last executing test programs:

9.629214478s ago: executing program 0 (id=1223):
r0 = syz_open_dev$I2C(&(0x7f0000000080), 0x0, 0x100002)
ioctl$I2C_SLAVE(r0, 0x703, 0x3ea)
syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYRESHEX=r0], 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r3 = socket$caif_stream(0x25, 0x1, 0x1)
ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000140)={0x1, 0x0, 0x10001})
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00'})
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x8898, @mcast2, 0x7}, 0x1c)
syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYRES32=r2], 0xffffffffffffffeb)
memfd_create(&(0x7f0000000280)='\x0e\xf7\x86\x93\xb24H\x9bL\b\xbdX-(\x9b\x98\x03\x00\x00\x00\x00\x00\x00\x00U|\x7f2\xf6\xceH\xa4\xdf#\xfc\xea\xa8\xae\x8b\xf1\x84_\x1a\x99$\x8a\b\x00\x00\x00\xf2\xdc\x8e\xa4}\xab\x80\xa5\x0f5\xde\x86\xd0G\x0e\xa8=\x87\x05l\x0f\x9e\xafl\xf0\xbc/s\v\n\xfb_HMC\x88\x06ho\x18\xd51\x06\x16\xa5', 0xc)
syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00')
socket(0x18, 0x5, 0x8001)
timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r4=>0x0)
fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5})
mprotect(&(0x7f0000008000/0x4000)=nil, 0x4000, 0x0)
timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r6 = dup(r5)
read$FUSE(r6, &(0x7f0000006e80)={0x2020}, 0x2020)
syz_fuse_handle_req(r6, &(0x7f0000004e80)="f06c71be9ea1e18b8ae22ed8926289f2dfe3916a56941f478ae8ca0aed14bc3991f195b27c7af06ebf182ccb3e2f2444bea100e2debf44795ed0ce5e49c83f903e6e70e21cb8e1aa750af8a3c61f8cade87d810c516dfd6b2c598002b4db7d7152500fa6e7b1ae59dfcf32b01a1a396da513a8da80ca4a99b720f13e611e3f360925089aa3efe5c80dbcf6ade9a5007320ea304c027db24d5f9b7ca847bf8a7a807190cd465d46ef14eafe74abbe48439ccd6cfa783d218c939977b209a4b593e942ee1b3f7b7174fcdf0ec6893200c2d04f34deb721909471281d1dc537629af23024a0d1ad89b9ded0a0ad575b5c49eb0ee0f19e3d691165bdbf277fde3488ce18bd38828b4c848343fb08f122691539eb607159b372aa2e2cc331650e7fce51d2d020d2d11d6a548facc605cd1dd1e0c8fd3725dde690e849fdf3cdf26fd65b6bc0077e17e73ad1a2c2edbd568146ddce9ec90b5fc2ae20d2b0f87d512f2ee46de31044e942e73540cad550cafb40df1530a429984467f87899cb7cca75170d5ca340571d568e8b6d35a64226c705561253ddaf01b3e042949d5cd9c249c9c593db8174501b7e257add090081144547a1559df490f1476d6b476a33d10b308553f8d2ddf02f291ec593b250d61b8804095ea87948bc09ba3905784a70e05cec13d77e3063de6bdfb6c42103701271ef623c7bdf2db92d01bd325d3fd3e86f54c26629bf15d4a294cdc5852825f224174d66fcaa582ecd40f61f616c3b64c21e26e23535dca6687c040f669609160d13a1d1eff44c6aec84ce1a10ea6f852eaf8535faec63865618d8564e136c986ee7de0aa6109a10f52cf28ea2a5919972b24f8d3c6aedea4c914fab435a07440e1176d839a56431cdcf004bb7ea0d038d3175c8ad1f190704802444d7faa10e34b90d3f81ff9b97b55f5acb7e6e81b60574c7f56f9590ac28eb3a37637b66703246479f2cee71bc47d8a57d91e47df2669657483d4fa3e9d117a01c62846c3eb1432e2e799c278ae74a1003f5d18f0c25ae0da401985f10cac6b1e6ef1e4ae400461c60d9fbe3b13e075b5e0ce08dea92e37f2f82d8261dce17ff32dd1c8817853dc0bdde67e0a2673b0b7fcf29deb9dc660568a5771ccc2aad4fbda9946cfd341252049a57c57017909922d59df8a3093e3842a29c7e0648bc247b716c46b8703d9077d3375674eb14d8ffd62c48f56686a5178c325c1f943928fb7fc40ea6d35d13c1e6f0dd97197855801151dad595e0e296aa0ac2ce855c7bc6508408dee3552eacee8a05a9ef4d7d1812ca69776a9f7914bd99e7d66957214788d4efc793d3129000cf573fccfb9c32b5b5ab94549f2a58e4163159f188a27bce5be0bed27cc6fc71d5940be14ab06b982dfa844c0ee76e8596f3b516547fb6451b9894633801ea53034b3f525e630dc0b26713a993219ed42a1761d6b9e4655e8df5d33134391d2412ca6d8b3a5e6965af27b99dd835939acf970ac02dcfbdd0a54566bee5c5ade1ed34258763b2c7071974c9e947ead135fe36304fce55ba2545af6a936b7ab321d055ac0706ee82bb4555b60d33a3b936e90cf809b8d95d28fc1f6c0cb3eca1c2e5602a608b588967ba28d1c4f94049f6c29645131e88bb161a67e7e937b1d18bf774af5253768cb1c009368d698a299951105bc2c7a4cc2b7e62d75e49aa202558aadd025ce5c3ed1a6e617ae3614ffbeebaa4d11ba6df8dbcf9b9a6ca7863fd4847fe28f2d35966db5e6df04745731b8adc988b068e8865393b2f3d594d686e202da8157020fd24c6d19e092a2d7180e4af732b8d96c78926229a5af1334e8c46e65e3a7c367549dc7f5c69897c766dc8fc9c852b56c0eed1edd9fccb06af30c15a7f54d130c48f5fb26b15cb89c74541fefeeb384aa2e652fe750f06a7c3cd18af7438ab2c619bb32f424d139bfd8c48ee24c30738cc9e435cdaf3cdf08121168b74341438a98707b5fbd3121b9219deb18ad7af48011dd4b85de317fddaa0bb32aed6ad405d590ebe71262179546d09fdbd6b77cfe8f9f8797a731de05e60efc6fc6f9bc77af87374c95e0360375382773f162b576587fcc041bf8ea4473fd886d31c279cb83167918f998861236dc017cd5aa4b924de6eb942c31ef433fe2034cce5091ea152cfb0a6cfb76e0b0155f6970036b8a9d2148e65711bbb2e40d8247c6ec7c04b7c34ba773984491864be9fd8e7dcf804d02a9b51d83085ed4c01d3dde63596efede95539e7e33a8c45237770d4d38776df27f415a316b6ddca9180515d4f460a544d65a70931a47cede47a862d1c108bef908761768631bf1057b6795e22709d7bc5fcf9b229618a50b8214ca103d2094ecc6d74e199c0fd804e0438ee8a77501b929da1a5cee932d8d7ec827c2b6766a3097852dca1d59b25c3b505c35af98a2e4eae86ad17d716476de7cfb549f8f07618e0817d4aa5221cb3acd7ca6eb4be20b0cd853affd79a09d61d9af1a4e2b2d2994f7bc74b5aec1ae26f6a21d1316ae4e7a447ab4e488d840f7cf7948ad6491fb5a70fef79d89463ac32f9f3e5faa6c341750948d36bb61dfb7cf59815a74d0776ee6142b2e74661acbcc8caba365edf2f988b991ea4a17828995fe374befc2829199393344ca9ac73cb8ce1f4d1ac3db0c5fd40d18836c27a04acdef316d03177e8bf993c7f31c2d443b40364915a686fedf0ebf3fd9e870df33ba5b4e35f6f699ff9c5b9d8914caa38751dd1c761690037833f6b60063e7e4cf071392c5da21908ada84c91b64b884b242ea98d021ad34bc665789f62e413e8790cfb2697ce8b28a2549d98f92dd2e11be3eef27ff72c14b49399ddbf01cd3e84871370d293d80db19c38d978563c85f34732023cc1910a759d40a0c7f6189fdae1f0b92a625d6218658caca97c4a0ceb925c04cebd947e05134fb12b16dbeb48244a4b81a284823497ed1aab8ea3ce981c34cdd8b4990587e9a3d555077879166d84df14cc99725caa8d52a2c1adf57f69011511ccd9cfe84b02404effa30accc2999ea3c0cb163719fbffc90ee6f773739e3e9305ebee2144e254e3ef62ac2a90fb69628504c0c62170e1499f5bead9713ca4d048c5a386dd00451eb5c31b0c49a447a7895d16db99f6492b97bfcfa93fb74481ab08c111de4cc97f9bc50f79403f357c93a134c24d9737b0ba9a8d469b7d99a25dcb85dbcbb528e9b24e1f821fb6f7404c65a0f54d53975d0d05062d0efe648b65307ab27f856bb25042bf021faf99a6453ae3e71673dcc58bab1d6235da7be87911e4102f3da2f416641ac1348a4c7be79e15fb50b872cddfc3b3b6b7d9096b327009bd346e882481ac3dc03dffe6a0710414ccd3438fef3776e29be79eeec3fc71e11eaaf21ad6b23da489093f4b35c673e9bf622397a4fa319dfdb2bc3f61e436d45f0a84b11cc48bdb8f881beb4609f34d30d42b29b690ab2a77e5c65a48921d8f5ae4c511597138bbce4e2f39cdfa625936bb29a9f291814ffc001a5084584f5b56ac222c0ba69b6bae9d568875f893c85a4e5d7e8b54de7912ded29a9eeb81921fb54a35bfbdadd633fb7edc090bfcc44a95a4477494eac43c54e617604183e8e060ad59d5db59f677663b5c07a56dde23ff113cb63b9c66eeacacb2b3799100495fb6d5c0d97324295e5c724973a2b338aec836d0c7f780fdb0270a44a8fb52a8942d78749b1d473aca27ab9c444021a6f60ee7de61079f84f3403ba8317c7ab20d730b8508d651c48ca1c951215e8a46aa579b9721be2936e50d0e09ca4478fc0e134ead7fe67ac247fd3ee2e5676b6b4c252f3fc09224f8c356f4a0e00f7b36d4a981302e0ac298fbc4db27e2047a3ae73668d30766b724d0644005a6ca4aa439fb78a8969c4d12969ebe11506e867552abeb3bf19d0fdf4cdbe98e61e6b50c3da3416dee00090a0e47351fa2ac47b3909693d41ba787476f9f4f25ceae83a24bdbc2fc38aff60de09b8ea0be585e82d6a9d9f095ab03362faabc080f677ebc70c991d77b4a15a72de1284554ad534de09766905b67bac0a7f8fed015f97d7feed6b1e81fe6799fb3a86756aa49f09ffc2b8a857aa14b56392eb310cdbff3a12b61c037212009be338ce681e215649125e93997312539869e078a4363056eba834d4bb2fc3b805ec13189f5a7df40c8b581e12d71339c329b50697152ef259fdad449b1ebfd5362f7aaf666a5f5dc4f7a6499b8a611a5aa37ea88d799c322242d010d1a11abf0c1641c9a06789089adc7d0a073da3399ffcfd600a34725cd91f903c8afc6cd2c97fb3822f381ae1789386659d1191877efd1698fc73d32062c78a2f0050dd675d676a86c4a8827e53eccf4ce547d88acf7283120e6ef1aaf0ba403b57f8c0159a08cb820b59cd7c2cc1aee55e5b6f55df47ac77f13c7e6cd08971557233e319ab53e840109cdda441323354b46d2e422cd86cb09a9da9229514d560166df7019b2919535597eabe3f2b36718fcd3880eb56ae53f5f12e25fc347faaa130a564f97e21151fde5163e1c82b91d12a97c393085cc7631f0fa88d4f52df57c4bb96d665a47edaeb174951badc2b3abb88b8246a2325228e21fa7eac286eaa18ff7d5314c003ca9362309cc7bc9992fd83ae2d5cf7225654bf08c98c1167e205955f6e1fc0eb8e60bb3911ab729438841ebc5f0eeefd80203fde5ec33b99787dbdbb073b3ac9072cbb76ced62e176f76cc5fb463bb7ae1315d2cc1f3a449d64f0cb9a4396e6427154768f01b68f3fa61c9be1a57c7646819c52e4ff6f5b5b43e6bfff6c3bafe722bf0e9a5e9f2bea72cac5780a548eaad0b8507c8feee63283f6c9f10269146cc801391500fb26469711e2a6495d4e9e45c0fc6753bb453f9347e92f3c97932b940d6530405aad8a057bc417f690e0e166f763962cf334a13df8231cedd9ed22207be09a850080b26f1d970fa6950e58ba6ea416c17d6efad4ccc14ab6d288b4343e46b0ccd4fc1d1cc7c87e7438d6449fafa5dd8d19c67b956a5898a4075867cd448bb94119a244f053f6889232667f0bd530526cef01da2f86944dbc9ae4557df8e04c6051cc723e988086e85d3b842935eddb9aee70fb87a35c865f62d6be26a39f8093efdbb777988aca6a1a968a8a96220888057f3f06734933dcde9e6ac82fb3db1c66c92d755c5eaed1d5cb762454c53a13008f30f749409cefb3c1d832f89d8f4983bd3ab00ba2c01a348afa5be2b144ba03b0a5d3986b8332017d033a1c82c98141102af589a4dda90417a6f27bda6ec856b2d0c836167a567a91eaaf413b76ba623e7a74211af0a3b8e296fcb3a432e7db01e691df3749a13cca67d6655197c929956ace5cda77b59b12e8c6179d0af7c77e102872166060858ad429b6eec25f4637d92412a4891d707d8a58c7cd5fae6f0f1f8fa9c15ce2d91f14317f6a4c002ea2ac92bb08dbefefed0c389d9fca0fe63b6d01366eb2d2e89ae5ba4d3eba5763889fd4c1853255d2873b0917303742a96efb11cd8e6bc778d37d953d283cbfb1480880f1383921ccb7a16dc514a00ed6fe5008500cd1627e663d41dbc1b39df477879dbc4586d8a661d4ee05c4bcca8d21212b7ba6e6560076fb4fd272b2fb4a4356c26f7a11ffa947fe9f8c018239dd9d5411b488101958eb39660115390df340249a8eaf20cee42561a2ffbdca65a095c2703d121d59b724aa9835c9a52d0e2298f8748580a6f0db1028d3cca4530e6829b1b78c170e48c7a6f52c47dd65a452838bed890df04167f1cb8c4c1ab594e874d1472e91620a929e05396152602f217e3d27b967f2f032da83d5952cca6f2977785405bead78a3214a7f4d6b9e0c045734c9b4e2eba82d39955f2bccd41ede1d0a2d5a2a39ae39558094d07151e4ee5f4f0755209e2ef8de52c590942bc18c788e153ef4d3062234994d1174f1db483ce989d6f42f9e0290722fb75ba20df0fe2afa43a5e9af6488778d8557aca54599bab5461100ed8b009271dbfab77a8949c90ba356ef9e130f2e53681de9020a12b06f635ae6e4ce0f8e2c3b283a9d24386edb2b9fd48fbd57593f8f064e23db45cd13fe2d51e4b2808d497983a9ddb3f53163f7b88123f3152dab9c4ee564395db25695361b25eeba21d09a0f3417741bbaa167df88822b16320603077df40e5d95ec38d14a45a18f51aa6b492e6115b35e74705ba4bd58093fd46c5f555fd9f7d453ccba5abf606939e88944321d1c2dca4b2a1567757d56ef83218b120bf7032faeb6789ab738911d4ef47fe160047e08106438fabe43295dbd1291c3ce6d1e3397f12de4c0125bd23818215b2d494973573ca9ddc983bcddb1e90fbe2aadc4c0b02c987771eb6e9fa7c4c7011aa1576649210d8ad36b203ebaae9aac00830a3a0244c522a64081d443f377f3e7521263bd40c5d84c2210eb4fdfd81db125c1f5b36204463664ab5c1dfc59946f4406c174f9552ec8df0253fffc74cdec337665ab74f762c92292a22e2dd52b83b84a123b67ae8e065f55bb3709a803743c0fa96ac236c4ade3ce16f0d169a712b67e9aa80992896ff03ac51a4f985750fa0d27e3f4164b7fcd80dc0c78c06dbd898bae606ada022266569581c6efe984a1a81b54581b56cf6648e33c9ed71ffb7fc94b5e4019832d553eca7fa154ae02df41a5c27856282c98c6fff3e9dc00ec45e67338569ea687e25dda1fa4b62d60847d13273a27520a02191c087dbe2e9d47b7f11ada6546b0c66b026f1916acf079f05ebc69bf3c82b1bee6ce4ed95b3978122078f717cb45dbd9cee6b8e5523b243c9c3ab27063dadc953fa3aa81e60daf4fbc38584cb3abbedc38e175a8feda09ffbb0785fa42b9c972742efab4ef5635fd810802649575d850e60b4b17d7359568b975954d935d15ed81f760434627adaaebd50996c681043d0ea5f61f8c8358849299d55b763cef7d833f9ef8750b462c711f9c763a3f95fa2c785a5e24a71b3be244968600f1dc87263090fa065d9f5b498333e19d82e5984fe7431ccb2d5815b5842f8b5f24bda6e835c8cfb6c3b63db5151e1c138135d89a6c523f3cdae319393ff3b05e07f11b456464d7d34a8e4ec93e3ca29dcf61f29d3e9390c925a17766a893751c7f42e3baf7eefa77b06e8200c2f4647e7fac0f7bf86012a7c957aca911a6dbd8dea0ad12e60813129b859794d8e38f39e797ba4729b269ac93d17000e8d1d0bd9e195d83fda977c3a0316f48dd150fcdaed9072c22c9a7b472616f00c5ce250ad6f6ad93da823ffe2a48f925fa3b6e9ab66d013d61cf7df56be9a25e4dda4fcc2a2d605a0aff8b8fd18a19f98bee0323563e427d80b46be5a981abd8e616fe3f5dd23828594e86e1dcf22d7749f3258c604798be30d9936e426d49c60bb9f88e8150fc892051eb2e82acf3bdbf16b9fa4f5e82c138ce201fb1d1de21aa2c699ce00212e4132cc0fcc665927aa41af5d2c45d879c0b534d5c74f2a9a2225993710318452f3c15b28c49efecd5a6c216a271bd0d625b4c9cfd56f2134578181d911645ab0265d560feedafcbe4ffaf4d63ba3b7bccb79d3574971998bfce00369a3c01b4c2c5e7e006f44ac38bdb4e1781830a1ccc9d1456673d90902cb29c51927f6cbfd67bfb24e02d8581e8f7dd996ae5afc5944bbfd57b2266e533d76a9f48774bada4e7e3b58aa5bba5dbb7998dfa8a076642d0b3fe6698d046217e8531bcecc8b2707834a4c21aa703b4da4aac7417adb843747125bb7744aba30d978782a24dc88f1e741fbb1ced581fd0a2807a93be5fa28040dd6f86063e8c931a8df6e9cde2c25f31432c65dd43fdbd2067a932da2e8a3f715067170248d7112a1ae7af4c84b72d065aaafcd03c2cd603f716579c682c7358e0e0e55ea5710531213b5f18a6432b2a0260b493a72863952b9fc7efe01855a4123ae206e90ad8b00e5454d681df308e718002e6e3d6fb709d06fc2f9ef25656b106a76bb06b1e506b97c367c413bb988b07d5c0915221161ad03e8fe8b8368da3ee38d92e928fd3b5780b93c2ac9c5fd27100bafabe1767a487e03192d756518f495c15bb8eac87572c14e88a64ec48769e98081923368e53df95f3f5d5391fe917238aa7c882ff55826ac54192c6b46f4f047069a6df7b313df0a38a2a5f9c6a8ba5be4ba6f91f6faba8f41969a10bcfaff9a000ca7a973ee4342c4b6377cb16edae11b52913bc5fc47b6a0388d8c5532c59457991ca36b77a2e480bb591c1759d17469748e6cf9278665425897d5f86638dd91c6487be2c719ae2d9de114c4ab33292b45255cd320ca1d9d3f34415a1d8a074818d24cd83d2b1db738d337deae672ab8805308fe2a11e415fda0709e2faf59440572e35f3dd54d1ca205f5896e2f9e905096b3fa73116ea914d8d968c909e03be2e42dc3670b4865f7949d2d4698b9979c9be4d02e08894f358be375784931fa097dcc408db3630b5287842b0b42e2835cbc08821d24b55ca71d15e00179ca4739fa61c6a3a32305a8d529c2f92b6e9a440117ec4a8889e47720d15260f464a990240871af9b20e36ea1da072688040c17f50ab532aade79dc3981b8d3194b1c58f74c030777233ae78f9fe81cb7005e9862951b95ac8f7d7292ab07d918a706567ea66492636c6f6a5c95bce0d6acb66af7f15b4153f7da539105578b090758f7272bc7664e7cf641365947db9dae84b92b83fb5321e3693a1938e28e7b6aed85f0927a5393e876ed233e8e9c8599a054689507053f5fb14f54a62b84a75a112699f97de6f20f602e7f2a0d16e97870e96de50308a4735669008bb53d64f6e6f753a5c53fe1027864aae703effef448bbfe7475bcc42fb4470c004498674bf7a56e1da596062330d00fe744d38f1ca3702725c9475cdf4dcf7ed250e2f4cb0a7bca8b506a5d91b759ec39d5e832502d9468a97b32fe13d722232933e0a709963f70da38be91ea2bdd7e38132b1bc3c7a488fc9439b3db3c6752c684d853cdaacc8025a8fa9fd532137c6943b2250d6165f875912f11a502f98b1990bc8ae6a96e146bdf9e9428ae01c04264327c2469fa32fd280f1cfea573dd8b8c1d7fe547a16c870bae47a29eb2462082b402d4df6be2f9b9f0c8d6310ec32b94b76a175ff8d04b5c10b35cfda26419515eadc2af36737d1a37f48f4ea46fc937871e3181533646122e266bbc3990ef3a1c582d873a0041cfd72406f028e53906a3494309cbaf4da24b09d0c1ba3c856e6436f7ac9e595890c6f4af4819b978a05eb3caff979dfa8cc48fb2d6e25cac18f99c9c57a6609aa968e39cd7334d61b22f1a3c599b50a9272e95f9765eb65e2486d32a56523802e76d63ee8138e36e399cf562fdb2064f90475cb974119115bfb036fe01bbd46c603184845c52f4ceda3826dead956e6a153c400513a4c3823018c086fe9e68d9ae7a6d1e04e78379258d7d888d61363604af3257e63503b598332dde7dba36881ca83db525315d5df9ab6b092b5e12578c2d6d28409da4801c7b64207257ea3b9cb0188db08ea7cba46a6606b9c6624ad368a4eac074fdb794c535a2eabce731a934119f95c572836da58745b387dc7aa563bfaaf4235773c58c3cf9a76260a652d1aabb202660581a05be481e3687c73f82d664ddb733b68f89d734b46d7c91033147e61be77e11d98de08393ab4c25da9a6b6c01721a4141b11362f8581fd655fb5e4a30726efaf68bc2dacfc47fed98ed8094ce91202831b8a998d324d7cf86fd26aa88e2e3e208b47b4179cc3724d6cdd33bde489cdaa70c884463063ee99d0350272746ce0772e72256c67f78a188405498eb731fa6a43141353d065dca6fb87a6ecf38fb989dfbf0c89afddfef72bc7d6fd8919a91002ea8dc7f13c3a376adc27021cbb7453c97520d9e86c3b9da30e8c68f70d11bfe108ecff0ecb38a59f0575a5eae0079c504ba8d445733e2efe0e6b051ebf60547707a66a19671867b7e49f0b9b74efc3b3fa39ce287bdccb7163ea85d944fb1b6c7c86d8e81a3a20f241215094d706b4dadbb6897eab38ecf399cf41fbcc6a82e21bb77cd93fd1bfd0e916b84f6ab20e48b041d3e97a5b2216fcc1ff47d07cd5f2d736f79291d00b49d9cc8ae8819d086f583a930612f549416bffd9cd58f0cdba540d2f7ea66d08dba5aba7f2bba5ef9c148e1efb3af6618230cc675ed94f28e560188a90e72500eec3ee5c1ced1493399a44ee74355fe11cc71fe80505eab48c4fa02746f6a4020f740d9c2dd5074d936fd4661ed8dd8efc6a2d614f55df76dfd2e509bf7506234474eedae12f9f6997ba90c213722c8298c583d8f6253a8bcf2d328378adf508b1d961be1af39efa0a279a5b4c3ee0da3e8a68a9e5e375b779f6015e4ccb34a8cdf93ff27055fe41c1cce8223e0dc870ab41ee299f6f515308340a6157f2c5cc2d0c932b98240345db5776eff9a0ea28fbca9858eec6a70bd2174ab8f9f3e0893cc1afc4664c511d31d7591a600f04c938af26a7fe24ea96a5e3a3806ad022295ebfccbe50af7688acc28d48e4400416af9266c3c996cfc101d243139ff8a0551667d3d48d4d88b7e5120d14d18fc1b4d9f80fd76f1f71301ed327773cf12eceb3866fad17442576fc41663cebb94310df4331f226fb80771618b504ca0c71aec3fedda1ce30cd0de8053f4c004a8d8b288d03a60bdb9ae27eab0d6028ef1928093fb17767afae194bdbb7e26176a521d088d7ead8c404a1e498ef8c9786764ab7658c856459373f2d99cfeaca8869d8b6596236008114df49aecbf7ee76b2687620e6d809a70ca29eb00950d49620c3db9911b2eaf9787a4d81c28f571208a10c9ad534cdde895b050be67333d6bf51ed264788086167bd99b7af42349a2ff70b5a00bb7f04d8c4715b6c222ba3bc15c32d00c88abb3159a3633e6687b500d400c54bb52e7ca5187143a62d8efa1ab652d8671aa40a237a8f1c099fa5a29a0a8ea683f7580c28e18958662e8a323a6f39b3603d060711dfcb0971e4e359c21fb68aeb24adcceb1c8ca436b03fc06ef4df90653b7b1d59b26d0090cf34264b7c4e17ea2093206fd37dc399819588d136ef2927b67c52633b69eb03fed90678b495de2504c0df129710b9fe0d64751572b4e5c6dcdb43cf171212a38f5fd1abad4ca53344669febac99d971df691af94a2dfaf9dcfd4332dbcfd03481feca9fd29d3c572ca589f383a2e7dc0ece37ed462b7543bb18439503510669323e687e8c4a2c19b8dd06a3298982daed4ffd0bdb38f9839f2bd058e1f97cbcc414f16fea22575999ed8d000cb01953380771defb9f991d397cd5877830bbfb9f206e845778029ccd67f5275552e83669afaa6cd3b9b54d811b42a2cdc42cd9d1ffac5b992e0671b1ec7c90bea258515525e76f72b21d4eb4ba7c8decefcfb8d5a9df16845cb264f38903d43ec47a15625ff5db24745dee593f05518da7a43ad672c35784bd5fd63efaa2c95f7dcf28eeb81c1758f7c7d04c00405728b0c5bdc81ad524d8719286940ca851b81d515ea3d9ed5cd43a504b3f2000826957a73a99cf83430289df71618cac5d7db787b3", 0x2000, &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='smaps_rollup\x00')
fchdir(r7)
r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000000)=[@register_looper={0x40086315}], 0x0, 0x0, 0x0})
r9 = inotify_init()
inotify_add_watch(r9, &(0x7f0000000000)='./file0\x00', 0x80000006)
mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
memfd_create(&(0x7f00000005c0)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1)

8.571014362s ago: executing program 4 (id=1230):
r0 = socket$inet6(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x401, 0x1000004, 0x0, {0x0, 0x0, 0x0, 0x0, 0x503, 0x20000}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x1}, @IFLA_OPERSTATE={0x5, 0x10, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004800}, 0x4000000)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac141400340008"], 0x2c}}, 0x0)
sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b)
socket(0x2, 0x3, 0xff)
syz_emit_ethernet(0x6a, &(0x7f0000000200)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x1, 0xb, 0x5c, 0x66, 0x0, 0x5, 0x1, 0x0, @remote, @remote}, @redirect={0x5, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, {0x10, 0x4, 0x0, 0x24, 0x6, 0x65, 0x4c0, 0x33, 0xff, 0x9, @multicast1, @dev={0xac, 0x14, 0x14, 0x11}, {[@timestamp_prespec={0x44, 0x2c, 0x16, 0x3, 0x4, [{@private=0xa010102, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@rand_addr=0x64010102, 0x10009}, {@multicast2, 0x12000000}, {@broadcast, 0x5}]}]}}}}}}}, 0x0)

8.266730999s ago: executing program 4 (id=1232):
socket$can_bcm(0x1d, 0x2, 0x2)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TCFLSH(r2, 0x4b63, 0x3)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socket$inet6(0xa, 0x3, 0xff)
socket$key(0xf, 0x3, 0x2)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e)
sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
write$P9_RVERSION(0xffffffffffffffff, 0x0, 0xfffffffffffffe3e)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)
sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff)='X', 0x1, 0x0, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x2, 0x89, 0x8, 0x20b319, 0x3}, 0x0)
r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GET_LEASE(r5, 0xc01064c8, &(0x7f00000001c0)={0x2, 0x0, &(0x7f0000000240)=[0x0, 0x0]})
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4)
setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xcac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308a3d40aa1c788df6"}, 0xd8)
connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000000c0), 0x4)
setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4)
ioctl$int_in(r6, 0x5452, &(0x7f0000000140)=0xcf34)
writev(r6, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1)

6.552111482s ago: executing program 0 (id=1240):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f000005000700840000000600"], 0x74}, 0x1, 0x0, 0x0, 0x10040007}, 0x0)

