last executing test programs: 2m35.492254635s ago: executing program 3 (id=629): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0) 2m35.39475871s ago: executing program 3 (id=633): openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xfffffffffffffffd}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) fgetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x4090) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) mount$9p_rdma(&(0x7f00000000c0), &(0x7f0000000140)='.\x00', &(0x7f00000001c0), 0x10000, &(0x7f0000000440)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@sq={'sq', 0x3d, 0xb}}]}}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file0\x00', 0x42, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x12, 0x8, 0x4, 0x7cb4, 0x0, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) 2m34.397177271s ago: executing program 3 (id=636): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000002c0)={'syzkaller1\x00', @broadcast}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000600)) r3 = dup(r1) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x220002, 0x0) r5 = fcntl$dupfd(r0, 0x0, r4) ioctl$VHOST_SET_VRING_ADDR(r5, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0, 0xe000}) ioctl$VHOST_NET_SET_BACKEND(r5, 0x4008af30, &(0x7f0000000080)={0x0, r3}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r7) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'veth1_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000200)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x727, 0x5, 0x1, 0x5, 0x382, 0x4, 0x1, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x2400c8d1}, 0x48004) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x319}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240408a0}, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r4, 0xc0206434, &(0x7f0000000380)={0xc00000, 0x0, 0x10001}) ioctl$DRM_IOCTL_SG_ALLOC(r3, 0xc0106438, &(0x7f0000000440)={0x4, r10}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r11 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r11) 2m33.9941643s ago: executing program 3 (id=640): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async, rerun: 32) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0) (async, rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (async, rerun: 32) r1 = getpid() (rerun: 32) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000380)=@abs={0x0, 0x0, 0x4e23}, 0x6e) (async) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) (async, rerun: 64) r4 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) (async) r5 = add_key(&(0x7f0000001340)='keyring\x00', &(0x7f0000001380)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000000)='asymmetric\x00', &(0x7f0000000040)=@chain={'key_or_keyring:', r5}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r6 = socket(0x400000000010, 0x4, 0x0) (async, rerun: 64) r7 = socket$unix(0x1, 0x5, 0x0) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r8, {0x8, 0x7}, {}, {0x8, 0x3}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0xffa, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x26044028}, 0x800) 2m33.777146472s ago: executing program 3 (id=642): ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, &(0x7f0000000040)={0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x2000000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) socket$nl_rdma(0x10, 0x3, 0x14) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x189002) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, 0x0) timer_create(0x3, 0x0, &(0x7f0000044000)) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000005580)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000d0000000001000026a03a3a33ae6a6130000000002c000000030a01080000000000000000010000000900010073797a30000000000900030073797a320000000014000000060a010400000000000000000100000014000000110001"], 0x88}}, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001800dd8d0000000000000000020000000000000600000000060015000100000018001680140001"], 0x3c}, 0x1, 0x0, 0x0, 0x20000010}, 0x200000a0) 2m33.718957143s ago: executing program 3 (id=643): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x7, 0x9, 0x6, 0x9b33}, {0x1, 0x10, 0x59, 0xfffffffd}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0, 0x0}) r3 = socket$igmp6(0xa, 0x3, 0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000100)={r1, 0x2, r3, 0x7fff}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)) ioctl$XFS_IOC_SWAPEXT(r3, 0xc0c0586d, &(0x7f00000001c0)={0x0, r0, r0, 0x9, 0xc, '\x00', {0x8000000000, 0xfff9, 0x7, 0x1e63e6cb, 0x9, 0x4, 0x10001, 0xaaaa, {0x7, 0x9}, {0x4, 0x7}, {0x4, 0x6}, 0x80, 0xfffffff8, 0x7, 0x1, 0x0, 0x20, 0x4, 0x4, 0xff, 0x0, '\x00', 0x3f5c, 0x3, 0x4, 0x6}}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x144, 0x9, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x4}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x4d}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_ADT={0x44, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @empty}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x7}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x1}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @local}, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x800}, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x6}, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x88, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2_TO={0x18, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e20}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x5, 0x1a, '\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xca80c077acbc61ea}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2_TO={0x18, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x48080}, 0xc000) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x4001, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r5, 0xc004ae02, &(0x7f0000000500)={0x1, [0x0]}) r6 = syz_open_dev$ndb(&(0x7f0000000540), 0x0, 0x2000) ioctl$NBD_SET_SIZE(r6, 0xab02, 0x0) socket$alg(0x26, 0x5, 0x0) r7 = syz_open_dev$video4linux(&(0x7f0000000580), 0x7, 0x600040) ioctl$VIDIOC_S_HW_FREQ_SEEK(r7, 0x40305652, &(0x7f00000005c0)={0x9, 0x1, 0x7, 0x1, 0x2, 0x9, 0x7}) r8 = syz_open_dev$loop(&(0x7f0000000600), 0x7fff000000000, 0x204801) r9 = syz_open_dev$sndmidi(&(0x7f0000000640), 0x1, 0x100000) ioctl$LOOP_CHANGE_FD(r8, 0x4c06, r9) r10 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000680), 0x80, 0x0) r11 = syz_open_dev$ndb(&(0x7f00000006c0), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r11, 0xab07, 0x4) io_setup(0xa, &(0x7f0000000700)=0x0) io_destroy(r12) sendto$inet_nvme_pdu(r10, &(0x7f0000000740)=@data_h2c_hdigest={{0x6, 0x2, 0x18, 0x1c, 0x9}, 0x9, 0x5, 0x3, 0xd5275c5, "b4b0060c"}, 0x80, 0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000a00)={r10, 0x58, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000ac0)={r10, 0xffffffffffffffff}, 0x4) r15 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000b00)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0xffffffff, '\x00', 0x0, r10, 0x2, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000c40)={0x11, 0xd, &(0x7f00000007c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xed4c, 0x0, 0x0, 0x0, 0x987}, [@btf_id={0x18, 0xb, 0x3, 0x0, 0x4}, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x101}}]}, &(0x7f0000000840)='GPL\x00', 0x3, 0xc9, &(0x7f0000000880)=""/201, 0x41000, 0x8, '\x00', r13, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000a40)={0x0, 0x5}, 0x8, 0x10, &(0x7f0000000a80)={0x0, 0xf, 0x5, 0xa00000}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000b80)=[r14, r10, r10, r15, r3], &(0x7f0000000bc0)=[{0x2, 0x2, 0x2, 0xa}, {0x0, 0x1, 0x2, 0x9}, {0x1, 0x2, 0x3, 0x4}, {0x2, 0x1, 0x1, 0x3}, {0x4, 0x1, 0x9, 0x3}, {0x4, 0x4, 0xc, 0x9}, {0x5, 0x3, 0x6, 0xb2883776ea08b010}], 0x10, 0x400}, 0x94) socket$pppl2tp(0x18, 0x1, 0x1) timer_create(0x2, &(0x7f0000000d00)={0x0, 0x3c, 0x2, @tid=r2}, &(0x7f0000000d40)) 2m18.384374169s ago: executing program 32 (id=643): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x7, 0x9, 0x6, 0x9b33}, {0x1, 0x10, 0x59, 0xfffffffd}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000080)={0x0, 0x0}) r3 = socket$igmp6(0xa, 0x3, 0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000100)={r1, 0x2, r3, 0x7fff}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000140)) ioctl$XFS_IOC_SWAPEXT(r3, 0xc0c0586d, &(0x7f00000001c0)={0x0, r0, r0, 0x9, 0xc, '\x00', {0x8000000000, 0xfff9, 0x7, 0x1e63e6cb, 0x9, 0x4, 0x10001, 0xaaaa, {0x7, 0x9}, {0x4, 0x7}, {0x4, 0x6}, 0x80, 0xfffffff8, 0x7, 0x1, 0x0, 0x20, 0x4, 0x4, 0xff, 0x0, '\x00', 0x3f5c, 0x3, 0x4, 0x6}}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x144, 0x9, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x4}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x4d}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_ADT={0x44, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @empty}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e22}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x7}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x1}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_ETHER={0xa, 0x11, @local}, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x800}, @IPSET_ATTR_SKBPRIO={0x8, 0x1c, 0x1, 0x0, 0x6}, @IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}]}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x88, 0x8, 0x0, 0x1, [{0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2={0x18, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2_TO={0x18, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e20}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x5, 0x1a, '\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xca80c077acbc61ea}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP2_TO={0x18, 0x16, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}}}}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x48080}, 0xc000) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x4001, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r5, 0xc004ae02, &(0x7f0000000500)={0x1, [0x0]}) r6 = syz_open_dev$ndb(&(0x7f0000000540), 0x0, 0x2000) ioctl$NBD_SET_SIZE(r6, 0xab02, 0x0) socket$alg(0x26, 0x5, 0x0) r7 = syz_open_dev$video4linux(&(0x7f0000000580), 0x7, 0x600040) ioctl$VIDIOC_S_HW_FREQ_SEEK(r7, 0x40305652, &(0x7f00000005c0)={0x9, 0x1, 0x7, 0x1, 0x2, 0x9, 0x7}) r8 = syz_open_dev$loop(&(0x7f0000000600), 0x7fff000000000, 0x204801) r9 = syz_open_dev$sndmidi(&(0x7f0000000640), 0x1, 0x100000) ioctl$LOOP_CHANGE_FD(r8, 0x4c06, r9) r10 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000680), 0x80, 0x0) r11 = syz_open_dev$ndb(&(0x7f00000006c0), 0x0, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r11, 0xab07, 0x4) io_setup(0xa, &(0x7f0000000700)=0x0) io_destroy(r12) sendto$inet_nvme_pdu(r10, &(0x7f0000000740)=@data_h2c_hdigest={{0x6, 0x2, 0x18, 0x1c, 0x9}, 0x9, 0x5, 0x3, 0xd5275c5, "b4b0060c"}, 0x80, 0x0, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000a00)={r10, 0x58, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000ac0)={r10, 0xffffffffffffffff}, 0x4) r15 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000b00)={0x3, 0x4, 0x4, 0xa, 0x0, r10, 0xffffffff, '\x00', 0x0, r10, 0x2, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000c40)={0x11, 0xd, &(0x7f00000007c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xed4c, 0x0, 0x0, 0x0, 0x987}, [@btf_id={0x18, 0xb, 0x3, 0x0, 0x4}, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x101}}]}, &(0x7f0000000840)='GPL\x00', 0x3, 0xc9, &(0x7f0000000880)=""/201, 0x41000, 0x8, '\x00', r13, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000a40)={0x0, 0x5}, 0x8, 0x10, &(0x7f0000000a80)={0x0, 0xf, 0x5, 0xa00000}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000b80)=[r14, r10, r10, r15, r3], &(0x7f0000000bc0)=[{0x2, 0x2, 0x2, 0xa}, {0x0, 0x1, 0x2, 0x9}, {0x1, 0x2, 0x3, 0x4}, {0x2, 0x1, 0x1, 0x3}, {0x4, 0x1, 0x9, 0x3}, {0x4, 0x4, 0xc, 0x9}, {0x5, 0x3, 0x6, 0xb2883776ea08b010}], 0x10, 0x400}, 0x94) socket$pppl2tp(0x18, 0x1, 0x1) timer_create(0x2, &(0x7f0000000d00)={0x0, 0x3c, 0x2, @tid=r2}, &(0x7f0000000d40)) 15.520721946s ago: executing program 0 (id=1271): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80015b1a, 0x0) 12.452984627s ago: executing program 0 (id=1283): syz_usb_connect(0x2, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000538acc089c0e00001e5b0102030109021b00010000000009040000014b34ef000905", @ANYRES16], 0x0) syz_open_dev$evdev(&(0x7f0000003880), 0x4, 0x8101) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000040)={0xa, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) io_uring_setup(0x77d0, &(0x7f0000000080)={0x0, 0x8ea6, 0x1, 0x1, 0x3da}) sendmsg$IPSET_CMD_LIST(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000000706010400000000000000000500000a0500010007000000d74f60678715c628a0c449fbfbd18fd2f571abc18fe059b01a8e9c133e050f346a8335806db529cd53e84bb08b30337ea2185c98660e5126a5b26d40"], 0x1c}, 0x1, 0x0, 0x0, 0x20004055}, 0x48000) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, &(0x7f0000000080)) sendmsg$NFT_MSG_GETTABLE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x100, 0x1, 0xa, 0x381, 0x0, 0x0, {0x8, 0x0, 0x1}, [@NFTA_TABLE_USERDATA={0xde, 0x6, "54578d8d9c43a288ae7d57c4ff39babad77ac99f0c6f9b0cdd253b0c9fb52282b2f374f3e4dda9db3030508c2701e0ef884846519203732adee95ccb69c3f3dd50e59b71b09cfd92d013cfe0f0ddd1668d12cc2aece1bf0997233dfc69ccece7a02ebe4f2b5e50f33ed0d5b35bd4ac1e332793d471fa56f20838fff135dc4aaa21bf75a101840d59253b466e016d5c89677b49d0d3b119cb7512a7b42d2a0a86ff6a2e3743ea4c6b5986eac8bfa736f2c91112be4b15651812caa25a4749027fcc0ad468b3a6377a1f50bdc6ea98a5c8291e347349acdfc21688"}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x100}, 0x1, 0x0, 0x0, 0x40}, 0x40) syz_open_procfs(0x0, &(0x7f0000000140)='attr/sockcreate\x00') 9.443857229s ago: executing program 0 (id=1301): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e8c}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 9.156354246s ago: executing program 0 (id=1303): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000000000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000075f84c1071042703a461000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000040)={0x8c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.468814317s ago: executing program 0 (id=1322): r0 = socket(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'erspan0\x00', 0x100}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040004) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@deltclass={0x4c, 0x29, 0x300, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x6, 0x3}, {0x0, 0xd}, {0xd, 0xb}}, [@TCA_RATE={0x6, 0x5, {0x12, 0x8}}, @tclass_kind_options=@c_sfq={0x8}, @tclass_kind_options=@c_multiq={0xb}, @tclass_kind_options=@c_ingress={0xc}]}, 0x4c}, 0x1, 0x0, 0x0, 0x60004080}, 0x20000000) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff77fc}]}) close_range(r6, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000001780)={&(0x7f0000000340)={0x34, r7, 0x23, 0x70bd25, 0x25dfdbfc, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4440}, 0x24048014) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000016c0)={0x11, 0xc, &(0x7f0000001600)=ANY=[@ANYRES64=r5, @ANYRES8=r9, @ANYRES8=r4], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r10, r9, 0x25, 0x0, @void}, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_GET(r0, &(0x7f0000001640)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000005c0)={&(0x7f00000017c0)={0x174, r7, 0x20, 0x70bd29, 0x25dfdbff, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0x4}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}]}, @HEADER={0x4}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}]}]}, 0x174}, 0x1, 0x0, 0x0, 0x20008881}, 0x4) r11 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r11, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000040)={0x20, 0x23}, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x2c, 0xaa}, [@ldst={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff0}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_usb_control_io$uac2(r11, &(0x7f0000000400)={0x14, &(0x7f00000002c0)={0x40, 0xa, 0xf8, {0xf8, 0x31, "685acdc7e098e03d1f73b536895edf4e261bd33e9434e19f3b9ee22b40c7faf29fe626c71e37e21bba658d4cbff352095760d926734b9bfc24205b0728106f6ccbb4cc20f779a267c6cf218dead33ac15671b24ce06a2bfc698feade1f2017174a286f575dd6f141471aeaa90f298f234149b8f1e3a892cf6c166f67d8ae946b176c59e61017fa0889a71275487da69ac806a5c893c194222f79839b5074c15a4034f521bf2ca7cf06c1299dc642a95ed974c06049f35fd3acefdbbb92786058da7143e0c8c281a338bea76c273dbbaba1bc5c5fcbf8393c9995580becaf4d0fd0a1b77b31e22d91451161165ede7067ab159edb5c46"}}, &(0x7f00000003c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44e}}}, &(0x7f0000001380)={0x44, &(0x7f0000000440)={0x40, 0xe, 0x92, "94be17d8f405109e38c8ef2fd41c69bed0a0414f81ae7a6473168361a5625a944d4f5c669ab9b28ae3b5fe8f6f88c05b6a6f911b66af82a31d97a20093b423ff29e868194eab7413b28d5b10cd0db3bfe141045b9c7f66b4223dcc33e6545d696376a60e7102e933dc7adec99e8b45a78d9a5b7747bb908c58db65be34725816dca5694602dfe1b8b29b6c209077758cf641"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0x94}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000001680)=ANY=[@ANYBLOB="7953faee00002c4a752163acd462b45091dbff7eaa30"], &(0x7f0000000600)=ANY=[@ANYBLOB="208202000600bdfa"], &(0x7f0000000640)={0x20, 0x83, 0x1, ','}, &(0x7f0000000680)={0x20, 0x84, 0x4, "7fd7562c"}, &(0x7f0000001340)={0x20, 0x85, 0x3, "32bda0"}}) syz_usb_connect(0x5, 0x91b, &(0x7f0000000780)={{0x12, 0x1, 0x201, 0xa6, 0x75, 0x42, 0x40, 0x64b, 0x7825, 0xf0e2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x909, 0x2, 0x10, 0x5, 0x0, 0x5, "", [{{0x9, 0x4, 0x4b, 0x3, 0xd, 0x6e, 0x7, 0x60, 0xe, [@generic={0xe1, 0xf, "0cbf1be89a289b51bdd93c9d3054eb71291a8a102197c35e0c828ffc2d90cac00dad1316437eb1d3f70130907105f62f56ef201d75569dd61bb2475a6062420faf298f8576420ab9c646f844d435fd562ffde5a27e83894517ed70868741c2554b3e076a020072aed1d38fb0a16e5151afe29271768852b0308d628045d3e201ad78b7c1510bfa8fd8cf6173091ce1f349071cdada76f836621acd51b456a5820383d6e7d5af2943b575a7e889904dae4b14ac54e12774e3b1118d74b014e4107fd8b1c7bdc39ef8b6627fb231622d2f5fa73acc33a07fd778419f93701b72"}, @hid_hid={0x9, 0x21, 0x6, 0x3a, 0x1, {0x22, 0x2ed}}], [{{0x9, 0x5, 0x80, 0x14, 0x40, 0x74, 0x80, 0x25}}, {{0x9, 0x5, 0xb, 0x3, 0x3ff, 0x5, 0x0, 0xbf, [@generic={0x71, 0x22, "f5d3eda6dac20792780327467c5491b3e6c7fe8d9c713b131596e1b1ed67260d631522deda8a5c3fe57adb5c48b04a1022a4c51394e06bf0cb2eb8cb7a1c9b8bce26573c2b1d373450dc62cc0e6a5ed4db193187a1955cb1c3eec3c2f4d13fbed283fa16d5d45aa2d7cf706c081f06"}, @generic={0x2d, 0xb, "18d3d554c0c46a6738cd7ac278a75a1207f9fc0f7e3b869690edd1e4970d96ea5b7e077e156ae1a845408a"}]}}, {{0x9, 0x5, 0xa, 0xc, 0x40, 0x6, 0x7, 0x5}}, {{0x9, 0x5, 0x0, 0x1, 0x10, 0x25, 0x0, 0x3, [@generic={0x7e, 0x10, "fc8a42619b1978dd63a5b4a624123e4aec8e483fc368221092e9b35067df76d7a6168fc76ad4691fca11f647d631701dfac63331ad031349dd40b39d3676c42b1e673249c129ac242f9e3a1e0f93a693e3d0bab22f069750b2e68665c26afe2675d6f01a1a5bb32e0d84d661d1c76b2b7129736632357ee05098b075"}, @generic={0x91, 0x0, "eaa8f0ca58c5c2667f109262349c84272609856a40e6f55acf37d43ade6fd765e780918a96a5cbbefa40082feecc95894d5c0f16d6eaf433bcf9abba2299eeb219edde55ee54c493245ebbe7727548cdf73e0f6890428352120931043f7b0df72cb5aaf0ffdcb397a0c0d0e0b2a455502fc5de0529a5aad8ae6467fdea44977e8f7ec4c7185eb23f2cd9cb31437e8f"}]}}, {{0x9, 0x5, 0x5, 0x3, 0x8, 0x4, 0x74, 0x0, [@generic={0xad, 0x1, "17298bed9c6f14357488e1aafbdc1c415e9aa3a729ff2fca8a34e004eecfaf7e7893dc07b4f4af210355931e1a0019c125df134cc62d22a2d6df00732b3181a99b9ffd2ad39781cb35be6d46ee79bcec6a5a7cfb35e14c973dc0d93d290578003ed17c452ce974e325b5410e27e0670c8460c689973f6af2db994d724f4355b3ae495611c26649c8675f6b19eaccbd9e3871e2e45553089813dc42c42f4a64dcdba117e3250352f7e2b6fd"}, @generic={0x55, 0x5b, "c3461bd06e3a935959ff675828c1ee83652c40699b354c95f7db82d90d8543dc823f5b856c63b7e9c2c78284aca1fb352e044660129ecda16a63e5fc5bf77f5162bba6e29a516f051dcfe8dea5e28a32e3c488"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x200, 0x4, 0xf5, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x8, 0x6}]}}, {{0x9, 0x5, 0x4, 0x8, 0x20, 0x78, 0x8, 0x4, [@generic={0x95, 0x30, "3ce97f820d01ecf8a45b4f3929eaf5abe467078377cc4825dfe19396121cb179701da52c5cdabfc348405e6f0f6277639698c81b8fd28bdc425d32f0d4b652337d05c9cae3b3950c281af254a73367da4aa514e4591652826f71acf6384f66cbf331c26d2445cae0284960a08a22a47b81405bd89d295feee34dc3673e98d87899e839145558e683a9f46fb8637497a11664ba"}]}}, {{0x9, 0x5, 0x80, 0x2, 0x10, 0x4, 0x4, 0xc}}, {{0x9, 0x5, 0xf, 0xc, 0x8, 0x6, 0x9, 0x20}}, {{0x9, 0x5, 0xb, 0x4, 0x20, 0x1a, 0x3, 0xb, [@generic={0xc8, 0xb, "9c7b1c384e643f101508f35b3750ff53e0de50d843296309039325cc596cb40ab7ed06dbc753dac7cd06f2aaa094880ad80aea6326f8a3b876266878a692bf7b0b5d4debf4cae9fa0f0c8c4afa1864fdd9fd187956fe4a9d4a50b28815c99c068bbdf0bf11a01a3126237994c3be893a999b257962d77d3157ffd8fd0a5d239d0771b71a247dfd0feae03466e2cb09c238084249baa1ebfcd8217d2dcba1804cf1981c15ce0ed14a5a7a57bda5695c9cf7521e77d4008dcf13eaca9f431a01b7ec20a1aa8f71"}]}}, {{0x9, 0x5, 0x6, 0x0, 0x20, 0x9, 0xff, 0xac, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x6, 0xff01}]}}, {{0x9, 0x5, 0x9, 0xc, 0x400, 0x0, 0x1, 0xe, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x0, 0x2}]}}, {{0x9, 0x5, 0x3, 0x1, 0x3ff, 0x3, 0x7}}]}}, {{0x9, 0x4, 0x38, 0xf7, 0xf, 0x1, 0x24, 0x6, 0xa, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "c204d6a5edb6"}, {0x5, 0x24, 0x0, 0x1000}, {0xd, 0x24, 0xf, 0x1, 0x8001, 0x8, 0x2cf0, 0x4}, [@mbim_extended={0x8, 0x24, 0x1c, 0x75db, 0xf7, 0x3}, @network_terminal={0x7, 0x24, 0xa, 0x80, 0x4, 0x6, 0x5}, @acm={0x4, 0x24, 0x2, 0x3}, @mbim_extended={0x8, 0x24, 0x1c, 0xff3f, 0x0, 0x3}, @country_functional={0xe, 0x24, 0x7, 0x3e, 0x9, [0x200, 0x792e, 0xff, 0x1]}, @country_functional={0x10, 0x24, 0x7, 0x4, 0x5be7, [0x2, 0x9, 0x8, 0x1a, 0x0]}]}], [{{0x9, 0x5, 0xe, 0x0, 0x40, 0xc, 0x7, 0x4}}, {{0x9, 0x5, 0xc, 0x10, 0x400, 0xfb, 0x8}}, {{0x9, 0x5, 0x9, 0x3, 0x200, 0xe, 0x5, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xb, 0x1000}]}}, {{0x9, 0x5, 0x0, 0xc, 0x40, 0x3, 0x9, 0x7f}}, {{0x9, 0x5, 0xb, 0x0, 0x10, 0x4b, 0x5, 0x81, [@generic={0x5b, 0x3, "3c3b84f28adb0f65b36bc4d09bf722f146b6e54af2899df856185fecf3e751d9c4366566b24ec5f778c01af3a38e97b4d12547f0fffcfa7eb15a07ed3edb700df07de24b82058786b173acc5a32bfb964458252dd958eba008"}]}}, {{0x9, 0x5, 0x7, 0x2, 0x40, 0x3b, 0x80, 0x7}}, {{0x9, 0x5, 0x1, 0x0, 0x400, 0x6, 0x4, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x26, 0x8}, @generic={0x47, 0x23, "40c1fdde850327a4576e26e312db885b55d01c7f450798145caa0dd7dba0c7370ab539974d5fd09c2c69fb4303cee7bd61a460768768e1e592addaac5a40219396870c4cd4"}]}}, {{0x9, 0x5, 0x5, 0x0, 0x40, 0x1, 0x3, 0x4}}, {{0x9, 0x5, 0x0, 0x0, 0x40, 0x80, 0x0, 0x5}}, {{0x9, 0x5, 0x8, 0x0, 0x10, 0xb, 0x81, 0x9}}, {{0x9, 0x5, 0xc, 0x0, 0x400, 0x2, 0x0, 0x3, [@generic={0x1f, 0x31, "460f1835f7de8295c30bdff0735c3a09ac169225514bdd25413ee60503"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x3ef, 0x7, 0x9, 0x3e, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x80, 0x4}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x7}]}}, {{0x9, 0x5, 0x6, 0x0, 0x10, 0x1, 0x2, 0x56}}, {{0x9, 0x5, 0x1, 0x0, 0x20, 