last executing test programs: 2m59.252536574s ago: executing program 0 (id=1420): syz_usb_connect(0x3, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080)={{{@in6=@mcast2, @in6=@remote, 0x4e20, 0xfd95, 0x4e24, 0x394, 0xa, 0xa0, 0xa0, 0x64}, {0x4, 0x53, 0xffff, 0x8000000000000000, 0x1, 0x800c5c4, 0x8, 0xfffbfffffffffffe}, {0x100000000003, 0x2, 0x9, 0x9}, 0x3, 0x0, 0x2, 0x0, 0x3, 0x3}, {{@in6=@private1, 0x4d2, 0x6c}, 0x2, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3504, 0x2, 0xf8a3eceea9e5829a, 0x2, 0x392daa26, 0xfffffffe}}, 0xe8) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001400000060"], 0xfdef) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r4 = epoll_create(0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x109980, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x23, 0x0, 0x0) ioctl$KVM_SET_XCRS(r7, 0x4188aea7, &(0x7f00000015c0)={0xb, 0x0, [{0x2, 0x0, 0x1}, {0x3, 0x0, 0xae}, {0x2}, {0x9, 0x0, 0x80}, {0x1, 0x0, 0x2c}, {0x4b2e, 0x0, 0x2}, {0xfffffffb, 0x0, 0xb0}, {0x80, 0x0, 0x6}, {0xa, 0x0, 0x3d}, {0x40, 0x0, 0x4}, {0x0, 0x0, 0x7}, {0x3, 0x0, 0x5}, {0x7, 0x0, 0x1}, {0xfffffff9, 0x0, 0xfffffffffffff801}, {0x4, 0x0, 0x3}, {0x40, 0x0, 0x10f4}]}) ioctl$KVM_SET_CPUID2(r7, 0x4008ae90, &(0x7f0000000080)={0x1, 0x0, [{0xd, 0xac, 0x0, 0x91ca, 0x1, 0x40000009, 0xfffffff7}]}) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)={0x80000000}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0x80000000, 0xf, 0x8, 0x80, 0x20000002, 0x318, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0xbc5b, 0x80000001, 0x25, 0x11, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x2, 0x8, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x7fffffff, 0x6, 0x6, 0x2, 0x9, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x6, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x9, 0x5, 0xfffffff7, 0x129432e6, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0xfffff001, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x7, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x0, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0x5, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0xf94, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x3, 0x5, 0x1, 0x486, 0x3, 0x303c, 0x3e7, 0x4, 0x5, 0x2002, 0x2, 0x3, 0x20000008, 0x2, 0x6d04, 0x6, 0x38, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x9, 0x5, 0x1c, 0x120000, 0x3, 0x7f, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x69d9, 0xb, 0x5, 0x4, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0xb54, 0x101, 0x10000, 0x4, 0x7fff, 0x14000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x7fffffff, 0x1, 0x98, 0xa1f, 0xf40, 0x2, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x7]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000009f00)=@bpf_tracing={0x1a, 0x1, &(0x7f0000009d00)=@raw=[@call], &(0x7f0000009d40)='syzkaller\x00', 0x0, 0xb5, &(0x7f0000009d80)=""/181, 0x41000, 0x30, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, &(0x7f0000009e40)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000009e80)={0x5, 0xa, 0x98a, 0x80000001}, 0x10, 0x6705, 0xffffffffffffffff, 0x1, 0x0, &(0x7f0000009ec0)=[{0x5, 0x5, 0xb, 0x1}], 0x10, 0xaa83}, 0x94) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'lo\x00'}) r10 = openat$incfs(r3, &(0x7f0000009fc0)='.log\x00', 0x34400, 0x0) read$FUSE(r2, &(0x7f000000a000)={0x2020, 0x0, 0x0, 0x0}, 0x2020) r12 = getgid() sendmmsg$unix(r2, &(0x7f000000c100)=[{{&(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000b40)=[{&(0x7f0000000280)="7d766e356a594aa6373b8800693fb61dd52ae44eec9afd2ef35af5caf0c20dcec9c3abdec5a145f8e91691b5bcc8513b8e824709672284fd547120107d5dda8af86ab9075325d1a3c0dddf62549f435fb47914ff0cf53b58cf4299d1ad00cb7c88fb98faa72a29f9cb7fbb87dbe25f1da2517aef3a1c573251e113af89131923627331363e328ba05c71233e0550f395b2d73cba8037bfb792d6c0ac62ebaf095a763938c6daf0bbf0d41a590fb0e5ab946de81c70cf88b92f1f80", 0xbb}, {&(0x7f0000000340)="295dc7fc5671960d9f5ee8c5f56ffe810d49ff2c9ca32647394ebcfd14872ef59e2250e54b458167a6eb933a41ba694a81beb4d5b8af96c069a5e65dc43ff7fdaaef2d757fe8ba87d21d4e6e1865090177afe350fb3212a9d66b00c13205f062b9f7b74394d22db1e1d4b9ef0f34fb6d19e894aec6fba416f176671173692803b72ff370159f062bf7c289ac85ce89e2cdeb322a27d5a567ce332d2c623f065cdad643a3246c0de2ef9084efa00e", 0xae}, {&(0x7f0000000880)="9d5fc51cd60d252a40975024c562897d23f86abd3a341474fb24e969c113aee3ba870556436fb7ce33c9e84f1793f235595dc86bc6bc543a84c7bc1ab832309851212287af1ce0c1c75361b27580e8eeac4768d36b6c93beeff9167d0b29c73be84a57acd1f13e653fc5e2b676c5fe42cb736182b234a50218cd82a6315defcebb1b5e4fb4b1e74862fba84794d9359cc6e7ae4ed32f3d8020c587393bffe5ef0242637d7e0ff5a23d295ca1e04104ace6882fb650ad29327e179c0026f634bd1d5b6f346a220253e7363f00f818a5742a9f0b83caa5e8625770bdaa6b5ee32f0ecbf3719f6deaadde63ed75ec45eb9d4b62a160", 0xf4}, {&(0x7f0000000980)="0d066fb62dcb7ebc79b00028f111070a10e2ea7ab990d01990bd610aa3e178521e13562906e08eb3c40ba54074255cb811c86d45fae61fed38dc25410ca969415a8f11a84ba3b7d752ead372c877bbf7ad09c7608dc7b8fdad204cba1d2eda46d98d470ee98d58e00691fdc2580d87c4c610d00dc6061e43eb9e5c7c8eea037cdfc2b1e821bcc6b994f5a3af1c02eaf45c94ef8d2e081d0cf928325497168ea2a2393615015645bee03134cfcabea3b7f7af4045ad21ea2943b7ff99d4138bae538a031fcc9f614f4dab1225d3dd98e677ef7c2c242f1c95560d02a7b5b6d1c9ede62277fa6a439964290057ba198b0f", 0xf0}, {&(0x7f0000000a80)="35fca16908d35c844bdb2b273f08fc4d7b527eedbd9a819b5dd4723b045c0dc8a2bb1d2e38b331f494fa1fc2e9dfc9d1f9aeb4fdea01256c270648f769c98525ca922ee446e3b87cbbdf7b50547b9a75f21484c8ecd96b064d16b110387487bb73e851ff92ad968df8dfd559ab8731f9676e9a8aac9b0ce668902a54058671dd6bd44b17d503fefcbbfc8c22fcbfeaf939cfdab501fe72a3b2c0fda1d1b0a9aa0000b5aefc12f1be0f75d8572478235109456039", 0xb4}], 0x5, &(0x7f0000000dc0)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x40000000}}, {{&(0x7f0000000e00)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000f80)=[{&(0x7f0000000e80)="d6da0e5bcb569c20d1399d553e8b07fc27870ecb931d840a7a14ea0811be2ca77e0bd0e5dd70c077d2a9aba6f013ffa300536598be224de179bdb884336a68a14bf9c352de297a913a022661931fa07f0215dc5cce02a90d084d725f59c7f852370a1c5239584e414293b84a1ab4f4730f0856cf1f66c56cd56c6ce5d70a8a8f3e1c2f22d68149da04ece1de1bc125ff814d8218077b8278ac472fe6499c12922ce1b2b15ee6d5542ab4b7f04dfb6560595def6c2fffce23376581", 0xbb}, {&(0x7f0000000f40)="d94ffc81b51026c11360b49a3b33801b43cf2ead9def7d924aec3e8ebcd52adaa4810762a9eaa690272ef3004e98f597", 0x30}], 0x2, 0x0, 0x0, 0x40000}}, {{&(0x7f0000000fc0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001180)=[{&(0x7f0000001040)="7b83395892f59c9e67b9321f4ea91cc2ebaa32b0d8982c5ef75550a41c528fb863cd9e8d53d325eb28231ab3f0a83f92c7a9100955a0130167d853cd915ec39c3d86a777dbf96ae571e6b1f1042eb76dcce97e8c776fe3502a301b968eebf9d11ce07a2a4a198e18400f269f3b410bb2281dbc8b2bc2e98ede6cc2e31f6c047b9a1a3a2ad2632e4031311a830fec0ecfeb696b82f6d45f507c5202e0c10432b1bfec6120588eaefe4bcf79f56ebe0b024ad6cb36bf56416c1077427c90595eca5de0c8e4f29031ab987781b927f68e24", 0xd0}, {&(0x7f0000001140)="1897fb707bdf", 0x6}], 0x2, &(0x7f0000003880)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [r2, r5, 0xffffffffffffffff, r3, r1, r6, r0]}}, @rights={{0x28, 0x1, 0x1, [r0, r6, r4, r4, r2, r7]}}, @cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff}}}, @rights={{0x28, 0x1, 0x1, [r5, r6, r0, r2, r5, r7]}}, @rights={{0x14, 0x1, 0x1, [r2]}}], 0xd8, 0x48000}}, {{0xfffffffffffffffe, 0x0, &(0x7f0000003dc0)=[{&(0x7f0000003980)="469c14e58862cc477a5ed93e7c84e591788185a3092cd23bfec52d84ec9adacbcea38842736fe4ae0b09b83d2e387d4875cfb410bdd6a597c8ad56eb76f0b2b8d009e6220278dfeb15713a9bdbb0c765e09ff34c19329c4d3c2a56e41066499383719b28a0e06bc66dfa74e5cf3ec023272074e6f3b2d3816c79", 0x7a}, {&(0x7f0000003a00)="2507e73967fe0e1db9af8f18807af2147869936d4bb5c029a48e068168e161266e523d5287917c6391d54fb26a29de947d81dc9b11b5b3847c5709ea91adf3bbe630cd537bdf4c232a4a6f0d53a234a913e340fe9a03f568b0509330f4d566c5184c5ae48d694595e906fa5f8e8fcf1044cfef98ccaff0e95dc684bdf565743cf7a090c29c453dddc8ac1ee1ac67ffd2af779c3eda69e31cfd84d24a31e8c59b414b62f6b14076dc3db16cc5ca86f6fc760d8e261a0226a3a775f3aa065c5a283f7851eec59843f80e4406eefa8e4fd66be875ca5b31d9fc8b2f9d6c", 0xdc}, {&(0x7f0000003b00)="01c0e80496d44ef7e09d30675194d267305bd43d7b352230af2684659aa7be5a55e9538f8f600e3c5226b201722e432e33f7c17727f0eea2e5d2ab7920647572f3b371a20ecdbb6acd8569bdb1a7f70cec1db8a2d7a9ee8a43497ecd56b8417cfed0e81792dded5a7acf35710fde5510e13abe4e5244c96cf91d740873a336e80083d565c4e26a7002d773ce", 0x8c}, {&(0x7f0000003bc0)="1d521a8e285a3af726812ba6502bc868f29bdccfa328e072b612e8e15161fa61f975487a56249cda0cab8e5078f971052fb0fcf2bda59f0935849d71a00e51b87dea032f73889caa0364bcd2b3b98cfae656dcf3d84d01f62a98dae6957f9a2873a19f3ccb4042e6d7377aef8397a12e6e46f0e52f12de41b93cc8d2aafc45fbd811e75160861b775823b3d82e2c7f19bf010b26a3e1037895a093d48f6e52e4ed93d232c95f4471cc13f8bd7aafc81aba1fe6af92810e12f01bc4bdc0eb5a", 0xbf}, {&(0x7f0000003c80)="bb1952420219d59d6ad3a6e7088b087335b03b1472d28e6bae10ecc7cb9e11babff40f", 0x23}, {&(0x7f0000003cc0)="e10d4e51a2ea8b273235e921f7b65053e725a9ad8d88ed964a606a1742b07aa3941590def4371847e58ba557e0b0ecb65ab8567a58ba55a7fd701cb96bb5de93f63369f2cce20eed1de0a516ced103e8fe36f6fe5dcb9ca6ae42933df057a89572e5d531a295e4b77d96365d1300f2e23fec6bb73242485c0b2b26cc8ba5fcf1e0885e5ea38ae40f656a422ffe67867fc39fe499d030fea1001ebe8c23097bc25db6c09b1ddbe40a961a5c494712c6925495d5209ef9b37515350f9a4cbee3291b3c15", 0xc3}], 0x6, &(0x7f0000004480)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [r5]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, r6, r0, r5, r7, 0xffffffffffffffff]}}], 0x80, 0x40}}, {{0x0, 0x0, &(0x7f0000004780)=[{&(0x7f0000004500)="09dc68733d014fe9ceb190a3c488068cf876b7faa4c2432be1dfe5dffb6cdd91241ca6b4b48c48c8c57b36b4e99e66eb0406464c9c6aa51a4f87e7997a2a13dfecc725411dc6d5d44630bdb9791122ab09f91a06f9c27af0b6b2c83f2165b224673caf1fadacd4af2e3eee7e3508898e3b4e831c3bd593813d521298028340cb16b58ab44741391922f8d14f5c8b4a2c79ae7d8ce2e1e3f4686d8592c97f34e50e246e707281cdbf18877fa735b764de0e79f22d718213974acf9ef1da9389c2bceae4b3e837f739809def103dd01c5da1f0080479dc2754996a5265efc35ff231", 0xe1}, {&(0x7f0000004600)="8421e32abef92c9efc95a6a0bef86e2aee3c43c923212e30e1cd8233356f4cd13c8f07a0b8945e9fa5ccfd82d08da2f1a399344701ef0bdc06254f42bb8bae7a78bbba1f0c8aa04e8fe07c3227502d71c09902e3496063b1f98b9bcf14035dbe487f1242a0e65b35cbe4397825083d448a636d8d8e43ed80c5bc566a21be068f8059d59b6ea240101782563c9406640dbe5229255e201d48f5bfcc41920017dda7dbc397144233fe", 0xa8}, {&(0x7f00000046c0)="eabfc0e4f8ac9d90269345bc5279b9df97c1337a93fe6d", 0x17}, {&(0x7f0000004700)="e4db3d3becaeef4c5e253621e624e5f5328cd1f48946f1fdd2baeb3b02191f173b1451f0c87a887706174cce584d144d21202b924e40c3229eb6d0e0745f8484b3f7c281513d67", 0x47}], 0x4, &(0x7f0000009940)=[@cred={{0x1c}}], 0x20, 0x20008000}}, {{&(0x7f0000009980)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000009b80)=[{&(0x7f0000009a00)="32b7422558419e3afe30b7e85a5d0ad4f86487c5bc23605bc938d7d17cff927061d12b9325376f6799ab20849f779143924a843400bbd9e98b3abbdb8327d910b5b51351cca417309f4e33f648fe3cb5267498cd2dab84a727734744078ea71d8cb7f18fbdea81763e2a4c79ade550530e", 0x71}, {&(0x7f0000009a80)="1046ce385b6f53fc705dc79d6488ad4102ae3c739ea5bf9dcf92da785778d23db9f4b65a142da1e7984bdfb40d7b5820bc94a8d75aceb8e7892ad0bb0c97a7937bbed290c6ef70b2acdbd0d192258c6f7aa2dc802a091d81457f1f7c87fd592d70f0b8e0dcb8beb6b5670d692dd261db27c551e40f5f4f696d97426a56dd0827e07e352d5880e8a1aa24b1cccb8b8d75d55187a1cbf89b833fc8489ec04a66862fd1cc64baf62bd83adcc04cd17eff3d2768d4e5876b014d67e5cbd683eaf4314f4c40be4cdddd857c893beab97245fd7bb465c5ccd6989058dfd3c3a42abf82387b81133583de649c03ed62ad6cf5b931", 0xf1}], 0x2, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000034000000000000000100000001000000", @ANYRES32=r3, @ANYRES32, @ANYRES32=r8, @ANYRES32=r4, @ANYRES32, @ANYRES32=r5, @ANYRES32=r4, @ANYRES32=r9, @ANYRES32=r7, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r10, @ANYRES32=r4, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32, @ANYRES32=r11, @ANYRES32=r12, @ANYBLOB="c8062c6c297aad5d08935e3b3ba77f75265713aaeeb54e1ab823e4b5373ec040f1a202ec93"], 0x90, 0x8c}}], 0x6, 0x24000000) unshare(0x20000400) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x7}, 0x20, 0x0, 0x0) r13 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r13, 0xff, 0x1, 0x0, 0x0) 2m54.58349404s ago: executing program 0 (id=1429): r0 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) getdents64(0xffffffffffffffff, 0x0, 0x0) 2m54.311838545s ago: executing program 0 (id=1433): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x4200, 0x11cfa, 0x0, 0x8000008, 0x7, 0x4, 0x1, 0x0, 0x7cce8c743ee810df}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x1c5842, 0x0) r4 = open_tree(0xffffffffffffff9c, 0x0, 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = dup(r3) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x60, 0x0, 0x0) ioctl$SNAPSHOT_GET_IMAGE_SIZE(r5, 0x8008330e, &(0x7f0000000bc0)) shutdown(r1, 0x0) unlinkat$binderfs_device(0xffffffffffffff9c, 0x0) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) write$binfmt_aout(r6, &(0x7f0000000640)=ANY=[@ANYBLOB="67d119e7ed77db81347ca37918d59c8079ceb2a5b90e6fafd55f71ffa39b4e2a2eaa0e42b1c46dcf73f83db65d95e3fb3ac43343e1b7a2834bc37bfc3b88dadf91b8c66545ce693065929f2257e42586bbdbd97a63d521327e347815853de818d479d7ff7d35ba733f2f5211d7364a924e283004a413eeec00cde93cb2fdd6b70a844f0d15efb446250a02e19046cbdb2c1906222c5104bad63ee8bbba488ab033f1652ecf0704b85810ca5d5923a17a3d9ebbbcb5cdd85538df7bdf8d00a1f0cdbb19c99e4b8440d025fe8f388f3924add267b02400", @ANYRES32=r6], 0xff2e) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xfe, "0062ba7d82000000160000000000f738096304"}) r7 = syz_open_pts(r6, 0x80) r8 = dup3(r7, r6, 0x80000) read$watch_queue(r8, &(0x7f0000001d40)=""/4095, 0xfdef) syz_emit_ethernet(0x4a, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "01011f", 0x14, 0x2c, 0xff, @local, @local, {[], {{0x3300, 0x2, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x8}}}}}}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x1c, &(0x7f00000013c0)=[@in6={0xa, 0x0, 0x0, @private2, 0x4}]}, &(0x7f0000001340)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000080)={r9, 0x101, 0xfffffffb}, 0x10) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0x42024, 0x28d89}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x4}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48001}, 0x0) unshare(0x20000400) r11 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/crypto\x00', 0x0, 0x0) r12 = epoll_create(0x3) epoll_ctl$EPOLL_CTL_ADD(r12, 0x1, r11, &(0x7f0000000040)={0x30000002}) syz_usb_connect$uac3(0x2, 0xaf, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0xff, 0xe41, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9d, 0x3, 0x1, 0xa, 0x100, 0x5, {0x8, 0xb, 0x0, 0x1, 0x1, 0x24, 0x30, 0x9}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x4, 0x19, 0x8}, [@mixer_unit={0x9, 0x24, 0x5, 0x5, 0x33, "75d594fa"}, @cluster_info_segment={0x6, 0x20, 0x6, 0x97, 0x8}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x0, 0x8, 0xe2, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0xf8, 0x7, 0x5, {0xa, 0x25, 0x25, 0x7, 0xb, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x9b, 0x4, 0x1, 0x2, "ab64a650"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xb6d, 0x3, 0x3, 0x9b}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x4, 0x4, 0x9, {0xa, 0x25, 0x25, 0x34, 0x1, 0x7}}}}}}}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x1, 0x6, 0x81, 0x40, 0x7f}, 0x5, &(0x7f0000000140)={0x5, 0xf, 0x5}, 0x8, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0xf8ff}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x415}}, {0x48, &(0x7f0000000740)=@string={0x48, 0x3, "e6f3f6f74ef2c2aebe4ecc5c9b9884b702fbee191f1364c75d6d57b12c3068f9722d2958567340ef932b4ee434912d93d829fdd60008ce471d742a85141b15159f9d67fd7d35"}}, {0xed, &(0x7f0000000300)=ANY=[@ANYBLOB="ed039ec068f6d1d515d802119f08b485d18db9fd2b459be0dc005c952b7427200fdd24eef3114a59392b3b72d55975f0e1b8d09c9dde43435d418982abd64ffa3152258fa8de36dc22053cb9e518b5effc63b79467bea4747efc60820d1bec117cf3d8e54e8fa5961fcaf775f0acfca69442a1e2e608fd61d14c74b77162da100e265996c3ab45d521211f20594adb9008fcffffff399f96a195c9fe0df7d1ff4bac9e2c3daab8df6f2e8f6f4255328cc139680df1887142363a9fb39d7f18a395b883da5aac0c99125eb91782b84db66704b872fa30365bb1f5d68c1291c33b38da9b19f8043e053c03000000"]}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x444}}, {0x6b, &(0x7f0000000500)=@string={0x6b, 0x3, "2a4e434d7c57b7c9f476d681ce82c14bff119fa242c0ff61e80ac7ad7691908ad3f8086824dd3fd5b29fc77aca8f14539b09382923a4130350f0e2d907424ab30c483c1ef026cb6739e26503530a1fe55112af1dcaabd7e216f3a35a1176eba85e142cec04cb132bc9"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x40a}}, {0xc6, &(0x7f00000005c0)=@string={0xc6, 0x3, "57f3966d07f42a95711fd8ff7a15777309ef8cd48b12b39dafab7897e58948f5c90230bc42789ba606a331f2bcae4ffee67c298cd3c56de75dbcd9d33aadabf229980510fcc641bd99a6244a01a94e295a65114f5c0eb0499ccfb91f2b7aba1252475b4beb4a3ca7c71bb132081ca1b061596e5d1b49ba66f4f5c418e20c4a9e539760bae27b8367415ac0184dd10ce93ccdca701b05419b4a2f9a3c8ff0186a85986a91b5a573540bc3206ced19b1e504969990b2c110a658930a112a1542d5f4f68143"}}]}) 2m51.168015949s ago: executing program 0 (id=1446): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0xffff, 0xffff}, {0x10, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x5, 0x1, {0x0, '\x00', 0x1, 0x7, 0x80000000, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_RETRIEVE(r6, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x1}}, 0x30) read$FUSE(r6, &(0x7f0000004200)={0x2020, 0x0, 0x0}, 0x2020) umount2(&(0x7f0000000000)='./file0\x00', 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r6, &(0x7f00000001c0)=ANY=[@ANYBLOB="220000000300004d21394b2e8cae240000f9ffff0000000000000002000000000100000000000000000001000e46e09bed"], 0x22) write$FUSE_INIT(r6, &(0x7f0000000040)={0x50, 0xfffffffffffffff5, r7, {0x7, 0x29, 0x0, 0x440, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x80}}, 0x50) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) bind$netlink(r2, &(0x7f00000000c0)={0x10, 0x0, 0x25dfdbfc, 0x40000}, 0xc) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) open_tree(r4, &(0x7f0000000640)='\x00', 0x89901) 2m49.819805148s ago: executing program 0 (id=1449): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x20400, 0x4c3524dedc3b6717) fcntl$notify(r0, 0x402, 0x30) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x79, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0xb, 0x10, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/custom0\x00', 0x802, 0x0) listen(r2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @random='\x00\b\x00', @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xfffe, 0x0, 0x8000}}}}}}, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000480)={'vcan0\x00', 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) bind$can_j1939(r3, &(0x7f0000000100)={0x1d, r4, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x1d, r4, 0x0, {0x0, 0x0, 0x4}, 0x1}, 0x18, &(0x7f00000001c0)={&(0x7f0000000140)}, 0x1, 0x0, 0x0, 0x200088c0}, 0x4000000) readv(r3, &(0x7f0000000080)=[{&(0x7f0000002200)=""/4096, 0x1000}], 0x1) syz_usb_control_io(r1, &(0x7f0000000400)={0x2c, &(0x7f0000000200)={0x20, 0x6, 0x29, {0x29, 0x2, "f1bd9db8a2dc0f0ad0c8874c6a5dbd12046bf37385fb55d92825f60179fed3893f79b6570572cf"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 2m49.515482325s ago: executing program 0 (id=1452): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x1, 0xb, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001000000850000006900000095"], &(0x7f0000000000)='syzkaller\x00', 0xb, 0x0, 0x0, 0x40f00}, 0x94) syz_open_dev$tty1(0xc, 0x4, 0x3) 2m49.031106798s ago: executing program 32 (id=1452): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000020000103feffffff0000000002000000000000000400010008000a000008000005001e"], 0x50}}, 0x4000850) r0 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x1, 0xb, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000001000000850000006900000095"], &(0x7f0000000000)='syzkaller\x00', 0xb, 0x0, 0x0, 0x40f00}, 0x94) syz_open_dev$tty1(0xc, 0x4, 0x3) 2m42.047150491s ago: executing program 3 (id=1472): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c051}, 0x8004) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000003e0400000b0000005d000000000000000704000012da0aff2500000017ffffffae040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6b8306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) 2m41.744194076s ago: executing program 3 (id=1474): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, 0x0, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000150001000000000000000000e00000020000000000000000000000002001000000000000000000000000000100000000000000000a00100000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000002000feffffff0000000000000000000000000000000000001e000000000000000000"], 0xb8}}, 0x20000004) 2m41.526998102s ago: executing program 3 (id=1475): r0 = socket$netlink(0x10, 0x3, 0x15) sendmsg$netlink(r0, &(0x7f0000002e00)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c0100001300010000000000000000001c01008085013ee98bf0a850b89d66cc57fa58ef4a05a90632128e77f035870bacbd517779f932ac75f1cda52be47ee9aa28ee08000000d25f00dd058c29e21040", @ANYRESHEX=r0, @ANYRES8=r0], 0x12c}], 0x1, 0x0, 0x0, 0x10}, 0x800) socket$netlink(0x10, 0x3, 0x15) (async) sendmsg$netlink(r0, &(0x7f0000002e00)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="2c0100001300010000000000000000001c01008085013ee98bf0a850b89d66cc57fa58ef4a05a90632128e77f035870bacbd517779f932ac75f1cda52be47ee9aa28ee08000000d25f00dd058c29e21040", @ANYRESHEX=r0, @ANYRES8=r0], 0x12c}], 0x1, 0x0, 0x0, 0x10}, 0x800) (async) 2m41.219937802s ago: executing program 3 (id=1477): getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x9d, 0x5, 0x4, 0x12, 0x5392, 0xfb9d, 0x80009, {0x0, @in6={{0xa, 0x4e21, 0xfffffff8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x6}}, 0x81, 0x8003, 0xc, 0x4b, 0x807}}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) r1 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}) ioctl$DRM_IOCTL_MODE_GETENCODER(0xffffffffffffffff, 0xc01464a6, &(0x7f0000000340)={0x0, 0x0, 0x0}) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) connect$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e23, 0x5, @dev={0xfe, 0x80, '\x00', 0x17}, 0x80000000}, 0x1c) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) open(&(0x7f0000000140)='./file1\x00', 0x60142, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x44000, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r5, 0xc01064c8, &(0x7f00000002c0)={0x1, 0x0, &(0x7f0000000280)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r5, 0xc02064b9, &(0x7f00000000c0)={&(0x7f0000000040), 0x0, 0x0, r9, 0xb0b0b0b0}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f00000003c0)={r2, r3, r9, 0x0, 0x0, 0x4, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006cdbf80789f3f947dd000280080003"], 0xe4}}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) 2m40.214975744s ago: executing program 3 (id=1479): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x20400, 0x4c3524dedc3b6717) fcntl$notify(r0, 0x402, 0x30) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x79, 0x6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0xb, 0x10, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/custom0\x00', 0x802, 0x0) listen(r2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x1, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @random='\x00\b\x00', @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xfffe, 0x0, 0x8000}}}}}}, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000480)={'vcan0\x00', 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) bind$can_j1939(r3, &(0x7f0000000100)={0x1d, r4, 0x0, {0x1, 0x1, 0x4}, 0x1}, 0x18) sendmsg$can_j1939(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x1d, r4, 0x0, {0x0, 0x0, 0x4}, 0x1}, 0x18, &(0x7f00000001c0)={&(0x7f0000000140)="5ab3715894", 0x5}, 0x1, 0x0, 0x0, 0x200088c0}, 0x4000000) readv(r3, &(0x7f0000000080)=[{&(0x7f0000002200)=""/4096, 0x1000}], 0x1) syz_usb_control_io(r1, &(0x7f0000000400)={0x2c, &(0x7f0000000200)={0x20, 0x6, 0x29, {0x29, 0x2, "f1bd9db8a2dc0f0ad0c8874c6a5dbd12046bf37385fb55d92825f60179fed3893f79b6570572cf"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 2m39.543953074s ago: executing program 3 (id=1480): r0 = socket(0x15, 0x80004, 0x4) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, 0x0, 0x40004) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x3, 0x1000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffffffc}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r8, 0x0, 0x20040084) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x24, 0x29, 0x29, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r11, {0xffff}, {0xffff, 0xffff}, {0x2, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 2m38.520645169s ago: executing program 33 (id=1480): r0 = socket(0x15, 0x80004, 0x4) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, 0x0, 0x40004) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x3, 0x1000000, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffffffc}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r8, 0x0, 0x20040084) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x24, 0x29, 0x29, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r11, {0xffff}, {0xffff, 0xffff}, {0x2, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 14.168303267s ago: executing program 4 (id=2050): socketpair$unix(0x1, 0x3, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x2}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f00000000c0)={@local, @empty, 0x0, 0x4, [@remote, @remote, @private=0xa010100, @rand_addr=0x64010100]}, 0x20) setsockopt$inet_tcp_int(r3, 0x6, 0x17, &(0x7f0000000000)=0x79, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000001000)={0x73622a85, 0x10b, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f0000000400)=[@acquire, @increfs], 0x0, 0x0, 0x0}) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r3, &(0x7f0000000580)="17", 0xfdef, 0x10008095, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'fpu(pcbc(aes-aesni))\x00'}, 0x58) syz_usb_connect$cdc_ncm(0x6, 0x76, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x7, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000300)={0x1, 0x0, 0x0, 'queue1\x00'}) socket$nl_route(0x10, 0x3, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) 9.763929393s ago: executing program 4 (id=2068): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902240001000000000904000001030000000921050000012205000905810300"], 0x0) r1 = syz_open_dev$sg(&(0x7f0000000140), 0x0, 0x121001) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffb, 0x6, 0x1, @buffer={0x300, 0x0, 0x0}, &(0x7f0000000100)="a8be01ffbb8c", 0x0, 0x0, 0x1c, 0x0, 0x0}) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000a40)={0x14, &(0x7f0000000980)={0x0, 0x6, 0x5c, {0x5c, 0x4, "615ef4ec2f2cd20d6028737a32afe826e1e9e8baf71092b47ee19ed1bad732fa2e30e64e43927c5958ee8dfa59315fcf8870ebe3dd28a41fd4f51960de2cd12dca6ff71db3cddd95a22c084d132a7b69c80096806687e8007879"}}, 0x0}, 0x0) 7.663972203s ago: executing program 4 (id=2073): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) (async) r1 = memfd_create(&(0x7f0000000440)='\x03U0f`\x0f\x16f\xc0\x9d\xae-\x99\x97\x03\x98\a\xfcakTt\x9f\xa5\v\x88\xa6\x8e@\x17%;g\x84$\xf3\x80i\n\xd2\xe2\xaf9W\xc8\x8f\xc4\x99\xd4\a\xb5\xf6\x82\xfd\xfd\xd53=\x05\xe5Z\xc7\x04\x00\x00\x00\x00\x00\x00\x00\x00.