6.468062217s ago: executing program 0 (id=1242):
socket$nl_route(0x10, 0x3, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x25, &(0x7f0000000000)=0x8, 0x4)
r1 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r1, &(0x7f00000003c0)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x6}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000040)='X', 0x1}], 0x1}}], 0x1, 0x200400d1)
shutdown(r1, 0x1)
setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x83, &(0x7f0000000480)={0x0, 0x2}, 0x8)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x3fe, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000500)={0xc, 0x1, 0x2, "3bd9d3fe337649c318d3b5710fe89a0d9ec9b50e98bc2e00", 0x32315241})
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8101, 0x0, 0x7, 0x0, 0x3ff, 0xfa11, 0xffffffff}, 0x0)
fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1)
write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0)
r5 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, 0x0)
ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f00000002c0)=0x3)
r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={<r7=>0xffffffffffffffff}, 0x111}}, 0x20)
r8 = socket(0x40000000015, 0x6, 0x3)
connect$inet(r8, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10)
bind$inet(r8, 0x0, 0x0)
sendto$inet(r8, 0x0, 0x0, 0x0, 0x0, 0x0)
sendmsg$nl_xfrm(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[], 0x18}}, 0x0)
getsockopt(r8, 0x7, 0xb60, 0x0, &(0x7f0000000040))
write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r6, &(0x7f0000000140)={0x15, 0x110, 0xfa00, {r7, 0x1, 0x30, 0x30, 0x0, @in6={0x1b, 0x4000, 0x0, @loopback, 0x10000bff}, @ib={0x1b, 0xd9, 0x100fff, {"4a50abf0c8ed50f638facd57de629163"}, 0x8000000000000001, 0x2, 0x3}}}, 0x118)

5.944009853s ago: executing program 4 (id=1244):
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @loopback}], 0x10)
r1 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000300)={0x7fffffff, 0xfc}, 0x10)
sendmsg$kcm(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x10}, 0x0)
sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000000)="fd", 0x1}], 0x1, 0x0, 0x0, 0x804c044}, 0x881)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0)
r3 = dup(r0)
write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000180)={0x4, 0xffffff95, 0xfa00, {0xffffffffffffffff, 0x4}}, 0x29fdf)
write$RDMA_USER_CM_CMD_MIGRATE_ID(r3, &(0x7f00000000c0)={0x12, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, r3}}, 0x18)

5.347283836s ago: executing program 1 (id=1248):
socket(0xa, 0x2, 0x0)
socket$inet6(0xa, 0x1, 0x0)
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/udp6\x00')
socket(0xa, 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff)
dup(r0)
socket(0x10, 0x3, 0x0)
socket$inet(0x2, 0x3, 0x8)
socket$netlink(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
socket$inet_udp(0x2, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_tcp(0x2, 0x1, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'bond0\x00', <r2=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="4400000010001d0025bd7000fadbdf2500000000", @ANYRES32=r2, @ANYBLOB, @ANYRES64=r1], 0x44}, 0x1, 0x0, 0x0, 0x40448e0}, 0x4000)

5.202712173s ago: executing program 0 (id=1249):
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'virt_wifi0\x00'})
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
msgctl$MSG_STAT(0x0, 0xb, 0x0)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
syz_open_dev$dri(0x0, 0xd21, 0x4000)
r2 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x41, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYBLOB="840000001000010029bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="4db20200201a0100140003006e657464657673696d30000000000000480016804400018040000c8014000104ff0300ff88a8000014000100390e00003f0000000d000000810000001400010006000000af0600000700000088a8000005001100060000000000000000000000337289ae8504346600e663960b2466b8aeb6d543ca7b0ab342095dd8aa80a9436ac2f322cd6bb964e3248157af44c58b53fb284ad18ee521b78b0b06ef2dad6158b7e9a5a099c23ff2e5a4f76b865a82818641f06dd6e5a447eed69dd0eb0c356e744afe52ad9e3f7a4ee55afa2316f56ff79b8928a92f1afe8c6d0077f0960092ad769d4294fff153"], 0x84}, 0x1, 0x0, 0x0, 0xc1}, 0x0)
ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f0000000040))
r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
syz_open_dev$swradio(&(0x7f0000000240), 0x0, 0x2)
ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}]})
r6 = msgget$private(0x0, 0x4a0)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c0000001000050400"/20, @ANYRES32=0x0, @ANYBLOB="5d580000000000001c001a8018000a801400070000000000000000000000000000000001140003006970766c616e310000000000000000001c0012800b0001006970766c616e00000c0002800600010000000000"], 0x6c}, 0x1, 0x0, 0x0, 0x840}, 0x0)
msgctl$IPC_STAT(r6, 0x2, 0x0)
ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000380)={[0xf, 0x3, 0x4, 0x1000000000000002, 0x102000000000002, 0x8000000d, 0x2004c8, 0xffff, 0x3, 0x200, 0xffffffffffffffff, 0x7fffffffffffffff, 0xd0b, 0xffffbffffffffff6, 0x2000000000000003, 0x5], 0x80a0000, 0x4284})
ioctl$KVM_RUN(r5, 0xae80, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
syz_open_procfs(0xffffffffffffffff, 0x0)
prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0)
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x0)

5.201138054s ago: executing program 1 (id=1250):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(ecb-aes-aesni)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="10797fcd6cd957d2b903c6bf46b4abf3629ff075475e4bd6e43be1712bf8b4dc", 0x20)
r1 = accept4(r0, 0x0, 0x0, 0x80000)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000007bc0)="f78d9ca38fff48f3be52163448412653", 0x10}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x4000814}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1}, 0x0)

5.073145898s ago: executing program 1 (id=1251):
munmap(&(0x7f0000000000/0x9000)=nil, 0x9000) (async)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=@newsa={0x138, 0x1a, 0x713, 0x0, 0x0, {{@in6=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xa0}, {@in=@empty, 0x0, 0x3c}, @in=@dev={0xac, 0x14, 0x14, 0x37}, {0x0, 0x0, 0x3, 0x0, 0xb4, 0x0, 0x0, 0x20000040}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x8, 0x2}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x60}, [@algo_auth={0x48, 0x1, {{'rmd160\x00'}}}]}, 0x138}}, 0x0) (async)
r1 = gettid()
r2 = syz_open_dev$media(&(0x7f0000000000), 0x8, 0x80)
ioctl$MEDIA_IOC_REQUEST_ALLOC(r2, 0x80047c05, 0xffffffffffffffff) (async)
sigaltstack(&(0x7f0000000480)={&(0x7f0000002340)=""/4126, 0x80000001, 0x101e}, 0x0) (async)
rt_sigqueueinfo(r1, 0x21, &(0x7f0000000100)={0x1f})

5.052899837s ago: executing program 1 (id=1252):
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4e20, @broadcast}})
bind$inet(0xffffffffffffffff, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r1 = getpid()
sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
umount2(&(0x7f0000000140)='./file0\x00', 0x1)
sendto$inet6(r4, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e1f, 0xffffffff, @loopback, 0x3}, 0x13)
r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fdc01a40f30c74933bbc0000000109021b0001000000000904000001a7a00f00090582020002"], 0x0)
syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="00000000003d3823d6188056b22ad7b8a4ba1fd4fed59e45e1b7b95f7926ba335117a0000000000000000773a1aefd3d571dc97f52f4ed50739bb116924f111bce6ac8814308e15bd7d8f397f4b680400ee5361cca4f3b5d861528c798bc57844abb99bf90775049a8e79e390f75d148e0e1ef7f25c164ba5a50b371b4c974b32adc1e0502440dd50c2c44a02ec36f67649208ba3c69920f60ec30076af01f52ae8acc3d7311a3398622f59c16a315c2d677e66ca7a4a08ff6b5f28ed822aa57996ec9b34301c0705935a5bb750aecf1264e0607002b6d0e54d83c4903a112f28b43d9c2b13475383010509c737bde72c69a4c6bf8dc0ab202f2fb03a6f93923e73369126e67c3dff67b2ff1820078911e5d69f685481df247fd007b2aebe20734d457e1e58e3f61eaab338de7a9c884053db2349811a0b99ee7746ac47c450110f2ec0b2fa46618e2d4061e0dbdaeb3f16c38da79f17707bfe9ff34a72db6dabc54816a6deff0764a9dccc91aaf1889249ed48086ccb574cdbe020f0f96c6d6ac17fb6c55b2ebafd1035f803c1001e7d4964f8b7e3d36cce7d9725c7802e80c6470a559792dea11e0e9e0fbdb952cc2f84302001ec5a86fd42e7199054027af59ec40590169656323a629325a2e490bb74c310b0107f2efbe7075d96955a135bda58265fd14605d5863c932759f31b680ba9e4e2ff127e00949cb97b413e4b405c15db29cce02c8bdb5711d7c74385fb1095fc1a568ff7bafddf556eeb745f1d13f2ccdfbfb27dc3132668eba2de2bd36ac545913fb0d224ea382cb2a8b0c4672886b433d88888db3b0ec7521ed30ff5c80ba9718550d9e9f4d656d3cde51002f667e92865fe06fbe4a500ae127facb90c1838541a1ca5b3788070454f3f160a806de74a085d7f439a811d31ce8954ea4e8a31d656ea58dae284f6cf03d1657faa06ce4aaa879add24f8856fd162c3bda1d13d1d6fabd3fc0a9db092eab5e8c5e8723b9db29c6c4"])
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, r4, 0x9c1e7000)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r0, 0x891c, &(0x7f0000000540)={'batadv_slave_1\x00', {0x2, 0x0, @private=0xffffffff}})
open(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
socket$inet6(0xa, 0x2, 0x0)
pipe2(&(0x7f0000000040)={<r6=>0xffffffffffffffff, <r7=>0xffffffffffffffff}, 0x0)
socket$inet6(0xa, 0x8080e, 0xfffffff8)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
r8 = socket(0x10, 0x803, 0x0)
fstat(r8, &(0x7f0000000040))
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000004000000ff0f00000500000004000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000292c2500000000000000000000100000000000"], 0x50)
syz_usb_connect$uac1(0x0, 0xa4, &(0x7f00000001c0)=ANY=[@ANYBLOB="2a01000020000040b708000000000000430109029200030172e5000904000000010100000a24010000000201020c0d240700000500006e626805000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r7, @ANYBLOB="05", @ANYRES16=r6, @ANYRES16=r7], 0x0)

4.957868091s ago: executing program 4 (id=1253):
r0 = gettid()
r1 = socket(0x2, 0x805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @broadcast}]}, &(0x7f0000000180)=0x10)
r2 = socket$inet(0x2, 0x80001, 0x84)
openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r3=>0x0}, &(0x7f00000000c0)=0x8)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x74, &(0x7f0000000200)={r3, 0x41, 0x20, 0xaefc}, &(0x7f0000000240)=0x18)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=<r4=>0x0)
timer_settime(r4, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
r5 = socket$kcm(0x2, 0x1, 0x84)
sendmsg$inet(r5, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc)
sendmsg$inet(r5, &(0x7f0000000680)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x4000080)
r6 = socket(0xa, 0x5, 0x0)
listen(r6, 0x100)
sendmmsg$inet(r6, &(0x7f0000001080)=[{{&(0x7f0000000500)={0x2, 0x4e24, @remote}, 0x10, &(0x7f0000000d00)=[{&(0x7f0000000980)='^', 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[@ip_ttl={{0x10, 0x84, 0x2, 0x6}}], 0x10}}], 0x2, 0x840)
syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)

4.389250273s ago: executing program 3 (id=1254):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket(0x10, 0x803, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x100, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x200002, 0x0)
unshare(0x40400)
fcntl$setlease(r3, 0x403, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=@newqdisc={0x198, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {0xffff, 0xffff}, {0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x6}, @qdisc_kind_options=@q_mq={0x7}, @qdisc_kind_options=@q_mqprio={{0xb}, {0x150, 0x2, {{0xc, [0x7, 0x3, 0x6, 0xa, 0x4b, 0x2, 0x2, 0x2, 0xb, 0x3, 0x9, 0x7, 0x5, 0x8, 0x9, 0xf], 0x1, [0x5, 0x400, 0x6, 0x3, 0x0, 0x80, 0x3, 0x2, 0x0, 0x8001, 0x2, 0x1ff, 0x0, 0xfffd, 0x0, 0xfd], [0xfffc, 0xfffa, 0xfd3, 0x8, 0x4bc, 0x8, 0x9, 0x5, 0x6, 0x82, 0xc, 0x2, 0x0, 0x6, 0x9, 0x5]}, [@TCA_MQPRIO_SHAPER={0x6, 0x2, 0x1}, @TCA_MQPRIO_MAX_RATE64={0x4}, @TCA_MQPRIO_MIN_RATE64={0x40, 0x3, 0x0, 0x1, [{0x4e, 0x3, 0xd40b}, {0xc}, {0xc, 0x3, 0x9}, {0xc, 0x3, 0x100}, {0xc, 0x3, 0x3}]}, @TCA_MQPRIO_SHAPER={0x6}, @TCA_MQPRIO_MIN_RATE64={0x94, 0x3, 0x0, 0x1, [{0xc, 0x3, 0xfffffffffffffffe}, {0xc, 0x3, 0x1}, {0xc, 0x3, 0x4}, {0xc, 0x3, 0x6}, {0xc, 0x3, 0x78d}, {0xc, 0x3, 0x24000000000}, {0xc, 0x3, 0x7f}, {0xc, 0x3, 0x1}, {0xc, 0x3, 0x7f}, {0xc, 0x3, 0xc1b4}, {0xc, 0x3, 0x9}, {0xc, 0x3, 0x9}]}, @TCA_MQPRIO_MODE={0x6, 0x1, 0x1}, @TCA_MQPRIO_MODE={0x6}]}}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x3ff}]}, 0x198}}, 0x0)
r6 = socket(0x400000000010, 0x3, 0x0)
r7 = socket$unix(0x1, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r8=>0x0})
sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x5, 0x10}, {}, {0x9, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x8, 0x2, [@TCA_MATCHALL_ACT={0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
r9 = socket$l2tp(0x2, 0x2, 0x73)
setsockopt$EBT_SO_SET_COUNTERS(r9, 0x0, 0x81, &(0x7f00000006c0)={'broute\x00', 0x0, 0x0, 0x0, [0x7fff, 0x700000000, 0x1, 0x2, 0x2, 0x3], 0x1, 0x0, 0x0, [{}]}, 0x88)
syz_emit_ethernet(0x4a, &(0x7f0000000180)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaaaa86dd60101040005406fffe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5470000990780000"], 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffffffffffffffff86dd6060626000102c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa11000001"], 0x0)
futex(&(0x7f000000cffc)=0x1, 0x800000000006, 0x0, 0x0, 0x0, 0x0)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2)
ioctl$KVM_SET_VCPU_EVENTS(r12, 0x4040aea0, &(0x7f0000000140)=@x86={0x6, 0x0, 0x8, 0x0, 0xc, 0x8, 0x4, 0xb, 0x3, 0x13, 0x5, 0x70, 0x0, 0xd, 0xb, 0x0, 0x0, 0x40, 0xce, '\x00', 0x4, 0x4})
futex(&(0x7f000000cffc)=0x1, 0x5, 0x0, 0x0, &(0x7f0000001600), 0x42fffffe)
r13 = socket$nl_route(0x10, 0x3, 0x0)
capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000100))
r14 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r14, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4)
sendmsg$nl_route(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="fd0f58700000", @ANYRES32=0x0, @ANYBLOB="000000000a000200"], 0x20}, 0x1, 0x0, 0x0, 0x4008451}, 0x20000800)

3.961127109s ago: executing program 4 (id=1255):
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x900, 0x0)
r0 = socket$vsock_stream(0x28, 0x1, 0x0)
bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10)
listen(r0, 0x0)
r1 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r1, &(0x7f0000000640)={0x28, 0x0, 0x2710, @local}, 0x10)
timer_create(0x3, 0x0, &(0x7f00000001c0)=<r2=>0x0)
timer_settime(r2, 0x0, &(0x7f0000000340)={{}, {0x0, 0x9}}, 0x0)
timer_gettime(r2, &(0x7f0000000000))
recvmmsg(r1, &(0x7f0000000a40)=[{{&(0x7f0000000100)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000000940)=[{&(0x7f0000000180)=""/189, 0xbd}, {&(0x7f0000000280)=""/232, 0xe8}, {&(0x7f0000000380)=""/164, 0xa4}, {&(0x7f0000000440)=""/253, 0xfd}, {&(0x7f0000000a80)=""/259, 0x103}, {&(0x7f0000000680)=""/70, 0x46}, {&(0x7f0000000700)=""/87, 0x57}, {&(0x7f0000000780)=""/39, 0x27}, {&(0x7f00000007c0)=""/99, 0x63}, {&(0x7f0000000840)=""/235, 0xeb}], 0xa, &(0x7f0000000a00)=""/4, 0x4}, 0x1}], 0x1, 0x1, 0x0)
shutdown(r1, 0x0)
shutdown(r1, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bcb7f620e90f01d55023010203010902120001000000000904"], 0x0)
r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402)
ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000080)={&(0x7f0000000240)=[{0x0, 0x1000, 0x0, 0x0}, {0x7, 0x0, 0x0, 0x0}], 0x2})