0xd, 0x3, 0x2}}, {{0x9, 0x5, 0x8, 0x2, 0x10, 0x7, 0x8, 0x4, [@generic={0xef, 0x5, "83bdaf4ba01512b3c3556e573f68d91c6bdd48d5b7bcf7eb10f7dd1ddab8adb5d85e1d6f9b3b51e107f4806f2531166e0a7d2d14aeae1d81da91178bf64f1a9ae44846b5a4104d95f856c2bd0b1243507058a2576d4e2320d34f9b5d90d05bbb849f0b67ffc8a061e8b76c414bda1fbfef410cf06f3812138b97a0bdc9fdfed0caff55313c329703851bad1809d429ba64f0d716d3872d700251f094d728ab763486c111eb7a454355296449c62165ddc2ed0319fb88ec79971927ca2efddfd48a7bd10cd0b248137d5cc043040700e6edf786bbcd9285886d65aaf9ddc76638acc801d757ca3fc9b858ab6cf9"}, @generic={0xc5, 0x10, "6a0d2fa870b31c45ad62761a02d0b9770cde0ef6403c6f3418f42a507f00b31a87d3735723cbf5bf214d6bca4589a215d8508d721d44b1e9880330084ca2158b8f93327d5f0b021aa2fc0334cc9581d8fa261854b1ce04b99b18d4ef0949572f487f241b5a6d824c19b7b0a7c13b4444671834fff37b6f548f2799fc180fb1db1b1e6c161460a13fbb395e09a046fa7742d768a6240314c9fe2ddb52af086e5ce0e538dff93536be61ee6afcd0693ee8199745a6fa2f722a9a348a67a7e2fc1a9891d7"}]}}]}}]}}]}}, &(0x7f0000001300)={0xa, &(0x7f00000010c0)={0xa, 0x6, 0x201, 0x55, 0x8, 0xf, 0x0, 0x26}, 0x5f, &(0x7f0000001100)={0x5, 0xf, 0x5f, 0x6, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x8, 0x41, 0x1c, 0xd9, 0x4, 0xfe}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "cfab5a5a139799168f4199677f85c765"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x4, 0x1, 0xfffc}, @ssp_cap={0x24, 0x10, 0xa, 0x4c, 0x6, 0x6, 0xf00, 0xb3, [0x30, 0x3f00, 0xff3f00, 0xc0, 0x600f, 0xff41ff]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xc, 0xf, 0x10, 0x8}]}, 0x2, [{0xb0, &(0x7f0000001180)=ANY=[@ANYBLOB="b003c8207dfe0bd0d20788cbdcc86f6a25968c1c07ebef97d0821836c740ecfac9eae0b3d06e2268f3848881b12d8b19f7509b164cfab023112e78f511b0793a5af1b79843cfd8c75050de3fb00a03cea7bb3099c637c8d91f68870305c70d11269a05a7e7d88ef0d59410581a71e2ceb2ab2cf3cccc19e606ea326df9e6bc2f51e2d21b91526e7140b55366457f04ce389200681792accc50c9c647708efadf2a314d4d9b2f133a7f5f7a846c999e28"]}, {0x94, &(0x7f0000001240)=@string={0x94, 0x3, "b88defcfac1963c8c268957bb8881a6df094f5fece9138fb24035900b35920fee26c3ea540395e10b0ac4f6b1f52d13a24ebfde328108eef75277c56ecd0f0d3e92dd07136bbd4a1ed9028491c9b9074418331f1771f725d7e3ff7ff16d5988abce7256718ad83fb4ff20a9fb0fe34fe03068729a8eabeab0aaef45b14cda6d1312a238cfabc91e1d06f042f64ce902a25a2"}}]}) syz_usb_control_io$rtl8150(r11, 0x0, 0x0) syz_usb_control_io$uac3(r11, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r11, 0x0, 0x0) syz_usb_control_io$hid(r11, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r11, 0x0, 0x0) 6.417065676s ago: executing program 5 (id=1323): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x80015b1a, 0x0) 5.606612541s ago: executing program 1 (id=1326): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000190a01110000000000000000020000000c00034000000000000000020900020073797a32000000000900010073797a30"], 0x38}, 0x1, 0x0, 0x0, 0x44044}, 0x4004) 5.404244258s ago: executing program 1 (id=1329): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c000200", @ANYRES16=r1], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) sendmsg$NFC_CMD_GET_TARGET(0xffffffffffffffff, 0x0, 0x54) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="3c00000010000304000000000020000000000000", @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350064756d6d79300000000000000000000008000a00", @ANYRES32=r2, @ANYBLOB], 0x3c}}, 0x8000) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r4, &(0x7f00000006c0)="3b000000010006", 0x7) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000100)) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000004c0)={0x4, 0x0, &(0x7f0000000000)=[@exit_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x30000000}], 0x0, 0x0, 0x0}) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) ioctl$KVM_GET_DIRTY_LOG(0xffffffffffffffff, 0x4010ae42, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000ffc000/0x4000)=nil}) 5.247196521s ago: executing program 1 (id=1330): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x2}, {}, {0x10, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0xccfc}]}}]}, 0x44}}, 0x20084084) (fail_nth: 3) 5.020935005s ago: executing program 1 (id=1332): syz_emit_ethernet(0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa5d3ec70048e886dd601823182c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa7302020c00000000000000000000000100"/78], 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000ac0), r0) r1 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setgroups(0x1, &(0x7f00000002c0)=[0x0]) setregid(0xffffffffffffffff, r2) socket$inet6_icmp(0xa, 0x2, 0x3a) r3 = gettid() close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r4, &(0x7f0000000100)='\x00', 0x1) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) syz_open_procfs$namespace(r3, &(0x7f0000000040)='ns/ipc\x00') ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b40)={'wpan1\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9}, 0x48) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050186dd6000000000202c00fe80000000000000004bbcadd649000000000000bbfe8000000000000000000000000000aa84000201000000008802036c00000000200100"/91], 0x0) syz_open_procfs(0x0, &(0x7f0000000440)='map_files\x00') r7 = semget$private(0x0, 0x4, 0x5c3) semop(r7, &(0x7f0000000180)=[{0x0, 0x203}, {}], 0x2) r8 = semget$private(0x0, 0x2, 0x101) semtimedop(r8, &(0x7f0000000280)=[{0x0, 0xb908, 0x1000}], 0x1, &(0x7f00000002c0)) r9 = syz_ublk_setup_io_uring(0x1f, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfffffffd, 0x249}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000000)=0x0) syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) 4.553490374s ago: executing program 4 (id=1333): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_udp(0xa, 0x2, 0x0) socket(0xa, 0x3, 0x3a) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x70bd25, 0x0, {0xa, 0x20}, [@RTA_IP_PROTO={0x5, 0x1b, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008864}, 0x800) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x0, 0x800) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) readv(r2, &(0x7f0000000180)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) 3.996817134s ago: executing program 5 (id=1335): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e8c}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 3.604105999s ago: executing program 1 (id=1336): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002980)={0x28, 0x10, 0x107, 0x70bd2b, 0x25dfdbff, {0x3, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x140}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x106, 0x0, 0x0, @pid}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) fchdir(r0) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000000)='proc\x00', 0x800000, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r2 = socket$netlink(0x10, 0x3, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, 0x0, 0x0) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r4, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x7, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000002380)='net/ip_mr_cache\x00') pread64(r5, &(0x7f0000000100)=""/253, 0xfd, 0x1) pselect6(0x40, &(0x7f0000000100)={0x0, 0x3, 0x0, 0x1, 0x800}, 0x0, &(0x7f0000000240)={0x1f, 0x3}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) bind$netlink(r2, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x4000000}, 0xc) getsockopt$netlink(r2, 0x10e, 0x9, &(0x7f0000001100)=""/4096, &(0x7f0000000040)=0x1000) r6 = syz_clone(0xd104200, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0) r7 = syz_open_procfs(r6, &(0x7f0000000040)='cgroup\x00') syz_fuse_handle_req(r7, &(0x7f0000000ac0)="74fca81a094e5eff20e5a35163dc087f600365763c07eff45b001f6e966b3f0aff6858516b180faecd528e20d5ee362d5f85720e001df2b5bacea1d82c9be600fa0bcfacb12b7de4fb2750ae0f79a0d83e14279c38a5f2b4b153a3f912fe6b9c8af6c652e640676f979681d948f76df02ce0c462485a84b14a7617ff56cfd79b98d143a4dea1ad223d9d41b373666272d261033eed1694743d1573333a0156576d59557c720241af7d7ab0cb2ab63c80a7ac3b4145eb7300367c185bdf1e7685b36c0fe98a72408ce9b30cd351c7f26123e90c1c349cefc6ebb6489b64e145acd005c2b11ff0f8028629c631b8267cc35f519196e9395f5847f4a35f491c1a7f7846f789aabeb19b1061561bf9b7185588bc81a6a6b1c27dc0ca2e052308941557bc014c85d5511206301c5b247ba2bb9824add742f4b68c92974aa5dd8e91743071e096b44a028e69a2d11320a841d547c2198dcc39106dd588695f0db772e2323bb75859d85e5404aa6fae75afd0c7604b3e9a3c908426787ad595d2ec80fc576c672e06442561c07f5d63a216ffb1d3066e749f4405202e7786025346b5269acc39169d5c6417fc4c20091c449ca28325ca170ce8eb1bf9acfc5aff2dff8469a54ae2497378952e5b8e960474cd550e91e73d5e487cf0d6797a189b7caf7a01b66b8f2d740b6b3acd326fd6ef2c9d93e2dfffada050822890f63ee1d293f8afb85568b42461ba182f09635ae8af78b71f0385de02cec76efd3f80c5fbe76611843975575a4464cfd77b80a9640c03d5351b3519e25d3956ecb8d6c07862b1de6bb3a552b70289b4f46ca02cfa7c4daba5ca6e7ca245dc62a3f2c78c5bc4b6d2f0dc22dc2b38315378d9cd3b1637d2e698b1f36049cdb9552318051ab4bad02fb99caab24c3f5278079aaa83081adf81ca7b674bf9f9e030615889ff8916f9bca3b320a01d2901477e25957cf41ff33ac16871bc8f11156aa046320888e02798495cb058745782b17a8545516c1d2b652d07923dce25c20b455ae565dc0f66265236c5de0b6bba8e182ded7efeef82dc05f559a6c2e84981ad006c712d4799f6e85f5102ee4fcefdd85c20f51e533aa4eafa9b5328259837318be982d06e63e5c6088df81e8fb87b7ad09147b85c0a4f1ea16e1147212f1b1772e061ee11dd0998e73b2611e5e4631c1e71fd3c3cc20370029cdeb20f4a7e5754b5bd4679f594a32e742d2e3e553eb9bfeb7ea5b14d73539682d49fa8f8fb817dfcd5cf2b8e8ee7e437c8b15bd3e9717f3c80bc6f52f4dc91de9f68d9d1e9c3ad7839157d4b5162612fb14d87638202757832415f5ebbd5317f59b08bfe89b1dd334deed7512ff11ac24a1ae315bfd94ebbe2d8504173d7e49941dc9ad0fd86105732d2697597cc5b0ed66230e64169a9fdfc648de36c95c7d60ae32c9931151b81343324894e151b92b50ad9e495a1b71db00ecfcabfc0006b39ed09497afa325b4df4a3bce0eecd430ecbbd54f4c6c7905d4f267cf5cc0367d5740f6632f6926c0ef6325ec1bbaecee21cb25bfd4d8749cf8e8ba4c0e89794db76940d74595bff439034eb7a58d8b7c13f6d287987bbaf9d6cbf301497280d77fbf5ac527e3985e7660bc2d1adc8eddd180477d076012661e1d300c4aa1dfd1926eab1c0a2483fb5e36e4ebea882e395a1f28ec65664d973b66328f01cd0ddd2f62aea0775c901d4f6f7314e97f80dab92e1de77637e194984c1bdeae1e57a0b17d33839d8df696f9ca880fa0f8197e6802e13d7983193604cb2eb3f1233a707d04361489af3a886135e4a861fb567f333e4741757aa977653275f4bb687d721c7204384dbd4c0a6913668141b7158df916fbac4003f84c86b1f09eae8800a12348dc9994eab2c6c6db64dce2b92e172412f9e7e5fe4116afd790f64b6155491ca653309febaf9761628828d1f3a99822b4492e6d179501e96cbd9d674f32cdfe7d8a45904703d800cd0a4f61c24202c06b471262310803d44715be0721bda34fe481f8f4356631573bfdc98abe6430ffe0a4dcede13457cf2a672bec0446096a5eb70e51b0b2120ecabf7cc1f90fd0c104c69a3c76048a786446a84e41accad538bdc60f56054e9741250a5ce18ad2b66ebbdaab8156026dfef9d5d8bed2000bf5218d785116ba9dd98044da042e5f58f33c563bd1325e9e5711920b79f0f177e326e26f58af7864da556516579d1f105dce01dd396b798f6d2a93ff9b4b2357a616d41d458715631e0b7d545f6576d431acf32434ca791fa5122e295019cc59eda61b399e119448f86c7258049cb5e6aaffad5c11b6a0745e1e7438e8a74868b75bf8c192cc745c153acc7a3b802f89d3bcc6b2094ce8da688c571fa84fa953c6ce667b98f1e7770a332178e41fdf6e75a456c178c25f1a0187fc5303fc2baa30c7fa62ade57d6b1dd20cb977806a004ce65f7a1caa98edf1cbf8ef42c08f902bd9fe7dd4c48aeb34815184dd2f8e5b1cb5b52611cc136bc75d6fac2cb31d41618ab60f3f8ca44952dad45df6f83c1f24d186f3b5f84210c0689201e7e15dc1f793b3a2dbfe71ce117c0b119c54aa1f95da9d1a40ed47c470b8f3836df84e9c53d16b8fd3d06544176cdb8c1909a33648e39057368b9be091c1fca09edfe27b0a4626925ebd3bbef44d74298fcf5d0aa13f2b85e31586c6cefd27eac576a927eae34d5aa81c2fb3daef502b4e66a05f64639bfcc9df53264ca3d9448adcb368666d41b174d013c43f357f104dcf63cc4daea464ccafa1cf07f07e92ce2d2c75c1b63432610023c1923a69effc9c1edfe35f250207bfdeea18ab395bec457ed78a9276968de4ab65e8413dcb314580ead73e4c3f75e8a8c1f0e2988332707f62dd05b9ea9c53135f5980e82e006da30de63e78a733974bdea07ec6e8a3f0629ad6233337b5d7f70cc04d3a8b11c8a2629881d029b75666d604c9ba5cbe6739e2dd5bd9f31f9f8488f98b05e50e40bebd483e8cfcd5e63e543ded359a6e1905a857d65be16de1197570d6abf0cefe28d5a76071f7c4bd5b92c09658fe2a81473021839e84356b7a612c24137f77e496f6f5fcc076c6119b8cee7eeefb7671ce56763870d183df426121ca0838b9f1a0e5055991767bfdffb8d66d6ecf2a1a19516258e8427650f8aa3b8a58732f7413d7757f1245f9117481e01663429734f4d63bdc20b7de7c0be414e52564ec1bcf428441448fe376bf03e23f60d60aeaa947a93db9d5216d6fb305226b7c9301eee50733d722acfb6d24d755d3ec1a2c07e3c5e0a1168cb0f259a0bd284e690df0af8125ad4fe25eb5f8c8c93c7d5b9158ce3c96ffb4fe42419b67664e977c3cb246a89281fbbf22fb4be6692732982b8210480e3dbc798a2f913f123b2c82aa383a79eeca01d9a001e9ee02d883e22cc010795b135de6468b7d0ecba7e552d4a0dd0ace9def717d2ffb1a2fa77177b670fad8517c94572b55b2f9b9faf7f529a8073a068fb75d1fcfe4332e6aa7189c6cbb2b2bfbf033b7ace4064a96fe9e8714ba809deedb580d17b7a753652df9d8ac0ebab2c9ba5228d55f613041a1b947946939c7d8ea9721a25897fe29a0419f7425bfd602b96ff73afe39515fbea57ea6e6f65da27684d32c77a373c539a9bf87b0ab4b764822d0bd0f5f4135d078290bfb42fae2b8c66b9b1b04ea091483e7d58b31f7cc3b248db49e4a06847dc2ec7c3ffc78c6759d9714328dffe97117fbaf9f5c527d1e4ec28254ccce8737904b29784eb0a57153c558d00ff5faef2cf5451e6dbd267fd9d0acd227189dea4c848f58a25984caa44d2c9036c918664c8cc77e38e4b1ad7ef60619762004b5c22673c929555e427a857f93903f4469010ac20fdd95f7eda8669530baef2f29a53172141bad23c0ad9f4a6d7a5f48b17fe5b7464e2f122436d26e43ebbac2dd0280cf91fb8b399fdbfda5b3ce403bb823779e0a91ba996cc9e992d412a036d3a1f284897f415c7ea75fb0015ba82089c8cec0194feea028c78d7d57f20bf6e4bdbd86fd2fbd816f69a7529d15b283dd157cff47c763a2c134d24fbff02a5ef520432a59cc7687bfb1e38196ddbaec9f586c34257da65df7d30d4a1964e97c7c82f6e0b6c333752a09bbe769aaa0aa9163a83eff58ffd73222561f098d284463ed1da4c6341afd08ce9fc9759b6385e97ba542bbffa20e731ce5e893f6755094a2fec36000bad060d07a31ec72ad52acd15436bbc75711d7ccaa16bea5db5bd70349354beea7a7d19daa507343936301566551eb7f2efb0a07391c493922349b9610b2c204dc0e93a156cd7873932c3a93837b97f3681f80bb31a0af6dc94820e1db8ed8112161f68c99cdd5f27d574f701eadbfb57b3190264433b65bf296cf00ed8950a72eb9f825ef3524ab5729e0bd59cc41bff967e3883ef6b3dd67644d14a9e6390fa05e49f2d72ae7ae29daa094a468ea3fdf3fe7b6ecd1caf82d69820e0f533a83102cd2caff74fd9d2a23163c0aa78c02498ba7fac6cb36aae07122ca7f9371ea4bb8ad9dbd6123e3964cc84bb298e6be00462186732e137c2fd158d5f7d54f34b617ac1a21286683eff66880429e2fb28dd91f3352cf0ebb09d4f2f80acc856c7cd8659d157a26b490ba88cc4857a2f9051781b23a7c878bd17dbf85d5cdf444f3f9af5733c94302518871185d9eeba6b6797d89b77043987848fe61074ca4fd51ba9a162ac540deb222493ba3db6c6e091f0a6d11da78b521a70c70e222b95cd93bef3f70b1be05a4a406a4b823c77fc952e0ca842310df7e343c718cfbb7cce98943e13df2c504091f87b4b2b477e3a91d182385bb4d97e50d8c93192de82b8c5dd73766fe3d6328a73240de1893192338e46048476709841ed0d3c307c73983b8e54f5d63e0f92ebd96afc9b76ae59d1ced7fed6d614e428b6d0b761c656d45bff815181a0bce68bf29c50a2d42f582adeaa9643a9d5ff06c796f6109615337b7e2cb2abc69bf659b489b270a258543befabbbc2f075ef904a796710e9bbdf61de6118bb017eb11caf964d891cd96437706953fc7bfc862e62b7febbdafa6772749f7cba3f2e0fb252a4297c3140c1f2977343cd96b1c3a89359270efca0405eaacb4bd851e0c2822fd71c2dda1e857e343184bb9ead04a304a27678a38938e5cf447980c96b40bb8d7bffd24ef2fec6a347591ed608e4c3a0153338ac5a945af99a1f16bbdbaff247d9b30c8e3536d1c842b7b1d5a2009f7a81fca2ecfc1c32b5ec3956cf2ce2374dc3a9014b7c0a1774124460141485d6bd23085f2c71b33d70fc4aad51b9b28e3101174504c349d3d66e4e6e3122937eabd391834a063126578ea1e61c7c77316988406fd0baaeeefb2a98651575a309865c82e98e4613de15cb82cd0029d9bb1505a3f57cc9c041794694f9f3c37bc6a90f13a17c673adff8127cd965b9fbecb667e0e0b703d7f965aacb6da5efcc5ee1d351f2d3f80d474b69cbe539e0bd6b3558dea13e8df2b879ce7313500ef89e7b8d33fc71295d1f73a76d18ecc3c68cb5897c65330ff1d0be6abc7db951efcfa19df0c921230da76706f3ad2cc12b09565a53eafe8deb8500cbb7c6a20df61fba56fcdfa25bc9f4c4bf4dd3922fed400ac604391ae9924b3f5e2f6b63c61026fe6592657d19149f5588f270b155a67d52084e50dd670285c0a957fe87cf098a576394f6c8bd8827464cdd324563ad06a3b8b41bb5dd3ac06c5b131856b4bd653ea6b9bde369f53d42f001d775a8607c7382f7f897e817e1b614a259e2e552908ccc676a4b5124c0c2cbc834b6d94f6d62f9b1e8d0d59219898e5625ae65bfc382ad7876f6eb7e5526185592089c4980e89343f34a2734fdf3062bbb5a287007e59c69c75c1deed01991897491012aa834c81750d5d660ce88c6a3e91573f22843b34456609a82656f3a24fbabc9034174cb1a2209e215a51baad48a5fef69bf627d69508a3fec96504ba308a7648f26f6d784d6fd27d9fd25497bec8196d2f1e3803ea8c253ce6190b8def9d6a3819da1fe37e0587be0b7e6aea6c879961846938640fbaa72c1fc1fdfbf12da36c251640b70222cfe8e5069fefeb2d545022888a05ba118d20fefaca6b2e24538ec0a28e8a70439ed81694f875116ebfa7f1e9f7ce224694b2588dd00c1f41295738491a4126c2d9424fa2e113af9574957fa41f47dfbef02fce9a82b7472a12696294bc31c4831a4d97a80bf7d6b07aba5cfdc6b7cd23a5d0549c976d42ce534e3860d8891e6911c5e6817ad8a7c380cc8d4b7486993b710b559e004a009a3115fa8902494fc593794e8103aa7caeb7728e415c5bded1b172a610fe7900d6a1c5b9e17411fa7dd7cf76564c35ff417a0030ab42ad3f5ff5b474ca4936168b04722887a5fe672b7b3238dcc4c36984ac673233b92c75904652347bdda5cd289a59f6fa0e7703f8996f7c1c8d7a6621fd1557da860eb127df5f35310b7d190e2c2860cee8dd9768aaa1d4e4edc1116a9555eea70ba4e241e4d8dd7f141f7036b9178d126eeccbf8b6cd0e53134ff48c41b20cbe7259adb29b6bb6b470c437f5d044ffbb3f51032d829c26845bb44ca275f8bd5cf0480ffb226e11c6a8296f31368281851d46314ba523ebb5d6ccfb61237c5705374f2dd37b5dd2134dfe24056877a2bcd68313a694a2a3fe8362a4f6e62d4e256089b8ae8d88dba0066cdb06634f8107858b907144f141e683ba3eb35db24403b80097bc5cc4d11f7ee38f1f6424837d2cb7aa9cc6029d013487c77dba270663bbfb6460c3a1993c7f147e1614e08e8ee55b4d13c1a0b3ff29264bbc2f26402ed0a37fb7e752d480d6be04dc6aff74b552c36e83a57f2189c8ba45327b5b4698d2d359bc9590cad072cd5e8ba2af200e8a79ba6a0fe057385980a709984d70b5767ea77324c69f0c4f147d97f876d84d65747c6dab707256946bf18c5602cd89b0f972804e8196f0ff79e89031369b3be7709baed338f31a3bc9881ed9286c89433f8cd60e0da1cbc1f60e14b85bc561465e020715bb00b326ed9398aae82bc1f4b64203c6533d26b5ca9cb75048c20a57351cc2fc2520e797ed1d45b0b03d57bf52af3641a98de943c68881f196131c9cd679a98243464bf826b71febe16007f3c5f32ba81b90ad4b3511f883a4b018bcfbc0f7ea12229ce6ebb335989331dadab42cfe9667b1a27829fced81e917c440cb2157776da910b6d60f8eecabaab762921364481a497abfef3549a493d2fc9749fed4fede6d8f93dc520ae2d4d2e93b0019f0cc446c34de26b931539f378f3c8a6730e2a0e31c76a5366aad50415e5c16ac5bccd0b18dd3bd6a1db4b6c1a65748521d22236674b210e47df62feda6e0c9c27087a0a81739bbf03126564acb761f3843a30c50c50bb6825fd6b50a47caf410ad72dc7f81776ed363ddaa936b12f7d3c49ffce798eaf27d02b01d95c25267304f311debd900f71e53d842455a9df09e546a3d6f64a64f27ac0e589b4a6bcaa9e5075456844a1c3c1f979e9e468b177c87ce4c1a141ff02bf825c1da209275aa4e80b5b228f9b1e2167529aab7567b3571ffe85e455ca6ed4a9fc5fccfd4e8877e1c587d280445e563a36018d76f0d2ee976e51b7e02875cff70bb078ef7fbbac276880adc9411f266fb7153c8348823dba17043855b19d2d857a3be1822ac324e83b721c9da7b81a16a2215a411baaa41dafe6a8a3818efd5690b5fa489b104e7adecf3e942109c872d263e68209b23d260eee90197d0c5988ea71bc13a1d926d0a3208afe9894e7ac6bf027fcc4761cc1df53303ed78fb2966ab2444549588224626edd712d392be395b598d32fe161378343827a28905e78c34cb989a2ad6ac520bf9215aa453e007c3b9e1a87dd1cfa018178d71dda4d6f7b35092fcdd1b32db0b72dfeeacb78c40f7dc3155bf48a663a19d4a061707a2d6b2715a0a05b1871b7dc1920be538eee0b2e289a64e8219b162a4654ebb55d15513781c9d5228c6f5078266b3147fd0a420c3c48ab8f394d49924e1c857478b0a2d4c3e8c6186ba436312bbbf580764c17f680ed343f3b9ac3cd7e89fd9fa6e4d04e97836352ef25c14692a697d6294793bf7f6ee8885f3b61b7c97b5942b8f6c000f79783a9be016cd13b72841021927b626484ba14e750dfd5e8f551fe3fbcb180d5e8668a32e9cdf7306c15786bfe038517b9cb6a2aa45bcabafe7f74198ee26f23a47056e9dc4204b71d3a2ca3c4dc70031a7d26e89a8b2d104d7dcf43aa5020b84e5c91b44ac1f999efc453182719b2e739ad0a1ab3fb2946dd26baf67a9e6ba2ea885fe79c45f8aae31246adfe51c0d0f5aa86a1bb47ae267d1338137378c0d5e544033897e17f6ee817adaed6fe36a032409e9f7131f2b9256ef1ca5a27e41663a3507745a86c22e93ba7dccb4a4e4a2b9b1d3769291a87f629ca2a73abe4f3ce76ac210022954dc2e854dadde65dc4885651e95d777926ba1c66cd34f80caffe2994b0c8bc0e810b9b80b26f0cfc843f1ac063d506a427ed10b2969cce5de58f48dffd23c2fb7290ae6c15e2dd0bc2f1930aa7e1d0759bb2fa12cffbb3fdcdb3c919e50974995edc0847e6ebf2c9f12d56ad7df8cad31e342993b48d369984a4f3a3f78cbb162ba8e2657caf9b781c7cc47853939df237707f77ea82d95ef83091302e7d21d99a7316529e8b2f363fd1cbea976bdfc773d27471be704a0a4973a3144cc17ad9c3d1c3513890ae17da5dc260fd39185a568cc3651d2a0c08666d04f4cc4f285ef1a4f0e7b5d9d8eafa71572db6b25f7d0d835ab6d447f260eeeb86b38eef46433a4649b7b835a1d37e57b79748372b69ea397845692c1568279aabe3c13ad59de558021970104134555a8e63e2fa5b0a2b067f14315544d0e44a5886649907325f1d6d86feae924e4a1acf837ac0f040856f305551e530748e264382306928631b3289245a63bb326cb53c295546c03d15b81fc13ea7ece96074d615aee9ca0646a3454b2530f09b1e3eb9dbf4d661a40c7da722212d2f70618307f662208bce5e4ce9ea76ed08f117c39abcd58a47dcd719e730e180fa53daaf28b5c6d96f96e5adff18359be14e25c7998bafd7ee8b2741a007fc89b0676536ef76aabf33b2491be0db8c36ddf34114771ea7c8786f3b185fe66153447ad483d03fc9fcab09601fca07b52608c3569971276fd59d6cc04e7e5d2a30f577b9c35af02f2ab69a5101e7261c6862b59b67394a54f32d8fc25349cd7498f45797f8aa06a88a677ef467ad5cdf7ca38efb80678fef8eb48f2889e797f9a992851dc1c6f0849c563e036dc40a333842f5fce5782ddfa7e24e1e3899565952706a31964aecf211554248b039d1314aa370297b353aebb58df1f45655dce8f38dd52a661db6feb6d2d334bae9bc04ff38f262f48daed732962680595fb9e629ebd5a5e1dd80c54924a5b9e061ce1bd34aec81315ca5ad91ad8ecb0f40b4a56c3465f2196a90176bee1a3309a61cb69701cde329ae420a48b16b23c992ca5e6695d523d244a69bc9a112e2526afe729189844ca06d67aaa9c41edcd590897800315236f9adbde9e9af613d84a0b7edd948d0d47b24582a47840c26146704512870c9229f5c05997d511f34b33bffa64c83eec8ef2661b9080774014e1d82a4d1dd92798134f67e36d1eed67241a0cd9b7d11ddd4580f27af0540787bb32d3748a06990a7c83a67b544c7a720510a669a87c5c5c0f92ce64e1c8148c8c46b26751a88bb81019ad4f3e7ed0f61dd548b7a42d8eff9ea9876eff75743640f3ba13473c719a677be170095b259097dba1ca25c578be10b32c78687395ed8a19f7508bcaa6057470b8f7797f331115b66e4960753a3abf55e67780ffa97db2cc84ae6086251ea1f1063961610b70db409b76658ac98be8f1930e3a6792cca824c7f6ce56434755533411a40a9cbdcedc624594e5719d0845c95d775d6a3de8c9c419e41ad06c4f2ce175dface2806f0f33b2e1bb2dd9abe03cd12ec8d37939a9d53ebc75771992fef5d65126893cc55d3a9ac95332beaa8a3cc1ca2923c55cf6cd1c31336d438c48739de4a57425fa2cf969afd3cd1c9f21d2d9545071bf1edc6a25bf11ebd70c6a2b74dcc10e8f625a3e7ca0315092310f12888831077f6f9d7fe1d006099b6ea6f34cd2dfac5076f4373e42970ac91d35665f94eb3eaf360d60d8d0c8eeed5cdfd441cc8d0ea98aad2e91979e625969232c01d698c4a87ee435a726b32b9c162f3153a4c43b4819730c782d96a57df99f743fabc976917c69a32a33cfd8e753f556355885f598d989e1fc9596696901b02c5eea80cb90c90933259be417184619bc783f2a8e049fb4234426c25d6b506fd17c9c81d97bad14f5ad0043f85224059cd6e24cfe0a2920c2edd6f14f8df00da992183ee3e2455cdd3dbfecb2cd9a8918d7b7ee016dd0cbc461993e8b2f890eecfbdeb706ba964f4f8076320db2dce8b9a7fb47abb56f09413254aba0ee3d280aabfc2ce5e0679c975c45c7d963d198f27fa775982b896c7727c2edd34f2c5121f3a0da5767935a78b144eb91875cc3b0caac1f6d43cfdc7719452d24ee702b44b609d1199af03d14704a2346726306626a80b78ed27db79be9c4a5b2ca459d9e20c928fa8c4bc39643b4af210ce9db0f7d8ac16a1e7d2e33c8ffac8de99a806dbea8fe738fa2c0ea6dc74babedd9cab7a5ce2da1e1572752939ac62ed66e3c814d77d89830c1245293ca5bd0ff6c66a932eda802a4bc389b6b37d9cfe143b713c73e7519962ee11791441a38a4d1242f5d9cb4fca2cea7a272132189bb0353d69025221bea2794d5a87c69aaca4c7a84cca8c13775c9d9f2213b941ba99319b9e870deb0e55f3447fda7dbc533ed330e5bc28569ab4d923750af787683fe0e5acc98cb4ae5124678a86b30316f979fef069914f051849cc41895120830a92fad052b2dce7c2029f2263b21042158ab90217718608be53ea9b4b19ab58781859efaab8826fe7fed997befde31216138ea6100758971807301e8eabf784e42503aa468c960902bddf70491ee89eac97ed22a4ba797fe3cd16271fc29a5050105dc8e3e92c610c59cce7956c66234f59f802601b310a1b3cd9c802a7fd9ca9ee096450c54398f1e6f62cf2b10b123d699ec6c5d341de31010ddad27bd734a650d7319ee6855c5bbf1cd3e563a39cfc4cfdc05bab326bb9e5ad90c6ac9d4fb2a1de7214e723ce48abf87026533f63fbf3ff0ac357ed8ea0622221efef759b54186d5269ab667aef82acfe74d6246010d16d612aaaa391bb0e6a801d6e65fba6e849bcdbdafdf8690c41d3a5aa2c4e51962d7985cc6d32d85616c56d1dc1f314953579c4e5d08c8187c8aef8c9b0e871083f5467033a3a05ae7155c69c31d6d72832c9b3b67ed1cdbf93456d48c46c512031ae6c3d61d306c92e73c21c6cd0a061e34ec0b6542982b4141ac9542ac181b73605d35cd6533c86176931f1980a7d283c0594f0c3f5c755a11412f5b7cc395ae6e21066672b6ad4238627ba90a4bb43458955ad0c3b0a40a7ea4f8c39b5", 