\x0e5\xf3\x88\xbf\x88\x8f\xed/\xc2\x84\xd4\x11\x93\xb899q\x0f_\xf0k\x14 68\"\xd9l\xf3\xc4u\xed\xceV\xd6Z]\x93\x93P\xbf\x05~\xde\x1f`\x95J\xfbY\x8b\xbe\xd90\xa2]\xb2\xe2\xec\x9f\xa4\xc6rF\xd8\x93?\xec\xa4\xd8\x9f\x8f\x90\xd8=\rP\xb8\x7f\xfa\xc3\xc4\xe9\xd0A@\x1d\x87\xf0\x83\x0e#p\xf4\x0e\xa0\x88g\xe0\xdba\xbcsw\xc0\xfev\xbd\xb0\xb6\x96\x8d\x11\xca\xee\xa8\xad\xaaV\xa7L\x9f\xe5J\x03\x87t\x99\x85:\xe4U\xa0c51()\x16\"(\x18G\b}\x1f\x85\x9bDP\xacQ\xbd\x1b\x00\xf4JtT{\x00^\xb1G \xe9\xbf\xd9 \x87x\xd5\x81\xdc\xf4\x8fYH\xadyk%`\xabkr\x00\xba\x9b\x98\x96*\x1c\xce$\xe1\xa2\x87I\xa6\"\xf5&,\x9fe\x1f+!n\xfb\xe7\xbf?\xc3\x80WO|\xfd\x91\xc4\xfd\x9a\t<\a\xb2Z\xd6LL\xca\xf1\xff^)f\x88\x0e\xf3\x03\x85\xe1\x10\xb6\x942\x11\xbe\x94\x1cJ\xd3i\xf8\tu\xa7\xce\x00\xc14m\xc9_\x80q\xc7?\xbaf\xadu\xe1\xd2\xd9\xf2&g\xb2\x00\xc48I\xcdy\x91\x93\xa4\xa79\x01\b\xbc\x8d\xb5\x9a\x1a\x0e\x15\r\x92\x00\x9a\xd6\xb7t\x80\xe0\xa7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa8\x80\x04\xe8O8v\xf9b\xc9\xe4d\xdd\xc8\xe2Z\tm\x02F\xf1\x9a\xb7\xa7\xab,\xcf\'\xdeb2\xac\x92\xad\xe4g\x8a5U8\xe3b\xa5\x01B/>0\xfe\xff\x1c\x0f^\xe9R\x97\x00\xd8\xb69\xb8\xbc\xaeeB\xbd\x02f7\xdas\xc22\xe8\x1dH\xdd\xe8Iwm\xee,\xbf\xe0\xbezq\x1b\a\x97\xbe\xa5\xdcy\f\x83\x05=\x92`\x03\xceX\xbb\x05\xfe\x80\xc7<%\xec\xac\xc3\x1c\xa2\x9d\x95q\xc0{6\x90Y\xe9\x17\x82q\x05X\x84\x83\x1c\xe7\xf1\x18\xc5\xe54\x1ah~$\xf7\xab\x93\x9b\xd1CUg\xf5\xdf\xa9\xe4\xd3\xe5\x00\x00\x00\x00\x00\x16\xde\xdc\x06\xeb\xa0\xf2\x95\x13M\"?\xf5/\x8f\a\r\x8fo)y\x0f\x9aR\'\xf0C\xee\xff\xfdn\x15b\xdcv\xd1J\xdc\xded\xd1\x1e', 0x2) r2 = memfd_secret(0x0) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000040)={0x4, 0xffffffffffffffff}) (async) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000780)={0x2, 0xf, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x3c, 0x0, 0x0, @in6={0xa, 0x4e20, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x9}}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) (async) ioctl$FICLONE(r1, 0x40049409, r3) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0xf, {[@local=@item_4={0x3, 0x2, 0x9, "30aa666d"}, @local=@item_012={0x2, 0x2, 0xd, "db3b"}, @main=@item_4={0x3, 0x0, 0x9, "ac84b51b"}, @global=@item_012={0x1, 0x1, 0x7, "84"}]}}, 0x0}, 0x0) (rerun: 32) r5 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) (async) setsockopt$TIPC_SRC_DROPPABLE(r2, 0x10f, 0x80, &(0x7f0000000100)=0x3, 0x4) ioctl$HIDIOCGFLAG(r5, 0x8004480e, 0x0) (async) syz_open_dev$hiddev(&(0x7f0000000080), 0x8, 0x40) 6.564195028s ago: executing program 1 (id=2076): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f0000000100)={0x79, 0x0, 0xf71}) (async) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) (async) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) (async) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) (async) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x4e, &(0x7f0000000200)=0x1, 0x4) (async) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0xa8aaaafffeaaaa1e}, 0x8000}, 0x1c) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000007, 0x38011, r7, 0x0) socket(0x10, 0x803, 0x0) (async) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000280)={0x3, r6, 0x1, 0xffff, 0xa, 0x1ff, 0x1}) (async) ioctl$I2C_PEC(r2, 0x708, 0x3) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) 5.776184045s ago: executing program 1 (id=2082): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) writev(r1, &(0x7f0000002680)=[{&(0x7f00000001c0)="c190f12eff8a0772e3b79bad3c4573d1cfe6cffdd651545a502f558a13dad6b9628e3784740cf359c6d19944e0cdb7d697186ddcaac1ba8ca889466447cd75302b3a43eb0c947ff2fad278e6", 0x4c}, {&(0x7f0000000240)="a5dea51f3487b10311ae86661f99e94f1cb8f87a7dc184d61fb082d2de395e6fa264e994128004a8a77d29b3ad9da50bc53aa92a744f785106a386e76261b7f38addfbe2c6abf33b77e7f39f0c29acf66379a06742e360faa8ba1f9a8110a908ee0eee5ec75fa1968b75cc3f845eeced9834e05c8eb9720a703d5fa51535a03bfa1fd5c83b18fe34c8e10a9332f668e6591f10585cbb3433ae878dadb320ef26f9b1ee5e97e12c5cef2abb632ca51894643414a145f09e8862ab6f91b6b329c56312cfcc7a3bfe0508cd16fb773256e08040a93eaab6c418329690f398958d233ee219cfe3f78e2469b22ecf1ab808caa88c994a3722e8de8f28504cc6b80187930b62679de1286a64e37fe8606731995b985e8ed4d62898e77ef9590bef8b815ee9c603af735dbf7d971e26990e8757ab496fae33334597659dd59b852304659ad75ba53dcac1c125612fa3cbc55762438172a903865178e96b9cc29546a748b28242d7da6b436c6a3375bf10e5d099753467692b10e9e982a7c7d81d9f0adb44dde8cd575c393a997318c608059d2d5c2580943e009604bd031d07d5196c6e54e9634ce0a8db620cdc9f5089246b7377d5a97187d0e882d90d5f37d201b70347b451a296973a940fd6f75a7c8899cce1b75abcfb7bb415d3e65aff936e652dd1260935fc134815ebd1799cc52086821c340567be976f15573c1a4046c8006f9c85d96067069395dacc3228ee45554e4824fd916628e99a4e1b7e2d24a5da036941675b65262b83e917d4836ce6c645e4ec204b78bb67b6864e30620666c65deec3b64c59f4eed13feee43ae352983491d41b47b1d14ab3bcf7d9162bc299fc40e9a1a730b48a632670d2bb5b7f96c401abfcc0985f41621ded0654f86e5472fd5fc97ae930b89167ab5b7475c3abd016ee085c1dd0ae40de205b7a27bff9280a57084740313c0eebb0a22931810fcfe7f451a63040a2841d2b762160322c5a81663471d1296674f7a54ce395bfee50382811e05c08a2aad26e7b0c8f1cc393ebb67f95d4faaf7cf7dd7a8df6fb55bf4ce17f66f03146f69d797e2dbcb54780340b929c49ebf45e3f13a046e55e5d65a3b1261e51068ff640495de8dc180bb86118f077cc642ef1686417f5607a855b44138011122a3e5d1a790a6c19fa0a0527fdbc044206e0d169b41d4b1b0e316fea880eed6e42d27df98f3aaaf2e4d92b40f33bb929d93caf963bdf397e5d5cf4949f78757d594d72e120c9deabe700f4adc7afac33f61ebff93c139f6280c600bb6d0efcad2fc71e2e3d47e097792945a871944526df92d3a10ec327407e213ca97d010bcd92aa257a87723870d8c9c2512acc2b1173ad0db793eb860631cba28ee9cf6082ba13e91bbe7d6a839f9a332e20f5693c95423b1eea3483122d491fb86c4bbd966bfe6d7f14e54fa66269a9a8b02e5f0ecc9353d23cc908522829bf56dd7c1a6c326ecd6b9f4a72489d62a41af553bcb58b9b9ecc38a3da7175e4ec70bbd4ecf3807a01d8c364aa64c6a857814e487d245a3f292f9416d08da07d263a2c657b9bb21c370e83f563131c7ecdf4c4e876f402d8ad492bb829f0473322503d85a1e112748aca156904de5961c636fcfadd9ba9dd3689b5a336c4712ce5e1cd1328689aada40d2a9f190629deb5c372b968f19b00070d12772a332faeba19c3b8451771924ecb7b24efe9d97b62264a2532c058f5d0954c43ceb8069cca6e4eea658b53d6cbfabee7e4f55ba4c9025863b9913b4c7b957633f32d2e70b022367c1339ebd6215c7a655c430b555477c0b38befd379e91e223e16d0b632519ef9565fa0b150b17e485e2a3a7f82ab258b4f4d44d3a66672b882df3237ee9acc2bd5b0c457366d0d474533f63509d0a2ef51a9e6a3fd71df53505aa6b985f43901b439ae6b50dca3aec1d385d421b131ccc8af678f105b4aaecadbc27181227e1be2397c83f818f6a7149442fb00943a40b551060f04dcefe20aca7e64b4a5d9b60d0d07d907f7b09422bd30cf7753e39ed1552e486b16592a75ba283799c93dd26028aac419fa9748bd6a0f0d5beeae547de11f5320298aabb4a34c46ce10019ebfa38b0dcad6f05f2aeeb5b9fb4a921efa1e5ba912cf070e5d4a64bb5b6037115511e858597ab8dd56ca6c57731822b67ba3f2ccbe772f1fa1a5db6548fed278cc811d99f8f371915baeef9979837b6a2568d34ebf08456ace645b06211194f5ecd10857bcc225f022057fcc6b1cbbc29411450793555842cb57604054c23ceeace814e5107d85c4a2f7bd0f632ea56760c30542be22196cb614fbae94778faee735e2d65d7bfa9421137825169b17d2d797c51722c4519a81850a27e770500e2ca8d28011dd9f538d6e9027bc36f3223432674603368bc764b05dadf5b18048196d084a7f799a4e8e89d7a6048d8d2648542a827163264f71adb2422fab2c33f65ef493deeb3ef4af93fcad0d040cfc7b5b4c6844538c9495ef60e29edd17a54662b9084e20faa627637443701fd2f07946ade960668d30078afa1a118cdcdbfc9314851a8af2540f8b7f57c76e49f7aa8cd9136a8e3fb45f13b58c64e7d166d0b0bba919b9c62c4ec3bfffcf2469f8ae7d0d54d2523858e35034ef7d8d5237d6cefd1c29efcfbe9e0e62b595cc83f07a9cbb8dce2fa0c4db73aeef610228fbc7017455f33d6b7796f1937e59b903defb2c08883cd0347d73534a67c0e3c7ec829ceffc852f0c96cd78ba14f88a60a1b7134cd0f1f030f0ae3428161cf537a75be29eb823a6e44d9aea847f5f277e49f881fc18a6ca28652950fa58c883a86f60c5d7229b680a3be4b4a8b2d769ece184fc6ef870cece49be2ef8b153e6bb1a098335535ff4e8af51c6bed736817be9fb74aa241fa84a6f61509b0d0caef13219240ac6e4f7ae4a9a17975609bfe15abd1ce634afa535a7f85cd24e67c90c099a369aa3ea5aee6aa215ccb0d6f605cb852b5ace7920c72477b27f1b5f0635be0a97d566ce8b2f8f2350a8a708a044cedac89abc93590f70647a73aab467444f719835b48140c0fc72cb0c2773dd6d4d639a4f335e38a739dbf2f7b58feeafefb00483c54b61c05783f220b5837ba55bfec8a48351de71d7ed2eb80fd634780d89ccf85c4d77b5d2e86b438c44c15d986b60245ddb3c139a61969819f7eed5657fda575994a15e4978a27611f4df55800725ddf9e6ed038cc1efdc8f232778188a577c7fd610215bb84f55b4e74608ef4d71ca3989ebbb4c5faf73b488b6ca955603bf2a9ebaf6d8f938f6a09a9ad43a8643a67c290a4720f74c5ac60235f2d7b8b1afc520ee99e43af40adf5374c58864e79fdff777ef835902f76b8dee9b4b2d3e34a9ee73c7ef88ebf5ef3a31f7ae04b88036cd5bbb37191e6bb934e57b4061ef4eb44686ad1efbe3d13b19fd5fefdc4baba042c1f420102858700f44433dfe1f4468ed2465f5fd9bf1c7d9f8e75e6cbe58561883baa4a8b7e29d43d6b27c29fbe4cd72209c0fe650e34edb5925f2a9455ac78bee3b9145965ba48e6cbc2499dfb6189b46b3aa8bf414f2d3facdd19287639329c81ed29cc30936f4bcccd81df7226328f383d1047b04d41a84c9302bd6276e700600cf8fe06571a91eee64d2eb2aede06e385636e42ed2db0600c316531c66f4c61f2029f491bf23430934ff5e6642e434452cd5a0ff3130ee1677d427aa2093ee37571232a55dc60e8ecf0b9a3affd3df26414918d92eed09d896c0d862545139e3283f23f8029d2b6410d30f7e642e7ca6564eb1747479163f395c4824fd597b2da57acd3138042606fa2577ef95fa312b9735dcd82f661410c86859eebd89b548dca87cb650ce0eb7f2f5422427e24713ddf5505feb3e87a48d45c3b778278291018a59fb97b520a9968bdff9db074ceaae5d52bdce81fbba20bee813145143808f9c83a9a4e182ea7ed5154daef5ea20a2c5bc798db29a17caa0c27a73419aca71ffbd8bda08939153fc233374e625d9e83bd36ca93306b759c4f6490529f30899edcffd26c1b16c7f9d6eadb007530f98c39f05859f79c3115adc574d2fe7c0061cb1302359a906a1ce51a68130b549efa668e78da4cffedb41d5d3c4ea8f2c86f1bdcc62e5b79e2e998002010e4711dc6036c3939c7265eb547a8ba86f769c9ea2a87876aa6beef8eb0c0d44ebf360689a84ad84adcaae6be1c556e60ceab4859a2d48661d02603e079d02dd3150a5d0c79e6cf082c6bdbbaa7679f2839d7f2dfb600993d0bac7067c9378fdfed4a18de55b951495151085e2367f3c9cfc6cfad6b5c3cc12c538b94003510038b6387d2a8e4a829cc8e0563c2d6c6532af8fc859a75abc63651641c58590ec94deaab0c2e20b67342d863a9857ebbf6321b71f7f9678fb16ef2b50397b0ee44cdd9e948d02c1d0208e83fe070102d7792626ac5bcdd6f9426b51e0087c3f8040b3b8c58221854aa723d93277f5c016873185d9d00bda91ac9333d0c76cc3b33222e6626a1f90a868e57ab582b6e6f7c82d683bd0f1f6e7d6a6a66549babc70ddb5a3723ea2daa865c1e3c21f962ca132234a739b40e273933c9aba051cc429c6332bfe9d735c356ff59821166af153161578e5f3c0a1091ce7d790cb28daa76e29f4cede70d582aa0ff3244fa191d2792b7a1b5b17949a3b9b1036fcd1cb7a6dc893a1d7afe42ae1238ea1122ec1dab68192e1f9e1df199153bad69960554ead468c8418b892984308f35b047dfdb76f26df340abd7ac188ddc4111a9232f20b4dd014713c64faf6d110ea384c8f5f27cc6c3a1837a6a2530a0c581454b0f7c29ac8eb69d45a89935935f2a282ef811a0a24b8820efb8edd3877d656ab6aa63c601ac0ad3db50d9763edf8c71071eca73bbcd3316846515ad46518233066ed4bd8c52bdbd677956099b80041a108ec579ebbc0236ec633526c62b214c5175d567c13f1db82cd86429217db90d8e0aeb9f2b91cbc69d641ed0e2432a1196bff9b28f1d81bb7533d7c82d22b0a56d14a1e0bc7977656e780ee9808de305de57dc5da9415a0089b4164ea06f2fb52b8d865214d2dcf1f16022c4261953f140bf22a5b525a8065d162df4f0f644c1253d8ec2c7388e5224c63520b0f70ee7d7afb8b10b3c58f9fd20fd69863a7479acecfee7748a6ca340977c02f8a50ed8a4dc816604a97c962ba436b3361488680bae2a651622293c390beeea99afb77326f845fc4bbe79a8d7530bc63730f2d416acdc7f37f99572638ccfdc3b32673d6f4bec945d04ad6f33966e0ddd36c1a2507e014718420f9b2cfb901b27ac07d812148a010633ee1a9b96e562c9fdaa7d4dc9e8fdb56e3fdb6137a197663df47538c13d19f54243c4c123e2768c3a6e98810342c0363c2ca129e29e422e71be6c7c6aeffc17d063951ff4c41d25b27745dfe17a0104d2f55837c2f7dfea50b0ebf7c7e0c9020eaa12b5586f8c564770030682107a340461a216fee49b6dfda8d27bac102e0fa52f9bba4f77346305e11804ff427062c0fdc243a0eabe7ce5f7913153b9782191f56ae5feb9a4fd09d7fae64034aa9414478a87b4b97250afba9dbcf672833d67adb265cd4c6e1049f7874eadeaa3ff9c6a4154ffe0d81758ea26034751b9808f1d6bc202e9d0dadec7303351c8a3680e8817c968c71ec35e7c1ca1dc97adc5cedf5543b631337a41d426c023c53c5c8e64cdc3797a6ce02f585127a19ffa99c0320b2c3abdd076e2af0b940334f8e73868d829e6c138c80e7d74f765c0cf22f3f9941a7ffc39c", 0x1000}, {&(0x7f0000001240)="eeb41e4cba81a174008451b9a3846fed8bbb5593b30129b12309bfc295da35e4ef6e3670c5addc54776c42941cf806906b300349f97c5cfd6e5fec701be2ea315e71d8ccca7771a8e03b938f7b2461bbf6fd15cebb1bcd1877669ef8b1d9cab231ec7a5de5b0e83f6cb18c2efbe510b18aa18f5f9c03c2aa4a0a5b9aa68a560efcb4bc949cbcbb9c2789aee0d651f31cf37075ef5e048866772525967028bc28702f23ed643ed226e033e05e285e9a76c1cc4c7cd5ce494b3bbf01c0", 0xbc}, {&(0x7f0000001300)="687cadc31bddfef0b186122a0dad321c50b2f162010eac6374c20df4fb1ade3037efe0420c7e42f329597fc06e912de100e4780a791fd84a79c6e97e49e6f99b0dde308acd911329f168faa9b13e5ca0aade37542fb0f9624a2e6edb7d587e2c44ca2a4a30e997fedfc59d233525752289700240d6c4eae92966b694aa58c3e18ea19f5d06adbc466e9c98430e5736c8b2f80c70994ad0b1c3a82d7d65eba399bfba0e9e251bea715094a7e39d9dbde78a2faff80a7dd0521494f2a9", 0xbc}, {&(0x7f00000013c0)="e5401aaca933a0e21ee31a3853117a81177dc9beb79d8feeb577411ffcf4103463736ce7977c1b6de0aca085d00d65d0a2d03dabc7a60684958085cbce2f2fc5dd49dbc416f5be1947f2c7875726cacfde9838e4d6f7f157d9160d5ad90b124dab903a909ba1fad45179c3c01a7570a980916c", 0x73}, {&(0x7f0000001440)="147019af4a881cce1c7da1e536000340f9075ac610535a6b7fcdbb652aa8ab672a7f087d2dcc0de0555b9f0dac1b8a19f896463f82c515aa804e033ebee329f3ccedb8b1a2717b2aa34f65dccaa451ce4a4b776cc7d3ca202b409a3105fdac4f36ec5587169b5ce03280f3b76617592b1beb45b148f9e721ea5b90257a0fa15226459c955953697978d3a1d6f9651fbdb75924ca81d787c54a980450711df5a3affce08c4206a96ff365b376eea18b8215019796b3d5af781972f0597181b698e88558123e7d82e63083d3bcb708ac56efc3013211", 0xd5}, {&(0x7f0000001540)="6b24b3f880c391fc2222fdb120dddb4cf47872b3adf4019fbc3baf5d056a9e01b080f9a6833bc89ee9578b9e2dd2f0c08f526019e796f9e32ae6452cb6f462b1827dd80e4352968611132ea03b363713eec388661a308e8f57d9bb1372ac52ff0e1c99c55c0a094c76c02f88b185f31f01f0a836c016113063df0c5885504a54d41d71a794c53e55461cb01ac64d79628fcb3d625fdebe82bf4c9a3dd32ad1efba4709247d36731f24773f9f169f5a4fc5408bea242562337d898eef9b5d11d9393be4a8a1828b811581e0892c27a6f0ce24a360f66b7c25861400a5bc17ac835e3bd552c6c43fc4303b9a1bb231ab6710a7d23e09381a00f6dc1b3fcdbab283b4c2857da90458f4db638c3dfa809113939ec4951763ddca50339d7fc99ea69a04920861692536209cb04ce4c079d686992c9b668730db4e6ff6bd5c40fd109b883558e4ae681cc4b15a150a0a00d027c8783bf15635191ddd38defd7fd36e1be9e5b5e040303de96963eb09be02e6e39ab0166e16d5ceca67ec30d90842f2581bdb05185070609a4d31fb8afa6b864b57151778015ad591b0b19b7ed52c77210ef7f5bc6bdc0b8b909fa2f6dce1d7ec7ad43f9f6bbdb83935cef78da2555e3e79b90d79a2d6c7d3aea82cde547827b62b0886301f0d4a5e4b36ac20235d2ca39d1d5a90b67d81188166478199737ec3dc8a56c198780c39ab5125f5acd8acbb0962cd17db9f926d6a7055eee1a4b318a2727adfa173852f7ba0ad25414bf1ae09374ec175a4a6e373bf2602323f8c482586a709f8ffd80bd015cabed41aeb583cecc584ece0431accf1dcede014bac8a3358c48a8b09a2dbe7b6f558171ea3c4b7b70bbb5e7323c3fdbe9fedb5b2063945c9963d542d0f92418c0f1735d049763935799a9df74b721f38a5dabf80381aa7cf5ecaf49548b80925eb27f5c1c09c830245bcb97e1e6a4de51d6b40d3f66e5965d10ecf96c62644cb314a32fe0e60913999caa74092ef96456a8139674602e21f0ce8fb4062bb3bb01b22e9eccfbd39caf1af55e63907bfb50726d9cc0bc6fda80ba6e740041651ba31bac6b62390be6aed4f70c9830b0ebf03b95072771fc954cf23c3dd210f7f85ff04bf37ded54871b1b622df59bb15b2ada4ce73bbfd2ad97442cf2c92cf87465e31adfc2eb84fbd96dcd38c408476a307df08082fbff0f2acfbc06e039f6e731aaa893976f8a29b2354c00a475914bb969d512857edb1011881f93b2826fdd5ab29c82f524f59cbd02880b636daa71fc816a4ae49dc4fefadfc9852de3aedf4fcb5bbb948bb70360a354cb0e05e6969d68b25084e58103217a90e5b5bf1e82dcd0a92329284b9a779d412ae3d6c55055721789127b972082b071783e701b2a3e5eea05ee903b333a403ef04e545dae46fb1db5e92410eb15b174caef1341167a269ee5beceb36597eb977a0091e1081280fc8458dd0d4b861991af45cdfea8789390f445a02a090eefc8041081b923d7b46873a9a9f5dab73b29ac8b40d15d7c4d37798bd8dd2d3d4dc2ad0a4a9340f6fe5698a39f75dbbc71e6d9726f5a6c60dd559c3b8b5ecd26056e4f744aaa4cd5124e5bab3ae1050954a9d13020163f70fab4c6c18fb529d1862cc577264196df8df229ca1aab9ca5b60260173383742fd19c56a321898982e6bf0c9ff9d58acd2fdf158338c1434b0854eef9cd8156eb1eda9d8ccf60f2bed762c321f59a0881b72bc986bd84e4fe4ddf122407ee8641c9cf1c21750eefb92c8fe6306064a688e956ee87980c311fe989927ccfe7bb61c6583abfb1543546e14856b194f192ed2f34de4ba365107584e504dc65dd941db5afdd6b61f0a7e7308e9bde3f3254518c2a055473c21ad79ea3cf2fc33cbad60653356e7c45a5f4ad998c3c063c22d0e9eaf835fab35ee8acc2c2ef6f66365ba36ab9d1ae8624b0b47e7e09225a4ba8f6e47c0d3721aabf634340606b430a3c2105cc4900c1fd216b819e6ce17c4019bde2f086943d4c6efd79f5f26f9ba679f96db5144f15840a72eec6695f9db4f220511e51a230b4583fed9f4695e1063575c276840e6173799709f9648a183ac0c131601b68e0717add6a144591d2f5bb1e3921ee7c5a42e786584280cf79eb08ac13b4b9e57409ce83b1bdcade3fb371e3a5eb793e9c6dd474b49798636584241417dc1f40b576afd7c7fe15d017ce6397525d07973edcaeb7aec8daa2b53206343fc1580281735759a9cc0cf96970b23c91189590a7fd5a168ff1248d7283b5f3bb3c597f675b566978889f7e1db6496fcfa8c6e95f4a498026c253d07779b65827c296dff90c3e4164c34b07cbd3de39ea291d37412f99886753c1198f1abea594ae753edb79384a170ddf3e3ff88e51376dc963c17b9a30ab834085b092a5d09210558a2ad2f6f04c6036c3cbfe9147bc8caaaf6f57bac78f61eaf1e1b71984d16eb166136ac7236839197ac988357588f2f0d191b1f8a7a3e13b8728b183ad48043b9918fff8e9e670750344a9bca402b6d5436ef7f08d9050b69f690ce351f928233a82e7752963ae641ab951a3feb1a3ac8033734d119ae9f3b0d899858f61d91b8c7c3c2a8dc9d3d0c928f6fbd651603767f13ba0e740d92c70a0f15a092a18b1a2c1c7e6e4a90bc00b48d44a0d2e7beeaeb5ae3c9ec0291c91110ae67d4d1b4c2bf9d5ce2f8403273165942e663692238786e13cccdd42037d5c1c5f083f3f9ce05218cd3d589717fed3652111da032bbbe3d027d1d754141b610fe278496c687cc1aa285cf39af3a6bc0c350f8a64bedbaeda86746f5583910e74f475c3c9c4cb5a2fbafd07efcd2dfb1ed81e501a6f736334d549c1d51b96bae34617660e862d1e00ae729c9651d62ea1abf0635d53511e2372e7af50cf13b736c90ec3545906f8c736de2dd7e697a69e81a6c87d3784aefb7e7f22c7387d557a13d55ecd0b8cf2ae51b826e07ac5a594b7bfb04f5575ce63c383d049a24ab431a20f8a0a45ab71c0bf52a40ab86b2411d4fff4a4574d0f963b9b7b416f26906ce861ea4dbca3246485039cd5fa345f74a239db54b28b08a78c7df85ea5dc646bc96e288e95a5fbde3ae698e93c6cee0f58f121d5cf43ddac2f5c2e7c248a828959dd4e3483931639399f5a77d331d2aa7eb1210f55c8c70b2a4e1f476b6b1f73645dd12143b8e7ec1cea38ba5d4e65edaddf9ee10105fbf3b82251c9095c48bac46dcdc6584aec9b7fed56a1135a8f48347d842f7248a8b8315af6dc1b0268d3723d00b8e77e231413bf47e6139b11487d859a6e03c95db38ec63f17c9c84ebf23521579e44aef761ee6b93c4202068aef9bc74e9f9d3deb55f59a6167a277284200c3ece96e75c64ca9f3464de6f371d6a5c5604eb4a2614d50a35ba922780763ce2818dfd93485bf9e49e05c2878336b9a0596ceef1772751fec9085d3cde5040312f6e02ec832355650c827ced360411bce5ff687e09cc57ac0c55adc5e48198209d277910ac390d868ef876d5ecc9787583de3384153d8fac97708e43cb828cccd6e3b4f9d953bae524678d0004ed99beff5a9ca9924b8f92d3b38b96bc4f6ed1e3bc1531ec83110ba69c7ddc269cc9e71f8823c1a146d56426abc756972c17deaedac34f2d01524f5e983d80e9ee3fca1bf939559aa898214cb77210f05bd414e5f3a5df818b196b60d44c5e727de736c84ec477fc5bfe0bcd4d2fde64ca255aa4e7cbd9eec5df28bec3795442319a55d173d0791e8aefcfac359041cbc7f9af91f66467cd93f7a2789f250c1f9ae2c4b5f9c8dd5b204e266825db1a38b08c9671022c09e692b9cff67552b6785a4b452686baf928bb5069ff213dcff766fcc25140b6747a0ee6a8579307eee33480e2660208628465f0c19d71617da472d81d514e0089dc75775cfc4ab6859dff103207ff943f72a12330df723dd3ccabc0129859aa4a8d40a51e36aa827c9c3b517c2ee7f9eff4d25608cdff349661b461ad3f48c997654b4c7cd159c8e1fe824e28d40b574401c1f346c6055a24b73fbb51de5777b817595c13d7219dc0fbde45c224f643551b03b025fbf698d7fab95ab3ac5ced9e3feb31682cf2e62461aca26851c972576cf4653cea7eea069b660195d4496611ba4a7f5e20d5f6a4c99411a08fde8c3f90ba07f91f152410fe44cc3a62faa8c04f499bd1ea885633b9226d01806ae5fabf35ec6fd670acd54a98568a03bd6e176df35a94cecd8064dd51b352c74c9aec994f091c52e9ba88652017026063a550ce7e5a9ed76008e4b45e13217a304f87b13e643055597784e5de204f901aec1762d8062fc35c5f73d7ee58b611f0c7b406e4fcb163e47066fe246bfea397f8a6290258e4f134d5216fea29f57b62dcdec4f4e7d3ed5fad94648b4f151c89053097ccb717be53156f1240eeaaac6af119f3a6fc2fd762c84a105aa0397e4a282fe83c1f56c279c2bf64b4a06a4bc02e8ed5054f5813e4598d40798b514325189f68cf33c3d517ffc3e4cb302d8f1d9ef0ca427bcc05a2f6e700ada9079425be1dcaaa2578cd6b63a69ed58b94792772951c3d45592f1a56bb0dee8d01f95c44c4c08e5eab235fc4ef06d4ee280de4267c924db2f6da5f1f4c2cd70155492bb4688080f181bb87f5ca2347e4cd0c2930f0710ca4b2c4b27a41a530f48433a64a261a6afe6ab5b81fffdf212346c65b0404d2c3320550f11c56dad4a0ba06c87531b2ed8d44446bc3539b8f06d200bc0a7d0c29d3f66662b2799438078b338bfca9443c41e42e93e53b8384bd5704a0c877d1cafd8699fc26d20ae263870456b58e5aa8b532ca69df548571d6df11683a2cf24e34dd5607103473d661efb3056793da218210b1ecc6481f8ea25f5c9a691a616c05f9c92f4cb703a01d1e8506c5b64a166652eda373e2c5567fde0de77ac9217ad0216f66336e5fe99927f166c5b2705d95725c153ec867b046eedb6ba3b1b925cb491a1d665055187ac2616405e0c7019be3dcc103e8e04e778123c56b5512888a0096df98e41eef8257c7a4f9703a1cee8f4b1af63364124284ff1990f96c06dac4eb528d5a8835bb3704247261f82d57f0d2d165f9b89e27680691a50e70bbf9d03dfef43883a2816735b60cc8fb66c8bb567f5766d7b75981bb8313add7b87ca73d9628cb09a3c45d71f0c83b5fe7fac0e2f96ffeb063987587cc1acc63575a19173ac0dd78f1707a670a1e633f5b2326123b38702eadcbed529fe42c88b2057f705f713ac35e93bee861cb00e72873c45cde8e5f07e25ac9897610b95d46364db5b5fd844d758fee18360762f530d1a29b3225a8130053d4f81ff5aac7bfa5b956a5928f31e3018a13e40b1c70fce9906119d15b2b854609dff064c03342dda186c3b8148699561bb6d1d3260f47f1577bfa7637c99a840b7f4a3a15bd8f760d99a1d60411f1143bd143ee5187baa1fe24a031943f765dc91b3a9104bfb", 0xf22}, {&(0x7f0000002540)="960bdbf58d62152b2757244fcba6352f1d222d86a3db468efff9784f5a7874303cc0b8b0096acaa48bf3d212b68164b9ef0f363db1dd1384b2735ff002cae1982d484f117d81702c0372289f6d09ac42f64a86404250efa414ab6b8ff0534e39b0e84ecb81e3db7640ebf2af7fdc85682c02d27e908e8fac92430e2fb7e89a3c0d98d7923220eede6f937334a827155cea808f03b7c8411a7e4828ced10f0d571d3ba3c30a4b883de379927ec3994c6a592072072610cd9e0e11b2afb67c2bc1b904b78728364769ebbab64b59254d4501062d23b95375a7232a6ce8c3c71c1b950c71767c110b1a33acfef8de594ec4b43914e0cc8c", 0xf6}, {&(0x7f0000002640)="d31115f03f51cf75b71428f03f2fae48f89fa94a025828204a", 0x19}], 0x9) 4.562689052s ago: executing program 4 (id=2088): io_uring_setup(0x77c6, &(0x7f0000000180)={0x0, 0x2951, 0x10, 0x0, 0x3}) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/locks\x00', 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240), 0x10000000000001e2, &(0x7f0000000a40)=ANY=[], 0x420}, 0x400c000) openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x19c) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224"], 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, 0x0}], 0x1, 0x63, 0x0, 0x0) (async) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r1) (async) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x200000000001, 0x2000) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000280)={&(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_RMFB(r1, 0xc00464af, &(0x7f0000000480)=r3) (async) r4 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/3\x00') (async) r5 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00@\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="01000000383801002400128009000100766c616e00000000140002800600010003000000040004800400038008000500", @ANYRES32=r7, @ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x45}, 0x40000) getsockname$packet(r5, &(0x7f00000005c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x2, &(0x7f00000000c0)=0x4, 0x4) (async) sendmsg$nl_route(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=ANY=[@ANYBLOB="74000000100037042bbd7000fddbdf2500000000", @ANYRES32=r8, @ANYBLOB="080c0400040200005400128009000100626f6e64000000004400028008001c003d090000080003"], 0x74}, 0x1, 0x0, 0x0, 0x4040880}, 0x2400c050) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) r9 = socket(0x10, 0x3, 0x0) (async) r10 = socket(0x10, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r11, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) (async) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000600)={0x47, {{0xa, 0x4e20, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0xc}}, {{0xa, 0x4e21, 0x8000, @mcast2, 0x5}}}, 0x108) sendmsg$nl_route(r9, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24004880}, 0x800) (async) ioctl$vim2m_VIDIOC_PREPARE_BUF(r4, 0xc058565d, 0x0) unshare(0x10050d00) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) 4.227842043s ago: executing program 6 (id=2089): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/profiling', 0xe41, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) syz_usb_connect$midi(0x0, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000020fd0701004000010203010902030000000000000004000002010300060d24010900070009058e0b00090fd7020c2501083b8cbb8907a6d53909058c0200026df707052501012e1e78e8508cb6b399f8bfe4e6a8919ca274a0375d9061e424d7dce9e032d9e8"], 0x0) 3.446519346s ago: executing program 4 (id=2092): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x4}, 0x1c) listen(r0, 0x2000005) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) ioctl$AUTOFS_DEV_IOCTL_FAIL(r1, 0xc0189377, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r2, {0x3, 