3.758188974s ago: executing program 0 (id=1256):
r0 = socket$igmp6(0xa, 0x3, 0x2)
io_uring_setup(0x4a8b, 0x0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)=ANY=[@ANYBLOB="400a0100000041e7e0df69a5600e813097d2990b766fe1340b6146eed25017b55cc809d2c8f84ade5e0bccda2dba77a07610063b2727e26f06f5ff44e9917e4fa62bd0006a23032b6d610b90c5f89a57af1ee68ed8a74b52"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_clone(0x20000011, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, &(0x7f0000000000)={0x1c, 0x526d630517582f25, 0x4})
wait4(0x0, 0x0, 0x8, &(0x7f00000001c0))
syz_usb_control_io(r1, 0x0, 0x0)
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0)
ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0})
ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680))
ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1)
ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f00000002c0)=0x200000000)
ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000002380)=0x1)
syz_usb_control_io(r1, 0x0, &(0x7f0000000a00)={0x84, &(0x7f0000000280)={0x20, 0x18, 0x2, "36bc"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0)
open(&(0x7f00000002c0)='./file0\x00', 0x2a4c0, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r3, &(0x7f00000061c0)={0x2020, 0x0, <r4=>0x0}, 0x2020)
write$FUSE_INIT(r3, &(0x7f0000000100)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x8000}}, 0x50)
syz_fuse_handle_req(r3, &(0x7f00000041c0)="412e450a2a7b9586d1e6e9de257afc4fd60c8de430c0d6348b2cf1db8d070a539de9c1e91a178f9240dbcfe303566018f6c20c55d643a2ed46aaacf49ca491ee2f06184bdb548778a2c56e56f6b40b994419428bbbb9dfa5f9593511ca8ae1c088fb0ee5da72f505000000000000002c04754204f194ae6ceff4570d44496eeffe619998eafc7167d22e1c6aa73e89ad19224e35130a37cf68d5c41ccafe59b4b753a26e06c4306d31d78de6cede97c06e3ca2cc4af66b7548268efa91621ffca2655d2c8f1a9bb019b88fa729cb3d32f72c098c44898d42c42f39feb4faead93980726c236129acdf31c01f1cabb5ca3ec4e45eb5e6e59912792b4976e3f2b560c861d49b539d8e1870040a8cf190a8a767ec067a8048aac53336b44669d3d425843ae80681a7c02a5d5a3d90f355fd4a6ac277e75230d558f0df20cb323cc65e9b5a258cdd669c8a9534e4aff09a8fe89b124748c9e756c28789c2152a5142bc0bb205e339d43bb980b3f04a3c1a424a2a093966b20600a5410e0528fb35937c998eea19f01eaf2f39e16d85563a6737ddab3213ca1832f0afdf891e34a582f6a4ac81fda70ebc3fedac2fb3a492fdb40b91021e5d371d990064cd1f7c2c1a6472dedb505f9a4940057a3e57fd53aa3cd2eb914e073a19b6e925f8553e6875c093c7d19de25861fd9640f0eca4cda0467f12126daa2e0c6df7d4e4babe5a6e59e8391be7700790315b6b8a8aa74cd6d3f054aceaeda79430676b67fe25c9029e0894b413377fc4d8300d9f9338fadd07e4c80cac08113df8971a868458c47c06fff0c1c4bfd48ea583e9e76ef103d42c233b6de10b30612cdbeb6b60a6a4dbbe2da63cc2dd4fb93cac65af3c1279274f4af0e2c5b96e6068aa5b41f7548fb72b0c142351f64446db7425115b89132b5589ee642ebbde655adb2d7d1117456a6e4f2886879b42baf85e05d53e2aceea9c3830673bdc4d081675fe76b994651af9c3f16b7513834fce4654f84558a8308fa677d05bffcc893d5e02bf87c5ec520cd66ad58dc06f0c47d253cd36dfec82980fc8dbdc9e185fe4fbdda2c2517ec9abfbb4841252e650b6bf56fdeca9a4ee3c311de3c6859ec14cc00e95323c57c02fa894d83ea17944f3112fc19a7e11335d7951ec6dd5b4f06fb9b637313a230341ea5da6a7a959e707d0cd5fca60a6649c8df8d6c17e9a49d230e5775df14e4b43aa3420bd0b8814ec7360ab1910e69fab8932f7646d7998bdc2e8ec354c52da21ed83fb7582cb9d37bb95f144974f72c7b0ae7b42945768fa8ec0dd6daba72d05809670506ef1054282201b00906c8af64e3e13a10f180688c96549b2d3d6b04403fd571e7b132891dd4b7cf37aec25ca1e9190c17aaefbc31e059915c12c232fb7097e9fa6f35fbb265c7102db62e2264590c583ea90f1aee3f166af81430d9084eb0c760ebbb16049c9fd1fee6ce33c8ac205e3ac9c275531feadfa4054e0c027c26beb009f54aa72b864d39bb11753f77931bb960276db33021c65671e57b3708bbf979be222e8439d71f58ca87cec7a054517af398a42735b580717377a54f139e2c46813cbb03d98e49c26f4ed54d75e48573cd06145f913f4e313eeee837496dfff75aa722fd8486c45f9c959da12ae48ba4a10712120a203e2476c7b96031d8f8773f68344e6fa21831287655aabbd594e9f272eb1a7315d2d79b8bcd5e63004cd106f80b1e40a5d9e428a01bc58264f4d63c2ee9db6efa70607a642aeb883bf4b9fe009d7f09c16b05a2c9b73573e9019e161ebbdc1fc9b9cd0c5fe1b57adcba2d0f3a767ad59aafa159b3dd181f0601ff95e8af8b5410e56c81ffb8ab35b1e04af35dabf69f08572e69260b72bfd502c5a0de627fd3fee44bf1d4a261bd356056c5739398e3ff161beec1240a089625daffbc61dc5e660c274565477a0ff1797fefff04a98704802ab0674ab72d400686229608cbfd2ca20f4e62495e8b09de9d180c47375bbad72f4474b67d56104b4b466192be60f7aa668fd0a4338b856f114311842ee806d6488ab09098ed9de0e21bcc8b42a5d5713d15eca108fcc7a65d6b414a112524a6e1418644508dd957147a92d4399d13faaf01cacef40549cd11900f9aa32a8333f55796ef25d33c554a308da9797cd0ac25888311b0ac88eff0be7a36ddedcfc2b095abb4d5a6a4edbbad67b70cdf60c7ed0c5e040ced90edb3322ef684332358942ede9191b431c99b3abf8f9c50206479f0ac118c0a99df61fb9c90d846f41caa6a2448fb7e15640965e051c2af4ee72a5cc7c962bacff7019615c10e6c3054e2e5792df3aa6e2c33425552148466a88568cc79b6edebf0107b7d3d24423a665d20c3a1c0f1a6b34eb475bf875912115914cfabcf394f8a096d64e5dc95705079f748b9d4688859c0200fa43719e4722ed6c064c0efa7e07beb2a26fd724b63537fa0eb506365d5c029cd8dce7dd0a1cb9d9058c061739734af6be9e880fe7e28a211a4c368a7babd1107110ecbb384b274cc092b9511c4abde2ddd863162e2739984a9f3c0a76e3c530a27d5e385f4a3b87607b2a944e09d28239661d27719e22c0a657ea383c30859ca29cdb8fbc79bc83e995dcb361743a7e195650c37e570b768a0a1f0b118fa5be9b3c838326343ec5b376d5ee040ee29dfd868cccf9cfa4591151f519cd6e2ae1453a58aa92f90ee5be11ceb8511ab743f399be0a190eeddfd112336866831c3255ef6520d88b2581ea3767f3df01a38d9b4656f2a89c5df41443291a795da45c8a846015cd041bea0dfbe648348b10ae73ce43d9017182792cd9172eee642c549a530cc1f537f9aa70ca63792ba4a86a713ae09b917136e5bf1506ad7f367d8d2f77f47a2318facd109bba9b1327b5db9e4aeffbdcf414db761eeacc227a15cd72aa52c8ede33bdbab9de9aa1e8f470a388013d07f08777e2131bbd4856ab5c1c38d03ef407197ccf24e8b2a8db69e78f9d6623033c453e2e54fce65fb785467064a146c4bf218068b5e3efdafaf93a98253becaef226cd79468ff1bbe0c9d43877f5cbb5844fd8957f15d3ef208aac11816585cdccf039c36b429d3d7fb634054fd0f09c8abea3746a6b7379142abde26d998ac7e39b94746c60c09f86ddbd7497849d1ef839730672449f35a3c3253666e9fc053ac1c518e44e0b84555be507f7c00fa9e4864b4bf40ac3d93f12001eb780a779e655d0633803268c094ae161a0efd652003d6ac47f9a6c28d866b56233f371627b01e0fe9361dca611a28841968d4e12cb73d49ce08fe25de4a90b2d34607202b20e71f5e1eed38e17d0a2748f548cf61735f4c9cead1cb93b11929d906d65fc60f88e6919b7b5a1014e6d408bce9c8cc832eecf9147708fe451891717d2ed99dee70773feaa97985102abd3dd05c904c28898afe060621db6564887bc4afe158fbe1d819136a1ac1dc9d8674798a93daf5255460b50c34496205834c668db4c764e76ebb6cdaf5fc44b881cc2ae87b4a7cc045143f96b1620abfd0f116e673b335beefdafa1e58d9194e010cb78956044646da5ba853ce981667f2b8e5001c2df437c9d597ccd2be7d2887f5cb7aad0539abb3f9db1c8f5cd4d7d831946ba1c1aa8737c114fec1ac9a82519f57cb48c49b7f62e9eaa89f448df33fb307cd0036c70b490ac340f7d04e14f32bfeebb08a9d5bc7bbef8f231ea09311d4c82cc55c90eb53c6c003cc98a34dd3c4ec2d8b3a655a78e16e908f368733d0a02b36fe963e2d80b5e6f7b2e3aae3013c900c76e4d56e8348bef221f8a642e692c23b12520fb68c793e789eeeceb4efb2097a4d5952d144094cd7be6edc933d257f6230e962d70ba42e1b07ad9eca0ccd60d3d9a6e06b73ccf96a8aa490ed3bd58bf4d79db65355ae145b54be004e464f4dd23fb8b1bf15e13838116083da67186513652608e37c8f847b2bcafb57bcefc7efc8c8182c7d708cce5d14695b4e618e77f8e7be81f27a05e415fd37ac21507a665b2558daee5c0b0859fedfede8c03f181ef5e0ec0da6caa3edf402dd73bcb4026c489a7cca8ab700d3e9f050006c36768a16e8a48e48ed5750b8cdb7ad1fd12d4cc8333d324d6c83905303fa7013fc02553b587544affe38f1a95e0c4c39740d63b6d387fc89b30bd5fd745cb64844b13897ccf5cca135f7d39e03ce8adcda919d86b25b52764b0a0c4f07f88df68868415de13863df84a7e8d355b09cf90e482eb4174fd01f1b371a4dc52f3c89fc3a70c71657aa5d7573ef9acf4d2b0b321c41ff2640515bb43637ba2288ca0bff2e2a3a998ad8294c52f9edfe0a4ee0a3f8ed5b4b5c43319bb9c58dd07ea3237d7bb62cb086e7ea4a81cba2cdeb28794a09c275a704963110b64720bd089e3737ee1a91e348b5e97b63e1724de1fa9f49961d653bbb47b6fa993b035cf59659bcd0306180645162568abf51127845cbe6e37cc3c19b9d69657db4258fa5e8428a73eff6506bff474c2e302ad5559ac8de44c6f0baba5e2e579e7d7f9d9ebf540674432ac11d92bfc9abdc24126888b533f43bd6f293b0bc315915743114a35308a0ee2e710522137918a2b09ddbbc7a2313a2a6b85a1ad26f14dd70072651c8300ddf6de29704b716ce1bc431c66ccc96731f46359a9f6850976c96dcb5e0ee47446f50b6b3ba90d45224066e123ad3854d877c0cdd9325000ac0d6813c30cd43d3e150335601724ca3666458dc4c04f6562296982353e155d5255c9008c0b46d21a678c8fcb3aa8d6574476e0458eb0a76a6cb50f929ed218cc4654cb4f95fb3afbc2548b74acc312563375a19e55d488599488dfed4dd31b39f29ad61dad343dfca3b45b316a34e7a7bebd2b0f562a9e69848d13fc80a4fa52d0f17bd15d9e1fd39a7dcc86128d14493805d105a745673bddea68ca74ac09d95cc7412d5be2cbd0a247a81dc9e148111e22cdf3375805469226ca3538f960a6ba6aa0eeeb87c784ffb1bfc09180a61be3c7c535fc6d593c3b3f4de21b8c3eccc9021e80fb07dce0aeb3b023bd55f24356f646791ba80e5ca21ac092a069ae0a22cfefc08c23cc7aa69b570bd17cce9de15871d363f167288f99f04761caa67f12c949466493f661d39ee4280c955446ff5a9bb14f2d1ae21cdb91a5868e0c52097cf380f571935b140562922763f1b79c3709b949c57a00b08828ce9e685f6b234b5fe3c62d9feb249ce75e81f5efd556c14d5da24dc0554723fdbe52659969a39f470e82c50c4777c908628436e31177af1125d5f70ff627462247e5bc20c47ef75f369174586d43d42f7eefdd47fefa745badebca2a881ccc018ea411cc8a7a0881422bee8704bb98e6bea9fbec63441fb45d7ccfd436909b57a2b60b788e15bda3ca7663b19bd84d0879deb639f10def9a99d42a4b9a4fd7fecbf6d2e7598678307ba9a5b6f143c27cf1ca41e3c904007bb762cd5df6e63c4cf422c2ba959e53bd8e5664cf5df6a91a4bc8cebc52b22f30060fcbc5ead53d38eabd160c1da4cab8aa95c3640ffd78074aa2cbb05cb8ea90a0c95a4a1b2be1ee94f238000f1faffa069d87039f13f5f84ff368aec5a0b10020232b9fc954a6c22573ef48459e574d48a4845837e1d6ef386738ccedd093d4d5bf3a3f790c875ba7449d03397642feb71100f2c25ab2cadf0b0802544a2095a51b19cdece623b17d420b173a99c081f8e229b6de3c680d6bb39bb98b479517d77cca581b81cf856753a44ebd64cff111fb8ca37ea45d217a3fca44a083e6c35b0fed9f8f7631178d15e88f86c85f1ce68c900afdd1f7e5b8bd4ef3f58c447b77d3befc49180df7a5eb2ae8ae33b4ef573f3a425da8a60cde84d8eeae6d6399b9fbbfa0fa8d448b25c7f79b7554d0b02b0decbc74ae8560f630af596313fb33d442a410061ace0aa7a440d5e31ca8bb2cc495c4f0b672edb011b0c5f16781836df7f4af8329143d5a1a99d7b18ef9f774c4199d635848cedebac82637a03a189c65bf667503737c75b6639ac65ad424ca475285437e6f19830b36549f607ffc387c8b11a34a838159376a6335afaa045bd2bb04e279dd72436331d07dfbd72e2436b27f0df23a266fd15cf56d1a9e93aaac8901cfe49a3219ae36c5c65c75e5c708fb82cac4d6a50726509ec3a7d32d54cf584ae353a5bff759fc677a0b240cf8a0a72817c9d37699ca89c96e0e0d96a7665ac3a7d1febca1a1d79e2cbde8025c271360e2f90048b2d9fd56f45c013e001dad4b7785be69dc01f8a954ef7a84455986fc5c9d5167d91808efdb4476ed79f99563d887cfd4e99809d9e388501dea228cbb3cf3770082dc566455251fd9c2c742963c33500618c6ec99e0bef007408a0462a081237be4c6e5db0258d4be5fc9cf63fd1ace1f4166c053b0fb84fe24917da1255cf40bbb1b45644f6a7699cf802a35a932c374b1d62013e6afca3787627469994c02f622ab877ed5491fc2a89eea60e4e1628da89e3ad600ff6442e4ebf20e47304176b6a1703c094b3cf6d7fbbddd8d8fa5a00f28b4d8f43d88487e9d4531071512f2027198714a8d1cef126775547fc74f2a35840510f325e50361be76557767560055e084f2ecaefa0dd8ca8215301a7a887d2eaddaeb1f5c3dfdbd2cc1ba5f02d4426b98c0f861c5f724405758f442560ea6cd1d953456cc4aac6642ad61c03dbaffc2364d8ec2ef9f483c70355139d1fbd9617ab3c7eedf0b8963c1cfdab769180db43c416a90d9fdf3fd0eb2f81187642b4e2a09d6462d27527fdfda31f7b262501749dcfc6c184983f9923424131d05cc811cacf5c2c87e8e6f135349e68cde0e8997bf1dde248e5124d5dca2681abdbe58d327a8edd585821f03fdd4515728f1336495ba25c9bba56a3f706d60c35cbd0b40d0ac0583a981f9af08510ed8ed0a726e5472f8995af3837fbf1e89587633d2ef944868a153919165778e963710872af12faf96c0919c638e5affa97104471ba6e178d27602f96b9546ebe52190d91be245be08742b96389080676a566d3229e593e4f56a76ae4c58113c6adc1088703b1b92dafe32a5600e14ac1e71df829dfef425911f16a2b91f693599ecabf93065c6c4f5fefca8d4ed095599113529f65d9120d5252f577af95b404979508c343df54e4d239720e7d3a861f1dcabfa69e12d655c8a026c10a4df279b139fd222e561d205ac9b45c1054f8699eca594fb23886e0de565186597766dd5e40f74a423d5708dac254f4172f1089270988fb18715813f13ee4d131b64dd517c7e77f27f804b229f5339ac2f483b14739ac33a9645044d3010bd77ed18fb117f7b11bb51c4ed683b59e28bf25a58f123dfbeb1f0f21f03d9b57d8e61d59b311037a5b757b03ca5c95e0eb73922c6918530c99de4d6733640f2b8d13bebce31d4f5e27aab201101e48cde23a0d7e87b9511949d812e3187ee5ff11bc5858c022ed7b00790eba32f9ef7e134ce5f73a01269ca971b40e62133eca9d596a768686d6390b2c74602f6dc597faec3ed9d9658102d99c9624c1a97d00d63853578afaccc7e30a77fe054ebc23eec45f608f996fd015cd6bd50a111360f0790eff6ffb1ea59d13c8e29480bd96217188f97e53a1f5d9eae0a2badb4fea52f2bb4f8cb04d0afd99e7371a978a7d7ef473f77ea6738ff84af655313a12db24cff692ec7e282245ae9a42338db814593448f7115df3dc3f4e2faa2c2fdbd68f679d6aba01a15031347bb17d8bf8f1fad0ecf365e9dcd32e69803c5c05f4b47adbf8a21af7e9fb327f267df1c914486389a9820edf0a03bde6ef388c255761e402b2f7e1f9c1c3c95bd30c502197ab37f76b52f0d0675f366e919be19329853767bba34a540fb75bcdcc9596a4cda254a660e11bed5af9d8646ac4b7d6d7aa5d7c0005879b6d08058a56c3d3a4d3d401b883153fa7f2f6a6d34dd010f6b9e7b4e457b9ff5a5802d7723abb35f9dca0afc10fd534e7753445b7268d90145b6438b93fc475f44d5d678d79da6c5770f3a9106f3cffbabe4b88cbe7eda9b8a495be4f6717b0fbee6fec78c86031b6d878d47e357b2089de3e6dd19a265552553d1f7da53884ef84d0eebe782791c48a9c68a28d8ea3bb70c922b01dc20b2cd05cfb276e326651398f766f5faaea54a41da597cf6b50f3d5ebc634185b99069126b8d935c6bc42c47f2109de42091ef4ade3d87cc44aeb78709255501e64f34ac2d4b2725cf7777315f8ca9424bc9d61a896a93500faa6cf5a5aee1fb888e17b47a38a667be2ffa3bae46afa88bfd8b5b6e1186d6e41b9a4e490591043372c23f36fb48d80caff74cc349adc92bb25f701738c809ccf74c47afa193795ee67bc58ea7fd85542fa7e70218490fff212163401cfde016df2f42496bae403d5391e53fe200f758bbcdead0fe72c77861889b9632a257229c35bdfe8fa78375b4f5c768b9c60cafbde1f00aff6ca1879f6472f28001f5f13d4d9d6c3a90e04d8df09873550daa8262d39efbe96a79c697fbcc9a7f27c9f6d782d5d5f6d024b291376e9cc40d902f809072e1f0f2c2ab88ce3d074e88461f5971853e7be749943ab6e25e25e8afa5042dd73407f49b50841c7782c54eece62ec2beef1f16caf1ca5989427bd2726ca0fee33e303702e9892e4382e92c3f3a03a6188f39762db81819c7e12b424be8fd964dcdbfbac00139e8c5a6200506f13f484ac34ef3d26e7cadd53cf402117419c1618205bfa5382486094bd55448f2b1aa4dbec2289189b601b1bbf5792b2a641c6f5dd19cf24abc72fc5264cf11f6b44a4929267a02cd1de1b602b9de65a6c06640aa0f76109baa90d66eeb17295b1711365b7d6835a2dd55b7fe868c59453613240643c847a5b48d27897a58dda63e579c1bba58350550e147b190f0a2c9a5ce719d627ce3302028b4b6801bbfa8cd74874ffba35817c0eca034d19210950796807125fe6065dcd47d7c870ed2db5c00cff235e4154e2d89ec2a09a87551f9b7ca25d519b5603c0c33d2cf72878199ffab567fc5e093529b89d1163587f3564ba8291d2d96cf9762e7f568e786ea90849f6312c1a10f45d61600cd45c48e6870a7d76c913f9c4497374fc04401cbd11f7710740148234fe8f041f24d0278fcfd48846e6aa49f05016fc332dc5d46b4a26574fed5c0751cebb9f7ab4cdbc1ee011d82d6ef95c52c9df8eedac3ab5cf30805f23d88d4f707601f8e6c606b58f2fe234e948d6756d430a5c4ec76a33874886c8fb484059b47a9bd198a61a1896419288a9e81d0969dec778a53e8233f0f63bd0134e5f29825e7817e7c8ccb7d9acd8f86ac9d3af78c43df3036d7934dd294f2bb12063bee52c547d27a218145befb0ca96cbfaabd39fa245b51c39f4cd4cf8db105f9dc46a7aaa8f7d06fa208120ce1ac49326179618fa2c8596c44e174eb7a141056b1d17689c10dee089c8b0867b8a757ae12251bbd68db5fba2be341275fb6ee379309f5cde9b31242b0b2bac44da74776fac141936bd96e3177161f057c820a8c22cca8cce29b158eb55aed0260253fbee70a6dd281d9fca23e0b0a38d46c76a95e1262f1cafcf0fc37b52e649a1ba1e2c0f97d10bbf4d2b5632cf340bce56736071d5885ec9b4e17910744d3e63e2ca6deb21e43fc21e89c6865d3ad424ef4a14efe8843ff3168c99ee395400dcc8755719d290c567c95a5e7d28ec1190ceee240084d444265cc801cd960f69b368359bbf06b8a4ec23b47c7bf9d4b16c701a1c4fb9e81abb75bf49d450b566ce03de939fc6f5c51291380086f8c995cdd4fa15a325601c4846a69f15c77f55c900270bc9ea5f406480cb0e3e89bc869fe8b7cec4fbef7e76283d50c25ab1b4d34d093a7df062990a925a9c44aa2661abd7d381a4d6cdb64821ef624dd51b72e99af914bca2f80c25b82ac6945df7c7582e6d0ce2cd073e35f1fc120a68ba210410db64592a9aa319b30f2b818c495750e1cea0610e27d52be31e52e501a3bd51b501bc51c2ec8592f679b6e55b9aa58d513fd2bebadc83ba76eb45e5676f130193e9a666b8c8132c9f5141681fbab324b555c5c890d488ac2dd00feead0a20fbd8a46391438e3193edc6fb89161cd864fca98f4f39a2893c933dcd13bc8c5d5a548d24862e8161c0fad7f33aca8c86791d620815fe3f0daddb5defd933d0c10097a7a98e67625420b6c0db7c3e17ab07ea64e6f0f53fdc670799e06a2e3a871d6be363a2639e35339361311e0f528cc433eacea4f79bf217108c7b1d657840253ffdea18bdd1f93cdee63e7a9b8dbcb4ee06162b253e09ea0641f2771bd9823dd210905e9ea495f43194bb471cdeb690e8890b03b50835d53dde1b572dd123ccc8507bb57a45e46c0efb8fb3d5596bddf9782d86dd911636eae2cf64b5829cf8893faf789be3fa22859accf688f5b5da6c29cacc96d477e23b63cc934f685b6e42e1655c9a9b94d6d78402de22b8d9776e3915391aa258e57467d770d65480ba2f6a94b0337965a8c659c42b4e90b14da4697d0c0a6d74774c94c52d8ecb694eec747bdaa6c3a6d60739db18c6446090eebba72e62ab88b0e8b88e728ba8cb133d8524eda89a2bff1c8414da3edfa6f83788331c8a7e5a8af2dd3682d4752190a3c689949abdad8350111373e7fb46151f54a10f79d91940e37efb05f9f157bddcfacf018b65a38ab614807c34a2786af4a1d48c4d1c1abd31815715f9d1b103992207fc664f12c82fd923c57d8e7cfb9f4af55182318d055c704865cf484206d60e34cf7fe9b6ce60b1772c5c7cdacb6695227d80da18ec1f98a434b1aaf9c6b6d082f5663aed2bf267e559dca6b93d3ce34273846fc677f529690482df0a8f782b8ad7269f344f5f2b4d320a7ce2d2fa02284f8db634dc930c3e2b9a629245364acf35d41e9a14c88efde4e742ef1ea4b43d0caf2e70d4a617278823e6403934524debbd933e7676e441a48f630dc8bcccd55d9032d6bf3dea97d1669c39fb865b0e619eeb3f5461e517000f5aee3ef2abdb87d3a76b88e140eb4644a9fbddbdc9e20972cdfacf00bffa3a1ca5f84122c2ebc54067cdaa23967eaeb7bbbfe44e5843382b834fae1f62a066688595e4ee67c7ff9858672355abf7893ebeb4bcf88a62b2237c6e6cec9aebe3f28bfc310ced3a590e88d4bd0f53289206deb9addbf6f3c02115ce4980dadfc112683ae250c2d438fd9c0f2a090dbf122a0072828db798bdb868dcd47384dd3f5eeebc0307a5b268683cd51f312e8f02b5a7746b11a97ac43287d9b9765f03c720503cfe6e0117660a4c00d67895224c4d42b032000a10d7a743054758a8f54941fd5eaf72498b678d1579b3de4e5518f90f1e3d32517d09d7f5da9d180215e66218e9dd64036819cf12638ce82712a6cc79a9ddb36e86814b797d72c2bc58b18ba439e99965f745b4fb7de2878e3186e3e7b835c746b0935f6c67e92e3770bd8d5eb4f66d8175ceb7850e418c55e574db891639aa77fc62bc45dcb734681ede8484d4d4109a9adb8c3d00", 0x2000, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x0, 0xfffffffffffffffc, {0x0, 0xe}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528)
syz_emit_ethernet(0x6e, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @random="fbff070300", @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x38, 0x6, 0xff, @private2={0xfc, 0x2, '\x00', 0x1}, @local, {[], {{0x4e20, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0xe, 0x10, 0x7, 0x0, 0x3, {[@md5sig={0x13, 0xffffffffffffffc6, "01f620e303f9aaade50c72235ba75f6a"}, @sack={0x5, 0x12, [0x2, 0x79da, 0xfffffffe, 0x1fac]}]}}}}}}}}, 0x0)

3.530572441s ago: executing program 2 (id=1257):
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', <r1=>0x0})
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80)
write$P9_RRENAME(r2, &(0x7f0000000040)={0x7, 0x15, 0x2}, 0x7)
sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x14)

3.385330535s ago: executing program 2 (id=1258):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x68, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0x8002}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x68}}, 0x0)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
pipe(&(0x7f00000045c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000140)=@req3={0x6, 0x2008001, 0x1, 0xe0a3, 0x3, 0x6, 0x9}, 0x1c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r4, 0x0)
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f00000010c0)='*', 0x1}], 0x1, 0x1)
r5 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18)
r6 = accept4(r5, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r6)
splice(r2, 0x0, r6, 0x0, 0x10000000000066, 0xa)
setsockopt$inet_int(r1, 0x0, 0x18, &(0x7f0000000000)=0xffffff82, 0x4)
bind$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x10)

3.351286745s ago: executing program 3 (id=1259):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x48, 0xd, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY_END={0xc, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "8819"}]}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20040801}, 0x8000) (fail_nth: 8)

3.30932426s ago: executing program 2 (id=1260):
unshare(0x2c020400)
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000780)=0x1)

3.101811465s ago: executing program 3 (id=1261):
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$igmp6(0xa, 0x3, 0x2)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x10, &(0x7f00000190c0)=[@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x2a}}]}, &(0x7f0000000000)=0x10)
getsockopt$bt_hci(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000000080)=""/4076, &(0x7f00000010c0)=0xfec)
r1 = syz_io_uring_setup(0xac9, &(0x7f00000002c0)={0x0, 0x3594, 0x10, 0x1003, 0x21e}, &(0x7f0000000240)=<r2=>0x0, &(0x7f0000000340))
syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4)
io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0)
r3 = socket$kcm(0x10, 0x3, 0x10)
syz_open_dev$tty1(0xc, 0x4, 0x3)
syz_open_dev$tty1(0xc, 0x4, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0})
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=<r4=>0x0)
fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff})
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0)
sendmsg$nl_route(r5, 0x0, 0x4048004)
fgetxattr(0xffffffffffffffff, &(0x7f0000001080)=ANY=[@ANYBLOB='systqm.]\x00'], &(0x7f0000001100)=""/149, 0x95)
ioctl$KVM_SET_PIT(r5, 0x8048ae66, 0x0)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9)
timer_settime(r4, 0x1, &(0x7f0000000040), 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
mknodat(0xffffffffffffffff, &(0x7f00000011c0)='./file4\x00', 0x11c0, 0x90000)
open$dir(0x0, 0x2601, 0x0)
ioprio_set$pid(0x1, 0x0, 0x0)
openat2$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file4\x00', &(0x7f0000000380)={0x8a001, 0x0, 0x12}, 0x18)
sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="1400000016000b63d25a80648c2594f921240685", 0x14}], 0x1}, 0x0)
setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x498, 0x140, 0xffffffff, 0xffffffff, 0x140, 0xffffffff, 0x3c8, 0xffffffff, 0xffffffff, 0x3c8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @rand_addr=' \x01\x00', [0x0, 0x0, 0xffffffff], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@tos={{0x28}, {0x9, 0x2, 0x1}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @empty}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4f8)
r6 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000004c0)={'bond0\x00'})

3.029122303s ago: executing program 2 (id=1262):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x48e80, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x200)
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x3)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000003c0)={0x2, 0x0, @ioapic={0x0, 0x2, 0x3, 0xeffffdff, 0x0, [{0x0, 0x80, 0x3}, {0x4, 0x5, 0x0, '\x00', 0x10}, {0xfc, 0x4}, {0xfe, 0x0, 0x7f, '\x00', 0x2}, {0x8, 0x0, 0x5, '\x00', 0x9}, {}, {0x0, 0x85, 0xbe}, {0x0, 0x5, 0x3, '\x00', 0xfc}, {0x1, 0x0, 0x0, '\x00', 0x7f}, {0x8, 0x6, 0xfe, '\x00', 0x42}, {0x0, 0x2}, {0x0, 0x50}, {0x4, 0x0, 0x24, '\x00', 0x3}, {0x1, 0x4e, 0x0, '\x00', 0xfc}, {0x2, 0x2, 0x4}, {}, {0x1, 0x0, 0x4, '\x00', 0x4}, {0x0, 0x0, 0x0, '\x00', 0xfd}, {0x1, 0x4, 0x7, '\x00', 0x3}, {0x81, 0x0, 0x0, '\x00', 0x40}, {0x0, 0x7}, {0x0, 0xfd, 0x0, '\x00', 0x70}, {0x1, 0xd, 0x0, '\x00', 0xe}, {0x10, 0x5, 0xe}]}})
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="319700000000000014002b800800030004000000080002000200000008001b"], 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x20000050)

2.693437434s ago: executing program 3 (id=1263):
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000040)=0x1, 0x4)
setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket(0x39, 0x803, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14)
sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=@newlink={0x40, 0x10, 0x439, 0x0, 0x60000, {0x0, 0x0, 0x0, r4, 0x9801}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gre={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r4}, @IFLA_GRE_REMOTE={0x8, 0x7, @broadcast}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x840}, 0x8000000)
sendto$packet(r1, &(0x7f0000000180)="2803", 0x2, 0x840, &(0x7f00000000c0)={0x11, 0xd, r4, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2eaaaac15ca67ef2}}, 0x14)

2.566508052s ago: executing program 4 (id=1264):
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
syz_usb_connect$cdc_ncm(0x7, 0xa7, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x95, 0x2, 0x1, 0xff, 0xb0, 0xc, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0xeee7, 0x680, 0x401, 0xc}, {0x6, 0x24, 0x1a, 0xfe, 0x18}, [@mbim_extended={0x8, 0x24, 0x1c, 0x1, 0x3, 0x6}, @dmm={0x7, 0x24, 0x14, 0x5, 0x9}, @network_terminal={0x7, 0x24, 0xa, 0x8, 0x68, 0x1, 0x40}, @network_terminal={0x7, 0x24, 0xa, 0x4, 0xf8, 0x7f, 0x1a}, @mdlm={0x15, 0x24, 0x12, 0x24}, @dmm={0x7, 0x24, 0x14, 0xb096, 0x1000}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x2, 0xf, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x5, 0xa, 0x25}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x6, 0xc1, 0xf2}}}}}}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x201, 0x5, 0x29, 0xf7, 0x8, 0x81}, 0x10f, &(0x7f0000000180)={0x5, 0xf, 0x10f, 0x5, [@ss_container_id={0x14, 0x10, 0x4, 0x4, "5e0685058b7d5f8412374e0504a7f52d"}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "624a55445a7098a0e4d04428948679c1"}, @ss_container_id={0x14, 0x10, 0x4, 0x5, "26484b57f07f21dd510468ec15d2a227"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0x9, 0x1, 0x738f}, @generic={0xc4, 0x10, 0x1, "19a05bfcc9f3b7e570f64de098f05bbace4c9b261c91eb1290c01a87dafc1d040da735b62f0fc2324b3906d333186287201aa9e928c72a5a0839c84ca506f75526a930986091731abb77850cf915230d627588fe12060b089f5d7aac15d191d3fb87f36a9b0ddee56a90c24371423a718fffa9f3181c4d9503fe50ea3fa139789b3d528d71f5c5a0549c2cc835036bcad1c7412a7d1e2c52baecc6bc6480bc34ea33dd9930461af0caf70e2d84175fbb6a4ce8d747a48f886e62257cbfa2113b32"}]}, 0x1, [{0x4, &(0x7f0000000040)=@lang_id={0x4, 0x3, 0x401}}]})
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000001640)={0x24, 0x0, 0x0, &(0x7f0000001bc0)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x9}]}}, 0x0}, 0x0)
syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340"], 0x0)
r2 = open(&(0x7f00000003c0)='./file0\x00', 0x20000, 0x100)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000400)={@my=0x0})
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000340)={r3, &(0x7f0000000300)='E\\', 0x0}, 0x20)
syz_usb_disconnect(r1)
syz_usb_connect$cdc_ncm(0x1, 0x9b, &(0x7f0000000440)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x89, 0x2, 0x1, 0x4, 0x40, 0xe, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "792cca"}, {0x5, 0x24, 0x0, 0x901}, {0xd, 0x24, 0xf, 0x1, 0xfffff69c, 0x3, 0x8, 0x6}, {0x6, 0x24, 0x1a, 0x4, 0x5f}, [@mdlm={0x15, 0x24, 0x12, 0xa69}, @mdlm={0x15, 0x24, 0x12, 0x1}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0xf2, 0xd3, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0xf7, 0x6, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x5, 0xc, 0xff}}}}}}}]}}, &(0x7f0000000800)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x300, 0xf7, 0x9, 0x8, 0x10, 0x1}, 0x49, &(0x7f0000000500)={0x5, 0xf, 0x49, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0xf, 0x10, 0x7}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "8bbbdf22d7b32fd5678067327400655a"}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x2, 0x3, 0x6}, @ext_cap={0x7, 0x10, 0x2, 0x12, 0x6, 0x1, 0x2}, @ssp_cap={0x18, 0x10, 0xa, 0x4, 0x3, 0x37f8e5d, 0xff0f, 0xcfd, [0x3fc0, 0xf, 0xc0c0]}]}, 0x6, [{0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x1401}}, {0x7b, &(0x7f0000000580)=@string={0x7b, 0x3, "e2ca2f7183ac4ea5704b6080d7ce502e1ea96708b176231759c3838d8a91df55c2932c04217fe5c1b0563b0f9bafc95a9d0c26e250d8703b2e9911886ea3967cccadeaf1f4f08183855e9595082555d2a38657511db1e2b636eede2d4a37808a9fdb6a229f7c7ae381e23e7157acfa0edb0dd29d546051ec91"}}, {0x62, &(0x7f0000000600)=@string={0x62, 0x3, "41475373d1e6a2b20b67ac8592d3b95efde8d8bf0913a95e8758aae3273a158b0252a766a8e479759daddfdf4a78b235d40a08cad288d498e79abbd61222e373355f69230727bb1b8b077e83f6932124515d9a3a8292140f5e44cae5f4c9c31f"}}, {0x97, &(0x7f0000000680)=@string={0x97, 0x3, "0d6e99495ad198e5b4dbf7e7683baf0035b2ece51b5bc586380e5d8e266a47a90c19a782044e25db61f48a9a09c2cdb7314c776f2ef126796282ff2f4e200a0eb64b0d0dcc2edc1f02328027b9e1d3e9ff5460225385e5717b6c7c0bdc953c47fec031fbb3876e918ecc2738bba547da709669c96c53921ba96eb1370524872a6cfeac0c9333b970d0b0244dfee51229ee806dc235"}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x816}}, {0x52, &(0x7f0000000780)=@string={0x52, 0x3, "1b0ee79bd2e0cdfc43fd3f0caf900bf0262ad3abf9067ced638c5f394f3cbe11e92f1e6af717abdba4ceda6d7a3c0dd23a2b7f5d50a536462c7bb1e35dc44563c88dd852c39a9062cd01054ae88e3f8a"}}]})

2.397807255s ago: executing program 3 (id=1265):
r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$vim2m_VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f0000000300)=@multiplanar_fd={0x2, 0x3, 0x4, 0x0, 0x7fff, {0x0, 0xea60}, {0x2, 0x0, 0xb, 0x7, 0xff, 0x0, "acd5b0c6"}, 0x7, 0x4, {0x0}, 0x101})
r1 = socket$netlink(0x10, 0x3, 0x8)
r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, <r3=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r3, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000})
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r3, 0x0, <r4=>0xffffffffffffffff, 0x1})
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r4, 0x0, 0x10000, 0x0, 0x200000, 0x2, 0x334e8b})
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000400)={0x48, 0x5, r3, 0x0, <r5=>0xffffffffffffffff, 0x1})
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000480)={0x48, 0x7, r5, 0x0, 0x10001, 0x0, 0x2, 0x2c06cf, 0x282e33})
close_range(r1, 0xffffffffffffffff, 0x0)
r6 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4004881}, 0x0)
syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="5c01000010000100feffffff00010000fe880000000000000000000000000001fc010000000000000000000000000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000050000000001000004d46c0000007f000005000000000000000000000000004000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffffffe10000270000001f00000000000000feffffffffffffff02000000fcffffff000000002abd700004350000020001002000000000000000480003006465666c61746500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000240009000f00000000000000810000000006000009000000000000000001"], 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0)
r8 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001380)={&(0x7f0000001200)=ANY=[@ANYBLOB="380100001a000100feffffff00010000e00000020000000000000000a7000000ff0200000000000000000000000000010001071c4e2300070a0000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fc01000000000000000000000000000100000000000000000800000000000000a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000000100010000000000fefffffffffffffffefffffffc030000000000008000000005350000020001000000000000000000480003006465666c61746500"/240], 0x138}}, 0x844)
r9 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='memory.events.local\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r9, 0x4c82)
r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
ioctl$TCSETS(r10, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x4, 0xff, "810000cc2b000000000000fa25ffff00ffffff"})
r11 = syz_open_pts(r10, 0x141601)
close(0x3)
fcntl$setstatus(r11, 0x4, 0x102800)
r12 = socket$inet6(0xa, 0x802, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]})
mount_setattr(0xffffffffffffffff, 0x0, 0x900, &(0x7f00000001c0)={0x100007, 0x79, 0x140000}, 0x20)
sendmsg$SMC_PNETID_FLUSH(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="20fc0a29f99730c907abaac95cd97d5ba5aea7565545ea85c6f4e85c389aaa5f9751c233e10ff916471d8f8b263297208363a2a39c698df221f07559c1fd7381c22f1b33d04c5d954718819a2cb195484ed4952972a0aadaab077c93a81c69e6171cf9fefc283e339104451f5f24fe46ab411801de6ef85ec817f383705282cb0f99949cac2a2313f9eb8f238c229d1a16d7b994914a73fd3b9adab4b1fb9a27384904954ab52e75", @ANYRES16=0x0, @ANYBLOB="00022bbd7000fcdbdf25040000000900030073797a3100000000"], 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x20004001)
connect$inet6(r12, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31)

1.990584131s ago: executing program 2 (id=1266):
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x2)
ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0x40a85323, &(0x7f0000001880)={{0xce, 0x7a}, 'port0\x00', 0x24, 0x20024, 0x1, 0x2, 0x6, 0xd5, 0x1000, 0x0, 0x1, 0x3})
socket$nl_audit(0x10, 0x3, 0x9)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd25, 0xfffffffc, {0x10}}, 0x14}, 0x1, 0x0, 0x0, 0x448d3}, 0x8000000)
r2 = socket(0x1e, 0x1, 0x0)
connect$tipc(r2, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x13, 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000340)={0x3ff, 0x1, 0xe, 0x2}, 0x14)
write$binfmt_misc(r2, &(0x7f0000000340), 0x2000011a)
ioctl$USBDEVFS_FREE_STREAMS(0xffffffffffffffff, 0x8008551d, &(0x7f0000000100)={0x9eef, 0x2, [{0x1, 0x1}, {0x1}]})
r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec29, 0x8, 0x1, 0x140}, &(0x7f0000000dc0)=<r5=>0x0, &(0x7f0000000080)=<r6=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4)
syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1})
io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0)
syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x28000)