0x2000, &(0x7f0000003100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac2(0x3, 0x80, &(0x7f00000003c0)=ANY=[@ANYBLOB="1201000200000010532b230040000102030109026e00030104600e080b0202010620400904000000010120000924010700020e000105240b1400090401800001022000090401010101023000090501"], 0x0) 3.543293873s ago: executing program 2 (id=1337): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0x1}], 0x1) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000200)={0x42, 0x3, 0x2, 0xf5ff}, 0x10) sendmsg$tipc(r3, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x10) 3.514554364s ago: executing program 4 (id=1338): openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x0, 0x0, &(0x7f0000000180)='syzkaller\x00', 0x3, 0xd6, &(0x7f00000004c0)=""/214, 0x0, 0x11, '\x00', 0x0, 0x0, r0, 0x9, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1}, 0x10}, 0x94) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000140)=""/31, 0x11) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYRESHEX=r1, @ANYRES32, @ANYRES64=r1], 0x50) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r3, &(0x7f0000000100)='5\x00', 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) prctl$PR_MCE_KILL(0x4e, 0x1, 0x4000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r4, 0x110, 0x4, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r2) connect$rxrpc(0xffffffffffffffff, &(0x7f0000000080)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000001405000300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x0) 3.469026732s ago: executing program 5 (id=1339): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x10, 0x11, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000040000000000000000700000018010000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000a0000000b70900000000000055090100000000009500000000000000180000000c0000000000000007000000bf91080000000000b7020000010000048500000084000000b70000000000000095"], &(0x7f0000000140)='GPL\x00', 0x3, 0x0, 0x0, 0x41100}, 0x94) 3.350175579s ago: executing program 5 (id=1340): pipe2$9p(0x0, 0x80880) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_udp(0xa, 0x2, 0x0) socket(0xa, 0x3, 0x3a) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x70bd25, 0x0, {0xa, 0x20}, [@RTA_IP_PROTO={0x5, 0x1b, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008864}, 0x800) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x0, 0x800) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) readv(r2, &(0x7f0000000180)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) 2.287458636s ago: executing program 5 (id=1341): r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x8000000000000001) ioctl$VT_SETMODE(r0, 0x5602, &(0x7f0000019400)={0x8, 0xff, 0x7, 0x6, 0x1}) personality(0xfe47fef9f5ef7379) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) personality(0x6) syz_io_uring_setup(0x30da, &(0x7f0000000200)={0x0, 0x4ddb, 0x10000, 0x1, 0x2002ca}, 0x0, 0x0, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_emit_ethernet(0x71, &(0x7f0000019440)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa86dd60000000003b3affac8b2bf17793f13f2ed53d1699fe8000000000000000000000000000aaff0200000000000000000000000000010401907800000001637c364d00062fffff021000000000000000000000000001fc00000000000000000000000000000033001a4066000000fe082f"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102400, 0x19000) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) r3 = accept$alg(r2, 0x0, 0x0) sendmmsg$alg(r3, &(0x7f000001b4c0), 0x0, 0x0) recvmsg(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000500)=""/184, 0xb8}, {&(0x7f0000000180)=""/104, 0x68}], 0x2}, 0x0) arch_prctl$ARCH_REQ_XCOMP_PERM(0x1023, 0x12) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002004e237f000001000000000000000014000200024000000000000000000000000000000d0001007564703a7379"], 0x54}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) shmctl$SHM_STAT_ANY(0x0, 0xf, &(0x7f0000019300)=""/195) 2.251436249s ago: executing program 0 (id=1342): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001bc0)={0xffffffffffffffff, 0x0, 0xdc0, 0x4000, &(0x7f0000001cc0)="633268f83ca3000000a2029e3815bb2fa117d8326687688b2c969fd7267d546214af00d1ca2524d00f9e4d9555f3ab381b5d44fd6bda8c509e66101d296f10c805252e7c5d48d9814f46db8f07441878734b13270fe47fba418b7358984b9a61c2bbf964a520459fd0d90590b46cf1677d580a26933b6e35aee75996b73a15a25aa8ae2f1f9bc9699a505c0dc4050ab2255fc35f508ccc52f10ac12febf28652fe36f725714868675ca2a7042ab4b26904b2f000589694f69ab0b22a5aec72c5036ce1c8974690045e4ab412a70336b4c65b2dfc8121af4143c2e10a0e5632bcd44e0b000029da424d86f298656822dae2c002e289fbfa6fe0dfb2fd57713a7684dc166c628dc45027ac174c5db54f22e409eb4e94263dbc9919f90f1af3290918b9824c3e0268b300bf69cc2eb3fc58f655439bdbe2b905", &(0x7f0000001c40)=""/76, 0x0, 0x0, 0x47, 0x50, &(0x7f0000001ac0)="9c01bd6f9a6028c80d7364240fd78867d9d62eca43c565f2c5ac65dd4a0fadceb6c65dcb07f2421e69087e0f17b4eb709e4805f2722709c46bef17c4cb9aed9fb1c342179ea349", &(0x7f0000001a40)="408fd0050dc7945b483103067eca9bd26ffbe35abf0f88a103f6893dc2b1d1cdc2195d4ae89abc04ff5fe5d2466892c81015df835a7d47be4f852161bc4015e7564b08584290fe1762f943a653008ac5", 0x1, 0x0, 0x13}, 0x22) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000075f84c1071042703a461000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f00000009c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000040)={0x8c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.249738834s ago: executing program 2 (id=1343): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x7, &(0x7f0000006680)) creat(0x0, 0xecf86c37d53049cc) bpf$PROG_LOAD(0x5, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) socket$inet6(0xa, 0x80002, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r0, 0x26, &(0x7f00000031c0)={0x1, 0x0, 0x0, 0x5}) fcntl$lock(r0, 0x26, &(0x7f0000000080)={0x1}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x101000, 0x0) recvfrom$inet_nvme(r1, &(0x7f0000000380)=""/238, 0xee, 0x102, 0x0, 0x0) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x1, 0x1, 0x0, 0x5}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x4c}}, 0x884) 2.175473267s ago: executing program 4 (id=1344): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x67) mount(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f0000000280)='virtiofs\x00', 0x38130d1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, &(0x7f0000000040)}) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)) syz_emit_ethernet(0x22, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaefbbbbbbbbbb810074857b9e65ac4a001f0c0000"], 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000400)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000005c0)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r5 = accept4(r4, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)=""/81, 0x51}], 0x1}, 0x0) 1.456998809s ago: executing program 5 (id=1345): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x80015b1a, 0x0) 1.358940381s ago: executing program 2 (id=1346): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x140) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './cgroup'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = creat(&(0x7f0000000240)='./file1\x00', 0x88) io_setup(0x200, &(0x7f0000000140)=0x0) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x0, 0x2, 0x1, 0x0, r0, 0x0}]) 1.234624616s ago: executing program 4 (id=1347): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfa, {0x0, 0x0, 0x0, r3, {0xfff1, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_FLAGS={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) (fail_nth: 3) 1.212176073s ago: executing program 2 (id=1348): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_udp(0xa, 0x2, 0x0) socket(0xa, 0x3, 0x3a) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv4_newroute={0x24, 0x1a, 0x1, 0x70bd25, 0x0, {0xa, 0x20}, [@RTA_IP_PROTO={0x5, 0x1b, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008864}, 0x800) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x0, 0x800) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103000000001c0000000a"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) readv(r2, &(0x7f0000000180)=[{&(0x7f0000000540)=""/4114, 0x1012}], 0x1) 708.691346ms ago: executing program 4 (id=1349): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e8c}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 354.310438ms ago: executing program 4 (id=1350): arch_prctl$ARCH_SHSTK_DISABLE(0x5002, 0x3) r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x300, 0x0, 0x111, 0x4b4, 0x168, 0xd4feffff, 0x230, 0x20a, 0x278, 0x230, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0xffffffff, 0xffffff00, 0xffffff00], [], 'ipvlan0\x00', 'caif0\x00', {}, {0xff}, 0x6, 0xde}, 0x0, 0x108, 0x168, 0x0, {}, [@common=@ah={{0x30}, {[0x4d4, 0x4d2], 0x0, 0x7, 0x2}}, @common=@srh={{0x30}, {0x0, 0x4, 0x9f, 0x6, 0x6, 0x1e0c, 0x800}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@empty, [0x0, 0xff, 0xff], 0x4e20, 0x4e23, 0x4e21, 0x4e24, 0x4917, 0x0, 0x4, 0x9, 0x9}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x360) r3 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r3, &(0x7f00000003c0)={0x1d, r1, 0x0, {0x0, 0xff}, 0x1}, 0x18) readahead(r0, 0x8, 0x5) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r4, &(0x7f0000001a40)=""/102392, 0x18ff8) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000180)) r5 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000280)={'syz_tun\x00'}) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040), 0x20200, 0x0) ioctl$FS_IOC_GETFLAGS(r6, 0x80086601, 0x0) r7 = syz_open_dev$admmidi(0x0, 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r7, 0xc0305710, 0x0) r8 = openat$ttyprintk(0xffffffffffffff9c, 0x0, 0xe8902, 0x0) ioctl$TIOCSETD(r8, 0x5423, 0x0) read$midi(r7, 0x0, 0x3b) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x103a, 0x1000, 0x103a, 0xfffffffc, 0xff, 0x80000000}, 0x1c) r10 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP(r10, 0x3b85, &(0x7f0000000440)={0x28, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2}) syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, "", {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32}}}}}}]}}, 0x0) 289.747691ms ago: executing program 1 (id=1351): r0 = io_uring_setup(0xf08, &(0x7f00000003c0)={0x0, 0xfb6e, 0x38c1, 0x4, 0xf0}) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(r0, 0x19, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0xa, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x48) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r3 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r3, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000001040)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000001540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x44a}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x8, 0x8, "fde61e0ee4a63b9e"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0x14, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r4, &(0x7f0000000540)=""/99, 0x63) r5 = getpgrp(0x0) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000600)='./cgroup.net/syz1\x00', 0x200002, 0x0) syz_clone3(&(0x7f0000000640)={0x0, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000000280), {0x17}, &(0x7f0000000380)=""/55, 0x37, &(0x7f0000000440)=""/208, &(0x7f0000000540)=[r5], 0x1, {r6}}, 0x58) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) recvmmsg(r2, &(0x7f0000008bc0)=[{{0x0, 0x0, 0x0}, 0x7fffffff}], 0x3fffffffffffde9, 0x10002, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000a8000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7, 0x1}, 0xc) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x34, 0x41, 0x1, 0x80000, 0x4, {0x1}, [@nested={0x4, 0xcb}, @nested={0x10, 0x1, 0x0, 0x1, [@nested={0xc, 0x10, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x5}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) io_uring_enter(r8, 0x1be, 0x9e12, 0x10, &(0x7f0000000040)={[0x6727974d]}, 0x8) 274.00891ms ago: executing program 2 (id=1352): r0 = socket(0x1e, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, 0x0, 0x0) 0s ago: executing program 2 (id=1353): r0 = socket$kcm(0x29, 0xa, 0x0) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000000)={r1}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = bpf$ITER_CREATE(0xb, 0x0, 0x0) openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x7fffffe, 0x5, 0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x27, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="fc00000012000701fefffffffcdbdf25037c0000e8004580175557450aaafcb9cefdcd1b039a526040c072ccd5a9e460725439ec1e353b9e3aad85bc8606a945d7745cd109acb538db5680f8516041a682878f811893c3911afdc77eead7fec2c6df2518ddcf9e973bee4191096d676db201386929dd6948449987140c64bc9d25803c2b69735d1986345401aba45d887813f1b2afb2a2104ac9738d1c49a036772a163f17bc3c4093fca1da88070784186a962d34ddb15b23f73d876b4d63f9304456b015d28c675e934a17eeac5e08a372d7363415736139c769d0ad0ff478e6a224dd867e8a4eaff34f7bfd89deae7fbcf275f05516c932d44d0b"], 0xfc}}, 0xc000) kernel console output (not intermixed with test programs): 0, space 0, times 0 [ 328.586799][ T9371] CPU: 0 UID: 0 PID: 9371 Comm: syz.5.932 Not tainted syzkaller #0 PREEMPT(full) [ 328.586824][ T9371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 328.586834][ T9371] Call Trace: [ 328.586841][ T9371] [ 328.586847][ T9371] dump_stack_lvl+0x100/0x190 [ 328.586871][ T9371] should_fail_ex.cold+0x5/0xa [ 328.586891][ T9371] should_failslab+0xc2/0x120 [ 328.586905][ T9371] kmem_cache_alloc_noprof+0x91/0x6a0 [ 328.586917][ T9371] ? do_raw_spin_lock+0x128/0x260 [ 328.586938][ T9371] ? dst_alloc+0x99/0x1a0 [ 328.586956][ T9371] dst_alloc+0x99/0x1a0 [ 328.586972][ T9371] rt_dst_alloc+0x35/0x3a0 [ 328.586987][ T9371] ip_route_output_key_hash_rcu+0x87a/0x2870 [ 328.587007][ T9371] ip_route_output_key_hash+0x118/0x2b0 [ 328.587021][ T9371] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 328.587035][ T9371] ? rcu_is_watching+0x12/0xc0 [ 328.587050][ T9371] ? udp_sendmsg+0x7f0/0x2720 [ 328.587067][ T9371] ip_route_output_flow+0x27/0x150 [ 328.587086][ T9371] udp_sendmsg+0x198a/0x2720 [ 328.587111][ T9371] ? __pfx_udp_sendmsg+0x10/0x10 [ 328.587134][ T9371] ? avc_has_perm+0x135/0x1e0 [ 328.587152][ T9371] ? do_user_addr_fault+0x7de/0x12f0 [ 328.587169][ T9371] ? lock_release+0x24d/0x310 [ 328.587182][ T9371] ? sock_has_perm+0x25a/0x2f0 [ 328.587197][ T9371] ? __pfx_sock_has_perm+0x10/0x10 [ 328.587219][ T9371] ? __pfx_udp_sendmsg+0x10/0x10 [ 328.587242][ T9371] inet_sendmsg+0x105/0x140 [ 328.587260][ T9371] ____sys_sendmsg+0x9c9/0xbe0 [ 328.587281][ T9371] ? __pfx_inet_sendmsg+0x10/0x10 [ 328.587295][ T9371] ? __pfx_____sys_sendmsg+0x10/0x10 [ 328.587310][ T9371] ? __pfx__kstrtoull+0x10/0x10 [ 328.587323][ T9371] ? putname+0xb1/0x110 [ 328.587334][ T9371] ___sys_sendmsg+0x190/0x1e0 [ 328.587350][ T9371] ? __pfx____sys_sendmsg+0x10/0x10 [ 328.587376][ T9371] ? rcu_is_watching+0x12/0xc0 [ 328.587404][ T9371] __sys_sendmmsg+0x20c/0x440 [ 328.587423][ T9371] ? __pfx___sys_sendmmsg+0x10/0x10 [ 328.587436][ T9371] ? rcu_is_watching+0x12/0xc0 [ 328.587451][ T9371] ? ksys_write+0x190/0x250 [ 328.587470][ T9371] ? fput+0x79/0x100 [ 328.587480][ T9371] ? ksys_write+0x1ac/0x250 [ 328.587495][ T9371] ? __pfx_ksys_write+0x10/0x10 [ 328.587519][ T9371] __x64_sys_sendmmsg+0x9c/0x100 [ 328.587537][ T9371] do_syscall_64+0x115/0x870 [ 328.587561][ T9371] ? clear_bhb_loop+0x40/0x90 [ 328.587576][ T9371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 328.587587][ T9371] RIP: 0033:0x7f4f2299ce59 [ 328.587596][ T9371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 328.587606][ T9371] RSP: 002b:00007f4f237ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 328.587618][ T9371] RAX: ffffffffffffffda RBX: 00007f4f22c16090 RCX: 00007f4f2299ce59 [ 328.587625][ T9371] RDX: 000000000800001d RSI: 0000200000007fc0 RDI: 0000000000000004 [ 328.587631][ T9371] RBP: 00007f4f237ab090 R08: 0000000000000000 R09: 0000000000000000 [ 328.587639][ T9371] R10: 0000000000000300 R11: 0000000000000246 R12: 0000000000000001 [ 328.587648][ T9371] R13: 00007f4f22c16128 R14: 00007f4f22c16090 R15: 00007fff554df5b8 [ 328.587664][ T9371] [ 328.843764][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 328.950600][ T5710] gspca_sonixj: reg_r err -110 [ 328.987524][ T5710] sonixj 2-1:0.0: probe with driver sonixj failed with error -110 [ 329.306377][ T9379] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 329.312908][ T9379] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 329.322541][ T9379] vhci_hcd vhci_hcd.0: Device attached [ 329.341612][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 329.349704][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 329.383802][ T991] usb 6-1: new full-speed USB device number 6 using dummy_hcd [ 329.383815][ T5791] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 329.444799][ T9384] FAULT_INJECTION: forcing a failure. [ 329.444799][ T9384] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 329.476698][ T9384] CPU: 1 UID: 0 PID: 9384 Comm: syz.0.936 Not tainted syzkaller #0 PREEMPT(full) [ 329.476716][ T9384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 329.476723][ T9384] Call Trace: [ 329.476726][ T9384] [ 329.476730][ T9384] dump_stack_lvl+0x100/0x190 [ 329.476747][ T9384] should_fail_ex.cold+0x5/0xa [ 329.476761][ T9384] _copy_from_user+0x2e/0xd0 [ 329.476778][ T9384] kvm_arch_vm_ioctl+0x1386/0x18d0 [ 329.476791][ T9384] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10 [ 329.476804][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.476820][ T9384] ? lock_acquire+0x301/0x370 [ 329.476833][ T9384] ? __pfx___might_resched+0x10/0x10 [ 329.476846][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.476861][ T9384] ? unwind_next_frame+0x3be/0x2090 [ 329.476871][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.476887][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.476902][ T9384] ? unwind_next_frame+0x3be/0x2090 [ 329.476912][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.476927][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.476942][ T9384] ? unwind_next_frame+0x3be/0x2090 [ 329.476953][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.476968][ T9384] ? is_bpf_text_address+0x8a/0x1a0 [ 329.476981][ T9384] ? lock_release+0x24d/0x310 [ 329.476993][ T9384] ? bpf_ksym_find+0x128/0x1c0 [ 329.477008][ T9384] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 329.477019][ T9384] ? is_bpf_text_address+0x94/0x1a0 [ 329.477032][ T9384] ? kernel_text_address+0x8d/0x100 [ 329.477044][ T9384] ? __pfx_widen_string+0x10/0x10 [ 329.477056][ T9384] ? __kernel_text_address+0xd/0x30 [ 329.477067][ T9384] ? unwind_get_return_address+0x59/0xa0 [ 329.477077][ T9384] ? arch_stack_walk+0xa6/0xf0 [ 329.477088][ T9384] ? tomoyo_path_number_perm+0x46d/0x580 [ 329.477105][ T9384] ? stack_trace_save+0x8e/0xc0 [ 329.477115][ T9384] ? __pfx_stack_trace_save+0x10/0x10 [ 329.477125][ T9384] ? stack_depot_save_flags+0x27/0x9d0 [ 329.477141][ T9384] ? tomoyo_path_number_perm+0x46d/0x580 [ 329.477158][ T9384] ? kasan_save_stack+0x3f/0x50 [ 329.477169][ T9384] ? kasan_save_stack+0x30/0x50 [ 329.477179][ T9384] ? kasan_save_track+0x14/0x30 [ 329.477190][ T9384] ? kasan_save_free_info+0x3b/0x70 [ 329.477206][ T9384] kvm_vm_ioctl+0x1564/0x4030 [ 329.477217][ T9384] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 329.477236][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.477251][ T9384] ? trace_irq_enable.constprop.0+0x122/0x160 [ 329.477266][ T9384] ? tomoyo_path_number_perm+0x28f/0x580 [ 329.477282][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.477297][ T9384] ? tomoyo_path_number_perm+0x28f/0x580 [ 329.477313][ T9384] ? lock_release+0x24d/0x310 [ 329.477326][ T9384] ? tomoyo_path_number_perm+0x188/0x580 [ 329.477343][ T9384] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 329.477365][ T9384] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 329.477378][ T9384] ? do_vfs_ioctl+0x226/0x13e0 [ 329.477395][ T9384] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 329.477408][ T9384] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 329.477422][ T9384] ? rcu_is_watching+0x12/0xc0 [ 329.477437][ T9384] ? hook_file_ioctl_common+0x140/0x440 [ 329.477453][ T9384] ? selinux_file_ioctl+0x13b/0x290 [ 329.477463][ T9384] ? selinux_file_ioctl+0xb6/0x290 [ 329.477474][ T9384] ? __pfx_kvm_vm_ioctl+0x10/0x10 [ 329.477490][ T9384] __x64_sys_ioctl+0x18e/0x210 [ 329.477504][ T9384] do_syscall_64+0x115/0x870 [ 329.477520][ T9384] ? clear_bhb_loop+0x40/0x90 [ 329.477532][ T9384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.477542][ T9384] RIP: 0033:0x7f648519ce59 [ 329.477551][ T9384] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.477562][ T9384] RSP: 002b:00007f6485f8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 329.477572][ T9384] RAX: ffffffffffffffda RBX: 00007f6485415fa0 RCX: 00007f648519ce59 [ 329.477579][ T9384] RDX: 00002000000001c0 RSI: 00000000400caed0 RDI: 0000000000000004 [ 329.477585][ T9384] RBP: 00007f6485f8f090 R08: 0000000000000000 R09: 0000000000000000 [ 329.477591][ T9384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 329.477597][ T9384] R13: 00007f6485416038 R14: 00007f6485415fa0 R15: 00007ffff7379858 [ 329.477607][ T9384] [ 329.899647][ T9381] vhci_hcd: connection closed [ 329.899798][ T13] vhci_hcd vhci_hcd.2: stop threads [ 329.909724][ T13] vhci_hcd vhci_hcd.2: release socket [ 329.915262][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 329.921320][ T991] usb 6-1: not running at top speed; connect to a high speed hub [ 329.930435][ T5791] usb 5-1: Using ep0 maxpacket: 8 [ 329.932533][ T991] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0035, bcdDevice= 0.40 [ 329.937887][ T5791] usb 5-1: config 0 interface 0 has no altsetting 0 [ 329.944741][ T5695] usb 38-1: enqueue for inactive port 0 [ 329.951272][ T5791] usb 5-1: New USB device found, idVendor=1b96, idProduct=0005, bcdDevice= 0.00 [ 329.966046][ T5791] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 329.976601][ T5791] usb 5-1: config 0 descriptor?? [ 329.978543][ T991] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.005642][ T991] usb 6-1: Product: syz [ 330.010357][ T991] usb 6-1: Manufacturer: syz [ 330.020197][ T991] usb 6-1: SerialNumber: syz [ 330.157914][ T9394] FAULT_INJECTION: forcing a failure. [ 330.157914][ T9394] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 330.180777][ T5730] usb 2-1: USB disconnect, device