0x3}}, './file0\x00'}) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$tcp_congestion(r2, &(0x7f0000000180)='nv\x00', 0x3) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f, 0x0, 0x10408}}, 0x50) syz_fuse_handle_req(r4, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000777a078afbd825c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000023000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db2100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cc2351270000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) dup2(r6, r4) splice(r1, 0x0, r3, 0x0, 0x4ffe2, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1ff, 0x200, 0x5, 0x9, 0x1}, 0x14) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io(r8, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000002c0)={0x40, 0xa, 0x1, 'A'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io(r8, 0x0, 0x0) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0xfffffffd, @loopback}, 0x1c) 3.392066849s ago: executing program 1 (id=2093): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0200001900010000000000000000000a0101000000000000000000000000000a01010100000000000000000000000000000003000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fcffffffffffffff0000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000001e0000000000000001000000000000000000000000000000fdffffffffffffffdd02040040000000040000000000000000000100000000008401050020010000000000000000000000000001000000002b00000000000000fc010000000000000000000000000001000000000000ff000000000000000000000000000000000000000000000000000000000100000000320000000000000000000000000000000000fffffffffffffeffffff0000000000000000000000000700000000000000000000000000000000000001000000003c00000002000000000000000000000000000000000000000100000001030000000000000000000009000000ff020000000000000000000000000001000000003200000002000000200100000000000000000000000000010000000000000000000000000300000000000000e0000002000000000000000000000000000000002b"], 0x23c}}, 0x8000000) 3.325541649s ago: executing program 1 (id=2094): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$KEYCTL_PKEY_VERIFY(0x1c, 0x0, 0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(r0, &(0x7f00000bd000), 0x492492492492846, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) mbind(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x0, 0x0, 0x0) mlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f00000001c0)={"1b00", 0x0, 0x5, 0x2, 0x802, 0x80000000, "f759e1006dc710000000d9fc6300", '\x00', "06000061", "e8cc1304", ["00e8ffffffffffffff00", "c2fe00408000", '\x00\x00\x00\t\t\x00\x00\x00\x00\x00\x00$', "0000005fc8000040001000"]}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000040)={0xb}) socket$nl_netfilter(0x10, 0x3, 0xc) socket$pptp(0x18, 0x1, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0xffffffff}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0xa, 0x84}}}, 0x98}}, 0x20050800) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{r0, 0x200}], 0x1, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=[@tclass={{0x14, 0x29, 0x43, 0x7ff}}, @rthdr={{0x18, 0x29, 0x39, {0x2, 0x0, 0x0, 0x4}}}], 0x30}, 0x440e0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000180)=0x80000001, 0x4) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000140)=0x6, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) io_setup(0x239f, &(0x7f0000000380)) 2.589789346s ago: executing program 5 (id=2097): timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) writev(r1, &(0x7f0000002b40)=[{&(0x7f0000000840)="e55ada0a26b834f902c337d74e5e7238720efb7f8ec4d0727d476db4c872aa904427840eab3b36d1ed0bfbd7d7e69c6ddb2d8226eb56e81bf8ed7bc36a3881f90a5727aff51762c4b5d02893baa44c4fcebd4fc1c1136289c57bb6b9cac240b24cc199cc7edaeaad975966a70c5ca43e81ba4cc0232281bdf279b9b7425198f2bdba0dca17ac5f36268368465090c8440b9760a36dbd8c3c802ddfefc112ebc32dc8b4647b588da74e1bfa3832615c74474e82bf0b93b1de336368ffd64d25c5e41478", 0xc3}], 0x1) 1.993047788s ago: executing program 1 (id=2099): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000e2793b10d10501200010010203010902120001000000000904"], 0x0) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@get={0xf8, 0x13, 0x10, 0x70bd2d, 0x25dfdbff, {{'drbg_pr_hmac_sha384\x00'}, '\x00', '\x00', 0x400, 0x2000}, [{0x8, 0x1, 0x9}, {0x8, 0x1, 0xbd}, {0x8, 0x1, 0xbbeb}]}, 0xf8}, 0x1, 0x0, 0x0, 0x400c040}, 0x200000c0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r1) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000002600)={0x34, &(0x7f00000002c0)={0x0, 0x31, 0x2, "aba2"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f0000000280)={0x40, 0x17, 0x2, "aaa2"}, 0x0, 0x0}) 1.781949951s ago: executing program 5 (id=2103): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x6, 0x3, 0xc06a2f6, 0x1, 0x7}, 0x6, 0x0, 0xa, 0x4, 0x6, 0x8, 0x18, 0x9, 0x3, 0x4, {0x0, 0x2, 0x9, 0x800, 0x8704, 0x27000000}}}}]}, 0x78}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)=@newtfilter={0xe94, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe60, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x1, 0x9, 0x6, 0x9, 0x8}, 0x7, 0xd6}, [{0x80, 0x5, 0xea6, 0x9, 0x6, 0x61443da9}, {0x4, 0x400, 0x7, 0x5, 0xcd00, 0x1}, {0x2, 0x4, 0x5, 0xbb, 0x5}, {0x5, 0x8, 0x9, 0x5, 0xfffffff7, 0x800}, {0x100, 0x8, 0x971, 0x9bd, 0x20, 0x1ff}, {0x5, 0x4911, 0x3, 0x2, 0x251, 0xffffffff}, {0x800, 0x3a1b, 0xffff, 0xfff, 0x81, 0x4}, {0xffffffff, 0xffffffff, 0x80, 0x3, 0x25}, {0xffff, 0x4, 0x2, 0x4, 0x4, 0x8001}, {0x5, 0x101, 0x5, 0xd0, 0xff, 0x8}, {0x1000, 0x4, 0x7f, 0xffffffff, 0x6, 0x2}, {0xfff, 0x5, 0x8, 0xe3d, 0x3, 0x8001}, {0x8, 0x0, 0x3, 0xc6, 0x2, 0x3}, {0x5da, 0x4, 0xa6a, 0x0, 0xfff, 0x6eed}, {0x1, 0x7, 0x7, 0x6, 0x800, 0x7}, {0x4, 0x6, 0x4, 0x4, 0x8b7f, 0x800000}, {0x9, 0x6, 0x0, 0xa, 0x9, 0x8001}, {0xd73, 0x6, 0x0, 0x1, 0x6}, {0x1, 0x1, 0x0, 0x3, 0x9, 0xd}, {0x8000, 0xd1, 0xffffff6e, 0x7, 0x7, 0x8}, {0x7, 0x8, 0x7ff, 0x5, 0x0, 0x3}, {0x9, 0x100, 0x461, 0x8, 0x0, 0x1000}, {0xffff, 0x8, 0xfffffff6, 0x5, 0x7ff, 0x2cf}, {0xffffffff, 0x9, 0x3, 0x0, 0x4, 0x10}, {0x9, 0xb932, 0x7, 0xff, 0x0, 0x81}, {0x3, 0x80000000, 0x200, 0x1, 0x40, 0x7fff}, {0xffff, 0x7, 0xf, 0x6, 0xa78, 0x7}, {0x9, 0x6f, 0x101, 0xfffffff9, 0xffffff7f, 0x4197}, {0x1, 0x9, 0x800, 0xfffffffb, 0x2}, {0x5, 0x8000, 0x3, 0xd, 0x500, 0x7}, {0xe1, 0xfff, 0x4, 0x2, 0x1, 0x6}, {0x0, 0x4036, 0x10000, 0x3, 0x7f, 0x3}, {0x5, 0x4, 0x80000000, 0x3, 0x9, 0x8}, {0x0, 0x8, 0x480000, 0x7, 0x80}, {0xfbdb, 0x70e6bfee, 0x8, 0x0, 0xffff, 0x3}, {0xdf0f, 0x4, 0xffff, 0x1, 0x9, 0x2}, {0x54f, 0x5, 0x89, 0x80000001, 0x1, 0x5}, {0x8, 0x5f33, 0x9, 0x2, 0x5, 0x5}, {0x9, 0x9, 0x3, 0x81, 0x1, 0x673}, {0x7ff, 0x6, 0x3, 0xb, 0x3, 0x7}, {0x81, 0x100, 0xd326, 0x7fff, 0x7fffffff, 0x8}, {0x0, 0x100, 0x2, 0x7, 0x7fff, 0x4}, {0x1000, 0x9, 0x8, 0x5, 0x3ff, 0x8}, {0x2, 0x5, 0x48, 0x85, 0xfffffff7, 0x9}, {0x3, 0xa, 0x1731c, 0x4, 0x2, 0x3}, {0x746b289, 0xe, 0x4, 0x1ff, 0xca5d, 0xee0}, {0x6, 0xffff, 0x8, 0xff, 0x10001}, {0x7240, 0xffffffff, 0x4ed, 0x8, 0x7, 0x6}, {0x7, 0x9, 0x7, 0xa, 0x40000000, 0xffffffff}, {0x1ff, 0x8, 0x1, 0x1, 0x7, 0x6}, {0x9, 0x4, 0x0, 0x2, 0x9, 0x3}, {0xfff, 0x0, 0x6, 0x6, 0x7, 0x340}, {0x8000, 0x8, 0xc0000000, 0x400, 0xd, 0x48}, {0x4, 0xccfd, 0x0, 0x7ed, 0x10000, 0x4}, {0x7da, 0x1, 0x5, 0x1000, 0x3, 0xf80}, {0x5, 0x57acc37c, 0x8, 0x80000000, 0x800, 0x9}, {0x7c, 0x3, 0x10, 0x3, 0x1, 0x5}, {0x2, 0x4, 0x8, 0x5, 0xda, 0x8001}, {0x8cd, 0x0, 0x9, 0x6, 0x800, 0xffff}, {0x6, 0x80000001, 0x3ef, 0x1000, 0x4caa12c5, 0x6}, {0x9, 0x4, 0xadc9, 0x401, 0x8, 0x5}, {0x6, 0x7, 0xb4d0, 0x1, 0x2, 0x4}, {0x8001, 0xfffffffd, 0x824, 0x8, 0xa5, 0x7}, {0x1, 0xffffffff, 0xed7e, 0x8, 0x400, 0x6}, {0x4, 0x2c24, 0x2e1, 0x1, 0x9, 0x6}, {0x7, 0x7fff, 0x7, 0x8, 0xe0, 0x6}, {0x8, 0x9, 0xb, 0xffff, 0xfffffffe, 0x7de8}, {0xc55e, 0x4, 0x4, 0x6, 0x9, 0x3}, {0xffff, 0x5, 0x7, 0x0, 0x380, 0x9}, {0x5, 0x6bd, 0x6, 0x9, 0x5, 0xd1c8}, {0x6, 0xc, 0x4, 0x200, 0x7fffffff, 0x10000}, {0x8, 0xf, 0x1ce00, 0x3, 0x1ff, 0xe7}, {0x1000, 0x2, 0x0, 0x5, 0x4}, {0x8d8c, 0xb9, 0x3, 0x2, 0x8000, 0x6}, {0xbc7, 0xc1, 0x6, 0x7ff, 0x9, 0x1}, {0x4, 0x2ab, 0xfffffffe, 0x4, 0xa055, 0x3b2}, {0x2, 0x401, 0x0, 0x1, 0x4, 0x2}, {0x3, 0x8, 0x7fff, 0x7fffffff, 0xffffc998, 0xa}, {0x3, 0x3b, 0x7, 0x7, 0x7, 0xffff}, {0x5bfb3be2, 0x9, 0x6ed, 0x6, 0xc6, 0x5}, {0x80000001, 0xd90, 0x6e4, 0x7, 0x100, 0x8001}, {0x4, 0x2000, 0x3, 0x9, 0x2, 0x4}, {0x9, 0x8, 0x858, 0x5, 0x6, 0xfffffac8}, {0x27b373d6, 0x6, 0xa4, 0x8, 0x1}, {0x7, 0x10, 0x3, 0xa, 0x9, 0x2}, {0x48fe, 0x9, 0xcb, 0x3, 0x3, 0x101}, {0x0, 0xd, 0x1, 0x5, 0x6f86, 0x9}, {0xfff, 0x8, 0x7ff, 0x3, 0x2, 0xa}, {0x3, 0x8, 0xffffffff, 0x3, 0xb8a, 0x8}, {0x0, 0x9, 0x8, 0x6, 0x0, 0x9}, {0x8, 0x7, 0x4, 0xffff, 0x4, 0x5}, {0x1, 0x6, 0x14fd, 0x4, 0x4, 0x5}, {0x1, 0x9, 0x8, 0xb, 0x8, 0x2}, {0x4, 0x9, 0x1ff, 0x1, 0x4, 0x7f}, {0x7, 0x6, 0x1, 0xbf, 0xb, 0x5}, {0xd, 0x4, 0x9, 0x5, 0x6, 0x5}, {0x4, 0x8, 0x9e1, 0x0, 0x9, 0x3}, {0x8, 0x1, 0x1, 0x1, 0x2, 0x6}, {0x4, 0x2, 0x18a, 0x6, 0x40, 0xd}, {0x1, 0x5, 0x8, 0x1, 0x1, 0x2e}, {0x7, 0x1, 0x80, 0x8, 0xfffffff9, 0xffffffff}, {0xfffffffd, 0x3, 0x9, 0x2e18c0, 0x1, 0x5}, {0x8, 0x4, 0xfffffbff, 0x0, 0x9b, 0x1}, {0x5, 0x8, 0xd1, 0x8, 0x2, 0x86}, {0xf, 0x5, 0x9, 0x9, 0xfffffcd7, 0x5}, {0x2, 0x3, 0x3, 0x9, 0x7, 0x6}, {0x3, 0xadc, 0x2, 0x101, 0x800, 0x4df}, {0xf, 0x3, 0x6, 0x6, 0x2, 0x6}, {0x3, 0x5, 0x8001, 0x6, 0x8, 0x7}, {0x8001, 0x7, 0xffff7fff, 0x1, 0xc, 0x1}, {0x5, 0x40, 0x4, 0x2, 0x4, 0x9866}, {0xb, 0x81, 0x1, 0x9, 0x4, 0x8}, {0x5, 0x8, 0x7, 0x10, 0x7, 0x401}, {0x1, 0xfffffff7, 0x3, 0x3, 0xbb, 0x4}, {0x9, 0x0, 0x22, 0x1cc, 0xc92c, 0x6}, {0x3, 0x1ff, 0x7, 0x7fffffff, 0x9d}, {0x3ff, 0x8000, 0x9, 0xb23, 0x1, 0x5}, {0x2, 0x2580, 0x1, 0x7ff, 0x1, 0x1}, {0x3, 0x9048, 0x8000, 0x237c, 0x9, 0x9}, {0x5, 0xec, 0xff, 0x9, 0x401, 0x5}, {0x5, 0x80, 0x7, 0x8000, 0x7, 0x2}, {0x1, 0xb7, 0x6, 0x1, 0x6, 0x38}, {0x3, 0x8, 0x6c, 0x8, 0x9, 0xef}, {0x10, 0x10000, 0x3, 0x8, 0x6ac}, {0x4, 0x9, 0xf8ec, 0x1, 0x6, 0x3}, {0xdf, 0xff, 0xfff, 0x80000000, 0x81, 0x101}, {0x9, 0x2, 0xffffffff, 0x9, 0x8}, {0x1a5b, 0x5, 0x800, 0x7, 0x2, 0x4}], [{0x4}, {0x5, 0x1}, {0x0, 0x1}, {}, {0x1, 0x1}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x2}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x5}, {}, {0x4}, {0x1, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x5}, {0x4, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x4}, {0x5}, {0x2}, {0x5}, {0x2}, {0x3}, {0x5}, {0x2, 0x1}, {0x1, 0x1}, {0x5}, {0x1, 0x1}, {0x3}, {0x3, 0x1}, {}, {0x4}, {0x1, 0x1}, {0x6}, {0x3, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {}, {0x3}, {0x4, 0x1}, {0x5}, {0x2, 0x1}, {0x5}, {0x5, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {0x4}, {0x3}, {0x1, 0x1}, {}, {0x4}, {0x5, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x3}, {0x0, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x5}, {}, {0x4, 0x1}, {}, {}, {0x2}, {0x2, 0x1}, {0x4, 0x1}, {0x6, 0x1}, {0x3}, {0x1}, {0x5}, {0x2, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x1}, {0x3}, {0x1}, {0x2, 0x1}, {}, {0x6, 0x1}, {0x3}, {}, {0x0, 0x1}, {0x4}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x5, 0x1}, {0x4}, {0x2}, {0x2}, {0x2, 0x1}, {0x0, 0x1}, {0x8bcdc3a00eb84eb7}, {0x4}, {0x0, 0x1}, {0x3}, {0x2}, {0x2}, {0x5, 0x1}, {0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x0, 0x1}, {0x1, 0x1}, {0x4}, {0x1, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x5}, {0x3}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2, 0x12}}]}}]}, 0xe94}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r5, 0xc}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 1.64873242s ago: executing program 5 (id=2104): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c051}, 0x8004) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff000000003e040000000002005d000000000000000704000012da0aff2500000017ffffffae040000000000007b0a00fe000000006e04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be3619184a0b139d8d4209c8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d8582755a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fc8706869ada11390d4dbcf840fa68e7d7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e224e67f1231bd236ed200073824d93c4e1a0f50a74bb4850486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cafffe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f80893220800c523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe917d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075f1488d22230592a79000000000000000000000000000000000000000000110000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783f26d0a52aefb0a5ef0b41e14a6fe6b8306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd370c06c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c3500800000087de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af24e2bb7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c796369f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed90000800847683c08bfda74a143c855030ae004ac797c575c202d8091eb77565212548ead770d680000000000"], &(0x7f00000001c0)='GPL\x00'}, 0x48) 1.633527893s ago: executing program 5 (id=2105): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a300000000009"], 0xe4}}, 0x20050840) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff10000400000000000009fff00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 1.469184574s ago: executing program 5 (id=2106): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x40000095, 0x0, 0xfffffffffffffffd}]}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000000c0)={0xffffffffffffffff, 0xc8, 0x3}) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f00000000c0)={0x4, 0xffffffffffffffff, 0x1}) r6 = syz_open_dev$vim2m(&(0x7f0000000680), 0x10007fffffff, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r6, 0xc100565c, &(0x7f0000000340)={0x0, 0x4005, 0x1, {0x1, @win={{}, 0x0, 0xfffffff8, 0x0, 0x0, 0x0}}}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0xfe, 0x86, 0xf3b8, 0xfffffffffffffffe, 0x1000, 0x400, 0x4002004c4, 0xb, 0x0, 0x1, 0x10, 0x0, 0x5, 0x4, 0x0, 0xa], 0xeeee8000, 0x402}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.226302465s ago: executing program 2 (id=2107): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x7a, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, &(0x7f0000000080)=0x9c) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000003e00070100000000fcdbdf25047c000004000000140001800674405c57e0a99819f2ca68aa"], 0x2c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet6(0xa, 0x1, 0x8010000000000084) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x7a, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, &(0x7f0000000080)=0x9c) (async) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000003e00070100000000fcdbdf25047c000004000000140001800674405c57e0a99819f2ca68aa"], 0x2c}}, 0x0) (async) 1.107963034s ago: executing program 5 (id=2108): pipe(&(0x7f0000000040)) mkdir(0x0, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_fuse_handle_req(r0, 0x0, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) io_submit(0x0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000600)=ANY=[@ANYBLOB="0201000000000010ac05418200000000000109022400010000000009040000110300000009210000000122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f0000000140)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000040)={0x6f, 0x20, 0x4, 0x3, "d80004000000000000957f00003d4a100a000000000020020661e6e66b8b37ff"}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r3 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.107004616s ago: executing program 2 (id=2109): r0 = fsopen(&(0x7f0000000400)='btrfs\x00', 0x1) r1 = fsopen(&(0x7f0000001c80)='9p\x00', 0x0) ioctl$XFS_IOC_GETBMAPA(r1, 0xc020582c, &(0x7f0000000000)={0x7ff, 0x9, 0x0, 0xd, 0x3}) fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, &(0x7f0000001cc0)='noxattr', &(0x7f00000002c0)="ae7184ee2eab000000000000", 0xc) r2 = fsmount(r1, 0x0, 0xe0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x8001000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x220, 0x0, 0x11, 0x148, 0xf8, 0x0, 0x188, 0x2a8, 0x2a8, 0x188, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x4, 0x4, 0xd, 0x0, 0x9]}, {0x0, [0x2, 0x188, 0x0, 0x2], 0x3}}}}, {{@uncond, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15}) r4 = socket(0x12, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010"], 0x48}}, 0x0) sendmmsg$alg(r4, &(0x7f00000000c0), 0x492492492492627, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000300)='acl\x00\x9a\v\x9e\xd4\x10\x18\xe6\xca\xf1\x0f\xc8H\xc8#A@\x9a\xe4r\x89h8\x1b\xab\x84<\x85\xe5\x88j_<(nW4\xe4\xbb\xe9PF\x1b|\xc4\xa1\xa0\x9e\x81\xa0lZS\'\x8f\x91\xf7\x03\xa2\x8cd\x1f\xd3y\xce\x1asj\x98\xb5\x95\xdf\x915\a\x97=\xa9\xe7A\x12\xc2\xf5_\x11\b\x00\x00\x00\x00\x00\x00\x00\x1c\x1e:^\xdeNT\xe8O\xe8\x1ez\x9e\xc8\x8eo@Ti\xf6\xe5F\x0fv\xf1H\xdf\xf1\xe1\x9en\xc1\xd1\xca\xca\x89\"\xe4\x9c\xe6\xc2\xd8\xaa\xf6\f>\x19\x15t=\x1eXp\xba~\xb8xd>\x92LO\x06\xa3\xfdS\x01\xd1GE\x0f\x98L\x99#\xef5\xed[H\x104\xcd\xe23l\xd1\x9fc5\x87\xb4\xd7\xf6\xecr)\x0f\xc7\xe4\x1d[\x82\xc3\x18\xa4{\xecF\x81\xdb', &(0x7f0000000280)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0xffffffffffffff9c) 999.394319ms ago: executing program 2 (id=2110): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x2a0, 0xffffffff, 0xffffffff, 0x2a0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [0x0, 0x70010000], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x6, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x100, 0x130, 0x0, {}, [@common=@srh={{0x30}, {0x87, 0xb, 0x7, 0x6, 0x6, 0x12c, 0x2000}}, @common=@inet=@tos={{0x28}, {0x80, 0xa7, 0x1}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x3d0) 893.468694ms ago: executing program 2 (id=2111): r0 = epoll_create1(0x0) (async) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="020000100400001247f1628f125f7e3d74dfae88ca004b177dc8362e9bd31f82e2c07083d7a3341257d0645eca705423b188829285fd1c78c51051bcba3470f5cb585f5c746a7bdc1507c61f18de966b1eba00eb5cb9caf3"], 0x48) r2 = dup3(r1, r0, 0x0) ioctl$PPPIOCSDEBUG(r2, 0x40047440, &(0x7f0000000100)=0xaf) (async) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000140)={0x28}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000009000000000000000700000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000beb60000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x9, 0xff5, &(0x7f0000001840)=""/4085, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) (async) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r4 = accept4(r3, 0x0, 0x0, 0x80800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0", 0x3}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}], 0x1}, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x5, 0x4, 0x65bf, 0x40, 0x11, 0x1, 0xcb00, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4080000400000006110540000000000a60000000000ffe49500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x9}, 0x8, 0x10, &(0x7f0000000080)={0x0, 0x8}, 0x10}, 0x94) 808.783753ms ago: executing program 6 (id=2112): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x40200, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000090a01020000000000000000050000040008000a40000000020900010073797a30000000000900020073797a3200000000140000001100010000000000000000000200000a00000000000000"], 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x20000854) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000740)={0x14, 0x22, 0xa01}, 0x14}}, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x550, 0x40, 0x1000, 0x0, 0x20, 0x0, {0x0, 0x9416}, {0x354, 0xffffffff, 0x400}, {0xf4ef}, {0x0, 0x0, 0xffe}, 0x1, 0x100, 0x0, 0xd616, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4, 0x0, 0xb}) 742.306533ms ago: executing program 2 (id=2113): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) writev(r0, &(0x7f0000002b40)=[{&(0x7f0000000840)="e55ada0a26b834f902c337d74e5e7238720efb7f8ec4d0727d476db4c872aa904427840eab3b36d1ed0bfbd7d7e69c6ddb2d8226eb56e81bf8ed7bc36a3881f90a5727aff51762c4b5d02893baa44c4fcebd4fc1c1136289c57bb6b9cac240b24cc199cc7edaeaad975966a70c5ca43e81ba4cc0232281bdf279b9b7425198f2bdba0dca17ac5f36268368465090c8440b9760a36dbd8c3c802ddfefc112ebc32dc8b4647b588da74e1bfa3832615c74474e82bf0b93b1de336368ffd64d25c5e41478", 0xc3}], 0x1) 609.631495ms ago: executing program 6 (id=2114): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x6, 0x3, 0xc06a2f6, 0x1, 0x7}, 0x6, 0x0, 0xa, 0x4, 0x6, 0x8, 0x18, 0x9, 0x3, 0x4, {0x0, 0x2, 0x9, 0x800, 0x8704, 0x27000000}}}}]}, 0x78}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000022c0)=@newtfilter={0xe94, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe60, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x1, 0x9, 0x6, 0x9, 0x8}, 0x7, 0xd6}, [{0x80, 0x5, 0xea6, 0x9, 0x6, 0x61443da9}, {0x4, 0x400, 0x7, 0x5, 0xcd00, 0x1}, {0x2, 0x4, 0x5, 0xbb, 0x5}, {0x5, 0x8, 0x9, 0x5, 0xfffffff7, 0x800}, {0x100, 0x8, 0x971, 0x9bd, 0x20, 0x1ff}, {0x5, 0x4911, 0x3, 0x2, 0x251, 0xffffffff}, {0x800, 0x3a1b, 0xffff, 0xfff, 0x81, 0x4}, {0xffffffff, 0xffffffff, 0x80, 0x3, 0x25}, {0xffff, 0x4, 0x2, 0x4, 0x4, 0x8001}, {0x5, 0x101, 0x5, 0xd0, 0xff, 0x8}, {0x1000, 0x4, 0x7f, 0xffffffff, 0x6, 0x2}, {0xfff, 0x5, 0x8, 0xe3d, 0x3, 0x8001}, {0x8, 0x0, 0x3, 0xc6, 0x2, 0x3}, {0x5da, 0x4, 0xa6a, 0x0, 0xfff, 0x6eed}, {0x1, 0x7, 0x7, 0x6, 0x800, 0x7}, {0x4, 0x6, 0x4, 0x4, 0x8b7f, 0x800000}, {0x9, 0x6, 0x0, 0xa, 0x9, 0x8001}, {0xd73, 0x6, 0x0, 0x1, 0x6}, {0x1, 0x1, 0x0, 0x3, 0x9, 0xd}, {0x8000, 0xd1, 0xffffff6e, 0x7, 0x7, 0x8}, {0x7, 0x8, 0x7ff, 0x5, 0x0, 0x3}, {0x9, 0x100, 0x461, 0x8, 0x0, 0x1000}, {0xffff, 0x8, 0xfffffff6, 0x5, 0x7ff, 0x2cf}, {0xffffffff, 0x9, 0x3, 0x0, 0x4, 0x10}, {0x9, 0xb932, 0x7, 0xff, 0x0, 0x81}, {0x3, 0x80000000, 0x200, 0x1, 0x40, 0x7fff}, {0xffff, 0x7, 0xf, 0x6, 0xa78, 0x7}, {0x9, 0x6f, 0x101, 0xfffffff9, 0xffffff7f, 0x4197}, {0x1, 0x9, 0x800, 0xfffffffb, 0x2}, {0x5, 0x8000, 0x3, 0xd, 0x500, 0x7}, {0xe1, 0xfff, 0x4, 0x2, 0x1, 0x6}, {0x0, 0x4036, 0x10000, 0x3, 0x7f, 0x3}, {0x5, 0x4, 0x80000000, 0x3, 0x9, 0x8}, {0x0, 0x8, 0x480000, 0x7, 0x80}, {0xfbdb, 0x70e6bfee, 0x8, 0x0, 0xffff, 0x3}, {0xdf0f, 0x4, 0xffff, 0x1, 0x9, 0x2}, {0x54f, 0x5, 0x89, 0x80000001, 0x1, 0x5}, {0x8, 0x5f33, 0x9, 0x2, 0x5, 0x5}, {0x9, 0x9, 0x3, 0x81, 0x1, 0x673}, {0x7ff, 0x6, 0x3, 0xb, 0x3, 0x7}, {0x81, 0x100, 0xd326, 0x7fff, 0x7fffffff, 0x8}, {0x0, 0x100, 0x2, 0x7, 0x7fff, 0x4}, {0x1000, 0x9, 0x8, 0x5, 0x3ff, 0x8}, {0x2, 0x5, 0x48, 0x85, 0xfffffff7, 0x9}, {0x3, 0xa, 0x1731c, 0x4, 0x2, 0x3}, {0x746b289, 0xe, 0x4, 0x1ff, 0xca5d, 0xee0}, {0x6, 0xffff, 0x8, 0xff, 0x10001}, {0x7240, 0xffffffff, 0x4ed, 0x8, 0x7, 0x6}, {0x7, 0x9, 0x7, 0xa, 0x40000000, 0xffffffff}, {0x1ff, 0x8, 0x1, 0x1, 0x7, 0x6}, {0x9, 0x4, 0x0, 0x2, 0x9, 0x3}, {0xfff, 0x0, 0x6, 0x6, 0x7, 0x340}, {0x8000, 0x8, 0xc0000000, 0x400, 0xd, 0x48}, {0x4, 0xccfd, 0x0, 0x7ed, 0x10000, 0x4}, {0x7da, 0x1, 0x5, 0x1000, 0x3, 0xf80}, {0x5, 0x57acc37c, 0x8, 0x80000000, 0x800, 0x9}, {0x7c, 0x3, 0x10, 0x3, 0x1, 0x5}, {0x2, 0x4, 0x8, 0x5, 0xda, 0x8001}, {0x8cd, 0x0, 0x9, 0x6, 0x800, 0xffff}, {0x6, 0x80000001, 0x3ef, 0x1000, 0x4caa12c5, 0x6}, {0x9, 0x4, 0xadc9, 0x401, 0x8, 0x5}, {0x6, 0x7, 0xb4d0, 0x1, 0x2, 0x4}, {0x8001, 0xfffffffd, 0x824, 0x8, 0xa5, 0x7}, {0x1, 0xffffffff, 0xed7e, 0x8, 0x400, 0x6}, {0x4, 0x2c24, 0x2e1, 0x1, 0x9, 0x6}, {0x7, 0x7fff, 0x7, 0x8, 0xe0, 0x6}, {0x8, 0x9, 0xb, 0xffff, 0xfffffffe, 0x7de8}, {0xc55e, 0x4, 0x4, 0x6, 0x9, 0x3}, {0xffff, 0x5, 0x7, 0x0, 0x380, 0x9}, {0x5, 0x6bd, 0x6, 0x9, 0x5, 0xd1c8}, {0x6, 0xc, 0x4, 0x200, 0x7fffffff, 0x10000}, {0x8, 0xf, 0x1ce00, 0x3, 0x1ff, 0xe7}, {0x1000, 0x2, 0x0, 0x5, 0x4}, {0x8d8c, 0xb9, 0x3, 0x2, 0x8000, 0x6}, {0xbc7, 0xc1, 0x6, 0x7ff, 0x9, 0x1}, {0x4, 0x2ab, 0xfffffffe, 0x4, 0xa055, 0x3b2}, {0x2, 0x401, 0x0, 0x1, 0x4, 0x2}, {0x3, 0x8, 0x7fff, 0x7fffffff, 0xffffc998, 0xa}, {0x3, 0x3b, 0x7, 0x7, 0x7, 0xffff}, {0x5bfb3be2, 0x9, 0x6ed, 0x6, 0xc6, 0x5}, {0x80000001, 0xd90, 0x6e4, 0x7, 0x100, 0x8001}, {0x4, 0x2000, 0x3, 0x9, 0x2, 0x4}, {0x9, 0x8, 0x858, 0x5, 0x6, 0xfffffac8}, {0x27b373d6, 0x6, 0xa4, 0x8, 0x1}, {0x7, 0x10, 0x3, 0xa, 0x9, 0x2}, {0x48fe, 0x9, 0xcb, 0x3, 0x3, 0x101}, {0x0, 0xd, 0x1, 0x5, 0x6f86, 0x9}, {0xfff, 0x8, 0x7ff, 0x3, 0x2, 0xa}, {0x3, 0x8, 0xffffffff, 0x3, 0xb8a, 0x8}, {0x0, 0x9, 0x8, 0x6, 0x0, 0x9}, {0x8, 0x7, 0x4, 0xffff, 0x4, 0x5}, {0x1, 0x6, 0x14fd, 0x4, 0x4, 0x5}, {0x1, 0x9, 0x8, 0xb, 0x8, 0x2}, {0x4, 0x9, 0x1ff, 0x1, 0x4, 0x7f}, {0x7, 0x6, 0x1, 0xbf, 0xb, 0x5}, {0xd, 0x4, 0x9, 0x5, 0x6, 0x5}, {0x4, 0x8, 0x9e1, 0x0, 0x9, 0x3}, {0x8, 0x1, 0x1, 0x1, 0x2, 0x6}, {0x4, 0x2, 0x18a, 0x6, 0x40, 0xd}, {0x1, 0x5, 0x8, 0x1, 0x1, 0x2e}, {0x7, 0x1, 0x80, 0x8, 0xfffffff9, 0xffffffff}, {0xfffffffd, 0x3, 0x9, 0x2e18c0, 0x1, 0x5}, {0x8, 0x4, 0xfffffbff, 0x0, 0x9b, 0x1}, {0x5, 0x8, 0xd1, 0x8, 0x2, 0x86}, {0xf, 0x5, 0x9, 0x9, 0xfffffcd7, 0x5}, {0x2, 0x3, 0x3, 0x9, 0x7, 0x6}, {0x3, 0xadc, 0x2, 0x101, 0x800, 0x4df}, {0xf, 0x3, 0x6, 0x6, 0x2, 0x6}, {0x3, 0x5, 0x8001, 0x6, 0x8, 0x7}, {0x8001, 0x7, 0xffff7fff, 0x1, 0xc, 0x1}, {0x5, 0x40, 0x4, 0x2, 0x4, 0x9866}, {0xb, 0x81, 0x1, 0x9, 0x4, 0x8}, {0x5, 0x8, 0x7, 0x10, 0x7, 0x401}, {0x1, 0xfffffff7, 0x3, 0x3, 0xbb, 0x4}, {0x9, 0x0, 0x22, 0x1cc, 0xc92c, 0x6}, {0x3, 0x1ff, 0x7, 0x7fffffff, 0x9d}, {0x3ff, 0x8000, 0x9, 0xb23, 0x1, 0x5}, {0x2, 0x2580, 0x1, 0x7ff, 0x1, 0x1}, {0x3, 0x9048, 0x8000, 0x237c, 0x9, 0x9}, {0x5, 0xec, 0xff, 0x9, 0x401, 0x5}, {0x5, 0x80, 0x7, 0x8000, 0x7, 0x2}, {0x1, 0xb7, 0x6, 0x1, 0x6, 0x38}, {0x3, 0x8, 0x6c, 0x8, 0x9, 0xef}, {0x10, 0x10000, 0x3, 0x8, 0x6ac}, {0x4, 0x9, 0xf8ec, 0x1, 0x6, 0x3}, {0xdf, 0xff, 0xfff, 0x80000000, 0x81, 0x101}, {0x9, 0x2, 0xffffffff, 0x9, 0x8}, {0x1a5b, 0x5, 0x800, 0x7, 0x2, 0x4}], [{0x4}, {0x5, 0x1}, {0x0, 0x1}, {}, {0x1, 0x1}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x2}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x5}, {}, {0x4}, {0x1, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x5}, {0x4, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x4}, {0x5}, {0x2}, {0x5}, {0x2}, {0x3}, {0x5}, {0x2, 0x1}, {0x1, 0x1}, {0x5}, {0x1, 0x1}, {0x3}, {0x3, 0x1}, {}, {0x4}, {0x1, 0x1}, {0x6}, {0x3, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {}, {0x3}, {0x4, 0x1}, {0x5}, {0x2, 0x1}, {0x5}, {0x5, 0x1}, {0x4, 0x1}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {0x4}, {0x3}, {0x1, 0x1}, {}, {0x4}, {0x5, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x3}, {0x0, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x5}, {}, {0x4, 