1.705955863s ago: executing program 1 (id=1267):
r0 = socket(0x1e, 0x4, 0x0)
setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x1, 0x91, 0x1ff, 0x801, 0x1}, 0x1c)
sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000)
recvmmsg$unix(r0, &(0x7f0000006ec0)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000080)=""/53, 0x35}], 0x1}}], 0x1, 0x2020, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x11, @rand_addr=0x64010102, 0x4e23, 0x2, 'lblcr\x00', 0x27, 0x6c, 0x1c}, 0x2c)
r1 = socket(0x2, 0x3, 0x100000001)
setsockopt(r1, 0xff, 0x1, 0x0, 0x26)
bind$tipc(r0, 0x0, 0x0)

1.64336937s ago: executing program 3 (id=1268):
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)
r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904000001faf40d000905820349"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x40000000000003)
read$char_usb(r1, &(0x7f0000000000)=""/74, 0x4a)
read$char_usb(r1, 0x0, 0x0)
r2 = socket$pppoe(0x18, 0x1, 0x0)
sendmsg(r2, &(0x7f0000000300)={&(0x7f0000000180)=@ethernet={0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000200)="b9ed58fd681cc7abf2d3a24d214eb2b5eedb372fbfc9221718ef1776d9e3fbaa655c597bb6da911cdeca3831ebc286e6a5685da88abebf53037d1f8a7128be03ed01ae979460a346a46c56906ee683b7e3d6803299b874766a0ed958a7ba4fd5573deeb5a2f3de68e82221a9beb0862cb54d2f264d1473bc1cb95105ad263748858de1254c7578b9ffb1c7b4c79c68f371881df2a21213fd87aed190850e6124fcd4e77993a3b145c4af1eb0cf6fb98d233ba45196689ed7eecb2d6fcb31698337766c43bf7788ba4871b71fd34a7f0819bb766f7aed1d", 0xd7}], 0x1, &(0x7f0000000100)}, 0x44881)
syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x1380, &(0x7f0000000100)=ANY=[])
r3 = socket(0x6, 0x5, 0x0)
setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x1, 0x91, 0x1ff, 0x801, 0x1}, 0x1c)
sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000)
bind$tipc(r3, 0x0, 0x0)

1.145751801s ago: executing program 2 (id=1269):
r0 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4)
setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x48, 0x83, 0x0, 0x80000001}, {0x6, 0x5, 0x0, 0xfffffc}]}, 0x10)
r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000000000000000a0200000000000109022400010000d0000000010300000009210900040122a0000905810340000000000000"], 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0)
r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@ipv6_newroute={0x30, 0x19, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, [@RTA_GATEWAY={0x14, 0x5, @private1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x0)
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0x988, 0xed}]})
r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r5 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4)
bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
setsockopt$inet_int(r5, 0x0, 0x14, &(0x7f0000000080)=0xcd, 0x4)
connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10)
sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0)
recvmmsg(r5, &(0x7f0000001280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/157, 0x9d}, 0x8}], 0x1, 0x45833af92e4b39ff, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000100)={0xffffffff, 0x1000, {0xffffffffffffffff}, {0xee01}})
r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3})
ioctl$KVM_RUN(r6, 0xae80, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f00000000c0)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="0000d2"], 0x0, 0x0, 0x0, 0x0}, 0x0)
openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/kernel/rcu_stall_count', 0x41, 0x92)
syz_emit_ethernet(0x3a, &(0x7f0000000140)=ANY=[@ANYBLOB="0000000000002a88a8dd7b81000c000800450166000009219078ac1e0101ffff74b1c1ff4e224e200431907868305ba4060000000000000000000000000000828d0acaa5799811f07d4326fba553418d8d7ab72bf987f75b4cbd98de6edef3f0c8a1fea06e833ecd68b46714eff0679398f5844ac9bd489b04a05a1ff43b7cfdd1db8c8c8e6b7326ea7f240b52dd8ec2a9afd1b3b7239ecc897fe287805f5b095372fade88116b0b"], 0x0)

784.091403ms ago: executing program 1 (id=1270):
socket(0xa, 0x5, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
ioctl$SNDCTL_SEQ_OUTOFBAND(0xffffffffffffffff, 0x40085112, 0x0)
r4 = timerfd_create(0x0, 0x0)
timerfd_settime(r4, 0x3, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0)
r5 = timerfd_create(0x0, 0x80000)
timerfd_settime(r5, 0x3, &(0x7f0000000000)={{0x77359400}, {0x0, 0x3938700}}, 0x0)
clock_adjtime(0x0, &(0x7f0000000580)={0x8003ff, 0x7, 0x23e654d4, 0xa, 0x1000, 0x0, 0x0, 0x0, 0x200, 0x100, 0x0, 0xfffffdfffffffffd, 0x9, 0x10, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x1000, 0x8, 0x2, 0x6, 0x0, 0x3})
setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0)
pread64(0xffffffffffffffff, &(0x7f00000000c0)=""/144, 0x90, 0x2f)
sendmmsg$sock(0xffffffffffffffff, &(0x7f00000044c0), 0x4000000000001c0, 0x0)
r6 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x40001, 0x0)
ioctl$PTP_EXTTS_REQUEST2(r6, 0x40603d10, 0x0)
r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/vmallocinfo\x00', 0x0, 0x0)
recvfrom(0xffffffffffffffff, &(0x7f0000000040)=""/60, 0x3c, 0x40, 0x0, 0x0)
r8 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000080)={0x200001fe0000, 0x3})
ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000180)={0x4, 0x4, 0x6000, 0xa7000, &(0x7f0000ffc000/0x2000)=nil, 0xa6, r8})
r9 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_PRE_FAULT_MEMORY(r9, 0xc040aed5, &(0x7f00000000c0)={0xd000, 0x7000})
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_GET_XSAVE(r7, 0x9000aea4, &(0x7f0000001680))

0s ago: executing program 0 (id=1271):
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e20}, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r2 = syz_io_uring_setup(0x938, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x1, 0x10288}, &(0x7f0000000440)=<r3=>0x0, &(0x7f0000000400)=<r4=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000140)=0xfffffffc, 0x0, 0x4)
r5 = socket(0x200000000000011, 0x2, 0x1)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'sit0\x00', <r6=>0x0})
bind$packet(r5, &(0x7f0000000080)={0x11, 0x15, r6, 0x1, 0x0, 0x6, @remote}, 0xfffffffffffffd90)
syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r5, 0x0, 0x0})
mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0)
r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000200), r5)
r8 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f00000002c0)={0x1, 0x2, 0x1})
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800007, 0x8010, r8, 0x2000)
r9 = socket$nl_route(0x10, 0x3, 0x0)
r10 = socket(0x11, 0x80a, 0x0)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000300)={'bond0\x00'})
sendmsg$MPTCP_PM_CMD_GET_ADDR(r10, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="08002dbd7000fedbdf25030000000800020006000000080004009151000008000400b20000000c000680060001000200000040000680080006001300000008000600000000005fff0300ac1e0001060001000200000008000700", @ANYRES32=r9, @ANYBLOB="14000400fe880000000000000000001600000001"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x40008d4)
r11 = syz_usb_connect(0x3, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b3000004040000000905830300b300"/51, @ANYRESHEX=r1, @ANYRES64, @ANYRESHEX=r9], 0x0)
syz_usb_ep_write$ath9k_ep2(r11, 0x83, 0x8, &(0x7f0000000980)=ANY=[@ANYBLOB="bcea"])
r12 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0x0)
ioctl$EVIOCSFF(r12, 0x40304580, &(0x7f00000001c0)={0x50, 0xffff, 0x560c, {0x803, 0x5d5}, {0xfffa, 0x2}, @period={0x59, 0x2, 0x4, 0x6d, 0x9ee, {0x2, 0x5, 0xfffb, 0xa}, 0x0, 0x0}})
ioctl$EVIOCSFF(r12, 0x40304580, &(0x7f00000001c0)={0x52, 0x9, 0x560e, {0x815, 0x5d3}, {0xfffa, 0x2}, @ramp={0x80, 0xffff, {0x10, 0x81, 0xfffa, 0x81}}})
prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0)
io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0)
syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_OPENAT2={0x1c, 0x4c, 0x0, 0xffffffffffffffff, &(0x7f0000000000)={0x8100, 0x1c8, 0x26}, 0xffffffffffffffff, 0x18, 0x0, 0x23456})
sendmsg$nl_route_sched(r5, 0x0, 0x4008000)
io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0)

kernel console output (not intermixed with test programs):

