] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 2772.725337][ T4248] ? __pfx_ksys_write+0x10/0x10 [ 2772.725368][ T4248] do_syscall_64+0x14d/0xf80 [ 2772.725390][ T4248] ? trace_irq_disable+0x3b/0x150 [ 2772.725413][ T4248] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2772.725431][ T4248] ? clear_bhb_loop+0x40/0x90 [ 2772.725453][ T4248] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2772.725470][ T4248] RIP: 0033:0x7f1bb019c819 [ 2772.725488][ T4248] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2772.725502][ T4248] RSP: 002b:00007f1bb0fab028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2772.725520][ T4248] RAX: ffffffffffffffda RBX: 00007f1bb0415fa0 RCX: 00007f1bb019c819 [ 2772.725532][ T4248] RDX: 0000000020008000 RSI: 0000200000000480 RDI: 0000000000000003 [ 2772.725544][ T4248] RBP: 00007f1bb0fab090 R08: 0000000000000000 R09: 0000000000000000 [ 2772.725555][ T4248] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2772.725565][ T4248] R13: 00007f1bb0416038 R14: 00007f1bb0415fa0 R15: 00007f1bb053fa48 [ 2772.725594][ T4248] [ 2772.727140][ T7713] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 2772.810634][T25488] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 2772.811139][T25488] sierra 3-1:3.92: device disconnected [ 2772.827448][T32329] sierra_net 7-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.6-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:03:07 [ 2772.980330][T25488] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 2772.981671][ T7713] em28xx 5-1:0.89: Video interface 89 found: [ 2773.021264][T25488] sierra 3-1:3.120: device disconnected [ 2773.112806][T32329] sierra_net 7-1:1.7 wwan0: Submit SYNC failed -71 [ 2773.219758][T32329] sierra_net 7-1:1.7 wwan0: Send SYNC failed, status -71 [ 2773.267114][T32329] sierra_net 7-1:1.7 wwan0: Submit SYNC failed -71 [ 2773.351814][T32329] sierra_net 7-1:1.7 wwan0: Send SYNC failed, status -71 [ 2773.466018][T32329] usb 7-1: USB disconnect, device number 71 [ 2773.483519][ T7713] em28xx 5-1:0.89: chip ID is em2840 [ 2773.507959][T32329] sierra_net 7-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.6-1, Sierra Wireless USB-to-WWAN Modem [ 2773.541129][T32329] sierra_net 7-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 2773.938777][ T4266] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 2774.230343][T32329] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 2774.337429][ T7713] em28xx 5-1:0.89: failed to get i2c transfer status from bridge register (error=-5) [ 2774.358512][ T7713] em28xx 5-1:0.89: board has no eeprom [ 2774.395496][T32329] usb 7-1: Using ep0 maxpacket: 8 [ 2774.402775][T32329] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2774.450395][T32329] usb 7-1: config 0 has no interfaces? [ 2774.485883][T32329] usb 7-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 2774.513803][T32329] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2774.522070][ T895] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 2774.529775][ T7713] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 2774.537435][ T7713] em28xx 5-1:0.89: analog set to bulk mode. [ 2774.549493][T26362] em28xx 5-1:0.89: Registering V4L2 extension [ 2774.597489][T32329] usb 7-1: Product: syz [ 2774.615166][ T7713] usb 5-1: USB disconnect, device number 126 [ 2774.625148][T32329] usb 7-1: Manufacturer: syz [ 2774.649698][T32329] usb 7-1: SerialNumber: syz [ 2774.655880][ T7713] em28xx 5-1:0.89: Disconnecting em28xx [ 