last executing test programs: 13.832899621s ago: executing program 0 (id=1708): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74f", 0x86}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {0x0}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a620982383e84178b017ba52b", 0xc3}, {&(0x7f0000000900)}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dc", 0xa2}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75", 0xd2}, {&(0x7f0000000580)}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000e00)="abc662f2a7dc713d226b612e712df36db5547daf508fb74a679224eba0fe5f05c53081", 0x23}, {&(0x7f0000000ec0)="6e20cbe6a4a132117801a95e6fd3ec5771da8352900bb19979b1", 0x1a}], 0x2}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 13.378891672s ago: executing program 0 (id=1711): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x20, r2, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}]}]}, 0x20}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) socket$isdn_base(0x22, 0x3, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) mq_open(&(0x7f00000001c0)='\x00', 0x1, 0x9, &(0x7f0000000280)={0x6, 0xfff, 0x7, 0x800}) (async) mq_open(&(0x7f00000001c0)='\x00', 0x1, 0x9, &(0x7f0000000280)={0x6, 0xfff, 0x7, 0x800}) membarrier(0x10, 0x0) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_setup(0x8, &(0x7f0000000600)=0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000240)={0x200000, 0x200003, 0x9, 0x0, 0x7, 0x3}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1f, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="0e000000fdffff7f000000000000e87dd3e1c57a333059765c4f29b738020085000000ac0000009500000005000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x58) bpf$MAP_CREATE(0x0, 0x0, 0x48) (async) bpf$MAP_CREATE(0x0, 0x0, 0x48) io_submit(r6, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r5, 0x0}]) (async) io_submit(r6, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r5, 0x0}]) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x58, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x1ba20, 0x40a38}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x11, 0x13}}]}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_LINKMODE={0x5, 0x11, 0x2}]}, 0x58}}, 0x40080) 12.871225436s ago: executing program 0 (id=1715): syz_usb_connect$hid(0x3, 0x3f, &(0x7f0000000280)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc090, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x5, "", [{{0x9, 0x4, 0x0, 0x5, 0xc, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0xb, 0x80, 0x1, {0x22, 0x2ab}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0xd, 0xfb, 0x5}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x1, 0x6, 0x85}}]}}}]}}]}}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f", 0xb3}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) readv(0xffffffffffffffff, &(0x7f00000008c0)=[{&(0x7f0000000300)=""/101, 0x65}, {&(0x7f0000000600)=""/198, 0xc6}, {&(0x7f0000000700)=""/58, 0x3a}, {&(0x7f0000000740)=""/224, 0xe0}, {&(0x7f0000000840)=""/124, 0x7c}], 0x5) 12.634759483s ago: executing program 1 (id=1718): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74f", 0x86}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {0x0}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a620982383e84178b017ba52b", 0xc3}, {&(0x7f0000000900)}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dc", 0xa2}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75", 0xd2}, {0x0}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000e00)="abc662f2a7dc713d226b612e712df36db5547daf508fb74a679224eba0fe5f05c53081", 0x23}, {&(0x7f0000000ec0)="6e20cbe6a4a132117801a95e6fd3ec5771da8352900bb19979b1", 0x1a}], 0x2}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 12.538984681s ago: executing program 1 (id=1719): symlink(&(0x7f0000001640)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/../file0\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') lsetxattr$system_posix_acl(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000004c0)='system.posix_acl_default\x00', &(0x7f00000040c0)=ANY=[@ANYBLOB="02000000010001000000000002000600", @ANYRES32=0x0, @ANYBLOB="02000000", @ANYRES32=0x0, @ANYBLOB="02000400", @ANYRES32=0x0, @ANYBLOB='\b\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="02000100", @ANYRES32=0x0, @ANYBLOB="040004000000000008000400", @ANYRES32, @ANYBLOB="08000500", @ANYRES32, @ANYBLOB="08000400", @ANYRES32, @ANYBLOB="08000400", @ANYRES32=0x0, @ANYBLOB="08000200", @ANYRES32, @ANYBLOB='\b\x00\x00\x00', @ANYRES32, @ANYBLOB="08000400", @ANYRES32, @ANYBLOB="10000400000000002000000000000000"], 0x84, 0x3) 12.415689602s ago: executing program 1 (id=1720): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x12, 0x9, 0x8, 0x2, 0x0, 0xffffffffffffffff, 0x4000}, 0x50) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) syz_emit_vhci(&(0x7f0000000440)=ANY=[@ANYBLOB="040e0c010320"], 0xf) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r3) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) r5 = getpgrp(0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf5c5d000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$unix(0x1, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r2, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f0000000740)=r1}, 0x22) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000580)={r8, &(0x7f0000000480), 0x0}, 0x20) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000300)={'ipvlan0\x00', {0x2, 0x0, @broadcast}}) 10.622262954s ago: executing program 1 (id=1727): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet(0x2, 0x1, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) openat$fuse(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) shutdown(r1, 0x1) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r6 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000800)=@can_newroute={0x14, 0x18, 0x1, 0x70bd29, 0x25dfdbfd, {0x1d, 0x1, 0x4}}, 0x14}}, 0x4c0c8) tkill(r6, 0xb) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r7, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x2}]}, @IFLA_GROUP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) (fail_nth: 1) 10.421742765s ago: executing program 0 (id=1731): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f0000000040)=0x2, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, 0x0) ioctl$SNDCTL_DSP_GETODELAY(0xffffffffffffffff, 0x80045017, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x20) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xf0ffffff) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, &(0x7f0000000380)={0x353, 0x78, 0x3c0, 0x0, 0xa, 0x0, 0x0, 0x4, {}, {}, {0x0, 0xffffffff}, {}, 0x0, 0x0, 0x3, 0x1, 0x1, 0x4, 0x9f6, 0x6, 0x7, 0x803d, 0x100, 0x7, 0x5f, 0x202, 0x1, 0x7}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r7, 0x4004ae99, &(0x7f0000000040)=0x3) 9.052172507s ago: executing program 2 (id=1733): r0 = socket(0x10, 0x3, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x2, 0x0, 0x4, 0x0, {0xa, 0x4e23, 0x800, @private0, 0x6}}}, 0x3a) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x601, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r4, 0x4010ae68, &(0x7f0000000000)={0x10000, 0x2000}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000005e000f"], 0x1c}, 0x1, 0x0, 0x0, 0x4048885}, 0x44040) 7.888085896s ago: executing program 3 (id=1737): syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a01010000000000064400030000080900010073797a300000000020000000000a000000000000000000000500000a0900010073797a300000000014000000020a0101000000000000000000000001200000000b0a01020000000000000000030000070900010073797a30"], 0x9c}, 0x1, 0x0, 0x0, 0x20008080}, 0x6004000) socket$inet(0x2, 0x1, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x110, 0xffffffffffffffff, 0xce21b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x218888, &(0x7f0000000600)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX=r4, @ANYBLOB="000fa3d3724f5b7879162d0b59b7191829914a2e9e7c01995194a15a1b460d0dcec3d3d3ad5cdfa268282428948c60993a567732348fd02abb7014f1727c37a5837291286288c90e3d9842cd6924e0e8ca391a8780d4090446a23a404f2150fa4c6eb7b9251b400b2c5ce28db733c8f21416a8e60fb68e463d5f51ba93e17d998ca58d3de09d818c5f07dee2c43508cacc90c3902c14dca94a04f82da1902e3b8e7570bda44c1aab725605c7f57dd79ed57ddadd701147a1c02712ae032d02f37663de1578f80257b8371b3bd7248ac11f5a649f0ea04b1db78334eb609b552b3d667a84883d730dc9c8868a90e87df67b70e6af"]) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r0, 0x0, r7, 0x0, 0x1038f5, 0x0) fcntl$setstatus(r8, 0x4, 0x42c00) write(r6, &(0x7f0000000040), 0xffffff4a) r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000340)=ANY=[@ANYBLOB="180900a90250ec98000000010000181200000000000000000000000000000000fa7fbb20118786a4b0a941773995cf394cd124135a0ee98e11d4c0b2e063138a8862cd19dca85c17b2d6872fb4ea18635281ddc65c277c5dd8b456c9aa04c2fd81c63a2d1caf66c09fc70a9396", @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000005c0)={{r10, 0xffffffffffffffff}, &(0x7f0000000540), &(0x7f0000000580)=r11}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r12, &(0x7f00000002c0)}, 0x20) 7.868174965s ago: executing program 0 (id=1738): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="e80000000001050500000000000000000a0000003c0002802c000180140003002001000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c000180"], 0xe8}, 0x1, 0x0, 0x0, 0x4040081}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000400)='syz1\x00', 0x200002, 0x0) syz_clone3(&(0x7f0000000540)={0x4000000, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), {0x33}, &(0x7f0000000240), 0x0, &(0x7f0000000340)=""/69, &(0x7f00000003c0)=[r1, r0, r0, r0, r1], 0x5, {r3}}, 0x58) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3800000012002927000000000000008b050021"], 0x38}}, 0x4) sysfs$2(0x2, 0x4, &(0x7f0000000240)=""/42) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0xfffffffffffffe90, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r5 = io_uring_setup(0x37b0, &(0x7f00000003c0)={0x0, 0x800000, 0x400, 0x3, 0x400022a}) io_uring_register$IORING_UNREGISTER_PBUF_RING(r5, 0x17, &(0x7f0000000300)={0x0}, 0x1) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f00000004c0)=""/89, 0x1031000, 0x1c00, 0x0, 0x2}, 0x20) sysfs$2(0x2, 0x0, &(0x7f00000005c0)=""/150) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'macvtap0\x00'}) bind$xdp(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="9f88eeff171353d2ff0b00000002000000000000007ea81e9f4200"/43], &(0x7f0000000f40)=""/4088, 0x26, 0xff8, 0xa, 0x1}, 0x28) syz_init_net_socket$ax25(0x3, 0x5, 0x0) 6.238227394s ago: executing program 3 (id=1739): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74f", 0x86}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {0x0}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a620982383e84178b017ba52b", 0xc3}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e", 0x4b}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dc", 0xa2}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75", 0xd2}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91566b7f1725f39f", 0x1c}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000e00)="abc662f2a7dc713d226b612e712df36db5547daf508fb74a679224eba0fe5f05c53081", 0x23}, {&(0x7f0000000ec0)="6e20cbe6a4a132117801a95e6fd3ec5771da8352900bb19979b1", 0x1a}], 0x2}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 6.237151352s ago: executing program 2 (id=1740): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74f", 0x86}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {0x0}, {0x0}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e", 0x4b}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dc", 0xa2}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75", 0xd2}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91566b7f1725f39f", 0x1c}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000e00)="abc662f2a7dc713d226b612e712df36db5547daf508fb74a679224eba0fe5f05c53081", 0x23}, {&(0x7f0000000ec0)="6e20cbe6a4a132117801a95e6fd3ec5771da8352900bb19979b1", 0x1a}], 0x2}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 6.055144581s ago: executing program 2 (id=1741): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x3, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000d40)={{{@in6=@private1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@private0}}, &(0x7f0000000e40)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in=@dev={0xac, 0x14, 0x14, 0x1c}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20, 0x0, 0x0, r2}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0x0, 0x200000000}, 0xfffffffd, 0x6e6bb9, 0x1}, {{@in=@broadcast, 0xfffffffc, 0x3c}, 0xa, @in=@empty, 0x4, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r3, 0x27, 0x28, 0x0, &(0x7f00000007c0)="f8ad48cc02cb29dcc8007d5b86dd96d65b6621c3fdda704973b0d4273cc4b90e16816b72f87293ea", 0x0, 0xe6, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000240)={'ip6tnl0\x00', &(0x7f0000000180)={'ip6gre0\x00', 0x0, 0x29, 0x0, 0x9, 0x0, 0x10, @private0, @mcast2, 0x7, 0x8, 0x9, 0x8}}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$inet_tcp(0x2, 0x1, 0x0) syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000280)={{0x12, 0x1, 0x2d937b961f869cea, 0x0, 0x0, 0x0, 0x8, 0x4d9, 0xa081, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x30, 0x7, "", [{{0x9, 0x4, 0x0, 0x90, 0x2, 0x3, 0x1, 0x0, 0xaa, {0x9, 0x21, 0x2, 0x2, 0x1, {0x22, 0xe8a}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x4, 0x9, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x0, 0xcb, 0xe, 0x1}}]}}}]}}]}}, &(0x7f0000000cc0)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x200, 0x5, 0xb, 0x1, 0x10, 0xe}, 0x9f, &(0x7f0000000680)={0x5, 0xf, 0x9f, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xb, 0x9, 0xa, 0x19}, @ssp_cap={0x20, 0x10, 0xa, 0x6, 0x5, 0x3, 0x0, 0x8, [0x0, 0xffc000, 0x30, 0xc0c0, 0x3fc0]}, @ext_cap={0x7, 0x10, 0x2, 0x6, 0x1, 0xc, 0x9c}, @generic={0x5e, 0x10, 0x0, "1650cd126ab3665b9534efd6a3005fdb2aa6e5b5efab60a79682d7a75403b2ae69b5fa8ee44bf8324a5574d17c6bca3edbc1f21d586660eb66997296638d2ad139df4f5787c8d770d207731ee9d7be8724790755b877fa00214c4f"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x6, 0x4, 0x3, 0x9, 0x5}]}, 0x7, [{0x4, &(0x7f0000000740)=@lang_id={0x4}}, {0xca, &(0x7f0000000800)=@string={0xca, 0x3, "d659c95e1b3b8aed32624fe2eb2270ba944344b401713a5ede62aed1e226b1c7dcd957559bdaab84e165a3c05aa7dce1c094a670dcfaf85eff09b7a53b86a73e123fb8bc3bfd1c0b5513c86b03bd31a17a5a0bf23df895f869b2ff14cda01465010abbd145e66d4a84498f92e6166a43625dcb094067d71316255536987e06ea8ca7a1e6330fa43d64022a07cb0c91a04b7933a4b29b96749b64ad9f1e3ab8d4c115d262b1f7b2ed47edf8821acd753260bfc25b620d935b24b7c519fa92b36cb2323253b87fe475"}}, {0xf6, &(0x7f0000000900)=@string={0xf6, 0x3, "37929fe793406a8d0d65ca11942fafa640481b67985900908f0c77e22bc74f9ed0775883f6061e96476fc08f5739602f7e86dc3c453720be17e3370b28ce2ee7b694e3234472705bef6c19b3bffe85343166eef5442c79072c326bfbc964e15ac2f9cad3d460fb32db4d3583eac796c08b44830f4f222d3336f7b625b3d2a95ec4b67119dc355d52942de789c377cc40e1d11992ec0f0d9b868819cbe2aa25b522bb8bd7aafac49f573b1390cd288d1169e5ad824a70d5430562fd00e7e16a2485271989c0044fc0d4907553c25a25f2f7be283e17e505714342c0d0d08f725863aa5b92ce9f7feac6009bd753d78152eb89a3de"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x3401}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x3c01}}, {0xef, &(0x7f0000000b00)=@string={0xef, 0x3, "04715e7c87fac5f101c6290e9327d4d769e36aede89071f6491e5a07e7df9e3e40ad03433d762cdcbaac9a9602c1aef7c8838961854b82817491c68f6aec75aedc9bade9e81d175b7f55f7bf2767ea97635b471a769092ba15b7fc2e32873b44a4c9855749111cc34bf3258c8e5b89a05c6976b801ab677697d29558df501c59bd7f7c12012facd9cdeb642c498dcbe33b5099dc815f4ad9a562efb09b665cd6a0107fd5e4677c7ab38d4c67e997642f00959e4adb1c78348d8334ed4aa64229bb4ccf3c646107b78d1cf0cbc33a58427c404cdce0e6891b2d5ee223983983490923fd073bac72cfe55c126dc9"}}, {0xbe, &(0x7f0000000c00)=@string={0xbe, 0x3, "65581185e466e5bd98bd2eeb01aaa6a9be237bc272f5889869f31f93225005388003baecfcf0f8cdd3bbaedea1077b1b7f006284f51e95685913dca9f570a1f2a5b5318564245ed57910c8628071532a901dbcaa02479a6e2479fc1d1fa802951a915e0c0c72d1268d8a5e0efa2b01f168ace48825c269bbf8454a99209444355992ce2b3de312e9c49ce4125190bff2b0e6799002a0d6c6511c351b9654797c975f490d577a08b4a2f9106dd23d53964005f6341f495fda94559f90"}}]}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r6}, &(0x7f00000004c0), &(0x7f0000000500)=r7}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r7, r9, 0x25, 0x2, @void}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x6, [@typedef={0x4, 0x0, 0x0, 0x7}, @restrict={0x0, 0x0, 0x0, 0xb, 0x1}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0xfffffffd, [{0x0, 0x2}]}]}, {0x0, [0x0, 0x0, 0x0, 0xda]}}, &(0x7f0000000340)=""/142, 0x4e, 0x8e, 0x1}, 0x1f) sendmsg$TEAM_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000440)=ANY=[@ANYBLOB="ac010000", @ANYRES16=r4, @ANYBLOB="020027bd7000fddbdf250000000800030000", @ANYRES32=r5, @ANYBLOB="900102803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000050003000300000008000400040000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r9, @ANYBLOB="64000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000003400040081ff6a0a0f0000009f06030cb4e40000045a06090000000000000205ff0300000800020c00000000030008040000000040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006c6f616462616c616e63650038000100240001006d636173745f72656a6f696e5f696e74657276616c000000000000000000000005000300030000000800040002000000"], 0x1ac}, 0x1, 0x0, 0x0, 0x1}, 0x0) 6.054862709s ago: executing program 3 (id=1742): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet(0x2, 0x1, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xb, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a4000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b400000095"], &(0x7f0000000880)='syzkaller\x00', 0x6, 0x0, 0x0, 0x9a3a0038a86fdc3b, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) openat$fuse(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) gettid() fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000001900)={0x2, {0xc, 0x117, 0x5, 0x101, 0x200}}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2404c854}, 0x4) 5.745070187s ago: executing program 0 (id=1743): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xfffffffffffffc7e}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0xffffffffffffff3e, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB', {0x1, 0x0, 0xfffc}}) 4.951953937s ago: executing program 3 (id=1744): recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x3a, [0xfffffff8, 0x0, 0x5, 0x10009, 0x8, 0x155f, 0x6, 0x2, 0x25cd, 0x401, 0xb4, 0xa, 0xb2b9, 0x26, 0x8, 0xe4, 0x6, 0xfc000000, 0x3, 0xbbf, 0x5000, 0x1, 0x48, 0x100d, 0x4, 0x12a0, 0x8000, 0x1, 0x7, 0x6, 0x7, 0x81, 0x40008a, 0x4, 0x2, 0x10001, 0x4, 0x91, 0x4, 0xe76b, 0x16, 0x2, 0xfffffff8, 0x401, 0xfffffff5, 0x405, 0xdb9, 0x81, 0x7, 0xf9a2, 0x80000001, 0xff, 0x2, 0x2, 0x2, 0x40000002, 0x7, 0x4, 0x7, 0x4, 0x4007f, 0xffffffff, 0x9], [0x3, 0x16e, 0x6, 0xf6ca, 0x4, 0xc66, 0xa8a9, 0x20000070, 0x8e, 0xd50, 0x7, 0x5, 0xfffffffe, 0x80d, 0x4, 0xa7, 0x1000, 0x0, 0x200b395, 0x5, 0x80000000, 0x4, 0x19, 0x7, 0x400001, 0xb14, 0x3, 0x8, 0xffffff7f, 0x402, 0x6, 0x4c2336d3, 0x96, 0x0, 0xfffffff6, 0x401, 0x6, 0xf1, 0x4, 0xab00060, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x0, 0x1ce, 0x1, 0x80000004, 0x80000001, 0x2, 0x2, 0x9, 0x95, 0x80000000, 0x4, 0xfffffff9, 0x40000003, 0x1000, 0x5, 0x5], [0x2, 0xfffffffe, 0xfffc, 0xc, 0x2, 0x2e6bf783, 0x5, 0x5, 0x400005, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x6, 0xee4b, 0x2008004, 0x1, 0x8000003, 0x5, 0x89, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10000a, 0x8000, 0x401, 0x3e55, 0x9, 0xd3, 0x8, 0x3437, 0x3, 0xd, 0x7, 0x601, 0x101, 0xdd80, 0x60a0, 0x1, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x6, 0x8000, 0x0, 0x3, 0xd500, 0x8, 0x77, 0x7, 0x6, 0x10000, 0x3, 0x8, 0x1], [0xa772, 0x6, 0x5, 0x1afa, 0xbfc, 0x8, 0x5, 0x7f, 0x55, 0x40, 0xbb3f, 0x1005, 0x1, 0x101, 0x1e, 0x9, 0x81, 0x3, 0x9d86, 0x9, 0xffbffff7, 0x8, 0x7, 0x5396, 0x939, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xffffffff, 0x7fffffff, 0x9, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x0, 0x3, 0xf, 0xe, 0x10, 0x26c, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0xf, 0x463f, 0x4, 0xdad, 0x8003, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) mount$afs(0x0, 0x0, 0x0, 0x14000, &(0x7f0000000280)=ANY=[@ANYBLOB="64794e45b6602c6e2c66"]) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ftruncate(r2, 0xf4ff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) 3.67031341s ago: executing program 1 (id=1746): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[], 