number 26 [ 330.183846][ T9394] CPU: 1 UID: 0 PID: 9394 Comm: syz.2.939 Not tainted syzkaller #0 PREEMPT(full) [ 330.183869][ T9394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 330.183877][ T9394] Call Trace: [ 330.183882][ T9394] [ 330.183888][ T9394] dump_stack_lvl+0x100/0x190 [ 330.183912][ T9394] should_fail_ex.cold+0x5/0xa [ 330.183931][ T9394] _copy_from_user+0x2e/0xd0 [ 330.183956][ T9394] drm_ioctl+0x520/0xc60 [ 330.183975][ T9394] ? __pfx_drm_mode_atomic_ioctl+0x10/0x10 [ 330.183996][ T9394] ? __pfx_drm_ioctl+0x10/0x10 [ 330.184012][ T9394] ? rcu_is_watching+0x12/0xc0 [ 330.184037][ T9394] ? selinux_file_ioctl+0x13b/0x290 [ 330.184054][ T9394] ? selinux_file_ioctl+0xb6/0x290 [ 330.184069][ T9394] ? __pfx_drm_ioctl+0x10/0x10 [ 330.184087][ T9394] __x64_sys_ioctl+0x18e/0x210 [ 330.184108][ T9394] do_syscall_64+0x115/0x870 [ 330.184130][ T9394] ? clear_bhb_loop+0x40/0x90 [ 330.184148][ T9394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.184163][ T9394] RIP: 0033:0x7f403299ce59 [ 330.184175][ T9394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 330.184189][ T9394] RSP: 002b:00007f40338a0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 330.184204][ T9394] RAX: ffffffffffffffda RBX: 00007f4032c15fa0 RCX: 00007f403299ce59 [ 330.184214][ T9394] RDX: 0000200000000580 RSI: 00000000c03864bc RDI: 0000000000000003 [ 330.184223][ T9394] RBP: 00007f40338a0090 R08: 0000000000000000 R09: 0000000000000000 [ 330.184232][ T9394] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 330.184241][ T9394] R13: 00007f4032c16038 R14: 00007f4032c15fa0 R15: 00007ffec8cac128 [ 330.184255][ T9394] [ 330.625755][ T991] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 330.653258][ T991] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -2 [ 330.664039][ T991] usb 6-1: USB disconnect, device number 6 [ 330.679544][ T5791] ntrig 0003:1B96:0005.0012: ignoring exceeding usage max [ 330.688488][ T5791] ntrig 0003:1B96:0005.0012: reserved main item tag 0xe [ 330.695879][ T5596] udevd[5596]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 330.704217][ T5791] ntrig 0003:1B96:0005.0012: report_id 18690 is invalid [ 330.711854][ T9] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 330.719002][ T5791] ntrig 0003:1B96:0005.0012: item 0 2 1 8 parsing failed [ 330.739685][ T5791] ntrig 0003:1B96:0005.0012: parse failed [ 330.745747][ T86] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 330.760549][ T5791] ntrig 0003:1B96:0005.0012: probe with driver ntrig failed with error -22 [ 330.814222][ T5695] usb usb38-port1: attempt power cycle [ 330.884981][ T991] usb 5-1: USB disconnect, device number 33 [ 330.894090][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 330.901714][ T9] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 330.912963][ T9] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 330.924815][ T9] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 330.926355][ T86] usb 3-1: Using ep0 maxpacket: 32 [ 330.938955][ T9] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 330.955624][ T86] usb 3-1: unable to get BOS descriptor or descriptor too short [ 330.955931][ T9] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 330.972932][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.986739][ T9] usb 1-1: Product: syz [ 330.986739][ T86] usb 3-1: config index 0 descriptor too short (expected 257, got 18) [ 330.986761][ T86] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 0 [ 330.990953][ T9] usb 1-1: Manufacturer: syz [ 331.009873][ T86] usb 3-1: can't read configurations, error -22 [ 331.019604][ T9] usb 1-1: SerialNumber: syz [ 331.031266][ C0] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 331.039678][ T9] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input39 [ 331.073980][ T5730] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 331.143861][ T86] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 331.235314][ T9390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 331.245083][ T9390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 331.245607][ T5730] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 331.261086][ T5730] usb 2-1: config 0 has no interface number 0 [ 331.267318][ T5730] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 331.276582][ T5730] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.284718][ T9] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 331.294433][ T5730] usb 2-1: config 0 descriptor?? [ 331.299444][ T9] (id 0x00) [ 331.300978][ T86] usb 3-1: Using ep0 maxpacket: 32 [ 331.304358][ T5730] usb 2-1: selecting invalid altsetting 1 [ 331.316551][ T86] usb 3-1: unable to get BOS descriptor or descriptor too short [ 331.323839][ T5730] dvb_ttusb_budget: ttusb_init_controller: error [ 331.326148][ T86] usb 3-1: config index 0 descriptor too short (expected 257, got 18) [ 331.335211][ T5730] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 331.339245][ T86] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 0 [ 331.366502][ T9] rc_core: IR keymap rc-imon-pad not found [ 331.369705][ T86] usb 3-1: can't read configurations, error -22 [ 331.378864][ T9] Registered IR keymap rc-empty [ 331.379016][ T86] usb usb3-port1: attempt power cycle [ 331.387823][ T5730] DVB: Unable to find symbol cx22700_attach() [ 331.395596][ T5695] usb usb38-port1: unable to enumerate USB device [ 331.402287][ T9] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 331.413347][ T9] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 331.451889][ T5730] DVB: Unable to find symbol tda10046_attach() [ 331.458922][ T5730] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 331.484251][ T9] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0 [ 331.724089][ T86] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 331.765118][ T86] usb 3-1: Using ep0 maxpacket: 32 [ 331.779057][ T86] usb 3-1: unable to get BOS descriptor or descriptor too short [ 331.807809][ T86] usb 3-1: config index 0 descriptor too short (expected 257, got 18) [ 331.823693][ T86] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 0 [ 331.854510][ T86] usb 3-1: can't read configurations, error -22 [ 331.923140][ T29] audit: type=1400 audit(1782223315.788:490): avc: denied { mount } for pid=9400 comm="syz.1.942" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 332.367101][ T86] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 332.424094][ T9] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0/input40 [ 332.424233][ T86] usb 3-1: Using ep0 maxpacket: 32 [ 332.436514][ T9] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:32> initialized [ 332.440880][ T29] audit: type=1400 audit(1782223315.838:491): avc: denied { getopt } for pid=9400 comm="syz.1.942" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 332.453712][ T9] usb 1-1: USB disconnect, device number 32 [ 332.525090][ T86] usb 3-1: unable to get BOS descriptor or descriptor too short [ 332.564500][ T86] usb 3-1: config index 0 descriptor too short (expected 257, got 18) [ 332.593638][ T86] usb 3-1: invalid descriptor for config index 0: type = 0x2, length = 0 [ 332.619650][ T29] audit: type=1400 audit(1782223316.408:492): avc: denied { mounton } for pid=9400 comm="syz.1.942" path="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=dir permissive=1 [ 332.623466][ T86] usb 3-1: can't read configurations, error -22 [ 332.641238][ T29] audit: type=1800 audit(1782223316.478:493): pid=9420 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=set_data cause=unavailable-hash-algorithm comm="syz.1.942" name="/newroot/198" dev="tmpfs" ino=1072 res=0 errno=0 [ 332.727537][ T86] usb usb3-port1: unable to enumerate USB device [ 332.930637][ T9431] ipvlan1: Caught tx_queue_len zero misconfig [ 333.484025][ T29] audit: type=1400 audit(1782223317.308:494): avc: denied { create } for pid=9443 comm="syz.4.953" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 333.610912][ T29] audit: type=1400 audit(1782223317.478:495): avc: denied { unmount } for pid=5612 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 334.811566][ T5614] usb 2-1: USB disconnect, device number 27 [ 334.933298][ T29] audit: type=1400 audit(1782223318.798:496): avc: denied { unmount } for pid=5606 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 335.086172][ T86] usb 5-1: new full-speed USB device number 34 using dummy_hcd [ 335.296943][ T9479] FAULT_INJECTION: forcing a failure. [ 335.296943][ T9479] name failslab, interval 1, probability 0, space 0, times 0 [ 335.336051][ T9479] CPU: 1 UID: 0 PID: 9479 Comm: syz.1.961 Not tainted syzkaller #0 PREEMPT(full) [ 335.336079][ T9479] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 335.336089][ T9479] Call Trace: [ 335.336094][ T9479] [ 335.336101][ T9479] dump_stack_lvl+0x100/0x190 [ 335.336124][ T9479] should_fail_ex.cold+0x5/0xa [ 335.336137][ T9479] ? __kmalloc_cache_noprof+0x6b/0x6c0 [ 335.336154][ T9479] should_failslab+0xc2/0x120 [ 335.336167][ T9479] __kmalloc_cache_noprof+0x91/0x6c0 [ 335.336183][ T9479] ? rcu_is_watching+0x12/0xc0 [ 335.336199][ T9479] ? vhost_task_create+0xee/0x370 [ 335.336211][ T9479] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 335.336223][ T9479] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 335.336237][ T9479] vhost_task_create+0xee/0x370 [ 335.336248][ T9479] ? __pfx_vhost_task_create+0x10/0x10 [ 335.336259][ T9479] ? rcu_is_watching+0x12/0xc0 [ 335.336276][ T9479] ? __pfx_vhost_task_fn+0x10/0x10 [ 335.336287][ T9479] ? __pfx___mutex_lock+0x10/0x10 [ 335.336313][ T9479] ? trace_irq_enable.constprop.0+0x122/0x160 [ 335.336337][ T9479] kvm_mmu_post_init_vm+0x1b3/0x360 [ 335.336361][ T9479] kvm_arch_vcpu_ioctl_run+0x66/0x1890 [ 335.336382][ T9479] ? kvm_vcpu_ioctl+0x1531/0x1700 [ 335.336395][ T9479] ? lock_release+0x24d/0x310 [ 335.336408][ T9479] kvm_vcpu_ioctl+0x730/0x1700 [ 335.336420][ T9479] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 335.336432][ T9479] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 335.336445][ T9479] ? do_vfs_ioctl+0x226/0x13e0 [ 335.336459][ T9479] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 335.336473][ T9479] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 335.336487][ T9479] ? rcu_is_watching+0x12/0xc0 [ 335.336503][ T9479] ? hook_file_ioctl_common+0x140/0x440 [ 335.336518][ T9479] ? selinux_file_ioctl+0x13b/0x290 [ 335.336529][ T9479] ? selinux_file_ioctl+0xb6/0x290 [ 335.336540][ T9479] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 335.336552][ T9479] __x64_sys_ioctl+0x18e/0x210 [ 335.336566][ T9479] do_syscall_64+0x115/0x870 [ 335.336582][ T9479] ? clear_bhb_loop+0x40/0x90 [ 335.336594][ T9479] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 335.336604][ T9479] RIP: 0033:0x7fc0f039ce59 [ 335.336613][ T9479] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 335.336624][ T9479] RSP: 002b:00007fc0f1244028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 335.336634][ T9479] RAX: ffffffffffffffda RBX: 00007fc0f0615fa0 RCX: 00007fc0f039ce59 [ 335.336641][ T9479] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 335.336647][ T9479] RBP: 00007fc0f1244090 R08: 0000000000000000 R09: 0000000000000000 [ 335.336653][ T9479] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 335.336660][ T9479] R13: 00007fc0f0616038 R14: 00007fc0f0615fa0 R15: 00007ffcb46271f8 [ 335.336669][ T9479] [ 335.830060][ T86] usb 5-1: not running at top speed; connect to a high speed hub [ 335.903998][ T86] usb 5-1: New USB device found, idVendor=04b4, idProduct=9320, bcdDevice= 0.40 [ 335.973571][ T86] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.999316][ T86] usb 5-1: Product: syz [ 336.023445][ T86] usb 5-1: Manufacturer: syz [ 336.048401][ T86] usb 5-1: SerialNumber: syz [ 336.118427][ T5695] hid_parser_main: 14 callbacks suppressed [ 336.118445][ T5695] hid-generic 0103:0004:0000.0013: unknown main item tag 0x0 [ 336.168787][ T5695] hid-generic 0103:0004:0000.0013: unknown main item tag 0x0 [ 336.230638][ T5695] hid-generic 0103:0004:0000.0013: unknown main item tag 0x0 [ 336.250733][ T5695] hid-generic 0103:0004:0000.0013: unknown main item tag 0x0 [ 336.262106][ T9] hid-generic 0103:0004:0000.0014: unknown main item tag 0x0 [ 336.269660][ T9] hid-generic 0103:0004:0000.0014: unknown main item tag 0x0 [ 336.288885][ T9] hid-generic 0103:0004:0000.0014: unknown main item tag 0x0 [ 336.296370][ T5695] hid-generic 0103:0004:0000.0013: unknown main item tag 0x0 [ 336.310001][ T9] hid-generic 0103:0004:0000.0014: unknown main item tag 0x0 [ 336.318572][ T5695] hid-generic 0103:0004:0000.0013: unknown main item tag 0x0 [ 336.333000][ T9] hid-generic 0103:0004:0000.0014: hidraw0: HID v0.05 Device [syz0] on syz1 [ 336.343642][ T5695] hid-generic 0103:0004:0000.0013: hidraw1: HID v0.05 Device [syz0] on syz1 [ 336.710315][ T9497] fido_id[9497]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 336.733248][ T9503] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1124 sclass=netlink_route_socket pid=9503 comm=syz.2.968 [ 336.794622][ T9498] fido_id[9498]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 337.103808][ T5791] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 337.208217][ T9] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 337.406759][ T9] usb 6-1: config 0 has an invalid descriptor of length 206, skipping remainder of the config [ 337.562299][ T9] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 337.659037][ T9] usb 6-1: New USB device found, idVendor=054c, idProduct=445f, bcdDevice=13.48 [ 337.689283][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 337.765670][ T9] usb 6-1: config 0 descriptor?? [ 337.779246][ T9] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 337.817188][ T86] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 337.827720][ T86] usb 5-1: MIDIStreaming interface descriptor not found [ 337.863823][ T5730] usb 2-1: new full-speed USB device number 28 using dummy_hcd [ 337.889065][ T86] usb 5-1: USB disconnect, device number 34 [ 337.895046][ T5791] usb 1-1: Using ep0 maxpacket: 8 [ 337.902837][ T5791] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 337.912093][ T5791] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 337.938956][ T5791] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 337.951389][ T5791] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 337.962967][ T5791] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 337.979439][ T5791] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 337.991131][ T5791] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.039481][ T9522] netlink: 'syz.4.975': attribute type 3 has an invalid length. [ 338.050111][ T29] audit: type=1400 audit(1782223321.918:497): avc: denied { setopt } for pid=9521 comm="syz.4.975" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 338.066536][ T5730] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 338.089992][ T5730] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 12592, setting to 64 [ 338.117962][ T29] audit: type=1400 audit(1782223321.938:498): avc: denied { ioctl } for pid=9521 comm="syz.4.975" path="socket:[22962]" dev="sockfs" ino=22962 ioctlcmd=0x5882 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 338.128372][ T5730] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 338.180879][ T5730] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 338.211492][ T5730] usb 2-1: Product: syz [ 338.254820][ T5730] usb 2-1: Manufacturer: syz [ 338.259987][ T5791] usb 1-1: usb_control_msg returned -32 [ 338.267765][ T5791] usbtmc 1-1:16.0: can't read capabilities [ 338.278795][ T5730] usb 2-1: SerialNumber: syz [ 338.299093][ T5730] usb 2-1: config 0 descriptor?? [ 338.305267][ T9514] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 338.704987][ T5730] rc_core: IR keymap rc-streamzap not found [ 338.711646][ T5730] Registered IR keymap rc-empty [ 338.718037][ T5730] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 338.730343][ T5730] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input41 [ 338.909679][ T5730] usb 1-1: USB disconnect, device number 33 [ 338.984498][ T9542] Set syz1 is full, maxelem 6117 reached [ 339.141165][ T5695] hid-generic 0103:0004:0000.0015: hidraw0: HID v0.05 Device [syz0] on syz1 [ 339.182883][ T9545] fido_id[9545]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 339.253867][ T5791] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 339.406019][ T5791] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 339.419586][ T5791] usb 3-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=2d.16 [ 339.428713][ T5791] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.436855][ T5791] usb 3-1: Product: syz [ 339.441092][ T5791] usb 3-1: Manufacturer: syz [ 339.446360][ T5791] usb 3-1: SerialNumber: syz [ 339.453577][ T5791] usb 3-1: config 0 descriptor?? [ 339.464960][ T5791] kvaser_usb 3-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 339.504085][ T5695] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 339.664896][ T5695] usb 5-1: Using ep0 maxpacket: 16 [ 339.687802][ T5695] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 339.962277][ T86] usb 6-1: USB disconnect, device number 7 [ 340.407313][ T5695] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 340.467282][ T5695] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.479221][ T5730] usb 3-1: USB disconnect, device number 40 [ 340.490667][ T5695] usb 5-1: Product: syz [ 340.500454][ T5695] usb 5-1: Manufacturer: syz [ 340.525854][ T5695] usb 5-1: SerialNumber: syz [ 340.668395][ T5695] usb 5-1: config 0 descriptor?? [ 340.705842][ T86] usb 2-1: USB disconnect, device number 28 [ 340.832690][ T29] audit: type=1400 audit(1782223324.698:499): avc: denied { call } for pid=9556 comm="syz.0.982" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 340.918394][ T29] audit: type=1400 audit(1782223324.698:500): avc: denied { transfer } for pid=9556 comm="syz.0.982" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 341.269398][ T5695] usb 5-1: USB disconnect, device number 35 [ 341.927850][ T29] audit: type=1400 audit(1782223325.798:501): avc: denied { map } for pid=9586 comm="syz.0.990" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 342.723887][ T5730] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 342.724278][ T86] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 342.907838][ T86] usb 3-1: config 0 has an invalid interface number: 199 but max is 1 [ 342.916836][ T86] usb 3-1: config 0 has no interface number 1 [ 342.923173][ T86] usb 3-1: config 0 interface 199 altsetting 2 endpoint 0xA has invalid wMaxPacketSize 0 [ 342.935894][ T86] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 342.948021][ T86] usb 3-1: config 0 interface 199 has no altsetting 0 [ 342.958160][ T86] usb 3-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 343.023920][ T86] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 343.040365][ T86] usb 3-1: SerialNumber: syz [ 343.054688][ T86] usb 3-1: config 0 descriptor?? [ 343.081508][ T86] uvcvideo 3-1:0.199: Found UVC 0.00 device (0002:0000) [ 343.091155][ T86] uvcvideo 3-1:0.199: No valid video chain found. [ 343.100301][ T9617] syzkaller1: entered promiscuous mode [ 343.123358][ T9617] syzkaller1: entered allmulticast mode [ 343.148640][ T5730] usb 5-1: not running at top speed; connect to a high speed hub [ 343.163721][ T5730] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 343.182075][ T5730] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.199421][ T5730] usb 5-1: Product: ꍥ熧ꭴ✔濺⨗㢱람旇䢡㥩섉龯闠첛韂埓鄃鸑ꠚ캓鲎镔엠仳ሆ座㏷訋༆胘較ಠ镣퓓潶嘺赎쀊屨鋠㬑퓄 [ 343.236910][ T5730] usb 5-1: Manufacturer: Ѓ [ 343.285822][ T9619] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1000'. [ 343.369948][ T9623] FAULT_INJECTION: forcing a failure. [ 343.369948][ T9623] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 343.384144][ T9623] CPU: 1 UID: 0 PID: 9623 Comm: syz.5.1002 Tainted: G L syzkaller #0 PREEMPT(full) [ 343.384171][ T9623] Tainted: [L]=SOFTLOCKUP [ 343.384176][ T9623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 343.384186][ T9623] Call Trace: [ 343.384191][ T9623] [ 343.384197][ T9623] dump_stack_lvl+0x100/0x190 [ 343.384222][ T9623] should_fail_ex.cold+0x5/0xa [ 343.384242][ T9623] _copy_from_user+0x2e/0xd0 [ 343.384267][ T9623] video_usercopy+0xe71/0x1730 [ 343.384287][ T9623] ? __pfx___video_do_ioctl+0x10/0x10 [ 343.384305][ T9623] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 343.384324][ T9623] ? __pfx_video_usercopy+0x10/0x10 [ 343.384347][ T9623] v4l2_ioctl+0x1bd/0x250 [ 343.384366][ T9623] ? __pfx_v4l2_ioctl+0x10/0x10 [ 343.384385][ T9623] __x64_sys_ioctl+0x18e/0x210 [ 343.384407][ T9623] do_syscall_64+0x115/0x870 [ 343.384429][ T9623] ? clear_bhb_loop+0x40/0x90 [ 343.384446][ T9623] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.384462][ T9623] RIP: 0033:0x7f4f2299ce59 [ 343.384474][ T9623] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.384489][ T9623] RSP: 002b:00007f4f237cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 343.384505][ T9623] RAX: ffffffffffffffda RBX: 00007f4f22c15fa0 RCX: 00007f4f2299ce59 [ 343.384516][ T9623] RDX: 0000200000000000 RSI: 000000004014563c RDI: 0000000000000003 [ 343.384531][ T9623] RBP: 00007f4f237cc090 R08: 0000000000000000 R09: 0000000000000000 [ 343.384541][ T9623] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 343.384550][ T9623] R13: 00007f4f22c16038 R14: 00007f4f22c15fa0 R15: 00007fff554df5b8 [ 343.384565][ T9623] [ 343.588226][ T5730] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 343.615539][ T9606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 343.624028][ T9606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.646175][ T29] audit: type=1400 audit(1782223327.508:502): avc: denied { create } for pid=9603 comm="syz.2.996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 343.665681][ T29] audit: type=1400 audit(1782223327.508:503): avc: denied { setopt } for pid=9603 comm="syz.2.996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 343.685705][ T29] audit: type=1400 audit(1782223327.518:504): avc: denied { getopt } for pid=9603 comm="syz.2.996" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 343.705909][ T5695] usb 3-1: USB disconnect, device number 41 [ 343.745326][ T9625] syzkaller1: entered promiscuous mode [ 343.767478][ T5730] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 343.789934][ T9625] syzkaller1: entered allmulticast mode [ 343.859414][ T5730] usb 5-1: USB disconnect, device number 36 [ 343.875724][ T5596] udevd[5596]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 343.931748][ T29] audit: type=1400 audit(1782223327.798:505): avc: denied { setopt } for pid=9627 comm="syz.1.1004" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 344.203060][ T9638] tipc: Enabling of bearer rejected, failed to enable media [ 344.394099][ T9642] FAULT_INJECTION: forcing a failure. [ 344.394099][ T9642] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 344.424689][ T9642] CPU: 1 UID: 0 PID: 9642 Comm: syz.2.1008 Tainted: G L syzkaller #0 PREEMPT(full) [ 344.424717][ T9642] Tainted: [L]=SOFTLOCKUP [ 344.424723][ T9642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 344.424730][ T9642] Call Trace: [ 344.424733][ T9642] [ 344.424737][ T9642] dump_stack_lvl+0x100/0x190 [ 344.424755][ T9642] should_fail_ex.cold+0x5/0xa [ 344.424770][ T9642] _copy_from_iter+0x1f4/0x1690 [ 344.424786][ T9642] ? __asan_memset+0x23/0x50 [ 344.424796][ T9642] ? __pfx__copy_from_iter+0x10/0x10 [ 344.424812][ T9642] ? __pfx___alloc_skb+0x10/0x10 [ 344.424823][ T9642] ? netlink_autobind.isra.0+0x160/0x370 [ 344.424841][ T9642] netlink_sendmsg+0x808/0xda0 [ 344.424858][ T9642] ? __pfx_netlink_sendmsg+0x10/0x10 [ 344.424876][ T9642] ____sys_sendmsg+0xa4d/0xbe0 [ 344.424891][ T9642] ? __pfx_netlink_sendmsg+0x10/0x10 [ 344.424907][ T9642] ? __pfx_____sys_sendmsg+0x10/0x10 [ 344.424922][ T9642] ? kstrtouint_from_user+0x13c/0x1d0 [ 344.424942][ T9642] ___sys_sendmsg+0x190/0x1e0 [ 344.424964][ T9642] ? __pfx____sys_sendmsg+0x10/0x10 [ 344.424987][ T9642] ? get_pid_task+0x106/0x250 [ 344.425021][ T9642] ? rcu_is_watching+0x12/0xc0 [ 344.425050][ T9642] __sys_sendmsg+0x160/0x210 [ 344.425068][ T9642] ? __pfx___sys_sendmsg+0x10/0x10 [ 344.425089][ T9642] ? rcu_is_watching+0x12/0xc0 [ 344.425111][ T9642] do_syscall_64+0x115/0x870 [ 344.425135][ T9642] ? clear_bhb_loop+0x40/0x90 [ 344.425153][ T9642] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.425164][ T9642] RIP: 0033:0x7f403299ce59 [ 344.425173][ T9642] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 344.425184][ T9642] RSP: 002b:00007f40338a0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 344.425195][ T9642] RAX: ffffffffffffffda RBX: 00007f4032c15fa0 RCX: 00007f403299ce59 [ 344.425201][ T9642] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 344.425208][ T9642] RBP: 00007f40338a0090 R08: 0000000000000000 R09: 0000000000000000 [ 344.425214][ T9642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 344.425220][ T9642] R13: 00007f4032c16038 R14: 00007f4032c15fa0 R15: 00007ffec8cac128 [ 344.425229][ T9642] [ 344.813814][ T5791] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 345.305515][ T5791] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 345.369738][ T86] usb 2-1: new full-speed USB device number 29 using dummy_hcd [ 345.533159][ T5791] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 345.560705][ T5791] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.570225][ T5791] usb 6-1: config 0 descriptor?? [ 345.577395][ T5791] pwc: Askey VC010 type 2 USB webcam detected. [ 345.845434][ T86] usb 2-1: New USB device found, idVendor=13d3, idProduct=3224, bcdDevice=cb.0d [ 345.864078][ T5730] usb 5-1: new low-speed USB device number 37 using dummy_hcd [ 346.028314][ T5730] usb 5-1: unable to get BOS descriptor or descriptor too short [ 346.041450][ T5730] usb 5-1: config 255 has an invalid interface number: 100 but max is 0 [ 346.052520][ T5730] usb 5-1: config 255 has no interface number 0 [ 346.059644][ T5730] usb 5-1: config 255 interface 100 has no altsetting 0 [ 346.076376][ T5730] usb 5-1: string descriptor 0 read error: -22 [ 346.083451][ T5730] usb 5-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=7b.81 [ 346.093976][ T5730] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.330669][ T5791] pwc: recv_control_msg error -32 req 02 val 2b00 [ 346.420077][ T86] usb 2-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 346.430038][ T86] usb 2-1: Product: syz [ 346.434256][ T86] usb 2-1: Manufacturer: syz [ 346.439111][ T86] usb 2-1: SerialNumber: syz [ 346.448471][ T5730] usb 5-1: USB disconnect, device number 37 [ 346.449711][ T86] dvb-usb: found a 'DigitalNow TinyUSB 2 DVB-t Receiver' in warm state. [ 346.937943][ T5791] pwc: recv_control_msg error -71 req 02 val 2c00 [ 346.945629][ T5791] pwc: recv_control_msg error -71 req 04 val 1000 [ 346.952304][ T5791] pwc: recv_control_msg error -71 req 04 val 1300 [ 346.959121][ T5791] pwc: recv_control_msg error -71 req 04 val 1400 [ 346.965805][ T5791] pwc: recv_control_msg error -71 req 02 val 2000 [ 346.972425][ T5791] pwc: recv_control_msg error -71 req 02 val 2100 [ 346.979120][ T5791] pwc: recv_control_msg error -71 req 04 val 1500 [ 346.986328][ T5791] pwc: recv_control_msg error -71 req 02 val 2500 [ 346.992932][ T5791] pwc: recv_control_msg error -71 req 02 val 2400 [ 346.999666][ T5791] pwc: recv_control_msg error -71 req 02 val 2600 [ 347.006358][ T5791] pwc: recv_control_msg error -71 req 02 val 2900 [ 347.012955][ T5791] pwc: recv_control_msg error -71 req 02 val 2800 [ 347.019698][ T5791] pwc: recv_control_msg error -71 req 04 val 1100 [ 347.026318][ T5791] pwc: recv_control_msg error -71 req 04 val 1200 [ 347.030198][ T29] audit: type=1400 audit(1782223330.898:506): avc: denied { ioctl } for pid=9646 comm="syz.1.1011" path="socket:[24176]" dev="sockfs" ino=24176 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 347.033489][ T5791] pwc: Registered as video103. [ 347.057585][ T5730] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 347.065118][ T5791] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input42 [ 347.083068][ T5791] usb 6-1: USB disconnect, device number 8 [ 347.114318][ T86] vp7045: USB control message 'in' went wrong. [ 347.140873][ T86] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 347.161011][ T86] dvb-usb: DigitalNow TinyUSB 2 DVB-t Receiver error while loading driver (-19) [ 347.178755][ T86] usb 2-1: USB disconnect, device number 29 [ 347.258741][ T5730] usb 1-1: config 0 has an invalid interface number: 199 but max is 1 [ 347.283617][ T5730] usb 1-1: config 0 has no interface number 1 [ 347.292517][ T5730] usb 1-1: config 0 interface 199 altsetting 2 endpoint 0xA has invalid wMaxPacketSize 0 [ 347.315130][ T5730] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 347.382873][ T5730] usb 1-1: config 0 interface 199 has no altsetting 0 [ 347.400863][ T5730] usb 1-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 347.532841][ T5730] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 348.418139][ T5730] usb 1-1: SerialNumber: syz [ 348.424092][ T5730] usb 1-1: config 0 descriptor?? [ 348.433187][ T5730] uvcvideo 1-1:0.199: Found UVC 0.00 device (0002:0000) [ 348.441202][ T5730] uvcvideo 1-1:0.199: No valid video chain found. [ 348.541638][ T9698] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9698 comm=syz.2.1024 [ 348.629635][ T9702] audit: audit_lost=3 audit_rate_limit=0 audit_backlog_limit=64 [ 348.638443][ T9702] audit: out of memory in audit_log_start [ 348.649493][ T9676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 348.659685][ T9676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 348.678063][ T5695] usb 1-1: USB disconnect, device number 34 [ 348.823798][ T5730] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 348.986732][ T5730] usb 5-1: New USB device found, idVendor=0403, idProduct=bca4, bcdDevice= 2.23 [ 348.996391][ T5730] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 349.005147][ T5730] usb 5-1: Product: syz [ 349.009526][ T5730] usb 5-1: Manufacturer: syz [ 349.014277][ T5730] usb 5-1: SerialNumber: syz [ 349.024966][ T5730] usb 5-1: config 0 descriptor?? [ 349.510316][ T5730] usb 5-1: USB disconnect, device number 38 [ 350.074450][ T5834] block nbd3: Possible stuck request ffff888027ff7000: control (read@0,1024B). Runtime 120 seconds [ 350.107148][ T5834] block nbd3: Possible stuck request ffff888027ff71c0: control (read@1024,1024B). Runtime 120 seconds [ 350.155691][ T5834] block nbd3: Possible stuck request ffff888027ff7380: control (read@2048,1024B). Runtime 120 seconds [ 350.203681][ T5834] block nbd3: Possible stuck request ffff888027ff7540: control (read@3072,1024B). Runtime 120 seconds [ 350.668936][ T9721] tipc: Enabling of bearer rejected, failed to enable media [ 350.833916][ T5791] usb 5-1: new low-speed USB device number 39 using dummy_hcd [ 351.845376][ T5791] usb 5-1: unable to get BOS descriptor or descriptor too short [ 351.859806][ T5791] usb 5-1: config 255 has an invalid interface number: 100 but max is 0 [ 351.869720][ T5791] usb 5-1: config 255 has no interface number 0 [ 351.876321][ T5791] usb 5-1: config 255 interface 100 has no altsetting 0 [ 351.897337][ T5791] usb 5-1: string descriptor 0 read error: -22 [ 351.917937][ T5791] usb 5-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=7b.81 [ 351.929690][ T9] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 352.018592][ T5791] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.193432][ T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 352.204085][ T29] audit: type=1400 audit(1782223336.058:507): avc: denied { getopt } for pid=9740 comm="syz.0.1036" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 352.261247][ T9] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 352.287628][ T5730] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 352.320923][ T991] usb 5-1: USB disconnect, device number 39 [ 352.329528][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.354792][ T9] usb 2-1: config 0 descriptor?? [ 352.366776][ T9] pwc: Askey VC010 type 2 USB webcam detected. [ 352.453981][ T5730] usb 6-1: device descriptor read/64, error -71 [ 352.516144][ T9749] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1036'. [ 352.879330][ T9] pwc: recv_control_msg error -32 req 02 val 2b00 [ 352.983797][ T5730] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 354.073867][ T5730] usb 6-1: device descriptor read/64, error -71 [ 354.104222][ T9] pwc: recv_control_msg error -71 req 02 val 2c00 [ 354.122278][ T9] pwc: recv_control_msg error -71 req 04 val 1000 [ 354.188659][ T5730] usb usb6-port1: attempt power cycle [ 354.420198][ T9] pwc: recv_control_msg error -71 req 04 val 1300 [ 354.561217][ T9] pwc: recv_control_msg error -71 req 04 val 1400 [ 354.571082][ T9] pwc: recv_control_msg error -71 req 02 val 2000 [ 354.579672][ T9] pwc: recv_control_msg error -71 req 02 val 2100 [ 354.660555][ T9] pwc: recv_control_msg error -71 req 04 val 1500 [ 354.711470][ T9] pwc: recv_control_msg error -71 req 02 val 2500 [ 354.733084][ T9] pwc: recv_control_msg error -71 req 02 val 2400 [ 354.762101][ T9] pwc: recv_control_msg error -71 req 02 val 2600 [ 354.833897][ T5730] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 354.848527][ T9] pwc: recv_control_msg error -71 req 02 val 2900 [ 354.893993][ T5730] usb 6-1: device descriptor read/8, error -71 [ 354.913139][ T9] pwc: recv_control_msg error -71 req 02 val 2800 [ 355.212653][ T9] pwc: recv_control_msg error -71 req 04 val 1100 [ 355.257488][ T9] pwc: recv_control_msg error -71 req 04 val 1200 [ 355.300470][ T9] pwc: Registered as video103. [ 355.315082][ T9776] tipc: Enabling of bearer rejected, failed to enable media [ 355.324777][ T5730] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 355.338143][ T9] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input43 [ 355.383469][ T9780] overlayfs: missing 'lowerdir' [ 355.395768][ T9] usb 2-1: USB disconnect, device number 30 [ 355.563809][ T5730] usb 6-1: device not accepting address 12, error -71 [ 355.858664][ T5730] usb usb6-port1: unable to enumerate USB device [ 356.061104][ T9788] tipc: Enabling of bearer rejected, failed to enable media [ 356.437032][ T5710] usb 5-1: new low-speed USB device number 40 using dummy_hcd [ 356.659580][ T9809] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 356.797550][ T9810] ipvlan2: entered allmulticast mode [ 356.802940][ T9810] batadv_slave_1: entered allmulticast mode [ 356.813250][ T9810] batman_adv: batadv0: Adding interface: ipvlan2 [ 356.813775][ T5614] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 356.827868][ T9810] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 356.853885][ T9] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 356.867490][ T9810] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 356.900703][ T9810] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 356.910680][ T9810] batman_adv: batadv0: Interface activated: ipvlan2 [ 357.108417][ T9] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 357.112340][ T5710] usb 5-1: unable to get BOS descriptor or descriptor too short [ 357.128384][ T5710] usb 5-1: config 255 has an invalid interface number: 100 but max is 0 [ 357.136930][ T5710] usb 5-1: config 255 has no interface number 0 [ 357.143804][ T5710] usb 5-1: config 255 interface 100 has no altsetting 0 [ 357.162567][ T5710] usb 5-1: string descriptor 0 read error: -22 [ 357.169200][ T5710] usb 5-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=7b.81 [ 357.178308][ T5710] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.671259][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.680021][ T9] usb 2-1: Product: syz [ 357.696385][ T5614] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 357.756393][ T9] usb 2-1: Manufacturer: syz [ 357.801555][ T9] usb 2-1: SerialNumber: syz [ 357.851049][ T9] usb 2-1: config 0 descriptor?? [ 358.158577][ T5710] usb 5-1: USB disconnect, device number 40 [ 358.164620][ T5614] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 358.175415][ T5614] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 358.180973][ T9808] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.184524][ T5614] usb 6-1: config 0 descriptor?? [ 358.199474][ T5614] pwc: Askey VC010 type 2 USB webcam detected. [ 358.213450][ T9808] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.471046][ T9817] tipc: Enabling of bearer rejected, failed to enable media [ 358.506580][ T9] usb 2-1: Firmware version (0.0) predates our first public release. [ 358.540268][ T9] usb 2-1: Please update to version 0.2 or newer [ 358.636615][ T9] usb 2-1: USB disconnect, device number 31 [ 358.652072][ T29] audit: type=1400 audit(1782223342.518:508): avc: denied { read } for pid=5271 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 358.656109][ T5614] pwc: recv_control_msg error -32 req 02 val 2b00 [ 358.843891][ T86] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 358.990150][ T5614] pwc: recv_control_msg error -71 req 02 val 2c00 [ 359.001784][ T5614] pwc: recv_control_msg error -71 req 04 val 1000 [ 359.010148][ T5614] pwc: recv_control_msg error -71 req 04 val 1300 [ 359.017222][ T5614] pwc: recv_control_msg error -71 req 04 val 1400 [ 359.024753][ T5614] pwc: recv_control_msg error -71 req 02 val 2000 [ 359.032288][ T5614] pwc: recv_control_msg error -71 req 02 val 2100 [ 359.044939][ T29] audit: type=1326 audit(1782223342.918:509): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9827 comm="syz.0.1059" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f648519ce59 code=0x0 [ 359.047316][ T5614] pwc: recv_control_msg error -71 req 04 val 1500 [ 359.078475][ T86] usb 5-1: Using ep0 maxpacket: 32 [ 359.083987][ T5614] pwc: recv_control_msg error -71 req 02 val 2500 [ 359.090804][ T5614] pwc: recv_control_msg error -71 req 02 val 2400 [ 359.097771][ T5614] pwc: recv_control_msg error -71 req 02 val 2600 [ 359.105673][ T86] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 359.113868][ T86] usb 5-1: config 0 has no interface number 0 [ 359.120151][ T86] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 359.131304][ T5614] pwc: recv_control_msg error -71 req 02 val 2900 [ 359.137855][ T86] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 359.148209][ T5614] pwc: recv_control_msg error -71 req 02 val 2800 [ 359.155020][ T5614] pwc: recv_control_msg error -71 req 04 val 1100 [ 359.161796][ T5614] pwc: recv_control_msg error -71 req 04 val 1200 [ 359.168713][ T86] usb 5-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 359.178628][ T5614] pwc: Registered as video103. [ 359.185938][ T5614] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input44 [ 359.199242][ T86] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 359.220144][ T86] usb 5-1: Product: syz [ 359.224775][ T5614] usb 6-1: USB disconnect, device number 13 [ 359.230961][ T86] usb 5-1: Manufacturer: syz [ 359.236725][ T86] usb 5-1: SerialNumber: syz [ 359.247040][ T86] usb 5-1: config 0 descriptor?? [ 359.420283][ T9839] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1061'. [ 359.845655][ T86] radio-si470x 5-1:0.35: this is not a si470x device. [ 359.898134][ T86] radio-raremono 5-1:0.35: this is not Thanko's Raremono. [ 360.006195][ T9844] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1058'. [ 360.686266][ T9847] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1064'. [ 361.080428][ T9861] FAULT_INJECTION: forcing a failure. [ 361.080428][ T9861] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 361.093708][ T9861] CPU: 0 UID: 0 PID: 9861 Comm: syz.0.1064 Tainted: G L syzkaller #0 PREEMPT(full) [ 361.093739][ T9861] Tainted: [L]=SOFTLOCKUP [ 361.093745][ T9861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 361.093755][ T9861] Call Trace: [ 361.093762][ T9861] [ 361.093769][ T9861] dump_stack_lvl+0x100/0x190 [ 361.093794][ T9861] should_fail_ex.cold+0x5/0xa [ 361.093816][ T9861] _copy_from_user+0x2e/0xd0 [ 361.093846][ T9861] kstrtouint_from_user+0xd6/0x1d0 [ 361.093864][ T9861] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 361.093879][ T9861] ? rhashtable_insert_slow+0x990/0x1e40 [ 361.093894][ T9861] ? rcu_is_watching+0x12/0xc0 [ 361.093911][ T9861] proc_fail_nth_write+0x83/0x220 [ 361.093933][ T9861] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 361.093954][ T9861] ? __pfx___might_resched+0x10/0x10 [ 361.093975][ T9861] vfs_write+0x2aa/0x1050 [ 361.093997][ T9861] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 361.094012][ T9861] ? __pfx_vfs_write+0x10/0x10 [ 361.094026][ T9861] ? rcu_is_watching+0x12/0xc0 [ 361.094042][ T9861] ? __fget_files+0x21f/0x3d0 [ 361.094053][ T9861] ksys_write+0x12a/0x250 [ 361.094072][ T9861] ? __pfx_ksys_write+0x10/0x10 [ 361.094094][ T9861] ? rcu_is_watching+0x12/0xc0 [ 361.094117][ T9861] do_syscall_64+0x115/0x870 [ 361.094140][ T9861] ? clear_bhb_loop+0x40/0x90 [ 361.094151][ T9861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 361.094162][ T9861] RIP: 0033:0x7f648515d68e [ 361.094171][ T9861] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 361.094181][ T9861] RSP: 002b:00007f64833f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 361.094193][ T9861] RAX: ffffffffffffffda RBX: 00007f64833f66c0 RCX: 00007f648515d68e [ 361.094200][ T9861] RDX: 0000000000000001 RSI: 00007f64833f60a0 RDI: 0000000000000009 [ 361.094210][ T9861] RBP: 00007f64833f6090 R08: 0000000000000000 R09: 0000000000000000 [ 361.094220][ T9861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 361.094230][ T9861] R13: 00007f6485416218 R14: 00007f6485416180 R15: 00007ffff7379858 [ 361.094245][ T9861] [ 361.378877][ T9852] overlayfs: failed to resolve './bus': -2 [ 361.561863][ T86] usb 5-1: USB disconnect, device number 41 [ 361.670090][ T9868] tipc: Enabling of bearer rejected, failed to enable media [ 361.723880][ T5730] usb 6-1: new low-speed USB device number 14 using dummy_hcd [ 361.889251][ T5730] usb 6-1: unable to get BOS descriptor or descriptor too short [ 361.912933][ T5730] usb 6-1: config 255 has an invalid interface number: 100 but max is 0 [ 361.932007][ T5730] usb 6-1: config 255 has no interface number 0 [ 361.954833][ T5730] usb 6-1: config 255 interface 100 has no altsetting 0 [ 361.985379][ T5730] usb 6-1: string descriptor 0 read error: -22 [ 362.028863][ T5730] usb 6-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=7b.81 [ 362.092877][ T5730] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 363.160577][ T9865] bridge0: port 2(bridge_slave_1) entered disabled state [ 363.250216][ T9865] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 363.313968][ T5730] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 363.329428][ T9865] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 363.346077][ T9884] overlayfs: missing 'lowerdir' [ 363.427774][ T1170] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.438215][ T1170] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.450851][ T5695] usb 6-1: USB disconnect, device number 14 [ 363.457604][ T1170] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.533917][ T86] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 363.736904][ T86] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 363.789154][ T1170] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 363.803800][ T5730] usb 1-1: Using ep0 maxpacket: 8 [ 363.809185][ T86] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 363.818880][ T5730] usb 1-1: config 0 interface 0 has no altsetting 0 [ 363.825613][ T86] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.833637][ T5730] usb 1-1: New USB device found, idVendor=1b96, idProduct=0005, bcdDevice= 0.00 [ 363.833662][ T5730] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.844769][ T86] usb 3-1: config 0 descriptor?? [ 363.863367][ T86] pwc: Askey VC010 type 2 USB webcam detected. [ 363.871421][ T5730] usb 1-1: config 0 descriptor?? [ 364.240099][ T9904] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1079'. [ 364.439199][ T4926] Bluetooth: hci5: unexpected event 0x03 length: 12 > 11 [ 364.803104][ T86] pwc: recv_control_msg error -32 req 02 val 2b00 [ 365.030093][ T9914] tipc: Enabling of bearer rejected, failed to enable media [ 365.209299][ T86] pwc: recv_control_msg error -71 req 02 val 2c00 [ 365.274373][ T86] pwc: recv_control_msg error -71 req 04 val 1000 [ 365.388684][ T86] pwc: recv_control_msg error -71 req 04 val 1300 [ 365.436237][ T86] pwc: recv_control_msg error -71 req 04 val 1400 [ 365.475679][ T86] pwc: recv_control_msg error -71 req 02 val 2000 [ 365.522033][ T86] pwc: recv_control_msg error -71 req 02 val 2100 [ 365.598449][ T86] pwc: recv_control_msg error -71 req 04 val 1500 [ 365.624025][ T9906] usb 5-1: new low-speed USB device number 42 using dummy_hcd [ 365.664016][ T5730] ntrig 0003:1B96:0005.0016: ignoring exceeding usage max [ 365.678193][ T86] pwc: recv_control_msg error -71 req 02 val 2500 [ 365.736933][ T86] pwc: recv_control_msg error -71 req 02 val 2400 [ 365.788210][ T86] pwc: recv_control_msg error -71 req 02 val 2600 [ 365.816715][ T86] pwc: recv_control_msg error -71 req 02 val 2900 [ 365.838964][ T9906] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 365.850611][ T86] pwc: recv_control_msg error -71 req 02 val 2800 [ 365.871378][ T9906] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 365.886718][ T86] pwc: recv_control_msg error -71 req 04 val 1100 [ 365.910605][ T86] pwc: recv_control_msg error -71 req 04 val 1200 [ 365.928139][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 365.968055][ T24] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 365.980369][ T86] pwc: Registered as video103. [ 366.011074][ T9906] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 366.043627][ T86] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input45 [ 366.058530][ T5730] ntrig 0003:1B96:0005.0016: reserved main item tag 0xe [ 366.130396][ T5730] ntrig 0003:1B96:0005.0016: report_id 18690 is invalid [ 366.138998][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 366.155681][ T5730] ntrig 0003:1B96:0005.0016: item 0 2 1 8 parsing failed [ 366.163353][ T5730] ntrig 0003:1B96:0005.0016: parse failed [ 366.168448][ T86] usb 3-1: USB disconnect, device number 42 [ 366.250737][ T5730] ntrig 0003:1B96:0005.0016: probe with driver ntrig failed with error -22 [ 366.485627][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 366.496929][ T9906] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 