0x1}, {}, {}, {0x2}, {0x2, 0x1}, {0x4, 0x1}, {0x6, 0x1}, {0x3}, {0x1}, {0x5}, {0x2, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x1}, {0x3}, {0x1}, {0x2, 0x1}, {}, {0x6, 0x1}, {0x3}, {}, {0x0, 0x1}, {0x4}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x5, 0x1}, {0x4}, {0x2}, {0x2}, {0x2, 0x1}, {0x0, 0x1}, {0x8bcdc3a00eb84eb7}, {0x4}, {0x0, 0x1}, {0x3}, {0x2}, {0x2}, {0x5, 0x1}, {0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x0, 0x1}, {0x1, 0x1}, {0x4}, {0x1, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x5}, {0x3}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2, 0x12}}]}}]}, 0xe94}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r5, 0xc}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 447.855357ms ago: executing program 6 (id=2115): r0 = socket(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000411800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x40}}, 0x80) close(r1) 364.705618ms ago: executing program 6 (id=2116): r0 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r0, &(0x7f0000000780)=[{&(0x7f00000004c0)='5', 0x2b}], 0x1) syz_emit_ethernet(0x3e, &(0x7f0000000340)=ANY=[@ANYBLOB="0180c2030000aaaaaaaaaa0086dd6000"], 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000086dd0001"], 0xfdef) 216.159738ms ago: executing program 4 (id=2117): syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x800) write(0xffffffffffffffff, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb", 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 133.93998ms ago: executing program 2 (id=2118): unshare(0x2040500) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0xb173, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000040)={0x3b, 0x1, 0x2, "4749570000000000000000000e1609d600", 0x20493859}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x48) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=ANY=[@ANYBLOB="840100001000010025bd7000fcdbdf257f00000100000000002a0e0000", @ANYRES32=0x0, @ANYRES32=0x0], 0x184}, 0x1, 0x0, 0x0, 0x40000}, 0x4840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x808001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x9, 0xfff}, 0x0) mmap$IORING_OFF_CQ_RING(&(0x7f00006ef000/0x4000)=nil, 0x4000, 0x9, 0x10, 0xffffffffffffffff, 0x8000000) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400), 0xffffffffffffffff) r6 = fsopen(&(0x7f0000000100)='ufs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000280)='port', &(0x7f0000000140)='f\x97-i\xcf_Z=\x03b\xa6\x850', 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xf7a5c5ded2e11e1f, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5}, 0x94) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000200)={r9, @in={{0x2, 0x4e23, @empty}}, 0x7, 0x400, 0x2, 0x41, 0x6, 0xffff, 0x10}, &(0x7f0000000080)=0x9c) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="340000409a5d010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r8, @ANYBLOB="08001b0000000000"], 0x34}}, 0x24048180) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r5, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x880) ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000040)=@overlay={0x0, 0x1, 0x4, 0x0, 0xd, {}, {0x4, 0x0, 0x0, 0x1, 0x0, 0x0, "12848098"}, 0x3}) openat$nullb(0xffffffffffffff9c, 0x0, 0x185802, 0x0) 106.26509ms ago: executing program 6 (id=2119): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x380, 0x150, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x2b0, 0xffffffff, 0xffffffff, 0x2b0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x128, 0x150, 0x0, {}, [@common=@unspec=@pkttype={{0x28}, {0x7, 0x7}}, @common=@inet=@hashlimit1={{0x58}, {'\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x18}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @mcast2, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x130, 0x160, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff, 0x18}}}, @common=@srh={{0x30}, {0x32, 0x21, 0xa1, 0x29, 0x1, 0x25c, 0x1}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x3e0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SREG={0x8, 0x1, 0x1, 0x0, 0x13}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x78}}, 0x0) (async) r2 = syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="03010000ac0fce405d0500904431000000010902120001000080040904"], 0x0) syz_usb_disconnect(r2) (async) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[], 0x0) syz_usb_ep_write(0xffffffffffffffff, 0x66, 0x48, &(0x7f0000000000)="755a20d9dc728597c29e980ac131bad43f1fb304bbaafcf7ace8ab8dc9fd22626ee92d72f4e164afa837b946963825fdacf6f84e15fb51058d03882eab488962c7f2592c136047f1") (async) syz_usb_control_io$hid(r3, 0x0, 0x0) 0s ago: executing program 1 (id=2120): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000000240)) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock2(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x1) socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x7e, &(0x7f0000000040)=ANY=[], 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r4, 0x5407, &(0x7f0000000040)={0x6, 0x7, 0xcd, 0x0, 0x12, "100056f200"}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000600)={@val={0x6f01, 0x800}, @val={0x3, 0x3, 0x2a, 0xc, 0x27}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x1000, 0x0, 0x18, {[@timestamp={0x5, 0xa, 0x7fffff8}]}}}}}}, 0x42) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001980)={0x1, 0x3, &(0x7f00000013c0)=@framed, &(0x7f0000001400)='syzkaller\x00'}, 0x80) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r7, 0x104, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x32, 0x8, 0x0, 0x0}}, 0x10) ioctl$TIOCMSET(r4, 0x5418, 0x0) openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x20040, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r8 = syz_open_dev$media(&(0x7f0000000380), 0xfffffffffffffffb, 0x680002) ioctl$MEDIA_IOC_ENUM_LINKS(r8, 0xc0287c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000002c0)=[{{0x80000000, 0x0}}, {{0x80000000}, {0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r8, 0xc0347c03, &(0x7f00000001c0)={{r10, r9, 0x1, [0x104, 0xf7df]}, {r11, r12, 0x4, [0x6, 0xfffff7ff]}, 0x2, [0x2, 0x3]}) kernel console output (not intermixed with test programs): ) [ 512.509201][ T5970] asix 3-1:0.188 (unnamed net_device) (uninitialized): invalid PHY address: 126 [ 512.531147][ T5884] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 512.595384][ T5884] usb 2-1: device descriptor read/8, error -71 [ 512.711962][T11523] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1568'. [ 512.744607][T11481] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.785964][T11481] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.871460][ T5884] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 512.910558][ T5884] usb 2-1: device descriptor read/8, error -71 [ 513.041837][ T5884] usb usb2-port1: unable to enumerate USB device [ 513.490455][T11539] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1571'. [ 513.942931][ T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 514.146099][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 514.153934][ T10] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 7 [ 514.339636][ T10] usb 6-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b [ 514.348918][ T10] usb 6-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3 [ 514.360451][ T10] usb 6-1: Product: syz [ 514.369137][ T10] usb 6-1: Manufacturer: syz [ 514.377731][ T10] usb 6-1: SerialNumber: syz [ 514.607164][ T10] usb 6-1: palm_os_3_probe - error -71 getting connection information [ 514.631917][ T10] visor 6-1:1.0: probe with driver visor failed with error -71 [ 514.686787][ T10] usb 6-1: USB disconnect, device number 6 [ 514.727224][ T49] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 515.028878][ T5884] usb 3-1: USB disconnect, device number 104 [ 515.259523][T11585] loop2: detected capacity change from 0 to 7 [ 515.313395][ T5842] Dev loop2: unable to read RDB block 7 [ 515.328997][ T5842] loop2: unable to read partition table [ 515.349874][ T5842] loop2: partition table beyond EOD, truncated [ 515.367172][T11585] Dev loop2: unable to read RDB block 7 [ 515.381627][T11585] loop2: unable to read partition table [ 515.388191][T11585] loop2: partition table beyond EOD, truncated [ 515.395788][T11585] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 516.391149][ T10] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 516.585733][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 516.597715][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 516.619837][ T10] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 516.649507][ T10] usb 2-1: config 1 has no interface number 1 [ 516.674116][ T10] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 516.861717][ T10] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 516.899662][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40 [ 516.910091][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.040924][ T10] usb 2-1: Product: syz [ 517.051329][ T10] usb 2-1: Manufacturer: syz [ 517.071064][ T10] usb 2-1: SerialNumber: syz [ 517.349275][ T10] usb 2-1: 2:1 : invalid UAC_AS_GENERAL desc [ 517.506243][ T10] usb 2-1: USB disconnect, device number 116 [ 517.562450][T11612] netlink: 204 bytes leftover after parsing attributes in process `syz.6.1583'. [ 517.577778][T11612] binder: BINDER_SET_CONTEXT_MGR already set [ 517.584284][T11612] binder: 11605:11612 ioctl 4018620d 200000004a80 returned -16 [ 517.593508][T11612] binder: 11605:11612 ioctl c0306201 200000000380 returned -14 [ 517.690270][ T5837] udevd[5837]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 517.908867][T11617] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1584'. [ 518.014799][T11620] netlink: 190972 bytes leftover after parsing attributes in process `syz.1.1585'. [ 518.128754][T11622] loop2: detected capacity change from 0 to 7 [ 518.168571][T11622] loop2: [ 518.175544][T11622] loop2: partition table partially beyond EOD, truncated [ 518.289058][T11624] netlink: 'syz.1.1588': attribute type 1 has an invalid length. [ 518.457587][T11630] loop2: detected capacity change from 0 to 7 [ 518.488317][T11624] 8021q: adding VLAN 0 to HW filter on device bond11 [ 518.509266][T11630] Dev loop2: unable to read RDB block 7 [ 518.569245][T11630] loop2: unable to read partition table [ 518.582264][T11630] loop2: partition table beyond EOD, truncated [ 518.604435][T11630] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 518.675730][ T5884] hid-generic 0000:0000:0000.0020: unknown main item tag 0x0 [ 518.697254][ T5884] hid-generic 0000:0000:0000.0020: hidraw0: HID v0.00 Device [syz1] on syz0 [ 520.225406][T11644] netlink: 104 bytes leftover after parsing attributes in process `syz.6.1594'. [ 521.782090][ T42] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 521.814942][T11668] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1600'. [ 522.003239][ T42] usb 6-1: unable to get BOS descriptor or descriptor too short [ 522.021460][ T42] usb 6-1: config 1 has an invalid descriptor of length 44, skipping remainder of the config [ 522.040638][ T42] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 522.057969][ T42] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 47, changing to 7 [ 522.096708][ T42] usb 6-1: New USB device found, idVendor=04fa, idProduct=4201, bcdDevice= 0.40 [ 522.128860][ T42] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.162167][ T42] usb 6-1: Product: syz [ 522.166396][ T42] usb 6-1: Manufacturer: syz [ 522.178622][ T42] usb 6-1: SerialNumber: syz [ 522.405277][ T42] usb 6-1: 1:1 : no or invalid class specific endpoint descriptor [ 522.413461][ T42] usb 6-1: 1:1 : sample bitwidth 62 in over sample bytes 3 [ 522.420705][ T42] usb 6-1: 1:1 : unsupported format bits 0x33820006 [ 522.450921][ T42] usb 6-1: parse_audio_format_rates_v2v3(): unable to find clock source (clock -22) [ 522.505283][ T42] usb 6-1: unit 2 not found! [ 522.510045][ T42] usb 6-1: unit 0 not found! [ 522.519828][T11671] loop2: detected capacity change from 0 to 7 [ 522.540313][T10466] Dev loop2: unable to read RDB block 7 [ 522.589676][T10466] loop2: unable to read partition table [ 522.609739][T10466] loop2: partition table beyond EOD, truncated [ 522.629758][T11671] Dev loop2: unable to read RDB block 7 [ 522.635673][T11671] loop2: unable to read partition table [ 522.641665][T11671] loop2: partition table beyond EOD, truncated [ 522.648020][T11671] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 522.701431][ T42] usb 6-1: USB disconnect, device number 7 [ 522.709676][ T5198] Dev loop2: unable to read RDB block 7 [ 522.715382][ T5198] loop2: unable to read partition table [ 522.731205][ T5198] loop2: partition table beyond EOD, truncated [ 522.798302][ T29] audit: type=1326 audit(1776142434.424:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 522.867607][ T29] audit: type=1326 audit(1776142434.424:491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.067252][ T29] audit: type=1326 audit(1776142434.424:492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.094257][ T5940] udevd[5940]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 523.192764][ T29] audit: type=1326 audit(1776142434.434:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.239753][ T29] audit: type=1326 audit(1776142434.434:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.269394][ T29] audit: type=1326 audit(1776142434.434:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=31 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.550722][ T29] audit: type=1326 audit(1776142434.434:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.574721][ T29] audit: type=1326 audit(1776142434.434:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.664428][ T29] audit: type=1326 audit(1776142434.434:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.771218][ T29] audit: type=1326 audit(1776142434.434:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11677 comm="syz.4.1603" exe="/root/syz-executor" sig=0 arch=c000003e syscall=73 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 523.838534][T11698] netlink: 204 bytes leftover after parsing attributes in process `syz.2.1608'. [ 523.899285][T11698] binder: 11692:11698 ioctl c0306201 200000000380 returned -14 [ 524.151557][ T10] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 524.344709][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 524.362914][ T10] usb 2-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 524.372178][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 524.408618][ T10] usb 2-1: config 0 descriptor?? [ 524.443996][ T10] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 525.391358][ T10] gspca_sonixj: reg_w1 err -110 [ 525.396364][ T10] sonixj 2-1:0.0: probe with driver sonixj failed with error -110 [ 525.549272][T11714] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1614'. [ 525.844103][T11716] loop2: detected capacity change from 0 to 7 [ 525.863088][T11716] Dev loop2: unable to read RDB block 7 [ 525.880012][T11716] loop2: unable to read partition table [ 525.927216][T11716] loop2: partition table beyond EOD, truncated [ 525.945037][T11716] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 525.989325][ T5198] Dev loop2: unable to read RDB block 7 [ 525.995199][ T5198] loop2: unable to read partition table [ 526.012801][ T5198] loop2: partition table beyond EOD, truncated [ 526.151484][ T42] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 526.257372][T11720] loop2: detected capacity change from 0 to 7 [ 526.289757][ T5837] loop2: [ 526.293221][ T5837] loop2: partition table partially beyond EOD, truncated [ 526.307947][ T42] usb 3-1: config 0 has an invalid interface number: 255 but max is 0 [ 526.316752][ T42] usb 3-1: config 0 has no interface number 0 [ 526.333395][T11720] loop2: [ 526.337474][T11720] loop2: partition table partially beyond EOD, truncated [ 526.346780][ T42] usb 3-1: too many endpoints for config 0 interface 255 altsetting 255: 255, using maximum allowed: 30 [ 526.401519][ T42] usb 3-1: config 0 interface 255 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 526.453068][ T42] usb 3-1: config 0 interface 255 has no altsetting 0 [ 526.478917][ T42] usb 3-1: New USB device found, idVendor=0bda, idProduct=0177, bcdDevice=7d.0b [ 526.503991][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.536656][ T42] usb 3-1: config 0 descriptor?? [ 526.564646][ T42] ums-realtek 3-1:0.255: USB Mass Storage device detected [ 527.085657][ T42] usb 2-1: USB disconnect, device number 117 [ 528.652560][T11748] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 530.817290][T11727] syzkaller1: entered promiscuous mode [ 530.823302][T11727] syzkaller1: entered allmulticast mode [ 531.205685][ T10] usb 3-1: USB disconnect, device number 105 [ 531.235378][T11768] loop2: detected capacity change from 0 to 7 [ 531.273749][T11768] Dev loop2: unable to read RDB block 7 [ 531.300878][T11768] loop2: unable to read partition table [ 531.347531][T11768] loop2: partition table beyond EOD, truncated [ 531.369476][T11768] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 531.488790][T11779] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1632'. [ 531.497799][T11779] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1632'. [ 531.573053][ T5950] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 531.645232][T11786] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1634'. [ 531.672428][T11786] gretap0: entered promiscuous mode [ 531.678736][T11786] debugfs: 'hsr1' already exists in 'hsr' [ 531.685345][T11786] Cannot create hsr debugfs directory [ 531.695565][T11786] hsr1: entered promiscuous mode [ 531.731868][ T5950] usb 6-1: Using ep0 maxpacket: 16 [ 531.740851][ T5950] usb 6-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 531.750563][ T5950] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.775320][ T5950] usb 6-1: config 0 descriptor?? [ 531.805299][ T5950] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 531.821488][ T42] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 531.971753][ T42] usb 2-1: Using ep0 maxpacket: 32 [ 531.980222][ T42] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 531.989915][ T42] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 531.998813][ T42] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 532.008336][ T42] usb 2-1: config 1 has no interface number 0 [ 532.015081][ T42] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 532.027494][ T42] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 532.043241][ T42] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 532.052891][ T42] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 532.083603][ T42] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 532.283214][ T42] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 532.539692][T11808] syzkaller0: entered promiscuous mode [ 532.561594][T11808] syzkaller0: entered allmulticast mode [ 532.731491][ T5950] gspca_sonixj: reg_w1 err -110 [ 532.736605][ T5950] sonixj 6-1:0.0: probe with driver sonixj failed with error -110 [ 533.194441][ T5950] usb 5-1: new full-speed USB device number 90 using dummy_hcd [ 533.358367][ T5950] usb 5-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 533.370384][ T5950] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.376589][ T5884] snd_usb_pod 2-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 533.393913][ T5950] usb 5-1: config 0 descriptor?? [ 533.416008][ T5950] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 533.616017][ T5950] gp8psk: usb in 128 operation failed. [ 533.829230][ T5950] gp8psk: FW Version = 68.248.173 (0x44f8ad) Build 2048/49/50 [ 534.046059][ T5950] gp8psk: usb in 149 operation failed. [ 534.061221][ T5950] gp8psk: failed to get FPGA version [ 534.073804][ T5950] gp8psk: usb in 138 operation failed. [ 534.103345][ T5950] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 534.147353][ T5950] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 534.219151][ T5950] usb 5-1: USB disconnect, device number 90 [ 534.654350][ T5950] usb 2-1: USB disconnect, device number 118 [ 534.685559][ T5950] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 534.699554][T11827] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1641'. [ 534.722578][ T42] usb 6-1: USB disconnect, device number 8 [ 536.480229][T11831] tipc: Enabling of bearer rejected, already enabled [ 536.631479][T11853] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1650'. [ 536.697055][T11858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1651'. [ 536.711048][ T5950] IPVS: starting estimator thread 0... [ 536.781056][ T42] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 536.836794][T11859] IPVS: using max 45 ests per chain, 108000 per kthread [ 536.961172][ T42] usb 2-1: Using ep0 maxpacket: 32 [ 536.976954][ T42] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 537.009419][ T42] usb 2-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 537.029765][ T42] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 537.039155][ T42] usb 2-1: Product: syz [ 537.060873][ T42] usb 2-1: Manufacturer: syz [ 537.081041][ T42] usb 2-1: SerialNumber: syz [ 537.099623][ T42] usb 2-1: config 0 descriptor?? [ 537.150157][ T42] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input41 [ 537.170680][ T42] usbtouchscreen 2-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -8 [ 537.191480][ T5970] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 537.254808][ T42] usbtouchscreen 2-1:0.0: probe with driver usbtouchscreen failed with error -8 [ 537.372271][ T5970] usb 6-1: Using ep0 maxpacket: 32 [ 537.386254][ T5970] usb 6-1: config 0 has an invalid interface number: 4 but max is 0 [ 537.417609][ T5970] usb 6-1: config 0 has no interface number 0 [ 537.424730][ T42] usb 2-1: USB disconnect, device number 119 [ 537.451454][ T5970] usb 6-1: config 0 interface 4 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 537.466308][ T5970] usb 6-1: config 0 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 537.482514][ T5970] usb 6-1: New USB device found, idVendor=046d, idProduct=c537, bcdDevice= 0.00 [ 537.494957][ T5970] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 537.522066][ T5970] usb 6-1: config 0 descriptor?? [ 537.546310][T11896] tipc: Enabling of bearer rejected, already enabled [ 537.667859][T11900] netlink: 'syz.1.1661': attribute type 6 has an invalid length. [ 538.060109][ T5970] logitech-djreceiver 0003:046D:C537.0021: unknown main item tag 0x0 [ 538.090507][ T5970] logitech-djreceiver 0003:046D:C537.0021: unknown main item tag 0x0 [ 538.100474][ T5970] logitech-djreceiver 0003:046D:C537.0021: unknown main item tag 0x0 [ 538.109909][ T5970] logitech-djreceiver 0003:046D:C537.0021: unknown main item tag 0x0 [ 538.120883][ T5970] logitech-djreceiver 0003:046D:C537.0021: unknown main item tag 0x0 [ 538.133406][ T5970] logitech-djreceiver 0003:046D:C537.0021: unknown main item tag 0x0 [ 538.160459][ T5970] logitech-djreceiver 0003:046D:C537.0021: unknown main item tag 0x0 [ 538.190052][ T5970] logitech-djreceiver 0003:046D:C537.0021: hidraw0: USB HID v10.00 Device [HID 046d:c537] on usb-dummy_hcd.5-1/input4 [ 538.293829][T11912] fuse: Unknown parameter 'ÿÿÿÿá·˜]ô&W"³|§’ÕS.