0x48}}, 0x4000020) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="340000006800e97800000000ffdbdf250a000000000000000800", @ANYRES32], 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x24008000) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) getpgid(0xffffffffffffffff) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = socket$rds(0x15, 0x5, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r2, &(0x7f00000001c0)={&(0x7f00000017c0)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000280)=[@rdma_args={0x48, 0x114, 0x1, {{0x9, 0x2}, {&(0x7f0000000140)=""/116, 0x74}, &(0x7f0000001b40), 0x0, 0x21, 0x400}}], 0x48}, 0x4000) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000200), 0xca801, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000ffb000/0x2000)=nil, 0x2000}, 0x2}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) setsockopt$llc_int(r1, 0x10c, 0x1, &(0x7f0000000000)=0x8, 0x4) syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120141014813442024040075ee69010203010902240001000010000904b8070259d1ca000905060200020d0006090582"], 0x0) 3.60546595s ago: executing program 4 (id=1748): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x2, 0x5, 0x5, 0x7ffc0001}]}) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x10000) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r2) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000100)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r2, 0xc06864ce, &(0x7f0000000680)={r6, 0x10000201, 0x7, 0x81, 0x3, [0x0, 0x0, 0x0, 0x0], [0x3fd86826, 0xfffffffd], [0x0, 0x7, 0x9], [0x0, 0x0, 0xfffffffffefffffc, 0x9]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r2, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x0, [r7, 0x0, 0x0, r8], [0x2b8]}) ioctl$DRM_IOCTL_GEM_FLINK(r1, 0xc008640a, &(0x7f0000000080)={r7}) flistxattr(r0, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x0) 3.54227795s ago: executing program 3 (id=1749): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) syz_emit_vhci(&(0x7f0000000440)=ANY=[@ANYBLOB="040e0c010320"], 0xf) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf5c5d000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$unix(0x1, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000580)={0xffffffffffffffff, &(0x7f0000000480), 0x0}, 0x20) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000300)={'ipvlan0\x00', {0x2, 0x0, @broadcast}}) 3.386992034s ago: executing program 4 (id=1750): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x3, &(0x7f00000001c0)=0xfffffffd, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x2}]}}}, {0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_SREG_QNUM={0x8, 0x4, 0x1, 0x0, 0x10}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}}, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r0, &(0x7f0000000600)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9", 0x1}], 0x1}}, {{&(0x7f00000000c0)={0x2, 0x4e24, @local}, 0x10, &(0x7f0000000580)=[{&(0x7f0000000200)="340d7abf094f17a9be494fd8cb8efe7496d7a2eae78a1e3a767c298aa86bd9570122312308815f923b94cbacb8c9e5c415184d663a779529779b8cdcc8bdb69242a4561579cfa2ee9ff3cd753175df900a1f3bc6515cb5e3facf18173df5d5a7ca96f938f78018d7c70882e68c343a9ee5350eef3b62b956a5cb7cd1fb3def2094a9", 0x82}, {&(0x7f00000002c0)}, {&(0x7f0000000300)="80354d492fc55a960d93979660ff42457f8c", 0x12}, {&(0x7f0000000380)="9ad4bb5182402d28aeecfb1a527a009342a228dbdd85642a8943b847d1aee8fe29010eaa10ececc7a578e68929f9adeb95ec706928d892acd4b085f8d747634ba07af0e301ea20ba3b878614bc6604f7261f99e13d6bbf750be0102dec0a6c58f69c550d43ff8b557b65ca6e0419ad6b84bd6df8e477461cb1a4509d23f8ee352710bb89dd495fb4c0da46eebc958e3455bedab85ec572287cf678ae426ea3cf6cc76a9ac81b3f9c50ae2bdd5183d337727914d03086030345c14671e637", 0xbe}, {&(0x7f0000000440)="43e88cda3a861ff4942bf180e83336d0db4602eca42e615198c98e101a9ca11857e8f5bd1ec51f273877be099c4d918404979c554136561c409c6d6b10a36991abce92d27ad0225ef606c64847a2589f5317849e4c649c36379e8fa7615f7bea27c0c298ba0b1444e93cafbe8521ac3a262c121bcc550e538d6354378f7d1283", 0x80}, {&(0x7f00000004c0)="baadbbe9bafead7dd03132925606433f3605770ba382eee55dc10138eb06dacbe3cc0ceb537416df311458379df09e39b1702100212472530b0d65f7ec866b3aacabd5be5cccd3f5b80ce431cb29231719b829e70ef74aa80351845ca6a1dbc7835ab88d7a4f930c34c2e50e5e25d16827cae75aa48dd780510e04061ef5ae224bf08f531bef8090c0be029e2cf5d9c02ec522103d2f0ba71a0a919f0f28dd693410acb0c0e4d35e5abc", 0xaa}], 0x6}}], 0x2, 0x20008000) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000080)=@gcm_128={{}, "9005451377480361", "bbad434d19477339418b5b79f10c141a", "dc717b03", "72f2ea1a3290afcc"}, 0x28) 1.832402047s ago: executing program 2 (id=1751): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74f", 0x86}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {0x0}, {0x0}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e", 0x4b}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dc", 0xa2}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75", 0xd2}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91566b7f1725f39f", 0x1c}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000e00)="abc662f2a7dc713d226b612e712df36db5547daf508fb74a679224eba0fe5f05c53081", 0x23}, {&(0x7f0000000ec0)="6e20cbe6a4a132117801a95e6fd3ec5771da8352900bb19979b1", 0x1a}], 0x2}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1.685634302s ago: executing program 4 (id=1752): socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000010}, 0x200000a0) prctl$PR_GET_TSC(0x43, &(0x7f0000000040)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) recvmsg(r0, &(0x7f00000054c0)={&(0x7f00000002c0)=@tipc, 0x80, &(0x7f0000005380)=[{0x0}, {&(0x7f0000005180)=""/127, 0x7f}], 0x2, &(0x7f0000005400)=""/188, 0xbc}, 0x60) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$setregs(0xf, r4, 0x0, &(0x7f00000003c0)) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r5 = openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r5, 0xc0585609, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) write$cgroup_devices(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB="10008ffbcb4bf0dd40598874e660ded1fcc2815ccbb67cffa7e96f51769f0d94e543cd2e9e175a97af"], 0x8) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x8, 0x3, 0x538, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x618, 0xffffffff, 0xffffffff, 0x618, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x330, 0x358, 0x0, {}, [@common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', {0x6}}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x8000, 0x16a, 0x1, 'syz1\x00', 'syz0\x00', {0x80000001}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x598) syz_clone3(&(0x7f0000000740)={0x8180080, 0x0, 0x0, 0x0, {0x39}, 0x0, 0x0, 0x0, &(0x7f00000005c0)=[0xffffffffffffffff], 0x1}, 0x58) (fail_nth: 1) 627.022683ms ago: executing program 3 (id=1753): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xb4e02000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="e80000000001050500000000000000000a0000003c0002802c000180140003002001000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000100000000003c000180"], 0xe8}, 0x1, 0x0, 0x0, 0x4040081}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000400)='syz1\x00', 0x200002, 0x0) syz_clone3(&(0x7f0000000540)={0x4000000, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), {0x33}, &(0x7f0000000240), 0x0, &(0x7f0000000340)=""/69, &(0x7f00000003c0)=[r1, r0, r0, r0, r1], 0x5, {r3}}, 0x58) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3800000012002927000000000000008b050021"], 0x38}}, 0x4) sysfs$2(0x2, 0x4, &(0x7f0000000240)=""/42) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0xfffffffffffffe90, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f0000000740)={&(0x7f0000002000)={[{0x0, 0x0, 0x3}, {0x0}, {0x0, 0x0, 0xfffe}, {0x0}]}, 0x4}, 0x1) io_uring_register$IORING_UNREGISTER_PBUF_RING(0xffffffffffffffff, 0x17, &(0x7f0000000300)={0x0}, 0x1) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f00000004c0)=""/89, 0x1031000, 0x1c00, 0x0, 0x2}, 0x20) sysfs$2(0x2, 0x0, &(0x7f00000005c0)=""/150) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'macvtap0\x00'}) bind$xdp(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="9f88eeff171353d2ff0b00000002000000000000007ea81e9f4200"/43], &(0x7f0000000f40)=""/4088, 0x26, 0xff8, 0xa, 0x1}, 0x28) syz_init_net_socket$ax25(0x3, 0x5, 0x0) 626.356537ms ago: executing program 4 (id=1754): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b", 0x77}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {0x0}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a620982383e84178b017ba52b", 0xc3}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4", 0x49}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dc", 0xa2}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75", 0xd2}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91566b7f1725f39f", 0x1c}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000e00)="abc662f2a7dc713d226b612e712df36db5547daf508fb74a679224eba0fe5f05c53081", 0x23}, {&(0x7f0000000ec0)="6e20cbe6a4a132117801a95e6fd3ec5771da8352900bb19979b1", 0x1a}], 0x2}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 506.917054ms ago: executing program 2 (id=1755): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x44, 0x4, 0x2, 0x400}, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000480)={r0, &(0x7f0000000400)}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x44, 0x4, 0x2, 0x400}, 0x50) (async) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000480)={r0, &(0x7f0000000400)}, 0x20) (async) 231.595248ms ago: executing program 1 (id=1756): bind$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) ioctl$PPPIOCSMRU1(r0, 0x40047452, &(0x7f00000000c0)=0x3c9d) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x2) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0xfeffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000001c0)="80fa", 0x0}, 0x4c) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002d40)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff48700000020000005c0000000000000095000000000000002ba728041598d6fbd307ce99e83d24a3aa81d36bb3019c13bd23212fb56fa54f2641d8b02c3815e79c1414eb07eae6f071326bd9174842fa9ea4318123341cf9d90a0e168c1884d005d94f204e345c652fbc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc84e974a22a550d6f97181980400003e05df3ceb9f1feae5737ecaa81d666963c474c2a19eed87b277be335c75e04ad6ee1cbf9b0a4def23d410f6296b32ae343881dcc7b1b85f3c3d44aeaced3641110bec4e90a634196508000000000000f0f4ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d4dcecb0c005d2a1bcf9436e101040000f73902ebcf0200822775985b231f000000ccb0ecf31b715f5888b2a858ab3f11afc9bd08c676d2b89432fb465b3dad9d2aa7f1521bc9901de2eb879a15943b6dc8ea15aab9dd6968698e3095c4c5c7a156cec33a7bb727667d81ff2757ca1e6bfdd4c968dacf81e65998b9091957d1d11a5730baa3a509b1041d06f6b0097c430481824a3f4fddd3c643f630ba165d876defd3541772f26e27c44cfd7bb5097379cf1756869cebc7b0b2d85d6d29983e830a9cdd1d0a017c100344c52a6f387a1340a1c8889464f90c284a4db539621fbb70f01a2c02dec4cd1f570dd39877dfb2ff1ae66e1ce917474b2e650ae610afd01409d9a337ac5d58bcb5e5fc231514952c5255f22bd8b325d9b76e57f041b665ab0249886c0a65cc99d5893521372c8d8b7bacac24000020a4a24d8dbd75062e1daef9dead619cc6e7baa72706287793c3d2a2661edcd3545236c204682bf7ecbd53f950ef4709ec01e230d2f53594ef4839c6130c4c13a0cca84b993508000000e480cd9d4850a049ee19b67d17ef0477aeb12b1d2502000000d9051f22614d1f62734d678039a97d2b74f9e8e97f4e8e7025123e783df8b8a17e3aa9fe9c502f9acee4f1b56e1f23128d743792cead3c058a5b700d64d160abe33df726608510136ce8bf239414a1d98ea93e3d35dbb6c23b90cf36e83b8a4309b402d264b09f2779a0bcd7cd6dfc06b02e69d384146056d125cf4aadd80800000000000000e88d10acd06864eac44c42fbe334bdc3e9768fc360b130dc6111fe3293e8e02f819a2aa34dba1c25be27945507a3477b437525b81aef2f0b4c4f63483026b5e34d44705b76ef29f7f6e0a2be625eae975e02069f6f24e1e1bc976d965ddabb01085f16bff63a06578d6d184f5de7bfb6aaa75f16996d8d60bd0111a8a237a1536256c02284cb1d3a6fb8eae87691fae365a70c3f15871565bba8dd8a8ca049f798bbe646f738bebdfc9d8a5edd7a19ca6a42bc3f1db37c17f22a287c6d31a13db5dfef409eb1d3c91c6e6f80d215c9e16e0c4736c81936315418f26770cca4e2f89800d18c89d7f46f679df6c9e2005f209dda94302a30003b952ae1ebfd0ca88368ee6ce139e8b5822422cf4c9dde943d34c432e1001171792c65986146666a549092398af45ba38c41df7e0fffeac41824ca1fd0eb68aa243c9035c788d5480e5aee9cde5f2e5a3628995b1531bd20360d33d8f9ffffff5f4bf6ea8a1850c4f83306dbca02ee3686da707b6d85db491ba0cc33f6be92c55969a2b52a25419d1476c73132ca7ca26ce8a7e3ffb700f09e157f9bc31f09834b4788be2a442aa81b259e9eb1bf5314844051f3a642aca9ff98c9036471ccff0522903e7bcf62e18f7796bbc280b95e8e0d6fd5644b0ebde330289d6348d183ed9d3dae3cccf109f7c78e8479a345e805e47dfa82cafc6b64b1f4659834aecbeded44b11a443c5ba92a326dd10921aa79c62800844c7a59f55ee205a11ab50fb402e7da6ada561ec1117cc186b01fd5c2061d22156b1b7d5f80c580dc31b0963ff953ce09148e8dfea9d03a61bbd2bb173518507a3cd0e37c4da0a71eee31071d5d642498181c69cee3b2e414ddd6a12ff4bdf6e96c247b6025d4376067e25357d3b521a5b927d3392a7503718aea24179528f6a0c6de4e61b49cad1e4d6b000000000000005b2d16877299acefc0655bc1422c3d425d988eedebcf242b780a687c9acae2a5a71c2a16a32ceb377f5d54f9b2fa90b2905925e611be56e9ebe20cab20c290a1f6c09272dbc3b2c0ab2b5baa1b07b16e81f278e54a479f1a06bc06e3656cfa196d6c050000000000000000814955c62a7d72b317399e572a7f6a4d57b741eb66c9179ffd097d61fcfd0fa1d46cfb110e3e8cff5579e83f2820f95eaa0c609f666950c24311740e36de8f65708cfffce788c99ef8f62fd2398e999b220125da8eb07947512365abbc5b84ef524bdf184727c67910051f204662264607d548dbdffe14b41dd0843cf3d85bb820656a88a9e52a4cd7b3eeadfe00007267f226019ef0a25bc15da71e893856a2182c3167d8ba73f709294b159a426ce44cd73f000000a66fc501eae0c3504c1400697ba69fd9b7eaf49aff6a6aea529610db8dfef86c3cc698e9fddf1b132876159972281a90c3a4cf415df25fbcdd35cf8368f068c4481844bdd0dda553e1cb0966d5686013d382956d50055dce0d1bc225c1d77612b1ec52e743dbc51f25cc07a202b704577316913cf067fa65e476f688de2d6c54ea192a569eed05d0d7536b3205c68d4ee0fe318ed3112c76dcf128a1d5595b773ef4c8a7ba4e10381de8808ff02dd0a7b996ecf1c65e6d9db90c87123d9cb3945330f7a270ee0cca35b1331ca8fec0b2f39f505140751b60f29a83e4bc0ef2ffea443e4aa221cc38a503add16a2c98cb589e1dac1912b4142a3be30f50b2d9479c5bde0beb38030d0c0ce0598700130000000000000000000000554361e1628ee0017ad19ca787f2c078aa260701ce0800000080623902000000000000000000003d118a04fa6a80c4928c01ccab57b5f4eb265ad15004f967543fe6e6ddc2a12165fe3a08bf9475ee0eee3539369b0e566fedbd215a6ddd4fe03dcc7a922e16410d820747b7e806c0f3b6f14c884d150a0ff07f2e0000bfb083c56d3bed0a61fab880f8885c612ebff8523d14cfb12aca274c000000005e5155611969f6e67dd83b20206207cb8b2cd2fab6fa6d7fdaed6a27a2e4db1d5adc80014ff11d9dbceba41d8dfce410333a054e82b1d050331ce0aeacb843b94d67f69f49eb4dd3b1b85b018359c32df01db8ebce0dbc36cade09c6b44f6bb956fac1ae4db5624d8a02f7be91bec65e4b3373059587dd6528bbc48e3379d477d482faff738c39c61cac1195043bd5b70cea5fc1083a169a8263e9aec56b9f7795fa27634a7f06359e3058d2dd69c4e5cc11b36d9ed9c4b2867f583de6fc582f789722bd1500e64c495abdb72de2c739d38c72f6f4fb1946081dcc825d5b5b747e9fa1b5226cd31e131263f1fcd7d45a630b46d04af906f0be464d829dd2dfcf7400002b7827f6d957e51bb1f1b44a50200c9dfadfaff2e32baa9c0edaac7144e174dba582a951d2b03c27219cec4fbc7b6e99c3f00188941e3fbf008cbace177ae250fd757a22e21ec05aa45c91e1345ca936184c3fc28153283e13654123cfaf4e661f4b6d430adad1e2116bc385f888405d48f0d386da0cc6747b33395772a68f2ea3fb7e7207000000b24088014c8e64f03d053c4e02ddd08b262e422eff1c9f124b892b0a9462b07d4f88c0693bd9c54ad2ab5227aa59ef2b53ac528c0800000000000000ebfde0c4a37c2d55c176680c4207000000e4aa467f995c9bc99e60441d4dbebead3b436427762618810bac7308c6d3298ea932b66572825e62d18462d3b2342ba48c145ff4674a94fa078cc552d064da2bb69a0d269076f8955076578f44ffb8895f11bd5e06840f8848df72230a28e0304569bfa0350b6dde9e96273de1758505aa1ba89dfb12be7a7c6dd18f6148354df7e60a489dc543ccdee1fff9d8f8d78844de27a77ef1181d5055c2a193a5763ed7749a17296c76818b60426082c86619dacc8a884c4de8572a044faf0c8e4377776c8703ecf2e3f1c3d64100cc000000008369f062639e3ddcf725be54f626448fb7bfc74c183b26e31b71a390ccea4be07278dd12fa16848797397b76908fa03613cd961b98b26a0879ccba4a78c82958764bce07a7f70df1cef6d4db1ddbda1db18e4f41c390fd3cb862216ece39a9ec60bd3be5f9329dcaf33bf2c87cc510557460d14421e1d26322ab64388f2ceae70922989f66827fe9acd2ec3ece39f3b4ffdc4dfea3da6ddb002512e2313253801044e751168e32d7bd6800000000a21008b8d26dabe977c503c30ef7c489e5ea1fff041e54de54cfeb258f2387dad096b72a78d91134927492cfc773c731cca9b13b3f6e7760ab0929c46f51ea5643f3df4f4044f3ad0a6ba739e72d8b8b2935d81534bea8372bc590c111d573e04280659a096eaa495a4154daae7d1800c130d920964845c50c8ba4763b19b6008f6d7a5091895c7a4b7816ab706503be879b18b778b0f61ecfde2f8bbb32cfeb766ec4430ee0ad45a0a263ddc4b2f47680c8d53439f8d388dab87112c83997c83e178be287eb6e8c95badaf8ed85cd5b03a7352a0fb83398566d1bc133582ce2d9f601cd23eba4432180b2d5c3019879cd949a5be1b241b3d0d0d52a3529cc9e704a9d8d54f4f7b776a969a4505e18fe5284985ca7d112c397d776e3baba918b7df456bd970e761e00f3b0efa5ce4246d9f08ba60da3be556c518a1f19504c7cea1491a9eadd27d747ca9cc5f92e30b2ca3cf0b142a8554c87e8026d4e586cf5f7c9d412e6eb4f66a076c8bca6b294305969dabb6c932b57a5dd4234bf1ed3bd095229ee3cbb86883d574c5af4bb78370561de3fbf55bfcd2db3979eb1be120b5795443324023353c959fd965702f1cd5bcb3c16d4b8bdd9fc87c862c247e140379ef098c7b3fa79a6638a245b6a74f14dde9bd4ee48e62cdc70f486ce38641e4e4309aa9f4bd097fa1530db966d9919544ab4890301e51f9525436f5d9591460340f5093161a78a249783945407f2576d6f35a99e3521d7991e3fdfde5ee7f6a8ff8181a68ef15a2ebfe9e22d7c745949ab5cc15b9f5659799b5e00debbf9f623f75bfd4d83c4859ca9b652cea33daeeef07b60c78a21965bcf91919071c7ded19317dc0b7587d9322f8cec9e32675a187465bdfa101bcd9ac680839b375af12c160247dd960e70eb7ee60c52a900440aa9bd9a6b15a4a34dc73c3c4936d8986300fdc264b28537df387e6442c3355fa2a31d24c1ed888a57fcc50400a084a38a3630ffc465f36a4b770fab0946148161184be39134542e934f3a538b011cb3928b430630b8ccc800000000881d4361e7fbd1fc2331b4e34733480bc497662a8234a7eeab3e65d6b0f5d92edff04416eedcd15b9ddbcb3cf9228afda6b17d44a276b205eabd0069f7e26aea50f537dc77b683ed83d2f9110e00a705f48e9d13378cf09bca22e8f45c4f360d5fff8ba35f21c4513bcc0800000000000000dc5cc7ad7290c60bc609bff9be7cd922f474c3faa78fd42cba7c78d6d912656b6313497625e2f9afaba05b17ca242b7ca8d6556175aee38142a8aac5f677c2f8a6967f2cb5e97aae97a5e5579a706243688ac4d38a4601b4aadb2d319fe7d6bf1272fa3fa701338d7bce390e8bf959081ed39e63a431901d615a26ff95e1620a6c26eda4f92d83499a173e7217001f58ed5406bdb59acbc997e8fd3d53b4c2c2a1b314bfe611e5958458af7b3c5319fdb4c40b8d01365fdee93af6fad7c7a8da86460f45c9e99d43264c921b090000000000000000000000000000000000007cf90000008f8a9da7a8a167815c6ffcd1b6863cde9ab45ecd8f06423198bb00cdf76877f407be46b000000000afbb4cb3a8de259a8beb2223f28b855e2bdf4b31b91e5062a42a55bd95e93f77f2499391cf0000000000000000000000000000195007ad27d1d61dc4d5512f117f0ed554c2c88c1713000000000000bb1ff447d6e12da22ee9f0422a84f361684861169f498909c4841f4d5a0f5807a3b7d833075fdcd9c1d169b03d7df7f4150fad8b9e92eaf86992adbda360dd91de51c6df335445492608162fb0804dabdeac6fb71042f906eefd37f1d190a1c8a0d9de7f34dcc8cbd7b565fc675f3bf7aac559411808ee703ec3ad461c6ddc571994cb504c46eabbc2ff4b97df394bc75b5e7f45b4450753b5d2b8b8414a7fe6a17661bdb5b1d080cfd974811e1d60763d8d9509c75aa729a334b55ee76b0c2d5027e81ceec1a6d7441d0b538d7a4d048d156ebcff102e45c15d2a73b40d74807f5182a319d50edbf430f00b1c29a9e4bd92111caacbb1d4541545c2d262646070da42f76e3f3c6d139eed89cc9300000000000000000000000000000000000072d7e605eb8e978d76796d9d3a728c51a3145da8e1ca4973aa8fed855328e9d2509335c5386cac74e862eac50e9ba95b6a2a29e8ef08a9ae29792e77fb9952b1ac5c816db5c23a656d9a28f81f6a9465aec94d701ee8646b30650c84b9510a337e82702baf368d29281d3d54b39014756ca5a1be184d4ebb942f99581a6fbac0b9c9f97c920dfac7e2379ef6bb076118aa9bbb4ee12e64aa530f852bf4f970a08a55531934e39fbae483129949a918115571d76740ca6a1cea59df290f2e63675ca30a289775825fe3e5d6f206f3f395346c0738035dc74368bb035fc65a40f8124369b8950ded31af64855cb18b23517ca935a0fa1b630d70c4ca9acbaf0f08910f327fba506d834029a90d47701102045fff90675adb3c83983d125ae730b9497c681a912a6bb70300a2d7fba051f82b9d6f710426b5bd0d0bc0b08a0f801276789613da406905011bd6ebbac91ff17a21d1ed0882e73394025772f31dc8a3048789c703f920c55746f6fc955046f9332d72150be23c26cbb08d1b438e84b83fefc6a16958fd46dc7b8cbea1da2d541324e373e9157696d698a0b4bc84d7cc2fdb069db8a5a491a9d2bbc0a61b73f75d81d07d778a1577db3b06d20a21b19ea17ecd996d7dea947ee8ce55fa2dea5a000000000000000000000000006f0143d8d4038ef9f57d9e9336f3559558710d1febe7394cf8b02f59dab24d07db3d3c1ebff58f973ba3fc0c3e2fb2c2a674a188614520ecb1d22b49e3550263bf9d669fba198b65ee3512db0e710d2070b5847face7ada12c83f0aea3a8c9e84e6c7406732c952c5695d43bca33d481ef9d442697875e114f4c759af306b3fc8224fdec89bf199234bff488b81438cbe89e4cabdc007139352b5cb69d7987cdf37ab549b7639eeadafd5315d9c9f0e8c9223102e6deaca4ae9cb943a3ad188bcad95e8f97d7fee7c47ea50d222fe67085b4fb3fecfb67dec23b6ab5ee19a5ca5367bff058149acf90a6c4014dea2b763389f77301ea8574d112625300906f480c36f41f82f84991800c37863de349f7"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffe89}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002c00)={r3, 