2774.674202][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 2774.680694][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 2774.687541][T32329] usb 7-1: config 0 descriptor?? [ 2774.692784][ T895] usb 4-1: Using ep0 maxpacket: 8 [ 2774.715077][ T895] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2774.726732][T26362] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 2774.736744][ T895] usb 4-1: config 9 has an invalid interface number: 160 but max is 0 [ 2774.775580][T26362] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 2774.782933][ T895] usb 4-1: config 9 has no interface number 0 [ 2774.789996][T26362] em28xx 5-1:0.89: No AC97 audio processor [ 2774.795942][ T895] usb 4-1: config 9 interface 160 altsetting 6 has an endpoint descriptor with address 0xD6, changing to 0x86 [ 2774.826018][T26362] usb 5-1: Decoder not found [ 2774.838949][ T895] usb 4-1: config 9 interface 160 altsetting 6 endpoint 0x86 has an invalid bInterval 132, changing to 7 [ 2774.859233][T26362] em28xx 5-1:0.89: failed to create media graph [ 2774.869399][T26362] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 2774.876284][ T895] usb 4-1: config 9 interface 160 altsetting 6 bulk endpoint 0xC has invalid maxpacket 32 [ 2774.914723][ T4276] ================================================================== [ 2774.922828][ T4276] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 2774.930259][ T4276] Read of size 8 at addr ffff8880a1944790 by task v4l_id/4276 [ 2774.937696][ T4276] [ 2774.940007][ T4276] CPU: 1 UID: 0 PID: 4276 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 2774.940023][ T4276] Tainted: [L]=SOFTLOCKUP [ 2774.940027][ T4276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2774.940033][ T4276] Call Trace: [ 2774.940038][ T4276] [ 2774.940042][ T4276] dump_stack_lvl+0xe8/0x150 [ 2774.940060][ T4276] print_report+0xba/0x230 [ 2774.940086][ T4276] ? v4l2_fh_open+0xac/0x420 [ 2774.940100][ T4276] kasan_report+0x117/0x150 [ 2774.940113][ T4276] ? v4l2_fh_open+0xac/0x420 [ 2774.940128][ T4276] v4l2_fh_open+0xac/0x420 [ 2774.940141][ T4276] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2774.940156][ T4276] em28xx_v4l2_open+0x157/0x9a0 [ 2774.940223][ T4276] ? do_raw_spin_lock+0x12b/0x2f0 [ 2774.940236][ T4276] v4l2_open+0x1bf/0x3a0 [ 2774.940277][ T4276] chrdev_open+0x4cd/0x5e0 [ 2774.940291][ T4276] ? __pfx_chrdev_open+0x10/0x10 [ 2774.940303][ T4276] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 2774.940314][ T4276] ? __pfx_chrdev_open+0x10/0x10 [ 2774.940326][ T4276] do_dentry_open+0x785/0x14e0 [ 2774.940342][ T4276] vfs_open+0x3b/0x340 [ 2774.940354][ T4276] ? path_openat+0x2df0/0x3860 [ 2774.940366][ T4276] path_openat+0x2e08/0x3860 [ 2774.940379][ T4276] ? __pfx_stack_trace_save+0x10/0x10 [ 2774.940391][ T4276] ? stack_depot_save_flags+0x33/0x810 [ 2774.940409][ T4276] ? __pfx_path_openat+0x10/0x10 [ 2774.940418][ T4276] ? __x64_sys_openat+0x138/0x170 [ 2774.940431][ T4276] ? do_syscall_64+0x14d/0xf80 [ 2774.940443][ T4276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2774.940455][ T4276] ? __lock_acquire+0x6b5/0x2cf0 [ 2774.940469][ T4276] do_file_open+0x23e/0x4a0 [ 2774.940480][ T4276] ? __pfx_do_file_open+0x10/0x10 [ 2774.940494][ T4276] ? _raw_spin_unlock+0x28/0x50 [ 2774.940505][ T4276] ? alloc_fd+0x64b/0x6c0 [ 2774.940520][ T4276] do_sys_openat2+0x113/0x200 [ 2774.940534][ T4276] ? __pfx_do_sys_openat2+0x10/0x10 [ 2774.940547][ T4276] ? exc_page_fault+0x6a/0xc0 [ 2774.940560][ T4276] ? do_user_addr_fault+0xc6f/0x1340 [ 2774.940573][ T4276] __x64_sys_openat+0x138/0x170 [ 2774.940588][ T4276] do_syscall_64+0x14d/0xf80 [ 2774.940600][ T4276] ? trace_irq_disable+0x3b/0x150 [ 2774.940609][ T4276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2774.940619][ T4276] ? clear_bhb_loop+0x40/0x90 [ 2774.940630][ T4276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2774.940640][ T4276] RIP: 0033:0x7facab2a7407 [ 2774.940651][ T4276] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 2774.940660][ T4276] RSP: 002b:00007ffff00e6250 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 2774.940673][ T4276] RAX: ffffffffffffffda RBX: 00007facab99f880 RCX: 00007facab2a7407 [ 2774.940680][ T4276] RDX: 0000000000000000 RSI: 00007ffff00e7f1b RDI: ffffffffffffff9c [ 2774.940688][ T4276] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 2774.940694][ T4276] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2774.940700][ T4276] R13: 00007ffff00e64a0 R14: 00007facabb06000 R15: 000055e6744cb4d8 [ 2774.940710][ T4276] [ 2774.940714][ T4276] [ 2775.239962][ T4276] Allocated by task 26362: [ 2775.244350][ T4276] kasan_save_track+0x3e/0x80 [ 2775.249010][ T4276] __kasan_kmalloc+0x93/0xb0 [ 2775.253593][ T4276] __kmalloc_cache_noprof+0x31c/0x660 [ 2775.258948][ T4276] em28xx_v4l2_init+0x10b/0x2e70 [ 2775.263862][ T4276] em28xx_init_extension+0x120/0x1c0 [ 2775.269187][ T4276] process_scheduled_works+0xb6e/0x18c0 [ 2775.274744][ T4276] worker_thread+0xa53/0xfc0 [ 2775.279314][ T4276] kthread+0x388/0x470 [ 2775.283358][ T4276] ret_from_fork+0x51e/0xb90 [ 2775.287928][ T4276] ret_from_fork_asm+0x1a/0x30 [ 2775.292672][ T4276] [ 2775.294980][ T4276] Freed by task 26362: [ 2775.299028][ T4276] kasan_save_track+0x3e/0x80 [ 2775.303684][ T4276] kasan_save_free_info+0x46/0x50 [ 2775.308691][ T4276] __kasan_slab_free+0x5c/0x80 [ 2775.313437][ T4276] kfree+0x1c1/0x630 [ 2775.317308][ T4276] em28xx_v4l2_init+0x1683/0x2e70 [ 2775.322327][ T4276] em28xx_init_extension+0x120/0x1c0 [ 2775.327608][ T4276] process_scheduled_works+0xb6e/0x18c0 [ 2775.333132][ T4276] worker_thread+0xa53/0xfc0 [ 2775.337702][ T4276] kthread+0x388/0x470 [ 2775.341746][ T4276] ret_from_fork+0x51e/0xb90 [ 2775.346316][ T4276] ret_from_fork_asm+0x1a/0x30 [ 2775.351077][ T4276] [ 2775.353379][ T4276] The buggy address belongs to the object at ffff8880a1944000 [ 2775.353379][ T4276] which belongs to the cache kmalloc-8k of size 8192 [ 2775.367406][ T4276] The buggy address is located 1936 bytes inside of [ 2775.367406][ T4276] freed 8192-byte region [ffff8880a1944000, ffff8880a1946000) [ 2775.381353][ T4276] [ 2775.383658][ T4276] The buggy address belongs to the physical page: [ 2775.390051][ T4276] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa1940 [ 2775.398790][ T4276] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 2775.407261][ T4276] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 2775.414815][ T4276] page_type: f5(slab) [ 2775.418776][ T4276] raw: 00fff00000000040 ffff88813fea7280 dead000000000122 0000000000000000 [ 2775.427334][ T4276] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 2775.435895][ T4276] head: 00fff00000000040 ffff88813fea7280 dead000000000122 0000000000000000 [ 2775.444540][ T4276] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 2775.453187][ T4276] head: 00fff00000000003 ffffea0002865001 00000000ffffffff 00000000ffffffff [ 2775.461843][ T4276] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 2775.470484][ T4276] page dumped because: kasan: bad access detected [ 2775.476897][ T4276] page_owner tracks the page as allocated [ 2775.482587][ T4276] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4219, tgid 4217 (syz.2.6717), ts 2770509318240, free_ts 2770193892302 [ 2775.505487][ T4276] post_alloc_hook+0x231/0x280 [ 2775.510234][ T4276] get_page_from_freelist+0x24dc/0x2580 [ 2775.515772][ T4276] __alloc_frozen_pages_noprof+0x18d/0x380 [ 2775.521559][ T4276] allocate_slab+0x77/0x660 [ 2775.526043][ T4276] refill_objects+0x331/0x3c0 [ 2775.530700][ T4276] __pcs_replace_empty_main+0x2e6/0x730 [ 2775.536231][ T4276] __kmalloc_cache_noprof+0x392/0x660 [ 2775.541579][ T4276] audit_log_d_path+0xb8/0x1a0 [ 2775.546324][ T4276] audit_log_d_path_exe+0x42/0x70 [ 2775.551327][ T4276] audit_log_task+0x2c3/0x3d0 [ 2775.555982][ T4276] audit_seccomp+0x85/0x190 [ 2775.560465][ T4276] __seccomp_filter+0xd48/0x1ef0 [ 2775.565380][ T4276] do_syscall_64+0xf4/0xf80 [ 2775.569862][ T4276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2775.575735][ T4276] page last free pid 5185 tgid 5185 stack trace: [ 2775.582035][ T4276] __free_frozen_pages+0xc2b/0xdb0 [ 2775.587125][ T4276] __slab_free+0x263/0x2b0 [ 2775.591523][ T4276] qlist_free_all+0x97/0x100 [ 2775.596119][ T4276] kasan_quarantine_reduce+0x148/0x160 [ 2775.601562][ T4276] __kasan_slab_alloc+0x22/0x80 [ 2775.606393][ T4276] kmem_cache_alloc_node_noprof+0x384/0x690 [ 2775.612266][ T4276] __alloc_skb+0x1d0/0x7d0 [ 2775.616662][ T4276] alloc_skb_with_frags+0xca/0x890 [ 2775.621813][ T4276] sock_alloc_send_pskb+0x878/0x990 [ 2775.627000][ T4276] unix_dgram_sendmsg+0x460/0x18e0 [ 2775.632152][ T4276] __sys_sendto+0x672/0x710 [ 2775.636637][ T4276] __x64_sys_sendto+0xde/0x100 [ 2775.641393][ T4276] do_syscall_64+0x14d/0xf80 [ 2775.645962][ T4276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2775.651833][ T4276] [ 2775.654145][ T4276] Memory state around the buggy address: [ 2775.659756][ T4276] ffff8880a1944680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2775.667797][ T4276] ffff8880a1944700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2775.675839][ T4276] >ffff8880a1944780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2775.683875][ T4276] ^ [ 2775.688438][ T4276] ffff8880a1944800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2775.696496][ T4276] ffff8880a1944880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 2775.704532][ T4276] ================================================================== [ 2775.714867][ T895] usb 4-1: config 9 interface 160 altsetting 6 endpoint 0xE has invalid maxpacket 512, setting to 64 [ 2775.726316][T26362] em28xx 5-1:0.89: Registering snapshot button... [ 2775.737317][ T895] usb 4-1: config 9 interface 160 has no altsetting 0 [ 2775.744326][T26362] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input358 [ 2775.788145][T26362] em28xx 5-1:0.89: Remote control support is not available for this card. [ 2775.800563][ T7713] em28xx 5-1:0.89: Closing input extension [ 2775.807845][ T7713] em28xx 5-1:0.89: Deregistering snapshot button [ 2775.890955][ T895] usb 4-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=39.33 [ 2775.900269][ T895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2775.908311][ T895] usb 4-1: Product: syz [ 2775.916644][ T895] usb 4-1: Manufacturer: syz [ 2775.921857][ T895] usb 4-1: SerialNumber: syz [ 2775.927622][ T4276] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 2775.934863][ T4276] CPU: 1 