ed with error -71
[  251.086144][ T6858] usb 2-1: new high-speed USB device number 16 using dummy_hcd
[  251.143251][ T6859] usb 4-1: USB disconnect, device number 19
[  251.271458][ T6858] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  251.617172][ T6858] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[  251.664459][ T6858] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  251.677934][ T6858] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67
[  251.708803][ T6858] usb 2-1: SerialNumber: syz
[  251.832749][ T5895] usb 3-1: new full-speed USB device number 17 using dummy_hcd
[  251.888300][ T8553] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  252.017437][ T5895] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  252.047012][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10
[  252.074681][ T5895] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 64
[  252.111059][ T5895] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5
[  252.151737][ T5895] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  252.163924][ T5895] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  252.182402][ T5895] usb 3-1: Manufacturer: syz
[  252.221835][ T5895] usb 3-1: config 0 descriptor??
[  252.238019][ T8564] netlink: 27 bytes leftover after parsing attributes in process `syz.4.783'.
[  252.249377][ T8564] FAULT_INJECTION: forcing a failure.
[  252.249377][ T8564] name failslab, interval 1, probability 0, space 0, times 0
[  252.265363][ T8564] CPU: 1 UID: 0 PID: 8564 Comm: syz.4.783 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  252.265402][ T8564] Tainted: [L]=SOFTLOCKUP
[  252.265409][ T8564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  252.265420][ T8564] Call Trace:
[  252.265429][ T8564]  <TASK>
[  252.265436][ T8564]  dump_stack_lvl+0xe8/0x150
[  252.265469][ T8564]  should_fail_ex+0x412/0x560
[  252.265498][ T8564]  should_failslab+0xa8/0x100
[  252.265520][ T8564]  __kmalloc_noprof+0xde/0x7e0
[  252.265536][ T8564]  ? __kernel_text_address+0xd/0x30
[  252.265552][ T8564]  ? fib_create_info+0x171d/0x31f0
[  252.265575][ T8564]  fib_create_info+0x171d/0x31f0
[  252.265620][ T8564]  fib_table_insert+0xc8/0x1b50
[  252.265639][ T8564]  ? inet_rtm_newaddr+0x11f9/0x1ad0
[  252.265660][ T8564]  ? rtnetlink_rcv_msg+0x7d5/0xbe0
[  252.265678][ T8564]  ? netlink_rcv_skb+0x232/0x4b0
[  252.265694][ T8564]  ? netlink_unicast+0x80f/0x9b0
[  252.265712][ T8564]  ? fib_magic+0x146/0x510
[  252.265728][ T8564]  ? fib_magic+0x146/0x510
[  252.265745][ T8564]  ? fib_new_table+0x10a/0x2d0
[  252.265769][ T8564]  fib_magic+0x434/0x510
[  252.265797][ T8564]  ? __pfx_fib_magic+0x10/0x10
[  252.265831][ T8564]  ? call_rcu+0x644/0x890
[  252.265849][ T8564]  ? lockdep_hardirqs_on+0x7a/0x110
[  252.265865][ T8564]  fib_modify_prefix_metric+0x201/0x3a0
[  252.265884][ T8564]  inet_rtm_newaddr+0x12f0/0x1ad0
[  252.265898][ T8564]  ? __local_bh_enable_ip+0xd0/0x130
[  252.265914][ T8564]  ? __dev_queue_xmit+0x274/0x3850
[  252.265939][ T8564]  ? __dev_queue_xmit+0x274/0x3850
[  252.265969][ T8564]  ? __pfx_inet_rtm_newaddr+0x10/0x10
[  252.266010][ T8564]  ? __pfx_inet_rtm_newaddr+0x10/0x10
[  252.266032][ T8564]  rtnetlink_rcv_msg+0x7d5/0xbe0
[  252.266052][ T8564]  ? rtnetlink_rcv_msg+0x1b9/0xbe0
[  252.266064][ T8564]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  252.266080][ T8564]  ? ref_tracker_free+0x693/0x840
[  252.266101][ T8564]  ? __copy_skb_header+0xa3/0x4a0
[  252.266127][ T8564]  ? __pfx_ref_tracker_free+0x10/0x10
[  252.266148][ T8564]  ? __skb_clone+0x63/0x7a0
[  252.266176][ T8564]  netlink_rcv_skb+0x232/0x4b0
[  252.266189][ T8564]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  252.266203][ T8564]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  252.266221][ T8564]  ? netlink_deliver_tap+0x2e/0x1b0
[  252.266247][ T8564]  netlink_unicast+0x80f/0x9b0
[  252.266282][ T8564]  ? __pfx_netlink_unicast+0x10/0x10
[  252.266359][ T8564]  ? netlink_sendmsg+0x650/0xb40
[  252.266369][ T8564]  ? skb_put+0x11b/0x210
[  252.266430][ T8564]  netlink_sendmsg+0x813/0xb40
[  252.266474][ T8564]  ? __pfx_netlink_sendmsg+0x10/0x10
[  252.266497][ T8564]  ? __fget_files+0x2a/0x420
[  252.266516][ T8564]  ? aa_sock_msg_perm+0xf1/0x1b0
[  252.266540][ T8564]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  252.266564][ T8564]  __sys_sendto+0x709/0x7a0
[  252.266589][ T8564]  ? __pfx___sys_sendto+0x10/0x10
[  252.266626][ T8564]  ? __mutex_unlock_slowpath+0x1bd/0x7d0
[  252.266660][ T8564]  ? __fget_files+0x3a0/0x420
[  252.266690][ T8564]  ? ksys_write+0x242/0x270
[  252.266711][ T8564]  ? __pfx_ksys_write+0x10/0x10
[  252.266730][ T8564]  __x64_sys_sendto+0xde/0x100
[  252.266748][ T8564]  do_syscall_64+0xe2/0xf80
[  252.266766][ T8564]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  252.266784][ T8564]  ? trace_irq_disable+0x37/0x100
[  252.266801][ T8564]  ? clear_bhb_loop+0x60/0xb0
[  252.266823][ T8564]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  252.266840][ T8564] RIP: 0033:0x7fcbe8b9aeb9
[  252.266859][ T8564] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  252.266870][ T8564] RSP: 002b:00007fcbe9a97028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  252.266884][ T8564] RAX: ffffffffffffffda RBX: 00007fcbe8e15fa0 RCX: 00007fcbe8b9aeb9
[  252.266893][ T8564] RDX: 0000000000010a73 RSI: 0000200000000000 RDI: 0000000000000003
[  252.266901][ T8564] RBP: 00007fcbe9a97090 R08: 0000000000000000 R09: 4b6ae4f95a5de35b
[  252.266909][ T8564] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001
[  252.266920][ T8564] R13: 00007fcbe8e16038 R14: 00007fcbe8e15fa0 R15: 00007fcbe8f3fa48
[  252.266952][ T8564]  </TASK>
[  252.876530][ T5895] rc_core: IR keymap rc-hauppauge not found
[  252.882502][ T5895] Registered IR keymap rc-empty
[  252.897129][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  252.924423][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  252.949281][ T5895] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0
[  252.967365][ T5895] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input16
[  253.005235][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.033519][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.055082][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.094565][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.145351][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.183511][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.215995][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.243269][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.263039][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.283188][ T5895] mceusb 3-1:0.0: Error: mce write urb status = -71
[  253.329803][ T5895] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  253.345156][ T5895] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  253.622366][ T6858] usb 2-1: 0:2 : does not exist
[  253.653051][ T6858] usb 2-1: unit 5: unexpected type 0x0a
[  253.736143][ T6858] usb 2-1: USB disconnect, device number 16
[  253.829923][ T8211] udevd[8211]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  253.883283][ T8601] netlink: 'syz.4.787': attribute type 21 has an invalid length.
[  253.901736][ T8601] netlink: 132 bytes leftover after parsing attributes in process `syz.4.787'.
[  254.232871][ T5909] usb 5-1: new high-speed USB device number 12 using dummy_hcd
[  254.405504][ T5909] usb 5-1: config 0 has an invalid interface number: 101 but max is 0
[  254.414186][ T5909] usb 5-1: config 0 has no interface number 0
[  254.420507][ T5909] usb 5-1: config 0 interface 101 has no altsetting 0
[  254.427704][ T5909] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  254.436855][ T5909] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  254.448153][ T5909] usb 5-1: config 0 descriptor??
[  254.459232][ T5909] cp210x 5-1:0.101: cp210x converter detected
[  254.657302][ T5909] cp210x 5-1:0.101: failed to get vendor val 0x370b size 1: -121
[  254.665370][ T5909] cp210x 5-1:0.101: querying part number failed
[  254.677953][ T5909] usb 5-1: cp210x converter now attached to ttyUSB0
[  254.749695][ T8612] MPI: mpi too large (112776 bits)
[  254.849177][ T6858] usb 3-1: USB disconnect, device number 17
[  255.738700][ T8627] netlink: 12 bytes leftover after parsing attributes in process `syz.3.796'.
[  255.757341][ T8627] netlink: 'syz.3.796': attribute type 13 has an invalid length.
[  255.769441][ T8627] gretap0: refused to change device tx_queue_len
[  255.776119][ T8627] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[  255.815860][ T1298] ieee802154 phy0 wpan0: encryption failed: -22
[  255.822520][ T1298] ieee802154 phy1 wpan1: encryption failed: -22
[  256.000724][ T6858] usb 1-1: new high-speed USB device number 18 using dummy_hcd
[  256.213214][ T6858] usb 1-1: Using ep0 maxpacket: 32
[  256.224762][ T6858] usb 1-1: config 0 has an invalid interface number: 51 but max is 0
[  256.233571][ T6858] usb 1-1: config 0 has no interface number 0
[  256.258217][ T6858] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f
[  256.268542][ T6858] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  256.284813][ T6858] usb 1-1: Product: syz
[  256.306762][ T6858] usb 1-1: Manufacturer: syz
[  256.319562][ T6858] usb 1-1: SerialNumber: syz
[  256.343262][ T6858] usb 1-1: config 0 descriptor??
[  256.371297][ T6858] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected
[  256.677781][ T6858] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1
[  256.711219][ T6858] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB2
[  257.237438][ T8659] tipc: Started in network mode
[  257.243700][ T8659] tipc: Node identity ae471cbf9a4f, cluster identity 4711
[  257.251432][ T8659] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  257.260797][ T8659] syzkaller0: entered promiscuous mode
[  257.266934][ T8659] syzkaller0: entered allmulticast mode
[  257.297118][ T8659] tipc: Resetting bearer <eth:syzkaller0>
[  257.663051][ T5895] usb 2-1: new high-speed USB device number 17 using dummy_hcd
[  257.688665][ T5909] usb 5-1: USB disconnect, device number 12
[  257.711043][ T5909] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  257.734666][ T5909] cp210x 5-1:0.101: device disconnected
[  257.832746][ T5895] usb 2-1: Using ep0 maxpacket: 32
[  257.843343][ T5895] usb 2-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8
[  257.852944][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  257.861339][ T5895] usb 2-1: Product: syz
[  257.868183][ T5895] usb 2-1: Manufacturer: syz
[  257.873830][ T5895] usb 2-1: SerialNumber: syz
[  257.890490][ T5895] usb 2-1: config 0 descriptor??
[  257.908916][ T5895] empeg 2-1:0.0: empeg converter detected
[  257.918194][ T5895] usb 2-1: active config #0 != 1 ??
[  258.022822][ T8670] netlink: 20 bytes leftover after parsing attributes in process `syz.2.808'.
[  258.105108][ T8668] netlink: 8 bytes leftover after parsing attributes in process `syz.4.807'.
[  258.163340][ T8672] loop2: detected capacity change from 0 to 7
[  258.177216][ T8211] Dev loop2: unable to read RDB block 7
[  258.184009][ T8211]  loop2: AHDI p1 p2 p3
[  258.189735][ T8211] loop2: partition table partially beyond EOD, truncated
[  258.203516][ T8211] loop2: p1 start 1818582900 is beyond EOD, truncated
[  258.221984][ T8211] loop2: p3 start 335544320 is beyond EOD, truncated
[  258.234229][ T8672] Dev loop2: unable to read RDB block 7
[  258.239889][ T8672]  loop2: AHDI p1 p2 p3
[  258.244796][ T8672] loop2: partition table partially beyond EOD, truncated
[  258.253451][ T8672] loop2: p1 start 1818582900 is beyond EOD, truncated
[  258.263570][ T8668] kvm: requested 4190 ns i8254 timer period limited to 200000 ns
[  258.271835][ T8672] loop2: p3 start 335544320 is beyond EOD, truncated
[  258.351085][ T5895] tipc: Node number set to 872946879
[  258.394717][   T30] kauditd_printk_skb: 154 callbacks suppressed
[  258.394740][   T30] audit: type=1326 audit(1769817962.833:193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8665 comm="syz.4.807" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fcbe8b9aeb9 code=0x0
[  258.557561][    C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71
[  258.579374][ T5895] usb 1-1: USB disconnect, device number 18
[  258.656586][ T5895] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1
[  258.728780][ T5895] quatech-serial ttyUSB2: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB2
[  258.748000][ T5895] quatech2 1-1:0.51: device disconnected
[  259.527906][ T8695] syzkaller1: entered promiscuous mode
[  259.539633][ T8695] syzkaller1: entered allmulticast mode
[  259.811104][ T8704] netlink: 36 bytes leftover after parsing attributes in process `syz.4.818'.
[  259.996061][ T8707] netlink: 20 bytes leftover after parsing attributes in process `syz.4.819'.
[  260.239834][ T6858] usb 2-1: USB disconnect, device number 17
[  260.370915][ T8660] tipc: Resetting bearer <eth:syzkaller0>
[  260.373723][ T8719] loop2: detected capacity change from 0 to 7
[  260.465826][ T8719] Dev loop2: unable to read RDB block 7
[  260.471477][ T8719]  loop2: AHDI p1 p2 p3
[  260.580561][ T8660] tipc: Disabling bearer <eth:syzkaller0>
[  260.621791][ T8719] loop2: partition table partially beyond EOD, truncated
[  260.662930][ T8719] loop2: p1 start 1818582900 is beyond EOD, truncated
[  260.670504][ T8719] loop2: p3 start 335544320 is beyond EOD, truncated
[  260.682873][ T5193] Dev loop2: unable to read RDB block 7
[  260.690376][ T5193]  loop2: AHDI p1 p2 p3
[  260.731997][ T5193] loop2: partition table partially beyond EOD, truncated
[  260.759780][ T5193] loop2: p1 start 1818582900 is beyond EOD, truncated
[  260.783214][ T5193] loop2: p3 start 335544320 is beyond EOD, truncated
[  260.904890][ T8727] netlink: 40 bytes leftover after parsing attributes in process `syz.1.825'.
[  261.052838][ T8727] netlink: 48 bytes leftover after parsing attributes in process `syz.1.825'.
[  261.100544][ T8729] fuse: Bad value for 'group_id'
[  261.105669][ T8729] fuse: Bad value for 'group_id'
[  261.617419][ T8748] netlink: 20 bytes leftover after parsing attributes in process `syz.0.831'.
[  261.682786][ T5909] usb 3-1: new high-speed USB device number 18 using dummy_hcd
[  261.862852][ T5909] usb 3-1: Using ep0 maxpacket: 8
[  262.075493][ T5909] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b
[  262.084927][ T5909] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  262.111946][ T5909] pvrusb2: Hardware description: Terratec Grabster AV400
[  262.119346][ T5909] pvrusb2: **********
[  262.124751][ T5909] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[  262.135625][ T5909] pvrusb2: Important functionality might not be entirely working.
[  262.145808][ T5909] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[  262.180164][ T5909] pvrusb2: **********
[  262.310488][ T2344] pvrusb2: Invalid write control endpoint
[  262.434385][ T8764] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  262.577299][ T5909] usb 3-1: USB disconnect, device number 18
[  262.620215][ T2344] pvrusb2: Invalid write control endpoint
[  262.641268][ T8770] loop2: detected capacity change from 0 to 7
[  262.642757][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[  262.699061][ T8770] Dev loop2: unable to read RDB block 7
[  262.738818][ T8770]  loop2: AHDI p1 p2 p3
[  262.751361][ T8770] loop2: partition table partially beyond EOD, 
[  262.751426][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[  262.751426][ T8770] truncated
[  262.751608][ T8770] loop2: p1 start 1818582900 is beyond EOD, truncated
[  262.777618][ T8770] loop2: p3 start 335544320 is beyond EOD, truncated
[  262.779988][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[  262.796847][ T5193] Dev loop2: unable to read RDB block 7
[  262.831684][ T2344] pvrusb2: Device being rendered inoperable
[  262.863360][ T2344] cx25840 1-0044: Unable to detect h/w, assuming cx23887
[  262.880772][ T2344] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[  262.905353][ T2344] pvrusb2: Attached sub-driver cx25840
[  262.917858][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  262.928411][ T5193]  loop2: AHDI p1 p2 p3
[  262.932878][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  262.942297][ T5193] loop2: partition table partially beyond EOD, truncated
[  262.977507][ T5193] loop2: p1 start 1818582900 is beyond EOD, truncated
[  263.014514][ T5193] loop2: p3 start 335544320 is beyond EOD, truncated
[  263.422823][ T5895] usb 3-1: new high-speed USB device number 19 using dummy_hcd
[  263.584694][ T5895] usb 3-1: New USB device found, idVendor=1b1c, idProduct=1c03, bcdDevice= 0.00
[  263.600046][ T5895] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  263.626240][ T5895] usb 3-1: config 0 descriptor??
[  263.758175][ T8790] netlink: 4 bytes leftover after parsing attributes in process `syz.3.843'.
[  263.891871][ T8792] netlink: 20 bytes leftover after parsing attributes in process `syz.0.844'.
[  264.037074][ T8783] FAULT_INJECTION: forcing a failure.
[  264.037074][ T8783] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  264.050445][ T8783] CPU: 1 UID: 0 PID: 8783 Comm: syz.2.842 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  264.050487][ T8783] Tainted: [L]=SOFTLOCKUP
[  264.050492][ T8783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  264.050499][ T8783] Call Trace:
[  264.050506][ T8783]  <TASK>
[  264.050511][ T8783]  dump_stack_lvl+0xe8/0x150
[  264.050532][ T8783]  should_fail_ex+0x412/0x560
[  264.050550][ T8783]  _copy_to_user+0x31/0xb0
[  264.050568][ T8783]  simple_read_from_buffer+0xe1/0x170
[  264.050584][ T8783]  proc_fail_nth_read+0x1bb/0x230
[  264.050603][ T8783]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  264.050621][ T8783]  ? rw_verify_area+0x2a6/0x4d0
[  264.050637][ T8783]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  264.050654][ T8783]  vfs_read+0x20c/0xa70
[  264.050670][ T8783]  ? fdget_pos+0x246/0x320
[  264.050685][ T8783]  ? __pfx___mutex_lock+0x10/0x10
[  264.050699][ T8783]  ? __pfx_vfs_read+0x10/0x10
[  264.050721][ T8783]  ? __fget_files+0x2a/0x420
[  264.050745][ T8783]  ? __fget_files+0x3a0/0x420
[  264.050765][ T8783]  ? __fget_files+0x2a/0x420
[  264.050791][ T8783]  ksys_read+0x150/0x270
[  264.050819][ T8783]  ? __pfx_ksys_read+0x10/0x10
[  264.050843][ T8783]  do_syscall_64+0xe2/0xf80
[  264.050855][ T8783]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  264.050866][ T8783]  ? trace_irq_disable+0x37/0x100
[  264.050877][ T8783]  ? clear_bhb_loop+0x60/0xb0
[  264.050890][ T8783]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  264.050902][ T8783] RIP: 0033:0x7ffa0135b78e
[  264.050914][ T8783] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  264.050924][ T8783] RSP: 002b:00007ffa02239fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  264.050938][ T8783] RAX: ffffffffffffffda RBX: 00007ffa0223a6c0 RCX: 00007ffa0135b78e
[  264.050947][ T8783] RDX: 000000000000000f RSI: 00007ffa0223a0a0 RDI: 0000000000000007
[  264.050954][ T8783] RBP: 00007ffa0223a090 R08: 0000000000000000 R09: 0000000000000000
[  264.050961][ T8783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  264.050968][ T8783] R13: 00007ffa01616038 R14: 00007ffa01615fa0 R15: 00007ffa0173fa48
[  264.050987][ T8783]  </TASK>
[  264.529813][ T5895] usbhid 3-1:0.0: can't add hid device: -71
[  264.538825][ T5895] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  264.560640][ T5895] usb 3-1: USB disconnect, device number 19
[  265.242819][ T6858] usb 2-1: new high-speed USB device number 18 using dummy_hcd
[  265.405628][ T6858] usb 2-1: unable to get BOS descriptor or descriptor too short
[  265.415695][ T6858] usb 2-1: unable to read config index 0 descriptor/start: -61
[  265.423922][ T6858] usb 2-1: can't read configurations, error -61
[  265.552900][ T6858] usb 2-1: new high-speed USB device number 19 using dummy_hcd
[  265.716828][ T6858] usb 2-1: unable to get BOS descriptor or descriptor too short
[  265.727450][ T6858] usb 2-1: unable to read config index 0 descriptor/start: -61
[  265.736993][ T6858] usb 2-1: can't read configurations, error -61
[  265.760429][ T6858] usb usb2-port1: attempt power cycle
[  265.794779][ T8819] netlink: 20 bytes leftover after parsing attributes in process `syz.2.855'.
[  266.153146][ T6858] usb 2-1: new high-speed USB device number 20 using dummy_hcd
[  266.414076][ T6858] usb 2-1: unable to get BOS descriptor or descriptor too short
[  266.423845][ T6858] usb 2-1: unable to read config index 0 descriptor/start: -61
[  266.437989][ T6858] usb 2-1: can't read configurations, error -61
[  266.652927][ T6858] usb 2-1: new high-speed USB device number 21 using dummy_hcd
[  266.715045][ T6858] usb 2-1: unable to get BOS descriptor or descriptor too short
[  266.787632][ T6858] usb 2-1: unable to read config index 0 descriptor/start: -61
[  266.799536][ T6858] usb 2-1: can't read configurations, error -61
[  266.813251][ T6858] usb usb2-port1: unable to enumerate USB device
[  267.127437][ T8839] geneve2: entered promiscuous mode
[  267.157797][ T8839] geneve2: entered allmulticast mode
[  269.010916][ T8877] netlink: 12 bytes leftover after parsing attributes in process `syz.1.871'.
[  269.021345][ T8877] netlink: 'syz.1.871': attribute type 13 has an invalid length.
[  269.060788][ T8877] gretap0: refused to change device tx_queue_len
[  269.079857][ T8877] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[  270.980901][ T8910] netlink: 3 bytes leftover after parsing attributes in process `syz.3.883'.
[  271.012887][ T6859] usb 1-1: new high-speed USB device number 19 using dummy_hcd
[  271.164604][ T6859] usb 1-1: config 0 has an invalid interface number: 1 but max is 0
[  271.174275][ T6859] usb 1-1: config 0 has no interface number 0
[  271.180562][ T6859] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  271.195864][ T6859] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  271.217442][ T6859] usb 1-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18
[  271.245060][ T6859] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  271.268391][ T6859] usb 1-1: config 0 descriptor??
[  271.663183][  T107] usb 2-1: new high-speed USB device number 22 using dummy_hcd
[  271.896293][  T107] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  271.907617][  T107] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df
[  271.922779][ T8930] netlink: 12 bytes leftover after parsing attributes in process `syz.3.890'.
[  271.932082][  T107] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  271.950289][  T107] usb 2-1: config 0 descriptor??
[  271.967026][  T107] pwc: Askey VC010 type 2 USB webcam detected.
[  272.176199][ T6859] usbhid 1-1:0.1: can't add hid device: -71
[  272.199858][ T6859] usbhid 1-1:0.1: probe with driver usbhid failed with error -71
[  272.237178][ T6859] usb 1-1: USB disconnect, device number 19
[  272.375490][  T107] pwc: recv_control_msg error -32 req 02 val 2b00
[  272.385281][  T107] pwc: recv_control_msg error -32 req 02 val 2700
[  272.426269][  T107] pwc: recv_control_msg error -32 req 02 val 2c00
[  272.436082][  T107] pwc: recv_control_msg error -32 req 04 val 1000
[  272.445652][  T107] pwc: recv_control_msg error -32 req 04 val 1300
[  272.456627][  T107] pwc: recv_control_msg error -32 req 04 val 1400
[  272.465420][  T107] pwc: recv_control_msg error -32 req 02 val 2000
[  272.481257][ T8919] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  272.490460][ T8939] netlink: 28 bytes leftover after parsing attributes in process `syz.2.893'.
[  272.501242][ T8919] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  272.516688][  T107] pwc: recv_control_msg error -32 req 02 val 2100
[  272.528373][  T107] pwc: recv_control_msg error -32 req 04 val 1500
[  272.538921][  T107] pwc: recv_control_msg error -32 req 02 val 2500
[  272.546553][  T107] pwc: recv_control_msg error -32 req 02 val 2400
[  272.554872][  T107] pwc: recv_control_msg error -32 req 02 val 2600
[  272.784339][  T107] pwc: recv_control_msg error -71 req 02 val 2800
[  272.791503][  T107] pwc: recv_control_msg error -71 req 04 val 1100
[  272.821045][  T107] pwc: recv_control_msg error -71 req 04 val 1200
[  272.887167][  T107] pwc: Registered as video103.
[  272.905298][  T107] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input18
[  272.956122][  T107] usb 2-1: USB disconnect, device number 22
[  273.012882][ T5909] usb 5-1: new high-speed USB device number 13 using dummy_hcd
[  273.206734][ T5909] usb 5-1: Using ep0 maxpacket: 8
[  273.255785][ T5909] usb 5-1: config 0 has an invalid interface number: 237 but max is 0
[  273.278023][ T5909] usb 5-1: config 0 has no interface number 0
[  273.335624][ T5909] usb 5-1: New USB device found, idVendor=093a, idProduct=2460, bcdDevice=2a.87
[  273.384430][ T5909] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  273.416742][ T5909] usb 5-1: Product: syz
[  273.435556][ T5909] usb 5-1: Manufacturer: syz
[  273.451184][ T5909] usb 5-1: SerialNumber: syz
[  273.479762][ T5909] usb 5-1: config 0 descriptor??
[  273.626739][ T8957] netlink: 8 bytes leftover after parsing attributes in process `syz.3.898'.
[  273.711521][ T8957] tc_dump_action: action bad kind
[  273.816363][ T5909] gspca_main: pac207-2.14.0 probing 093a:2460
[  273.932961][ T5909] gspca_pac207: Failed to read a register (index 0x0001, error -110)
[  274.073353][ T8972] geneve2: entered promiscuous mode
[  274.079031][ T8972] geneve2: entered allmulticast mode
[  274.116974][ T6858] usb 5-1: USB disconnect, device number 13
[  275.050973][ T8985] netlink: 'syz.4.906': attribute type 12 has an invalid length.
[  275.062307][ T8992] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  275.299990][ T8985] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.906'.
[  275.423298][  T107] usb 4-1: new high-speed USB device number 20 using dummy_hcd
[  275.611112][  T107] usb 4-1: Using ep0 maxpacket: 32
[  275.639676][  T107] usb 4-1: config 0 has an invalid interface number: 125 but max is 0
[  275.662854][  T107] usb 4-1: config 0 has no interface number 0
[  275.702457][  T107] usb 4-1: config 0 interface 125 has no altsetting 0
[  275.730650][  T107] usb 4-1: New USB device found, idVendor=1039, idProduct=2120, bcdDevice= 2.a7
[  275.765969][  T107] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  275.795360][  T107] usb 4-1: Product: syz
[  275.808743][  T107] usb 4-1: Manufacturer: syz
[  275.826985][  T107] usb 4-1: SerialNumber: syz
[  275.845324][  T107] usb 4-1: config 0 descriptor??
[  276.068770][  T107] usb 4-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2120) Rev (0X2A7): Eagle II
[  276.310684][ T9013] bond0: option ad_select: unable to set because the bond device is up
[  276.623506][  T107] usb 4-1: reset high-speed USB device number 20 using dummy_hcd
[  277.213977][ T8994] netlink: 16 bytes leftover after parsing attributes in process `syz.3.909'.
[  277.224036][ T8994] netlink: 4 bytes leftover after parsing attributes in process `syz.3.909'.
[  277.235369][ T8994] netlink: 24 bytes leftover after parsing attributes in process `syz.3.909'.
[  277.253413][ T8994] sctp: [Deprecated]: syz.3.909 (pid 8994) Use of int in maxseg socket option.
[  277.253413][ T8994] Use struct sctp_assoc_value instead
[  277.273765][  T107] ueagle-atm 4-1:0.125: usbatm_usb_probe: bind failed: -19!
[  277.284233][ T9025] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  277.296868][ T9025] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  277.355400][  T107] usb 4-1: USB disconnect, device number 20
[  277.881654][ T9032] xt_CT: You must specify a L4 protocol and not use inversions on it
[  278.482431][ T6858] hid_parser_main: 1 callbacks suppressed
[  278.482456][ T6858] hid-generic 0000:0000:0000.000A: unknown main item tag 0x0
[  278.532983][ T6858] hid-generic 0000:0000:0000.000A: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  278.982837][ T6858] usb 4-1: new high-speed USB device number 21 using dummy_hcd
[  279.115733][ T9056] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  279.178762][ T6858] usb 4-1: config 0 has an invalid interface number: 197 but max is 0
[  279.197881][ T6858] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  279.220531][ T6858] usb 4-1: config 0 has 2 interfaces, different from the descriptor's value: 1
[  279.251479][ T6858] usb 4-1: config 0 has no interface number 1
[  279.354642][ T6858] usb 4-1: config 0 interface 197 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 8
[  279.376257][ T6858] usb 4-1: config 0 interface 197 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  279.393148][  T107] usb 2-1: new high-speed USB device number 23 using dummy_hcd
[  279.408201][ T6858] usb 4-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=bb.42
[  279.418368][ T6858] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  279.426577][ T6858] usb 4-1: Product: syz
[  279.432941][ T6858] usb 4-1: Manufacturer: syz
[  279.437580][ T6858] usb 4-1: SerialNumber: syz
[  279.459533][ T6858] usb 4-1: config 0 descriptor??
[  279.478197][ T9045] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  279.487681][ T6858] qmi_wwan 4-1:0.197: probe with driver qmi_wwan failed with error -22
[  279.644926][ T9062] FAULT_INJECTION: forcing a failure.
[  279.644926][ T9062] name failslab, interval 1, probability 0, space 0, times 0
[  279.668739][  T107] usb 2-1: Using ep0 maxpacket: 8
[  279.672787][ T9062] CPU: 1 UID: 0 PID: 9062 Comm: syz.2.929 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  279.672817][ T9062] Tainted: [L]=SOFTLOCKUP
[  279.672824][ T9062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  279.672834][ T9062] Call Trace:
[  279.672842][ T9062]  <TASK>
[  279.672849][ T9062]  dump_stack_lvl+0xe8/0x150
[  279.672878][ T9062]  should_fail_ex+0x412/0x560
[  279.672905][ T9062]  should_failslab+0xa8/0x100
[  279.672926][ T9062]  __kvmalloc_node_noprof+0x166/0x8d0
[  279.672948][ T9062]  ? nf_hook_entries_grow+0x288/0x720
[  279.672974][ T9062]  nf_hook_entries_grow+0x288/0x720
[  279.673004][ T9062]  ? __mutex_unlock_slowpath+0x1bd/0x7d0
[  279.673033][ T9062]  __nf_register_net_hook+0x2c9/0x930
[  279.673056][ T9062]  ? nf_register_net_hook+0xc8/0x190
[  279.673078][ T9062]  nf_register_net_hook+0xb2/0x190
[  279.673099][ T9062]  nf_register_net_hooks+0x44/0x1b0
[  279.673122][ T9062]  nf_ct_netns_do_get+0x3bf/0x5c0
[  279.673146][ T9062]  ? __pfx_nf_ct_netns_do_get+0x10/0x10
[  279.673170][ T9062]  ? xt_find_target+0x1f3/0x240
[  279.673192][ T9062]  ? nf_ct_netns_get+0xe9/0x320
[  279.673214][ T9062]  xt_check_target+0x3b5/0xa90
[  279.673239][ T9062]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  279.673259][ T9062]  ? __pfx_xt_check_target+0x10/0x10
[  279.673296][ T9062]  ? xt_find_target+0x1f3/0x240
[  279.673324][ T9062]  translate_table+0x1881/0x2110
[  279.673363][ T9062]  ? __pfx_translate_table+0x10/0x10
[  279.673379][ T9062]  ? __might_fault+0xaf/0x130
[  279.673404][ T9062]  ? __might_fault+0xaf/0x130
[  279.673445][ T9062]  ? _copy_from_user+0x94/0xb0
[  279.673476][ T9062]  do_ipt_set_ctl+0x9f5/0xe00
[  279.673497][ T9062]  ? rcu_is_watching+0x15/0xb0
[  279.673515][ T9062]  ? trace_contention_end+0x39/0x100
[  279.673533][ T9062]  ? __pfx_do_ipt_set_ctl+0x10/0x10
[  279.673568][ T9062]  ? __pfx___mutex_lock+0x10/0x10
[  279.673587][ T9062]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  279.673613][ T9062]  ? __pfx_aa_sk_perm+0x10/0x10
[  279.673640][ T9062]  nf_setsockopt+0x26f/0x290
[  279.673663][ T9062]  ? __pfx_sock_common_setsockopt+0x10/0x10
[  279.673684][ T9062]  do_sock_setsockopt+0x17c/0x1b0
[  279.673710][ T9062]  __x64_sys_setsockopt+0x13d/0x1b0
[  279.673736][ T9062]  do_syscall_64+0xe2/0xf80
[  279.673755][ T9062]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  279.673770][ T9062]  ? trace_irq_disable+0x37/0x100
[  279.673786][ T9062]  ? clear_bhb_loop+0x60/0xb0
[  279.673807][ T9062]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  279.673823][ T9062] RIP: 0033:0x7ffa0139aeb9
[  279.673840][ T9062] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  279.673857][ T9062] RSP: 002b:00007ffa0223a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  279.673879][ T9062] RAX: ffffffffffffffda RBX: 00007ffa01615fa0 RCX: 00007ffa0139aeb9
[  279.673892][ T9062] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004
[  279.673905][ T9062] RBP: 00007ffa0223a090 R08: 0000000000000490 R09: 0000000000000000
[  279.673916][ T9062] R10: 00002000000014c0 R11: 0000000000000246 R12: 0000000000000001
[  279.673928][ T9062] R13: 00007ffa01616038 R14: 00007ffa01615fa0 R15: 00007ffa0173fa48
[  279.673959][ T9062]  </TASK>
[  279.998800][ T9066] loop2: detected capacity change from 0 to 7
[  280.026022][ T9066] Dev loop2: unable to read RDB block 7
[  280.033007][ T9066]  loop2: unable to read partition table
[  280.038840][ T9066] loop2: partition table beyond EOD, truncated