0x18000000000002a0, 0x42, 0xfffffffffffffec1, &(0x7f0000000500)="b9ff0300600d698cb89e14f008001f000c0cae0e4000632177fbac14140ee934a0a662079f4b4d2f87e5feca6aab845013f2325f1a39010108038da1924425181aa5", 0x0, 0x100, 0x60000000, 0x5c, 0xfb, &(0x7f0000000000), &(0x7f0000000280)="8dc92a8ff39080a675b6565efa3ed46f2a2756e4686c04020000002599fc2b73f432c834dac249597b646035045af99decf86f5b32dc0404e599f56091e15e581ff6805ee283c0313298a5b8ba1c84f1850c217b5a2c2bc547eaf4585e5ba878d1660fa871a275fb61d1fec75942919083919f8d8fdad79615bc06003fa40e054d38d49dfbebc2f137fc7110f48727f3ac3d6c83f6fda9222d2acdb0b3b9374206648707f4f5aeabd986d5f491389e9114ba8bd9aeeeed448e227802a455d6ba62aebeebc45885165e2501c30dc33fa47f5627e572e86278239ca2d8aeec7a25c43448bce8000000"}, 0x3d) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2, 0x2000}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x10, 0x0, 0x0, 0x4}]}}, 0x0, 0x42, 0x0, 0x1, 0x8}, 0x28) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x300, 0x9c, 0x39, 0x7c, 0x40, 0x979, 0x270, 0xbf6b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x2, 0xc, 0xc0, 0xfa, "", [{{0x9, 0x4, 0x38, 0x0, 0x0, 0x81, 0x82, 0x19, 0xa}}]}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x404c2, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r2, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x30}}, 0x0) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), r1) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'gre0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x80, 0x7800, 0x7f, 0x207, {{0x1a, 0x4, 0x1, 0x2b, 0x68, 0x66, 0x0, 0x4, 0x4, 0x0, @multicast2, @private=0xa010102, {[@timestamp={0x44, 0x28, 0x58, 0x0, 0x3, [0x9, 0x9, 0x2, 0x7, 0x6, 0x4, 0x400, 0x3, 0xfffffc01]}, @timestamp_addr={0x44, 0x1c, 0xc0, 0x1, 0x6, [{@rand_addr=0x64010102, 0x7}, {@broadcast, 0x5b52}, {@dev={0xac, 0x14, 0x14, 0x16}, 0xffffff94}]}, @generic={0x83, 0xa, "bd0133844dad1337"}, @generic={0x44, 0x4, "4b80"}, @noop]}}}}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000001c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, &(0x7f0000000200)=[0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0], 0x0, 0x28, &(0x7f0000000280)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f00000002c0), &(0x7f0000000340), 0x8, 0xc, 0x8, 0x8, &(0x7f0000000380)}}, 0x10) sendmsg$FOU_CMD_GET(r1, &(0x7f0000000640)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f0000000580)={0x44, r4, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@FOU_ATTR_AF={0x5, 0x2, 0xa}, @FOU_ATTR_PEER_V4={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}, @FOU_ATTR_IPPROTO={0x5}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_IFINDEX={0x8, 0xb, r5}, @FOU_ATTR_IFINDEX={0x8, 0xb, r6}]}, 0x44}, 0x1, 0x0, 0x0, 0x810}, 0x4000) 225.834928ms ago: executing program 2 (id=1757): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f0000000040)=0x2, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102400, 0x19000) r3 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, 0x0) ioctl$SNDCTL_DSP_GETODELAY(0xffffffffffffffff, 0x80045017, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100) ioctl$TCSETS(r0, 0x40384708, &(0x7f0000000080)={0x4, 0xfffff001, 0x9, 0x8000003, 0x20, "3eccd2000500000000000e00"}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xf0ffffff) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, &(0x7f0000000380)={0x353, 0x78, 0x3c0, 0x0, 0xa, 0x0, 0x0, 0x4, {}, {}, {0x0, 0xffffffff}, {}, 0x0, 0x0, 0x3, 0x1, 0x1, 0x4, 0x9f6, 0x6, 0x7, 0x803d, 0x100, 0x7, 0x5f, 0x202, 0x1, 0x7}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r7, 0x4004ae99, &(0x7f0000000040)=0x3) 183.096515ms ago: executing program 4 (id=1758): open$dir(0x0, 0x480, 0x10) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) r0 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r0, 0x7) landlock_restrict_self(r0, 0x9) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x5) landlock_restrict_self(r0, 0xa) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x4000, 0x3, 0x2}, 0x18, 0x0) landlock_restrict_self(r1, 0x2) r2 = landlock_create_ruleset(&(0x7f00000001c0)={0x2fbd, 0x1}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) link(&(0x7f0000000140)='.\x00', &(0x7f0000000180)='./file0\x00') 0s ago: executing program 4 (id=1759): r0 = socket$netlink(0x10, 0x3, 0x8000000004) capset(&(0x7f0000000c00)={0x20080522}, &(0x7f0000000140)) (async) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000280)="580000001400192340834b80040d8c560a0677bc45ff810500000000000058000b480400945f64009400050028925a01000000000000008000f0fffeff60a461e700fff5dd0000001000014001080800418e00000504fcff", 0x58}], 0x1) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) r1 = socket(0x10, 0x2, 0x0) r2 = epoll_create1(0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) io_uring_setup(0x135, &(0x7f0000000180)={0x0, 0xc4af, 0x2, 0x1, 0x14e}) (async) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r2, &(0x7f0000000000)={0xa0000001}) (async) epoll_pwait(r4, &(0x7f0000000040)=[{}], 0x1, 0xff, 0x0, 0x0) (async) close_range(r1, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): re name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 329.333017][ T9796] Call Trace: [ 329.333024][ T9796] [ 329.333031][ T9796] dump_stack_lvl+0xe8/0x150 [ 329.333061][ T9796] should_fail_ex+0x46b/0x600 [ 329.333088][ T9796] _copy_from_user+0x2d/0xb0 [ 329.333106][ T9796] ___sys_recvmsg+0x175/0x590 [ 329.333132][ T9796] ? __pfx____sys_recvmsg+0x10/0x10 [ 329.333174][ T9796] ? __fget_files+0x3a6/0x420 [ 329.333205][ T9796] do_recvmmsg+0x33a/0x800 [ 329.333232][ T9796] ? __pfx_do_recvmmsg+0x10/0x10 [ 329.333268][ T9796] ? rt_mutex_slowunlock+0x1cb/0x300 [ 329.333305][ T9796] __x64_sys_recvmmsg+0x198/0x250 [ 329.333328][ T9796] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 329.333359][ T9796] do_syscall_64+0x14d/0xf80 [ 329.333376][ T9796] ? trace_irq_disable+0x3b/0x150 [ 329.333395][ T9796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.333412][ T9796] ? clear_bhb_loop+0x40/0x90 [ 329.333433][ T9796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.333449][ T9796] RIP: 0033:0x7fef954dc819 [ 329.333466][ T9796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.333480][ T9796] RSP: 002b:00007fef93736028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 329.333498][ T9796] RAX: ffffffffffffffda RBX: 00007fef95755fa0 RCX: 00007fef954dc819 [ 329.333511][ T9796] RDX: 040000000000012d RSI: 0000200000000080 RDI: 0000000000000003 [ 329.333523][ T9796] RBP: 00007fef93736090 R08: 0000000000000000 R09: 0000000000000000 [ 329.333534][ T9796] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 329.333544][ T9796] R13: 00007fef95756038 R14: 00007fef95755fa0 R15: 00007ffc7cc9e3d8 [ 329.333572][ T9796] [ 329.874772][ T36] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 329.903865][ T6000] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.020102][ T36] usb 5-1: Using ep0 maxpacket: 32 [ 330.033015][ T36] usb 5-1: unable to get BOS descriptor or descriptor too short [ 330.034623][ T36] usb 5-1: config 1 interface 0 altsetting 249 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 330.034651][ T36] usb 5-1: config 1 interface 0 altsetting 249 endpoint 0x81 has invalid wMaxPacketSize 0 [ 330.034671][ T36] usb 5-1: config 1 interface 0 altsetting 249 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 330.034693][ T36] usb 5-1: config 1 interface 0 has no altsetting 0 [ 330.036950][ T36] usb 5-1: New USB device found, idVendor=05ac, idProduct=0259, bcdDevice= 0.40 [ 330.036975][ T36] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 330.036992][ T36] usb 5-1: Product: syz [ 330.037004][ T36] usb 5-1: Manufacturer: syz [ 330.037016][ T36] usb 5-1: SerialNumber: syz [ 330.418291][ T9812] FAULT_INJECTION: forcing a failure. [ 330.418291][ T9812] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 330.418323][ T9812] CPU: 1 UID: 0 PID: 9812 Comm: syz.2.1405 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 330.418343][ T9812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 330.418353][ T9812] Call Trace: [ 330.418360][ T9812] [ 330.418367][ T9812] dump_stack_lvl+0xe8/0x150 [ 330.418399][ T9812] should_fail_ex+0x46b/0x600 [ 330.418427][ T9812] _copy_from_user+0x2d/0xb0 [ 330.418445][ T9812] ___sys_recvmsg+0x175/0x590 [ 330.418471][ T9812] ? __pfx____sys_recvmsg+0x10/0x10 [ 330.418514][ T9812] ? __fget_files+0x3a6/0x420 [ 330.418551][ T9812] do_recvmmsg+0x33a/0x800 [ 330.418579][ T9812] ? __pfx_do_recvmmsg+0x10/0x10 [ 330.418611][ T9812] ? rt_mutex_slowunlock+0x1cb/0x300 [ 330.418649][ T9812] __x64_sys_recvmmsg+0x198/0x250 [ 330.418672][ T9812] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 330.418703][ T9812] do_syscall_64+0x14d/0xf80 [ 330.418721][ T9812] ? trace_irq_disable+0x3b/0x150 [ 330.418739][ T9812] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.418756][ T9812] ? clear_bhb_loop+0x40/0x90 [ 330.418776][ T9812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 330.418793][ T9812] RIP: 0033:0x7fb5f2bec819 [ 330.418809][ T9812] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 330.418823][ T9812] RSP: 002b:00007fb5f0e46028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 330.418841][ T9812] RAX: ffffffffffffffda RBX: 00007fb5f2e65fa0 RCX: 00007fb5f2bec819 [ 330.418853][ T9812] RDX: 040000000000012d RSI: 0000200000000080 RDI: 0000000000000003 [ 330.418865][ T9812] RBP: 00007fb5f0e46090 R08: 0000000000000000 R09: 0000000000000000 [ 330.418876][ T9812] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 330.418886][ T9812] R13: 00007fb5f2e66038 R14: 00007fb5f2e65fa0 R15: 00007ffc96e5da28 [ 330.418914][ T9812] [ 330.494455][ T9801] netlink: 'syz.4.1402': attribute type 1 has an invalid length. [ 330.494475][ T9801] netlink: 760 bytes leftover after parsing attributes in process `syz.4.1402'. [ 330.514355][ T36] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input80 [ 330.610079][ T5856] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 331.037954][ T9818] kAFS: No cell specified [ 331.080514][ T9818] overlayfs: missing 'lowerdir' [ 331.083392][ T5808] Bluetooth: hci5: command tx timeout [ 331.084688][ T5148] bcm5974 5-1:1.0: could not read from device [ 331.554508][ T5856] usb 4-1: Using ep0 maxpacket: 8 [ 331.570930][ T5856] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 331.570956][ T5856] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.570972][ T5856] usb 4-1: Product: syz [ 331.570984][ T5856] usb 4-1: Manufacturer: syz [ 331.570996][ T5856] usb 4-1: SerialNumber: syz [ 331.593576][ T5856] usb 4-1: config 0 descriptor?? [ 331.616347][ T5856] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 331.616392][ T5856] pctv452e: pctv452e_power_ctrl: 1 [ 331.616392][ T5856] [ 331.616435][ T5856] usb 4-1: selecting invalid altsetting 3 [ 331.616447][ T5856] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 331.616447][ T5856] [ 331.616461][ T5856] dvb-usb: bulk message failed: -22 (5/0) [ 331.656667][ T5856] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 331.676193][ T5856] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 331.676256][ T5856] usb 4-1: media controller created [ 331.676302][ T5856] dvb-usb: bulk message failed: -22 (8/0) [ 331.676316][ T5856] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 331.676358][ T5856] dvb-usb: MAC address reading failed. [ 331.689810][ T36] usb 5-1: USB disconnect, device number 34 [ 331.757206][ T5856] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 331.814470][ T5808] Bluetooth: hci3: unexpected event for opcode 0x1c58 [ 331.992470][ T9806] netlink: 'syz.3.1404': attribute type 4 has an invalid length. [ 332.025578][ T7802] udevd[7802]: Error opening device "/dev/input/event4": No such file or directory [ 332.025701][ T7802] udevd[7802]: Unable to EVIOCGABS device "/dev/input/event4" [ 332.025799][ T7802] udevd[7802]: Unable to EVIOCGABS device "/dev/input/event4" [ 332.025895][ T7802] udevd[7802]: Unable to EVIOCGABS device "/dev/input/event4" [ 332.025990][ T7802] udevd[7802]: Unable to EVIOCGABS device "/dev/input/event4" [ 332.185243][ T5856] DVB: Unable to find symbol stb0899_attach() [ 332.185258][ T5856] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 333.629145][ T5808] Bluetooth: hci5: command tx timeout [ 333.678604][ T6000] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.702301][ T5856] rc_core: IR keymap rc-tt-1500 not found [ 333.702321][ T5856] Registered IR keymap rc-empty [ 333.716007][ T5856] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 333.718812][ T5856] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input81 [ 333.727535][ T5856] dvb-usb: schedule remote query interval to 100 msecs. [ 333.727555][ T5856] pctv452e: pctv452e_power_ctrl: 0 [ 333.727555][ T5856] [ 333.727565][ T5856] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 333.744677][ T5856] usb 4-1: USB disconnect, device number 40 [ 335.352282][ T5856] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 335.942367][ T9851] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1412'. [ 335.942391][ T9851] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1412'. [ 335.942423][ T9851] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1412'. [ 336.042253][ T6000] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.217565][ T9857] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1410'. [ 336.490358][ T9857] hsr_slave_1 (unregistering): left promiscuous mode [ 337.491357][ T9724] chnl_net:caif_netlink_parms(): no params data found [ 337.586548][ T9889] netlink: 'syz.2.1416': attribute type 8 has an invalid length. [ 338.879903][ T812] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 338.965247][ T9919] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.1422'. [ 338.980703][ T9724] bridge0: port 1(bridge_slave_0) entered blocking state [ 338.980958][ T9724] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.981180][ T9724] bridge_slave_0: entered allmulticast mode [ 338.983607][ T9724] bridge_slave_0: entered promiscuous mode [ 338.988547][ T9724] bridge0: port 2(bridge_slave_1) entered blocking state [ 338.988676][ T9724] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.988862][ T9724] bridge_slave_1: entered allmulticast mode [ 339.029836][ T812] usb 5-1: Using ep0 maxpacket: 16 [ 339.045276][ T812] usb 5-1: config 127 has an invalid interface number: 124 but max is 0 [ 339.045300][ T812] usb 5-1: config 127 has no interface number 0 [ 339.045327][ T812] usb 5-1: config 127 interface 124 has no altsetting 0 [ 339.047848][ T812] usb 5-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=36.87 [ 339.047874][ T812] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.047891][ T812] usb 5-1: Product: syz [ 339.047904][ T812] usb 5-1: Manufacturer: syz [ 339.047916][ T812] usb 5-1: SerialNumber: syz [ 339.104857][ T9724] bridge_slave_1: entered promiscuous mode [ 339.118544][ T6000] bridge_slave_1: left allmulticast mode [ 339.118736][ T6000] bridge_slave_1: left promiscuous mode [ 339.119560][ T6000] bridge0: port 2(bridge_slave_1) entered disabled state [ 339.236181][ T6000] bridge_slave_0: left allmulticast mode [ 339.236210][ T6000] bridge_slave_0: left promiscuous mode [ 339.236519][ T6000] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.379939][ T36] usb 3-1: new full-speed USB device number 37 using dummy_hcd [ 339.557875][ T36] usb 3-1: too many endpoints for config 0 interface 0 altsetting 2: 254, using maximum allowed: 30 [ 339.557925][ T36] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid maxpacket 18139, setting to 64 [ 339.557949][ T36] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 339.557973][ T36] usb 3-1: config 0 interface 0 has no altsetting 0 [ 339.558003][ T36] usb 3-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.00 [ 339.558022][ T36] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.568087][ T36] usb 3-1: config 0 descriptor?? [ 339.570070][ T9926] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 339.945475][ T812] usb 5-1: reset high-speed USB device number 35 using dummy_hcd [ 339.982389][ T36] ryos 0003:1E7D:3138.000F: unknown main item tag 0x2 [ 339.982422][ T36] ryos 0003:1E7D:3138.000F: item fetching failed at offset 2/5 [ 339.983103][ T36] ryos 0003:1E7D:3138.000F: parse failed [ 339.983166][ T36] ryos 0003:1E7D:3138.000F: probe with driver ryos failed with error -22 [ 340.260465][ T9926] hpfs: Bad magic ... probably not HPFS [ 340.272159][ T9926] hpfs: Bad magic ... probably not HPFS [ 340.422728][ T36] usb 3-1: USB disconnect, device number 37 [ 340.703957][ T6000] smc: removing net device bond0 with user defined pnetid SYZ2 [ 340.741439][ T6000] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 340.803575][ T6000] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 340.832208][ T6000] bond0 (unregistering): Released all slaves [ 340.910396][ T9953] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1418'. [ 340.971419][ T9724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 340.990485][ T9724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 341.081027][ T9724] team0: Port device team_slave_0 added [ 341.084087][ T9724] team0: Port device team_slave_1 added [ 341.132500][ T9724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 341.132516][ T9724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 341.132548][ T9724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 341.134664][ T9724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 341.134677][ T9724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 341.134701][ T9724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 341.243691][ T812] usb 5-1: failed to restore interface 124 altsetting 11 (error=-71) [ 341.262630][ T6000] : left promiscuous mode [ 341.309026][ T812] usb 5-1: USB disconnect, device number 35 [ 341.402430][ T9724] hsr_slave_0: entered promiscuous mode [ 341.403548][ T9724] hsr_slave_1: entered promiscuous mode [ 341.404509][ T9724] debugfs: 'hsr0' already exists in 'hsr' [ 341.404530][ T9724] Cannot create hsr debugfs directory [ 341.571041][ T5980] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 341.602254][ T9] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 341.722239][ T5980] usb 1-1: Using ep0 maxpacket: 8 [ 341.726380][ T5980] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 341.726409][ T5980] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 341.726443][ T5980] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 341.726463][ T5980] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.755088][ T5980] usb 1-1: config 0 descriptor?? [ 341.778703][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 341.793737][ T9] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 341.793764][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 341.793781][ T9] usb 4-1: Product: syz [ 341.793793][ T9] usb 4-1: Manufacturer: syz [ 341.793804][ T9] usb 4-1: SerialNumber: syz [ 341.803679][ T9] usb 4-1: config 0 descriptor?? [ 341.841683][ T9] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 341.841712][ T9] pctv452e: pctv452e_power_ctrl: 1 [ 341.841712][ T9] [ 341.841740][ T9] usb 4-1: selecting invalid altsetting 3 [ 341.841747][ T9] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 341.841747][ T9] [ 341.841755][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 341.951371][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 341.957979][ T9] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 341.958077][ T9] usb 4-1: media controller created [ 341.958120][ T9] dvb-usb: bulk message failed: -22 (8/0) [ 341.958133][ T9] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 341.958176][ T9] dvb-usb: MAC address reading failed. [ 342.103435][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 342.139460][ T5980] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 342.247384][ T9958] iowarrior 1-1:0.0: Error -90 while submitting URB [ 342.275071][ T5980] usb 1-1: USB disconnect, device number 38 [ 342.349981][ T9] DVB: Unable to find symbol stb0899_attach() [ 342.349997][ T9] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 342.469866][ T9] rc_core: IR keymap rc-tt-1500 not found [ 342.469885][ T9] Registered IR keymap rc-empty [ 342.473105][ T9] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 342.474973][ T9] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input84 [ 342.487107][ T9] dvb-usb: schedule remote query interval to 100 msecs. [ 342.487129][ T9] pctv452e: pctv452e_power_ctrl: 0 [ 342.487129][ T9] [ 342.487138][ T9] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 342.499493][ T9] usb 4-1: USB disconnect, device number 41 [ 342.544659][ T9987] process 'syz.4.1434' launched './file1' with NULL argv: empty string added [ 342.648602][ T9] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 342.768177][ T5808] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 342.890480][ T9995] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 344.410978][ T36] usb 5-1: new high-speed USB device number 36 using dummy_hcd [ 344.573802][ T36] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 344.573825][ T36] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 344.575112][ T36] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 344.575135][ T36] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 344.575151][ T36] usb 5-1: SerialNumber: syz [ 344.876321][ T36] usb 5-1: 0:2 : does not exist [ 344.954641][ T36] usb 5-1: USB disconnect, device number 36 [ 345.006311][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 346.542581][T10025] netlink: 'syz.0.1446': attribute type 4 has an invalid length. [ 346.600631][ T9] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 346.700325][ T6000] hsr_slave_0: left promiscuous mode [ 346.739927][ T6000] hsr_slave_1: left promiscuous mode [ 346.741529][ T6000] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 346.741645][ T6000] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 346.750042][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 346.763311][ T9] usb 1-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 346.763337][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.763354][ T9] usb 1-1: Product: syz [ 346.763366][ T9] usb 1-1: Manufacturer: syz [ 346.763378][ T9] usb 1-1: SerialNumber: syz [ 346.773275][ T9] usb 1-1: config 0 descriptor?? [ 346.788198][ T9] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 346.788240][ T9] pctv452e: pctv452e_power_ctrl: 1 [ 346.788240][ T9] [ 346.788281][ T9] usb 1-1: selecting invalid altsetting 3 [ 346.788292][ T9] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 346.788292][ T9] [ 346.788306][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 346.794748][ T6000] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 346.794774][ T6000] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 346.803969][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 346.806592][ T9] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 346.806643][ T9] usb 1-1: media controller created [ 346.806775][ T9] dvb-usb: bulk message failed: -22 (8/0) [ 346.806789][ T9] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 346.806834][ T9] dvb-usb: MAC address reading failed. [ 346.836349][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 346.977936][ T5808] Bluetooth: hci2: unexpected event for opcode 0x1c58 [ 346.995825][ T9] DVB: Unable to find symbol stb0899_attach() [ 346.995834][ T9] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 347.044842][ T6000] veth1_macvtap: left promiscuous mode [ 347.045132][ T6000] veth0_macvtap: left promiscuous mode [ 347.045412][ T6000] veth1_vlan: left promiscuous mode [ 347.079854][ T9] rc_core: IR keymap rc-tt-1500 not found [ 347.079876][ T9] Registered IR keymap rc-empty [ 347.080962][ T9] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 347.083011][ T9] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input86 [ 347.085125][ T9] dvb-usb: schedule remote query interval to 100 msecs. [ 347.085144][ T9] pctv452e: pctv452e_power_ctrl: 0 [ 347.085144][ T9] [ 347.085154][ T9] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 347.095524][ T9] usb 1-1: USB disconnect, device number 39 [ 347.242675][ T9] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 347.951258][ T6000] team0 (unregistering): Port device team_slave_1 removed [ 347.990513][ T6000] team0 (unregistering): Port device team_slave_0 removed [ 348.220386][ T5808] Bluetooth: hci1: unexpected event for opcode 0x2003 [ 350.280141][T10073] binder: BINDER_SET_CONTEXT_MGR already set [ 350.280154][T10073] binder: 10070:10073 ioctl 4018620d 200000000040 returned -16 [ 350.962938][T10090] binder: BINDER_SET_CONTEXT_MGR already set [ 350.962952][T10090] binder: 10087:10090 ioctl 4018620d 200000000040 returned -16 [ 351.142300][ T9724] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 351.245910][ T9724] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 351.306026][ T9724] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 351.396289][ T9724] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 353.190682][ T5856] usb 4-1: new full-speed USB device number 42 using dummy_hcd [ 353.463605][T10128] binder: BINDER_SET_CONTEXT_MGR already set [ 353.463618][T10128] binder: 10126:10128 ioctl 4018620d 200000000040 returned -16 [ 353.464347][ T5856] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 353.464369][ T5856] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 353.464386][ T5856] usb 4-1: config 0 has no interface number 0 [ 353.464428][ T5856] usb 4-1: config 0 interface 8 altsetting 248 endpoint 0xC has an invalid bInterval 0, changing to 10 [ 353.464452][ T5856] usb 4-1: config 0 interface 8 altsetting 248 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 353.464475][ T5856] usb 4-1: config 0 interface 8 has no altsetting 0 [ 353.468220][ T5856] usb 4-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=2d.bb [ 353.468246][ T5856] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.468261][ T5856] usb 4-1: Product: syz [ 353.468273][ T5856] usb 4-1: Manufacturer: syz [ 353.468284][ T5856] usb 4-1: SerialNumber: syz [ 353.596939][ T5856] usb 4-1: config 0 descriptor?? [ 353.848146][ T9724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 353.858467][T10137] FAULT_INJECTION: forcing a failure. [ 353.858467][T10137] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.858501][T10137] CPU: 0 UID: 0 PID: 10137 Comm: syz.0.1471 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 353.858520][T10137] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 353.858531][T10137] Call Trace: [ 353.858538][T10137] [ 353.858546][T10137] dump_stack_lvl+0xe8/0x150 [ 353.858573][T10137] should_fail_ex+0x46b/0x600 [ 353.858599][T10137] _copy_from_user+0x2d/0xb0 [ 353.858616][T10137] __sys_bpf+0x229/0x950 [ 353.858639][T10137] ? __pfx___sys_bpf+0x10/0x10 [ 353.858656][T10137] ? rt_mutex_slowunlock+0x1cb/0x300 [ 353.858691][T10137] ? ksys_write+0x248/0x270 [ 353.858717][T10137] ? __pfx_ksys_write+0x10/0x10 [ 353.858746][T10137] __x64_sys_bpf+0x7c/0x90 [ 353.858766][T10137] do_syscall_64+0x14d/0xf80 [ 353.858783][T10137] ? trace_irq_disable+0x3b/0x150 [ 353.858802][T10137] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.858819][T10137] ? clear_bhb_loop+0x40/0x90 [ 353.858837][T10137] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 353.858853][T10137] RIP: 0033:0x7f0aea34c819 [ 353.858868][T10137] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.858883][T10137] RSP: 002b:00007f0ae859e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 353.858900][T10137] RAX: ffffffffffffffda RBX: 00007f0aea5c5fa0 RCX: 00007f0aea34c819 [ 353.858910][T10137] RDX: 0000000000000048 RSI: 0000200000000180 RDI: 0000000000000000 [ 353.858919][T10137] RBP: 00007f0ae859e090 R08: 0000000000000000 R09: 0000000000000000 [ 353.858928][T10137] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 353.858938][T10137] R13: 00007f0aea5c6038 R14: 00007f0aea5c5fa0 R15: 00007ffd3b410248 [ 353.858965][T10137] [ 353.934452][ T9724] 8021q: adding VLAN 0 to HW filter on device team0 [ 354.009548][ T173] bridge0: port 1(bridge_slave_0) entered blocking state [ 354.013393][ T173] bridge0: port 1(bridge_slave_0) entered forwarding state [ 354.072316][ T6907] bridge0: port 2(bridge_slave_1) entered blocking state [ 354.081903][ T6907] bridge0: port 2(bridge_slave_1) entered forwarding state [ 354.136470][ T5856] ath6kl: Failed to submit usb control message: -71 [ 354.136516][ T5856] ath6kl: unable to send the bmi data to the device: -71 [ 354.136529][ T5856] ath6kl: Unable to send get target info: -71 [ 354.163031][ T5856] ath6kl: Failed to init ath6kl core: -71 [ 354.163740][ T5856] ath6kl_usb 4-1:0.8: probe with driver ath6kl_usb failed with error -71 [ 354.190046][ T5856] usb 4-1: USB disconnect, device number 42 [ 354.210111][T10140] capability: warning: `syz.2.1472' uses 32-bit capabilities (legacy support in use) [ 354.335356][T10143] FAULT_INJECTION: forcing a failure. [ 354.335356][T10143] name failslab, interval 1, probability 0, space 0, times 0 [ 354.335388][T10143] CPU: 0 UID: 0 PID: 10143 Comm: syz.0.1473 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 354.335408][T10143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 354.335419][T10143] Call Trace: [ 354.335426][T10143] [ 354.335435][T10143] dump_stack_lvl+0xe8/0x150 [ 354.335462][T10143] should_fail_ex+0x46b/0x600 [ 354.335492][T10143] should_failslab+0xa8/0x100 [ 354.335512][T10143] __kmalloc_noprof+0xdf/0x7b0 [ 354.335529][T10143] ? kfree+0x4d/0x6c0 [ 354.335549][T10143] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 354.335577][T10143] tomoyo_realpath_from_path+0xe3/0x5d0 [ 354.335608][T10143] ? tomoyo_path_number_perm+0x219/0x630 [ 354.335627][T10143] tomoyo_path_number_perm+0x246/0x630 [ 354.335648][T10143] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 354.335669][T10143] ? __lock_acquire+0x6b5/0x2cf0 [ 354.335721][T10143] ? __fget_files+0x2a/0x420 [ 354.335746][T10143] ? __fget_files+0x2a/0x420 [ 354.335765][T10143] ? __fget_files+0x3a6/0x420 [ 354.335784][T10143] ? __fget_files+0x2a/0x420 [ 354.335808][T10143] security_file_ioctl+0xc3/0x2a0 [ 354.335830][T10143] __se_sys_ioctl+0x47/0x170 [ 354.335850][T10143] do_syscall_64+0x14d/0xf80 [ 354.335870][T10143] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 354.335888][T10143] ? clear_bhb_loop+0x40/0x90 [ 354.335910][T10143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 354.335927][T10143] RIP: 0033:0x7f0aea34c819 [ 354.335944][T10143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 354.335959][T10143] RSP: 002b:00007f0ae859e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 354.335978][T10143] RAX: ffffffffffffffda RBX: 00007f0aea5c5fa0 RCX: 00007f0aea34c819 [ 354.335991][T10143] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 354.336002][T10143] RBP: 00007f0ae859e090 R08: 0000000000000000 R09: 0000000000000000 [ 354.336014][T10143] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 354.336025][T10143] R13: 00007f0aea5c6038 R14: 00007f0aea5c5fa0 R15: 00007ffd3b410248 [ 354.336055][T10143] [ 354.336063][T10143] ERROR: Out of memory at tomoyo_realpath_from_path. [ 355.143019][T10161] binder: 10157:10161 ioctl c018620c 200000000000 returned -22 [ 355.329045][ T9724] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 355.485465][ T9724] veth0_vlan: entered promiscuous mode [ 355.505036][ T9724] veth1_vlan: entered promiscuous mode [ 355.591870][ T9724] veth0_macvtap: entered promiscuous mode [ 355.618682][ T9724] veth1_macvtap: entered promiscuous mode [ 355.640649][T10175] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.1484'. [ 355.724377][ T9724] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 355.757940][ T9724] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 355.805469][ T6907] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.811137][ T6907] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.811627][ T6907] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.820155][ T6907] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.386237][T10181] usb usb7: usbfs: process 10181 (syz.3.1486) did not claim interface 0 before use [ 356.627308][T10191] FAULT_INJECTION: forcing a failure. [ 356.627308][T10191] name (null), interval 1, probability 0, space 0, times 1 [ 356.627340][T10191] CPU: 0 UID: 0 PID: 10191 Comm: syz.3.1488 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 356.627360][T10191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 356.627371][T10191] Call Trace: [ 356.627378][T10191] [ 356.627387][T10191] dump_stack_lvl+0xe8/0x150 [ 356.627417][T10191] should_fail_ex+0x46b/0x600 [ 356.627445][T10191] null_queue_rq+0x244/0xe30 [ 356.627483][T10191] null_queue_rqs+0x123/0x270 [ 356.627513][T10191] ? blk_mq_dispatch_queue_requests+0x11a/0x800 [ 356.627538][T10191] blk_mq_dispatch_queue_requests+0x417/0x800 [ 356.627560][T10191] ? rcu_is_watching+0x15/0xb0 [ 356.627583][T10191] blk_mq_flush_plug_list+0x456/0x570 [ 356.627604][T10191] ? blk_add_rq_to_plug+0x300/0x450 [ 356.627628][T10191] ? blk_mq_submit_bio+0xf36/0x28e0 [ 356.627649][T10191] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 356.627681][T10191] __blk_flush_plug+0x3ed/0x4d0 [ 356.627706][T10191] ? gup_fast_fallback+0x1d1f/0x2240 [ 356.627730][T10191] ? __pfx___blk_flush_plug+0x10/0x10 [ 356.627761][T10191] __submit_bio+0x28d/0x580 [ 356.627786][T10191] ? __pfx___submit_bio+0x10/0x10 [ 356.627823][T10191] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 356.627851][T10191] ? __pfx_submit_bio_noacct_nocheck+0x10/0x10 [ 356.627891][T10191] submit_bio_wait+0x12a/0x260 [ 356.627909][T10191] ? __pfx_submit_bio_wait+0x10/0x10 [ 356.627945][T10191] blkdev_direct_IO+0x1106/0x17a0 [ 356.627981][T10191] ? __pfx_blkdev_direct_IO+0x10/0x10 [ 356.628010][T10191] ? inode_maybe_inc_iversion+0x18f/0x200 [ 356.628037][T10191] ? __pfx_submit_bio_wait_endio+0x10/0x10 [ 356.628066][T10191] ? rcu_is_watching+0x15/0xb0 [ 356.628089][T10191] ? kiocb_invalidate_pages+0xfc/0x140 [ 356.628116][T10191] blkdev_direct_write+0x7c/0x140 [ 356.628142][T10191] blkdev_write_iter+0x54a/0x720 [ 356.628180][T10191] vfs_write+0x629/0xba0 [ 356.628212][T10191] ? __pfx_vfs_write+0x10/0x10 [ 356.628246][T10191] ? __fget_files+0x2a/0x420 [ 356.628277][T10191] ksys_write+0x156/0x270 [ 356.628304][T10191] ? __pfx_ksys_write+0x10/0x10 [ 356.628338][T10191] do_syscall_64+0x14d/0xf80 [ 356.628357][T10191] ? trace_irq_disable+0x3b/0x150 [ 356.628376][T10191] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.628394][T10191] ? clear_bhb_loop+0x40/0x90 [ 356.628415][T10191] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.628433][T10191] RIP: 0033:0x7f850ce4c819 [ 356.628449][T10191] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 356.628464][T10191] RSP: 002b:00007f850b0a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 356.628484][T10191] RAX: ffffffffffffffda RBX: 00007f850d0c5fa0 RCX: 00007f850ce4c819 [ 356.628497][T10191] RDX: 0000000000002000 RSI: 0000200000000080 RDI: 0000000000000004 [ 356.628508][T10191] RBP: 00007f850b0a6090 R08: 0000000000000000 R09: 0000000000000000 [ 356.628519][T10191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 356.628530][T10191] R13: 00007f850d0c6038 R14: 00007f850d0c5fa0 R15: 00007ffd5ed8c2a8 [ 356.628560][T10191] [ 357.230996][T10201] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 4, id = 0 [ 357.355356][ T6907] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.355377][ T6907] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 357.433203][T10203] FAULT_INJECTION: forcing a failure. [ 357.433203][T10203] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 357.433231][T10203] CPU: 1 UID: 0 PID: 10203 Comm: syz.0.1492 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 357.433248][T10203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 357.433257][T10203] Call Trace: [ 357.433263][T10203] [ 357.433270][T10203] dump_stack_lvl+0xe8/0x150 [ 357.433294][T10203] should_fail_ex+0x46b/0x600 [ 357.433319][T10203] _copy_from_user+0x2d/0xb0 [ 357.433336][T10203] __sys_bpf+0x229/0x950 [ 357.433357][T10203] ? __pfx___sys_bpf+0x10/0x10 [ 357.433373][T10203] ? rt_mutex_slowunlock+0x1cb/0x300 [ 357.433409][T10203] ? ksys_write+0x248/0x270 [ 357.433435][T10203] ? __pfx_ksys_write+0x10/0x10 [ 357.433465][T10203] __x64_sys_bpf+0x7c/0x90 [ 357.433485][T10203] do_syscall_64+0x14d/0xf80 [ 357.433503][T10203] ? trace_irq_disable+0x3b/0x150 [ 357.433522][T10203] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.433540][T10203] ? clear_bhb_loop+0x40/0x90 [ 357.433561][T10203] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.433578][T10203] RIP: 0033:0x7f0aea34c819 [ 357.433595][T10203] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 357.433610][T10203] RSP: 002b:00007f0ae859e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 357.433629][T10203] RAX: ffffffffffffffda RBX: 00007f0aea5c5fa0 RCX: 00007f0aea34c819 [ 357.433643][T10203] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 357.433654][T10203] RBP: 00007f0ae859e090 R08: 0000000000000000 R09: 0000000000000000 [ 357.433666][T10203] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 357.433677][T10203] R13: 00007f0aea5c6038 R14: 00007f0aea5c5fa0 R15: 00007ffd3b410248 [ 357.433706][T10203] [ 357.641514][ T6904] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 357.641535][ T6904] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 358.021124][T10211] FAULT_INJECTION: forcing a failure. [ 358.021124][T10211] name failslab, interval 1, probability 0, space 0, times 0 [ 358.021155][T10211] CPU: 1 UID: 0 PID: 10211 Comm: syz.1.1383 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 358.021175][T10211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 358.021185][T10211] Call Trace: [ 358.021193][T10211] [ 358.021201][T10211] dump_stack_lvl+0xe8/0x150 [ 358.021231][T10211] should_fail_ex+0x46b/0x600 [ 358.021260][T10211] should_failslab+0xa8/0x100 [ 358.021280][T10211] __kmalloc_noprof+0xdf/0x7b0 [ 358.021297][T10211] ? kfree+0x4d/0x6c0 [ 358.021318][T10211] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 358.021345][T10211] tomoyo_realpath_from_path+0xe3/0x5d0 [ 358.021376][T10211] ? tomoyo_path_number_perm+0x219/0x630 [ 358.021394][T10211] tomoyo_path_number_perm+0x246/0x630 [ 358.021416][T10211] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 358.021437][T10211] ? __lock_acquire+0x6b5/0x2cf0 [ 358.021488][T10211] ? __fget_files+0x2a/0x420 [ 358.021512][T10211] ? __fget_files+0x2a/0x420 [ 358.021532][T10211] ? __fget_files+0x3a6/0x420 [ 358.021550][T10211] ? __fget_files+0x2a/0x420 [ 358.021575][T10211] security_file_ioctl+0xc3/0x2a0 [ 358.021597][T10211] __se_sys_ioctl+0x47/0x170 [ 358.021617][T10211] do_syscall_64+0x14d/0xf80 [ 358.021635][T10211] ? trace_irq_disable+0x3b/0x150 [ 358.021655][T10211] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.021673][T10211] ? clear_bhb_loop+0x40/0x90 [ 358.021694][T10211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.021711][T10211] RIP: 0033:0x7feb3433c819 [ 358.021728][T10211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 358.021743][T10211] RSP: 002b:00007feb32596028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 358.021762][T10211] RAX: ffffffffffffffda RBX: 00007feb345b5fa0 RCX: 00007feb3433c819 [ 358.021775][T10211] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 358.021786][T10211] RBP: 00007feb32596090 R08: 0000000000000000 R09: 0000000000000000 [ 358.021805][T10211] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 358.021815][T10211] R13: 00007feb345b6038 R14: 00007feb345b5fa0 R15: 00007fffd5397b28 [ 358.021845][T10211] [ 358.021852][T10211] ERROR: Out of memory at tomoyo_realpath_from_path. [ 358.039195][T10211] kvm: pic: single mode not supported [ 358.039668][T10211] kvm: pic: non byte write [ 359.020426][T10227] trusted_key: encrypted_key: keyword 'newdefault' not recognized [ 359.028911][T10227] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1499'. [ 359.129575][T10228] netlink: 'syz.0.1500': attribute type 4 has an invalid length. [ 359.697766][ T37] audit: type=1326 audit(16912403.380:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10225 comm="syz.1.1499" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7feb3433c819 code=0x0 [ 359.769836][ T9] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 360.039825][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 360.044047][ T9] usb 1-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 360.044064][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 360.044074][ T9] usb 1-1: Product: syz [ 360.044081][ T9] usb 1-1: Manufacturer: syz [ 360.044089][ T9] usb 1-1: SerialNumber: syz [ 360.047023][ T9] usb 1-1: config 0 descriptor?? [ 360.052712][ T9] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 360.052754][ T9] pctv452e: pctv452e_power_ctrl: 1 [ 360.052754][ T9] [ 360.052796][ T9] usb 1-1: selecting invalid altsetting 3 [ 360.052809][ T9] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 360.052809][ T9] [ 360.052824][ T9] dvb-usb: bulk message failed: -22 (5/0) [ 360.062162][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 360.063480][ T9] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 360.063528][ T9] usb 1-1: media controller created [ 360.063592][ T9] dvb-usb: bulk message failed: -22 (8/0) [ 360.063606][ T9] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 360.063651][ T9] dvb-usb: MAC address reading failed. [ 360.193921][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 360.305880][ T5808] Bluetooth: hci2: unexpected event for opcode 0x1c58 [ 360.349110][ T9] DVB: Unable to find symbol stb0899_attach() [ 360.349120][ T9] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 360.482428][ T9] rc_core: IR keymap rc-tt-1500 not found [ 360.482443][ T9] Registered IR keymap rc-empty [ 360.492562][ T9] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 360.495240][ T9] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input88 [ 360.510025][ T9] dvb-usb: schedule remote query interval to 100 msecs. [ 360.510045][ T9] pctv452e: pctv452e_power_ctrl: 0 [ 360.510045][ T9] [ 360.510055][ T9] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 360.525864][ T9] usb 1-1: USB disconnect, device number 40 [ 360.560153][ T5899] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 360.689860][ T5899] usb 3-1: device descriptor read/64, error -71 [ 360.715928][ T9] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 360.949836][ T5899] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 361.199922][ T5899] usb 3-1: device descriptor read/64, error -71 [ 361.310387][ T5899] usb usb3-port1: attempt power cycle [ 361.829878][ T5899] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 361.854288][ T5899] usb 3-1: device descriptor read/8, error -71 [ 361.854420][ T5856] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 363.325651][ T5856] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 363.325679][ T5856] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 363.334785][ T5856] usb 1-1: config 0 descriptor?? [ 363.361821][ T71] null_blk: rq ffff888026ea3d80 timed out [ 363.362074][ T71] timeout error, dev nullb0, sector 0 op 0x1:(WRITE) flags 0x8800 phys_seg 2 prio class 2 [ 363.379869][ T5899] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 363.589946][ T5899] usb 3-1: device not accepting address 41, error -71 [ 363.595835][ T5899] usb usb3-port1: unable to enumerate USB device [ 363.654922][T10255] bridge0: entered allmulticast mode [ 364.002145][ T5899] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 364.539877][ T5899] usb 3-1: Using ep0 maxpacket: 32 [ 364.542195][ T5899] usb 3-1: unable to get BOS descriptor or descriptor too short [ 364.543324][ T5899] usb 3-1: config 1 interface 0 altsetting 4 bulk endpoint 0x1 has invalid maxpacket 32 [ 364.543351][ T5899] usb 3-1: config 1 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 364.543376][ T5899] usb 3-1: config 1 interface 0 has no altsetting 0 [ 364.545409][ T5899] usb 3-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 364.545433][ T5899] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.545444][ T5899] usb 3-1: Product: syz [ 364.545451][ T5899] usb 3-1: Manufacturer: syz [ 364.545458][ T5899] usb 3-1: SerialNumber: syz [ 364.551558][T10258] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 364.762068][ T5899] usblp0: Disabling reads from problematic bidirectional printer [ 364.767078][ T5899] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 42 if 0 alt 4 proto 1 vid 0x03F0 pid 0x0004 [ 364.782618][ T5899] usb 3-1: USB disconnect, device number 42 [ 364.858074][ T5899] usblp0: removed [ 364.872839][ T5849] udevd[5849]: setting owner of /dev/bus/usb/003/042 to uid=0, gid=7 failed: No such file or directory [ 364.936522][ T5856] usb 1-1: Cannot set autoneg [ 364.936769][ T5856] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 364.966751][ T5856] usb 1-1: USB disconnect, device number 41 [ 365.129900][ T7121] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 365.286131][ T7121] usb 5-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 365.286241][ T7121] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.329902][ T7121] usb 5-1: config 0 descriptor?? [ 365.845219][ T5856] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 366.050531][ T5856] usb 3-1: Using ep0 maxpacket: 8 [ 366.158256][ T5856] usb 3-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 366.158285][ T5856] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.158303][ T5856] usb 3-1: Product: syz [ 366.158315][ T5856] usb 3-1: Manufacturer: syz [ 366.158327][ T5856] usb 3-1: SerialNumber: syz [ 366.198526][ T5856] usb 3-1: config 0 descriptor?? [ 366.211820][ T5856] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 366.211876][ T5856] pctv452e: pctv452e_power_ctrl: 1 [ 366.211876][ T5856] [ 366.211917][ T5856] usb 3-1: selecting invalid altsetting 3 [ 366.211930][ T5856] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 366.211930][ T5856] [ 366.211943][ T5856] dvb-usb: bulk message failed: -22 (5/0) [ 366.263802][ T5856] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 366.264862][ T5856] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 366.264912][ T5856] usb 3-1: media controller created [ 366.264958][ T5856] dvb-usb: bulk message failed: -22 (8/0) [ 366.264970][ T5856] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 366.265010][ T5856] dvb-usb: MAC address reading failed. [ 366.330273][ T5856] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 366.433883][ T5856] DVB: Unable to find symbol stb0899_attach() [ 366.433899][ T5856] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 367.879850][ T5856] rc_core: IR keymap rc-tt-1500 not found [ 367.879870][ T5856] Registered IR keymap rc-empty [ 367.900825][ T5856] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 367.909618][ T5856] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input90 [ 367.940410][ T5856] dvb-usb: schedule remote query interval to 100 msecs. [ 367.940430][ T5856] pctv452e: pctv452e_power_ctrl: 0 [ 367.940430][ T5856] [ 367.940441][ T5856] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 367.947206][ T5856] usb 3-1: USB disconnect, device number 43 [ 368.008283][ T7121] usb 5-1: Cannot set autoneg [ 368.008529][ T7121] MOSCHIP usb-ethernet driver 5-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 368.039087][ T7121] usb 5-1: USB disconnect, device number 37 [ 368.153365][T10294] netlink: 'syz.4.1521': attribute type 64 has an invalid length. [ 368.191155][ T5856] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 368.646484][ T7121] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 368.989873][ T7121] usb 2-1: Using ep0 maxpacket: 8 [ 368.992851][ T7121] usb 2-1: unable to get BOS descriptor or descriptor too short [ 368.993903][ T7121] usb 2-1: config 0 has an invalid interface number: 88 but max is 0 [ 368.993924][ T7121] usb 2-1: config 0 has no interface number 0 [ 368.993964][ T7121] usb 2-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 368.993987][ T7121] usb 2-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 368.994007][ T7121] usb 2-1: config 0 interface 88 has no altsetting 0 [ 369.011563][ T7121] usb 2-1: string descriptor 0 read error: -22 [ 369.011694][ T7121] usb 2-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 369.011715][ T7121] usb 2-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 369.016684][ T7121] usb 2-1: config 0 descriptor?? [ 369.029608][ T5808] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 369.047810][ T7121] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.88/input/input91 [ 371.110351][ T5876] usb 2-1: USB disconnect, device number 22 [ 371.119967][ T31] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 371.173149][ T6044] udevd[6044]: Error opening device "/dev/input/event4": Input/output error [ 371.173183][ T6044] udevd[6044]: Unable to EVIOCGABS device "/dev/input/event4" [ 371.173208][ T6044] udevd[6044]: Unable to EVIOCGABS device "/dev/input/event4" [ 371.173242][ T6044] udevd[6044]: Assertion 'close_nointr(fd) != -EBADF' failed at util.c:228, function safe_close(). Aborting. [ 371.218072][ T5163] udevd[5163]: worker [6044] terminated by signal 6 (Aborted) [ 371.218104][ T5163] udevd[5163]: worker [6044] failed while handling '/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.88/input/input91/event4' [ 371.220239][ T5856] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 371.299880][ T31] usb 4-1: Using ep0 maxpacket: 32 [ 371.302277][ T31] usb 4-1: config 2 has an invalid interface number: 88 but max is 0 [ 371.302302][ T31] usb 4-1: config 2 has no interface number 0 [ 371.302336][ T31] usb 4-1: config 2 interface 88 altsetting 7 bulk endpoint 0x6 has invalid maxpacket 256 [ 371.302350][ T31] usb 4-1: config 2 interface 88 has no altsetting 0 [ 371.304735][ T31] usb 4-1: New USB device found, idVendor=0557, idProduct=2009, bcdDevice=c7.1e [ 371.304757][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.304767][ T31] usb 4-1: Product: syz [ 371.304774][ T31] usb 4-1: Manufacturer: syz [ 371.304781][ T31] usb 4-1: SerialNumber: syz [ 371.311326][T10312] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 371.352641][ T5980] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 371.389941][ T5899] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 371.432825][ T5856] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 371.432851][ T5856] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 371.433961][ T5856] usb 3-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 371.433976][ T5856] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 371.433985][ T5856] usb 3-1: Manufacturer: syz [ 371.439446][ T5856] usb 3-1: config 0 descriptor?? [ 371.507233][ T5980] usb 5-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 371.507261][ T5980] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 371.537529][ T31] asix 4-1:2.88: probe with driver asix failed with error -71 [ 371.550293][ T5980] usb 5-1: config 0 descriptor?? [ 371.576012][ T5899] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 371.576039][ T5899] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 371.576055][ T5899] usb 1-1: Product: syz [ 371.576065][ T5899] usb 1-1: Manufacturer: syz [ 371.576076][ T5899] usb 1-1: SerialNumber: syz [ 371.638194][ T31] usb 4-1: USB disconnect, device number 43 [ 371.652897][ T5899] usb 1-1: config 0 descriptor?? [ 371.692817][ T5899] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 372.178794][T10333] FAULT_INJECTION: forcing a failure. [ 372.178794][T10333] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 372.178844][T10333] CPU: 0 UID: 0 PID: 10333 Comm: syz.3.1533 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 372.178861][T10333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 372.178872][T10333] Call Trace: [ 372.178876][T10333] [ 372.178885][T10333] dump_stack_lvl+0xe8/0x150 [ 372.178903][T10333] should_fail_ex+0x46b/0x600 [ 372.178931][T10333] _copy_from_user+0x2d/0xb0 [ 372.178950][T10333] ___sys_recvmsg+0x175/0x590 [ 372.178970][T10333] ? get_pid_task+0x20/0x1f0 [ 372.178986][T10333] ? get_pid_task+0x20/0x1f0 [ 372.179007][T10333] ? __pfx____sys_recvmsg+0x10/0x10 [ 372.179038][T10333] ? __pfx_vfs_write+0x10/0x10 [ 372.179053][T10333] ? enqueue_task+0x341/0x410 [ 372.179070][T10333] __x64_sys_recvmsg+0x1c0/0x2a0 [ 372.179092][T10333] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 372.179121][T10333] ? __pfx_ksys_write+0x10/0x10 [ 372.179154][T10333] do_syscall_64+0x14d/0xf80 [ 372.179173][T10333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.179189][T10333] ? clear_bhb_loop+0x40/0x90 [ 372.179201][T10333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 372.179210][T10333] RIP: 0033:0x7f850ce4c819 [ 372.179221][T10333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 372.179230][T10333] RSP: 002b:00007f850b0a6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 372.179244][T10333] RAX: ffffffffffffffda RBX: 00007f850d0c5fa0 RCX: 00007f850ce4c819 [ 372.179257][T10333] RDX: 0000000000000000 RSI: 0000200000000880 RDI: 0000000000000004 [ 372.179268][T10333] RBP: 00007f850b0a6090 R08: 0000000000000000 R09: 0000000000000000 [ 372.179279][T10333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 372.179290][T10333] R13: 00007f850d0c6038 R14: 00007f850d0c5fa0 R15: 00007ffd5ed8c2a8 [ 372.179319][T10333] [ 372.790058][ T5980] usb 5-1: Cannot set autoneg [ 372.790304][ T5980] MOSCHIP usb-ethernet driver 5-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 372.824704][ T5980] usb 5-1: USB disconnect, device number 38 [ 373.063137][T10341] FAULT_INJECTION: forcing a failure. [ 373.063137][T10341] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 373.063171][T10341] CPU: 0 UID: 0 PID: 10341 Comm: syz.1.1535 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 373.063192][T10341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 373.063203][T10341] Call Trace: [ 373.063211][T10341] [ 373.063219][T10341] dump_stack_lvl+0xe8/0x150 [ 373.063251][T10341] should_fail_ex+0x46b/0x600 [ 373.063278][T10341] _copy_from_user+0x2d/0xb0 [ 373.063297][T10341] __sys_bpf+0x229/0x950 [ 373.063321][T10341] ? __pfx___sys_bpf+0x10/0x10 [ 373.063338][T10341] ? rt_mutex_slowunlock+0x1cb/0x300 [ 373.063373][T10341] ? ksys_write+0x248/0x270 [ 373.063397][T10341] ? __pfx_ksys_write+0x10/0x10 [ 373.063428][T10341] __x64_sys_bpf+0x7c/0x90 [ 373.063448][T10341] do_syscall_64+0x14d/0xf80 [ 373.063475][T10341] ? trace_irq_disable+0x3b/0x150 [ 373.063492][T10341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.063507][T10341] ? clear_bhb_loop+0x40/0x90 [ 373.063536][T10341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.063553][T10341] RIP: 0033:0x7feb3433c819 [ 373.063571][T10341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.063586][T10341] RSP: 002b:00007feb32596028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 373.063605][T10341] RAX: ffffffffffffffda RBX: 00007feb345b5fa0 RCX: 00007feb3433c819 [ 373.063616][T10341] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 373.063627][T10341] RBP: 00007feb32596090 R08: 0000000000000000 R09: 0000000000000000 [ 373.063637][T10341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 373.063648][T10341] R13: 00007feb345b6038 R14: 00007feb345b5fa0 R15: 00007fffd5397b28 [ 373.063676][T10341] [ 373.400052][T10345] FAULT_INJECTION: forcing a failure. [ 373.400052][T10345] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 373.400074][T10345] CPU: 1 UID: 0 PID: 10345 Comm: syz.1.1537 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 373.400086][T10345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 373.400093][T10345] Call Trace: [ 373.400097][T10345] [ 373.400102][T10345] dump_stack_lvl+0xe8/0x150 [ 373.400124][T10345] should_fail_ex+0x46b/0x600 [ 373.400141][T10345] _copy_from_user+0x2d/0xb0 [ 373.400152][T10345] __x64_sys_rt_sigsuspend+0xd4/0x160 [ 373.400166][T10345] ? __pfx___x64_sys_rt_sigsuspend+0x10/0x10 [ 373.400179][T10345] ? do_syscall_64+0xa3/0xf80 [ 373.400192][T10345] do_syscall_64+0x14d/0xf80 [ 373.400202][T10345] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.400212][T10345] ? clear_bhb_loop+0x40/0x90 [ 373.400224][T10345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.400234][T10345] RIP: 0033:0x7feb3433c819 [ 373.400243][T10345] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.400252][T10345] RSP: 002b:00007feb32596028 EFLAGS: 00000246 ORIG_RAX: 0000000000000082 [ 373.400263][T10345] RAX: ffffffffffffffda RBX: 00007feb345b5fa0 RCX: 00007feb3433c819 [ 373.400271][T10345] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000200000000040 [ 373.400277][T10345] RBP: 00007feb32596090 R08: 0000000000000000 R09: 0000000000000000 [ 373.400283][T10345] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 373.400289][T10345] R13: 00007feb345b6038 R14: 00007feb345b5fa0 R15: 00007fffd5397b28 [ 373.400304][T10345] [ 373.425838][ T37] audit: type=1326 audit(16912417.110:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10344 comm="syz.1.1537" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7feb3433c819 code=0x0 [ 373.705693][T10349] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1538'. [ 373.776226][T10351] sctp: [Deprecated]: syz.4.1538 (pid 10351) Use of int in max_burst socket option. [ 373.776226][T10351] Use struct sctp_assoc_value instead [ 373.776961][T10351] binder: 10348:10351 unknown command 0 [ 373.777472][T10351] binder: 10348:10351 ioctl c0306201 200000004a40 returned -22 [ 373.789238][ T37] audit: type=1326 audit(16912417.470:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10348 comm="syz.4.1538" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fef954dc819 code=0x0 [ 373.915497][ T5856] usbhid 3-1:0.0: can't add hid device: -71 [ 373.915568][ T5856] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 373.951779][ T5856] usb 3-1: USB disconnect, device number 44 [ 374.184135][ T5856] usb 1-1: USB disconnect, device number 42 [ 374.275395][T10365] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1543'. [ 374.388290][T10365] bond1: entered promiscuous mode [ 374.388854][T10365] 8021q: adding VLAN 0 to HW filter on device bond1 [ 374.429642][T10369] kAFS: No cell specified [ 374.691180][T10374] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1544'. [ 374.736666][T10372] veth3: entered promiscuous mode [ 374.765134][T10372] bond1: (slave veth3): Enslaving as an active interface with an up link [ 375.360068][T10378] netlink: 'syz.4.1546': attribute type 4 has an invalid length. [ 375.449867][ T7121] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 375.576102][ T37] audit: type=1326 audit(16912419.260:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10389 comm="syz.0.1549" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0aea34c819 code=0x7ffc0000 [ 375.576153][ T37] audit: type=1326 audit(16912419.260:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10389 comm="syz.0.1549" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0aea34c819 code=0x7ffc0000 [ 375.576277][ T37] audit: type=1326 audit(16912419.260:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10389 comm="syz.0.1549" exe="/root/syz-executor" sig=0 arch=c000003e syscall=304 compat=0 ip=0x7f0aea34c819 code=0x7ffc0000 [ 375.576398][ T37] audit: type=1326 audit(16912419.260:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10389 comm="syz.0.1549" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0aea34c819 code=0x7ffc0000 [ 375.576784][ T37] audit: type=1326 audit(16912419.260:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10389 comm="syz.0.1549" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0aea34c819 code=0x7ffc0000 [ 375.576956][ T37] audit: type=1326 audit(16912419.260:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10389 comm="syz.0.1549" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f0aea34c819 code=0x7ffc0000 [ 375.577489][ T37] audit: type=1326 audit(16912419.260:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10389 comm="syz.0.1549" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0aea34c819 code=0x7ffc0000 [ 375.577535][ T37] audit: type=1326 audit(16912419.260:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10389 comm="syz.0.1549" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0aea34c819 code=0x7ffc0000 [ 375.578711][T10376] veth3: entered promiscuous mode [ 375.600085][ T7121] usb 5-1: Using ep0 maxpacket: 8 [ 376.263939][T10392] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 376.410504][ T36] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 376.612738][ T36] usb 3-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 376.612765][ T36] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 376.793966][ T36] usb 3-1: config 0 descriptor?? [ 376.906005][ T7121] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 376.906034][ T7121] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 376.906051][ T7121] usb 5-1: Product: syz [ 376.906063][ T7121] usb 5-1: Manufacturer: syz [ 376.906077][ T7121] usb 5-1: SerialNumber: syz [ 376.949179][ T7121] usb 5-1: config 0 descriptor?? [ 376.958697][ T7121] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 376.958740][ T7121] pctv452e: pctv452e_power_ctrl: 1 [ 376.958740][ T7121] [ 376.958783][ T7121] usb 5-1: selecting invalid altsetting 3 [ 376.958797][ T7121] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 376.958797][ T7121] [ 376.958813][ T7121] dvb-usb: bulk message failed: -22 (5/0) [ 377.039184][ T7121] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 377.050156][ T7121] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 377.050214][ T7121] usb 5-1: media controller created [ 377.050262][ T7121] dvb-usb: bulk message failed: -22 (8/0) [ 377.050276][ T7121] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 377.050329][ T7121] dvb-usb: MAC address reading failed. [ 377.105169][ T7121] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 377.196695][ T5808] Bluetooth: hci4: unexpected event for opcode 0x1c58 [ 377.247829][ T7121] DVB: Unable to find symbol stb0899_attach() [ 377.247845][ T7121] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 377.382174][ T7121] rc_core: IR keymap rc-tt-1500 not found [ 377.382195][ T7121] Registered IR keymap rc-empty [ 377.384854][ T7121] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 377.387257][ T7121] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input94 [ 377.423433][ T7121] dvb-usb: schedule remote query interval to 100 msecs. [ 377.423456][ T7121] pctv452e: pctv452e_power_ctrl: 0 [ 377.423456][ T7121] [ 377.423468][ T7121] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 377.454836][ T7121] usb 5-1: USB disconnect, device number 39 [ 378.515819][ T7121] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 378.646315][ T1324] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.646384][ T1324] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.754326][ T36] usb 3-1: Cannot set autoneg [ 378.754642][ T36] MOSCHIP usb-ethernet driver 3-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 378.811023][ T36] usb 3-1: USB disconnect, device number 45 [ 379.073431][ T37] kauditd_printk_skb: 10 callbacks suppressed [ 379.073449][ T37] audit: type=1326 audit(16912422.750:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.073489][ T37] audit: type=1326 audit(16912422.750:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.073525][ T37] audit: type=1326 audit(16912422.750:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=304 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.073562][ T37] audit: type=1326 audit(16912422.750:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.073601][ T37] audit: type=1326 audit(16912422.750:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.073640][ T37] audit: type=1326 audit(16912422.750:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.073675][ T37] audit: type=1326 audit(16912422.750:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.073711][ T37] audit: type=1326 audit(16912422.750:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.073747][ T37] audit: type=1326 audit(16912422.750:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10412 comm="syz.2.1554" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7fb5f2bec819 code=0x7ffc0000 [ 379.097273][T10417] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1556'. [ 380.043352][T10421] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 380.061573][ T5856] IPVS: starting estimator thread 0... [ 380.730005][T10423] IPVS: using max 8 ests per chain, 19200 per kthread [ 381.194990][T10435] netlink: 'syz.4.1562': attribute type 4 has an invalid length. [ 381.372367][ T5856] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 381.581144][ T5876] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 381.628919][ T5856] usb 4-1: Using ep0 maxpacket: 32 [ 381.794855][ T7121] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 381.836361][ T5856] usb 4-1: unable to get BOS descriptor or descriptor too short [ 381.839611][ T5856] usb 4-1: config 1 interface 0 altsetting 249 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 381.839644][ T5856] usb 4-1: config 1 interface 0 altsetting 249 endpoint 0x81 has invalid wMaxPacketSize 0 [ 381.839666][ T5856] usb 4-1: config 1 interface 0 altsetting 249 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 381.839690][ T5856] usb 4-1: config 1 interface 0 has no altsetting 0 [ 381.867419][ T5856] usb 4-1: New USB device found, idVendor=05ac, idProduct=0259, bcdDevice= 0.40 [ 381.867447][ T5856] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.867463][ T5856] usb 4-1: Product: syz [ 381.867476][ T5856] usb 4-1: Manufacturer: syz [ 381.867488][ T5856] usb 4-1: SerialNumber: syz [ 381.889829][ T5980] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 381.979882][ T5876] usb 5-1: Using ep0 maxpacket: 8 [ 381.984081][ T5876] usb 5-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 381.984098][ T5876] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.984108][ T5876] usb 5-1: Product: syz [ 381.984115][ T5876] usb 5-1: Manufacturer: syz [ 381.984122][ T5876] usb 5-1: SerialNumber: syz [ 382.029012][ T7121] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 382.029038][ T7121] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 382.029054][ T7121] usb 1-1: config 0 has no interface number 0 [ 382.029095][ T7121] usb 1-1: config 0 interface 8 altsetting 248 endpoint 0xC has an invalid bInterval 0, changing to 10 [ 382.029119][ T7121] usb 1-1: config 0 interface 8 altsetting 248 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 382.029143][ T7121] usb 1-1: config 0 interface 8 has no altsetting 0 [ 382.039823][ T5980] usb 2-1: Using ep0 maxpacket: 8 [ 382.044999][ T5980] usb 2-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 382.045022][ T5980] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.045041][ T5980] usb 2-1: Product: syz [ 382.045053][ T5980] usb 2-1: Manufacturer: syz [ 382.045066][ T5980] usb 2-1: SerialNumber: syz [ 382.071237][ T5876] usb 5-1: config 0 descriptor?? [ 382.123076][ T5876] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 382.123124][ T5876] pctv452e: pctv452e_power_ctrl: 1 [ 382.123124][ T5876] [ 382.124208][ T5876] usb 5-1: selecting invalid altsetting 3 [ 382.124226][ T5876] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 382.124226][ T5876] [ 382.124243][ T5876] dvb-usb: bulk message failed: -22 (5/0) [ 382.146147][ T5876] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 382.147057][ T5876] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 382.147108][ T5876] usb 5-1: media controller created [ 382.147200][ T5876] dvb-usb: bulk message failed: -22 (8/0) [ 382.147215][ T5876] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 382.147260][ T5876] dvb-usb: MAC address reading failed. [ 382.206319][ T5876] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 382.240931][ T5980] usb 2-1: config 0 descriptor?? [ 382.244202][ T7121] usb 1-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=2d.bb [ 382.244230][ T7121] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 382.244248][ T7121] usb 1-1: Product: syz [ 382.244260][ T7121] usb 1-1: Manufacturer: syz [ 382.244273][ T7121] usb 1-1: SerialNumber: syz [ 382.293358][ T5980] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 382.293402][ T5980] pctv452e: pctv452e_power_ctrl: 1 [ 382.293402][ T5980] [ 382.293444][ T5980] usb 2-1: selecting invalid altsetting 3 [ 382.293457][ T5980] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 382.293457][ T5980] [ 382.293472][ T5980] dvb-usb: bulk message failed: -22 (5/0) [ 382.310069][T10431] netlink: 'syz.3.1559': attribute type 1 has an invalid length. [ 382.310138][T10431] netlink: 760 bytes leftover after parsing attributes in process `syz.3.1559'. [ 382.325622][ T5808] Bluetooth: hci4: unexpected event for opcode 0x1c58 [ 382.360288][ T5856] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input96 [ 382.372058][ T5980] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 382.398649][ T5980] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 382.398706][ T5980] usb 2-1: media controller created [ 382.398761][ T5980] dvb-usb: bulk message failed: -22 (8/0) [ 382.398775][ T5980] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 382.398822][ T5980] dvb-usb: MAC address reading failed. [ 382.420402][ T7121] usb 1-1: config 0 descriptor?? [ 382.464801][ T5980] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 382.519042][ T5148] bcm5974 4-1:1.0: could not read from device [ 382.573391][ T5856] usb 4-1: USB disconnect, device number 44 [ 382.595225][ T5876] DVB: Unable to find symbol stb0899_attach() [ 382.595242][ T5876] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 382.667405][ T7121] ath6kl: Failed to submit usb control message: -71 [ 382.667454][ T7121] ath6kl: unable to send the bmi data to the device: -71 [ 382.667467][ T7121] ath6kl: Unable to send get target info: -71 [ 382.696324][ T7121] ath6kl: Failed to init ath6kl core: -71 [ 382.696844][ T7121] ath6kl_usb 1-1:0.8: probe with driver ath6kl_usb failed with error -71 [ 382.714223][ T5980] DVB: Unable to find symbol stb0899_attach() [ 382.714238][ T5980] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 382.719490][ T7121] usb 1-1: USB disconnect, device number 43 [ 382.742208][ T5876] rc_core: IR keymap rc-tt-1500 not found [ 382.742225][ T5876] Registered IR keymap rc-empty [ 382.744365][ T5876] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 382.746190][ T5876] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input97 [ 382.767591][ T5876] dvb-usb: schedule remote query interval to 100 msecs. [ 382.767615][ T5876] pctv452e: pctv452e_power_ctrl: 0 [ 382.767615][ T5876] [ 382.767626][ T5876] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 382.816091][ T5876] usb 5-1: USB disconnect, device number 40 [ 382.880384][ T5980] rc_core: IR keymap rc-tt-1500 not found [ 382.880404][ T5980] Registered IR keymap rc-empty [ 382.881887][ T5980] rc rc1: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc1 [ 382.884606][ T5980] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc1/input98 [ 382.962616][ T5980] dvb-usb: schedule remote query interval to 100 msecs. [ 382.962638][ T5980] pctv452e: pctv452e_power_ctrl: 0 [ 382.962638][ T5980] [ 382.962649][ T5980] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 382.966659][ T5980] usb 2-1: USB disconnect, device number 23 [ 382.972356][ T31] usb 3-1: new full-speed USB device number 46 using dummy_hcd [ 383.087745][ T5876] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 383.111053][ T31] usb 3-1: device descriptor read/64, error -71 [ 383.197427][ T5980] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 383.300365][T10457] netlink: 'syz.3.1566': attribute type 4 has an invalid length. [ 383.350556][ T31] usb 3-1: new full-speed USB device number 47 using dummy_hcd [ 383.418514][T10461] io-wq is not configured for unbound workers [ 383.490398][ T31] usb 3-1: device descriptor read/64, error -71 [ 383.549937][ T5856] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 383.600220][ T31] usb usb3-port1: attempt power cycle [ 383.714812][ T5856] usb 4-1: Using ep0 maxpacket: 8 [ 383.719015][ T5856] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 383.719043][ T5856] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 383.719054][ T5856] usb 4-1: Product: syz [ 383.719061][ T5856] usb 4-1: Manufacturer: syz [ 383.719069][ T5856] usb 4-1: SerialNumber: syz [ 383.743957][ T5856] usb 4-1: config 0 descriptor?? [ 383.777468][ T5856] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 383.777496][ T5856] pctv452e: pctv452e_power_ctrl: 1 [ 383.777496][ T5856] [ 383.777529][ T5856] usb 4-1: selecting invalid altsetting 3 [ 383.777537][ T5856] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 383.777537][ T5856] [ 383.777546][ T5856] dvb-usb: bulk message failed: -22 (5/0) [ 383.786332][ T5856] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 383.793553][ T5856] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 383.793607][ T5856] usb 4-1: media controller created [ 383.793652][ T5856] dvb-usb: bulk message failed: -22 (8/0) [ 383.793665][ T5856] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 383.793711][ T5856] dvb-usb: MAC address reading failed. [ 383.815157][ T5856] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 383.912717][ T5856] DVB: Unable to find symbol stb0899_attach() [ 383.912738][ T5856] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 383.969208][ T5808] Bluetooth: hci3: unexpected event for opcode 0x1c58 [ 383.969846][ T31] usb 3-1: new full-speed USB device number 48 using dummy_hcd [ 384.029829][ T5856] rc_core: IR keymap rc-tt-1500 not found [ 384.029850][ T5856] Registered IR keymap rc-empty [ 384.031450][ T5856] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 384.034430][ T5856] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input99 [ 384.041528][ T31] usb 3-1: device descriptor read/8, error -71 [ 384.050437][ T5856] dvb-usb: schedule remote query interval to 100 msecs. [ 384.050457][ T5856] pctv452e: pctv452e_power_ctrl: 0 [ 384.050457][ T5856] [ 384.050468][ T5856] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 384.062428][ T5856] usb 4-1: USB disconnect, device number 45 [ 384.253312][ T5856] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 384.283442][ T31] usb 3-1: new full-speed USB device number 49 using dummy_hcd [ 384.300572][ T31] usb 3-1: device descriptor read/8, error -71 [ 384.349429][T10478] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1575'. [ 384.410735][T10479] netlink: 'syz.1.1573': attribute type 2 has an invalid length. [ 384.420356][ T31] usb usb3-port1: unable to enumerate USB device [ 384.725311][T10490] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1580'. [ 384.746036][ T5808] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 384.779934][ T5856] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 386.119303][T10493] sctp: [Deprecated]: syz.0.1580 (pid 10493) Use of int in max_burst socket option. [ 386.119303][T10493] Use struct sctp_assoc_value instead [ 386.119562][T10493] binder: 10488:10493 unknown command 0 [ 386.119578][T10493] binder: 10488:10493 ioctl c0306201 200000004a40 returned -22 [ 386.160100][ T5856] usb 5-1: Using ep0 maxpacket: 32 [ 386.162720][ T5856] usb 5-1: unable to get BOS descriptor or descriptor too short [ 386.164956][ T5856] usb 5-1: config 1 interface 0 altsetting 249 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 386.164984][ T5856] usb 5-1: config 1 interface 0 altsetting 249 endpoint 0x81 has invalid wMaxPacketSize 0 [ 386.165004][ T5856] usb 5-1: config 1 interface 0 altsetting 249 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 386.165028][ T5856] usb 5-1: config 1 interface 0 has no altsetting 0 [ 386.167184][ T5856] usb 5-1: New USB device found, idVendor=05ac, idProduct=0259, bcdDevice= 0.40 [ 386.167208][ T5856] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.167226][ T5856] usb 5-1: Product: syz [ 386.167238][ T5856] usb 5-1: Manufacturer: syz [ 386.167250][ T5856] usb 5-1: SerialNumber: syz [ 386.188561][ T37] audit: type=1326 audit(16912429.850:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10488 comm="syz.0.1580" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0aea34c819 code=0x0 [ 386.718689][T10484] netlink: 'syz.4.1577': attribute type 1 has an invalid length. [ 386.718713][T10484] netlink: 760 bytes leftover after parsing attributes in process `syz.4.1577'. [ 386.758594][ T5856] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input100 [ 387.465021][ T5148] bcm5974 5-1:1.0: could not read from device [ 387.487320][ T5856] usb 5-1: USB disconnect, device number 41 [ 387.505439][ T31] IPVS: starting estimator thread 0... [ 387.701527][T10507] IPVS: using max 10 ests per chain, 24000 per kthread [ 387.788563][ T7802] udevd[7802]: Error opening device "/dev/input/event4": No such file or directory [ 387.788612][ T7802] udevd[7802]: Unable to EVIOCGABS device "/dev/input/event4" [ 387.788651][ T7802] udevd[7802]: Unable to EVIOCGABS device "/dev/input/event4" [ 387.788688][ T7802] udevd[7802]: Unable to EVIOCGABS device "/dev/input/event4" [ 387.788724][ T7802] udevd[7802]: Unable to EVIOCGABS device "/dev/input/event4" [ 387.788768][ T7802] udevd[7802]: Assertion 'close_nointr(fd) != -EBADF' failed at util.c:228, function safe_close(). Aborting. [ 387.810614][ T5808] Bluetooth: hci2: ISO packet for unknown connection handle 5 [ 387.846618][ T5163] udevd[5163]: worker [7802] terminated by signal 6 (Aborted) [ 387.846666][ T5163] udevd[5163]: worker [7802] failed while handling '/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input100/event4' [ 390.123073][T10519] FAULT_INJECTION: forcing a failure. [ 390.123073][T10519] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 390.123125][T10519] CPU: 0 UID: 0 PID: 10519 Comm: syz.0.1587 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 390.123154][T10519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 390.123164][T10519] Call Trace: [ 390.123172][T10519] [ 390.123181][T10519] dump_stack_lvl+0xe8/0x150 [ 390.123204][T10519] should_fail_ex+0x46b/0x600 [ 390.123221][T10519] _copy_from_user+0x2d/0xb0 [ 390.123232][T10519] __sys_bpf+0x229/0x950 [ 390.123247][T10519] ? __pfx___sys_bpf+0x10/0x10 [ 390.123273][T10519] __x64_sys_bpf+0x7c/0x90 [ 390.123285][T10519] do_syscall_64+0x14d/0xf80 [ 390.123296][T10519] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.123306][T10519] ? clear_bhb_loop+0x40/0x90 [ 390.123318][T10519] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 390.123327][T10519] RIP: 0033:0x7f0aea34c819 [ 390.123338][T10519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 390.123346][T10519] RSP: 002b:00007f0ae857d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 390.123357][T10519] RAX: ffffffffffffffda RBX: 00007f0aea5c6090 RCX: 00007f0aea34c819 [ 390.123364][T10519] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 390.123371][T10519] RBP: 00007f0ae857d090 R08: 0000000000000000 R09: 0000000000000000 [ 390.123376][T10519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 390.123382][T10519] R13: 00007f0aea5c6128 R14: 00007f0aea5c6090 R15: 00007ffd3b410248 [ 390.123397][T10519] [ 393.089889][ T812] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 393.245558][ T812] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 393.245588][ T812] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 393.247686][ T812] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 393.247713][ T812] usb 5-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 393.247730][ T812] usb 5-1: Manufacturer: syz [ 393.282095][ T812] usb 5-1: config 0 descriptor?? [ 394.006342][T10554] FAULT_INJECTION: forcing a failure. [ 394.006342][T10554] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 394.006375][T10554] CPU: 1 UID: 0 PID: 10554 Comm: syz.0.1591 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 394.006395][T10554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 394.006407][T10554] Call Trace: [ 394.006414][T10554] [ 394.006422][T10554] dump_stack_lvl+0xe8/0x150 [ 394.006451][T10554] should_fail_ex+0x46b/0x600 [ 394.006478][T10554] _copy_from_user+0x2d/0xb0 [ 394.006497][T10554] ___sys_sendmsg+0x1c6/0x360 [ 394.006524][T10554] ? __pfx____sys_sendmsg+0x10/0x10 [ 394.006574][T10554] ? __fget_files+0x2a/0x420 [ 394.006596][T10554] ? __fget_files+0x3a6/0x420 [ 394.006625][T10554] __x64_sys_sendmsg+0x1c3/0x2a0 [ 394.006648][T10554] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 394.006676][T10554] ? __pfx_ksys_write+0x10/0x10 [ 394.006711][T10554] do_syscall_64+0x14d/0xf80 [ 394.006730][T10554] ? trace_irq_disable+0x3b/0x150 [ 394.006750][T10554] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.006767][T10554] ? clear_bhb_loop+0x40/0x90 [ 394.006789][T10554] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.006806][T10554] RIP: 0033:0x7f0aea34c819 [ 394.006823][T10554] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 394.006840][T10554] RSP: 002b:00007f0ae859e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 394.006860][T10554] RAX: ffffffffffffffda RBX: 00007f0aea5c5fa0 RCX: 00007f0aea34c819 [ 394.006881][T10554] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000006 [ 394.006892][T10554] RBP: 00007f0ae859e090 R08: 0000000000000000 R09: 0000000000000000 [ 394.006903][T10554] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 394.006914][T10554] R13: 00007f0aea5c6038 R14: 00007f0aea5c5fa0 R15: 00007ffd3b410248 [ 394.006942][T10554] [ 396.653706][T10583] vlan3: entered allmulticast mode [ 397.160265][ T812] usbhid 5-1:0.0: can't add hid device: -71 [ 397.160384][ T812] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 397.182199][ T812] usb 5-1: USB disconnect, device number 42 [ 397.468866][T10597] netlink: 'syz.0.1602': attribute type 1 has an invalid length. [ 397.533146][ T37] audit: type=1800 audit(16912441.190:62): pid=10595 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.4.1601" name="bus" dev="tmpfs" ino=1198 res=0 errno=0 [ 397.739895][ T812] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 397.891782][ T812] usb 1-1: config index 0 descriptor too short (expected 64638, got 72) [ 397.894194][ T812] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 397.894211][ T812] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 397.894221][ T812] usb 1-1: Product: syz [ 397.894227][ T812] usb 1-1: Manufacturer: syz [ 397.894234][ T812] usb 1-1: SerialNumber: syz [ 397.911960][ T812] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 397.950009][ T9] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 398.245929][ T5808] Bluetooth: hci4: unexpected event for opcode 0x2003 [ 398.382751][T10597] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1602'. [ 398.389493][ T31] usb 1-1: USB disconnect, device number 44 [ 398.661414][ T5856] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 399.240391][ T5856] usb 3-1: Using ep0 maxpacket: 32 [ 399.246802][ T5856] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 399.246826][ T5856] usb 3-1: config 0 has no interface number 0 [ 399.246909][ T5856] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 399.246930][ T5856] usb 3-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 399.252431][ T5856] usb 3-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 399.252458][ T5856] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 399.252476][ T5856] usb 3-1: Product: syz [ 399.252490][ T5856] usb 3-1: Manufacturer: syz [ 399.252502][ T5856] usb 3-1: SerialNumber: syz [ 399.344004][ T5856] usb 3-1: config 0 descriptor?? [ 399.400501][ T36] usb 2-1: new full-speed USB device number 24 using dummy_hcd [ 400.398208][ T9] usb 1-1: Service connection timeout for: 256 [ 400.398232][ T9] ath9k_htc 1-1:1.0: ath9k_htc: Unable to initialize HTC services [ 400.404119][ T9] ath9k_htc: Failed to initialize the device [ 400.421447][ T31] usb 1-1: ath9k_htc: USB layer deinitialized [ 400.621846][ T36] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 400.621872][ T36] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 400.621889][ T36] usb 2-1: config 0 has no interface number 0 [ 400.621983][ T36] usb 2-1: config 0 interface 8 altsetting 248 endpoint 0xC has an invalid bInterval 0, changing to 10 [ 400.622008][ T36] usb 2-1: config 0 interface 8 altsetting 248 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 400.622031][ T36] usb 2-1: config 0 interface 8 has no altsetting 0 [ 400.624874][ T36] usb 2-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=2d.bb [ 400.624900][ T36] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 400.624971][ T36] usb 2-1: Product: syz [ 400.624985][ T36] usb 2-1: Manufacturer: syz [ 400.624997][ T36] usb 2-1: SerialNumber: syz [ 400.635246][ T36] usb 2-1: config 0 descriptor?? [ 401.112192][ T5856] radio-si470x 3-1:0.35: this is not a si470x device. [ 401.140192][ T5856] radio-raremono 3-1:0.35: this is not Thanko's Raremono. [ 401.157891][ T36] ath6kl: Failed to submit usb control message: -71 [ 401.157937][ T36] ath6kl: unable to send the bmi data to the device: -71 [ 401.157950][ T36] ath6kl: Unable to send get target info: -71 [ 401.186693][ T36] ath6kl: Failed to init ath6kl core: -71 [ 401.187322][ T36] ath6kl_usb 2-1:0.8: probe with driver ath6kl_usb failed with error -71 [ 401.255286][ T36] usb 2-1: USB disconnect, device number 24 [ 401.743396][ T9] usb 3-1: USB disconnect, device number 50 [ 403.328786][ T5980] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 403.610633][ T5980] usb 3-1: Using ep0 maxpacket: 32 [ 403.618409][ T5980] usb 3-1: unable to get BOS descriptor or descriptor too short [ 403.620561][ T5980] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 403.620584][ T5980] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 403.626119][ T5980] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000c, bcdDevice= 0.40 [ 403.626144][ T5980] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.626162][ T5980] usb 3-1: Product: syz [ 403.626175][ T5980] usb 3-1: Manufacturer: syz [ 403.626187][ T5980] usb 3-1: SerialNumber: syz [ 403.800095][ T5808] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 405.240274][ T5980] usb 3-1: unit 3 not found! [ 405.366731][ T5980] usb 3-1: USB disconnect, device number 51 [ 405.501655][T10639] udevd[10639]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 407.215163][ T5808] Bluetooth: hci1: unexpected event for opcode 0x2003 [ 407.490489][T10707] FAULT_INJECTION: forcing a failure. [ 407.490489][T10707] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 407.490522][T10707] CPU: 1 UID: 0 PID: 10707 Comm: syz.1.1636 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 407.490543][T10707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 407.490554][T10707] Call Trace: [ 407.490562][T10707] [ 407.490570][T10707] dump_stack_lvl+0xe8/0x150 [ 407.490599][T10707] should_fail_ex+0x46b/0x600 [ 407.490626][T10707] _copy_from_user+0x2d/0xb0 [ 407.490645][T10707] __sys_bpf+0x229/0x950 [ 407.490676][T10707] ? __pfx___sys_bpf+0x10/0x10 [ 407.490695][T10707] ? rt_mutex_slowunlock+0x1cb/0x300 [ 407.490733][T10707] ? ksys_write+0x248/0x270 [ 407.490759][T10707] ? __pfx_ksys_write+0x10/0x10 [ 407.490789][T10707] __x64_sys_bpf+0x7c/0x90 [ 407.490809][T10707] do_syscall_64+0x14d/0xf80 [ 407.490826][T10707] ? trace_irq_disable+0x3b/0x150 [ 407.490845][T10707] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.490863][T10707] ? clear_bhb_loop+0x40/0x90 [ 407.490888][T10707] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 407.490906][T10707] RIP: 0033:0x7feb3433c819 [ 407.490923][T10707] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 407.490937][T10707] RSP: 002b:00007feb32596028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 407.490957][T10707] RAX: ffffffffffffffda RBX: 00007feb345b5fa0 RCX: 00007feb3433c819 [ 407.490970][T10707] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 000000000000000a [ 407.490981][T10707] RBP: 00007feb32596090 R08: 0000000000000000 R09: 0000000000000000 [ 407.490992][T10707] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 407.491003][T10707] R13: 00007feb345b6038 R14: 00007feb345b5fa0 R15: 00007fffd5397b28 [ 407.491032][T10707] [ 408.522340][T10714] netlink: 'syz.4.1638': attribute type 12 has an invalid length. [ 408.748489][T10721] FAULT_INJECTION: forcing a failure. [ 408.748489][T10721] name failslab, interval 1, probability 0, space 0, times 0 [ 408.748522][T10721] CPU: 1 UID: 0 PID: 10721 Comm: syz.0.1640 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 408.748543][T10721] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 408.748554][T10721] Call Trace: [ 408.748562][T10721] [ 408.748570][T10721] dump_stack_lvl+0xe8/0x150 [ 408.748599][T10721] should_fail_ex+0x46b/0x600 [ 408.748629][T10721] should_failslab+0xa8/0x100 [ 408.748650][T10721] __kmalloc_noprof+0xdf/0x7b0 [ 408.748666][T10721] ? kfree+0x4d/0x6c0 [ 408.748688][T10721] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 408.748716][T10721] tomoyo_realpath_from_path+0xe3/0x5d0 [ 408.748747][T10721] ? tomoyo_path_number_perm+0x219/0x630 [ 408.748765][T10721] tomoyo_path_number_perm+0x246/0x630 [ 408.748787][T10721] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 408.748808][T10721] ? __lock_acquire+0x6b5/0x2cf0 [ 408.748859][T10721] ? __fget_files+0x2a/0x420 [ 408.748884][T10721] ? __fget_files+0x2a/0x420 [ 408.748903][T10721] ? __fget_files+0x3a6/0x420 [ 408.748923][T10721] ? __fget_files+0x2a/0x420 [ 408.748947][T10721] security_file_ioctl+0xc3/0x2a0 [ 408.748970][T10721] __se_sys_ioctl+0x47/0x170 [ 408.748991][T10721] do_syscall_64+0x14d/0xf80 [ 408.749010][T10721] ? trace_irq_disable+0x3b/0x150 [ 408.749029][T10721] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.749048][T10721] ? clear_bhb_loop+0x40/0x90 [ 408.749068][T10721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.749086][T10721] RIP: 0033:0x7f0aea34c819 [ 408.749103][T10721] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 408.749118][T10721] RSP: 002b:00007f0ae855c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 408.749137][T10721] RAX: ffffffffffffffda RBX: 00007f0aea5c6180 RCX: 00007f0aea34c819 [ 408.749151][T10721] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 [ 408.749162][T10721] RBP: 00007f0ae855c090 R08: 0000000000000000 R09: 0000000000000000 [ 408.749174][T10721] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 408.749184][T10721] R13: 00007f0aea5c6218 R14: 00007f0aea5c6180 R15: 00007ffd3b410248 [ 408.749215][T10721] [ 408.749222][T10721] ERROR: Out of memory at tomoyo_realpath_from_path. [ 410.116675][ T5856] usb 5-1: new full-speed USB device number 43 using dummy_hcd [ 410.391126][ T5856] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 410.391157][ T5856] usb 5-1: config 0 interface 0 altsetting 128 endpoint 0x81 has invalid wMaxPacketSize 0 [ 410.391178][ T5856] usb 5-1: config 0 interface 0 has no altsetting 0 [ 410.391200][ T5856] usb 5-1: New USB device found, idVendor=05ac, idProduct=0320, bcdDevice= 0.00 [ 410.391212][ T5856] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 410.449950][ T5856] usb 5-1: config 0 descriptor?? [ 411.146632][ T812] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 411.421203][ T5856] usbhid 5-1:0.0: can't add hid device: -71 [ 411.421311][ T5856] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 411.541520][ T5856] usb 5-1: USB disconnect, device number 43 [ 411.641652][ T812] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 411.641682][ T812] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 411.642717][ T812] usb 2-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 411.642742][ T812] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 411.642759][ T812] usb 2-1: Manufacturer: syz [ 411.652343][ T812] usb 2-1: config 0 descriptor?? [ 412.275459][T10743] FAULT_INJECTION: forcing a failure. [ 412.275459][T10743] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 412.275510][T10743] CPU: 0 UID: 0 PID: 10743 Comm: syz.4.1646 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 412.275533][T10743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 412.275544][T10743] Call Trace: [ 412.275551][T10743] [ 412.275560][T10743] dump_stack_lvl+0xe8/0x150 [ 412.275584][T10743] should_fail_ex+0x46b/0x600 [ 412.275601][T10743] _copy_from_user+0x2d/0xb0 [ 412.275612][T10743] ___sys_sendmsg+0x1c6/0x360 [ 412.275626][T10743] ? __pfx____sys_sendmsg+0x10/0x10 [ 412.275654][T10743] ? __fget_files+0x2a/0x420 [ 412.275667][T10743] ? __fget_files+0x3a6/0x420 [ 412.275683][T10743] __sys_sendmmsg+0x282/0x4e0 [ 412.275697][T10743] ? __pfx___sys_sendmmsg+0x10/0x10 [ 412.275728][T10743] __x64_sys_sendmmsg+0xa0/0xc0 [ 412.275740][T10743] do_syscall_64+0x14d/0xf80 [ 412.275752][T10743] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.275762][T10743] ? clear_bhb_loop+0x40/0x90 [ 412.275774][T10743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 412.275783][T10743] RIP: 0033:0x7fef954dc819 [ 412.275794][T10743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.275803][T10743] RSP: 002b:00007fef93715028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 412.275815][T10743] RAX: ffffffffffffffda RBX: 00007fef95756090 RCX: 00007fef954dc819 [ 412.275822][T10743] RDX: 0400000000000172 RSI: 0000200000003cc0 RDI: 0000000000000005 [ 412.275829][T10743] RBP: 00007fef93715090 R08: 0000000000000000 R09: 0000000000000000 [ 412.275835][T10743] R10: 0000000004001c00 R11: 0000000000000246 R12: 0000000000000001 [ 412.275841][T10743] R13: 00007fef95756128 R14: 00007fef95756090 R15: 00007ffc7cc9e3d8 [ 412.275856][T10743] [ 414.070317][ T5808] Bluetooth: hci4: unexpected event for opcode 0x2003 [ 414.632305][ T812] usbhid 2-1:0.0: can't add hid device: -71 [ 414.632421][ T812] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 414.645952][ T812] usb 2-1: USB disconnect, device number 25 [ 414.748433][T10788] netlink: 'syz.3.1654': attribute type 4 has an invalid length. [ 414.783826][T10789] FAULT_INJECTION: forcing a failure. [ 414.783826][T10789] name failslab, interval 1, probability 0, space 0, times 0 [ 414.783857][T10789] CPU: 0 UID: 0 PID: 10789 Comm: syz.0.1652 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 414.783875][T10789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 414.783881][T10789] Call Trace: [ 414.783886][T10789] [ 414.783891][T10789] dump_stack_lvl+0xe8/0x150 [ 414.783910][T10789] should_fail_ex+0x46b/0x600 [ 414.783927][T10789] should_failslab+0xa8/0x100 [ 414.783946][T10789] kmem_cache_alloc_noprof+0x87/0x680 [ 414.783962][T10789] ? do_getname+0x2e/0x250 [ 414.783976][T10789] do_getname+0x2e/0x250 [ 414.783985][T10789] ? getname_flags+0x11/0x20 [ 414.783997][T10789] __se_sys_statx+0xd7/0x2a0 [ 414.784009][T10789] ? lockdep_hardirqs_on+0x7a/0x110 [ 414.784021][T10789] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 414.784033][T10789] ? __pfx___se_sys_statx+0x10/0x10 [ 414.784049][T10789] ? fput+0xa0/0xd0 [ 414.784062][T10789] ? ksys_write+0x248/0x270 [ 414.784077][T10789] ? __pfx_ksys_write+0x10/0x10 [ 414.784094][T10789] ? __x64_sys_statx+0x20/0xc0 [ 414.784106][T10789] do_syscall_64+0x14d/0xf80 [ 414.784117][T10789] ? trace_irq_disable+0x3b/0x150 [ 414.784128][T10789] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.784138][T10789] ? clear_bhb_loop+0x40/0x90 [ 414.784150][T10789] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 414.784159][T10789] RIP: 0033:0x7f0aea34c819 [ 414.784170][T10789] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 414.784178][T10789] RSP: 002b:00007f0ae857d028 EFLAGS: 00000246 ORIG_RAX: 000000000000014c [ 414.784190][T10789] RAX: ffffffffffffffda RBX: 00007f0aea5c6090 RCX: 00007f0aea34c819 [ 414.784197][T10789] RDX: 0000000000002000 RSI: 00002000000001c0 RDI: ffffffffffffff9c [ 414.784204][T10789] RBP: 00007f0ae857d090 R08: 0000000000000000 R09: 0000000000000000 [ 414.784210][T10789] R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000001 [ 414.784216][T10789] R13: 00007f0aea5c6128 R14: 00007f0aea5c6090 R15: 00007ffd3b410248 [ 414.784231][T10789] [ 414.999920][ T5899] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 415.711719][ T5899] usb 4-1: Using ep0 maxpacket: 8 [ 415.786045][ T5899] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 415.786074][ T5899] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.786092][ T5899] usb 4-1: Product: syz [ 415.786105][ T5899] usb 4-1: Manufacturer: syz [ 415.786118][ T5899] usb 4-1: SerialNumber: syz [ 415.860314][T10796] FAULT_INJECTION: forcing a failure. [ 415.860314][T10796] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 415.860369][T10796] CPU: 0 UID: 0 PID: 10796 Comm: syz.1.1655 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 415.860390][T10796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 415.860401][T10796] Call Trace: [ 415.860409][T10796] [ 415.860417][T10796] dump_stack_lvl+0xe8/0x150 [ 415.860446][T10796] should_fail_ex+0x46b/0x600 [ 415.860470][T10796] _copy_from_user+0x2d/0xb0 [ 415.860484][T10796] ___sys_sendmsg+0x1c6/0x360 [ 415.860504][T10796] ? __pfx____sys_sendmsg+0x10/0x10 [ 415.860541][T10796] ? __fget_files+0x2a/0x420 [ 415.860558][T10796] ? __fget_files+0x3a6/0x420 [ 415.860580][T10796] __x64_sys_sendmsg+0x1c3/0x2a0 [ 415.860597][T10796] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 415.860626][T10796] ? __pfx_ksys_write+0x10/0x10 [ 415.860652][T10796] do_syscall_64+0x14d/0xf80 [ 415.860666][T10796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.860679][T10796] ? clear_bhb_loop+0x40/0x90 [ 415.860694][T10796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 415.860707][T10796] RIP: 0033:0x7feb3433c819 [ 415.860720][T10796] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 415.860731][T10796] RSP: 002b:00007feb32554028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 415.860746][T10796] RAX: ffffffffffffffda RBX: 00007feb345b6180 RCX: 00007feb3433c819 [ 415.860755][T10796] RDX: 0000000000048043 RSI: 0000200000000800 RDI: 0000000000000007 [ 415.860764][T10796] RBP: 00007feb32554090 R08: 0000000000000000 R09: 0000000000000000 [ 415.860773][T10796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 415.860781][T10796] R13: 00007feb345b6218 R14: 00007feb345b6180 R15: 00007fffd5397b28 [ 415.860802][T10796] [ 416.641737][ T5899] usb 4-1: config 0 descriptor?? [ 416.647601][ T5899] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 416.647628][ T5899] pctv452e: pctv452e_power_ctrl: 1 [ 416.647628][ T5899] [ 416.647654][ T5899] usb 4-1: selecting invalid altsetting 3 [ 416.647662][ T5899] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 416.647662][ T5899] [ 416.647671][ T5899] dvb-usb: bulk message failed: -22 (5/0) [ 416.657531][ T5899] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 416.658915][ T5899] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 416.658965][ T5899] usb 4-1: media controller created [ 416.659011][ T5899] dvb-usb: bulk message failed: -22 (8/0) [ 416.659025][ T5899] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 416.659069][ T5899] dvb-usb: MAC address reading failed. [ 416.683068][ T5899] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 416.901814][ T5808] Bluetooth: hci3: unexpected event for opcode 0x1c58 [ 416.903544][ T5899] DVB: Unable to find symbol stb0899_attach() [ 416.903555][ T5899] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 417.059859][ T5899] rc_core: IR keymap rc-tt-1500 not found [ 417.059880][ T5899] Registered IR keymap rc-empty [ 417.061551][ T5899] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 417.064488][ T5899] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input101 [ 417.080360][ T5899] dvb-usb: schedule remote query interval to 100 msecs. [ 417.080382][ T5899] pctv452e: pctv452e_power_ctrl: 0 [ 417.080382][ T5899] [ 417.080392][ T5899] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 417.102695][ T5899] usb 4-1: USB disconnect, device number 46 [ 417.416511][ T5899] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 419.622555][ T5808] Bluetooth: hci2: unexpected event for opcode 0x2003 [ 424.098838][T10863] random: crng reseeded on system resumption [ 425.128603][ T5899] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 425.251887][T10871] random: crng reseeded on system resumption [ 426.279905][ T5899] usb 5-1: Using ep0 maxpacket: 32 [ 426.307807][ T5899] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 426.307834][ T5899] usb 5-1: config 0 has no interface number 0 [ 426.307876][ T5899] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 426.307900][ T5899] usb 5-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 426.349070][ T5899] usb 5-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 426.349101][ T5899] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.349119][ T5899] usb 5-1: Product: syz [ 426.349132][ T5899] usb 5-1: Manufacturer: syz [ 426.349144][ T5899] usb 5-1: SerialNumber: syz [ 426.399455][ T5899] usb 5-1: config 0 descriptor?? [ 426.657334][ T5899] radio-si470x 5-1:0.35: this is not a si470x device. [ 427.460152][ T5899] radio-raremono 5-1:0.35: this is not Thanko's Raremono. [ 427.515702][ T5899] usb 5-1: USB disconnect, device number 44 [ 428.162094][ T5808] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 430.059403][T10898] FAULT_INJECTION: forcing a failure. [ 430.059403][T10898] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 430.059455][T10898] CPU: 0 UID: 0 PID: 10898 Comm: syz.2.1688 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 430.059477][T10898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 430.059489][T10898] Call Trace: [ 430.059497][T10898] [ 430.059505][T10898] dump_stack_lvl+0xe8/0x150 [ 430.059529][T10898] should_fail_ex+0x46b/0x600 [ 430.059546][T10898] _copy_from_user+0x2d/0xb0 [ 430.059557][T10898] ___sys_sendmsg+0x1c6/0x360 [ 430.059571][T10898] ? __pfx____sys_sendmsg+0x10/0x10 [ 430.059584][T10898] ? irqentry_exit+0x59e/0x620 [ 430.059595][T10898] ? rcu_is_watching+0x15/0xb0 [ 430.059624][T10898] ? __fget_files+0x2a/0x420 [ 430.059637][T10898] ? __fget_files+0x3a6/0x420 [ 430.059653][T10898] __x64_sys_sendmsg+0x1c3/0x2a0 [ 430.059666][T10898] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 430.059690][T10898] ? __pfx_ksys_write+0x10/0x10 [ 430.059720][T10898] do_syscall_64+0x14d/0xf80 [ 430.059739][T10898] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.059750][T10898] ? clear_bhb_loop+0x40/0x90 [ 430.059762][T10898] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.059771][T10898] RIP: 0033:0x7fb5f2bec819 [ 430.059781][T10898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 430.059790][T10898] RSP: 