366.511522][ T9906] usb 5-1: config 168 interface 0 has no altsetting 0 [ 366.518817][ T24] usb 2-1: config 0 has no interfaces? [ 366.519794][ T5730] usb 1-1: USB disconnect, device number 35 [ 366.525118][ T9906] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 366.540888][ T9906] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 366.553590][ T24] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 366.565977][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 366.577267][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.590286][ T24] usb 2-1: Product: syz [ 366.594786][ T9906] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 366.608424][ T24] usb 2-1: Manufacturer: syz [ 366.613125][ T24] usb 2-1: SerialNumber: syz [ 366.618511][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 366.631439][ T24] usb 2-1: config 0 descriptor?? [ 366.636803][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 366.668680][ T9906] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 366.682816][ T9906] usb 5-1: config 168 interface 0 has no altsetting 0 [ 366.972881][ T9906] usb 5-1: config 168 descriptor has 1 excess byte, ignoring [ 366.990667][ T9906] usb 5-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 367.011168][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 367.019913][ T9933] overlayfs: missing 'workdir' [ 367.029286][ T9906] usb 5-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 367.115781][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 367.147993][ T9906] usb 5-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 367.159830][ T9906] usb 5-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 367.173564][ T9906] usb 5-1: config 168 interface 0 has no altsetting 0 [ 367.182460][ T9906] usb 5-1: string descriptor 0 read error: -22 [ 367.188738][ T9906] usb 5-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 367.565516][ T9906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 367.578393][ T9906] adutux 5-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 367.614754][ T9939] syzkaller1: entered promiscuous mode [ 367.630317][ T9939] syzkaller1: entered allmulticast mode [ 368.220961][ T5730] usb 5-1: USB disconnect, device number 42 [ 368.598904][ T9911] ip6t_REJECT: ECHOREPLY is not supported [ 369.001326][ T9953] netlink: 256 bytes leftover after parsing attributes in process `syz.5.1092'. [ 369.041816][ T86] usb 2-1: USB disconnect, device number 32 [ 369.111890][ T9957] IPVS: set_ctl: invalid protocol: 60 172.20.20.30:20000 [ 369.201306][ T9960] binder: BINDER_SET_CONTEXT_MGR already set [ 369.207642][ T9960] binder: 9956:9960 ioctl 4018620d 200000001000 returned -16 [ 369.398751][ T9962] bond1: Unable to set up delay as MII monitoring is disabled [ 369.416860][ T9962] bond1 (unregistering): Released all slaves [ 369.485071][ T9906] usb 1-1: new full-speed USB device number 36 using dummy_hcd [ 369.530185][ T9971] overlayfs: missing 'workdir' [ 369.531946][ T9965] dummy0: left promiscuous mode [ 369.571971][ T9962] netlink: 'syz.1.1094': attribute type 10 has an invalid length. [ 369.593858][ T9962] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1094'. [ 369.614123][ T9962] dummy0: entered promiscuous mode [ 370.045219][ T9906] usb 1-1: config index 0 descriptor too short (expected 21127, got 36) [ 370.058780][ T9906] usb 1-1: config 134 has too many interfaces: 59, using maximum allowed: 32 [ 370.067969][ T9906] usb 1-1: config 134 has an invalid descriptor of length 147, skipping remainder of the config [ 370.081560][ T9906] usb 1-1: config 134 has 0 interfaces, different from the descriptor's value: 59 [ 370.092898][ T9906] usb 1-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.00 [ 370.102935][ T9906] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.293961][ T5730] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 370.634273][ T5730] usb 3-1: Using ep0 maxpacket: 8 [ 370.642000][ T5730] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 370.642213][ T5730] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 370.642465][ T5730] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 370.642689][ T5730] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 370.642875][ T5730] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 370.643074][ T5730] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 370.762462][ T9998] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1105'. [ 370.894145][ T29] audit: type=1400 audit(1782223354.758:510): avc: denied { write } for pid=9979 comm="syz.2.1101" name="ppp" dev="devtmpfs" ino=710 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 371.093968][ T5730] usb 3-1: GET_CAPABILITIES returned 0 [ 371.114645][ T5730] usbtmc 3-1:16.0: can't read capabilities [ 371.887197][ T5791] usb 3-1: USB disconnect, device number 43 [ 372.618486][ T9906] usb 1-1: string descriptor 0 read error: -71 [ 372.654695][ T9906] usb 1-1: USB disconnect, device number 36 [ 372.798027][T10021] tipc: Enabling of bearer rejected, failed to enable media [ 373.005169][T10023] overlayfs: missing 'workdir' [ 373.044879][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 373.505250][ T5730] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 373.653826][ T5730] usb 6-1: Using ep0 maxpacket: 8 [ 373.660057][ T5730] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 373.668413][ T5730] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 373.678291][ T5730] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 373.688629][ T5730] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 373.698566][ T5730] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 373.711607][ T5730] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 373.720742][ T5730] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.941718][ T5730] usb 6-1: usb_control_msg returned -32 [ 373.950237][ T5730] usbtmc 6-1:16.0: can't read capabilities [ 374.086959][T10055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1120'. [ 374.114557][T10055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1120'. [ 374.142666][T10055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1120'. [ 374.189332][T10055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1120'. [ 374.233828][T10055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1120'. [ 375.246031][ T9906] usb 6-1: USB disconnect, device number 15 [ 375.682905][T10078] tipc: Enabling of bearer rejected, failed to enable media [ 375.898589][T10084] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1129'. [ 375.988882][T10090] dummy0: left promiscuous mode [ 376.003295][T10084] netlink: 'syz.5.1129': attribute type 10 has an invalid length. [ 376.012777][T10084] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1129'. [ 376.023555][T10084] dummy0: entered promiscuous mode [ 377.631885][T10121] FAULT_INJECTION: forcing a failure. [ 377.631885][T10121] name failslab, interval 1, probability 0, space 0, times 0 [ 377.645349][T10121] CPU: 0 UID: 0 PID: 10121 Comm: syz.1.1139 Tainted: G L syzkaller #0 PREEMPT(full) [ 377.645378][T10121] Tainted: [L]=SOFTLOCKUP [ 377.645384][T10121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 377.645393][T10121] Call Trace: [ 377.645399][T10121] [ 377.645405][T10121] dump_stack_lvl+0x100/0x190 [ 377.645430][T10121] should_fail_ex.cold+0x5/0xa [ 377.645450][T10121] ? fs_reclaim_acquire+0x70/0x100 [ 377.645472][T10121] should_failslab+0xc2/0x120 [ 377.645492][T10121] __kmalloc_noprof+0xfc/0x820 [ 377.645510][T10121] ? __pfx_dynamic_dname+0x10/0x10 [ 377.645534][T10121] ? tomoyo_encode2+0xfb/0x3c0 [ 377.645553][T10121] tomoyo_encode2+0xfb/0x3c0 [ 377.645572][T10121] tomoyo_encode+0x29/0x50 [ 377.645590][T10121] tomoyo_realpath_from_path+0x18c/0x690 [ 377.645610][T10121] tomoyo_path_number_perm+0x23c/0x580 [ 377.645638][T10121] ? tomoyo_path_number_perm+0x22e/0x580 [ 377.645664][T10121] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 377.645691][T10121] ? preempt_count_add+0x76/0x150 [ 377.645716][T10121] ? rcu_is_watching+0x12/0xc0 [ 377.645741][T10121] ? __fget_files+0x215/0x3d0 [ 377.645755][T10121] ? hook_file_ioctl_common+0x140/0x440 [ 377.645777][T10121] ? lock_release+0x24d/0x310 [ 377.645797][T10121] ? __fget_files+0x21f/0x3d0 [ 377.645813][T10121] security_file_ioctl+0xd3/0x230 [ 377.645830][T10121] __x64_sys_ioctl+0xb7/0x210 [ 377.645853][T10121] do_syscall_64+0x115/0x870 [ 377.645876][T10121] ? clear_bhb_loop+0x40/0x90 [ 377.645895][T10121] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 377.645912][T10121] RIP: 0033:0x7fc0f039ce59 [ 377.645925][T10121] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 377.645940][T10121] RSP: 002b:00007fc0f1244028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 377.645958][T10121] RAX: ffffffffffffffda RBX: 00007fc0f0615fa0 RCX: 00007fc0f039ce59 [ 377.645969][T10121] RDX: 0000200000000040 RSI: 00000000c028aa05 RDI: 0000000000000005 [ 377.645980][T10121] RBP: 00007fc0f1244090 R08: 0000000000000000 R09: 0000000000000000 [ 377.645990][T10121] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 377.645999][T10121] R13: 00007fc0f0616038 R14: 00007fc0f0615fa0 R15: 00007ffcb46271f8 [ 377.646014][T10121] [ 377.646062][T10121] ERROR: Out of memory at tomoyo_realpath_from_path. [ 378.296731][T10129] bond1: Unable to set up delay as MII monitoring is disabled [ 378.305392][T10129] bond1 (unregistering): Released all slaves [ 378.350254][T10133] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1143'. [ 378.370194][T10133] dummy0: left promiscuous mode [ 378.428534][T10133] netlink: 'syz.2.1143': attribute type 10 has an invalid length. [ 378.452803][T10129] dummy0: left promiscuous mode [ 378.459791][T10133] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1143'. [ 378.472038][T10133] dummy0: entered promiscuous mode [ 378.846801][T10152] SQUASHFS error: Failed to read block 0x0: -5 [ 378.876372][T10152] unable to read squashfs_super_block [ 378.930452][T10152] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1149'. [ 379.313944][ T9] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 379.456166][ T9] usb 5-1: device descriptor read/64, error -71 [ 379.541358][ T29] audit: type=1400 audit(1782223363.408:511): avc: denied { write } for pid=10164 comm="syz.1.1154" name="file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 379.565426][T10165] 0x0000000000d5-0x000800008590 : "" [ 379.579233][T10165] mtd: partition "" extends beyond the end of device "mtdram test device" -- size truncated to 0x1ff2b [ 379.595770][T10165] ftl_cs: FTL header corrupt! [ 379.605444][ T29] audit: type=1400 audit(1782223363.408:512): avc: denied { open } for pid=10164 comm="syz.1.1154" path="/234/file0/file0" dev="fuse" ino=64 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 379.630414][ T29] audit: type=1400 audit(1782223363.438:513): avc: denied { ioctl } for pid=10164 comm="syz.1.1154" path="/234/file0/file0" dev="fuse" ino=64 ioctlcmd=0x1269 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 379.708730][T10176] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1158'. [ 379.723791][ T9] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 379.797951][T10176] dummy0: left promiscuous mode [ 379.817911][T10176] binder: 10174:10176 ioctl 4018620d 0 returned -22 [ 379.827938][T10176] netlink: 'syz.0.1158': attribute type 10 has an invalid length. [ 379.863217][ T9] usb 5-1: device descriptor read/64, error -71 [ 379.893969][T10176] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1158'. [ 380.070799][ T9] usb usb5-port1: attempt power cycle [ 380.076896][T10176] dummy0: entered promiscuous mode [ 380.134823][ T7803] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 380.797955][ T8042] block nbd3: Possible stuck request ffff888027ff7000: control (read@0,1024B). Runtime 150 seconds [ 380.808714][ T8042] block nbd3: Possible stuck request ffff888027ff71c0: control (read@1024,1024B). Runtime 150 seconds [ 380.819751][ T8042] block nbd3: Possible stuck request ffff888027ff7380: control (read@2048,1024B). Runtime 150 seconds [ 380.820433][ T7803] usb 2-1: config 0 has an invalid interface number: 64 but max is 0 [ 380.830811][ T8042] block nbd3: Possible stuck request ffff888027ff7540: control (read@3072,1024B). Runtime 150 seconds [ 380.849888][ T9] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 380.857868][ T7803] usb 2-1: config 0 has no interface number 0 [ 380.864294][ T7803] usb 2-1: config 0 interface 64 altsetting 2 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 380.875362][ T7803] usb 2-1: config 0 interface 64 altsetting 2 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 380.887329][ T7803] usb 2-1: config 0 interface 64 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 380.897436][ T9] usb 5-1: device descriptor read/8, error -71 [ 380.903749][ T7803] usb 2-1: config 0 interface 64 has no altsetting 0 [ 380.912002][ T7803] usb 2-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=35.bc [ 380.921671][ T5695] usb 3-1: new full-speed USB device number 44 using dummy_hcd [ 380.929388][ T7803] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.937542][ T7803] usb 2-1: Product: syz [ 380.958028][ T7803] usb 2-1: Manufacturer: syz [ 380.962695][ T7803] usb 2-1: SerialNumber: syz [ 380.984529][ T7803] usb 2-1: config 0 descriptor?? [ 381.033370][T10200] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1166'. [ 381.115338][ T5695] usb 3-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 381.128490][ T5695] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 381.151088][ T5695] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 381.160710][ T9] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 381.168523][ T5695] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.176723][ T5695] usb 3-1: Product: syz [ 381.180915][ T5695] usb 3-1: Manufacturer: syz [ 381.185879][ T5695] usb 3-1: SerialNumber: syz [ 381.192220][ T5695] usb 3-1: config 0 descriptor?? [ 381.198257][ T9] usb 5-1: device descriptor read/8, error -71 [ 381.640440][ T9] usb usb5-port1: unable to enumerate USB device [ 381.698762][ T5695] streamzap 3-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 381.707869][ T7803] ttusbir 2-1:0.64: cannot find expected altsetting [ 381.721662][ T7803] usb 2-1: USB disconnect, device number 33 [ 381.798365][T10209] tipc: Enabling of bearer rejected, failed to enable media [ 382.207403][T10214] bond1: Unable to set up delay as MII monitoring is disabled [ 382.216018][T10214] bond1 (unregistering): Released all slaves [ 382.315189][T10214] dummy0: left promiscuous mode [ 382.755174][T10232] FAULT_INJECTION: forcing a failure. [ 382.755174][T10232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 382.768575][T10232] CPU: 0 UID: 0 PID: 10232 Comm: syz.4.1175 Tainted: G L syzkaller #0 PREEMPT(full) [ 382.768593][T10232] Tainted: [L]=SOFTLOCKUP [ 382.768597][T10232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 382.768603][T10232] Call Trace: [ 382.768606][T10232] [ 382.768610][T10232] dump_stack_lvl+0x100/0x190 [ 382.768627][T10232] should_fail_ex.cold+0x5/0xa [ 382.768642][T10232] _copy_to_user+0x32/0xd0 [ 382.768658][T10232] simple_read_from_buffer+0xcb/0x170 [ 382.768676][T10232] proc_fail_nth_read+0x1af/0x230 [ 382.768690][T10232] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 382.768704][T10232] ? security_file_permission+0x76/0x210 [ 382.768717][T10232] ? rw_verify_area+0xce/0x6d0 [ 382.768730][T10232] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 382.768744][T10232] vfs_read+0x1e4/0xb40 [ 382.768758][T10232] ? __pfx_vfs_read+0x10/0x10 [ 382.768772][T10232] ? rcu_is_watching+0x12/0xc0 [ 382.768790][T10232] ? __fget_files+0x21f/0x3d0 [ 382.768801][T10232] ksys_read+0x12a/0x250 [ 382.768815][T10232] ? __pfx_ksys_read+0x10/0x10 [ 382.768830][T10232] ? rcu_is_watching+0x12/0xc0 [ 382.768846][T10232] do_syscall_64+0x115/0x870 [ 382.768862][T10232] ? clear_bhb_loop+0x40/0x90 [ 382.768873][T10232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 382.768884][T10232] RIP: 0033:0x7fdaaf35d68e [ 382.768893][T10232] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 382.768903][T10232] RSP: 002b:00007fdab02aafe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 382.768914][T10232] RAX: ffffffffffffffda RBX: 00007fdab02ab6c0 RCX: 00007fdaaf35d68e [ 382.768921][T10232] RDX: 000000000000000f RSI: 00007fdab02ab0a0 RDI: 0000000000000005 [ 382.768927][T10232] RBP: 00007fdab02ab090 R08: 0000000000000000 R09: 0000000000000000 [ 382.768934][T10232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 382.768940][T10232] R13: 00007fdaaf616128 R14: 00007fdaaf616090 R15: 00007ffda26cf018 [ 382.768949][T10232] [ 383.167658][T10247] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1181'. [ 383.251786][ T5791] usb 3-1: USB disconnect, device number 44 [ 383.490557][T10251] tipc: Enabling of bearer rejected, failed to enable media [ 383.492919][T10255] FAULT_INJECTION: forcing a failure. [ 383.492919][T10255] name failslab, interval 1, probability 0, space 0, times 0 [ 383.511706][T10250] dummy0: left promiscuous mode [ 383.517972][T10255] CPU: 0 UID: 0 PID: 10255 Comm: syz.2.1183 Tainted: G L syzkaller #0 PREEMPT(full) [ 383.517998][T10255] Tainted: [L]=SOFTLOCKUP [ 383.518003][T10255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 383.518011][T10255] Call Trace: [ 383.518015][T10255] [ 383.518020][T10255] dump_stack_lvl+0x100/0x190 [ 383.518042][T10255] should_fail_ex.cold+0x5/0xa [ 383.518062][T10255] ? __kmalloc_noprof+0xd6/0x820 [ 383.518080][T10255] should_failslab+0xc2/0x120 [ 383.518099][T10255] __kmalloc_noprof+0xfc/0x820 [ 383.518117][T10255] ? __import_iovec+0x1d2/0x640 [ 383.518139][T10255] ? sock_kmalloc+0x111/0x170 [ 383.518163][T10255] sock_kmalloc+0x111/0x170 [ 383.518189][T10255] ____sys_sendmsg+0x569/0xbe0 [ 383.518213][T10255] ? __pfx_____sys_sendmsg+0x10/0x10 [ 383.518238][T10255] ? kstrtouint_from_user+0x13c/0x1d0 [ 383.518259][T10255] ___sys_sendmsg+0x190/0x1e0 [ 383.518283][T10255] ? __pfx____sys_sendmsg+0x10/0x10 [ 383.518305][T10255] ? get_pid_task+0x106/0x250 [ 383.518331][T10255] ? rcu_is_watching+0x12/0xc0 [ 383.518360][T10255] __sys_sendmsg+0x160/0x210 [ 383.518377][T10255] ? __pfx___sys_sendmsg+0x10/0x10 [ 383.518397][T10255] ? rcu_is_watching+0x12/0xc0 [ 383.518426][T10255] do_syscall_64+0x115/0x870 [ 383.518448][T10255] ? clear_bhb_loop+0x40/0x90 [ 383.518466][T10255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.518482][T10255] RIP: 0033:0x7f403299ce59 [ 383.518496][T10255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 383.518512][T10255] RSP: 002b:00007f40338a0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 383.518530][T10255] RAX: ffffffffffffffda RBX: 00007f4032c15fa0 RCX: 00007f403299ce59 [ 383.518542][T10255] RDX: 0000000000040880 RSI: 0000200000000140 RDI: 0000000000000005 [ 383.518552][T10255] RBP: 00007f40338a0090 R08: 0000000000000000 R09: 0000000000000000 [ 383.518562][T10255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 383.518572][T10255] R13: 00007f4032c16038 R14: 00007f4032c15fa0 R15: 00007ffec8cac128 [ 383.518587][T10255] [ 383.735463][T10247] binder: 10246:10247 ioctl 4018620d 0 returned -22 [ 383.743618][T10247] netlink: 'syz.5.1181': attribute type 10 has an invalid length. [ 383.751540][T10247] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1181'. [ 383.760829][T10247] dummy0: entered promiscuous mode [ 383.967891][T10263] overlayfs: fs on './cgroup' does not support file handles, falling back to index=off,nfs_export=off. [ 384.427620][T10278] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1192'. [ 384.522240][ T7803] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 384.668432][T10286] tipc: Enabling of bearer rejected, failed to enable media [ 384.741225][ T7803] usb 5-1: config 0 has an invalid interface number: 199 but max is 1 [ 384.770907][ T7803] usb 5-1: config 0 has no interface number 1 [ 384.805050][ T7803] usb 5-1: config 0 interface 199 altsetting 2 endpoint 0xA has invalid wMaxPacketSize 0 [ 384.823886][ T5791] usb 2-1: new low-speed USB device number 34 using dummy_hcd [ 384.872972][ T7803] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 384.955270][ T7803] usb 5-1: config 0 interface 199 has no altsetting 0 [ 384.979753][ T7803] usb 5-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 385.223479][ T5791] usb 2-1: unable to get BOS descriptor or descriptor too short [ 385.223544][ T7803] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 385.348059][ T5791] usb 2-1: config 255 has an invalid interface number: 100 but max is 0 [ 385.352163][ T7803] usb 5-1: SerialNumber: syz [ 385.375111][ T5791] usb 2-1: config 255 has no interface number 0 [ 385.381393][ T5791] usb 2-1: config 255 interface 100 has no altsetting 0 [ 385.396000][ T5791] usb 2-1: string descriptor 0 read error: -22 [ 385.402365][ T5791] usb 2-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=7b.81 [ 385.402633][ T7803] usb 5-1: config 0 descriptor?? [ 385.412341][ T5791] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 385.457012][ T7803] uvcvideo 5-1:0.199: Found UVC 0.00 device (0002:0000) [ 385.465709][ T7803] uvcvideo 5-1:0.199: No valid video chain found. [ 385.761973][T10284] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.769114][T10284] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.781836][T10265] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 385.794033][T10265] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 385.859182][T10284] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 385.871627][T10284] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 385.922420][T10299] tipc: Enabling of bearer rejected, failed to enable media [ 385.934458][ T6778] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 2816 - 0 [ 385.934944][ T5790] usb 2-1: USB disconnect, device number 34 [ 385.960605][ T7803] usb 5-1: USB disconnect, device number 47 [ 385.969809][ T6778] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.999838][ T6778] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 2816 - 0 [ 386.020206][ T6778] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.033918][ T6778] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 2816 - 0 [ 386.043575][ T6778] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.052819][ T6778] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 2816 - 0 [ 386.071895][ T6778] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.860927][T10321] tipc: Enabling of bearer rejected, failed to enable media [ 387.171929][T10338] netlink: 'syz.4.1210': attribute type 15 has an invalid length. [ 387.195220][T10338] netlink: 666 bytes leftover after parsing attributes in process `syz.4.1210'. [ 388.583865][ T5791] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 388.626666][ T9] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 388.973911][ T5791] usb 1-1: Using ep0 maxpacket: 8 [ 389.030926][ T5791] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 389.039695][ T5791] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 389.049735][ T5791] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 389.060569][ T5791] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 389.071009][ T5791] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 