ªª3E±$÷½8oãnŽ°Û`' [ 538.341238][ T29] kauditd_printk_skb: 30 callbacks suppressed [ 538.341259][ T29] audit: type=1326 audit(1776142449.934:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ddcd9c819 code=0x7ffc0000 [ 538.439639][T11915] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1663'. [ 538.474174][ T5970] usb 6-1: USB disconnect, device number 9 [ 538.484074][ T29] audit: type=1326 audit(1776142449.944:531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ddcd9c819 code=0x7ffc0000 [ 538.574868][ T29] audit: type=1326 audit(1776142449.944:532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f8ddcd9c819 code=0x7ffc0000 [ 538.715201][ T29] audit: type=1326 audit(1776142449.944:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ddcd9c819 code=0x7ffc0000 [ 539.020770][ T29] audit: type=1326 audit(1776142449.944:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f8ddcd9c819 code=0x7ffc0000 [ 539.090734][ T29] audit: type=1326 audit(1776142449.944:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ddcd9c819 code=0x7ffc0000 [ 539.327458][ T1639] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 539.351242][ T29] audit: type=1326 audit(1776142449.944:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f8ddcd9b687 code=0x7ffc0000 [ 539.381631][ T5950] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 539.471096][ T29] audit: type=1326 audit(1776142449.944:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7f8ddcd9da8a code=0x7ffc0000 [ 539.525440][T11938] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1669'. [ 539.541120][ T5950] usb 6-1: Using ep0 maxpacket: 32 [ 539.550545][ T1639] usb 5-1: unable to get BOS descriptor or descriptor too short [ 539.567458][ T5950] usb 6-1: New USB device found, idVendor=1039, idProduct=2120, bcdDevice= 2.a7 [ 539.573012][ T5970] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 539.577203][ T5950] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.602646][ T1639] usb 5-1: string descriptor 0 read error: -22 [ 539.617182][ T1639] usb 5-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice= 0.40 [ 539.631096][ T29] audit: type=1326 audit(1776142449.954:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8ddcd9c819 code=0x7ffc0000 [ 539.673769][ T1639] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.691061][ T5950] usb 6-1: Product: syz [ 539.699423][ T5970] hid-generic 0000:0000:0000.0022: hidraw0: HID v0.00 Device [syz1] on syz0 [ 539.702650][ T5950] usb 6-1: Manufacturer: syz [ 539.739905][ T1639] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 539.750734][ T29] audit: type=1326 audit(1776142449.954:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11907 comm="syz.2.1662" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f8ddcd5d04e code=0x7ffc0000 [ 539.781056][ T5950] usb 6-1: SerialNumber: syz [ 539.795216][ T5950] usb 6-1: config 0 descriptor?? [ 539.940043][ T1639] usb 5-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 540.138859][T11945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 540.181458][ T1639] usb 5-1: USB disconnect, device number 91 [ 540.208497][T11945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 540.341198][ T5950] usb 6-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2120) Rev (0X2A7): Eagle II [ 540.711439][ T5970] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 540.871600][ T5970] usb 2-1: Using ep0 maxpacket: 8 [ 540.879248][ T5970] usb 2-1: unable to get BOS descriptor or descriptor too short [ 540.888418][ T5970] usb 2-1: config 1 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 540.900195][ T5970] usb 2-1: config 1 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 540.914539][ T5970] usb 2-1: config 1 interface 0 has no altsetting 0 [ 540.923377][ T5970] usb 2-1: New USB device found, idVendor=05ac, idProduct=0254, bcdDevice= 0.40 [ 540.932861][ T5970] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 540.941836][ T5970] usb 2-1: Product: syz [ 540.946101][ T5970] usb 2-1: Manufacturer: syz [ 540.950740][ T5970] usb 2-1: SerialNumber: syz [ 540.993955][ T5950] usb 6-1: reset high-speed USB device number 10 using dummy_hcd [ 541.131500][ T5950] usb 6-1: device descriptor read/64, error -71 [ 541.165019][ T5970] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input42 [ 541.197685][ T5183] bcm5974 2-1:1.0: could not read from device [ 541.213928][ T5183] bcm5974 2-1:1.0: could not read from device [ 541.222639][ T5183] bcm5974 2-1:1.0: could not read from device [ 541.227214][ T5970] usb 2-1: USB disconnect, device number 120 [ 541.278990][T10466] udevd[10466]: Error opening device "/dev/input/event4": No such file or directory [ 541.290076][T11964] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1675'. [ 541.317581][T10466] udevd[10466]: Unable to EVIOCGABS device "/dev/input/event4" [ 541.325512][T10466] udevd[10466]: Unable to EVIOCGABS device "/dev/input/event4" [ 541.350775][T10466] udevd[10466]: Unable to EVIOCGABS device "/dev/input/event4" [ 541.369140][T10466] udevd[10466]: Unable to EVIOCGABS device "/dev/input/event4" [ 541.381560][ T5950] usb 6-1: reset high-speed USB device number 10 using dummy_hcd [ 541.521758][ T5950] usb 6-1: device descriptor read/64, error -71 [ 541.781102][ T5950] usb 6-1: reset high-speed USB device number 10 using dummy_hcd [ 541.811973][ T5950] usb 6-1: device descriptor read/8, error -71 [ 541.951456][ T5970] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 542.052285][ T5950] usb 6-1: reset high-speed USB device number 10 using dummy_hcd [ 542.101073][ T5970] usb 5-1: device descriptor read/64, error -71 [ 542.261100][ T5950] usb 6-1: device not accepting address 10, error -71 [ 542.275178][ T5950] usb 6-1: [UEAGLE-ATM] interface 1 not found [ 542.282502][ T5950] ueagle-atm 6-1:0.0: usbatm_usb_probe: bind failed: -19! [ 542.294586][ T5950] usb 6-1: USB disconnect, device number 10 [ 542.416481][ T5970] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 542.581092][ T5970] usb 5-1: device descriptor read/64, error -71 [ 542.693803][ T5970] usb usb5-port1: attempt power cycle [ 543.072016][ T5970] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 543.106877][ T5970] usb 5-1: device descriptor read/8, error -71 [ 543.215384][T11994] fuse: Bad value for 'fd' [ 543.247760][T11994] IPv6: NLM_F_REPLACE set, but no existing node found! [ 543.362562][ T5970] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 543.391560][ T5970] usb 5-1: device descriptor read/8, error -71 [ 543.512607][ T5970] usb usb5-port1: unable to enumerate USB device [ 543.531105][ T1639] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 543.582016][T12005] netlink: 204 bytes leftover after parsing attributes in process `syz.5.1690'. [ 543.599351][T12005] binder: 12002:12005 ioctl c0306201 200000000380 returned -14 [ 543.702694][ T1639] usb 3-1: Using ep0 maxpacket: 16 [ 543.718430][ T1639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 543.749548][ T1639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 543.785197][ T1639] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 543.831502][ T1639] usb 3-1: New USB device found, idVendor=045e, idProduct=9994, bcdDevice=fc.3c [ 543.864496][ T1639] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.933964][ T1639] usb 3-1: config 0 descriptor?? [ 544.016272][T12014] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1692'. [ 544.064282][T12015] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1692'. [ 544.399707][ T1639] hid-multitouch 0003:045E:9994.0023: unknown main item tag 0x2 [ 544.538386][ T1639] hid-multitouch 0003:045E:9994.0023: unknown main item tag 0x0 [ 544.554251][ T1639] hid-multitouch 0003:045E:9994.0023: unknown main item tag 0x0 [ 544.583822][ T1639] hid-multitouch 0003:045E:9994.0023: hidraw0: USB HID v0.00 Device [HID 045e:9994] on usb-dummy_hcd.2-1/input0 [ 544.623949][ T1639] usb 3-1: USB disconnect, device number 106 [ 544.791350][T12024] fido_id[12024]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 544.868513][T12032] netlink: 204 bytes leftover after parsing attributes in process `syz.1.1697'. [ 544.908938][T12032] binder: 12027:12032 ioctl c0306201 200000000380 returned -14 [ 546.641673][ T1335] wlan0: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 547.831129][ T5914] usb 3-1: new full-speed USB device number 107 using dummy_hcd [ 549.314884][T12079] loop2: detected capacity change from 0 to 7 [ 549.325866][T12079] Dev loop2: unable to read RDB block 7 [ 549.332081][T12079] loop2: unable to read partition table [ 549.338732][T12079] loop2: partition table beyond EOD, truncated [ 549.361634][ T5970] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 549.369466][T12079] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 549.541560][ T5970] usb 6-1: Using ep0 maxpacket: 32 [ 549.548955][ T5970] usb 6-1: config 0 has an invalid interface number: 151 but max is 0 [ 549.557748][ T5970] usb 6-1: config 0 has no interface number 0 [ 549.564428][ T5970] usb 6-1: config 0 interface 151 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 549.577744][ T5970] usb 6-1: New USB device found, idVendor=0499, idProduct=6bb7, bcdDevice=68.2f [ 549.588498][ T5970] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 549.597528][ T5970] usb 6-1: Product: syz [ 549.604382][ T5970] usb 6-1: Manufacturer: syz [ 549.609134][ T5970] usb 6-1: SerialNumber: syz [ 549.617919][T12088] vivid-004: disconnect [ 549.622459][ T5970] usb 6-1: config 0 descriptor?? [ 550.366278][T12087] vivid-004: reconnect [ 550.431665][ T1211] usb 2-1: new high-speed USB device number 121 using dummy_hcd [ 550.652193][ T1211] usb 2-1: Using ep0 maxpacket: 8 [ 550.660766][ T1211] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 550.679730][ T1211] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 550.696241][ T1211] usb 2-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 550.708151][ T1211] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.801895][ T1211] usb 2-1: config 0 descriptor?? [ 551.493597][T12110] netlink: 'syz.2.1725': attribute type 7 has an invalid length. [ 551.520220][T12110] netlink: 'syz.2.1725': attribute type 8 has an invalid length. [ 552.050274][ T1211] dragonrise 0003:0079:0006.0024: item fetching failed at offset 2/41 [ 552.100301][ T1211] dragonrise 0003:0079:0006.0024: parse failed [ 552.190003][ T1211] dragonrise 0003:0079:0006.0024: probe with driver dragonrise failed with error -22 [ 552.248522][ T5829] usb 5-1: new full-speed USB device number 96 using dummy_hcd [ 552.287297][T12120] loop2: detected capacity change from 0 to 7 [ 552.298751][ T5950] usb 2-1: USB disconnect, device number 121 [ 552.334285][T12120] Dev loop2: unable to read RDB block 7 [ 552.347995][T12120] loop2: unable to read partition table [ 552.355454][T12120] loop2: partition table beyond EOD, truncated [ 552.375602][T12120] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 552.416808][ T5970] usb 6-1: USB disconnect, device number 11 [ 552.427266][ T5829] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 552.472525][ T5829] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 552.489935][ T5837] udevd[5837]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.151/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 552.515755][ T5829] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 552.536310][ T5829] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.806140][ T5829] usb 5-1: usb_control_msg returned -32 [ 552.853585][ T5829] usbtmc 5-1:16.0: can't read capabilities [ 553.046281][T12136] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 553.074579][T12133] syzkaller0: entered promiscuous mode [ 553.080110][T12133] syzkaller0: entered allmulticast mode [ 553.271139][ T5829] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 553.441131][ T5829] usb 2-1: Using ep0 maxpacket: 8 [ 553.449033][ T5829] usb 2-1: config 2 has an invalid interface number: 31 but max is 0 [ 553.458170][ T5829] usb 2-1: config 2 has no interface number 0 [ 553.464607][ T5829] usb 2-1: config 2 interface 31 has no altsetting 0 [ 553.474746][ T5829] usb 2-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 553.485312][ T5829] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 553.493644][ T5829] usb 2-1: Product: syz [ 553.507602][ T5829] usb 2-1: Manufacturer: syz [ 553.512542][ T5829] usb 2-1: SerialNumber: syz [ 553.790603][T12144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 553.800291][T12144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 554.891052][ T5829] ch9200 2-1:2.31: probe with driver ch9200 failed with error -22 [ 554.913292][ T5914] usb 5-1: USB disconnect, device number 96 [ 555.022114][T12138] tipc: Enabled bearer , priority 0 [ 555.030389][T12139] syzkaller0: entered promiscuous mode [ 555.036090][T12139] syzkaller0: entered allmulticast mode [ 555.043174][ T5829] usb 2-1: USB disconnect, device number 122 [ 555.080391][T12142] tipc: Resetting bearer [ 555.088060][T12130] tipc: Resetting bearer [ 555.148990][T12130] tipc: Disabling bearer [ 555.367127][T12160] loop2: detected capacity change from 0 to 7 [ 555.374701][T12160] Dev loop2: unable to read RDB block 7 [ 555.380334][T12160] loop2: unable to read partition table [ 555.387081][T12160] loop2: partition table beyond EOD, truncated [ 555.394749][T12160] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 555.474435][T12162] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1738'. [ 555.916053][T12169] ipt_REJECT: ECHOREPLY no longer supported. [ 556.512553][T12174] loop2: detected capacity change from 0 to 7 [ 556.557509][T12177] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1745'. [ 556.577135][T12174] Dev loop2: unable to read RDB block 7 [ 556.596827][T12174] loop2: unable to read partition table [ 556.623108][T12174] loop2: partition table beyond EOD, truncated [ 556.629450][T12174] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 558.791062][ T5970] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 559.002121][ T5970] usb 6-1: Using ep0 maxpacket: 8 [ 559.009110][ T5970] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 559.022619][ T5970] usb 6-1: New USB device found, idVendor=17a1, idProduct=0128, bcdDevice= 5.f6 [ 559.039746][ T5970] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.067322][ T5970] usb 6-1: Product: syz [ 559.078256][ T5970] usb 6-1: Manufacturer: syz [ 559.093706][ T5970] usb 6-1: SerialNumber: syz [ 559.159552][ T5970] usb 6-1: config 0 descriptor?? [ 559.188627][ T5970] gspca_main: t613-2.14.0 probing 17a1:0128 [ 559.273417][T12217] loop2: detected capacity change from 0 to 7 [ 559.282906][T12217] Dev loop2: unable to read RDB block 7 [ 559.288568][T12217] loop2: unable to read partition table [ 559.299124][T12217] loop2: partition table beyond EOD, truncated [ 559.309053][T12217] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 559.516409][ T5970] gspca_t613: unknown sensor 0000 [ 559.524894][ T5970] t613 6-1:0.0: probe with driver t613 failed with error -22 [ 559.596008][ T1639] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 559.817969][ T1639] usb 2-1: Using ep0 maxpacket: 32 [ 559.910612][ T1639] usb 2-1: config 0 has an invalid interface number: 89 but max is 0 [ 559.921676][ T1639] usb 2-1: config 0 has no interface number 0 [ 559.937659][ T1639] usb 2-1: config 0 interface 89 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 559.939475][ T5970] usb 6-1: USB disconnect, device number 12 [ 559.962904][ T1639] usb 2-1: config 0 interface 89 has no altsetting 0 [ 560.067489][ T1639] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4a [ 560.077120][ T1639] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 560.097187][ T1639] usb 2-1: Product: syz [ 560.132313][ T1639] usb 2-1: Manufacturer: syz [ 560.153020][ T1639] usb 2-1: SerialNumber: syz [ 560.170388][T12228] syzkaller0: entered promiscuous mode [ 560.176157][T12228] syzkaller0: entered allmulticast mode [ 560.225762][ T1639] usb 2-1: config 0 descriptor?? [ 560.314391][ T1639] em28xx 2-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 560.439727][ T1639] em28xx 2-1:0.89: Video interface 89 found: [ 560.516746][T12219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.527684][T12219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.743672][T12219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.755790][T12233] syzkaller0: entered promiscuous mode [ 560.769984][T12219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 560.780662][T12233] syzkaller0: entered allmulticast mode [ 560.791413][T12219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 560.807673][T12219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.029181][T12219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.122088][T12219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.274098][T12219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 561.291673][T12219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 561.348555][T12219] xt_hashlimit: size too large, truncated to 1048576 [ 561.655452][ T1639] em28xx 2-1:0.89: unknown em28xx chip ID (0) [ 561.724868][ T1639] em28xx 2-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 561.741139][ T1639] em28xx 2-1:0.89: board has no eeprom [ 561.801132][ T1639] em28xx 2-1:0.89: Identified as Terratec Grabby (card=67) [ 561.808573][ T1639] em28xx 2-1:0.89: analog set to bulk mode. [ 561.821113][ T5950] em28xx 2-1:0.89: Registering V4L2 extension [ 561.845453][ T1639] usb 2-1: USB disconnect, device number 123 [ 561.879074][ T1639] em28xx 2-1:0.89: Disconnecting em28xx [ 561.939662][ T5950] em28xx 2-1:0.89: Config register raw data: 0xffffffed [ 561.961053][ T5950] em28xx 2-1:0.89: AC97 chip type couldn't be determined [ 561.979965][ T5950] em28xx 2-1:0.89: No AC97 audio processor [ 562.019712][ T5950] usb 2-1: Decoder not found [ 562.029365][ T5950] em28xx 2-1:0.89: failed to create media graph [ 562.049600][ T5950] em28xx 2-1:0.89: V4L2 device video103 deregistered [ 562.121360][ T5950] em28xx 2-1:0.89: Registering snapshot button... [ 562.139852][ T5950] input: em28xx snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.89/input/input43 [ 562.208791][ T5950] em28xx 2-1:0.89: Remote control support is not available for this card. [ 562.251147][ T1639] em28xx 2-1:0.89: Closing input extension [ 562.262923][ T1639] em28xx 2-1:0.89: Deregistering snapshot button [ 562.334066][ T1639] em28xx 2-1:0.89: Freeing device [ 563.297553][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.306840][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 565.010513][T12278] [U]  [ 565.690304][T12293] input: syz1 as /devices/virtual/input/input45 [ 565.703013][T12293] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1777'. [ 565.882251][T12295] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 565.893659][T12295] batadv1: entered promiscuous mode [ 565.902531][T12295] team0: Port device batadv1 added [ 566.687263][T12311] tipc: Enabling of bearer rejected, already enabled [ 566.750304][ T5950] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 566.820823][T12313] loop4: detected capacity change from 0 to 7 [ 566.867829][T12313] Dev loop4: unable to read RDB block 7 [ 566.893229][T12313] loop4: AHDI p1 p2 [ 566.897954][T12313] loop4: partition table partially beyond EOD, truncated [ 566.906220][T12313] loop4: p1 start 1835360114 is beyond EOD, truncated [ 566.931405][ T5950] usb 6-1: Using ep0 maxpacket: 32 [ 566.943867][ T5950] usb 6-1: config 0 has an invalid interface number: 85 but max is 0 [ 566.968012][ T5950] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.001258][ T5950] usb 6-1: config 0 has no interface number 0 [ 567.017723][ T5950] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x8 has invalid maxpacket 512, setting to 64 [ 567.050799][ T5950] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 567.077074][ T5950] usb 6-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 567.103520][ T5950] usb 6-1: config 0 interface 85 altsetting 7 has 6 endpoint descriptors, different from the interface descriptor's value: 7 [ 567.119711][ T5950] usb 6-1: config 0 interface 85 has no altsetting 0 [ 567.137545][ T5950] usb 6-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 567.148612][ T5950] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.158476][ T5950] usb 6-1: Product: syz [ 567.163107][ T5950] usb 6-1: Manufacturer: syz [ 567.167893][ T5950] usb 6-1: SerialNumber: syz [ 567.186468][ T5950] usb 6-1: config 0 descriptor?? [ 567.210278][ T5198] Dev loop4: unable to read RDB block 7 [ 567.216185][ T5198] loop4: AHDI p1 p2 [ 567.220289][ T5198] loop4: partition table partially beyond EOD, truncated [ 567.229515][ T5198] loop4: p1 start 1835360114 is beyond EOD, truncated [ 567.241574][ T1639] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 567.360611][T12322] syzkaller0: entered promiscuous mode [ 567.367883][T12322] syzkaller0: entered allmulticast mode [ 567.401166][ T1639] usb 2-1: Using ep0 maxpacket: 8 [ 567.428612][ T1639] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 567.453448][ T5950] appletouch 6-1:0.85: Failed to read mode from device. [ 567.473102][ T1639] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.485674][ T5950] appletouch 6-1:0.85: probe with driver appletouch failed with error -5 [ 567.502814][ T1639] usb 2-1: Product: syz [ 567.507213][ T1639] usb 2-1: Manufacturer: syz [ 567.512930][ T1639] usb 2-1: SerialNumber: syz [ 567.551260][ T5950] usb 6-1: USB disconnect, device number 13 [ 567.569333][ T1639] usb 2-1: config 0 descriptor?? [ 567.649433][T12314] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 567.673196][T12314] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 567.699954][T12314] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 567.709692][T12314] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 567.812864][ T1639] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 570.164938][ T1639] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 570.276939][ T5970] usb 2-1: USB disconnect, device number 124 [ 570.286780][T12314] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 570.316352][T12314] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 570.498733][T12314] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 570.515294][T12314] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 570.857742][T12376] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1797'. [ 570.913667][T12376] net_ratelimit: 10 callbacks suppressed [ 570.913692][T12376] openvswitch: netlink: Flow key attr not present in new flow. [ 571.032379][T12386] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 571.040781][T12386] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 571.120727][T12386] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 572.316526][T12408] syzkaller0: entered promiscuous mode [ 572.327718][T12408] syzkaller0: entered allmulticast mode [ 573.160155][T12421] loop2: detected capacity change from 0 to 7 [ 573.233740][T12426] Dev loop2: unable to read RDB block 7 [ 573.239405][T12426] loop2: unable to read partition table [ 573.246190][T12426] loop2: partition table beyond EOD, truncated [ 573.254239][T12421] Dev loop2: unable to read RDB block 7 [ 573.279478][T12421] loop2: unable to read partition table [ 573.291268][T12421] loop2: partition table beyond EOD, truncated [ 573.332605][T12421] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 573.377212][ T5198] Dev loop2: unable to read RDB block 7 [ 573.387888][ T5198] loop2: unable to read partition table [ 573.411537][ T5198] loop2: partition table beyond EOD, truncated [ 574.061184][ T10] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 574.225313][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 574.238714][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 574.251339][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 574.268720][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.294088][ T10] usb 3-1: Product: syz [ 574.298328][ T10] usb 3-1: Manufacturer: syz [ 574.303361][ T10] usb 3-1: SerialNumber: syz [ 574.333880][ T10] usb 3-1: config 0 descriptor?? [ 574.350227][ T10] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 574.359719][ T10] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 574.973561][ T10] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 575.419558][ T10] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 575.430497][ T10] em28xx 3-1:0.0: board has no eeprom [ 575.531177][ T10] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 575.559659][ T10] em28xx 3-1:0.0: dvb set to bulk mode. [ 575.602168][ T1639] em28xx 3-1:0.0: Binding DVB extension [ 575.644000][ T10] usb 3-1: USB disconnect, device number 108 [ 575.701109][ T1639] em28xx 3-1:0.0: Registering input extension [ 575.711333][ T10] em28xx 3-1:0.0: Disconnecting em28xx [ 575.724280][ T10] em28xx 3-1:0.0: Closing input extension [ 575.765203][ T10] em28xx 3-1:0.0: Freeing device [ 576.018585][T12467] use of bytesused == 0 is deprecated and will be removed in the future, [ 576.032931][T12467] use the actual size instead. [ 576.122822][ T1639] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 576.271169][ T1639] usb 6-1: Using ep0 maxpacket: 32 [ 576.288617][ T1639] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 576.302006][ T1639] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 576.331086][ T1639] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 576.355645][ T1639] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 576.395450][ T1639] usb 6-1: config 1 has no interface number 0 [ 576.408938][ T1639] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 576.447056][ T1639] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 576.480971][ T1639] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 576.594881][T12484] loop2: detected capacity change from 0 to 7 [ 576.609033][ T5837] loop2: [ 576.621073][ T5837] loop2: partition table partially beyond EOD, truncated [ 576.633802][T12484] loop2: [ 576.636819][T12484] loop2: partition table partially beyond EOD, truncated [ 576.755691][ T10] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 576.958725][ T10] usb 3-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 576.969793][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.038936][ T10] usb 3-1: Product: syz [ 577.054180][ T10] usb 3-1: Manufacturer: syz [ 577.058887][ T10] usb 3-1: SerialNumber: syz [ 577.097229][ T10] usb 3-1: config 0 descriptor?? [ 577.114254][ T10] i2c-tiny-usb 3-1:0.0: version 6d.cc found at bus 003 address 109 [ 577.276474][T12499] tipc: Started in network mode [ 577.285810][T12499] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 577.301710][T12499] tipc: New replicast peer: 0000:0000:0000:0000:0000:0000:0001:0600 [ 577.327465][T12502] RDS: rds_bind could not find a transport for ::ffff:100.1.1.1, load rds_tcp or rds_rdma? [ 577.334381][T12499] tipc: Enabled bearer , priority 10 [ 577.364651][T12477] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1818'. [ 577.481593][ T10] (null): failure setting delay to 10us [ 577.488929][ T10] i2c-tiny-usb 3-1:0.0: probe with driver i2c-tiny-usb failed with error -5 [ 577.536218][ T10] usb 3-1: USB disconnect, device number 109 [ 577.998241][T12514] loop2: detected capacity change from 0 to 7 [ 578.029671][T12514] Dev loop2: unable to read RDB block 7 [ 578.046464][T12514] loop2: unable to read partition table [ 578.101474][T12514] loop2: partition table beyond EOD, truncated [ 578.114549][T12514] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 578.201893][ T5198] Dev loop2: unable to read RDB block 7 [ 578.214315][ T5198] loop2: unable to read partition table [ 578.222545][ T5198] loop2: partition table beyond EOD, truncated [ 578.321136][ T5970] tipc: Node number set to 1 [ 578.444392][T12521] syzkaller0: entered promiscuous mode [ 578.460208][T12521] syzkaller0: entered allmulticast mode [ 578.944513][ T1639] snd_usb_pod 6-1:1.1: set_interface failed [ 578.976690][ T1639] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 579.016753][ T1639] snd_usb_pod 6-1:1.1: probe with driver snd_usb_pod failed with error -71 [ 579.064276][T12536] loop2: detected capacity change from 0 to 7 [ 579.091254][ T1639] usb 6-1: USB disconnect, device number 14 [ 579.116324][ T5837] loop2: [ 579.141123][ T5837] loop2: partition table partially beyond EOD, truncated [ 579.170760][T12536] loop2: [ 579.175985][T12536] loop2: partition table partially beyond EOD, truncated [ 579.547742][T12546] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1834'. [ 579.817835][T12548] tipc: Enabling of bearer rejected, already enabled [ 580.057673][T12552] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1839'. [ 580.402231][ T5950] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 580.601299][ T5950] usb 5-1: unable to get BOS descriptor or descriptor too short [ 580.617496][ T5950] usb 5-1: config 9 has an invalid interface number: 242 but max