[  280.045696][ T9066] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  280.097640][ T5193] Dev loop2: unable to read RDB block 7
[  280.125572][ T5193]  loop2: unable to read partition table
[  280.131884][ T5193] loop2: partition table beyond EOD, truncated
[  280.487567][  T107] usb 2-1: config 127 has an invalid interface number: 171 but max is 1
[  280.675821][  T107] usb 2-1: config 127 has no interface number 1
[  280.684115][  T107] usb 2-1: config 127 interface 0 altsetting 10 endpoint 0xA has invalid wMaxPacketSize 0
[  280.709431][  T107] usb 2-1: config 127 interface 171 has no altsetting 0
[  280.734450][ T9080] netlink: 8 bytes leftover after parsing attributes in process `syz.2.932'.
[  280.749385][  T107] usb 2-1: config 127 interface 0 has no altsetting 0
[  280.781661][  T107] usb 2-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9
[  280.793851][ T9080] kvm: requested 4190 ns i8254 timer period limited to 200000 ns
[  280.835730][  T107] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  280.888754][   T30] audit: type=1326 audit(1769817985.353:194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9076 comm="syz.2.932" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ffa0139aeb9 code=0x0
[  280.932280][  T107] usb 2-1: Product: syz
[  281.185097][  T107] usb 2-1: Manufacturer: syz
[  281.199830][  T107] usb 2-1: SerialNumber: syz
[  281.546006][ T6858] usb 4-1: USB disconnect, device number 21
[  281.550498][  T107] xr_serial 2-1:127.171: xr_serial converter detected
[  281.662950][  T107] xr_serial ttyUSB0: Failed to set reg 0x1a: -71
[  281.675803][  T107] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71
[  281.706311][  T107] usb 2-1: USB disconnect, device number 23
[  281.735506][  T107] xr_serial 2-1:127.171: device disconnected
[  282.344329][ T9098] geneve2: entered promiscuous mode
[  282.360186][ T9098] geneve2: entered allmulticast mode
[  282.749895][ T9109] random: crng reseeded on system resumption
[  283.122866][ T6859] usb 5-1: new full-speed USB device number 14 using dummy_hcd
[  283.330191][ T6859] usb 5-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c
[  283.377802][ T6859] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  283.458565][ T6859] usb 5-1: config 0 descriptor??
[  284.083187][ T6858] usb 4-1: new high-speed USB device number 22 using dummy_hcd
[  284.353631][ T6858] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  284.364313][ T6858] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[  284.375152][ T6858] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  284.384825][ T6858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67
[  284.393136][ T6858] usb 4-1: SerialNumber: syz
[  284.463308][  T107] usb 1-1: new high-speed USB device number 20 using dummy_hcd
[  284.532768][ T5910] usb 3-1: new high-speed USB device number 20 using dummy_hcd
[  284.627006][  T107] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023
[  284.645485][  T107] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 8
[  284.660670][  T107] usb 1-1: New USB device found, idVendor=2c7c, idProduct=030e, bcdDevice=81.28
[  284.670515][  T107] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  284.678924][  T107] usb 1-1: Product: syz
[  284.684244][  T107] usb 1-1: Manufacturer: syz
[  284.688927][  T107] usb 1-1: SerialNumber: syz
[  284.716242][  T107] usb 1-1: config 0 descriptor??
[  284.722026][ T9126] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22
[  284.731618][ T9126] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22
[  284.749041][  T107] option 1-1:0.0: GSM modem (1-port) converter detected
[  284.772069][  T107] usb 1-1: GSM modem (1-port) converter now attached to ttyUSB0
[  284.795888][ T5910] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  284.806231][ T5910] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3
[  284.817444][ T5910] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  284.827456][ T5910] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67
[  284.840178][ T5910] usb 3-1: SerialNumber: syz
[  284.977088][ T6860] usb 1-1: USB disconnect, device number 20
[  284.991296][ T6860] option1 ttyUSB0: GSM modem (1-port) converter now disconnected from ttyUSB0
[  285.003150][ T6860] option 1-1:0.0: device disconnected
[  285.193759][ T9142] netlink: 12 bytes leftover after parsing attributes in process `syz.1.946'.
[  285.208303][ T9142] netlink: 'syz.1.946': attribute type 13 has an invalid length.
[  285.237005][ T9142] gretap0: refused to change device tx_queue_len
[  285.245479][ T9142] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[  285.419019][ T6859] pegasus 5-1:0.0: can't reset MAC
[  285.424749][ T6859] pegasus 5-1:0.0: probe with driver pegasus failed with error -5
[  285.454497][ T6859] usb 5-1: USB disconnect, device number 14
[  286.564752][ T6858] usb 4-1: 0:2 : does not exist
[  286.598315][ T6858] usb 4-1: unit 5: unexpected type 0x0a
[  286.721218][ T6858] usb 4-1: USB disconnect, device number 22
[  287.232308][ T5910] usb 3-1: 0:2 : does not exist
[  287.242204][ T5910] usb 3-1: unit 5 not found!
[  287.251654][ T8211] udevd[8211]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  287.394477][ T5910] usb 3-1: USB disconnect, device number 20
[  287.696889][ T9172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.954'.
[  287.797824][ T8211] udevd[8211]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  287.956235][ T9175] netlink: 'syz.0.955': attribute type 1 has an invalid length.
[  288.653104][  T107] usb 5-1: new high-speed USB device number 15 using dummy_hcd
[  288.822936][  T107] usb 5-1: Using ep0 maxpacket: 16
[  288.843851][ T9193] xt_TPROXY: Can be used only with -p tcp or -p udp
[  288.851297][  T107] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[  288.873873][  T107] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  288.891069][  T107] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  288.910808][  T107] usb 5-1: Product: syz
[  288.924648][  T107] usb 5-1: Manufacturer: syz
[  288.937479][  T107] usb 5-1: SerialNumber: syz
[  288.961710][  T107] usb 5-1: config 0 descriptor??
[  289.002788][ T5910] usb 3-1: new full-speed USB device number 21 using dummy_hcd
[  289.073268][  T107] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  289.095800][  T107] em28xx 5-1:0.0: DVB interface 0 found: bulk
[  289.195376][ T5910] usb 3-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config
[  289.205722][ T5910] usb 3-1: config 8 has 0 interfaces, different from the descriptor's value: 1
[  289.215699][ T5910] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1
[  289.226005][ T5910] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  289.385196][  T107] em28xx 5-1:0.0: unknown em28xx chip ID (0)
[  289.772817][  T107] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5)
[  289.793716][  T107] em28xx 5-1:0.0: board has no eeprom
[  289.872943][ T9204] MPI: mpi too large (112776 bits)
[  289.882894][  T107] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94)
[  289.892102][  T107] em28xx 5-1:0.0: dvb set to bulk mode.
[  289.900531][ T5895] em28xx 5-1:0.0: Binding DVB extension
[  289.988685][  T107] usb 5-1: USB disconnect, device number 15
[  290.009081][  T107] em28xx 5-1:0.0: Disconnecting em28xx
[  290.360225][ T5895] em28xx 5-1:0.0: Registering input extension
[  290.598850][  T107] em28xx 5-1:0.0: Closing input extension
[  290.726508][  T107] em28xx 5-1:0.0: Freeing device
[  291.261653][ T9221] netlink: 4 bytes leftover after parsing attributes in process `syz.4.966'.
[  291.972788][  T107] usb 1-1: new high-speed USB device number 21 using dummy_hcd
[  292.015536][ T5895] usb 3-1: USB disconnect, device number 21
[  292.125121][  T107] usb 1-1: config 4 has an invalid interface number: 28 but max is 0
[  292.140088][  T107] usb 1-1: config 4 has no interface number 0
[  292.168133][  T107] usb 1-1: New USB device found, idVendor=05ac, idProduct=0245, bcdDevice= a.3a
[  292.191302][  T107] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  292.215805][  T107] usb 1-1: Product: syz
[  292.227956][  T107] usb 1-1: Manufacturer: syz
[  292.242738][  T107] usb 1-1: SerialNumber: syz
[  292.270773][  T107] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:4.28/input/input20
[  292.360028][ T9238] x_tables: ip_tables: osf match: only valid for protocol 6
[  292.480497][ T9229] IPv6: Can't replace route, no match found
[  292.488302][ T5178] bcm5974 1-1:4.28: could not read from device
[  292.509392][ T5178] bcm5974 1-1:4.28: could not read from device
[  292.525900][  T107] bcm5974 1-1:4.28: could not read from device
[  292.562930][  T107] input: failed to attach handler mousedev to device input20, error: -5
[  292.587774][ T5178] bcm5974 1-1:4.28: could not read from device
[  292.610099][  T107] usb 1-1: USB disconnect, device number 21
[  292.621417][ T5178] bcm5974 1-1:4.28: could not read from device
[  293.268451][ T5910] usb 2-1: new full-speed USB device number 24 using dummy_hcd
[  293.442792][ T6858] usb 1-1: new high-speed USB device number 22 using dummy_hcd
[  293.777490][ T6858] usb 1-1: config index 0 descriptor too short (expected 23569, got 27)
[  293.786019][ T6858] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  293.798305][ T6858] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0
[  293.807980][ T6858] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0
[  293.822458][ T6858] usb 1-1: Manufacturer: syz
[  293.830994][ T6858] usb 1-1: config 0 descriptor??
[  293.922883][ T6858] rc_core: IR keymap rc-hauppauge not found
[  293.928977][ T6858] Registered IR keymap rc-empty
[  293.974568][ T6858] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
[  293.982891][  T107] usb 3-1: new high-speed USB device number 22 using dummy_hcd
[  294.006798][ T6858] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input21
[  294.037962][ T9269] netlink: 28 bytes leftover after parsing attributes in process `syz.4.987'.
[  294.057521][    C1] igorplugusb 1-1:0.0: Error: urb status = -32
[  294.182376][  T107] usb 3-1: Using ep0 maxpacket: 16
[  294.189497][ T5895] usb 1-1: USB disconnect, device number 22
[  294.206296][  T107] usb 3-1: config 0 has an invalid interface number: 41 but max is 0
[  294.217766][  T107] usb 3-1: config 0 has no interface number 0
[  294.227935][  T107] usb 3-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16
[  294.240773][  T107] usb 3-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64
[  294.253348][  T107] usb 3-1: config 0 interface 41 has no altsetting 0
[  294.269196][  T107] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a
[  294.284803][  T107] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  294.298353][  T107] usb 3-1: Product: syz
[  294.304553][  T107] usb 3-1: Manufacturer: syz
[  294.311102][  T107] usb 3-1: SerialNumber: syz
[  294.345796][  T107] usb 3-1: config 0 descriptor??
[  294.371282][ T9264] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22
[  294.400434][ T9264] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22
[  294.631301][  T107] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -71
[  294.697289][  T107] usb 3-1: USB disconnect, device number 22
[  294.830838][ T9302] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  295.055354][   T30] audit: type=1326 audit(1769817999.523:195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9305 comm="syz.3.999" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb38d99aeb9 code=0x0
[  295.132565][ T9309] netlink: 'syz.0.1000': attribute type 5 has an invalid length.
[  295.742040][ T9315] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  295.954207][ T9320] sctp: [Deprecated]: syz.3.1003 (pid 9320) Use of int in max_burst socket option.
[  295.954207][ T9320] Use struct sctp_assoc_value instead
[  296.882788][  T107] usb 4-1: new high-speed USB device number 23 using dummy_hcd
[  296.997276][ T9338] FAULT_INJECTION: forcing a failure.
[  296.997276][ T9338] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  297.027865][ T9338] CPU: 1 UID: 0 PID: 9338 Comm: syz.1.1009 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  297.027896][ T9338] Tainted: [L]=SOFTLOCKUP
[  297.027902][ T9338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  297.027914][ T9338] Call Trace:
[  297.027922][ T9338]  <TASK>
[  297.027929][ T9338]  dump_stack_lvl+0xe8/0x150
[  297.027959][ T9338]  should_fail_ex+0x412/0x560
[  297.027987][ T9338]  _copy_from_iter+0x1d3/0x1670
[  297.028019][ T9338]  ? trace_kmem_cache_alloc+0x1f/0xb0
[  297.028058][ T9338]  ? __pfx__copy_from_iter+0x10/0x10
[  297.028082][ T9338]  ? __build_skb_around+0x22d/0x3c0
[  297.028105][ T9338]  ? __alloc_skb+0x193/0x390
[  297.028126][ T9338]  ? netlink_sendmsg+0x650/0xb40
[  297.028145][ T9338]  ? skb_put+0x11b/0x210
[  297.028170][ T9338]  netlink_sendmsg+0x6c0/0xb40
[  297.028200][ T9338]  ? __pfx_netlink_sendmsg+0x10/0x10
[  297.028223][ T9338]  ? aa_sock_msg_perm+0xf1/0x1b0
[  297.028249][ T9338]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  297.028271][ T9338]  ? __pfx_netlink_sendmsg+0x10/0x10
[  297.028290][ T9338]  ____sys_sendmsg+0xa68/0xad0
[  297.028316][ T9338]  ? __might_fault+0xaf/0x130
[  297.028349][ T9338]  ? __pfx_____sys_sendmsg+0x10/0x10
[  297.028381][ T9338]  ? import_iovec+0x73/0xa0
[  297.028410][ T9338]  ___sys_sendmsg+0x2a5/0x360
[  297.028433][ T9338]  ? __lock_acquire+0x6b5/0x2cf0
[  297.028463][ T9338]  ? __pfx____sys_sendmsg+0x10/0x10
[  297.028521][ T9338]  ? __fget_files+0x2a/0x420
[  297.028540][ T9338]  ? __fget_files+0x3a0/0x420
[  297.028568][ T9338]  __x64_sys_sendmsg+0x1bd/0x2a0
[  297.028593][ T9338]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  297.028623][ T9338]  ? __pfx_ksys_write+0x10/0x10
[  297.028658][ T9338]  do_syscall_64+0xe2/0xf80
[  297.028678][ T9338]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  297.028694][ T9338]  ? trace_irq_disable+0x37/0x100
[  297.028710][ T9338]  ? clear_bhb_loop+0x60/0xb0
[  297.028732][ T9338]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  297.028749][ T9338] RIP: 0033:0x7f8a6ed9aeb9
[  297.028767][ T9338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  297.028782][ T9338] RSP: 002b:00007f8a6fbc7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  297.028803][ T9338] RAX: ffffffffffffffda RBX: 00007f8a6f015fa0 RCX: 00007f8a6ed9aeb9
[  297.028817][ T9338] RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000003
[  297.028829][ T9338] RBP: 00007f8a6fbc7090 R08: 0000000000000000 R09: 0000000000000000
[  297.028840][ T9338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  297.028851][ T9338] R13: 00007f8a6f016038 R14: 00007f8a6f015fa0 R15: 00007f8a6f13fa48
[  297.028881][ T9338]  </TASK>
[  297.093140][  T107] usb 4-1: Using ep0 maxpacket: 16
[  297.191560][ T5910] usb 3-1: new high-speed USB device number 23 using dummy_hcd
[  297.282289][  T107] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  297.334400][  T107] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  297.373481][  T107] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  297.383551][  T107] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  297.391580][  T107] usb 4-1: Product: syz
[  297.402672][  T107] usb 4-1: Manufacturer: syz
[  297.407439][  T107] usb 4-1: SerialNumber: syz
[  297.423328][  T107] usb 4-1: config 0 descriptor??
[  297.435803][  T107] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  297.452791][  T107] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class)
[  297.489854][ T9346] fuse: Bad value for 'rootmode'
[  297.647483][ T5910] usb 3-1: config index 0 descriptor too short (expected 23569, got 27)
[  297.675130][ T5910] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  297.700947][ T5910] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0
[  297.722066][ T5910] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0
[  297.739614][ T5910] usb 3-1: Manufacturer: syz
[  297.752802][ T5895] usb 2-1: new high-speed USB device number 25 using dummy_hcd
[  297.772940][ T5910] usb 3-1: config 0 descriptor??
[  297.912991][ T5910] rc_core: IR keymap rc-hauppauge not found
[  297.929342][ T5910] Registered IR keymap rc-empty
[  297.932042][ T5895] usb 2-1: config 0 has an invalid interface number: 1 but max is 0
[  297.944498][ T5895] usb 2-1: config 0 has no interface number 0
[  297.953030][ T5910] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0
[  297.982258][ T5895] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b
[  297.991920][ T5895] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  297.991965][ T5910] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input22
[  298.010508][ T5895] usb 2-1: Product: syz
[  298.033199][ T5895] usb 2-1: Manufacturer: syz
[  298.058464][ T5895] usb 2-1: SerialNumber: syz
[  298.059082][    C1] igorplugusb 3-1:0.0: Error: urb status = -32
[  298.070449][  T107] em28xx 4-1:0.0: unknown em28xx chip ID (0)
[  298.079543][ T9330] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  298.088943][ T9330] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  298.091121][ T9351] syzkaller0: entered promiscuous mode
[  298.104637][ T5895] usb 2-1: config 0 descriptor??
[  298.118597][ T9351] syzkaller0: entered allmulticast mode
[  298.155529][  T107] em28xx 4-1:0.0: Config register raw data: 0xfffffffb
[  298.164490][ T9354] netlink: 31 bytes leftover after parsing attributes in process `syz.4.1013'.
[  298.211439][ T5909] usb 3-1: USB disconnect, device number 23
[  298.316062][ T5895] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in cold state
[  298.339713][ T5895] usb 2-1: Direct firmware load for dvb-usb-ec168.fw failed with error -2
[  298.360533][ T5895] usb 2-1: Falling back to sysfs fallback for: dvb-usb-ec168.fw
[  298.795790][  T107] em28xx 4-1:0.0: Unknown AC97 audio processor detected!
[  299.433188][  T107] em28xx 4-1:0.0: AC97 command still being executed: not handled properly!
[  299.449225][  T107] em28xx 4-1:0.0: couldn't setup AC97 register 4
[  299.622557][  T107] em28xx 4-1:0.0: couldn't setup AC97 register 6
[  299.649877][  T107] em28xx 4-1:0.0: couldn't setup AC97 register 54
[  299.663011][  T107] em28xx 4-1:0.0: couldn't setup AC97 register 56
[  299.691532][  T107] usb 4-1: USB disconnect, device number 23
[  300.124425][ T9380] loop8: detected capacity change from 0 to 8
[  300.133005][ T8211] Dev loop8: unable to read RDB block 8
[  300.139251][ T8211]  loop8: unable to read partition table
[  300.155119][ T8211] loop8: partition table beyond EOD, truncated
[  300.174181][ T9380] Dev loop8: unable to read RDB block 8
[  300.182153][ T9380]  loop8: unable to read partition table
[  300.188449][ T9380] loop8: partition table beyond EOD, truncated
[  300.202608][ T9380] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5)
[  300.265439][   T30] audit: type=1326 audit(1769818004.733:196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9376 comm="syz.2.1021" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0139aeb9 code=0x7fc00000
[  300.862776][ T5909] usb 1-1: new high-speed USB device number 23 using dummy_hcd
[  301.102853][  T107] usb 5-1: new high-speed USB device number 16 using dummy_hcd
[  301.146664][ T9408] binder: 9406:9408 ioctl c0306201 2000000003c0 returned -14
[  301.228800][ T5909] usb 1-1: config index 0 descriptor too short (expected 23569, got 27)
[  301.244673][ T5909] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  301.276211][ T5909] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0
[  301.291300][ T5909] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0
[  301.309609][ T5909] usb 1-1: Manufacturer: syz
[  301.343856][ T5909] usb 1-1: config 0 descriptor??
[  301.433171][  T107] usb 5-1: Using ep0 maxpacket: 32
[  301.449581][ T5909] rc_core: IR keymap rc-hauppauge not found
[  301.461030][ T5909] Registered IR keymap rc-empty
[  301.467100][  T107] usb 5-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50
[  301.482824][  T107] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  301.490879][  T107] usb 5-1: Product: syz
[  301.496823][ T5909] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
[  301.522785][  T107] usb 5-1: Manufacturer: syz
[  301.527567][  T107] usb 5-1: SerialNumber: syz
[  301.533310][ T5909] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input23
[  301.549509][  T107] usb 5-1: config 0 descriptor??
[  301.556653][    C0] igorplugusb 1-1:0.0: Error: urb status = -32
[  301.568355][  T107] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state.
[  301.578132][  T107] dvb-usb: bulk message failed: -22 (2/0)
[  301.624553][  T107] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  301.661639][ T9412] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  301.675312][ T9412] fuse: Bad value for 'fd'
[  301.705506][  T107] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold)
[  301.714458][  T107] usb 5-1: media controller created
[  301.771176][ T9401] dvb-usb: bulk message failed: -22 (3/0)
[  301.777880][ T5910] usb 1-1: USB disconnect, device number 23
[  301.945403][  T107] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  302.055185][  T107] usb 5-1: selecting invalid altsetting 7
[  302.102280][  T107] cxusb: set interface failed
[  302.183105][  T107] dvb-usb: bulk message failed: -22 (1/0)
[  302.207859][ T9414] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.1031'.
[  302.274120][  T107] DVB: Unable to find symbol lgdt330x_attach()
[  302.299878][  T107] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold'
[  302.392972][  T107] rc_core: IR keymap rc-dvico-portable not found
[  302.424968][  T107] Registered IR keymap rc-empty
[  302.439851][  T107] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0
[  302.487610][  T107] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input24
[  302.525364][  T107] dvb-usb: schedule remote query interval to 100 msecs.
[  302.548092][  T107] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected.
[  302.598951][  T107] usb 5-1: USB disconnect, device number 16
[  302.693150][ T5909] usb 3-1: new high-speed USB device number 24 using dummy_hcd
[  302.829608][  T107] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected.
[  302.842048][ T9428] FAULT_INJECTION: forcing a failure.
[  302.842048][ T9428] name failslab, interval 1, probability 0, space 0, times 0
[  302.859823][ T9428] CPU: 0 UID: 0 PID: 9428 Comm: syz.4.1036 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  302.859862][ T9428] Tainted: [L]=SOFTLOCKUP
[  302.859870][ T9428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  302.859881][ T9428] Call Trace:
[  302.859890][ T9428]  <TASK>
[  302.859898][ T9428]  dump_stack_lvl+0xe8/0x150
[  302.859930][ T9428]  should_fail_ex+0x412/0x560
[  302.859959][ T9428]  should_failslab+0xa8/0x100
[  302.859982][ T9428]  __kmalloc_cache_noprof+0x83/0x6e0
[  302.860003][ T9428]  ? fuse_alloc_inode+0xec/0x1a0
[  302.860029][ T9428]  fuse_alloc_inode+0xec/0x1a0
[  302.860061][ T9428]  ? __pfx_fuse_alloc_inode+0x10/0x10
[  302.860082][ T9428]  alloc_inode+0x6a/0x1b0
[  302.860100][ T9428]  ? __pfx_fuse_inode_eq+0x10/0x10
[  302.860118][ T9428]  ? __pfx_fuse_inode_set+0x10/0x10
[  302.860134][ T9428]  iget5_locked+0x4a/0xa0
[  302.860160][ T9428]  fuse_iget+0x381/0x9b0
[  302.860187][ T9428]  ? __pfx_fuse_iget+0x10/0x10
[  302.860205][ T9428]  ? __kmalloc_cache_noprof+0x3d1/0x6e0
[  302.860233][ T9428]  fuse_lookup_name+0x75b/0x8b0
[  302.860262][ T9428]  ? __pfx_fuse_lookup_name+0x10/0x10
[  302.860298][ T9428]  ? d_alloc_parallel+0x366/0x1610
[  302.860333][ T9428]  fuse_lookup+0x213/0x4e0
[  302.860351][ T9428]  ? look_up_lock_class+0x57/0x110
[  302.860378][ T9428]  ? __pfx_fuse_lookup+0x10/0x10
[  302.860414][ T9428]  ? __raw_spin_lock_init+0x45/0x100
[  302.860438][ T9428]  ? __init_waitqueue_head+0xa9/0x150
[  302.860468][ T9428]  __lookup_slow+0x2b7/0x410
[  302.860492][ T9428]  ? __pfx___lookup_slow+0x10/0x10
[  302.860556][ T9428]  ? down_read+0x272/0x2e0
[  302.860587][ T9428]  lookup_slow+0x53/0x70
[  302.860610][ T9428]  path_lookupat+0x3f5/0x8c0
[  302.860651][ T9428]  filename_lookup+0x256/0x5d0
[  302.860680][ T9428]  ? __pfx_filename_lookup+0x10/0x10
[  302.860726][ T9428]  ? strncpy_from_user+0x150/0x2b0
[  302.860751][ T9428]  ? getname_flags+0x1e4/0x540
[  302.860775][ T9428]  do_readlinkat+0xe6/0x510
[  302.860802][ T9428]  ? __pfx_do_readlinkat+0x10/0x10
[  302.860825][ T9428]  ? __pfx_ksys_write+0x10/0x10
[  302.860858][ T9428]  __x64_sys_readlink+0x7f/0x90
[  302.860882][ T9428]  do_syscall_64+0xe2/0xf80
[  302.860902][ T9428]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  302.860920][ T9428]  ? trace_irq_disable+0x37/0x100
[  302.860939][ T9428]  ? clear_bhb_loop+0x60/0xb0
[  302.860961][ T9428]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  302.860979][ T9428] RIP: 0033:0x7fcbe8b9aeb9
[  302.860997][ T9428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  302.861013][ T9428] RSP: 002b:00007fcbe9a97028 EFLAGS: 00000246 ORIG_RAX: 0000000000000059
[  302.861043][ T9428] RAX: ffffffffffffffda RBX: 00007fcbe8e15fa0 RCX: 00007fcbe8b9aeb9
[  302.861057][ T9428] RDX: 0000000000000097 RSI: 00002000000021c0 RDI: 0000200000002000
[  302.861069][ T9428] RBP: 00007fcbe9a97090 R08: 0000000000000000 R09: 0000000000000000
[  302.861081][ T9428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  302.861092][ T9428] R13: 00007fcbe8e16038 R14: 00007fcbe8e15fa0 R15: 00007fcbe8f3fa48
[  302.861126][ T9428]  </TASK>
[  303.231061][ T9433] xt_TPROXY: Can be used only with -p tcp or -p udp
[  303.521280][ T5909] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  303.532999][ T5909] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  303.545321][ T5909] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00
[  303.562773][ T5909] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  303.577488][ T5909] usb 3-1: Manufacturer: syz
[  303.586214][ T5909] usb 3-1: config 0 descriptor??
[  303.858473][ T5910] usb 1-1: new high-speed USB device number 24 using dummy_hcd
[  303.998328][ T5909] usbhid 3-1:0.0: can't add hid device: -32
[  304.004889][ T5909] usbhid 3-1:0.0: probe with driver usbhid failed with error -32
[  304.062930][ T5910] usb 1-1: Using ep0 maxpacket: 32
[  304.069936][ T5910] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  304.091741][ T5910] usb 1-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39
[  304.112584][ T9442] ptrace attach of "./syz-executor exec"[9445] was attempted by "./syz-executor exec"[9442]
[  304.122461][ T5910] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  304.132739][ T5910] usb 1-1: Product: syz
[  304.137688][ T5910] usb 1-1: Manufacturer: syz
[  304.142801][ T5910] usb 1-1: SerialNumber: syz
[  304.157752][ T5910] usb 1-1: config 0 descriptor??
[  304.174681][ T5910] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b
[  304.793157][ T5909] usb 5-1: new high-speed USB device number 17 using dummy_hcd
[  304.848543][ T9464] program syz.1.1047 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  304.954449][ T5909] usb 5-1: config index 0 descriptor too short (expected 23569, got 27)
[  304.963124][ T5909] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  304.974704][ T5909] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0
[  304.985273][ T5909] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0
[  304.995767][ T5909] usb 5-1: Manufacturer: syz
[  305.004342][ T5909] usb 5-1: config 0 descriptor??
[  305.028978][ T5910] input: gspca_pac7302 as /devices/platform/dummy_hcd.0/usb1/1-1/input/input26
[  305.083908][ T9467] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.1032'.
[  305.094597][ T5909] rc_core: IR keymap rc-hauppauge not found
[  305.114044][ T5909] Registered IR keymap rc-empty
[  305.120874][ T5909] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0
[  305.136856][ T5909] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input25
[  305.218874][    C0] igorplugusb 5-1:0.0: Error: urb status = -32
[  305.310699][ T5910] usb 1-1: USB disconnect, device number 24
[  305.336860][ T5909] usb 5-1: USB disconnect, device number 17
[  306.016683][ T9480] loop2: detected capacity change from 0 to 7
[  306.023740][ T9480] Dev loop2: unable to read RDB block 7
[  306.029370][ T9480]  loop2: AHDI p1 p2
[  306.033607][ T9480] loop2: partition table partially beyond EOD, truncated
[  306.040870][ T9480] loop2: p1 start 1818582900 is beyond EOD, truncated
[  306.143124][ T9483] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1050'.
[  306.310242][ T5910] usb 3-1: USB disconnect, device number 24
[  307.502757][ T6858] usb 3-1: new high-speed USB device number 25 using dummy_hcd
[  307.522827][ T5909] usb 4-1: new high-speed USB device number 24 using dummy_hcd
[  307.662595][ T6858] usb 3-1: config 0 has an invalid interface number: 64 but max is 0
[  307.670926][ T6858] usb 3-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config
[  307.689869][ T9517] MPI: mpi too large (112776 bits)
[  307.724321][ T6858] usb 3-1: config 0 has no interface number 0
[  307.735477][ T6858] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48
[  307.744965][ T6858] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  307.753185][ T6858] usb 3-1: Product: syz
[  307.758906][ T6858] usb 3-1: Manufacturer: syz
[  307.768439][ T6858] usb 3-1: SerialNumber: syz
[  307.785648][ T6858] usb 3-1: config 0 descriptor??
[  307.805884][ T5909] usb 4-1: config index 0 descriptor too short (expected 23569, got 27)
[  307.819464][ T5909] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  307.823720][ T6858] uvcvideo 3-1:0.64: probe with driver uvcvideo failed with error -22
[  307.871282][ T5909] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0
[  307.909461][ T5909] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0
[  307.938793][ T5909] usb 4-1: Manufacturer: syz
[  307.965209][ T5909] usb 4-1: config 0 descriptor??
[  308.024577][ T6858] usb 3-1: USB disconnect, device number 25
[  308.133931][ T5909] rc_core: IR keymap rc-hauppauge not found
[  308.146420][ T5909] Registered IR keymap rc-empty
[  308.188064][ T5909] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0
[  308.238075][ T5909] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input27
[  308.271075][    C0] igorplugusb 4-1:0.0: Error: urb status = -32
[  308.552849][ T6858] usb 4-1: USB disconnect, device number 24
[  308.735578][ T9536] x_tables: ip_tables: osf match: only valid for protocol 6
[  308.751247][ T9536] FAULT_INJECTION: forcing a failure.
[  308.751247][ T9536] name failslab, interval 1, probability 0, space 0, times 0
[  308.786243][ T9536] CPU: 1 UID: 0 PID: 9536 Comm: syz.2.1068 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  308.786277][ T9536] Tainted: [L]=SOFTLOCKUP
[  308.786285][ T9536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  308.786296][ T9536] Call Trace:
[  308.786304][ T9536]  <TASK>
[  308.786313][ T9536]  dump_stack_lvl+0xe8/0x150
[  308.786345][ T9536]  should_fail_ex+0x412/0x560
[  308.786375][ T9536]  should_failslab+0xa8/0x100
[  308.786399][ T9536]  __kvmalloc_node_noprof+0x166/0x8d0
[  308.786422][ T9536]  ? static_key_slow_dec+0x3d/0x90
[  308.786449][ T9536]  ? __nf_hook_entries_try_shrink+0x328/0x700
[  308.786480][ T9536]  __nf_hook_entries_try_shrink+0x328/0x700
[  308.786517][ T9536]  __nf_unregister_net_hook+0x4cc/0x6f0
[  308.786550][ T9536]  nf_unregister_net_hooks+0xcb/0x140
[  308.786577][ T9536]  nf_ct_netns_put+0x3b9/0x520
[  308.786602][ T9536]  ? __pfx_redirect_tg_destroy+0x10/0x10
[  308.786630][ T9536]  cleanup_entry+0x28c/0x350
[  308.786653][ T9536]  ? __pfx_cleanup_entry+0x10/0x10
[  308.786682][ T9536]  ? xt_find_match+0x1f7/0x250
[  308.786714][ T9536]  translate_table+0x1f09/0x2110
[  308.786758][ T9536]  ? __pfx_translate_table+0x10/0x10
[  308.786779][ T9536]  ? __might_fault+0xaf/0x130
[  308.786829][ T9536]  ? _copy_from_user+0x94/0xb0
[  308.786864][ T9536]  do_ipt_set_ctl+0x9f5/0xe00
[  308.786887][ T9536]  ? rcu_is_watching+0x15/0xb0
[  308.786914][ T9536]  ? trace_contention_end+0x39/0x100
[  308.786944][ T9536]  ? __pfx_do_ipt_set_ctl+0x10/0x10
[  308.786984][ T9536]  ? __pfx___mutex_lock+0x10/0x10
[  308.787007][ T9536]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  308.787037][ T9536]  ? __pfx_aa_sk_perm+0x10/0x10
[  308.787067][ T9536]  nf_setsockopt+0x26f/0x290
[  308.787095][ T9536]  ? __pfx_sock_common_setsockopt+0x10/0x10
[  308.787118][ T9536]  do_sock_setsockopt+0x17c/0x1b0
[  308.787149][ T9536]  __x64_sys_setsockopt+0x13d/0x1b0
[  308.787181][ T9536]  do_syscall_64+0xe2/0xf80
[  308.787201][ T9536]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  308.787220][ T9536]  ? trace_irq_disable+0x37/0x100
[  308.787239][ T9536]  ? clear_bhb_loop+0x60/0xb0
[  308.787263][ T9536]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  308.787282][ T9536] RIP: 0033:0x7ffa0139aeb9