389.071569][ T9] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 389.097912][ T5791] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 389.107391][ T5791] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 389.107584][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 12592, setting to 64 [ 389.197779][ T9] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 389.208679][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.216889][ T9] usb 2-1: Product: syz [ 389.221372][ T9] usb 2-1: Manufacturer: syz [ 389.226321][ T9] usb 2-1: SerialNumber: syz [ 389.244830][ T9] usb 2-1: config 0 descriptor?? [ 389.266747][T10357] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 389.354602][ T9] rc_core: IR keymap rc-streamzap not found [ 389.364414][ T9] Registered IR keymap rc-empty [ 389.366055][ T5791] usb 1-1: usb_control_msg returned -32 [ 389.373993][ T9] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 389.386387][ T5791] usbtmc 1-1:16.0: can't read capabilities [ 389.410269][T10371] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1221'. [ 389.422601][ T9] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input47 [ 389.467588][T10371] dummy0: left promiscuous mode [ 389.521792][T10374] FAULT_INJECTION: forcing a failure. [ 389.521792][T10374] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 389.536445][T10371] binder: BINDER_SET_CONTEXT_MGR already set [ 389.542672][T10371] binder: 10370:10371 ioctl 4018620d 2000000002c0 returned -16 [ 389.550904][T10374] CPU: 0 UID: 0 PID: 10374 Comm: syz.4.1222 Tainted: G L syzkaller #0 PREEMPT(full) [ 389.550932][T10374] Tainted: [L]=SOFTLOCKUP [ 389.550937][T10374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 389.550947][T10374] Call Trace: [ 389.550952][T10374] [ 389.550958][T10374] dump_stack_lvl+0x100/0x190 [ 389.550987][T10374] should_fail_ex.cold+0x5/0xa [ 389.551007][T10374] _copy_from_user+0x2e/0xd0 [ 389.551032][T10374] do_sys_poll+0x345/0xe90 [ 389.551055][T10374] ? is_bpf_text_address+0x8a/0x1a0 [ 389.551076][T10374] ? lock_release+0x24d/0x310 [ 389.551095][T10374] ? bpf_ksym_find+0x128/0x1c0 [ 389.551118][T10374] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 389.551136][T10374] ? is_bpf_text_address+0x94/0x1a0 [ 389.551157][T10374] ? __pfx_do_sys_poll+0x10/0x10 [ 389.551180][T10374] ? arch_stack_walk+0xa6/0xf0 [ 389.551203][T10374] ? rcu_is_watching+0x12/0xc0 [ 389.551242][T10374] ? __mutex_unlock_slowpath+0x35d/0x930 [ 389.551266][T10374] ? set_user_sigmask+0x1e1/0x270 [ 389.551283][T10374] ? __pfx_set_user_sigmask+0x10/0x10 [ 389.551300][T10374] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 389.551324][T10374] __x64_sys_ppoll+0x2b5/0x350 [ 389.551340][T10374] ? __pfx___x64_sys_ppoll+0x10/0x10 [ 389.551355][T10374] ? ksys_write+0x1ac/0x250 [ 389.551387][T10374] ? __pfx_ksys_write+0x10/0x10 [ 389.551412][T10374] ? rcu_is_watching+0x12/0xc0 [ 389.551433][T10374] do_syscall_64+0x115/0x870 [ 389.551456][T10374] ? clear_bhb_loop+0x40/0x90 [ 389.551472][T10374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.551487][T10374] RIP: 0033:0x7fdaaf39ce59 [ 389.551499][T10374] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 389.551514][T10374] RSP: 002b:00007fdab02cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000010f [ 389.551529][T10374] RAX: ffffffffffffffda RBX: 00007fdaaf615fa0 RCX: 00007fdaaf39ce59 [ 389.551539][T10374] RDX: 0000000000000000 RSI: 20000000000000dc RDI: 00002000000000c0 [ 389.551548][T10374] RBP: 00007fdab02cc090 R08: 0000000000000000 R09: 0000000000000000 [ 389.551558][T10374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 389.551567][T10374] R13: 00007fdaaf616038 R14: 00007fdaaf615fa0 R15: 00007ffda26cf018 [ 389.551584][T10374] [ 389.781159][T10375] netlink: 'syz.5.1221': attribute type 10 has an invalid length. [ 389.789989][T10375] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1221'. [ 389.800407][T10375] dummy0: entered promiscuous mode [ 390.216753][ T5791] usb 1-1: USB disconnect, device number 37 [ 391.891811][ T9] usb 2-1: USB disconnect, device number 35 [ 392.657361][T10432] netlink: 7 bytes leftover after parsing attributes in process `syz.5.1239'. [ 392.979709][ T29] audit: type=1400 audit(1782223376.848:514): avc: denied { getopt } for pid=10431 comm="syz.5.1239" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 393.156595][T10445] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1243'. [ 393.204115][ T9] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 393.376295][ T5791] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 393.573888][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 393.575042][ T5791] usb 6-1: config 0 has an invalid interface number: 64 but max is 0 [ 393.588115][ T5791] usb 6-1: config 0 has no interface number 0 [ 393.588576][ T9] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 393.594482][ T5791] usb 6-1: config 0 interface 64 altsetting 2 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 393.615023][ T5791] usb 6-1: config 0 interface 64 altsetting 2 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 393.627616][ T5791] usb 6-1: config 0 interface 64 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 393.638514][ T5791] usb 6-1: config 0 interface 64 has no altsetting 0 [ 393.650474][ T5791] usb 6-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=35.bc [ 393.660762][ T5791] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.683891][ T5791] usb 6-1: Product: syz [ 393.688457][ T5791] usb 6-1: Manufacturer: syz [ 393.693084][ T5791] usb 6-1: SerialNumber: syz [ 393.706901][ T5791] usb 6-1: config 0 descriptor?? [ 393.751087][ T9] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 393.767034][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 393.820011][ T9] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 393.837161][ T9] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 393.855307][ T9] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 393.913909][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 393.997809][ T5791] ttusbir 6-1:0.64: cannot find expected altsetting [ 394.009905][ T5791] usb 6-1: USB disconnect, device number 16 [ 394.129564][ T9] usb 5-1: usb_control_msg returned -32 [ 394.135278][ T9] usbtmc 5-1:16.0: can't read capabilities [ 394.213781][ T7803] usb 2-1: new full-speed USB device number 36 using dummy_hcd [ 394.353868][ T7803] usb 2-1: device descriptor read/64, error -71 [ 394.605147][ T7803] usb 2-1: new full-speed USB device number 37 using dummy_hcd [ 394.743793][ T7803] usb 2-1: device descriptor read/64, error -71 [ 394.843789][ T9] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 394.856545][ T7803] usb usb2-port1: attempt power cycle [ 395.015101][ T9] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xE8, changing to 0x88 [ 395.026734][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 395.037739][ T9] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 395.049442][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 114, changing to 10 [ 395.060764][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 25966, setting to 1024 [ 395.073825][ T9] usb 6-1: New USB device found, idVendor=1781, idProduct=0938, bcdDevice=9b.49 [ 395.082950][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.091016][ T9] usb 6-1: Product: syz [ 395.095281][ T9] usb 6-1: Manufacturer: syz [ 395.099903][ T9] usb 6-1: SerialNumber: syz [ 395.106634][ T9] usb 6-1: config 0 descriptor?? [ 395.112385][T10467] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 395.121255][ T9] iguanair 6-1:0.0: probe with driver iguanair failed with error -12 [ 395.213967][ T7803] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 395.234197][ T7803] usb 2-1: device descriptor read/8, error -71 [ 395.327232][T10467] capability: warning: `syz.5.1251' uses deprecated v2 capabilities in a way that may be insecure [ 395.521747][ T5791] usb 6-1: USB disconnect, device number 17 [ 395.534889][ T7803] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 395.605069][ T7803] usb 2-1: device descriptor read/8, error -71 [ 395.734488][ T7803] usb usb2-port1: unable to enumerate USB device [ 395.954892][ T9] usb 5-1: USB disconnect, device number 48 [ 396.201632][ T7803] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 396.690896][T10501] tipc: Enabling of bearer rejected, failed to enable media [ 396.723771][ T7803] usb 1-1: Using ep0 maxpacket: 8 [ 396.732784][ T7803] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 396.743547][ T7803] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 396.753895][ T7803] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 396.772783][ T7803] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 396.964652][ T7803] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 396.987070][ T7803] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 397.015930][ T7803] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 397.433873][ T24] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 397.460990][ T7803] usb 1-1: usb_control_msg returned -32 [ 397.469752][ T7803] usbtmc 1-1:16.0: can't read capabilities [ 397.705057][ T24] usb 2-1: Using ep0 maxpacket: 16 [ 397.713969][ T24] usb 2-1: config 0 has an invalid interface number: 48 but max is 0 [ 397.722187][ T24] usb 2-1: config 0 has no interface number 0 [ 397.728340][ T24] usb 2-1: too many endpoints for config 0 interface 48 altsetting 48: 48, using maximum allowed: 30 [ 397.739286][ T24] usb 2-1: config 0 interface 48 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 397.752462][ T24] usb 2-1: config 0 interface 48 has no altsetting 0 [ 397.760623][ T24] usb 2-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 397.769762][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.778282][ T24] usb 2-1: Product: syz [ 397.782496][ T24] usb 2-1: Manufacturer: syz [ 397.787146][ T24] usb 2-1: SerialNumber: syz [ 397.793079][ T24] usb 2-1: config 0 descriptor?? [ 397.933986][ T7803] usb 3-1: new low-speed USB device number 45 using dummy_hcd [ 398.002680][ T9] usb 1-1: USB disconnect, device number 38 [ 398.095282][ T7803] usb 3-1: unable to get BOS descriptor or descriptor too short [ 398.104753][ T29] audit: type=1400 audit(1782223381.978:515): avc: denied { write } for pid=10507 comm="syz.1.1265" name="loop-control" dev="devtmpfs" ino=646 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 398.130283][ T7803] usb 3-1: config 255 has an invalid interface number: 100 but max is 0 [ 398.140632][ T7803] usb 3-1: config 255 has no interface number 0 [ 398.147256][ T7803] usb 3-1: config 255 interface 100 has no altsetting 0 [ 398.156967][ T7803] usb 3-1: string descriptor 0 read error: -22 [ 398.163292][ T7803] usb 3-1: New USB device found, idVendor=eb1a, idProduct=e357, bcdDevice=7b.81 [ 398.172785][ T7803] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.263102][ T24] ssu100 2-1:0.48: Quatech SSU-100 USB to Serial Driver converter detected [ 398.275501][ T24] ssu100 2-1:0.48: probe with driver ssu100 failed with error -71 [ 398.296073][ T24] usb 2-1: USB disconnect, device number 40 [ 398.401800][ T9] usb 3-1: USB disconnect, device number 45 [ 398.818924][T10528] netlink: 'syz.1.1272': attribute type 7 has an invalid length. [ 398.943833][ T24] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 399.063816][ T5791] usb 2-1: new low-speed USB device number 41 using dummy_hcd [ 399.094003][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 399.100265][ T24] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 399.109701][ T24] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 399.119607][ T24] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 399.129435][ T24] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 399.139495][ T24] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 399.152743][ T24] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 399.161833][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 399.203829][ T5791] usb 2-1: device descriptor read/64, error -71 [ 399.323791][ T5790] usb 5-1: new full-speed USB device number 49 using dummy_hcd [ 399.373383][ T24] usb 1-1: usb_control_msg returned -32 [ 399.379123][ T24] usbtmc 1-1:16.0: can't read capabilities [ 399.454157][ T5791] usb 2-1: new low-speed USB device number 42 using dummy_hcd [ 399.503161][ T5790] usb 5-1: config 0 has an invalid interface number: 64 but max is 0 [ 399.511449][ T5790] usb 5-1: config 0 has no interface number 0 [ 399.518173][ T5790] usb 5-1: config 0 interface 64 altsetting 2 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 399.521434][T10536] tipc: Enabling of bearer rejected, failed to enable media [ 399.537763][ T5790] usb 5-1: config 0 interface 64 altsetting 2 has an endpoint descriptor with address 0xFD, changing to 0x8D [ 399.549649][ T5790] usb 5-1: config 0 interface 64 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 399.561489][ T5790] usb 5-1: config 0 interface 64 has no altsetting 0 [ 399.574292][ T5790] usb 5-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=35.bc [ 399.583551][ T5790] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.591816][ T5790] usb 5-1: Product: syz [ 399.596112][ T5790] usb 5-1: Manufacturer: syz [ 399.600784][ T5790] usb 5-1: SerialNumber: syz [ 399.633005][ T5791] usb 2-1: device descriptor read/64, error -71 [ 399.652524][ T5790] usb 5-1: config 0 descriptor?? [ 399.755575][ T5791] usb usb2-port1: attempt power cycle [ 399.923293][ T5790] ttusbir 5-1:0.64: cannot find expected altsetting [ 399.945548][ T5790] usb 5-1: USB disconnect, device number 49 [ 400.333880][ T5791] usb 2-1: new low-speed USB device number 43 using dummy_hcd [ 400.364263][ T5791] usb 2-1: device descriptor read/8, error -71 [ 400.553824][ T9] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 400.603845][ T5791] usb 2-1: new low-speed USB device number 44 using dummy_hcd [ 400.624195][ T5791] usb 2-1: device descriptor read/8, error -71 [ 400.689333][T10546] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1278'. [ 400.705515][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 400.713273][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 400.721558][ T9] usb 3-1: config 0 has no interface number 0 [ 400.729967][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 400.736286][ T5791] usb usb2-port1: unable to enumerate USB device [ 400.741380][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 400.762245][ T29] audit: type=1400 audit(1782223384.628:516): avc: denied { getopt } for pid=10545 comm="syz.5.1278" laddr=224.0.0.1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 400.783460][ T9] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 400.795822][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.805109][ T29] audit: type=1400 audit(1782223384.628:517): avc: denied { read } for pid=10545 comm="syz.5.1278" path="socket:[28287]" dev="sockfs" ino=28287 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 400.810701][ T9] usb 3-1: config 0 descriptor?? [ 400.834759][T10546] 0x0000000000d5-0x000800008590 : "" [ 400.840275][T10546] mtd: partition "" extends beyond the end of device "mtdram test device" -- size truncated to 0x1ff2b [ 400.859551][T10546] ftl_cs: FTL header corrupt! [ 401.143837][ T5730] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 401.280112][T10544] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1277'. [ 401.289395][T10544] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1277'. [ 401.303967][ T5730] usb 5-1: Using ep0 maxpacket: 32 [ 401.310335][ T5730] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 401.318656][ T5730] usb 5-1: config 0 has no interface number 0 [ 401.325004][ T5730] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 401.336065][ T5730] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 401.345869][ T5730] usb 5-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 401.355037][ T5730] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.364154][ T5730] usb 5-1: config 0 descriptor?? [ 401.719961][ T5790] usb 1-1: USB disconnect, device number 39 [ 401.774206][ T5791] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 401.808268][ T9] usbhid 3-1:0.1: can't add hid device: -71 [ 401.815086][ T9] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 401.820294][T10555] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1281'. [ 401.825975][ T9] usb 3-1: USB disconnect, device number 46 [ 401.846736][T10555] netlink: 168 bytes leftover after parsing attributes in process `syz.4.1281'. [ 401.924907][ T5791] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 401.945969][ T5791] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 401.965034][ T5791] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 401.975329][ T5791] usb 6-1: config 0 descriptor?? [ 401.985935][ T5791] pwc: Askey VC010 type 2 USB webcam detected. [ 402.076030][ T5790] usb 1-1: new full-speed USB device number 40 using dummy_hcd [ 402.091694][T10573] tipc: Enabling of bearer rejected, failed to enable media [ 402.255757][ T5790] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 402.276626][ T5790] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 402.295503][ T5790] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 402.321012][ T5790] usb 1-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 402.332853][ T5790] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 402.341922][ T5790] usb 1-1: Product: syz [ 402.347438][ T5790] usb 1-1: Manufacturer: syz [ 402.352103][ T5790] usb 1-1: SerialNumber: syz [ 402.363934][ T5790] usb 1-1: config 0 descriptor?? [ 402.370875][ T5790] streamzap 1-1:0.0: streamzap_probe: endpoint Max Packet Size is 0!?! [ 402.404968][ T5730] usbhid 5-1:0.1: can't add hid device: -71 [ 402.425115][ T5730] usbhid 5-1:0.1: probe with driver usbhid failed with error -71 [ 402.463902][ T5730] usb 5-1: USB disconnect, device number 50 [ 402.474187][ T5791] pwc: recv_control_msg error -32 req 02 val 2b00 [ 402.573866][ T9] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 402.684415][ T5791] pwc: recv_control_msg error -71 req 02 val 2c00 [ 402.793859][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 402.976647][ T5791] pwc: recv_control_msg error -71 req 04 val 1000 [ 402.984022][ T5791] pwc: recv_control_msg error -71 req 04 val 1300 [ 402.991119][ T5791] pwc: recv_control_msg error -71 req 04 val 1400 [ 402.998479][ T5791] pwc: recv_control_msg error -71 req 02 val 2000 [ 403.005514][ T5791] pwc: recv_control_msg error -71 req 02 val 2100 [ 403.012578][ T5791] pwc: recv_control_msg error -71 req 04 val 1500 [ 403.019684][ T5791] pwc: recv_control_msg error -71 req 02 val 2500 [ 403.020390][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 403.035077][ T9] usb 3-1: config 0 has no interface number 0 [ 403.041228][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 403.052407][ T5791] pwc: recv_control_msg error -71 req 02 val 2400 [ 403.052666][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 403.069891][ T5791] pwc: recv_control_msg error -71 req 02 val 2600 [ 403.070136][ T9] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 403.086637][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.094734][ T5791] pwc: recv_control_msg error -71 req 02 val 2900 [ 403.102221][ T5791] pwc: recv_control_msg error -71 req 02 val 2800 [ 403.109969][ T5791] pwc: recv_control_msg error -71 req 04 val 1100 [ 403.111528][ T9] usb 3-1: config 0 descriptor?? [ 403.124864][ T5791] pwc: recv_control_msg error -71 req 04 val 1200 [ 403.136914][ T5791] pwc: Registered as video103. [ 403.147121][ T5791] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input51 [ 403.174721][ T5791] usb 6-1: USB disconnect, device number 18 [ 403.610251][T10577] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1288'. [ 403.619855][T10577] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1288'. [ 403.654058][ T5695] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 403.713832][ T5730] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 403.803784][ T5695] usb 5-1: Using ep0 maxpacket: 8 [ 403.811167][ T5695] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 403.820350][ T5695] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 403.831007][ T5695] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 403.841079][ T5695] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 403.851380][ T5695] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 403.864678][ T5695] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 403.873861][ T5695] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.884748][ T5730] usb 6-1: Using ep0 maxpacket: 8 [ 403.890996][ T5730] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 403.899407][ T5730] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 403.909505][ T5730] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 403.919344][ T5730] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 403.929365][ T5730] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 403.942802][ T5730] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 403.951925][ T5730] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 404.030197][T10601] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1295'. [ 404.050482][T10601] binder: BINDER_SET_CONTEXT_MGR already set [ 404.056500][T10601] binder: 10600:10601 ioctl 4018620d 2000000002c0 returned -16 [ 404.064693][T10601] netlink: 'syz.1.1295': attribute type 10 has an invalid length. [ 404.072494][T10601] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1295'. [ 404.081609][T10601] dummy0: entered promiscuous mode [ 404.090374][ T5695] usb 5-1: usb_control_msg returned -32 [ 404.096610][ T5695] usbtmc 5-1:16.0: can't read capabilities [ 404.141101][ T9] usbhid 3-1:0.1: can't add hid device: -71 [ 404.164824][ T9] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 404.178316][ T5730] usb 6-1: usb_control_msg returned -32 [ 404.190305][ T5730] usbtmc 6-1:16.0: can't read capabilities [ 404.198823][ T9] usb 3-1: USB disconnect, device number 47 [ 404.365807][T10614] audit: audit_lost=4 audit_rate_limit=0 audit_backlog_limit=64 [ 404.375248][T10614] audit: out of memory in audit_log_start [ 404.777988][ T5791] usb 1-1: USB disconnect, device number 40 [ 405.029836][ T5790] usb 5-1: USB disconnect, device number 51 [ 405.253811][ T24] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 405.403880][ T5791] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 405.412484][ T24] usb 2-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 405.421571][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.430396][ T24] usb 2-1: config 0 descriptor?? [ 405.436948][ T24] gspca_main: spca508-2.14.0 probing 8086:0110 [ 405.553877][ T5791] usb 1-1: Using ep0 maxpacket: 16 [ 405.561083][ T5791] usb 1-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 405.570781][ T5791] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.583037][ T5791] usb 1-1: config 0 descriptor?? [ 405.591455][ T5791] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 405.643482][ T24] gspca_spca508: reg_read err -71 [ 405.649497][ T24] gspca_spca508: reg_read err -71 [ 405.655524][ T24] gspca_spca508: reg_read err -71 [ 405.661117][ T24] gspca_spca508: reg_read err -71 [ 405.666572][ T24] gspca_spca508: reg_read err -71 [ 405.671818][ T24] gspca_spca508: reg write: error -71 [ 405.677325][ T24] spca508 2-1:0.0: probe with driver spca508 failed with error -71 [ 405.686702][ T24] usb 2-1: USB disconnect, device number 45 [ 406.502236][ T9] usb 6-1: USB disconnect, device number 19 [ 407.025734][ T5791] usb 1-1: USB disconnect, device number 41 [ 407.029846][T10654] bond1: Unable to set up delay as MII monitoring is disabled [ 407.175653][T10654] bond1 (unregistering): Released all slaves [ 407.391140][T10669] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1314'. [ 407.458485][T10669] dummy0: left promiscuous mode [ 407.476491][T10669] binder: BINDER_SET_CONTEXT_MGR already set [ 407.482511][T10669] binder: 10668:10669 ioctl 4018620d 2000000002c0 returned -16 [ 407.490812][T10669] netlink: 'syz.5.1314': attribute type 10 has an invalid length. [ 407.499207][T10669] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1314'. [ 407.509077][T10669] dummy0: entered promiscuous mode [ 407.543591][T10675] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1316'. [ 408.654348][ T9] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 408.692541][ T5730] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 408.790025][T10705] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1326'. [ 408.818916][T10707] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1328'. [ 408.831738][T10709] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1329'. [ 408.843899][ T29] audit: type=1400 audit(1782223392.698:518): avc: denied { name_connect } for pid=10706 comm="syz.2.1328" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 408.878579][T10709] dummy0: left promiscuous mode [ 408.887789][T10709] binder: BINDER_SET_CONTEXT_MGR already set [ 408.894094][T10709] binder: 10708:10709 ioctl 4018620d 2000000002c0 returned -16 [ 408.902135][T10709] netlink: 'syz.1.1329': attribute type 10 has an invalid length. [ 408.910056][ T5730] usb 1-1: Using ep0 maxpacket: 32 [ 408.915211][ T9] usb 6-1: Using ep0 maxpacket: 8 [ 408.920422][T10709] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1329'. [ 408.930528][T10709] dummy0: entered promiscuous mode [ 408.936326][ T9] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 408.944645][ T5730] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 408.953784][ T9] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 408.967883][ T5730] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 408.976351][ T9] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 408.997915][ T5730] usb 1-1: config 0 descriptor?? [ 409.003685][ T9] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 409.014605][ T9] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 409.030150][ T5730] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 409.036720][ T9] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 409.046161][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 409.270476][ T9] usb 6-1: usb_control_msg returned -32 [ 409.293393][ T29] audit: type=1326 audit(1782223393.158:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10716 comm="syz.1.1332" exe="/root/ci-upstream-kasan-gce-selinux-root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc0f039ce59 code=0x0 [ 409.909609][ T9] usbtmc 6-1:16.0: can't read capabilities [ 409.954404][T10689] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 409.999233][ T9] usb 6-1: USB disconnect, device number 20 [ 410.067301][T10689] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 410.154035][ T5730] gspca_vc032x: reg_w err -110 [ 410.159692][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.234621][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.300914][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.369412][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.428619][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.492084][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.578947][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.662841][T10728] netlink: 'syz.1.1336': attribute type 1 has an invalid length. [ 410.663183][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.709255][ T29] audit: type=1400 audit(1782223394.578:520): avc: denied { mounton } for pid=10727 comm="syz.1.1336" path="/proc/883/task" dev="proc" ino=29736 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 410.710600][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.841559][ T29] audit: type=1400 audit(1782223394.708:521): avc: denied { associate } for pid=10738 comm="syz.1.1336" name="core" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 410.963416][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.968886][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.974450][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.979744][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.985247][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.990709][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 410.996175][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 411.001552][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 411.006856][ T5730] gspca_vc032x: I2c Bus Busy Wait 00 [ 411.012236][ T5730] gspca_vc032x: Unknown sensor... [ 411.017329][ T5730] vc032x 1-1:0.0: probe with driver vc032x failed with error -22 [ 411.113839][ T86] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 411.936531][ T5730] usb 1-1: USB disconnect, device number 42 [ 411.937593][ T5834] block nbd3: Possible stuck request ffff888027ff7000: control (read@0,1024B). Runtime 180 seconds [ 411.953349][ T5834] block nbd3: Possible stuck request ffff888027ff71c0: control (read@1024,1024B). Runtime 180 seconds [ 411.964653][ T5834] block nbd3: Possible stuck request ffff888027ff7380: control (read@2048,1024B). Runtime 180 seconds [ 411.978904][ T5834] block nbd3: Possible stuck request ffff888027ff7540: control (read@3072,1024B). Runtime 180 seconds [ 412.083885][ T86] usb 2-1: Using ep0 maxpacket: 16 [ 412.097011][ T86] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 412.108277][ T86] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 412.120225][ T86] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 412.184089][ T86] usb 2-1: config 1 interface 1 has no altsetting 0 [ 412.185572][T10758] tipc: Enabling of bearer rejected, failed to enable media [ 412.192302][ T86] usb 2-1: New USB device found, idVendor=2b53, idProduct=0023, bcdDevice= 0.40 [ 412.208022][ T86] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.216497][ T86] usb 2-1: Product: syz [ 412.220711][ T86] usb 2-1: Manufacturer: syz [ 412.225461][ T86] usb 2-1: SerialNumber: syz [ 412.663971][ T5730] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 412.833864][ T5730] usb 1-1: Using ep0 maxpacket: 16 [ 412.840605][ T5730] usb 1-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 412.849804][ T5730] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 412.859106][ T5730] usb 1-1: config 0 descriptor?? [ 412.875166][ T5730] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 413.011289][T10767] FAULT_INJECTION: forcing a failure. [ 413.011289][T10767] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 413.024886][ T991] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 413.032931][T10767] CPU: 0 UID: 0 PID: 10767 Comm: syz.4.1347 Tainted: G L syzkaller #0 PREEMPT(full) [ 413.032964][T10767] Tainted: [L]=SOFTLOCKUP [ 413.032971][T10767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 413.032981][T10767] Call Trace: [ 413.032987][T10767] [ 413.032997][T10767] dump_stack_lvl+0x100/0x190 [ 413.033023][T10767] should_fail_ex.cold+0x5/0xa [ 413.033045][T10767] _copy_from_iter+0x1f4/0x1690 [ 413.033073][T10767] ? __asan_memset+0x23/0x50 [ 413.033089][T10767] ? __pfx__copy_from_iter+0x10/0x10 [ 413.033113][T10767] ? __pfx___alloc_skb+0x10/0x10 [ 413.033130][T10767] ? __pfx_selinux_socket_getpeersec_dgram+0x10/0x10 [ 413.033157][T10767] ? rcu_is_watching+0x12/0xc0 [ 413.033182][T10767] netlink_sendmsg+0x808/0xda0 [ 413.033209][T10767] ? __pfx_netlink_sendmsg+0x10/0x10 [ 413.033235][T10767] ? security_socket_sendmsg+0x51/0x230 [ 413.033259][T10767] ? __sanitizer_cov_trace_pc+0x3f/0x70 [ 413.033281][T10767] ____sys_sendmsg+0xa4d/0xbe0 [ 413.033304][T10767] ? __pfx_netlink_sendmsg+0x10/0x10 [ 413.033330][T10767] ? __pfx_____sys_sendmsg+0x10/0x10 [ 413.033357][T10767] ? kstrtouint_from_user+0x13c/0x1d0 [ 413.033378][T10767] ___sys_sendmsg+0x190/0x1e0 [ 413.033403][T10767] ? __pfx____sys_sendmsg+0x10/0x10 [ 413.033428][T10767] ? get_pid_task+0x106/0x250 [ 413.033456][T10767] ? rcu_is_watching+0x12/0xc0 [ 413.033487][T10767] __sys_sendmsg+0x160/0x210 [ 413.033506][T10767] ? __pfx___sys_sendmsg+0x10/0x10 [ 413.033529][T10767] ? rcu_is_watching+0x12/0xc0 [ 413.033554][T10767] do_syscall_64+0x115/0x870 [ 413.033580][T10767] ? clear_bhb_loop+0x40/0x90 [ 413.033599][T10767] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 413.033614][T10767] RIP: 0033:0x7fdaaf39ce59 [ 413.033628][T10767] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 413.033645][T10767] RSP: 002b:00007fdab02cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 413.033664][T10767] RAX: ffffffffffffffda RBX: 00007fdaaf615fa0 RCX: 00007fdaaf39ce59 [ 413.033676][T10767] RDX: 0000000020004804 RSI: 0000200000000000 RDI: 0000000000000004 [ 413.033687][T10767] RBP: 00007fdab02cc090 R08: 0000000000000000 R09: 0000000000000000 [ 413.033697][T10767] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 413.033708][T10767] R13: 00007fdaaf616038 R14: 00007fdaaf615fa0 R15: 00007ffda26cf018 [ 413.033723][T10767] [ 413.423886][ T991] usb 6-1: Using ep0 maxpacket: 8 [ 413.600218][ T991] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 413.614103][ T991] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 413.697831][ T991] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 413.812653][ T991] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 413.893899][ T991] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 413.920936][ T86] usb 2-1: selecting invalid altsetting 0 [ 413.958202][ T86] usb 2-1: USB disconnect, device number 46 [ 413.967682][T10774] xt_HMARK: spi-set and port-set can't be combined [ 413.978469][ T991] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 414.233615][ T991] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.242772][ T6564] udevd[6564]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 414.260719][ T5695] usb 1-1: USB disconnect, device number 43 [ 414.565963][ T991] usb 6-1: usb_control_msg returned -32 [ 414.620618][ T991] usbtmc 6-1:16.0: can't read capabilities [ 414.671649][ T30] INFO: task syz.3.643:8280 blocked for more than 143 seconds. [ 414.757422][ T991] usb 6-1: USB disconnect, device number 21 [ 414.765331][ T30] Tainted: G L syzkaller #0 [ 414.855628][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 414.883771][ T86] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 414.921767][ T30] task:syz.3.643 state:D stack:27688 pid:8280 tgid:8279 ppid:5624 task_flags:0x400140 flags:0x00080002 [ 414.999099][ T30] Call Trace: [ 415.020144][ T30] [ 415.039928][ T30] __schedule+0x125c/0x6730 [ 415.069367][ T30] ? do_raw_spin_lock+0x128/0x260 [ 415.083840][ T5730] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 415.102086][ T30] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 415.131676][ T30] ? __pfx___schedule+0x10/0x10 [ 415.142652][ T30] ? rcu_is_watching+0x12/0xc0 [ 415.150147][ T30] ? schedule+0x2bf/0x390 [ 415.157929][ T30] ? lock_release+0x24d/0x310 [ 415.162662][ T30] schedule+0xdd/0x390 [ 415.169677][ T30] schedule_preempt_disabled+0x13/0x30 [ 415.175285][ T30] __mutex_lock+0xccc/0x1bd0 [ 415.179890][ T30] ? bdev_open+0x41a/0xe40 [ 415.184665][ T30] ? rcu_is_watching+0x12/0xc0 [ 415.189445][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 415.194569][ T30] ? __rcu_read_unlock+0x27f/0x5e0 [ 415.199707][ T30] ? kobject_get_unless_zero+0x156/0x200 [ 415.214822][ T30] ? bdev_open+0x41a/0xe40 [ 415.219412][ T30] bdev_open+0x41a/0xe40 [ 415.223692][ T30] ? iput+0x3a/0x40 [ 415.227579][ T30] blkdev_open+0x34e/0x4f0 [ 415.231986][ T30] do_dentry_open+0x6ab/0x14d0 [ 415.236840][ T30] ? __pfx_blkdev_open+0x10/0x10 [ 415.241785][ T30] vfs_open+0x82/0x3f0 [ 415.245955][ T30] path_openat+0x2873/0x4280 [ 415.250651][ T30] ? __pfx_path_openat+0x10/0x10 [ 415.255625][ T30] do_file_open+0x20e/0x430 [ 415.260151][ T30] ? __pfx_do_file_open+0x10/0x10 [ 415.265256][ T5730] usb 2-1: Using ep0 maxpacket: 32 [ 415.270391][ T30] ? alloc_fd+0x471/0x7a0 [ 415.274868][ T30] ? do_getname+0x191/0x390 [ 415.279411][ T30] do_sys_openat2+0x10f/0x1e0 [ 415.284324][ T30] ? __pfx_do_sys_openat2+0x10/0x10 [ 415.285186][ T86] usb 5-1: config 1 has an invalid interface number: 7 but max is 0 [ 415.289588][ T30] ? irqentry_exit+0x24d/0xa00 [ 415.289628][ T30] __x64_sys_openat+0x12d/0x210 [ 415.289651][ T30] ? __pfx___x64_sys_openat+0x10/0x10 [ 415.289675][ T30] ? rcu_is_watching+0x12/0xc0 [ 415.289720][ T30] do_syscall_64+0x115/0x870 [ 415.289746][ T30] ? clear_bhb_loop+0x40/0x90 [ 415.298382][ T86] usb 5-1: config 1 has no interface number 0 [ 415.302824][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.307691][ T86] usb 5-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 415.312909][ T30] RIP: 0033:0x7f05f455d68e [ 415.317927][ T86] usb 5-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 415.322345][ T5730] usb 2-1: unable to get BOS descriptor or descriptor too short [ 415.327016][ T86] usb 5-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 415.333589][ T30] RSP: 002b:00007f05f27f5b28 EFLAGS: 00000246 [ 415.340787][ T86] usb 5-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 415.351150][ T30] ORIG_RAX: 0000000000000101 [ 415.355307][ T86] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.365089][ T5730] usb 2-1: config 14 has an invalid interface number: 57 but max is 1 [ 415.372769][ T86] usb 5-1: Product: syz [ 415.383569][ T5730] usb 2-1: config 14 has an invalid interface number: 228 but max is 1 [ 415.419548][ T86] usb 5-1: Manufacturer: syz [ 415.423774][ T30] RAX: ffffffffffffffda RBX: 00007f05f27f66c0 RCX: 00007f05f455d68e [ 415.432155][ T86] usb 5-1: SerialNumber: syz [ 415.436552][ T30] RDX: 0000000000002000 RSI: 00007f05f27f5c00 RDI: ffffffffffffff9c [ 415.457467][ T5730] usb 2-1: config 14 has no interface number 0 [ 415.458658][T10774] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 415.471131][ T5730] usb 2-1: config 14 has no interface number 1 [ 415.477414][ T5730] usb 2-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 415.488230][ T30] RBP: 00007f05f27f5c00 R08: 0000000000000000 R09: 0000000000000000 [ 415.496254][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 415.504301][ T5730] usb 2-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 415.516071][ T30] R13: 00007f05f4816038 R14: 00007f05f4815fa0 R15: 00007fff40932cb8 [ 415.524170][ T5730] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 415.535584][ T30] [ 415.538702][ T30] INFO: task syz.3.643:8283 blocked for more than 144 seconds. [ 415.547555][ T5730] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 415.558960][ T30] Tainted: G L syzkaller #0 [ 415.565490][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 415.574197][ T5730] usb 2-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 415.585510][ T30] task:syz.3.643 state:D stack:27912 pid:8283 tgid:8279 ppid:5624 task_flags:0x400040 flags:0x00080002 [ 415.597497][ T5730] usb 2-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 415.610646][ T30] Call Trace: [ 415.613946][ T30] [ 415.616872][ T30] __schedule+0x125c/0x6730 [ 415.621383][ T30] ? __pfx___schedule+0x10/0x10 [ 415.626270][ T5730] usb 2-1: config 14 interface 57 has no altsetting 0 [ 415.633047][ T5730] usb 2-1: config 14 interface 228 has no altsetting 0 [ 415.640010][ T30] ? rcu_is_watching+0x12/0xc0 [ 415.644819][ T30] ? schedule+0x2bf/0x390 [ 415.649152][ T30] ? lock_release+0x24d/0x310 [ 415.653965][ T30] schedule+0xdd/0x390 [ 415.658207][ T30] schedule_preempt_disabled+0x13/0x30 [ 415.664006][ T30] __mutex_lock+0xccc/0x1bd0 [ 415.668759][ T30] ? bdev_open+0x41a/0xe40 [ 415.673330][ T30] ? rcu_is_watching+0x12/0xc0 [ 415.674718][ T86] usb 5-1: Error in usbnet_get_endpoints (-71) [ 415.678174][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 415.689424][ T5730] usb 2-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 415.693283][ T86] usb 5-1: USB disconnect, device number 52 [ 415.700146][ T5730] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.712563][ T30] ? __rcu_read_unlock+0x27f/0x5e0 [ 415.717854][ T30] ? kobject_get_unless_zero+0x156/0x200 [ 415.723523][ T5730] usb 2-1: Product: syz [ 415.727703][ T30] ? bdev_open+0x41a/0xe40 [ 415.732149][ T5730] usb 2-1: Manufacturer: syz [ 415.736767][ T30] bdev_open+0x41a/0xe40 [ 415.741035][ T5730] usb 2-1: SerialNumber: syz [ 415.745706][ T30] ? iput+0x3a/0x40 [ 415.749859][ T30] blkdev_open+0x34e/0x4f0 [ 415.754816][ T30] do_dentry_open+0x6ab/0x14d0 [ 415.759635][ T30] ? __pfx_blkdev_open+0x10/0x10 [ 415.764761][ T30] vfs_open+0x82/0x3f0 [ 415.768861][ T30] path_openat+0x2873/0x4280 [ 415.773445][ T30] ? trace_sched_exit_tp+0x120/0x160 [ 415.778766][ T30] ? __schedule+0x126e/0x6730 [ 415.783459][ T30] ? __pfx_path_openat+0x10/0x10 [ 415.788448][ T30] do_file_open+0x20e/0x430 [ 415.792979][ T30] ? __pfx_do_file_open+0x10/0x10 [ 415.798036][ T30] ? __pfx___schedule+0x10/0x10 [ 415.802907][ T30] ? irqentry_exit+0x24d/0xa00 [ 415.807710][ T30] ? alloc_fd+0x471/0x7a0 [ 415.812039][ T30] ? do_getname+0x191/0x390 [ 415.816580][ T30] do_sys_openat2+0x10f/0x1e0 [ 415.821273][ T30] ? __pfx_do_sys_openat2+0x10/0x10 [ 415.826495][ T30] __x64_sys_openat+0x12d/0x210 [ 415.831347][ T30] ? __pfx___x64_sys_openat+0x10/0x10 [ 415.836789][ T30] ? rcu_is_watching+0x12/0xc0 [ 415.841585][ T30] do_syscall_64+0x115/0x870 [ 415.846211][ T30] ? clear_bhb_loop+0x40/0x90 [ 415.850895][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.856907][ T30] RIP: 0033:0x7f05f455d68e [ 415.861341][ T30] RSP: 002b:00007f05f27d4b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 415.869768][ T30] RAX: ffffffffffffffda RBX: 00007f05f27d56c0 RCX: 00007f05f455d68e [ 415.877775][ T30] RDX: 0000000000000000 RSI: 00007f05f27d4c00 RDI: ffffffffffffff9c [ 415.885766][ T30] RBP: 00007f05f27d4c00 R08: 0000000000000000 R09: 0000000000000000 [ 415.893764][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 415.901747][ T30] R13: 00007f05f4816128 R14: 00007f05f4816090 R15: 00007fff40932cb8 [ 415.909763][ T30] [ 415.912810][ T30] INFO: lockdep is turned off. [ 415.920276][ T30] NMI backtrace for cpu 0 [ 415.920298][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 415.920323][ T30] Tainted: [L]=SOFTLOCKUP [ 415.920330][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 415.920340][ T30] Call Trace: [ 415.920347][ T30] [ 415.920354][ T30] dump_stack_lvl+0x100/0x190 [ 415.920380][ T30] nmi_cpu_backtrace.cold+0x12d/0x151 [ 415.920406][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 415.920430][ T30] nmi_trigger_cpumask_backtrace+0x21c/0x2a0 [ 415.920454][ T30] sys_info+0x141/0x190 [ 415.920472][ T30] watchdog+0xcb1/0x1030 [ 415.920494][ T30] ? trace_irq_enable.constprop.0+0x122/0x160 [ 415.920518][ T30] ? __pfx_watchdog+0x10/0x10 [ 415.920537][ T30] ? __kthread_parkme+0x18c/0x230 [ 415.920562][ T30] ? kthread+0x13a/0x450 [ 415.920576][ T30] ? __pfx_watchdog+0x10/0x10 [ 415.920594][ T30] kthread+0x370/0x450 [ 415.920609][ T30] ? __pfx_kthread+0x10/0x10 [ 415.920626][ T30] ret_from_fork+0x72b/0xd50 [ 415.920650][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 415.920673][ T30] ? __switch_to+0x800/0x10f0 [ 415.920691][ T30] ? __pfx_kthread+0x10/0x10 [ 415.920707][ T30] ret_from_fork_asm+0x1a/0x30 [ 415.920727][ T30] [ 415.920748][ T30] Sending NMI from CPU 0 to CPUs 1: [ 416.053317][ C1] NMI backtrace for cpu 1 [ 416.053336][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 416.053357][ C1] Tainted: [L]=SOFTLOCKUP [ 416.053363][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 416.053371][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 416.053398][ C1] Code: 16 86 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 23 b8 10 00 fb f4 fc 48 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 416.053414][ C1] RSP: 0018:ffffc90000197e00 EFLAGS: 00000246 [ 416.053429][ C1] RAX: 0000000003299b74 RBX: ffff88801e692540 RCX: ffffffff8b9ae2d5 [ 416.053440][ C1] RDX: 0000000000000001 RSI: ffffffff8c1e6000 RDI: ffffffff81de4aa7 [ 416.053451][ C1] RBP: ffffed1003cd24a8 R08: 0000000000000000 R09: ffffed10170a678d [ 416.053462][ C1] R10: ffff8880b8533c6b R11: ffffffff81d51f9c R12: 0000000000000000 [ 416.053473][ C1] R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000 [ 416.053484][ C1] FS: 0000000000000000(0000) GS:ffff8881243ef000(0000) knlGS:0000000000000000 [ 416.053500][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 416.053509][ C1] CR2: 00007fc0f03ea540 CR3: 000000005d523000 CR4: 00000000003526f0 [ 416.053519][ C1] Call Trace: [ 416.053523][ C1] [ 416.053529][ C1] default_idle+0x9/0x10 [ 416.053556][ C1] default_idle_call+0x6c/0xb0 [ 416.053572][ C1] do_idle+0x3a7/0x5b0 [ 416.053596][ C1] ? __pfx_do_idle+0x10/0x10 [ 416.053616][ C1] ? finish_task_switch.isra.0+0x14c/0x1010 [ 416.053639][ C1] cpu_startup_entry+0x4f/0x60 [ 416.053657][ C1] start_secondary+0x21d/0x2d0 [ 416.053678][ C1] ? __pfx_start_secondary+0x10/0x10 [ 416.053699][ C1] common_startup_64+0x13e/0x158 [ 416.053718][ C1] [ 416.252494][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 416.259379][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 416.270037][ T30] Tainted: [L]=SOFTLOCKUP [ 416.274338][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 416.284381][ T30] Call Trace: [ 416.287669][ T30] [ 416.290601][ T30] dump_stack_lvl+0x100/0x190 [ 416.295288][ T30] vpanic+0x552/0x970 [ 416.299254][ T30] ? __pfx_vpanic+0x10/0x10 [ 416.303737][ T30] ? rcu_is_watching+0x12/0xc0 [ 416.308499][ T30] ? nmi_trigger_cpumask_backtrace+0x1c7/0x2a0 [ 416.314640][ T30] panic+0xd1/0xe0 [ 416.318345][ T30] ? __pfx_panic+0x10/0x10 [ 416.322742][ T30] ? nmi_trigger_cpumask_backtrace+0x1fa/0x2a0 [ 416.328879][ T30] ? nmi_trigger_cpumask_backtrace+0x260/0x2a0 [ 416.335020][ T30] ? nmi_trigger_cpumask_backtrace+0x26a/0x2a0 [ 416.341157][ T30] ? watchdog.cold+0x1ec/0x234 [ 416.345905][ T30] ? watchdog+0xcc1/0x1030 [ 416.350304][ T30] watchdog.cold+0x1fd/0x234 [ 416.354886][ T30] ? trace_irq_enable.constprop.0+0x122/0x160 [ 416.360952][ T30] ? __pfx_watchdog+0x10/0x10 [ 416.365611][ T30] ? __kthread_parkme+0x18c/0x230 [ 416.370622][ T30] ? kthread+0x13a/0x450 [ 416.374842][ T30] ? __pfx_watchdog+0x10/0x10 [ 416.379500][ T30] kthread+0x370/0x450 [ 416.383548][ T30] ? __pfx_kthread+0x10/0x10 [ 416.388128][ T30] ret_from_fork+0x72b/0xd50 [ 416.392715][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 416.397811][ T30] ? __switch_to+0x800/0x10f0 [ 416.402467][ T30] ? __pfx_kthread+0x10/0x10 [ 416.407037][ T30] ret_from_fork_asm+0x1a/0x30 [ 416.411785][ T30] [ 416.414981][ T30] Kernel Offset: disabled [ 416.419279][ T30] Rebooting in 86400 seconds..