is 0 [ 580.626455][ T5950] usb 5-1: config 9 has no interface number 0 [ 580.637286][ T5950] usb 5-1: config 9 interface 242 has no altsetting 0 [ 580.648521][ T5950] usb 5-1: New USB device found, idVendor=0af0, idProduct=7041, bcdDevice=d0.f9 [ 580.658265][ T5950] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 580.677166][ T5950] usb 5-1: Product: syz [ 580.684652][ T5950] usb 5-1: Manufacturer: syz [ 580.705850][ T5950] usb 5-1: SerialNumber: syz [ 581.000831][ T5950] usb 5-1: USB disconnect, device number 97 [ 581.587548][T12581] tipc: Enabling of bearer rejected, already enabled [ 581.651736][ T1639] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 581.817618][T12586] syzkaller0: entered promiscuous mode [ 581.823859][T12586] syzkaller0: entered allmulticast mode [ 581.843761][ T1639] usb 3-1: config 0 has an invalid interface number: 64 but max is 0 [ 581.853020][ T1639] usb 3-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config [ 581.868028][ T1639] usb 3-1: config 0 has no interface number 0 [ 581.881483][ T1639] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 581.893635][ T1639] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 581.934341][ T1639] usb 3-1: Product: syz [ 581.940737][ T1639] usb 3-1: Manufacturer: syz [ 581.946059][ T1639] usb 3-1: SerialNumber: syz [ 581.956935][ T1639] usb 3-1: config 0 descriptor?? [ 581.996034][ T1639] uvcvideo 3-1:0.64: probe with driver uvcvideo failed with error -22 [ 582.402641][ T1211] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 582.541311][ T1211] usb 6-1: device descriptor read/64, error -71 [ 582.724052][T12597] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1854'. [ 582.751170][ T1639] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 582.781344][ T1211] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 582.911604][ T1639] usb 2-1: Using ep0 maxpacket: 16 [ 582.911601][ T1211] usb 6-1: device descriptor read/64, error -71 [ 582.930256][ T1639] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 582.944311][ T1639] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 582.963866][ T1639] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 582.979557][ T1639] usb 2-1: Product: syz [ 582.984349][ T1639] usb 2-1: Manufacturer: syz [ 582.989983][ T1639] usb 2-1: SerialNumber: syz [ 583.000261][ T1639] usb 2-1: config 0 descriptor?? [ 583.016706][ T1639] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 583.026432][ T1211] usb usb6-port1: attempt power cycle [ 583.032130][ T1639] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 583.377757][ T1211] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 583.403791][ T1211] usb 6-1: device descriptor read/8, error -71 [ 583.626882][ T1639] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 583.661047][ T1211] usb 6-1: new full-speed USB device number 18 using dummy_hcd [ 583.721833][ T1211] usb 6-1: device descriptor read/8, error -71 [ 583.841617][ T1211] usb usb6-port1: unable to enumerate USB device [ 584.049125][ T1639] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 584.077275][ T1639] em28xx 2-1:0.0: board has no eeprom [ 584.211041][ T1639] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 584.227727][ T1639] em28xx 2-1:0.0: dvb set to bulk mode. [ 584.234092][ T5950] em28xx 2-1:0.0: Binding DVB extension [ 584.269866][ T1639] usb 2-1: USB disconnect, device number 125 [ 584.295978][ T1639] em28xx 2-1:0.0: Disconnecting em28xx [ 584.339221][ T5950] em28xx 2-1:0.0: Registering input extension [ 584.348546][ T1639] em28xx 2-1:0.0: Closing input extension [ 584.406325][ T1639] em28xx 2-1:0.0: Freeing device [ 584.467450][ T1211] usb 3-1: USB disconnect, device number 110 [ 584.481630][ T5970] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 584.651076][ T5970] usb 5-1: Using ep0 maxpacket: 8 [ 584.658582][ T5970] usb 5-1: config 0 has an invalid descriptor of length 187, skipping remainder of the config [ 584.669445][ T5970] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 584.678954][ T5970] usb 5-1: New USB device found, idVendor=0458, idProduct=5014, bcdDevice= 0.00 [ 584.688956][ T5970] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 584.742305][T12626] netlink: 204 bytes leftover after parsing attributes in process `syz.1.1861'. [ 584.760762][T12626] binder: BINDER_SET_CONTEXT_MGR already set [ 584.766906][T12626] binder: 12621:12626 ioctl 4018620d 200000004a80 returned -16 [ 584.787376][T12626] binder: 12621:12626 ioctl c0306201 200000000380 returned -14 [ 584.879839][T12625] netlink: 'syz.2.1860': attribute type 1 has an invalid length. [ 584.988922][ T5970] usb 5-1: config 0 descriptor?? [ 585.124846][T12625] 8021q: adding VLAN 0 to HW filter on device bond6 [ 585.137102][T12628] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 585.155160][ T1327] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 585.178789][T12628] bond6: (slave batadv0): Enslaving as an active interface with an up link [ 585.364279][ T1335] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 585.710121][T12633] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=34144512 (68289024 ns) > initial count (35652132 ns). Using initial count to start timer. [ 585.871293][ T1211] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 586.023145][ T1211] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 586.035417][ T1211] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 586.063437][ T1211] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 586.090184][ T1211] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.139349][ T1211] usb 6-1: config 0 descriptor?? [ 586.269964][T12641] netlink: 'syz.1.1865': attribute type 1 has an invalid length. [ 586.323352][T12644] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1865'. [ 586.340021][T12641] bond12: entered promiscuous mode [ 586.432926][T12644] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1865'. [ 586.538211][T12641] 8021q: adding VLAN 0 to HW filter on device bond12 [ 586.569715][ T1211] keytouch 0003:0926:3333.0025: fixing up Keytouch IEC report descriptor [ 586.605107][ T1211] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.0025/input/input49 [ 586.753998][T12647] syzkaller0: entered promiscuous mode [ 586.772206][T12647] syzkaller0: entered allmulticast mode [ 586.786914][ T1211] keytouch 0003:0926:3333.0025: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 586.907279][T12636] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1863'. [ 587.058293][ T5950] usb 6-1: USB disconnect, device number 19 [ 587.407476][ T1639] usb 5-1: USB disconnect, device number 98 [ 587.489399][T12658] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 587.506646][ T1211] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 587.519625][T12659] netlink: 204 bytes leftover after parsing attributes in process `syz.6.1868'. [ 587.534716][T12659] binder: BINDER_SET_CONTEXT_MGR already set [ 587.541018][T12659] binder: 12653:12659 ioctl 4018620d 200000004a80 returned -16 [ 587.553417][T12659] binder: 12653:12659 ioctl c0306201 200000000380 returned -14 [ 587.650265][T12658] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 587.822150][ T1211] usb 2-1: config index 0 descriptor too short (expected 20004, got 36) [ 587.837791][ T1211] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 587.878995][ T1211] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 587.918560][ T1211] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 587.970895][ T1211] usb 2-1: config 0 descriptor?? [ 588.018495][ T1211] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 588.191231][ T5970] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 588.238471][T12652] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 588.249091][T12652] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 588.691354][ T5970] usb 5-1: Using ep0 maxpacket: 16 [ 588.698314][ T5970] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 588.752341][ T42] usb 6-1: new full-speed USB device number 20 using dummy_hcd [ 588.772705][ T5970] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 588.790514][ T5970] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.814532][ T5970] usb 5-1: Product: syz [ 588.826915][ T5970] usb 5-1: Manufacturer: syz [ 588.839740][ T5970] usb 5-1: SerialNumber: syz [ 588.868129][ T5970] usb 5-1: config 0 descriptor?? [ 588.898213][ T5970] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 588.913348][ T42] usb 6-1: device descriptor read/64, error -71 [ 588.947577][ T5970] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 589.181121][ T42] usb 6-1: new full-speed USB device number 21 using dummy_hcd [ 589.311234][ T42] usb 6-1: device descriptor read/64, error -71 [ 589.421717][ T42] usb usb6-port1: attempt power cycle [ 589.504304][ T5970] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 589.781834][ T42] usb 6-1: new full-speed USB device number 22 using dummy_hcd [ 589.834548][ T42] usb 6-1: device descriptor read/8, error -71 [ 589.919980][ T5970] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 589.928476][ T5970] em28xx 5-1:0.0: board has no eeprom [ 589.991061][ T5970] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 589.999026][ T5970] em28xx 5-1:0.0: dvb set to bulk mode. [ 590.009979][ T1211] em28xx 5-1:0.0: Binding DVB extension [ 590.037278][ T5970] usb 5-1: USB disconnect, device number 99 [ 590.059004][ T5970] em28xx 5-1:0.0: Disconnecting em28xx [ 590.091215][ T42] usb 6-1: new full-speed USB device number 23 using dummy_hcd [ 590.124462][ T42] usb 6-1: device descriptor read/8, error -71 [ 590.150299][ T1211] em28xx 5-1:0.0: Registering input extension [ 590.157910][ T5970] em28xx 5-1:0.0: Closing input extension [ 590.183847][ T5970] em28xx 5-1:0.0: Freeing device [ 590.231491][ T42] usb usb6-port1: unable to enumerate USB device [ 590.631091][ T10] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 590.783441][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 590.798198][ T10] usb 3-1: New USB device found, idVendor=0403, idProduct=6010, bcdDevice= 1.41 [ 590.823639][ T10] usb 3-1: New USB device strings: Mfr=0, Product=246, SerialNumber=2 [ 590.881347][ T5950] usb 2-1: USB disconnect, device number 126 [ 590.910725][ T10] usb 3-1: Product: syz [ 590.915557][ T10] usb 3-1: SerialNumber: syz [ 590.935974][ T10] usb 3-1: config 0 descriptor?? [ 590.952462][ T10] ftdi_sio 3-1:0.0: FTDI USB Serial Device converter detected [ 590.987572][ T10] usb 3-1: Detected SIO [ 591.009194][ T10] usb 3-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 591.181683][T12699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 591.220392][T12699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 591.237913][ T5970] usb 3-1: USB disconnect, device number 111 [ 591.248372][ T5970] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 591.292486][ T5970] ftdi_sio 3-1:0.0: device disconnected [ 591.409538][T12721] loop2: detected capacity change from 0 to 7 [ 591.426515][ T5837] Dev loop2: unable to read RDB block 7 [ 591.432418][ T5837] loop2: unable to read partition table [ 591.438391][ T5837] loop2: partition table beyond EOD, truncated [ 591.460538][T12721] Dev loop2: unable to read RDB block 7 [ 591.505394][T12721] loop2: unable to read partition table [ 591.515659][T12721] loop2: partition table beyond EOD, truncated [ 591.653893][T12722] gtp0: entered promiscuous mode [ 591.659181][T12722] team0: Device gtp0 is of different type [ 591.681021][T12721] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 591.960960][T12730] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1888'. [ 592.011125][ T42] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 592.171363][ T42] usb 6-1: Using ep0 maxpacket: 16 [ 592.333764][ T42] usb 6-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 592.343144][ T42] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 592.359473][ T42] usb 6-1: config 0 descriptor?? [ 592.374717][ T42] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 592.621100][ T5970] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 592.791070][ T5970] usb 3-1: Using ep0 maxpacket: 16 [ 592.800462][ T5970] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 592.870481][ T5970] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 592.880016][ T5970] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.898899][ T5970] usb 3-1: Product: syz [ 592.908712][ T5970] usb 3-1: Manufacturer: syz [ 592.919009][ T5970] usb 3-1: SerialNumber: syz [ 592.935399][ T5970] usb 3-1: config 0 descriptor?? [ 592.950000][ T5970] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 592.963743][ T5970] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 593.209862][ T10] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 593.301613][ T42] gspca_sonixj: reg_w1 err -110 [ 593.466375][ T42] sonixj 6-1:0.0: probe with driver sonixj failed with error -110 [ 593.510879][ T10] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 593.534836][ T10] usb 5-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 593.552869][ T5970] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 593.583648][T12743] loop2: detected capacity change from 0 to 7 [ 593.591738][T12743] loop2: [ 593.594761][T12743] loop2: partition table partially beyond EOD, truncated [ 593.628924][ T10] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 593.659839][ T10] usb 5-1: config 220 has no interface number 2 [ 593.676400][ T10] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 593.714244][ T10] usb 5-1: config 220 interface 0 has no altsetting 0 [ 593.721738][ T10] usb 5-1: config 220 interface 76 has no altsetting 0 [ 593.728807][ T10] usb 5-1: config 220 interface 1 has no altsetting 0 [ 593.739404][ T10] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 593.760063][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.799539][ T10] usb 5-1: Product: syz [ 593.804358][ T10] usb 5-1: Manufacturer: syz [ 593.809466][ T10] usb 5-1: SerialNumber: syz [ 593.967452][ T5970] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 593.975880][ T5970] em28xx 3-1:0.0: board has no eeprom [ 594.041073][ T5970] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 594.049025][ T5970] em28xx 3-1:0.0: dvb set to bulk mode. [ 594.058808][ T5829] em28xx 3-1:0.0: Binding DVB extension [ 594.078147][ T5970] usb 3-1: USB disconnect, device number 112 [ 594.096007][ T5970] em28xx 3-1:0.0: Disconnecting em28xx [ 594.105811][T12735] erspan0: entered promiscuous mode [ 594.113399][T12735] vlan2: entered promiscuous mode [ 594.193832][ T5829] em28xx 3-1:0.0: Registering input extension [ 594.200703][ T5970] em28xx 3-1:0.0: Closing input extension [ 594.227869][ T5970] em28xx 3-1:0.0: Freeing device [ 595.017424][ T5950] usb 6-1: USB disconnect, device number 24 [ 595.331373][ T5829] usb 2-1: new full-speed USB device number 127 using dummy_hcd [ 595.461466][ T5829] usb 2-1: device descriptor read/64, error -71 [ 595.721243][ T5829] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 595.783393][ T10] usb 5-1: selecting invalid altsetting 0 [ 595.789916][ T10] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 595.819310][T12767] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1900'. [ 595.838684][ T10] uvcvideo 5-1:220.0: No valid video chain found. [ 595.843742][T12767] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1900'. [ 595.891068][ T5829] usb 2-1: device descriptor read/64, error -71 [ 595.935368][ T10] usb 5-1: selecting invalid altsetting 0 [ 595.963573][ T10] usbtest 5-1:220.1: probe with driver usbtest failed with error -22 [ 596.003080][ T5829] usb usb2-port1: attempt power cycle [ 596.025194][ T10] usb 5-1: USB disconnect, device number 100 [ 596.402550][ T5829] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 596.478211][ T5829] usb 2-1: device descriptor read/8, error -71 [ 596.545463][T12775] usb usb8: usbfs: interface 0 claimed by hub while 'syz.2.1901' sets config #2 [ 596.731449][ T5829] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 596.751864][ T5829] usb 2-1: device descriptor read/8, error -71 [ 596.861483][ T5829] usb usb2-port1: unable to enumerate USB device [ 598.576025][ T5829] IPVS: starting estimator thread 0... [ 598.794613][T12804] IPVS: using max 42 ests per chain, 100800 per kthread [ 599.342491][T12814] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1911'. [ 599.526277][T12816] loop2: detected capacity change from 0 to 7 [ 599.536768][ T5837] loop2: [ 599.539769][ T5837] loop2: partition table partially beyond EOD, truncated [ 599.553447][T12816] loop2: [ 599.556435][T12816] loop2: partition table partially beyond EOD, truncated [ 599.676000][T12818] syzkaller0: entered promiscuous mode [ 599.692493][T12818] syzkaller0: entered allmulticast mode [ 599.714533][T12821] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1915'. [ 599.880086][T12826] netlink: 'syz.2.1917': attribute type 3 has an invalid length. [ 599.890565][T12826] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1917'. [ 599.900268][T12826] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1917'. [ 600.102693][T12842] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1920'. [ 600.133878][ T1639] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 600.164570][T12845] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1920'. [ 600.294331][ T1639] usb 5-1: Using ep0 maxpacket: 8 [ 600.321298][ T1639] usb 5-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 600.333916][ T1639] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x93, changing to 0x83 [ 600.348680][ T1639] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 600.370259][ T1639] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 600.415025][ T1639] usb 5-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 600.433204][ T1639] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.436964][T12849] netlink: 'syz.6.1922': attribute type 11 has an invalid length. [ 600.442423][ T1639] usb 5-1: Product: syz [ 600.453569][ T1639] usb 5-1: Manufacturer: syz [ 600.458208][ T1639] usb 5-1: SerialNumber: syz [ 600.469012][ T1639] usb 5-1: config 0 descriptor?? [ 600.489803][ C0] imon 5-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 600.508532][ T1639] input: iMON Panel, Knob and Mouse(15c2:003b) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input52 [ 600.521550][ T5829] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 600.673673][ T5829] usb 6-1: Using ep0 maxpacket: 16 [ 600.698134][ T5829] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 33437, setting to 1024 [ 600.710129][ T5829] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0xF has invalid maxpacket 1024 [ 600.728772][ T5829] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 600.759154][ T5829] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 600.804606][ T5829] usb 6-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87 [ 600.811772][ T1639] rc_core: IR keymap rc-imon-pad not found [ 600.814180][ T5829] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.820137][ T1639] Registered IR keymap rc-empty [ 600.830037][ T5829] usb 6-1: Product: syz [ 600.846484][ T1639] imon 5-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 600.847709][ T5829] usb 6-1: Manufacturer: syz [ 600.860171][ T1639] imon 5-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 600.866060][ T5829] usb 6-1: SerialNumber: syz [ 600.900448][ T5829] usb 6-1: config 0 descriptor?? [ 600.906699][T12847] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 600.932137][ T5829] port100 6-1:0.0: NFC: Could not get supported command types [ 601.154634][ T10] usb 6-1: USB disconnect, device number 25 [ 601.970027][T12842] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 602.002048][T12845] bond7: peer notification delay (2365) is not a multiple of miimon (4), value rounded to 2364 ms [ 602.429405][T12875] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1927'. [ 602.492765][ T10] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 602.654845][ T10] usb 2-1: New USB device found, idVendor=0a2c, idProduct=0008, bcdDevice=c7.b3 [ 602.664509][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 602.672753][ T10] usb 2-1: Product: syz [ 602.677201][ T10] usb 2-1: Manufacturer: syz [ 602.686812][ T10] usb 2-1: config 0 descriptor?? [ 602.695971][ T10] cypress_cy7c63 2-1:0.0: Cypress CY7C63xxx device now attached [ 602.976133][ T10] usb 2-1: USB disconnect, device number 5 [ 602.990218][ T10] cypress_cy7c63 2-1:0.0: Cypress CY7C63xxx device now disconnected [ 603.087076][ T29] kauditd_printk_skb: 43 callbacks suppressed [ 603.087095][ T29] audit: type=1326 audit(1776142514.734:583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12882 comm="syz.2.1930" exe="/root/syz-executor" sig=31 arch=c000003e syscall=317 compat=0 ip=0x7f8ddcd9c819 code=0x7ffb0000 [ 603.328989][ T1639] imon:send_packet: packet tx failed (-71) [ 603.351131][ T10] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 603.371502][ T1639] imon 5-1:0.0: remote input dev register failed [ 603.379275][ T1639] imon 5-1:0.0: imon_init_intf0: rc device setup failed [ 603.423049][ T1639] imon 5-1:0.0: unable to initialize intf0, err 0 [ 603.429508][ T1639] imon:imon_probe: failed to initialize context! [ 603.451687][ T1639] imon 5-1:0.0: unable to register, err -19 [ 603.471076][ T5829] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 603.481241][ T1639] usb 5-1: USB disconnect, device number 101 [ 603.516893][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 603.541645][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 603.561159][ T10] usb 2-1: New USB device found, idVendor=1c4f, idProduct=0059, bcdDevice= 0.00 [ 603.570295][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.593082][ T10] usb 2-1: config 0 descriptor?? [ 603.633478][ T5829] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 603.645174][ T5829] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 603.657105][ T5829] usb 6-1: New USB device found, idVendor=0582, idProduct=0582, bcdDevice= 0.40 [ 603.667764][ T5829] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.676502][ T5829] usb 6-1: Product: syz [ 603.680917][ T5829] usb 6-1: Manufacturer: syz [ 603.686003][ T5829] usb 6-1: SerialNumber: syz [ 603.791057][ T1639] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 603.807047][T12890] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 603.817092][T12890] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 603.893392][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 603.899447][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 603.926963][ T5829] usb 6-1: unit 132 not found! [ 603.956011][ T10] usb 2-1: USB disconnect, device number 6 [ 603.962011][ T1639] usb 5-1: Using ep0 maxpacket: 16 [ 603.970562][ T1639] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 604.021817][ T1639] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 604.030911][ T1639] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.071017][ T1639] usb 5-1: Product: syz [ 604.075309][ T1639] usb 5-1: Manufacturer: syz [ 604.107643][ T1639] usb 5-1: SerialNumber: syz [ 604.117098][ T1639] usb 5-1: config 0 descriptor?? [ 604.120912][ T1639] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 604.121007][ T1639] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 604.141372][ T5829] usb 6-1: USB disconnect, device number 26 [ 604.279356][T12903] netlink: 204 bytes leftover after parsing attributes in process `syz.5.1934'. [ 604.296712][T12903] binder: 12900:12903 ioctl c0306201 200000000380 returned -14 [ 604.738176][ T1639] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 605.154371][ T1639] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 605.167345][ T1639] em28xx 5-1:0.0: board has no eeprom [ 605.241138][ T1639] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 605.274505][ T1639] em28xx 5-1:0.0: dvb set to bulk mode. [ 605.295291][ T5914] em28xx 5-1:0.0: Binding DVB extension [ 605.315694][ T1639] usb 5-1: USB disconnect, device number 102 [ 605.337708][T12916] usb usb8: usbfs: process 12916 (syz.1.1937) did not claim interface 0 before use [ 605.368669][ T1639] em28xx 5-1:0.0: Disconnecting em28xx [ 605.479215][ T5914] em28xx 5-1:0.0: Registering input extension [ 605.514113][ T1639] em28xx 5-1:0.0: Closing input extension [ 605.589230][ T1639] em28xx 5-1:0.0: Freeing device [ 605.986818][T12928] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1942'. [ 606.353827][T12930] loop2: detected capacity change from 0 to 7 [ 606.360864][T12930] Dev loop2: unable to read RDB block 7 [ 606.377537][T12930] loop2: unable to read partition table [ 606.394365][T12930] loop2: partition table beyond EOD, truncated [ 606.413233][T12930] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 607.539575][T12945] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1949'. [ 607.752355][T12952] netlink: 204 bytes leftover after parsing attributes in process `syz.2.1951'. [ 607.773883][T12952] binder: 12948:12952 ioctl c0306201 200000000380 returned -14 [ 607.867670][T12953] netlink: 204 bytes leftover after parsing attributes in process `syz.1.1950'. [ 608.031727][T12953] binder: 12946:12953 ioctl c0306201 200000000380 returned -14 [ 608.958691][T12958] loop2: detected capacity change from 0 to 7 [ 608.984948][T12958] Dev loop2: unable to read RDB block 7 [ 609.000646][T12958] loop2: unable to read partition table [ 609.015241][T12958] loop2: partition table beyond EOD, truncated [ 609.028830][T12958] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 609.181606][T12962] syzkaller0: entered promiscuous mode [ 609.190712][T12962] syzkaller0: entered allmulticast mode [ 609.315462][T12964] fuse: Unknown parameter 'rmode' [ 609.406127][T12969] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1957'. [ 609.418395][T12969] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1957'. [ 609.428814][T12969] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1957'. [ 609.439918][T12969] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1957'. [ 609.588589][T12976] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1960'. [ 