[  308.787302][ T9536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  308.787318][ T9536] RSP: 002b:00007ffa0223a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  308.787341][ T9536] RAX: ffffffffffffffda RBX: 00007ffa01615fa0 RCX: 00007ffa0139aeb9
[  308.787355][ T9536] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004
[  308.787367][ T9536] RBP: 00007ffa0223a090 R08: 0000000000000490 R09: 0000000000000000
[  308.787379][ T9536] R10: 00002000000014c0 R11: 0000000000000246 R12: 0000000000000002
[  308.787392][ T9536] R13: 00007ffa01616038 R14: 00007ffa01615fa0 R15: 00007ffa0173fa48
[  308.787426][ T9536]  </TASK>
[  309.202195][ T9544] ip6gre1: entered allmulticast mode
[  309.468546][ T9556] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1075'.
[  309.881484][ T9567] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1078'.
[  310.115959][ T6858] usb 4-1: new high-speed USB device number 25 using dummy_hcd
[  310.161204][ T9571] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1080'.
[  310.236817][ T9574] kvm: requested 4190 ns i8254 timer period limited to 200000 ns
[  310.276046][   T30] audit: type=1326 audit(1769818014.733:197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9570 comm="syz.0.1080" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff0d6b9aeb9 code=0x0
[  310.526308][ T6858] usb 4-1: Using ep0 maxpacket: 32
[  310.544591][ T6858] usb 4-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7
[  310.557701][ T6858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  310.624841][ T6858] usb 4-1: config 0 descriptor??
[  310.655414][ T6858] gspca_main: sq930x-2.14.0 probing 041e:403c
[  311.457439][ T9565] vlan3: entered allmulticast mode
[  311.472714][ T9565] geneve1: entered allmulticast mode
[  311.669594][ T9591] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  311.687352][ T9591] fuse: Bad value for 'fd'
[  311.706926][ T6858] gspca_sq930x: ucbus_write failed -71
[  311.713954][ T6858] sq930x 4-1:0.0: probe with driver sq930x failed with error -71
[  311.764259][ T9595] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1086'.
[  311.776044][ T9595] netlink: 'syz.0.1086': attribute type 13 has an invalid length.
[  311.784824][ T9595] gretap0: refused to change device tx_queue_len
[  311.791334][ T9595] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[  311.820407][ T6858] usb 4-1: USB disconnect, device number 25
[  312.125504][ T9597] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  312.142237][ T9597] fuse: Bad value for 'fd'
[  312.655087][ T9601] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1088'.
[  312.674694][ T9602] xt_hashlimit: size too large, truncated to 1048576
[  313.724162][ T9623] vlan0: entered promiscuous mode
[  313.729364][ T9623] bridge0: entered promiscuous mode
[  313.813146][ T6858] usb 4-1: new high-speed USB device number 26 using dummy_hcd
[  313.887318][ T9629] loop2: detected capacity change from 0 to 7
[  313.895679][ T9629] Dev loop2: unable to read RDB block 7
[  313.901345][ T9629]  loop2: AHDI p1 p2 p3
[  313.909018][ T9629] loop2: partition table partially beyond EOD, truncated
[  313.924970][ T9629] loop2: p1 start 1818582900 is beyond EOD, truncated
[  313.946766][ T9629] loop2: p3 start 335544320 is beyond EOD, truncated
[  313.972870][ T6858] usb 4-1: Using ep0 maxpacket: 8
[  314.008253][ T6858] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  314.040272][ T6858] usb 4-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  314.070294][ T6858] usb 4-1: config 0 interface 0 has no altsetting 0
[  314.082392][ T6858] usb 4-1: New USB device found, idVendor=0458, idProduct=4018, bcdDevice= 0.00
[  314.141355][ T6858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  314.167725][ T6858] usb 4-1: config 0 descriptor??
[  314.410931][ T9618] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  314.421425][ T9618] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  314.647733][ T6858] kye 0003:0458:4018.000B: unknown main item tag 0x0
[  314.665812][ T6858] kye 0003:0458:4018.000B: reserved main item tag 0xe
[  314.685914][ T6858] kye 0003:0458:4018.000B: item fetching failed at offset 15/133
[  314.713709][ T6858] kye 0003:0458:4018.000B: parse failed
[  314.730029][ T6858] kye 0003:0458:4018.000B: probe with driver kye failed with error -22
[  314.850669][ T5909] usb 4-1: USB disconnect, device number 26
[  315.465036][ T9650] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  315.482564][ T9650] fuse: Bad value for 'fd'
[  315.603539][ T9653] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.1102'.
[  316.137128][ T5909] usb 4-1: new high-speed USB device number 27 using dummy_hcd
[  316.339132][ T5909] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  316.361595][ T5909] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[  316.395340][ T5909] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  316.418302][ T5909] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67
[  316.459956][ T5909] usb 4-1: SerialNumber: syz
[  316.539618][ T9678] loop2: detected capacity change from 0 to 7
[  316.559036][ T9678] Dev loop2: unable to read RDB block 7
[  316.574003][ T9678]  loop2: AHDI p1 p2 p3
[  316.584146][ T9678] loop2: partition table partially beyond EOD, truncated
[  316.597312][ T9678] loop2: p1 start 1818582900 is beyond EOD, truncated
[  316.608427][ T9678] loop2: p3 start 335544320 is beyond EOD, truncated
[  317.175897][ T9691] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1112'.
[  317.200617][ T9691] netlink: 'syz.2.1112': attribute type 13 has an invalid length.
[  317.211226][ T9691] gretap0: refused to change device tx_queue_len
[  317.218026][ T9691] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check.
[  317.284571][ T1298] ieee802154 phy0 wpan0: encryption failed: -22
[  317.297899][ T1298] ieee802154 phy1 wpan1: encryption failed: -22
[  318.584520][  T107] usb 5-1: new high-speed USB device number 18 using dummy_hcd
[  318.755682][ T5909] usb 4-1: 0:2 : does not exist
[  318.760675][ T5909] usb 4-1: unit 5: unexpected type 0x0d
[  318.788501][ T9715] loop2: detected capacity change from 0 to 7
[  318.796335][  T107] usb 5-1: config 0 contains an unexpected descriptor of type 0x2, skipping
[  318.817624][ T9715] Dev loop2: unable to read RDB block 7
[  318.820951][  T107] usb 5-1: config 0 has an invalid interface number: 2 but max is -1
[  318.837090][ T9715]  loop2: AHDI p1 p2 p3
[  318.863772][ T9715] loop2: partition table partially beyond EOD, truncated
[  318.866153][ T5909] usb 4-1: USB disconnect, device number 27
[  318.877266][  T107] usb 5-1: config 0 has an invalid interface number: 2 but max is -1
[  318.900127][ T9715] loop2: p1 start 1818582900 is beyond EOD, truncated
[  318.910829][  T107] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  318.938397][ T9715] loop2: p3 start 335544320 is beyond EOD, truncated
[  318.971612][  T107] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0
[  319.070605][ T9719] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  319.081614][ T9719] fuse: Bad value for 'fd'
[  319.192770][  T107] usb 5-1: config 0 has no interface number 0
[  319.244570][  T107] usb 5-1: config 0 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  319.284305][  T107] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  319.298292][  T107] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  319.314632][ T8211] udevd[8211]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  319.330735][  T107] usb 5-1: Product: syz
[  319.351037][  T107] usb 5-1: Manufacturer: syz
[  319.364231][  T107] usb 5-1: SerialNumber: syz
[  319.382267][  T107] usb 5-1: config 0 descriptor??
[  319.958875][  T107] usb 5-1: No MIDI 2.0 at altset 1, falling back to MIDI 1.0
[  319.985028][  T107] usb 5-1: MIDIStreaming interface descriptor not found
[  320.016784][ T9730] netlink: 27 bytes leftover after parsing attributes in process `syz.2.1126'.
[  320.086645][  T107] usb 5-1: USB disconnect, device number 18
[  320.230022][ T9734] x_tables: ip_tables: osf match: only valid for protocol 6
[  320.240923][ T9734] FAULT_INJECTION: forcing a failure.
[  320.240923][ T9734] name failslab, interval 1, probability 0, space 0, times 0
[  320.253932][ T6858] usb 1-1: new high-speed USB device number 25 using dummy_hcd
[  320.263751][ T9734] CPU: 1 UID: 0 PID: 9734 Comm: syz.2.1128 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  320.263781][ T9734] Tainted: [L]=SOFTLOCKUP
[  320.263788][ T9734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  320.263799][ T9734] Call Trace:
[  320.263808][ T9734]  <TASK>
[  320.263817][ T9734]  dump_stack_lvl+0xe8/0x150
[  320.263848][ T9734]  should_fail_ex+0x412/0x560
[  320.263879][ T9734]  should_failslab+0xa8/0x100
[  320.263903][ T9734]  __kvmalloc_node_noprof+0x166/0x8d0
[  320.263926][ T9734]  ? __nf_hook_entries_try_shrink+0x328/0x700
[  320.263957][ T9734]  __nf_hook_entries_try_shrink+0x328/0x700
[  320.263993][ T9734]  __nf_unregister_net_hook+0x4cc/0x6f0
[  320.264025][ T9734]  nf_unregister_net_hooks+0xcb/0x140
[  320.264051][ T9734]  nf_ct_netns_put+0x3b9/0x520
[  320.264075][ T9734]  ? __pfx_redirect_tg_destroy+0x10/0x10
[  320.264103][ T9734]  cleanup_entry+0x28c/0x350
[  320.264125][ T9734]  ? __pfx_cleanup_entry+0x10/0x10
[  320.264152][ T9734]  ? xt_find_match+0x1f7/0x250
[  320.264184][ T9734]  translate_table+0x1f09/0x2110
[  320.264227][ T9734]  ? __pfx_translate_table+0x10/0x10
[  320.264249][ T9734]  ? __might_fault+0xaf/0x130
[  320.264298][ T9734]  ? _copy_from_user+0x94/0xb0
[  320.264332][ T9734]  do_ipt_set_ctl+0x9f5/0xe00
[  320.264355][ T9734]  ? rcu_is_watching+0x15/0xb0
[  320.264376][ T9734]  ? trace_contention_end+0x39/0x100
[  320.264397][ T9734]  ? __pfx_do_ipt_set_ctl+0x10/0x10
[  320.264437][ T9734]  ? __pfx___mutex_lock+0x10/0x10
[  320.264460][ T9734]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  320.264488][ T9734]  ? __pfx_aa_sk_perm+0x10/0x10
[  320.264528][ T9734]  nf_setsockopt+0x26f/0x290
[  320.264553][ T9734]  ? __pfx_sock_common_setsockopt+0x10/0x10
[  320.264577][ T9734]  do_sock_setsockopt+0x17c/0x1b0
[  320.264606][ T9734]  __x64_sys_setsockopt+0x13d/0x1b0
[  320.264637][ T9734]  do_syscall_64+0xe2/0xf80
[  320.264656][ T9734]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  320.264680][ T9734]  ? trace_irq_disable+0x37/0x100
[  320.264697][ T9734]  ? clear_bhb_loop+0x60/0xb0
[  320.264720][ T9734]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  320.264739][ T9734] RIP: 0033:0x7ffa0139aeb9
[  320.264757][ T9734] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  320.264773][ T9734] RSP: 002b:00007ffa0223a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  320.264795][ T9734] RAX: ffffffffffffffda RBX: 00007ffa01615fa0 RCX: 00007ffa0139aeb9
[  320.264809][ T9734] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000004
[  320.264821][ T9734] RBP: 00007ffa0223a090 R08: 0000000000000490 R09: 0000000000000000
[  320.264833][ T9734] R10: 00002000000014c0 R11: 0000000000000246 R12: 0000000000000002
[  320.264844][ T9734] R13: 00007ffa01616038 R14: 00007ffa01615fa0 R15: 00007ffa0173fa48
[  320.264877][ T9734]  </TASK>
[  320.656468][ T6858] usb 1-1: Using ep0 maxpacket: 16
[  320.665142][ T6858] usb 1-1: config 8 has an invalid interface number: 159 but max is 0
[  320.673599][ T6858] usb 1-1: config 8 has no interface number 0
[  320.679912][ T6858] usb 1-1: config 8 interface 159 has no altsetting 0
[  320.691633][ T6858] usb 1-1: New USB device found, idVendor=0c45, idProduct=612a, bcdDevice=29.9c
[  320.718371][ T6858] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  320.726507][ T6858] usb 1-1: Product: syz
[  320.730679][ T6858] usb 1-1: Manufacturer: syz
[  320.735804][ T6858] usb 1-1: SerialNumber: syz
[  320.959633][ T6858] gspca_main: sonixj-2.14.0 probing 0c45:612a
[  320.971350][ T6858] gspca_sonixj: reg_w1 err -71
[  320.979065][ T6858] sonixj 1-1:8.159: probe with driver sonixj failed with error -71
[  320.995042][ T6858] usb 1-1: USB disconnect, device number 25
[  321.190599][ T9752] FAULT_INJECTION: forcing a failure.
[  321.190599][ T9752] name failslab, interval 1, probability 0, space 0, times 0
[  321.207481][ T9752] CPU: 0 UID: 0 PID: 9752 Comm: syz.1.1136 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  321.207515][ T9752] Tainted: [L]=SOFTLOCKUP
[  321.207521][ T9752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  321.207533][ T9752] Call Trace:
[  321.207540][ T9752]  <TASK>
[  321.207547][ T9752]  dump_stack_lvl+0xe8/0x150
[  321.207577][ T9752]  should_fail_ex+0x412/0x560
[  321.207607][ T9752]  should_failslab+0xa8/0x100
[  321.207631][ T9752]  kmem_cache_alloc_noprof+0x87/0x6e0
[  321.207661][ T9752]  ? skb_clone+0x212/0x3a0
[  321.207693][ T9752]  skb_clone+0x212/0x3a0
[  321.207730][ T9752]  __netlink_deliver_tap+0x404/0x850
[  321.207762][ T9752]  ? netlink_deliver_tap+0x2e/0x1b0
[  321.207780][ T9752]  netlink_deliver_tap+0x19c/0x1b0
[  321.207796][ T9752]  netlink_sendskb+0x68/0x140
[  321.207819][ T9752]  netlink_unicast+0x3a3/0x9b0
[  321.207848][ T9752]  ? __pfx_netlink_unicast+0x10/0x10
[  321.207877][ T9752]  netlink_rcv_skb+0x2b6/0x4b0
[  321.207892][ T9752]  ? __pfx_nfnetlink_rcv_msg+0x10/0x10
[  321.207916][ T9752]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  321.207940][ T9752]  ? bpf_lsm_capable+0x9/0x20
[  321.207958][ T9752]  ? security_capable+0x7e/0x2c0
[  321.207981][ T9752]  nfnetlink_rcv+0x2c0/0x27b0
[  321.208008][ T9752]  ? __local_bh_enable_ip+0xd0/0x130
[  321.208022][ T9752]  ? lockdep_hardirqs_on+0x7a/0x110
[  321.208037][ T9752]  ? __dev_queue_xmit+0x274/0x3850
[  321.208056][ T9752]  ? __local_bh_enable_ip+0xd0/0x130
[  321.208067][ T9752]  ? __dev_queue_xmit+0x274/0x3850
[  321.208087][ T9752]  ? __dev_queue_xmit+0x1e6c/0x3850
[  321.208105][ T9752]  ? __x64_sys_sendmsg+0x1bd/0x2a0
[  321.208132][ T9752]  ? __dev_queue_xmit+0x274/0x3850
[  321.208153][ T9752]  ? __pfx_nfnetlink_rcv+0x10/0x10
[  321.208179][ T9752]  ? __pfx___dev_queue_xmit+0x10/0x10
[  321.208205][ T9752]  ? ref_tracker_free+0x693/0x840
[  321.208222][ T9752]  ? __copy_skb_header+0xa3/0x4a0
[  321.208242][ T9752]  ? __pfx_ref_tracker_free+0x10/0x10
[  321.208258][ T9752]  ? __skb_clone+0x63/0x7a0
[  321.208280][ T9752]  ? __skb_clone+0x483/0x7a0
[  321.208305][ T9752]  ? skb_clone+0x246/0x3a0
[  321.208327][ T9752]  ? __netlink_deliver_tap+0x807/0x850
[  321.208342][ T9752]  ? netlink_deliver_tap+0x2e/0x1b0
[  321.208361][ T9752]  ? netlink_deliver_tap+0x2e/0x1b0
[  321.208383][ T9752]  netlink_unicast+0x80f/0x9b0
[  321.208411][ T9752]  ? __pfx_netlink_unicast+0x10/0x10
[  321.208434][ T9752]  ? __alloc_skb+0x193/0x390
[  321.208560][ T9752]  ? netlink_sendmsg+0x650/0xb40
[  321.208574][ T9752]  ? skb_put+0x11b/0x210
[  321.208594][ T9752]  netlink_sendmsg+0x813/0xb40
[  321.208616][ T9752]  ? __pfx_netlink_sendmsg+0x10/0x10
[  321.208635][ T9752]  ? aa_sock_msg_perm+0xf1/0x1b0
[  321.208654][ T9752]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  321.208671][ T9752]  ? __pfx_netlink_sendmsg+0x10/0x10
[  321.208685][ T9752]  ____sys_sendmsg+0xa68/0xad0
[  321.208705][ T9752]  ? __might_fault+0xaf/0x130
[  321.208731][ T9752]  ? __pfx_____sys_sendmsg+0x10/0x10
[  321.208757][ T9752]  ? import_iovec+0x73/0xa0
[  321.208781][ T9752]  ___sys_sendmsg+0x2a5/0x360
[  321.208799][ T9752]  ? __lock_acquire+0x6b5/0x2cf0
[  321.208824][ T9752]  ? __pfx____sys_sendmsg+0x10/0x10
[  321.208876][ T9752]  ? __fget_files+0x2a/0x420
[  321.208892][ T9752]  ? __fget_files+0x3a0/0x420
[  321.208915][ T9752]  __x64_sys_sendmsg+0x1bd/0x2a0
[  321.208936][ T9752]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  321.208963][ T9752]  ? __pfx_ksys_write+0x10/0x10
[  321.208993][ T9752]  do_syscall_64+0xe2/0xf80
[  321.209012][ T9752]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  321.209027][ T9752]  ? trace_irq_disable+0x37/0x100
[  321.209040][ T9752]  ? clear_bhb_loop+0x60/0xb0
[  321.209058][ T9752]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  321.209072][ T9752] RIP: 0033:0x7f8a6ed9aeb9
[  321.209087][ T9752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  321.209100][ T9752] RSP: 002b:00007f8a6fbc7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  321.209118][ T9752] RAX: ffffffffffffffda RBX: 00007f8a6f015fa0 RCX: 00007f8a6ed9aeb9
[  321.209128][ T9752] RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000003
[  321.209138][ T9752] RBP: 00007f8a6fbc7090 R08: 0000000000000000 R09: 0000000000000000
[  321.209146][ T9752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  321.209155][ T9752] R13: 00007f8a6f016038 R14: 00007f8a6f015fa0 R15: 00007f8a6f13fa48
[  321.209180][ T9752]  </TASK>
[  321.322763][ T6858] usb 5-1: new low-speed USB device number 19 using dummy_hcd
[  321.962784][ T6858] usb 5-1: device descriptor read/64, error -71
[  322.092749][ T9773] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1141'.
[  322.176629][ T9776] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1144'.
[  322.187566][ T9773] kvm: requested 4190 ns i8254 timer period limited to 200000 ns
[  322.195716][ T9776] netem: invalid attributes len -7
[  322.205777][ T6858] usb 5-1: new low-speed USB device number 20 using dummy_hcd
[  322.215069][ T9776] netem: change failed
[  322.350418][ T6858] usb 5-1: device descriptor read/64, error -71
[  322.356953][   T30] audit: type=1326 audit(1769818026.763:198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9764 comm="syz.0.1141" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff0d6b9aeb9 code=0x0
[  322.494627][ T6858] usb usb5-port1: attempt power cycle
[  322.982913][ T6858] usb 5-1: new low-speed USB device number 21 using dummy_hcd
[  323.029163][ T6858] usb 5-1: device descriptor read/8, error -71
[  323.188484][ T9791] loop5: detected capacity change from 0 to 7
[  323.395355][ T8211] Dev loop5: unable to read RDB block 7
[  323.402763][ T6858] usb 5-1: new low-speed USB device number 22 using dummy_hcd
[  323.422978][ T8211]  loop5: AHDI p4
[  323.433803][ T8211] loop5: partition table partially beyond EOD, truncated
[  323.449319][ T6858] usb 5-1: device descriptor read/8, error -71
[  323.527227][ T9791] Dev loop5: unable to read RDB block 7
[  323.533599][ T9791]  loop5: AHDI p4
[  323.543039][ T9791] loop5: partition table partially beyond EOD, truncated
[  323.573273][ T6858] usb usb5-port1: unable to enumerate USB device
[  324.114857][ T9802] netlink: 52 bytes leftover after parsing attributes in process `syz.0.1150'.
[  324.594717][  T107] usb 5-1: new low-speed USB device number 23 using dummy_hcd
[  325.531104][ T9826] FAULT_INJECTION: forcing a failure.
[  325.531104][ T9826] name failslab, interval 1, probability 0, space 0, times 0
[  325.544488][ T9826] CPU: 0 UID: 0 PID: 9826 Comm: syz.0.1158 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  325.544516][ T9826] Tainted: [L]=SOFTLOCKUP
[  325.544522][ T9826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  325.544531][ T9826] Call Trace:
[  325.544539][ T9826]  <TASK>
[  325.544547][ T9826]  dump_stack_lvl+0xe8/0x150
[  325.544578][ T9826]  should_fail_ex+0x412/0x560
[  325.544607][ T9826]  should_failslab+0xa8/0x100
[  325.544631][ T9826]  __kmalloc_cache_noprof+0x83/0x6e0
[  325.544650][ T9826]  ? lockdep_hardirqs_on+0x7a/0x110
[  325.544671][ T9826]  ? __request_module+0x2d0/0x610
[  325.544695][ T9826]  __request_module+0x2d0/0x610
[  325.544726][ T9826]  ? rtnl_link_ops_get+0x23/0x250
[  325.544752][ T9826]  ? __pfx___request_module+0x10/0x10
[  325.544782][ T9826]  ? rtnl_link_ops_get+0x23/0x250
[  325.544804][ T9826]  ? rtnl_link_ops_get+0x23/0x250
[  325.544828][ T9826]  ? rtnl_link_ops_get+0x215/0x250
[  325.544855][ T9826]  rtnl_newlink+0x620/0x1be0
[  325.544878][ T9826]  ? unwind_next_frame+0xa5/0x23c0
[  325.544908][ T9826]  ? __pfx_rtnl_newlink+0x10/0x10
[  325.544933][ T9826]  ? __lock_acquire+0x6b5/0x2cf0
[  325.544965][ T9826]  ? __lock_acquire+0x6b5/0x2cf0
[  325.545000][ T9826]  ? __lock_acquire+0x6b5/0x2cf0
[  325.545037][ T9826]  ? unwind_next_frame+0xa5/0x23c0
[  325.545064][ T9826]  ? unwind_next_frame+0xa5/0x23c0
[  325.545088][ T9826]  ? is_bpf_text_address+0x26/0x2b0
[  325.545130][ T9826]  ? __lock_acquire+0x6b5/0x2cf0
[  325.545158][ T9826]  ? is_bpf_text_address+0x292/0x2b0
[  325.545179][ T9826]  ? is_bpf_text_address+0x26/0x2b0
[  325.545204][ T9826]  ? kernel_text_address+0xa5/0xe0
[  325.545230][ T9826]  ? __kernel_text_address+0xd/0x30
[  325.545253][ T9826]  ? unwind_get_return_address+0x4d/0x90
[  325.545282][ T9826]  ? rtnetlink_rcv_msg+0x1b9/0xbe0
[  325.545320][ T9826]  ? __pfx_rtnl_newlink+0x10/0x10
[  325.545341][ T9826]  rtnetlink_rcv_msg+0x7d5/0xbe0
[  325.545367][ T9826]  ? rtnetlink_rcv_msg+0x1b9/0xbe0
[  325.545389][ T9826]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  325.545428][ T9826]  ? __lock_acquire+0x6b5/0x2cf0
[  325.545467][ T9826]  netlink_rcv_skb+0x232/0x4b0
[  325.545489][ T9826]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  325.545513][ T9826]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  325.545545][ T9826]  ? netlink_deliver_tap+0x2e/0x1b0
[  325.545573][ T9826]  netlink_unicast+0x80f/0x9b0
[  325.545611][ T9826]  ? __pfx_netlink_unicast+0x10/0x10
[  325.545638][ T9826]  ? __alloc_skb+0x193/0x390
[  325.545662][ T9826]  ? netlink_sendmsg+0x650/0xb40
[  325.545680][ T9826]  ? skb_put+0x11b/0x210
[  325.545707][ T9826]  netlink_sendmsg+0x813/0xb40
[  325.545746][ T9826]  ? __pfx_netlink_sendmsg+0x10/0x10
[  325.545770][ T9826]  ? aa_sock_msg_perm+0xf1/0x1b0
[  325.545796][ T9826]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  325.545818][ T9826]  ? __pfx_netlink_sendmsg+0x10/0x10
[  325.545838][ T9826]  ____sys_sendmsg+0xa68/0xad0
[  325.545862][ T9826]  ? __might_fault+0xaf/0x130
[  325.545896][ T9826]  ? __pfx_____sys_sendmsg+0x10/0x10
[  325.545932][ T9826]  ? import_iovec+0x73/0xa0
[  325.545963][ T9826]  ___sys_sendmsg+0x2a5/0x360
[  325.545986][ T9826]  ? __lock_acquire+0x6b5/0x2cf0
[  325.546016][ T9826]  ? __pfx____sys_sendmsg+0x10/0x10
[  325.546078][ T9826]  ? __fget_files+0x2a/0x420
[  325.546098][ T9826]  ? __fget_files+0x3a0/0x420
[  325.546130][ T9826]  __x64_sys_sendmsg+0x1bd/0x2a0
[  325.546159][ T9826]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  325.546195][ T9826]  ? __pfx_ksys_write+0x10/0x10
[  325.546234][ T9826]  do_syscall_64+0xe2/0xf80
[  325.546255][ T9826]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  325.546273][ T9826]  ? trace_irq_disable+0x37/0x100
[  325.546292][ T9826]  ? clear_bhb_loop+0x60/0xb0
[  325.546315][ T9826]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  325.546334][ T9826] RIP: 0033:0x7ff0d6b9aeb9
[  325.546353][ T9826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  325.546369][ T9826] RSP: 002b:00007ff0d7b2c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  325.546393][ T9826] RAX: ffffffffffffffda RBX: 00007ff0d6e15fa0 RCX: 00007ff0d6b9aeb9
[  325.546407][ T9826] RDX: 0000000000004040 RSI: 0000200000000180 RDI: 0000000000000003
[  325.546420][ T9826] RBP: 00007ff0d7b2c090 R08: 0000000000000000 R09: 0000000000000000
[  325.546432][ T9826] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  325.546444][ T9826] R13: 00007ff0d6e16038 R14: 00007ff0d6e15fa0 R15: 00007ff0d6f3fa48
[  325.546474][ T9826]  </TASK>
[  326.082752][    T9] usb 4-1: new high-speed USB device number 28 using dummy_hcd
[  326.296369][    T9] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  326.309205][    T9] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config
[  326.322739][    T9] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66
[  326.333014][    T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9
[  326.344528][    T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024
[  326.368040][    T9] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  326.377151][    T9] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  326.385318][    T9] usb 4-1: Product: syz
[  326.389511][    T9] usb 4-1: Manufacturer: syz
[  326.400067][    T9] cdc_wdm 4-1:1.0: skipping garbage
[  326.406254][    T9] cdc_wdm 4-1:1.0: skipping garbage
[  326.412987][    T9] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device
[  326.419170][    T9] cdc_wdm 4-1:1.0: Unknown control protocol
[  326.498453][ T9836] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1160'.
[  326.588473][ T9836] kvm: requested 4190 ns i8254 timer period limited to 200000 ns
[  326.649385][ T9844] tipc: Started in network mode
[  326.655773][ T9844] tipc: Node identity 02c9c7847c69, cluster identity 4711
[  326.665615][ T9844] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  326.802809][   T30] audit: type=1326 audit(1769818031.203:199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9831 comm="syz.1.1160" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8a6ed9aeb9 code=0x0
[  326.948667][  T107] usb 4-1: USB disconnect, device number 28
[  327.003984][ T9848] syzkaller0: entered promiscuous mode
[  327.010280][ T9848] syzkaller0: entered allmulticast mode
[  327.057342][ T9844] tipc: Resetting bearer <eth:syzkaller0>
[  327.254960][ T9854] geneve2: entered promiscuous mode
[  327.294349][ T9854] geneve2: entered allmulticast mode
[  327.382812][ T6858] usb 5-1: new full-speed USB device number 24 using dummy_hcd
[  327.453028][ T9839] tipc: Resetting bearer <eth:syzkaller0>
[  327.477378][ T9839] tipc: Disabling bearer <eth:syzkaller0>
[  327.578554][ T6858] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea
[  327.588012][ T6858] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  327.597127][ T6858] usb 5-1: Product: syz
[  327.601627][ T6858] usb 5-1: Manufacturer: syz
[  327.619856][ T6858] usb 5-1: SerialNumber: syz
[  327.640529][ T6858] usb 5-1: config 0 descriptor??
[  327.668565][ T9860] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1168'.
[  327.698694][ T9860] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1168'.
[  327.708607][ T9860] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1168'.
[  327.857327][ T6858] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state
[  328.572203][ T9881] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1173'.
[  328.807482][ T9887] xt_TPROXY: Can be used only with -p tcp or -p udp
[  329.015107][ T9892] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1176'.
[  329.103172][ T9892] kvm: requested 4190 ns i8254 timer period limited to 200000 ns
[  329.230919][   T30] audit: type=1326 audit(1769818033.693:200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9888 comm="syz.1.1176" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8a6ed9aeb9 code=0x0
[  329.718790][   T30] audit: type=1326 audit(1769818034.183:201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  329.747119][ T6858] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32
[  329.791909][ T6858] usb 5-1: USB disconnect, device number 24
[  329.798147][   T30] audit: type=1326 audit(1769818034.183:202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  329.851286][   T30] audit: type=1326 audit(1769818034.183:203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=79 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  329.986052][   T30] audit: type=1326 audit(1769818034.183:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  330.024881][ T9903] x_tables: ip_tables: osf match: only valid for protocol 6
[  330.057497][   T30] audit: type=1326 audit(1769818034.183:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  330.163945][    T9] usb 1-1: new high-speed USB device number 26 using dummy_hcd
[  330.175408][   T30] audit: type=1326 audit(1769818034.193:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  330.206455][   T30] audit: type=1326 audit(1769818034.193:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  330.231501][   T30] audit: type=1326 audit(1769818034.233:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  330.254231][   T30] audit: type=1326 audit(1769818034.233:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9899 comm="syz.2.1178" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ffa0139aeb9 code=0x7ffc0000
[  330.302802][    T9] usb 1-1: device descriptor read/64, error -71
[  330.459462][ T9911] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1182'.
[  330.470810][ T9908] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1181'.
[  330.579125][    T9] usb 1-1: new high-speed USB device number 27 using dummy_hcd
[  330.720284][    T9] usb 1-1: device descriptor read/64, error -71
[  330.835432][    T9] usb usb1-port1: attempt power cycle
[  331.153447][ T9934] Failed to get privilege flags for destination (handle=0x2:0x8)
[  331.242814][    T9] usb 1-1: new high-speed USB device number 28 using dummy_hcd
[  331.284041][    T9] usb 1-1: device descriptor read/8, error -71
[  331.532842][    T9] usb 1-1: new high-speed USB device number 29 using dummy_hcd
[  331.579648][    T9] usb 1-1: device descriptor read/8, error -71
[  331.592783][ T6858] usb 3-1: new high-speed USB device number 26 using dummy_hcd
[  331.693999][    T9] usb usb1-port1: unable to enumerate USB device
[  331.753316][ T6858] usb 3-1: Using ep0 maxpacket: 16
[  331.777119][ T6858] usb 3-1: config 166 has an invalid interface number: 177 but max is 1
[  331.805484][ T6858] usb 3-1: config 166 has an invalid interface number: 34 but max is 1
[  331.827003][ T6858] usb 3-1: config 166 has no interface number 0
[  331.843567][ T6858] usb 3-1: config 166 has no interface number 1
[  331.856974][ T6858] usb 3-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping
[  331.891266][ T6858] usb 3-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping
[  331.928857][ T6858] usb 3-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping
[  331.960973][ T6858] usb 3-1: config 166 interface 34 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86
[  332.020376][ T6858] usb 3-1: config 166 interface 34 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024
[  332.053548][ T6858] usb 3-1: config 166 interface 34 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024
[  332.076902][ T6858] usb 3-1: config 166 interface 34 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7
[  332.112969][ T6858] usb 3-1: config 166 interface 34 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0
[  332.123207][ T6858] usb 3-1: config 166 interface 34 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4
[  332.136673][ T6858] usb 3-1: config 166 interface 177 has no altsetting 0
[  332.143756][ T6858] usb 3-1: config 166 interface 34 has no altsetting 0
[  332.159775][ T6858] usb 3-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12
[  332.178867][ T6858] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  332.193793][ T6858] usb 3-1: Product: syz
[  332.219654][ T6858] usb 3-1: Manufacturer: syz
[  332.247005][ T6858] usb 3-1: SerialNumber: syz
[  332.669067][ T6858] ums-realtek 3-1:166.177: USB Mass Storage device detected
[  332.807374][ T6858] ums-realtek 3-1:166.34: USB Mass Storage device detected
[  332.913127][ T9961] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1196'.
[  332.990007][ T6858] ums-realtek 3-1:166.34: probe with driver ums-realtek failed with error -5
[  333.006221][ T6858] uvcvideo 3-1:166.34: Found UVC 0.00 device syz (0bda:0138)
[  333.025850][ T6858] uvcvideo 3-1:166.34: No valid video chain found.
[  333.078186][ T6858] usb 3-1: USB disconnect, device number 26
[  333.122481][ T5836] udevd[5836]: setting owner of /dev/bus/usb/003/026 to uid=0, gid=0 failed: No such file or directory
[  333.552841][ T5910] usb 5-1: new high-speed USB device number 25 using dummy_hcd
[  333.640522][ T9979] IPVS: Error connecting to the multicast addr
[  333.753053][ T5910] usb 5-1: Using ep0 maxpacket: 32
[  333.782900][ T5910] usb 5-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50
[  333.807139][ T5910] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  333.825123][ T5910] usb 5-1: Product: syz
[  333.847189][ T5910] usb 5-1: Manufacturer: syz
[  333.859778][ T5910] usb 5-1: SerialNumber: syz
[  333.876184][ T5910] usb 5-1: config 0 descriptor??
[  333.887227][ T5910] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state.
[  333.895523][ T5910] dvb-usb: bulk message failed: -22 (2/0)
[  333.905894][ T5910] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  333.938729][ T5910] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold)
[  333.947507][ T5910] usb 5-1: media controller created
[  333.996209][ T5910] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  334.054560][ T5910] usb 5-1: selecting invalid altsetting 7
[  334.070461][ T5910] cxusb: set interface failed
[  334.078860][ T5910] dvb-usb: bulk message failed: -22 (1/0)
[  334.178301][ T5910] DVB: Unable to find symbol lgdt330x_attach()
[  334.196139][ T5910] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold'
[  334.351716][ T9998] dlm: plock device version mismatch: kernel (1.2.0), user (0.0.0)