002b:00007fb5f0e25028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 430.059801][T10898] RAX: ffffffffffffffda RBX: 00007fb5f2e66090 RCX: 00007fb5f2bec819 [ 430.059808][T10898] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 430.059814][T10898] RBP: 00007fb5f0e25090 R08: 0000000000000000 R09: 0000000000000000 [ 430.059820][T10898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 430.059826][T10898] R13: 00007fb5f2e66128 R14: 00007fb5f2e66090 R15: 00007ffc96e5da28 [ 430.059841][T10898] [ 431.844559][T10914] fuse: Bad value for 'user_id' [ 431.844579][T10914] fuse: Bad value for 'user_id' [ 432.079927][T10917] netlink: 'syz.0.1694': attribute type 4 has an invalid length. [ 432.409882][ T5856] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 432.639805][ T5856] usb 1-1: Using ep0 maxpacket: 8 [ 432.643536][ T5856] usb 1-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 432.643553][ T5856] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.643562][ T5856] usb 1-1: Product: syz [ 432.643570][ T5856] usb 1-1: Manufacturer: syz [ 432.643577][ T5856] usb 1-1: SerialNumber: syz [ 432.646328][ T5856] usb 1-1: config 0 descriptor?? [ 432.649111][ T5856] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 432.649138][ T5856] pctv452e: pctv452e_power_ctrl: 1 [ 432.649138][ T5856] [ 432.649173][ T5856] usb 1-1: selecting invalid altsetting 3 [ 432.649182][ T5856] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 432.649182][ T5856] [ 432.649191][ T5856] dvb-usb: bulk message failed: -22 (5/0) [ 432.673305][ T5856] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 432.688379][ T5856] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 432.688433][ T5856] usb 1-1: media controller created [ 432.688478][ T5856] dvb-usb: bulk message failed: -22 (8/0) [ 432.688492][ T5856] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 432.688538][ T5856] dvb-usb: MAC address reading failed. [ 432.753467][ T5856] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 432.871060][ T5808] Bluetooth: hci2: unexpected event for opcode 0x1c58 [ 432.899852][ T5856] DVB: Unable to find symbol stb0899_attach() [ 432.899868][ T5856] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 433.029869][ T5856] rc_core: IR keymap rc-tt-1500 not found [ 433.029888][ T5856] Registered IR keymap rc-empty [ 433.031483][ T5856] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 433.033509][ T5856] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input103 [ 433.046060][ T5856] dvb-usb: schedule remote query interval to 100 msecs. [ 433.046081][ T5856] pctv452e: pctv452e_power_ctrl: 0 [ 433.046081][ T5856] [ 433.046090][ T5856] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 433.159954][ T31] dvb-usb: bulk message failed: -22 (4/0) [ 433.159989][ T31] dvb-usb: error -22 while querying for an remote control event. [ 433.279936][ T31] dvb-usb: bulk message failed: -22 (4/0) [ 433.279966][ T31] dvb-usb: error -22 while querying for an remote control event. [ 433.389880][ T31] dvb-usb: bulk message failed: -22 (4/0) [ 433.389916][ T31] dvb-usb: error -22 while querying for an remote control event. [ 433.502820][ T31] dvb-usb: bulk message failed: -22 (4/0) [ 433.502852][ T31] dvb-usb: error -22 while querying for an remote control event. [ 433.671805][T10938] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 433.671897][T10938] ALSA: mixer_oss: invalid index 1374389 [ 433.738509][ T5856] dvb-usb: bulk message failed: -22 (4/0) [ 433.738614][ T5856] dvb-usb: error -22 while querying for an remote control event. [ 433.841299][ T36] dvb-usb: bulk message failed: -22 (4/0) [ 433.841466][ T36] dvb-usb: error -22 while querying for an remote control event. [ 434.029796][ T5856] dvb-usb: bulk message failed: -22 (4/0) [ 434.029818][ T5856] dvb-usb: error -22 while querying for an remote control event. [ 434.069867][ T5899] usb 1-1: USB disconnect, device number 45 [ 434.160467][ T31] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 434.320573][ T31] usb 4-1: Using ep0 maxpacket: 16 [ 434.323046][ T31] usb 4-1: config index 0 descriptor too short (expected 29555, got 27) [ 434.323072][ T31] usb 4-1: config 109 has too many interfaces: 95, using maximum allowed: 32 [ 434.323089][ T31] usb 4-1: config 109 has an invalid descriptor of length 114, skipping remainder of the config [ 434.323107][ T31] usb 4-1: config 109 has 0 interfaces, different from the descriptor's value: 95 [ 434.325226][ T31] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 434.325253][ T31] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.325265][ T31] usb 4-1: Product: syz [ 434.325273][ T31] usb 4-1: Manufacturer: syz [ 434.325280][ T31] usb 4-1: SerialNumber: syz [ 434.506002][ T5899] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 434.566820][T10943] netlink: 'syz.2.1699': attribute type 4 has an invalid length. [ 435.250516][ T7121] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 435.399888][ T7121] usb 3-1: Using ep0 maxpacket: 8 [ 435.404693][ T7121] usb 3-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 435.404721][ T7121] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.404739][ T7121] usb 3-1: Product: syz [ 435.404751][ T7121] usb 3-1: Manufacturer: syz [ 435.404764][ T7121] usb 3-1: SerialNumber: syz [ 435.410184][ T7121] usb 3-1: config 0 descriptor?? [ 435.418917][ T7121] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 435.418959][ T7121] pctv452e: pctv452e_power_ctrl: 1 [ 435.418959][ T7121] [ 435.419001][ T7121] usb 3-1: selecting invalid altsetting 3 [ 435.419014][ T7121] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 435.419014][ T7121] [ 435.419029][ T7121] dvb-usb: bulk message failed: -22 (5/0) [ 435.427216][ T7121] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 435.428336][ T7121] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 435.428388][ T7121] usb 3-1: media controller created [ 435.428434][ T7121] dvb-usb: bulk message failed: -22 (8/0) [ 435.428447][ T7121] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 435.428495][ T7121] dvb-usb: MAC address reading failed. [ 435.577345][ T7121] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 435.596357][ T5808] Bluetooth: hci4: unexpected event for opcode 0x2003 [ 435.623447][ T5808] Bluetooth: hci1: unexpected event for opcode 0x1c58 [ 436.469669][ T31] usb 4-1: USB disconnect, device number 47 [ 436.578796][ T7121] DVB: Unable to find symbol stb0899_attach() [ 436.578811][ T7121] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 437.045875][ T36] usb 2-1: new full-speed USB device number 26 using dummy_hcd [ 437.142198][ T7121] rc_core: IR keymap rc-tt-1500 not found [ 437.142212][ T7121] Registered IR keymap rc-empty [ 437.143141][ T7121] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 437.144709][ T7121] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input104 [ 437.157056][ T7121] dvb-usb: schedule remote query interval to 100 msecs. [ 437.157078][ T7121] pctv452e: pctv452e_power_ctrl: 0 [ 437.157078][ T7121] [ 437.157093][ T7121] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 437.222180][ T36] usb 2-1: config 0 has an invalid interface number: 8 but max is 0 [ 437.222206][ T36] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 437.222225][ T36] usb 2-1: config 0 has no interface number 0 [ 437.222266][ T36] usb 2-1: config 0 interface 8 altsetting 248 endpoint 0xC has an invalid bInterval 0, changing to 10 [ 437.222291][ T36] usb 2-1: config 0 interface 8 altsetting 248 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 437.222314][ T36] usb 2-1: config 0 interface 8 has no altsetting 0 [ 437.224562][ T36] usb 2-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=2d.bb [ 437.224587][ T36] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.224605][ T36] usb 2-1: Product: syz [ 437.224618][ T36] usb 2-1: Manufacturer: syz [ 437.224631][ T36] usb 2-1: SerialNumber: syz [ 437.298489][ T5899] dvb-usb: bulk message failed: -22 (4/0) [ 437.298521][ T5899] dvb-usb: error -22 while querying for an remote control event. [ 437.306872][ T7121] usb 3-1: USB disconnect, device number 52 [ 438.156052][ T5899] dvb-usb: bulk message failed: -22 (4/0) [ 438.156073][ T5899] dvb-usb: error -22 while querying for an remote control event. [ 438.303844][ T36] usb 2-1: config 0 descriptor?? [ 438.629483][ T36] ath6kl: Failed to submit usb control message: -71 [ 438.629530][ T36] ath6kl: unable to send the bmi data to the device: -71 [ 438.629543][ T36] ath6kl: Unable to send get target info: -71 [ 438.656823][ T36] ath6kl: Failed to init ath6kl core: -71 [ 438.657339][ T36] ath6kl_usb 2-1:0.8: probe with driver ath6kl_usb failed with error -71 [ 438.719877][ T36] usb 2-1: USB disconnect, device number 26 [ 438.742834][ T7121] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 438.883444][T10995] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1712'. [ 439.319846][ T7121] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 439.469877][ T7121] usb 1-1: Using ep0 maxpacket: 8 [ 439.472107][ T7121] usb 1-1: config 0 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 12 [ 439.472137][ T7121] usb 1-1: config 0 interface 0 has no altsetting 0 [ 439.472168][ T7121] usb 1-1: New USB device found, idVendor=046d, idProduct=c090, bcdDevice= 0.00 [ 439.472187][ T7121] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.540595][ T7121] usb 1-1: config 0 descriptor?? [ 440.910644][ T1324] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.911314][ T1324] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.990745][ T7121] usbhid 1-1:0.0: can't add hid device: -71 [ 440.990856][ T7121] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 441.020191][ T7121] usb 1-1: USB disconnect, device number 46 [ 443.205165][ T7121] IPVS: starting estimator thread 0... [ 443.522797][T11043] IPVS: using max 12 ests per chain, 28800 per kthread [ 443.525260][T11042] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 443.775954][ T31] lo speed is unknown, defaulting to 1000 [ 444.330155][ T5856] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 445.179835][ T5856] usb 5-1: device descriptor read/64, error -71 [ 445.474210][ T5856] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 445.799838][ T5856] usb 5-1: device descriptor read/64, error -71 [ 445.921997][ T5856] usb usb5-port1: attempt power cycle [ 446.346856][ T5856] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 446.408027][ T5856] usb 5-1: device descriptor read/8, error -71 [ 447.040173][ T5899] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 447.123402][ T5856] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 447.209886][ T5899] usb 3-1: Using ep0 maxpacket: 8 [ 447.216865][ T5899] usb 3-1: config 1 interface 0 altsetting 144 endpoint 0x2 has an invalid bInterval 203, changing to 11 [ 447.216899][ T5899] usb 3-1: config 1 interface 0 altsetting 144 endpoint 0x2 has invalid wMaxPacketSize 0 [ 447.216918][ T5899] usb 3-1: config 1 interface 0 has no altsetting 0 [ 447.231471][ T5856] usb 5-1: device descriptor read/8, error -71 [ 447.283117][ T5808] Bluetooth: hci5: command 0x0406 tx timeout [ 447.340198][ T5856] usb usb5-port1: unable to enumerate USB device [ 447.411366][ T5899] usb 3-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.40 [ 447.411393][ T5899] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.411410][ T5899] usb 3-1: Product: 鈷䂓赪æ”ᇊ⾔ꚯ䡀望妘退à²î‰·ìœ«é¹çŸè˜Û¶é˜žæ½‡è¿€ã¥—⽠虾㳜ã…븠ଷ츨钶â£ç‰„孰泯댙ﺿ㒅昱ⱄݹ㈬ﭫ擉嫡蓼íŠæƒ”㋻䷛茵쟪삖䒋ྃâ‰ãŒ­ïœ¶â–¶íŠ³åº©ë›„ᥱ㗜å‰â¶”觧矃䃌퇡鈙࿬é¬è¢†ì¬™ê«¢ë”¥ë¬¢íž‹ïªªé¿„㭗逓â£á†î•©èŠ­çŠä•æˆ…ý⑪➅褙Ӏì郔åµå«‚뻷㸨焅䉃타è¿å¡²ê©£é‰›é¿Žî©¿Ã†íž›í“åŠè§« [ 447.411439][ T5899] usb 3-1: Manufacturer: 姖廉㬛戲î‰â‹«ë©°äŽ”ë‘„ç„帺拞톮⛢잱啗蒫旡삣êšî‡œé“€ç‚¦ï«œå»¸à§¿ê–·è˜»ãº§ã¼’벸ﴻଜá•æ¯ˆë´ƒê„±å©ºïˆ‹ï ½ï¢•ë‰©á“¿êƒæ””à¨í†»î™…䩭䦄éŠá›¦äªåµ¢à§‹æ€á—┖㙕纘ꞌ༳㶤ɤܪೋꂑ祋ê³é®²ç’–撛龭㨞풸á—拒苸촚㉵뽠寂ൢ宓뜤ᧅ鋺河㊲匲羸痤 [ 447.411462][ T5899] usb 3-1: SerialNumber: ã [ 447.896253][T11082] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 448.626112][ T5806] Bluetooth: hci3: unexpected event for opcode 0x2003 [ 450.029880][ T5856] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 450.163831][ T5899] usbhid 3-1:1.0: can't add hid device: -71 [ 450.163948][ T5899] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 450.199891][ T5856] usb 2-1: Using ep0 maxpacket: 32 [ 450.202898][ T5856] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 450.202923][ T5856] usb 2-1: config 0 has no interface number 0 [ 450.202965][ T5856] usb 2-1: config 0 interface 184 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 450.202986][ T5856] usb 2-1: config 0 interface 184 has no altsetting 0 [ 450.206388][ T5856] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 450.206411][ T5856] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.206428][ T5856] usb 2-1: Product: syz [ 450.206440][ T5856] usb 2-1: Manufacturer: syz [ 450.206451][ T5856] usb 2-1: SerialNumber: syz [ 450.223452][ T5899] usb 3-1: USB disconnect, device number 53 [ 450.333511][ T5856] usb 2-1: config 0 descriptor?? [ 450.356603][ T5856] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 450.356853][ T5856] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -22 [ 450.568171][ T5856] usb 2-1: USB disconnect, device number 27 [ 450.676203][T11111] FAULT_INJECTION: forcing a failure. [ 450.676203][T11111] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 450.676258][T11111] CPU: 0 UID: 0 PID: 11111 Comm: syz.4.1752 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 450.676279][T11111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 450.676291][T11111] Call Trace: [ 450.676299][T11111] [ 450.676307][T11111] dump_stack_lvl+0xe8/0x150 [ 450.676337][T11111] should_fail_ex+0x46b/0x600 [ 450.676366][T11111] _copy_from_user+0x2d/0xb0 [ 450.676385][T11111] copy_clone_args_from_user+0x1fa/0x740 [ 450.676409][T11111] ? trace_sched_exit_tp+0x3a/0x150 [ 450.676433][T11111] ? __pfx_copy_clone_args_from_user+0x10/0x10 [ 450.676471][T11111] __se_sys_clone3+0x142/0x360 [ 450.676498][T11111] ? __pfx___se_sys_clone3+0x10/0x10 [ 450.676529][T11111] ? irqentry_exit+0x59e/0x620 [ 450.676548][T11111] ? lockdep_hardirqs_on+0x7a/0x110 [ 450.676592][T11111] do_syscall_64+0x14d/0xf80 [ 450.676611][T11111] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.676629][T11111] ? clear_bhb_loop+0x40/0x90 [ 450.676651][T11111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.676668][T11111] RIP: 0033:0x7fef954dc819 [ 450.676685][T11111] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 450.676700][T11111] RSP: 002b:00007fef936f3ef8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 450.676720][T11111] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fef954dc819 [ 450.676733][T11111] RDX: 00007fef936f3f10 RSI: 0000000000000058 RDI: 00007fef936f3f10 [ 450.676745][T11111] RBP: 00007fef936f4090 R08: 0000000000000000 R09: 0000000000000058 [ 450.676756][T11111] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 450.676768][T11111] R13: 00007fef95756218 R14: 00007fef95756180 R15: 00007ffc7cc9e3d8 [ 450.676796][T11111] [ 450.694213][ T9] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 451.412350][ T9] usb 1-1: config index 0 descriptor too short (expected 64638, got 72) [ 451.415446][ T9] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 451.415473][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.415490][ T9] usb 1-1: Product: syz [ 451.415502][ T9] usb 1-1: Manufacturer: syz [ 451.415514][ T9] usb 1-1: SerialNumber: syz [ 451.507906][ T9] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 451.589086][ T5899] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 453.353671][ T5899] usb 1-1: Service connection timeout for: 256 [ 453.353688][ T5899] ath9k_htc 1-1:1.0: ath9k_htc: Unable to initialize HTC services [ 453.359913][ T7121] usb 1-1: USB disconnect, device number 47 [ 453.385569][ T5899] ath9k_htc: Failed to initialize the device [ 453.424739][ T7121] usb 1-1: ath9k_htc: USB layer deinitialized [ 453.600536][ T7121] ================================================================== [ 453.600553][ T7121] BUG: KASAN: vmalloc-out-of-bounds in __list_add_valid_or_report+0x4e/0x130 [ 453.600583][ T7121] Read of size 8 at addr ffffc90006a92008 by task kworker/0:7/7121 [ 453.600598][ T7121] [ 453.600609][ T7121] CPU: 0 UID: 0 PID: 7121 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 453.600629][ T7121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 453.600642][ T7121] Workqueue: usb_hub_wq hub_event [ 453.600663][ T7121] Call Trace: [ 453.600671][ T7121] [ 453.600679][ T7121] dump_stack_lvl+0xe8/0x150 [ 453.600703][ T7121] print_report+0xba/0x230 [ 453.600724][ T7121] ? __list_add_valid_or_report+0x4e/0x130 [ 453.600743][ T7121] kasan_report+0x117/0x150 [ 453.600762][ T7121] ? __list_add_valid_or_report+0x4e/0x130 [ 453.600785][ T7121] __list_add_valid_or_report+0x4e/0x130 [ 453.600807][ T7121] kcov_remote_stop+0x457/0x680 [ 453.600830][ T7121] hub_event+0x49d8/0x4f60 [ 453.600863][ T7121] ? __perf_event_task_sched_in+0xf2/0x1800 [ 453.600887][ T7121] ? __pfx_hub_event+0x10/0x10 [ 453.600910][ T7121] ? process_scheduled_works+0xa8d/0x18c0 [ 453.600931][ T7121] ? process_scheduled_works+0xa8d/0x18c0 [ 453.600953][ T7121] process_scheduled_works+0xb6e/0x18c0 [ 453.600987][ T7121] ? __pfx_process_scheduled_works+0x10/0x10 [ 453.601010][ T7121] ? assign_work+0x3d5/0x5e0 [ 453.601029][ T7121] worker_thread+0xa53/0xfc0 [ 453.601061][ T7121] kthread+0x388/0x470 [ 453.601079][ T7121] ? __pfx_worker_thread+0x10/0x10 [ 453.601097][ T7121] ? __pfx_kthread+0x10/0x10 [ 453.601114][ T7121] ret_from_fork+0x51e/0xb90 [ 453.601138][ T7121] ? __pfx_ret_from_fork+0x10/0x10 [ 453.601156][ T7121] ? __switch_to+0xc7d/0x1450 [ 453.601174][ T7121] ? __pfx_kthread+0x10/0x10 [ 453.601194][ T7121] ret_from_fork_asm+0x1a/0x30 [ 453.601211][ T7121] [ 453.601216][ T7121] [ 453.601220][ T7121] The buggy address belongs to a vmalloc virtual mapping [ 453.601233][ T7121] Memory state around the buggy address: [ 453.601240][ T7121] ffffc90006a91f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 453.601248][ T7121] ffffc90006a91f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 453.601256][ T7121] >ffffc90006a92000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 453.601263][ T7121] ^ [ 453.601270][ T7121] ffffc90006a92080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 453.601278][ T7121] ffffc90006a92100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 453.601285][ T7121] ================================================================== [ 453.601309][ T7121] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 453.601322][ T7121] CPU: 0 UID: 0 PID: 7121 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 453.601341][ T7121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 453.601352][ T7121] Workqueue: usb_hub_wq hub_event [ 453.601369][ T7121] Call Trace: [ 453.601373][ T7121] [ 453.601378][ T7121] vpanic+0x56c/0xa60 [ 453.601397][ T7121] ? __pfx_vpanic+0x10/0x10 [ 453.601414][ T7121] ? irqentry_exit+0x59e/0x620 [ 453.601430][ T7121] panic+0xc5/0xd0 [ 453.601448][ T7121] ? __pfx_panic+0x10/0x10 [ 453.601464][ T7121] ? __list_add_valid_or_report+0x4e/0x130 [ 453.601483][ T7121] ? __list_add_valid_or_report+0x4e/0x130 [ 453.601497][ T7121] check_panic_on_warn+0x89/0xb0 [ 453.601511][ T7121] ? __list_add_valid_or_report+0x4e/0x130 [ 453.601525][ T7121] end_report+0x73/0x180 [ 453.601537][ T7121] ? __list_add_valid_or_report+0x4e/0x130 [ 453.601551][ T7121] kasan_report+0x128/0x150 [ 453.601564][ T7121] ? __list_add_valid_or_report+0x4e/0x130 [ 453.601581][ T7121] __list_add_valid_or_report+0x4e/0x130 [ 453.601597][ T7121] kcov_remote_stop+0x457/0x680 [ 453.601613][ T7121] hub_event+0x49d8/0x4f60 [ 453.601642][ T7121] ? __perf_event_task_sched_in+0xf2/0x1800 [ 453.601660][ T7121] ? __pfx_hub_event+0x10/0x10 [ 453.601677][ T7121] ? process_scheduled_works+0xa8d/0x18c0 [ 453.601693][ T7121] ? process_scheduled_works+0xa8d/0x18c0 [ 453.601709][ T7121] process_scheduled_works+0xb6e/0x18c0 [ 453.601735][ T7121] ? __pfx_process_scheduled_works+0x10/0x10 [ 453.601753][ T7121] ? assign_work+0x3d5/0x5e0 [ 453.601770][ T7121] worker_thread+0xa53/0xfc0 [ 453.601794][ T7121] kthread+0x388/0x470 [ 453.601806][ T7121] ? __pfx_worker_thread+0x10/0x10 [ 453.601822][ T7121] ? __pfx_kthread+0x10/0x10 [ 453.601835][ T7121] ret_from_fork+0x51e/0xb90 [ 453.601851][ T7121] ? __pfx_ret_from_fork+0x10/0x10 [ 453.601866][ T7121] ? __switch_to+0xc7d/0x1450 [ 453.601881][ T7121] ? __pfx_kthread+0x10/0x10 [ 453.601894][ T7121] ret_from_fork_asm+0x1a/0x30 [ 453.601910][ T7121] [ 453.602343][ T7121] Kernel Offset: disabled