609.720027][T12985] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 609.828626][T12990] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1963'. [ 609.888095][T12993] No such timeout policy "syz1" [ 610.596062][T12979] delete_channel: no stack [ 611.453977][T13007] netlink: 204 bytes leftover after parsing attributes in process `syz.4.1967'. [ 611.466327][T13007] binder: 13004:13007 unknown command 0 [ 611.472103][T13007] binder: 13004:13007 ioctl c0306201 200000000080 returned -22 [ 611.482603][T13007] binder: BINDER_SET_CONTEXT_MGR already set [ 611.488630][T13007] binder: 13004:13007 ioctl 4018620d 200000004a80 returned -16 [ 611.497576][T13007] binder: 13004:13007 ioctl c0306201 200000000380 returned -14 [ 611.591119][ T1639] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 611.774279][ T1639] usb 6-1: Using ep0 maxpacket: 16 [ 611.786493][ T1639] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 611.815888][ T1639] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 611.921544][ T1639] usb 6-1: config 0 interface 0 has no altsetting 0 [ 611.959601][ T1639] usb 6-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 611.977295][ T1639] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.005303][ T1639] usb 6-1: config 0 descriptor?? [ 612.303749][T13018] loop2: detected capacity change from 0 to 7 [ 612.327198][T13018] loop2: [ 612.330276][T13018] loop2: partition table partially beyond EOD, truncated [ 612.344717][T13019] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1968'. [ 612.384799][ T5198] loop2: [ 612.387840][ T5198] loop2: partition table partially beyond EOD, truncated [ 612.503370][T13003] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1966'. [ 612.542911][T13003] unsupported nlmsg_type 40 [ 613.475190][ T1639] usbhid 6-1:0.0: can't add hid device: -71 [ 613.497081][ T1639] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 613.542039][ T1639] usb 6-1: USB disconnect, device number 27 [ 613.804956][T13034] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1974'. [ 613.832420][T13033] netlink: 1 bytes leftover after parsing attributes in process `syz.4.1974'. [ 613.940158][T13039] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 614.564479][T13052] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1979'. [ 614.580493][T13054] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1980'. [ 614.901096][ T5914] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 615.032666][T13072] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1983'. [ 615.052078][ T5914] usb 6-1: Using ep0 maxpacket: 16 [ 615.062994][ T5914] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 615.076266][ T5914] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 615.087100][ T5914] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.100997][ T5914] usb 6-1: Product: syz [ 615.105284][ T5914] usb 6-1: Manufacturer: syz [ 615.109994][ T5914] usb 6-1: SerialNumber: syz [ 615.127166][ T5914] usb 6-1: config 0 descriptor?? [ 615.150679][ T5914] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 615.168284][ T5914] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 615.339367][T13074] netlink: del zone limit has 4 unknown bytes [ 615.670933][ T1639] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 615.740007][ T5914] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 615.851418][ T1639] usb 5-1: Using ep0 maxpacket: 16 [ 615.862405][ T1639] usb 5-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 615.872026][ T1639] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.880107][ T1639] usb 5-1: Product: syz [ 615.885288][ T1639] usb 5-1: Manufacturer: syz [ 615.890856][ T1639] usb 5-1: SerialNumber: syz [ 615.984316][ T1639] usb 5-1: config 0 descriptor?? [ 616.212806][ T1639] visor 5-1:0.0: Sony Clie 3.5 converter detected [ 616.309733][ T5914] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 616.328639][ T5914] em28xx 6-1:0.0: board has no eeprom [ 616.341635][ T5970] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 616.402130][ T5914] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 616.410022][ T5914] em28xx 6-1:0.0: dvb set to bulk mode. [ 616.420660][ T10] em28xx 6-1:0.0: Binding DVB extension [ 616.449198][ T5914] usb 6-1: USB disconnect, device number 28 [ 616.493516][ T5914] em28xx 6-1:0.0: Disconnecting em28xx [ 616.504193][ T1639] usb 5-1: clie_3_5_startup: get interface number bad return length: 0 [ 616.521315][ T5970] usb 2-1: Using ep0 maxpacket: 16 [ 616.524458][ T1639] visor 5-1:0.0: probe with driver visor failed with error -5 [ 616.550426][ T5970] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 616.614570][ T5970] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 616.639243][ T10] em28xx 6-1:0.0: Registering input extension [ 616.652625][ T5914] em28xx 6-1:0.0: Closing input extension [ 616.657077][ T5970] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 616.699463][ T5970] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 616.716008][ T5914] em28xx 6-1:0.0: Freeing device [ 616.853055][ T5970] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.875697][ T5970] usb 2-1: config 0 descriptor?? [ 616.903458][ T1639] usb 5-1: USB disconnect, device number 103 [ 617.128042][ T1639] IPVS: starting estimator thread 0... [ 617.231445][T13088] IPVS: using max 32 ests per chain, 76800 per kthread [ 617.446113][T13078] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1985'. [ 617.803726][ T1639] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 617.971549][ T1639] usb 3-1: Using ep0 maxpacket: 16 [ 618.052796][ T1639] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 618.128314][ T1639] usb 3-1: config 0 has no interfaces? [ 618.158293][ T1639] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 618.180766][ T1639] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.207870][ T1639] usb 3-1: config 0 descriptor?? [ 618.644573][ T29] audit: type=1326 audit(1776142530.264:584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13093 comm="syz.2.1988" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8ddcd9c819 code=0x0 [ 619.490884][ T5970] usbhid 2-1:0.0: can't add hid device: -71 [ 619.512099][ T5970] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 619.556223][ T5970] usb 2-1: USB disconnect, device number 7 [ 619.676143][T13124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 619.714324][T13124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 619.808944][T13124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 619.848662][T13124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 619.968230][T13127] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1994'. [ 619.991334][ T5970] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 620.144294][T13132] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1995'. [ 620.171064][ T5970] usb 2-1: Invalid ep0 maxpacket: 32 [ 620.311560][ T5970] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 620.382358][ T1211] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 620.491778][ T5970] usb 2-1: Invalid ep0 maxpacket: 32 [ 620.497808][ T5970] usb usb2-port1: attempt power cycle [ 620.521096][ T5829] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 620.541499][ T1211] usb 5-1: device descriptor read/64, error -71 [ 620.571119][ T42] usb 3-1: USB disconnect, device number 113 [ 620.644268][T13139] fuse: Bad value for 'fd' [ 620.651903][ T5829] usb 6-1: device descriptor read/64, error -71 [ 620.781091][ T1211] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 620.851235][ T5970] usb 2-1: new low-speed USB device number 10 using dummy_hcd [ 620.872178][ T5970] usb 2-1: Invalid ep0 maxpacket: 32 [ 620.891209][ T5829] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 620.911457][ T1211] usb 5-1: device descriptor read/64, error -71 [ 621.001223][ T5970] usb 2-1: new low-speed USB device number 11 using dummy_hcd [ 621.021408][ T1211] usb usb5-port1: attempt power cycle [ 621.027499][ T5829] usb 6-1: device descriptor read/64, error -71 [ 621.034408][ T5970] usb 2-1: Invalid ep0 maxpacket: 32 [ 621.040875][ T5970] usb usb2-port1: unable to enumerate USB device [ 621.142665][ T5829] usb usb6-port1: attempt power cycle [ 621.270269][T13143] loop2: detected capacity change from 0 to 7 [ 621.278175][T13143] Dev loop2: unable to read RDB block 7 [ 621.284947][T13143] loop2: unable to read partition table [ 621.290901][T13143] loop2: partition table beyond EOD, truncated [ 621.299456][T13143] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 621.371311][ T1211] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 621.392675][ T1211] usb 5-1: device descriptor read/8, error -71 [ 621.491377][ T5829] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 621.541850][ T5829] usb 6-1: device descriptor read/8, error -71 [ 621.652424][ T1211] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 621.683947][ T1211] usb 5-1: device descriptor read/8, error -71 [ 621.781855][ T5829] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 621.792968][ T1211] usb usb5-port1: unable to enumerate USB device [ 621.802658][ T5829] usb 6-1: device descriptor read/8, error -71 [ 621.851057][ T5970] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 621.922747][ T5829] usb usb6-port1: unable to enumerate USB device [ 622.011518][ T5970] usb 3-1: Using ep0 maxpacket: 32 [ 622.019760][ T5970] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 622.032362][ T5970] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 622.041905][ T5970] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 622.050120][ T5970] usb 3-1: Product: syz [ 622.054472][ T5970] usb 3-1: Manufacturer: syz [ 622.059093][ T5970] usb 3-1: SerialNumber: syz [ 622.066544][ T5970] usb 3-1: config 0 descriptor?? [ 622.073469][T13154] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 622.083770][ T5970] hub 3-1:0.0: bad descriptor, ignoring hub [ 622.089692][ T5970] hub 3-1:0.0: probe with driver hub failed with error -5 [ 622.348445][T13155] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2004'. [ 622.391704][ T5970] usb 3-1: USB disconnect, device number 114 [ 622.894363][T13162] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2006'. [ 623.807450][T13171] loop2: detected capacity change from 0 to 7 [ 623.819068][T13171] Dev loop2: unable to read RDB block 7 [ 623.827558][T13171] loop2: unable to read partition table [ 623.842964][T13171] loop2: partition table beyond EOD, truncated [ 623.858374][T13171] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 624.448542][T13189] program syz.1.2017 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 624.481301][ T5914] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 624.651179][ T5914] usb 5-1: device descriptor read/64, error -71 [ 624.739297][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.745968][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.891617][ T5914] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 624.941362][ T1211] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 625.031386][ T5914] usb 5-1: device descriptor read/64, error -71 [ 625.066193][T13208] loop2: detected capacity change from 0 to 7 [ 625.083849][T13208] Dev loop2: unable to read RDB block 7 [ 625.089479][T13208] loop2: unable to read partition table [ 625.106835][ T1211] usb 3-1: Using ep0 maxpacket: 16 [ 625.129489][ T1211] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 625.144274][ T5914] usb usb5-port1: attempt power cycle [ 625.146521][T13208] loop2: partition table beyond EOD, truncated [ 625.159501][T13208] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 625.170652][ T1211] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 625.180854][ T1211] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.193691][ T1211] usb 3-1: Product: syz [ 625.201126][ T1211] usb 3-1: Manufacturer: syz [ 625.210350][ T1211] usb 3-1: SerialNumber: syz [ 625.254217][ T1211] usb 3-1: config 0 descriptor?? [ 625.296978][ T1211] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 625.308498][ T1211] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 625.324700][T13212] netlink: 104 bytes leftover after parsing attributes in process `syz.1.2024'. [ 625.501096][ T5914] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 625.525645][ T5914] usb 5-1: device descriptor read/8, error -71 [ 625.571077][ T10] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 625.731077][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 625.739716][ T10] usb 2-1: config 0 has an invalid interface number: 143 but max is 0 [ 625.756381][ T10] usb 2-1: config 0 has no interface number 0 [ 625.767860][ T10] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=c1.9b [ 625.777528][ T5914] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 625.796655][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.811706][ T5914] usb 5-1: device descriptor read/8, error -71 [ 625.825590][ T10] usb 2-1: config 0 descriptor?? [ 625.896144][ T1211] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 625.921959][ T5914] usb usb5-port1: unable to enumerate USB device [ 625.942104][ T10] viperboard 2-1:0.143: version 0.00 found at bus 002 address 012 [ 625.984831][ T10] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 625.999405][ T10] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 626.016715][T13214] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2025'. [ 626.038292][T13212] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.052763][T13212] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.064018][ T10] usb 2-1: USB disconnect, device number 12 [ 626.327922][ T1211] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 626.340240][ T1211] em28xx 3-1:0.0: board has no eeprom [ 626.411101][ T1211] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 626.419044][ T1211] em28xx 3-1:0.0: dvb set to bulk mode. [ 626.425043][ T5829] em28xx 3-1:0.0: Binding DVB extension [ 626.441727][ T1211] usb 3-1: USB disconnect, device number 115 [ 626.453556][ T1211] em28xx 3-1:0.0: Disconnecting em28xx [ 626.490399][ T5829] em28xx 3-1:0.0: Registering input extension [ 626.502528][ T1211] em28xx 3-1:0.0: Closing input extension [ 626.515510][ T1211] em28xx 3-1:0.0: Freeing device [ 626.646625][T13223] tipc: Enabling of bearer rejected, already enabled [ 626.751508][T13227] netlink: 'syz.1.2030': attribute type 32 has an invalid length. [ 626.759412][T13227] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2030'. [ 626.783881][T13227] bond13: Setting coupled_control to off (0) [ 626.831361][T13230] fuse: Bad value for 'fd' [ 627.043769][T13236] netlink: 'syz.5.2033': attribute type 30 has an invalid length. [ 627.055478][T13236] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2033'. [ 627.075623][T13236] bridge0: port 2(bridge_slave_1) entered disabled state [ 627.694010][ T29] audit: type=1326 audit(1776142539.334:585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 627.755329][T13245] syzkaller0: entered promiscuous mode [ 627.760903][T13245] syzkaller0: entered allmulticast mode [ 627.783578][T13264] netlink: 204 bytes leftover after parsing attributes in process `syz.1.2039'. [ 627.827793][ T29] audit: type=1326 audit(1776142539.334:586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 627.859604][T13264] binder: 13257:13264 ioctl c0306201 200000000380 returned -14 [ 628.067184][T13249] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.106465][ T29] audit: type=1326 audit(1776142539.334:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 628.264391][ T29] audit: type=1326 audit(1776142539.344:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 628.601096][ T29] audit: type=1326 audit(1776142539.344:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 628.753300][ T29] audit: type=1326 audit(1776142539.344:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 628.931103][ T29] audit: type=1326 audit(1776142539.424:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 629.052154][ T29] audit: type=1326 audit(1776142539.424:592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 629.132947][ T29] audit: type=1326 audit(1776142539.594:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 629.313357][ T29] audit: type=1326 audit(1776142539.594:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13253 comm="syz.4.2037" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ebef9c819 code=0x7ffc0000 [ 629.651471][ T10] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 629.813247][ T10] usb 3-1: config 0 has an invalid interface number: 213 but max is 0 [ 629.827472][ T10] usb 3-1: config 0 has no interface number 0 [ 629.847803][ T10] usb 3-1: config 0 interface 213 altsetting 101 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 629.879847][ T10] usb 3-1: config 0 interface 213 altsetting 101 endpoint 0x81 has invalid wMaxPacketSize 0 [ 629.920709][ T10] usb 3-1: config 0 interface 213 has no altsetting 0 [ 629.938111][ T10] usb 3-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 629.965521][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.003850][ T10] usb 3-1: config 0 descriptor?? [ 630.260532][T13270] PKCS7: Unknown OID: [4] 5.25.287.112.81.102.117.87.150326315.2007.15776.1 [ 630.355427][T13270] PKCS7: Only support pkcs7_signedData type [ 630.987564][ T10] usbhid 3-1:0.213: can't add hid device: -71 [ 630.999555][ T10] usbhid 3-1:0.213: probe with driver usbhid failed with error -71 [ 631.007809][ T1639] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 631.031359][ T10] usb 3-1: USB disconnect, device number 116 [ 631.182416][ T1639] usb 2-1: Using ep0 maxpacket: 16 [ 631.209256][ T1639] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 631.243303][ T1639] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 631.253888][ T1639] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 631.262040][ T1639] usb 2-1: Product: syz [ 631.266237][ T1639] usb 2-1: Manufacturer: syz [ 631.270875][ T1639] usb 2-1: SerialNumber: syz [ 631.284012][ T1639] usb 2-1: config 0 descriptor?? [ 631.295142][ T1639] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 631.304515][ T1639] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 631.909344][ T1639] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 632.333961][ T1639] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 632.354505][T13281] loop2: detected capacity change from 0 to 7 [ 632.362599][ T1639] em28xx 2-1:0.0: board has no eeprom [ 632.369313][T13281] loop2: [ 632.376514][T13281] loop2: partition table partially beyond EOD, truncated [ 632.441199][ T1639] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 632.467011][ T1639] em28xx 2-1:0.0: dvb set to bulk mode. [ 632.490905][ T10] em28xx 2-1:0.0: Binding DVB extension [ 632.526995][ T1639] usb 2-1: USB disconnect, device number 13 [ 632.543265][ T1639] em28xx 2-1:0.0: Disconnecting em28xx [ 632.713960][ T10] em28xx 2-1:0.0: Registering input extension [ 632.743701][ T1639] em28xx 2-1:0.0: Closing input extension [ 632.772586][ T1639] em28xx 2-1:0.0: Freeing device [ 632.986461][T13305] bridge0: port 2(bridge_slave_1) entered blocking state [ 632.993781][T13305] bridge0: port 2(bridge_slave_1) entered forwarding state [ 633.001401][T13305] bridge0: port 1(bridge_slave_0) entered blocking state [ 633.008586][T13305] bridge0: port 1(bridge_slave_0) entered forwarding state [ 633.041980][T13307] netlink: 104 bytes leftover after parsing attributes in process `syz.5.2052'. [ 633.218214][T13305] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 633.411489][ T1211] usb 2-1: new full-speed USB device number 14 using dummy_hcd [ 633.441093][ T1639] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 633.563089][ T1211] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 633.574440][ T1211] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 633.586027][ T1211] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 633.591554][ T1639] usb 3-1: Using ep0 maxpacket: 16 [ 633.601130][ T1211] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.608098][ T1639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 633.621059][ T1639] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 633.632141][ T1211] usb 2-1: config 0 descriptor?? [ 633.686971][ T1211] hub 2-1:0.0: USB hub found [ 633.701158][ T1639] usb 3-1: New USB device found, idVendor=1b96, idProduct=0008, bcdDevice= 0.00 [ 633.715453][ T1639] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.735680][ T1639] usb 3-1: config 0 descriptor?? [ 633.882069][ T1211] hub 2-1:0.0: 1 port detected [ 634.194958][ T1639] ntrig 0003:1B96:0008.0026: hidraw0: USB HID v0.00 Device [HID 1b96:0008] on usb-dummy_hcd.2-1/input0 [ 634.491434][ T5970] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 634.553946][T13325] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2056'. [ 634.661167][ T5970] usb 6-1: Using ep0 maxpacket: 32 [ 634.679212][ T5970] usb 6-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 634.688910][ T5970] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.697519][ T1211] hub 2-1:0.0: activate --> -90 [ 634.724046][ T5970] usb 6-1: Product: syz [ 634.728363][ T5970] usb 6-1: Manufacturer: syz [ 634.733512][ T5970] usb 6-1: SerialNumber: syz [ 634.848554][ T1639] usb 3-1: USB disconnect, device number 117 [ 634.875058][ T5970] usb 6-1: config 0 descriptor?? [ 634.929086][ T5970] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 634.945654][ T5970] dvb-usb: bulk message failed: -22 (4/0) [ 634.952631][ T5970] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 634.966121][ T5970] dvb-usb: bulk message failed: -22 (5/0) [ 634.975677][ T5970] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 635.031594][T13328] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2059'. [ 635.037660][ T5970] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 635.065895][ T5970] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 635.075640][ T5970] usb 6-1: media controller created [ 635.100019][T13309] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 635.120055][T13309] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 635.189967][ T5914] usb 2-1: USB disconnect, device number 14 [ 635.189981][ T1211] hub 2-1:0.0: hub_ext_port_status failed (err = -71) [ 635.246841][ T5970] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 635.257622][T13322] ttusb2: i2c wr len=58 too high [ 635.266925][ T1211] hub_port_connect: 47 callbacks suppressed [ 635.266944][ T1211] usb 2-1-port1: connect-debounce failed [ 635.379337][ T5970] usb 6-1: selecting invalid altsetting 3 [ 635.392545][T13336] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2060'. [ 635.402127][ T5970] ttusb2: set interface to alts=3 failed [ 635.417341][T13336] netlink: 'syz.1.2060': attribute type 16 has an invalid length. [ 635.474848][ T5970] DVB: Unable to find symbol tda10086_attach() [ 635.485801][ T5970] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 635.612529][ T5970] dvb-usb: bulk message failed: -22 (4/0) [ 635.618588][ T5970] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 635.630671][T11241] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 635.630712][ T5970] dvb-usb: bulk message failed: -22 (5/0) [ 635.674643][ T5970] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 635.697101][ T5970] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 635.791055][T11241] usb 3-1: Using ep0 maxpacket: 8 [ 635.804558][T11241] usb 3-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 635.875370][T11241] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.890908][T11241] usb 3-1: Product: syz [ 635.901122][T11241] usb 3-1: Manufacturer: syz [ 635.909957][T11241] usb 3-1: SerialNumber: syz [ 635.931383][T11241] usb 3-1: config 0 descriptor?? [ 636.181168][ T5970] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 636.285448][T11241] dvb_usb_rtl28xxu 3-1:0.0: chip type detection failed -71 [ 636.295275][T11241] dvb_usb_rtl28xxu 3-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 636.334744][ T5970] usb 2-1: Using ep0 maxpacket: 16 [ 636.343359][ T5970] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 636.365380][T11241] usb 3-1: USB disconnect, device number 118 [ 636.374250][ T5970] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 636.383630][ T5970] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.392201][ T5970] usb 2-1: Product: syz [ 636.397392][ T5970] usb 2-1: Manufacturer: syz [ 636.411804][ T5970] usb 2-1: SerialNumber: syz [ 636.498388][T13345] loop2: detected capacity change from 0 to 7 [ 636.498621][ T5970] usb 2-1: config 0 descriptor?? [ 636.615798][T13345] Dev loop2: unable to read RDB block 7 [ 636.621731][T13345] loop2: unable to read partition table [ 636.622719][ T5970] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 636.628143][T13345] loop2: partition table beyond EOD, [ 636.637315][ T5970] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 636.639165][T13345] truncated [ 636.669634][T13345] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 636.797948][T13347] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2065'. [ 636.875885][T13349] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2066'. [ 637.167561][ T5970] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 637.371643][ T5829] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 637.436309][T13358] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 637.448986][T13358] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 637.541173][ T5829] usb 5-1: Using ep0 maxpacket: 16 [ 637.556208][ T5829] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 637.570763][ T5829] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 637.581252][ T5829] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 637.593699][ T5829] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.607805][ T5970] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 637.618031][ T5970] em28xx 2-1:0.0: board has no eeprom [ 637.666114][ T5829] usb 5-1: config 0 descriptor?? [ 637.678441][T11241] usb 6-1: USB disconnect, device number 33 [ 637.748260][T11241] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 