[  334.375091][ T5910] rc_core: IR keymap rc-dvico-portable not found
[  334.383622][ T5910] Registered IR keymap rc-empty
[  334.399254][ T5910] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0
[  334.426492][ T5910] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input28
[  334.544947][ T5910] dvb-usb: schedule remote query interval to 100 msecs.
[  334.552056][ T5910] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected.
[  334.567770][ T5910] usb 5-1: USB disconnect, device number 25
[  334.718869][ T5910] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected.
[  334.959657][T10013] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1212'.
[  335.023438][T10016] fuse: Unknown parameter 'grou'
[  335.137891][T10022] FAULT_INJECTION: forcing a failure.
[  335.137891][T10022] name failslab, interval 1, probability 0, space 0, times 0
[  335.195565][T10016] fuse: Unknown parameter 'Ld'
[  335.202841][T10022] CPU: 1 UID: 0 PID: 10022 Comm: syz.1.1214 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  335.202871][T10022] Tainted: [L]=SOFTLOCKUP
[  335.202877][T10022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  335.202889][T10022] Call Trace:
[  335.202897][T10022]  <TASK>
[  335.202905][T10022]  dump_stack_lvl+0xe8/0x150
[  335.202938][T10022]  should_fail_ex+0x412/0x560
[  335.202968][T10022]  should_failslab+0xa8/0x100
[  335.202992][T10022]  __kmalloc_cache_noprof+0x83/0x6e0
[  335.203012][T10022]  ? lockdep_hardirqs_on+0x7a/0x110
[  335.203034][T10022]  ? __request_module+0x2d0/0x610
[  335.203057][T10022]  __request_module+0x2d0/0x610
[  335.203080][T10022]  ? rtnl_link_ops_get+0x23/0x250
[  335.203106][T10022]  ? __pfx___request_module+0x10/0x10
[  335.203136][T10022]  ? rtnl_link_ops_get+0x23/0x250
[  335.203156][T10022]  ? rtnl_link_ops_get+0x23/0x250
[  335.203183][T10022]  ? rtnl_link_ops_get+0x215/0x250
[  335.203211][T10022]  rtnl_newlink+0x620/0x1be0
[  335.203234][T10022]  ? kasan_save_track+0x4f/0x80
[  335.203251][T10022]  ? kasan_save_track+0x3e/0x80
[  335.203268][T10022]  ? kasan_save_free_info+0x46/0x50
[  335.203290][T10022]  ? __kasan_slab_free+0x5c/0x80
[  335.203312][T10022]  ? __netlink_deliver_tap+0x5ad/0x850
[  335.203332][T10022]  ? netlink_deliver_tap+0x19c/0x1b0
[  335.203350][T10022]  ? netlink_unicast+0x7e3/0x9b0
[  335.203374][T10022]  ? netlink_sendmsg+0x813/0xb40
[  335.203393][T10022]  ? __pfx_rtnl_newlink+0x10/0x10
[  335.203415][T10022]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  335.203467][T10022]  ? kasan_quarantine_put+0xbb/0x1f0
[  335.203495][T10022]  ? lockdep_hardirqs_on+0x7a/0x110
[  335.203521][T10022]  ? kmem_cache_free+0x195/0x610
[  335.203540][T10022]  ? nlmon_xmit+0xb0/0x100
[  335.203569][T10022]  ? __lock_acquire+0x6b5/0x2cf0
[  335.203615][T10022]  ? __local_bh_enable_ip+0xd0/0x130
[  335.203634][T10022]  ? lockdep_hardirqs_on+0x7a/0x110
[  335.203655][T10022]  ? __dev_queue_xmit+0x274/0x3850
[  335.203680][T10022]  ? __local_bh_enable_ip+0xd0/0x130
[  335.203695][T10022]  ? __dev_queue_xmit+0x274/0x3850
[  335.203728][T10022]  ? rtnetlink_rcv_msg+0x1b9/0xbe0
[  335.203764][T10022]  ? __pfx_rtnl_newlink+0x10/0x10
[  335.203788][T10022]  rtnetlink_rcv_msg+0x7d5/0xbe0
[  335.203813][T10022]  ? rtnetlink_rcv_msg+0x1b9/0xbe0
[  335.203834][T10022]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  335.203855][T10022]  ? ref_tracker_free+0x693/0x840
[  335.203876][T10022]  ? __copy_skb_header+0xa3/0x4a0
[  335.203903][T10022]  ? __pfx_ref_tracker_free+0x10/0x10
[  335.203926][T10022]  ? __skb_clone+0x63/0x7a0
[  335.203958][T10022]  netlink_rcv_skb+0x232/0x4b0
[  335.203977][T10022]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[  335.203998][T10022]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  335.204028][T10022]  ? netlink_deliver_tap+0x2e/0x1b0
[  335.204054][T10022]  netlink_unicast+0x80f/0x9b0
[  335.204089][T10022]  ? __pfx_netlink_unicast+0x10/0x10
[  335.204116][T10022]  ? __alloc_skb+0x193/0x390
[  335.204137][T10022]  ? netlink_sendmsg+0x650/0xb40
[  335.204155][T10022]  ? skb_put+0x11b/0x210
[  335.204180][T10022]  netlink_sendmsg+0x813/0xb40
[  335.204210][T10022]  ? __pfx_netlink_sendmsg+0x10/0x10
[  335.204233][T10022]  ? aa_sock_msg_perm+0xf1/0x1b0
[  335.204259][T10022]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  335.204281][T10022]  ? __pfx_netlink_sendmsg+0x10/0x10
[  335.204300][T10022]  ____sys_sendmsg+0xa68/0xad0
[  335.204325][T10022]  ? __might_fault+0xaf/0x130
[  335.204356][T10022]  ? __pfx_____sys_sendmsg+0x10/0x10
[  335.204391][T10022]  ? import_iovec+0x73/0xa0
[  335.204423][T10022]  ___sys_sendmsg+0x2a5/0x360
[  335.204447][T10022]  ? __lock_acquire+0x6b5/0x2cf0
[  335.204477][T10022]  ? __pfx____sys_sendmsg+0x10/0x10
[  335.204540][T10022]  ? __fget_files+0x2a/0x420
[  335.204559][T10022]  ? __fget_files+0x3a0/0x420
[  335.204590][T10022]  __x64_sys_sendmsg+0x1bd/0x2a0
[  335.204628][T10022]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  335.204663][T10022]  ? __pfx_ksys_write+0x10/0x10
[  335.204702][T10022]  do_syscall_64+0xe2/0xf80
[  335.204722][T10022]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  335.204739][T10022]  ? trace_irq_disable+0x37/0x100
[  335.204757][T10022]  ? clear_bhb_loop+0x60/0xb0
[  335.204780][T10022]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  335.204799][T10022] RIP: 0033:0x7f8a6ed9aeb9
[  335.204816][T10022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  335.204832][T10022] RSP: 002b:00007f8a6fbc7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  335.204853][T10022] RAX: ffffffffffffffda RBX: 00007f8a6f015fa0 RCX: 00007f8a6ed9aeb9
[  335.204867][T10022] RDX: 0000000000004040 RSI: 0000200000000180 RDI: 0000000000000003
[  335.204880][T10022] RBP: 00007f8a6fbc7090 R08: 0000000000000000 R09: 0000000000000000
[  335.204892][T10022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  335.204903][T10022] R13: 00007f8a6f016038 R14: 00007f8a6f015fa0 R15: 00007f8a6f13fa48
[  335.204934][T10022]  </TASK>
[  335.705099][T10025] MPI: mpi too large (112776 bits)
[  336.612406][T10045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  336.633174][T10045] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  336.821131][T10052] netlink: 'syz.4.1224': attribute type 11 has an invalid length.
[  336.852800][    T9] usb 3-1: new high-speed USB device number 27 using dummy_hcd
[  336.942830][  T107] usb 1-1: new high-speed USB device number 30 using dummy_hcd
[  337.013024][    T9] usb 3-1: Using ep0 maxpacket: 8
[  337.020690][    T9] usb 3-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  337.032405][    T9] usb 3-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4
[  337.045934][    T9] usb 3-1: config 0 interface 0 has no altsetting 0
[  337.052696][    T9] usb 3-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00
[  337.061991][    T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  337.072880][  T107] usb 1-1: device descriptor read/64, error -71
[  337.080213][    T9] usb 3-1: config 0 descriptor??
[  337.118194][    T9] usbhid 3-1:0.0: fixing wrong optional hid class descriptors count
[  337.266766][T10055] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1225'.
[  337.308972][    T9] usbhid 3-1:0.0: can't add hid device: -71
[  337.319792][    T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  337.338204][    T9] usb 3-1: USB disconnect, device number 27
[  337.350576][  T107] usb 1-1: new high-speed USB device number 31 using dummy_hcd
[  337.402454][T10057] xt_CT: You must specify a L4 protocol and not use inversions on it
[  337.502901][  T107] usb 1-1: device descriptor read/64, error -71
[  337.613203][  T107] usb usb1-port1: attempt power cycle
[  337.718876][T10065] geneve2: entered promiscuous mode
[  337.724435][T10065] geneve2: entered allmulticast mode
[  337.783106][ T5910] usb 4-1: new high-speed USB device number 29 using dummy_hcd
[  337.814027][T10067] netlink: 27 bytes leftover after parsing attributes in process `syz.4.1230'.
[  337.972979][  T107] usb 1-1: new high-speed USB device number 32 using dummy_hcd
[  337.975078][ T5910] usb 4-1: Using ep0 maxpacket: 8
[  338.018096][ T5910] usb 4-1: config 218 has too many interfaces: 244, using maximum allowed: 32
[  338.035519][  T107] usb 1-1: device descriptor read/8, error -71
[  338.036878][ T5910] usb 4-1: config 218 has 1 interface, different from the descriptor's value: 244
[  338.090397][ T5910] usb 4-1: config 218 has no interface number 0
[  338.098807][ T5910] usb 4-1: config 218 interface 95 altsetting 64 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  338.114307][ T5910] usb 4-1: config 218 interface 95 altsetting 64 endpoint 0x82 has invalid wMaxPacketSize 0
[  338.126649][ T5910] usb 4-1: config 218 interface 95 has no altsetting 0
[  338.137457][ T5910] usb 4-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=dc.4d
[  338.147841][ T5910] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  338.159081][ T5910] usb 4-1: Product: syz
[  338.164707][ T5910] usb 4-1: Manufacturer: syz
[  338.170870][ T5910] usb 4-1: SerialNumber: syz
[  338.342728][  T107] usb 1-1: new high-speed USB device number 33 using dummy_hcd
[  338.413586][T10059] fuse: Bad value for 'fd'
[  338.450392][  T107] usb 1-1: device descriptor read/8, error -71
[  338.563049][  T107] usb usb1-port1: unable to enumerate USB device
[  339.494614][T10086] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1236'.
[  339.912171][T10100] TCP: TCP_TX_DELAY enabled
[  340.649808][ T5910] usbtouchscreen 4-1:218.95: probe with driver usbtouchscreen failed with error -71
[  340.717551][ T5910] usb 4-1: USB disconnect, device number 29
[  340.773694][T10117] xt_TPROXY: Can be used only with -p tcp or -p udp
[  340.912760][ T6858] usb 3-1: new high-speed USB device number 28 using dummy_hcd
[  340.982698][T10121] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1248'.
[  341.074894][ T6858] usb 3-1: config 0 has an invalid interface number: 64 but max is 0
[  341.084263][ T6858] usb 3-1: config 0 has an invalid descriptor of length 48, skipping remainder of the config
[  341.097308][ T6858] usb 3-1: config 0 has no interface number 0
[  341.119444][ T6858] usb 3-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48
[  341.138478][ T6858] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  341.158889][ T6858] usb 3-1: Product: syz
[  341.166752][ T6858] usb 3-1: Manufacturer: syz
[  341.171589][ T6858] usb 3-1: SerialNumber: syz
[  341.184092][ T6858] usb 3-1: config 0 descriptor??
[  341.243718][T10130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1249'.
[  341.383940][T10130] kvm: requested 4190 ns i8254 timer period limited to 200000 ns
[  341.410567][   T30] kauditd_printk_skb: 18 callbacks suppressed
[  341.410588][   T30] audit: type=1326 audit(1769818045.873:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10122 comm="syz.0.1249" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7ff0d6b9aeb9 code=0x0
[  341.655383][T10113] batadv_slave_0: entered promiscuous mode
[  341.666240][T10113] batadv_slave_0: entered allmulticast mode
[  341.897774][T10113] program syz.2.1245 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  341.921947][T10140] vti0: entered promiscuous mode
[  342.046205][ T6858] uvcvideo 3-1:0.64: Found UVC 0.00 device syz (046d:0823)
[  342.054175][ T6858] uvcvideo 3-1:0.64: No valid video chain found.
[  342.185687][ T6858] usb 3-1: USB disconnect, device number 28
[  342.593070][    T9] usb 5-1: new high-speed USB device number 26 using dummy_hcd
[  342.762736][  T107] usb 1-1: new high-speed USB device number 34 using dummy_hcd
[  342.770555][    T9] usb 5-1: Using ep0 maxpacket: 32
[  342.795858][    T9] usb 5-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50
[  342.806787][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  342.815016][    T9] usb 5-1: Product: syz
[  342.819381][    T9] usb 5-1: Manufacturer: syz
[  342.826712][    T9] usb 5-1: SerialNumber: syz
[  342.844481][    T9] usb 5-1: config 0 descriptor??
[  342.874303][    T9] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state.
[  342.882138][    T9] dvb-usb: bulk message failed: -22 (2/0)
[  342.894043][    T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  342.927068][T10153] FAULT_INJECTION: forcing a failure.
[  342.927068][T10153] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  342.931431][  T107] usb 1-1: Using ep0 maxpacket: 32
[  342.953169][T10153] CPU: 1 UID: 0 PID: 10153 Comm: syz.3.1259 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  342.953205][T10153] Tainted: [L]=SOFTLOCKUP
[  342.953212][T10153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  342.953223][T10153] Call Trace:
[  342.953231][T10153]  <TASK>
[  342.953239][T10153]  dump_stack_lvl+0xe8/0x150
[  342.953270][T10153]  should_fail_ex+0x412/0x560
[  342.953301][T10153]  _copy_from_user+0x2d/0xb0
[  342.953330][T10153]  kstrtouint_from_user+0xd6/0x180
[  342.953355][T10153]  ? __pfx_kstrtouint_from_user+0x10/0x10
[  342.953398][T10153]  proc_fail_nth_write+0x8e/0x210
[  342.953423][T10153]  ? __pfx_proc_fail_nth_write+0x10/0x10
[  342.953454][T10153]  ? __pfx_proc_fail_nth_write+0x10/0x10
[  342.953489][T10153]  vfs_write+0x29a/0xb90
[  342.953523][T10153]  ? __pfx_vfs_write+0x10/0x10
[  342.953550][T10153]  ? __fget_files+0x2a/0x420
[  342.953574][T10153]  ? __fget_files+0x3a0/0x420
[  342.953593][T10153]  ? __fget_files+0x2a/0x420
[  342.953622][T10153]  ksys_write+0x150/0x270
[  342.953652][T10153]  ? __pfx_ksys_write+0x10/0x10
[  342.953690][T10153]  do_syscall_64+0xe2/0xf80
[  342.953711][T10153]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  342.953729][T10153]  ? trace_irq_disable+0x37/0x100
[  342.953747][T10153]  ? clear_bhb_loop+0x60/0xb0
[  342.953770][T10153]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  342.953788][T10153] RIP: 0033:0x7fb38d95b78e
[  342.953806][T10153] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  342.953823][T10153] RSP: 002b:00007fb38e799fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  342.953845][T10153] RAX: ffffffffffffffda RBX: 00007fb38e79a6c0 RCX: 00007fb38d95b78e
[  342.953859][T10153] RDX: 0000000000000001 RSI: 00007fb38e79a0a0 RDI: 0000000000000004
[  342.953872][T10153] RBP: 00007fb38e79a090 R08: 0000000000000000 R09: 0000000000000000
[  342.953883][T10153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  342.953894][T10153] R13: 00007fb38dc16038 R14: 00007fb38dc15fa0 R15: 00007fb38dd3fa48
[  342.953928][T10153]  </TASK>
[  342.963576][    T9] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold)
[  343.068416][T10145] dvb-usb: bulk message failed: -22 (3/0)
[  343.080836][    T9] usb 5-1: media controller created
[  343.203917][  T107] usb 1-1: config 0 has an invalid interface number: 132 but max is 0
[  343.212201][  T107] usb 1-1: config 0 has no interface number 0
[  343.212253][  T107] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  343.226931][  T107] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5
[  343.226965][  T107] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  343.226984][  T107] usb 1-1: Product: syz
[  343.227000][  T107] usb 1-1: Manufacturer: syz
[  343.227016][  T107] usb 1-1: SerialNumber: syz
[  343.231283][  T107] usb 1-1: config 0 descriptor??
[  343.238886][  T107] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132)
[  343.238922][  T107] em28xx 1-1:0.132: Video interface 132 found:
[  343.244018][    T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  343.368029][    T9] usb 5-1: selecting invalid altsetting 7
[  343.373924][    T9] cxusb: set interface failed
[  343.380115][    T9] dvb-usb: bulk message failed: -22 (1/0)
[  343.437108][T10163] lo: entered promiscuous mode
[  343.442422][    T9] DVB: Unable to find symbol lgdt330x_attach()
[  343.443195][T10163] lo: entered allmulticast mode
[  343.463007][    T9] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold'
[  343.574843][T10163] netlink: 'syz.2.1262': attribute type 2 has an invalid length.
[  343.623568][    T9] rc_core: IR keymap rc-dvico-portable not found
[  343.630012][    T9] Registered IR keymap rc-empty
[  343.638127][T10163] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  343.646321][    T9] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0
[  343.671358][    T9] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input30
[  343.682205][  T107] em28xx 1-1:0.132: chip ID is em2874
[  343.694221][    T9] dvb-usb: schedule remote query interval to 100 msecs.
[  343.701256][    T9] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected.
[  343.716238][    T9] usb 5-1: USB disconnect, device number 26
[  343.874043][    T9] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected.
[  344.312857][    T9] usb 5-1: new high-speed USB device number 27 using dummy_hcd
[  344.473592][    T9] usb 5-1: Using ep0 maxpacket: 32
[  344.481736][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  344.502740][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  344.522844][    T9] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  344.532061][    T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  344.557306][    T9] usb 5-1: config 0 descriptor??
[  344.577493][    T9] hub 5-1:0.0: USB hub found
[  344.599877][  T107] em28xx 1-1:0.132: failed to read eeprom (err=-110)
[  344.611989][  T107] em28xx 1-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-110]
[  344.801231][    T9] hub 5-1:0.0: config failed, can't read hub descriptor (err -22)
[  344.829372][    T9] usbhid 5-1:0.0: can't add hid device: -71
[  344.848565][    T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  344.893819][    T9] usb 5-1: USB disconnect, device number 27
[  344.943617][ T6858] usb 4-1: new high-speed USB device number 30 using dummy_hcd
[  345.103323][ T6858] usb 4-1: Using ep0 maxpacket: 8
[  345.127180][ T6858] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  345.144703][ T6858] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22
[  345.160409][ T6858] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  345.176895][ T6858] usb 4-1: config 0 descriptor??
[  345.363067][    T9] usb 5-1: new high-speed USB device number 28 using dummy_hcd
[  345.382841][ T5910] usb 3-1: new high-speed USB device number 29 using dummy_hcd
[  345.395188][ T6858] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0
[  345.522805][    T9] usb 5-1: Using ep0 maxpacket: 32
[  345.522817][ T5910] usb 3-1: device descriptor read/64, error -71
[  345.536258][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  345.547610][    T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  345.557603][    T9] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  345.566734][    T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  345.578776][    T9] usb 5-1: config 0 descriptor??
[  345.600866][    T9] hub 5-1:0.0: USB hub found
[  345.722791][  T107] em28xx 1-1:0.132: Identified as Leadtek Winfast USB II (card=7)
[  345.740887][  T107] em28xx 1-1:0.132: analog set to bulk mode.
[  345.747132][ T5909] em28xx 1-1:0.132: Registering V4L2 extension
[  345.766116][ T5910] usb 3-1: new high-speed USB device number 30 using dummy_hcd
[  345.808262][    T9] hub 5-1:0.0: config failed, can't read hub descriptor (err -22)
[  345.843382][    T9] usbhid 5-1:0.0: can't add hid device: -71
[  345.857899][    T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  345.876512][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0x4a (error=-5)
[  345.899833][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0x48 (error=-5)
[  345.912535][    T9] usb 5-1: USB disconnect, device number 28
[  345.912767][ T5910] usb 3-1: device descriptor read/64, error -71
[  345.927899][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0x42 (error=-5)
[  345.950237][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0x40 (error=-5)
[  346.004886][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0x84 (error=-5)
[  346.015147][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0x86 (error=-5)
[  346.038681][ T5910] usb usb3-port1: attempt power cycle
[  346.048942][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0x94 (error=-5)
[  346.065674][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0x96 (error=-5)
[  346.121423][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0xc0 (error=-5)
[  346.138719][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0xc2 (error=-5)
[  346.154861][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0xc4 (error=-5)
[  346.172561][ T5909] em28xx 1-1:0.132: failed to trigger read from i2c address 0xc6 (error=-5)
[  346.186888][ T6858] usb 1-1: USB disconnect, device number 34
[  346.201855][ T6858] em28xx 1-1:0.132: Disconnecting em28xx
[  346.217205][ T5909] usb 1-1: Decoder not found
[  346.232471][ T5909] em28xx 1-1:0.132: failed to create media graph
[  346.287937][ T5909] em28xx 1-1:0.132: V4L2 device video103 deregistered
[  346.310387][T10195] ==================================================================
[  346.318513][T10195] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420
[  346.325921][T10195] Read of size 8 at addr ffff888077f30740 by task v4l_id/10195
[  346.333489][T10195] 
[  346.335838][T10195] CPU: 0 UID: 0 PID: 10195 Comm: v4l_id Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  346.335866][T10195] Tainted: [L]=SOFTLOCKUP
[  346.335873][T10195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  346.335885][T10195] Call Trace:
[  346.335893][T10195]  <TASK>
[  346.335902][T10195]  dump_stack_lvl+0xe8/0x150
[  346.335931][T10195]  print_report+0xba/0x230
[  346.335951][T10195]  ? v4l2_fh_open+0xac/0x420
[  346.335972][T10195]  kasan_report+0x117/0x150
[  346.335994][T10195]  ? v4l2_fh_open+0xac/0x420
[  346.336018][T10195]  v4l2_fh_open+0xac/0x420
[  346.336039][T10195]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  346.336064][T10195]  em28xx_v4l2_open+0x157/0x9a0
[  346.336091][T10195]  ? do_raw_spin_lock+0x12b/0x2f0
[  346.336116][T10195]  v4l2_open+0x1bf/0x3a0
[  346.336140][T10195]  chrdev_open+0x4cd/0x5e0
[  346.336159][T10195]  ? __pfx_chrdev_open+0x10/0x10
[  346.336177][T10195]  ? fsnotify_open_perm_and_set_mode+0x135/0x6d0
[  346.336203][T10195]  ? __pfx_chrdev_open+0x10/0x10
[  346.336221][T10195]  do_dentry_open+0x7ce/0x1420
[  346.336248][T10195]  vfs_open+0x3b/0x340
[  346.336267][T10195]  ? path_openat+0x346e/0x3e20
[  346.336293][T10195]  path_openat+0x3486/0x3e20
[  346.336331][T10195]  ? kmem_cache_alloc_noprof+0x370/0x6e0
[  346.336358][T10195]  ? getname_flags+0xb7/0x540
[  346.336378][T10195]  ? __pfx_path_openat+0x10/0x10
[  346.336413][T10195]  ? __lock_acquire+0x6b5/0x2cf0
[  346.336444][T10195]  do_filp_open+0x22d/0x490
[  346.336470][T10195]  ? __pfx_do_filp_open+0x10/0x10
[  346.336504][T10195]  ? _raw_spin_unlock+0x28/0x50
[  346.336530][T10195]  ? alloc_fd+0x64b/0x6c0
[  346.336554][T10195]  do_sys_openat2+0x12f/0x220
[  346.336577][T10195]  ? __pfx_do_sys_openat2+0x10/0x10
[  346.336599][T10195]  ? exc_page_fault+0x6a/0xc0
[  346.336618][T10195]  ? do_user_addr_fault+0xc7c/0x1360
[  346.336647][T10195]  __x64_sys_openat+0x138/0x170
[  346.336672][T10195]  do_syscall_64+0xe2/0xf80
[  346.336692][T10195]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  346.336710][T10195]  ? trace_irq_disable+0x37/0x100
[  346.336728][T10195]  ? clear_bhb_loop+0x60/0xb0
[  346.336749][T10195]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  346.336767][T10195] RIP: 0033:0x7f3fadea7407
[  346.336786][T10195] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  346.336803][T10195] RSP: 002b:00007fff03707b60 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[  346.336825][T10195] RAX: ffffffffffffffda RBX: 00007f3fae680880 RCX: 00007f3fadea7407
[  346.336840][T10195] RDX: 0000000000000000 RSI: 00007fff03709f1b RDI: ffffffffffffff9c
[  346.336853][T10195] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[  346.336865][T10195] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[  346.336876][T10195] R13: 00007fff03707db0 R14: 00007f3fae7e7000 R15: 000055b760fa84d8
[  346.336897][T10195]  </TASK>
[  346.336904][T10195] 
[  346.402766][ T5910] usb 3-1: new high-speed USB device number 31 using dummy_hcd
[  346.406369][T10195] Allocated by task 5909:
[  346.406386][T10195]  kasan_save_track+0x3e/0x80
[  346.406409][T10195]  __kasan_kmalloc+0x93/0xb0
[  346.643433][T10195]  __kmalloc_cache_noprof+0x3d1/0x6e0
[  346.648806][T10195]  em28xx_v4l2_init+0x10b/0x2e70
[  346.653740][T10195]  em28xx_init_extension+0x120/0x1c0
[  346.659014][T10195]  process_scheduled_works+0xaec/0x17a0
[  346.664554][T10195]  worker_thread+0xda6/0x1360
[  346.669249][T10195]  kthread+0x726/0x8b0
[  346.673401][T10195]  ret_from_fork+0x51b/0xa40
[  346.677986][T10195]  ret_from_fork_asm+0x1a/0x30
[  346.682759][T10195] 
[  346.685107][T10195] Freed by task 5909:
[  346.689107][T10195]  kasan_save_track+0x3e/0x80
[  346.693823][T10195]  kasan_save_free_info+0x46/0x50
[  346.698934][T10195]  __kasan_slab_free+0x5c/0x80
[  346.703690][T10195]  kfree+0x1be/0x650
[  346.707696][T10195]  em28xx_v4l2_init+0x1683/0x2e70
[  346.712742][T10195]  em28xx_init_extension+0x120/0x1c0
[  346.718054][T10195]  process_scheduled_works+0xaec/0x17a0
[  346.723694][T10195]  worker_thread+0xda6/0x1360
[  346.728380][T10195]  kthread+0x726/0x8b0
[  346.732451][T10195]  ret_from_fork+0x51b/0xa40
[  346.737141][T10195]  ret_from_fork_asm+0x1a/0x30
[  346.741916][T10195] 
[  346.744237][T10195] The buggy address belongs to the object at ffff888077f30000
[  346.744237][T10195]  which belongs to the cache kmalloc-8k of size 8192
[  346.758290][T10195] The buggy address is located 1856 bytes inside of
[  346.758290][T10195]  freed 8192-byte region [ffff888077f30000, ffff888077f32000)
[  346.772365][T10195] 
[  346.774688][T10195] The buggy address belongs to the physical page:
[  346.781365][T10195] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77f30
[  346.790212][T10195] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  346.798789][T10195] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  346.806678][T10195] page_type: f5(slab)
[  346.810654][T10195] raw: 00fff00000000040 ffff88813fe27280 ffffea00007ffa00 dead000000000003
[  346.819225][T10195] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[  346.827831][T10195] head: 00fff00000000040 ffff88813fe27280 ffffea00007ffa00 dead000000000003
[  346.836589][T10195] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000
[  346.845261][T10195] head: 00fff00000000003 ffffea0001dfcc01 00000000ffffffff 00000000ffffffff
[  346.853947][T10195] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  346.862605][T10195] page dumped because: kasan: bad access detected
[  346.869022][T10195] page_owner tracks the page as allocated
[  346.874746][T10195] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 9213, tgid 9208 (syz.0.965), ts 290370539470, free_ts 288955051548
[  346.896037][T10195]  post_alloc_hook+0x228/0x280
[  346.900806][T10195]  get_page_from_freelist+0x24dc/0x2580
[  346.906352][T10195]  __alloc_frozen_pages_noprof+0x18d/0x380
[  346.912152][T10195]  alloc_pages_mpol+0x232/0x4a0
[  346.916999][T10195]  allocate_slab+0x86/0x3a0
[  346.921494][T10195]  ___slab_alloc+0xd82/0x1760
[  346.926163][T10195]  __slab_alloc+0x65/0x100
[  346.930605][T10195]  __kmalloc_cache_noprof+0x40d/0x6e0
[  346.936063][T10195]  ptp_open+0xd0/0x480
[  346.940126][T10195]  posix_clock_open+0x14d/0x230
[  346.944977][T10195]  chrdev_open+0x4cd/0x5e0
[  346.949393][T10195]  do_dentry_open+0x7ce/0x1420
[  346.954174][T10195]  vfs_open+0x3b/0x340
[  346.958315][T10195]  path_openat+0x3486/0x3e20
[  346.962895][T10195]  do_filp_open+0x22d/0x490
[  346.967392][T10195]  do_sys_openat2+0x12f/0x220
[  346.972251][T10195] page last free pid 107 tgid 107 stack trace:
[  346.978388][T10195]  __free_frozen_pages+0xbf8/0xd70
[  346.983509][T10195]  __put_partials+0x146/0x170
[  346.988218][T10195]  __slab_free+0x294/0x320
[  346.992744][T10195]  qlist_free_all+0x97/0x100
[  346.997389][T10195]  kasan_quarantine_reduce+0x148/0x160
[  347.002928][T10195]  __kasan_slab_alloc+0x22/0x80
[  347.007769][T10195]  kmem_cache_alloc_noprof+0x370/0x6e0
[  347.013224][T10195]  __kernfs_new_node+0xe9/0x8e0
[  347.018160][T10195]  kernfs_new_node+0x102/0x210
[  347.022933][T10195]  __kernfs_create_file+0x4b/0x2e0
[  347.028046][T10195]  sysfs_add_file_mode_ns+0x238/0x300
[  347.033418][T10195]  internal_create_group+0x673/0x1180
[  347.038794][T10195]  sysfs_create_groups+0x59/0x120
[  347.043821][T10195]  device_add_attrs+0x1bf/0x5b0
[  347.048670][T10195]  device_add+0x496/0xb70
[  347.053003][T10195]  usb_new_device+0xa08/0x16f0
[  347.057767][T10195] 
[  347.060089][T10195] Memory state around the buggy address:
[  347.065716][T10195]  ffff888077f30600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  347.073779][T10195]  ffff888077f30680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  347.081835][T10195] >ffff888077f30700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  347.089903][T10195]                                            ^
[  347.096066][T10195]  ffff888077f30780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  347.104142][T10195]  ffff888077f30800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  347.112372][T10195] ==================================================================
[  347.121283][ T5909] em28xx 1-1:0.132: Remote control support is not available for this card.
[  347.121934][ T5910] usb 3-1: device descriptor read/8, error -71
[  347.143975][    T9] usb 5-1: new low-speed USB device number 29 using dummy_hcd
[  347.181759][T10195] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  347.189013][T10195] CPU: 0 UID: 0 PID: 10195 Comm: v4l_id Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  347.199721][T10195] Tainted: [L]=SOFTLOCKUP
[  347.204075][T10195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  347.214146][T10195] Call Trace:
[  347.217501][T10195]  <TASK>
[  347.220459][T10195]  vpanic+0x1e0/0x670
[  347.224473][T10195]  panic+0xc5/0xd0
[  347.228223][T10195]  ? __pfx_panic+0x10/0x10
[  347.232660][T10195]  ? preempt_schedule_common+0x82/0xd0
[  347.238142][T10195]  ? v4l2_fh_open+0xac/0x420
[  347.242802][T10195]  check_panic_on_warn+0x89/0xb0
[  347.247772][T10195]  ? v4l2_fh_open+0xac/0x420
[  347.252386][T10195]  end_report+0x6f/0x140
[  347.256648][T10195]  kasan_report+0x128/0x150
[  347.261179][T10195]  ? v4l2_fh_open+0xac/0x420
[  347.265799][T10195]  v4l2_fh_open+0xac/0x420
[  347.270324][T10195]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  347.276325][T10195]  em28xx_v4l2_open+0x157/0x9a0
[  347.281240][T10195]  ? do_raw_spin_lock+0x12b/0x2f0
[  347.286297][T10195]  v4l2_open+0x1bf/0x3a0
[  347.290562][T10195]  chrdev_open+0x4cd/0x5e0
[  347.295084][T10195]  ? __pfx_chrdev_open+0x10/0x10
[  347.300048][T10195]  ? fsnotify_open_perm_and_set_mode+0x135/0x6d0
[  347.306403][T10195]  ? __pfx_chrdev_open+0x10/0x10
[  347.311444][T10195]  do_dentry_open+0x7ce/0x1420
[  347.316321][T10195]  vfs_open+0x3b/0x340
[  347.320409][T10195]  ? path_openat+0x346e/0x3e20
[  347.325299][T10195]  path_openat+0x3486/0x3e20
[  347.329924][T10195]  ? kmem_cache_alloc_noprof+0x370/0x6e0
[  347.335578][T10195]  ? getname_flags+0xb7/0x540
[  347.340269][T10195]  ? __pfx_path_openat+0x10/0x10
[  347.345204][T10195]  ? __lock_acquire+0x6b5/0x2cf0
[  347.350148][T10195]  do_filp_open+0x22d/0x490
[  347.354650][T10195]  ? __pfx_do_filp_open+0x10/0x10
[  347.359673][T10195]  ? _raw_spin_unlock+0x28/0x50
[  347.364519][T10195]  ? alloc_fd+0x64b/0x6c0
[  347.368927][T10195]  do_sys_openat2+0x12f/0x220
[  347.373605][T10195]  ? __pfx_do_sys_openat2+0x10/0x10
[  347.378800][T10195]  ? exc_page_fault+0x6a/0xc0
[  347.383466][T10195]  ? do_user_addr_fault+0xc7c/0x1360
[  347.388756][T10195]  __x64_sys_openat+0x138/0x170
[  347.393609][T10195]  do_syscall_64+0xe2/0xf80
[  347.398126][T10195]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  347.404203][T10195]  ? trace_irq_disable+0x37/0x100
[  347.409366][T10195]  ? clear_bhb_loop+0x60/0xb0
[  347.414037][T10195]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  347.420006][T10195] RIP: 0033:0x7f3fadea7407
[  347.424413][T10195] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  347.444101][T10195] RSP: 002b:00007fff03707b60 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[  347.452511][T10195] RAX: ffffffffffffffda RBX: 00007f3fae680880 RCX: 00007f3fadea7407
[  347.460470][T10195] RDX: 0000000000000000 RSI: 00007fff03709f1b RDI: ffffffffffffff9c
[  347.468694][T10195] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
[  347.476656][T10195] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[  347.484636][T10195] R13: 00007fff03707db0 R14: 00007f3fae7e7000 R15: 000055b760fa84d8
[  347.492625][T10195]  </TASK>
[  347.496178][T10195] Kernel Offset: disabled
[  347.500542][T10195] Rebooting in 86400 seconds..