UID: 0 PID: 4276 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 2775.945351][ T4276] Tainted: [L]=SOFTLOCKUP [ 2775.949747][ T4276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 2775.959799][ T4276] Call Trace: [ 2775.963065][ T4276] [ 2775.965983][ T4276] vpanic+0x56c/0xa60 [ 2775.969963][ T4276] ? __pfx_vpanic+0x10/0x10 [ 2775.974460][ T4276] panic+0xc5/0xd0 [ 2775.978162][ T4276] ? __pfx_panic+0x10/0x10 [ 2775.982573][ T4276] ? preempt_schedule_thunk+0x16/0x30 [ 2775.987983][ T4276] ? preempt_schedule_thunk+0x16/0x30 [ 2775.993341][ T4276] ? v4l2_fh_open+0xac/0x420 [ 2775.997923][ T4276] check_panic_on_warn+0x89/0xb0 [ 2776.002845][ T4276] ? v4l2_fh_open+0xac/0x420 [ 2776.007421][ T4276] end_report+0x73/0x180 [ 2776.011648][ T4276] ? v4l2_fh_open+0xac/0x420 [ 2776.016221][ T4276] kasan_report+0x128/0x150 [ 2776.020709][ T4276] ? v4l2_fh_open+0xac/0x420 [ 2776.025297][ T4276] v4l2_fh_open+0xac/0x420 [ 2776.029711][ T4276] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2776.035694][ T4276] em28xx_v4l2_open+0x157/0x9a0 [ 2776.040534][ T4276] ? do_raw_spin_lock+0x12b/0x2f0 [ 2776.045552][ T4276] v4l2_open+0x1bf/0x3a0 [ 2776.049786][ T4276] chrdev_open+0x4cd/0x5e0 [ 2776.054191][ T4276] ? __pfx_chrdev_open+0x10/0x10 [ 2776.059117][ T4276] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 2776.065442][ T4276] ? __pfx_chrdev_open+0x10/0x10 [ 2776.070368][ T4276] do_dentry_open+0x785/0x14e0 [ 2776.075124][ T4276] vfs_open+0x3b/0x340 [ 2776.079184][ T4276] ? path_openat+0x2df0/0x3860 [ 2776.083934][ T4276] path_openat+0x2e08/0x3860 [ 2776.088513][ T4276] ? __pfx_stack_trace_save+0x10/0x10 [ 2776.093871][ T4276] ? stack_depot_save_flags+0x33/0x810 [ 2776.099323][ T4276] ? __pfx_path_openat+0x10/0x10 [ 2776.104248][ T4276] ? __x64_sys_openat+0x138/0x170 [ 2776.109260][ T4276] ? do_syscall_64+0x14d/0xf80 [ 2776.114013][ T4276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2776.120074][ T4276] ? __lock_acquire+0x6b5/0x2cf0 [ 2776.125004][ T4276] do_file_open+0x23e/0x4a0 [ 2776.129502][ T4276] ? __pfx_do_file_open+0x10/0x10 [ 2776.134517][ T4276] ? _raw_spin_unlock+0x28/0x50 [ 2776.139353][ T4276] ? alloc_fd+0x64b/0x6c0 [ 2776.143673][ T4276] do_sys_openat2+0x113/0x200 [ 2776.148339][ T4276] ? __pfx_do_sys_openat2+0x10/0x10 [ 2776.153524][ T4276] ? exc_page_fault+0x6a/0xc0 [ 2776.158188][ T4276] ? do_user_addr_fault+0xc6f/0x1340 [ 2776.163462][ T4276] __x64_sys_openat+0x138/0x170 [ 2776.168301][ T4276] do_syscall_64+0x14d/0xf80 [ 2776.172887][ T4276] ? trace_irq_disable+0x3b/0x150 [ 2776.177899][ T4276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2776.183949][ T4276] ? clear_bhb_loop+0x40/0x90 [ 2776.188613][ T4276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2776.194492][ T4276] RIP: 0033:0x7facab2a7407 [ 2776.198894][ T4276] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 2776.218494][ T4276] RSP: 002b:00007ffff00e6250 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 2776.226894][ T4276] RAX: ffffffffffffffda RBX: 00007facab99f880 RCX: 00007facab2a7407 [ 2776.234852][ T4276] RDX: 0000000000000000 RSI: 00007ffff00e7f1b RDI: ffffffffffffff9c [ 2776.242808][ T4276] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 2776.250851][ T4276] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 2776.258809][ T4276] R13: 00007ffff00e64a0 R14: 00007facabb06000 R15: 000055e6744cb4d8 [ 2776.266769][ T4276] [ 2776.270108][ T4276] Kernel Offset: disabled [ 2776.274437][ T4276] Rebooting in 86400 seconds..