637.761609][ T5970] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 637.793630][ T5970] em28xx 2-1:0.0: dvb set to bulk mode. [ 637.811473][ T1211] em28xx 2-1:0.0: Binding DVB extension [ 637.831065][ T1639] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 637.851704][ T5970] usb 2-1: USB disconnect, device number 15 [ 637.875218][ T5970] em28xx 2-1:0.0: Disconnecting em28xx [ 637.903979][ T1211] em28xx 2-1:0.0: Registering input extension [ 637.920682][ T5970] em28xx 2-1:0.0: Closing input extension [ 637.947532][ T5970] em28xx 2-1:0.0: Freeing device [ 637.982000][ T1639] usb 3-1: Using ep0 maxpacket: 16 [ 637.989018][ T1639] usb 3-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 638.000463][ T1639] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.016574][ T1639] usb 3-1: config 0 descriptor?? [ 638.029363][ T1639] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 638.111186][T11241] usb 6-1: new low-speed USB device number 34 using dummy_hcd [ 638.123099][ T5829] mcp2221 0003:04D8:00DD.0027: unknown main item tag 0x6 [ 638.135636][ T5829] mcp2221 0003:04D8:00DD.0027: item fetching failed at offset 4/5 [ 638.144447][ T5829] mcp2221 0003:04D8:00DD.0027: can't parse reports [ 638.152476][ T5829] mcp2221 0003:04D8:00DD.0027: probe with driver mcp2221 failed with error -22 [ 638.264282][T11241] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 638.275715][T11241] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 64, setting to 8 [ 638.287050][T11241] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 638.300443][T11241] usb 6-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice= 0.00 [ 638.310522][T11241] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.323868][T11241] usb 6-1: config 0 descriptor?? [ 638.330431][T13364] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 638.343875][ T5829] usb 5-1: USB disconnect, device number 112 [ 638.747688][T11241] elecom 0003:056E:00FD.0028: ignoring exceeding usage max [ 638.757211][T11241] elecom 0003:056E:00FD.0028: item fetching failed at offset 24/38 [ 638.767106][T11241] elecom 0003:056E:00FD.0028: probe with driver elecom failed with error -22 [ 638.953139][T11241] usb 6-1: USB disconnect, device number 34 [ 638.959971][ T1639] gspca_sonixj: reg_w1 err -110 [ 638.969026][ T1639] sonixj 3-1:0.0: probe with driver sonixj failed with error -110 [ 639.405991][ T5970] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 639.571541][ T5970] usb 5-1: device descriptor read/64, error -71 [ 639.811265][ T5970] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 639.901257][T11241] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 639.951136][ T5970] usb 5-1: device descriptor read/64, error -71 [ 640.055256][T11241] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 640.064703][T11241] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.076532][ T5970] usb usb5-port1: attempt power cycle [ 640.116517][T11241] usb 6-1: config 0 descriptor?? [ 640.143970][T11241] cp210x 6-1:0.0: cp210x converter detected [ 640.441094][ T5970] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 640.472526][ T5970] usb 5-1: device descriptor read/8, error -71 [ 640.598079][T11241] cp210x 6-1:0.0: failed to get vendor val 0x0010 size 3: -71 [ 640.608292][T11241] cp210x 6-1:0.0: failed to get vendor val 0x000e size 678: -71 [ 640.629667][T11241] cp210x 6-1:0.0: GPIO initialisation failed: -71 [ 640.691743][T11241] usb 6-1: cp210x converter now attached to ttyUSB0 [ 640.730823][T11241] usb 6-1: USB disconnect, device number 35 [ 640.748703][T13390] netlink: 104 bytes leftover after parsing attributes in process `syz.6.2077'. [ 640.759130][ T5970] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 640.804126][ T5970] usb 5-1: device descriptor read/8, error -71 [ 640.817387][T13392] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2078'. [ 640.827281][T11241] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 640.857845][T11241] cp210x 6-1:0.0: device disconnected [ 640.923802][ T5970] usb usb5-port1: unable to enumerate USB device [ 641.027810][ T5914] usb 3-1: USB disconnect, device number 119 [ 641.154419][T13399] tipc: Enabled bearer , priority 0 [ 641.162388][T13399] syzkaller0: entered promiscuous mode [ 641.168167][T13399] syzkaller0: entered allmulticast mode [ 641.185522][T13399] tipc: Resetting bearer [ 641.199222][T13397] tipc: Resetting bearer [ 641.232279][T13397] tipc: Disabling bearer [ 641.279733][T13404] ipvlan0: entered promiscuous mode [ 641.285064][T13404] ipvlan0: entered allmulticast mode [ 641.290501][T13404] veth0_vlan: entered allmulticast mode [ 641.401193][ T5970] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 641.551190][ T5970] usb 2-1: Using ep0 maxpacket: 16 [ 641.558605][ T5970] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 641.570733][ T5970] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 641.580395][ T5970] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.588998][ T5970] usb 2-1: Product: syz [ 641.593742][ T5970] usb 2-1: Manufacturer: syz [ 641.693778][ T5970] usb 2-1: SerialNumber: syz [ 641.729462][ T5970] usb 2-1: config 0 descriptor?? [ 641.745697][ T5970] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 641.755814][ T5970] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 642.011085][ T10] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 642.162191][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 642.176441][ T10] usb 6-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 642.231554][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=222 [ 642.239938][ T10] usb 6-1: SerialNumber: syz [ 642.318706][ T10] usb 6-1: config 0 descriptor?? [ 642.352757][ T10] ftdi_sio 6-1:0.0: FTDI USB Serial Device converter detected [ 642.360305][ T5970] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 642.379242][ T10] usb 6-1: Detected FT232A [ 642.394383][ T10] usb 6-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 642.616426][T13422] FAULT_INJECTION: forcing a failure. [ 642.616426][T13422] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 642.630424][T13422] CPU: 1 UID: 0 PID: 13422 Comm: syz.2.2090 Tainted: G L syzkaller #0 PREEMPT(full) [ 642.630464][T13422] Tainted: [L]=SOFTLOCKUP [ 642.630471][T13422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 642.630485][T13422] Call Trace: [ 642.630492][T13422] [ 642.630501][T13422] dump_stack_lvl+0xe8/0x150 [ 642.630536][T13422] should_fail_ex+0x412/0x560 [ 642.630562][T13422] _copy_from_user+0x2d/0xb0 [ 642.630590][T13422] ___sys_sendmsg+0x1c6/0x360 [ 642.630625][T13422] ? __pfx____sys_sendmsg+0x10/0x10 [ 642.630699][T13422] __sys_sendmmsg+0x27c/0x4e0 [ 642.630732][T13422] ? __pfx___sys_sendmmsg+0x10/0x10 [ 642.630759][T13422] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 642.630814][T13422] ? ksys_write+0x242/0x270 [ 642.630839][T13422] ? __pfx_ksys_write+0x10/0x10 [ 642.630868][T13422] __x64_sys_sendmmsg+0xa0/0xc0 [ 642.630900][T13422] do_syscall_64+0x14d/0xf80 [ 642.630934][T13422] ? trace_irq_disable+0x3b/0x150 [ 642.630952][T13422] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 642.630972][T13422] ? clear_bhb_loop+0x40/0x90 [ 642.630996][T13422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 642.631016][T13422] RIP: 0033:0x7f8ddcd9c819 [ 642.631035][T13422] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 642.631052][T13422] RSP: 002b:00007f8dddbde028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 642.631074][T13422] RAX: ffffffffffffffda RBX: 00007f8ddd015fa0 RCX: 00007f8ddcd9c819 [ 642.631089][T13422] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 642.631103][T13422] RBP: 00007f8dddbde090 R08: 0000000000000000 R09: 0000000000000000 [ 642.631115][T13422] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 642.631127][T13422] R13: 00007f8ddd016038 R14: 00007f8ddd015fa0 R15: 00007f8ddd13fa48 [ 642.631157][T13422] [ 642.854744][ T5970] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 642.863310][ T5970] em28xx 2-1:0.0: board has no eeprom [ 642.901341][ T5829] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 642.932933][ T5970] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 642.940913][ T5970] em28xx 2-1:0.0: dvb set to bulk mode. [ 642.948217][ T1211] em28xx 2-1:0.0: Binding DVB extension [ 642.960061][ T5970] usb 2-1: USB disconnect, device number 16 [ 642.969975][ T5970] em28xx 2-1:0.0: Disconnecting em28xx [ 643.023678][ T1211] em28xx 2-1:0.0: Registering input extension [ 643.030486][ T5970] em28xx 2-1:0.0: Closing input extension [ 643.050421][ T5970] em28xx 2-1:0.0: Freeing device [ 643.055918][ T5829] usb 5-1: Using ep0 maxpacket: 16 [ 643.067593][ T5829] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 643.077893][ T5829] usb 5-1: config 0 has no interfaces? [ 643.102464][ T5829] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 643.112963][ T5829] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.133057][ T5829] usb 5-1: config 0 descriptor?? [ 643.173465][ T10] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 643.238082][ T5914] usb 6-1: USB disconnect, device number 36 [ 643.246620][ T5914] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 643.268326][ T5914] ftdi_sio 6-1:0.0: device disconnected [ 643.332566][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x31, changing to 0x1 [ 643.344225][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid maxpacket 13364, setting to 64 [ 643.378956][T11241] usb 5-1: USB disconnect, device number 117 [ 643.411743][ T10] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 643.420866][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 643.429142][ T10] usb 3-1: Product: syz [ 643.433454][ T10] usb 3-1: Manufacturer: syz [ 643.438083][ T10] usb 3-1: SerialNumber: syz [ 643.447919][ T10] usb 3-1: config 0 descriptor?? [ 643.861738][T11241] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 643.894509][T13428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 643.910823][T13428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 643.948224][ T5970] usb 3-1: USB disconnect, device number 120 [ 644.007234][T13447] fuse: Invalid gid '00000000000000065534' [ 644.013259][T11241] usb 5-1: Using ep0 maxpacket: 32 [ 644.026370][T11241] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 644.052443][T11241] usb 5-1: config 0 has no interface number 0 [ 644.061891][T11241] usb 5-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 644.089386][T11241] usb 5-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 644.113889][T11241] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 644.135826][T11241] usb 5-1: Product: syz [ 644.140067][T11241] usb 5-1: Manufacturer: syz [ 644.146053][T11241] usb 5-1: SerialNumber: syz [ 644.160006][ T29] audit: type=1800 audit(1776142555.804:642): pid=13449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2096" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 644.199037][T11241] usb 5-1: config 0 descriptor?? [ 644.219507][T11241] em28xx 5-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 644.237986][T11241] em28xx 5-1:0.132: Video interface 132 found: [ 644.691612][T11241] em28xx 5-1:0.132: chip ID is em2874 [ 645.112318][ T10] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 645.238890][T13471] loop2: detected capacity change from 0 to 7 [ 645.246488][T13471] Dev loop2: unable to read RDB block 7 [ 645.253909][T13471] loop2: unable to read partition table [ 645.260096][T13471] loop2: partition table beyond EOD, truncated [ 645.271087][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 645.276582][T13471] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 645.294637][ T10] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00 [ 645.304880][T11241] em28xx 5-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 645.318050][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.326517][T11241] em28xx 5-1:0.132: board has no eeprom [ 645.332616][ T10] usb 2-1: Product: syz [ 645.336825][ T10] usb 2-1: Manufacturer: syz [ 645.341894][ T10] usb 2-1: SerialNumber: syz [ 645.374256][ T10] usb 2-1: config 0 descriptor?? [ 645.393012][ T10] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 645.401084][T11241] em28xx 5-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 645.409827][T11241] em28xx 5-1:0.132: analog set to bulk mode. [ 645.417918][ T10] usb 2-1: Detected FT-X [ 645.423069][ T5950] em28xx 5-1:0.132: Registering V4L2 extension [ 645.588745][ T10] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 645.961024][ T5970] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 646.028729][ T10] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 646.042551][T13493] netlink: 40 bytes leftover after parsing attributes in process `syz.6.2112'. [ 646.142804][ T5970] usb 6-1: Using ep0 maxpacket: 16 [ 646.159146][ T5970] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 646.172816][ T5970] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 646.183456][ T5970] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 646.196782][ T5970] usb 6-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 646.206225][ T5970] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 646.228189][ T1211] usb 2-1: USB disconnect, device number 17 [ 646.266279][ T1211] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 646.282040][ T5970] usb 6-1: config 0 descriptor?? [ 646.307747][ T1211] ftdi_sio 2-1:0.0: device disconnected [ 646.561476][ T5950] em28xx 5-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 646.581434][ T5950] em28xx 5-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 646.602974][ T5950] em28xx 5-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 646.623250][ T10] usb 5-1: USB disconnect, device number 118 [ 646.631160][ T5950] em28xx 5-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 646.641480][ T10] em28xx 5-1:0.132: Disconnecting em28xx [ 646.741739][ T5970] input: HID 05ac:8241 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:05AC:8241.0029/input/input61 [ 646.813700][T13511] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2119'. [ 646.847752][T13511] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2119'. [ 646.888962][ T5970] appleir 0003:05AC:8241.0029: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 05ac:8241] on usb-dummy_hcd.5-1/input0 [ 646.933688][ T5950] usb 5-1: Decoder not found [ 646.951622][T13517] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2118'. [ 647.055121][ T5970] usb 6-1: USB disconnect, device number 37 [ 647.067008][ T5950] em28xx 5-1:0.132: failed to create media graph [ 647.120123][ T5950] em28xx 5-1:0.132: V4L2 device video103 deregistered [ 647.190813][T13519] ================================================================== [ 647.198927][T13519] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 647.206304][T13519] Read of size 8 at addr ffff88804c3ec790 by task v4l_id/13519 [ 647.213847][T13519] [ 647.216184][T13519] CPU: 1 UID: 0 PID: 13519 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 647.216206][T13519] Tainted: [L]=SOFTLOCKUP [ 647.216212][T13519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 647.216223][T13519] Call Trace: [ 647.216230][T13519] [ 647.216237][T13519] dump_stack_lvl+0xe8/0x150 [ 647.216262][T13519] print_report+0xba/0x230 [ 647.216282][T13519] ? v4l2_fh_open+0xac/0x420 [ 647.216296][T13519] kasan_report+0x117/0x150 [ 647.216317][T13519] ? v4l2_fh_open+0xac/0x420 [ 647.216334][T13519] v4l2_fh_open+0xac/0x420 [ 647.216348][T13519] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 647.216374][T13519] em28xx_v4l2_open+0x157/0x9a0 [ 647.216395][T13519] ? do_raw_spin_lock+0x12b/0x2f0 [ 647.216414][T13519] v4l2_open+0x1bf/0x3a0 [ 647.216432][T13519] chrdev_open+0x4cd/0x5e0 [ 647.216453][T13519] ? __pfx_chrdev_open+0x10/0x10 [ 647.216473][T13519] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 647.216493][T13519] ? __pfx_chrdev_open+0x10/0x10 [ 647.216512][T13519] do_dentry_open+0x785/0x14e0 [ 647.216539][T13519] vfs_open+0x3b/0x340 [ 647.216560][T13519] ? path_openat+0x2df0/0x3860 [ 647.216578][T13519] path_openat+0x2e08/0x3860 [ 647.216600][T13519] ? __pfx_stack_trace_save+0x10/0x10 [ 647.216618][T13519] ? stack_depot_save_flags+0x33/0x810 [ 647.216638][T13519] ? __pfx_path_openat+0x10/0x10 [ 647.216655][T13519] ? __x64_sys_openat+0x138/0x170 [ 647.216677][T13519] ? do_syscall_64+0x14d/0xf80 [ 647.216699][T13519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.216718][T13519] ? __lock_acquire+0x6b5/0x2cf0 [ 647.216740][T13519] do_file_open+0x23e/0x4a0 [ 647.216758][T13519] ? __pfx_do_file_open+0x10/0x10 [ 647.216783][T13519] ? _raw_spin_unlock+0x28/0x50 [ 647.216802][T13519] ? alloc_fd+0x64b/0x6c0 [ 647.216828][T13519] do_sys_openat2+0x113/0x200 [ 647.216851][T13519] ? __pfx_do_sys_openat2+0x10/0x10 [ 647.216878][T13519] ? exc_page_fault+0x6a/0xc0 [ 647.216901][T13519] ? do_user_addr_fault+0xc6f/0x1340 [ 647.216924][T13519] __x64_sys_openat+0x138/0x170 [ 647.216948][T13519] do_syscall_64+0x14d/0xf80 [ 647.216970][T13519] ? trace_irq_disable+0x3b/0x150 [ 647.216984][T13519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.216999][T13519] ? clear_bhb_loop+0x40/0x90 [ 647.217016][T13519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.217032][T13519] RIP: 0033:0x7fdb9cea7407 [ 647.217047][T13519] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 647.217060][T13519] RSP: 002b:00007ffc01e99460 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 647.217077][T13519] RAX: ffffffffffffffda RBX: 00007fdb9d60b880 RCX: 00007fdb9cea7407 [ 647.217089][T13519] RDX: 0000000000000000 RSI: 00007ffc01e9af1b RDI: ffffffffffffff9c [ 647.217100][T13519] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 647.217110][T13519] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 647.217119][T13519] R13: 00007ffc01e996b0 R14: 00007fdb9d772000 R15: 00005574b22a74d8 [ 647.217137][T13519] [ 647.217143][T13519] [ 647.519063][T13519] Allocated by task 5950: [ 647.523417][T13519] kasan_save_track+0x3e/0x80 [ 647.528124][T13519] __kasan_kmalloc+0x93/0xb0 [ 647.532729][T13519] __kmalloc_cache_noprof+0x31c/0x660 [ 647.538120][T13519] em28xx_v4l2_init+0x10b/0x2e70 [ 647.543077][T13519] em28xx_init_extension+0x120/0x1c0 [ 647.548376][T13519] process_scheduled_works+0xb6e/0x18c0 [ 647.553943][T13519] worker_thread+0xa53/0xfc0 [ 647.558823][T13519] kthread+0x388/0x470 [ 647.562913][T13519] ret_from_fork+0x51e/0xb90 [ 647.567543][T13519] ret_from_fork_asm+0x1a/0x30 [ 647.572336][T13519] [ 647.574677][T13519] Freed by task 5950: [ 647.578679][T13519] kasan_save_track+0x3e/0x80 [ 647.583369][T13519] kasan_save_free_info+0x46/0x50 [ 647.588429][T13519] __kasan_slab_free+0x5c/0x80 [ 647.593210][T13519] kfree+0x1c1/0x630 [ 647.597117][T13519] em28xx_v4l2_init+0x1683/0x2e70 [ 647.602155][T13519] em28xx_init_extension+0x120/0x1c0 [ 647.607453][T13519] process_scheduled_works+0xb6e/0x18c0 [ 647.613103][T13519] worker_thread+0xa53/0xfc0 [ 647.617717][T13519] kthread+0x388/0x470 [ 647.621795][T13519] ret_from_fork+0x51e/0xb90 [ 647.626408][T13519] ret_from_fork_asm+0x1a/0x30 [ 647.631200][T13519] [ 647.633539][T13519] The buggy address belongs to the object at ffff88804c3ec000 [ 647.633539][T13519] which belongs to the cache kmalloc-8k of size 8192 [ 647.647608][T13519] The buggy address is located 1936 bytes inside of [ 647.647608][T13519] freed 8192-byte region [ffff88804c3ec000, ffff88804c3ee000) [ 647.661594][T13519] [ 647.663935][T13519] The buggy address belongs to the physical page: [ 647.670374][T13519] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4c3e8 [ 647.679150][T13519] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 647.687673][T13519] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 647.695244][T13519] page_type: f5(slab) [ 647.699271][T13519] raw: 00fff00000000040 ffff88813feac280 dead000000000100 dead000000000122 [ 647.707878][T13519] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 647.716505][T13519] head: 00fff00000000040 ffff88813feac280 dead000000000100 dead000000000122 [ 647.725192][T13519] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 647.733877][T13519] head: 00fff00000000003 ffffea000130fa01 00000000ffffffff 00000000ffffffff [ 647.742586][T13519] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 647.751287][T13519] page dumped because: kasan: bad access detected [ 647.757706][T13519] page_owner tracks the page as allocated [ 647.763427][T13519] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12905, tgid 12904 (syz.1.1935), ts 604566784848, free_ts 604563715393 [ 647.784979][T13519] post_alloc_hook+0x231/0x280 [ 647.789795][T13519] get_page_from_freelist+0x24dc/0x2580 [ 647.795358][T13519] __alloc_frozen_pages_noprof+0x18d/0x380 [ 647.801177][T13519] allocate_slab+0x77/0x660 [ 647.805704][T13519] refill_objects+0x331/0x3c0 [ 647.810403][T13519] __pcs_replace_empty_main+0x2e6/0x730 [ 647.815986][T13519] __kmalloc_noprof+0x474/0x760 [ 647.820854][T13519] snd_seq_oss_readq_new+0x86/0x230 [ 647.826071][T13519] snd_seq_oss_open+0x81e/0xfc0 [ 647.830931][T13519] odev_open+0x67/0xd0 [ 647.835026][T13519] chrdev_open+0x4cd/0x5e0 [ 647.839482][T13519] do_dentry_open+0x785/0x14e0 [ 647.844268][T13519] vfs_open+0x3b/0x340 [ 647.848374][T13519] path_openat+0x2e08/0x3860 [ 647.852976][T13519] do_file_open+0x23e/0x4a0 [ 647.857499][T13519] do_sys_openat2+0x113/0x200 [ 647.862214][T13519] page last free pid 7610 tgid 7610 stack trace: [ 647.868546][T13519] __free_frozen_pages+0xc2b/0xdb0 [ 647.873678][T13519] skb_release_data+0x741/0x8f0 [ 647.878573][T13519] __kfree_skb+0x5d/0x210 [ 647.883015][T13519] batadv_forw_packet_free+0x65/0x1f0 [ 647.888411][T13519] process_scheduled_works+0xb6e/0x18c0 [ 647.893978][T13519] worker_thread+0xa53/0xfc0 [ 647.898587][T13519] kthread+0x388/0x470 [ 647.902667][T13519] ret_from_fork+0x51e/0xb90 [ 647.907271][T13519] ret_from_fork_asm+0x1a/0x30 [ 647.912074][T13519] [ 647.914426][T13519] Memory state around the buggy address: [ 647.920070][T13519] ffff88804c3ec680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 647.928139][T13519] ffff88804c3ec700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 647.936301][T13519] >ffff88804c3ec780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 647.944374][T13519] ^ [ 647.948979][T13519] ffff88804c3ec800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 647.957058][T13519] ffff88804c3ec880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 647.965134][T13519] ================================================================== [ 647.994494][ T5950] em28xx 5-1:0.132: Remote control support is not available for this card. [ 648.004237][T13519] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 648.011493][T13519] CPU: 1 UID: 0 PID: 13519 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 648.022115][T13519] Tainted: [L]=SOFTLOCKUP [ 648.026456][T13519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 648.036530][T13519] Call Trace: [ 648.039848][T13519] [ 648.042806][T13519] vpanic+0x56c/0xa60 [ 648.046856][T13519] ? __pfx_vpanic+0x10/0x10 [ 648.051409][T13519] panic+0xc5/0xd0 [ 648.055180][T13519] ? __pfx_panic+0x10/0x10 [ 648.059647][T13519] ? preempt_schedule_thunk+0x16/0x30 [ 648.065050][T13519] ? preempt_schedule_thunk+0x16/0x30 [ 648.070452][T13519] ? v4l2_fh_open+0xac/0x420 [ 648.075066][T13519] check_panic_on_warn+0x89/0xb0 [ 648.080031][T13519] ? v4l2_fh_open+0xac/0x420 [ 648.084652][T13519] end_report+0x73/0x180 [ 648.088931][T13519] ? v4l2_fh_open+0xac/0x420 [ 648.093542][T13519] kasan_report+0x128/0x150 [ 648.098093][T13519] ? v4l2_fh_open+0xac/0x420 [ 648.102726][T13519] v4l2_fh_open+0xac/0x420 [ 648.107168][T13519] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 648.113208][T13519] em28xx_v4l2_open+0x157/0x9a0 [ 648.118093][T13519] ? do_raw_spin_lock+0x12b/0x2f0 [ 648.123142][T13519] v4l2_open+0x1bf/0x3a0 [ 648.127413][T13519] chrdev_open+0x4cd/0x5e0 [ 648.131873][T13519] ? __pfx_chrdev_open+0x10/0x10 [ 648.136844][T13519] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 648.143207][T13519] ? __pfx_chrdev_open+0x10/0x10 [ 648.148180][T13519] do_dentry_open+0x785/0x14e0 [ 648.153048][T13519] vfs_open+0x3b/0x340 [ 648.157168][T13519] ? path_openat+0x2df0/0x3860 [ 648.161966][T13519] path_openat+0x2e08/0x3860 [ 648.166599][T13519] ? __pfx_stack_trace_save+0x10/0x10 [ 648.172008][T13519] ? stack_depot_save_flags+0x33/0x810 [ 648.177497][T13519] ? __pfx_path_openat+0x10/0x10 [ 648.182471][T13519] ? __x64_sys_openat+0x138/0x170 [ 648.187534][T13519] ? do_syscall_64+0x14d/0xf80 [ 648.192334][T13519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.198458][T13519] ? __lock_acquire+0x6b5/0x2cf0 [ 648.203432][T13519] do_file_open+0x23e/0x4a0 [ 648.207985][T13519] ? __pfx_do_file_open+0x10/0x10 [ 648.213054][T13519] ? _raw_spin_unlock+0x28/0x50 [ 648.217943][T13519] ? alloc_fd+0x64b/0x6c0 [ 648.222316][T13519] do_sys_openat2+0x113/0x200 [ 648.227036][T13519] ? __pfx_do_sys_openat2+0x10/0x10 [ 648.232279][T13519] ? exc_page_fault+0x6a/0xc0 [ 648.236992][T13519] ? do_user_addr_fault+0xc6f/0x1340 [ 648.242313][T13519] __x64_sys_openat+0x138/0x170 [ 648.247236][T13519] do_syscall_64+0x14d/0xf80 [ 648.251861][T13519] ? trace_irq_disable+0x3b/0x150 [ 648.256921][T13519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.263059][T13519] ? clear_bhb_loop+0x40/0x90 [ 648.267772][T13519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 648.273699][T13519] RIP: 0033:0x7fdb9cea7407 [ 648.278143][T13519] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 648.297776][T13519] RSP: 002b:00007ffc01e99460 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 648.306318][T13519] RAX: ffffffffffffffda RBX: 00007fdb9d60b880 RCX: 00007fdb9cea7407 [ 648.314312][T13519] RDX: 0000000000000000 RSI: 00007ffc01e9af1b RDI: ffffffffffffff9c [ 648.322320][T13519] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 648.330350][T13519] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 648.338376][T13519] R13: 00007ffc01e996b0 R14: 00007fdb9d772000 R15: 00005574b22a74d8 [ 648.346383][T13519] [ 648.350043][T13519] Kernel Offset: disabled [ 648.354377][T13519] Rebooting in 86400 seconds..