last executing test programs: 19m41.773366588s ago: executing program 2 (id=1783): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) (async) sendmmsg(r0, &(0x7f00000021c0)=[{{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f00000005c0)="1a", 0x1}], 0x1, &(0x7f0000003040)=[{0x10, 0x1, 0x85}], 0x10}}], 0x1, 0x4004000) (async) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) (async) sendmsg$nl_route_sched(r1, 0x0, 0x2000400c) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x20}, {0x6, 0xfd, 0x0, 0x1ff}]}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) ioctl$PPPIOCBRIDGECHAN(r2, 0x40047435, &(0x7f00000003c0)=0x7) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000140)={0xa, &(0x7f0000000300)=[{0xfffc, 0x3, 0xfa, 0xffffffdc}, {0xe, 0x80, 0x8, 0x7f}, {0x0, 0xa9, 0x5, 0x6}, {0x3, 0x81, 0x6, 0xb6e}, {0x421d, 0x3, 0x3, 0x798a}, {0x9, 0xe3, 0x9, 0xffffffff}, {0x8, 0x7, 0x4, 0x2}, {0x4, 0x55, 0xb4, 0xffffffff}, {0x4, 0x3, 0xed, 0x8}, {0x4, 0x5, 0x11, 0x400}]}) (async) prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0) (async) pipe(&(0x7f0000000500)={0xffffffffffffffff}) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) (async) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = fsopen(&(0x7f0000000040)='exfat\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000080)='debug', &(0x7f0000000100)='noblock_validity', 0x0) (async) tee(r3, r4, 0xf3a, 0x4) (async) syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) (async) socket$netlink(0x10, 0x3, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) (async) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r4, 0xc0945662, &(0x7f0000000200)={0xfff, 0x0, '\x00', {0x0, @bt={0x3, 0x719, 0x1, 0x1, 0x2000000000000000, 0x5, 0x8, 0x1, 0x7, 0x40, 0x2, 0x50, 0x2, 0xa39d855, 0x4, 0x10, {0x7, 0x400}, 0x4, 0xf5}}}) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x34, 0x2, [@TCA_RED_EARLY_DROP_BLOCK={0x7, 0x5, 0x7fff}, @TCA_RED_EARLY_DROP_BLOCK={0x2b, 0x5, 0x6}, @TCA_RED_FLAGS={0xc, 0x4, {0x8, 0xf}}, @TCA_RED_FLAGS={0xc, 0x4, {0xf, 0xf}}, @TCA_RED_MARK_BLOCK={0x8, 0x6, 0x6}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800060000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES64=r8], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x88010) 19m41.560843014s ago: executing program 2 (id=1786): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f00000000c0)={0x0, 0x1, 0x6, [0x0, 0x2, 0x7, 0xb1d6, 0x70eb, 0x9]}, &(0x7f0000000180)=0x14) syz_io_uring_setup(0x1f97, &(0x7f0000000080)={0x0, 0xe244, 0x13580}, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000005c0)='smaps_rollup\x00') lseek(r4, 0x2000, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r5, &(0x7f0000000700)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)={0x190, r6, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffff85}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffff4bbe}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xb3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x330f4438}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x15d}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7fff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x800}]}, @TIPC_NLA_BEARER={0xfc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x478, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfff}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x2, @local, 0xd}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x22, @mcast1, 0x6}}, {0x14, 0x2, @in={0x2, 0x42, @rand_addr=0x64010100}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x34}}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x0, @mcast2, 0x800}}}}]}]}, 0x190}, 0x1, 0x0, 0x0, 0x48000}, 0x8040) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000400)={r3, @in={{0x2, 0x4e21, @broadcast}}, 0x7f, 0x101}, 0x90) sendmsg(r1, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4b23}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) close(r7) ioctl$EVIOCGPROP(r7, 0x80404509, &(0x7f0000000340)=""/69) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) fsopen(&(0x7f00000003c0)='omfs\x00', 0x0) r8 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b000100000000090400000101292000090509"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000500)={'team_slave_1\x00', &(0x7f00000002c0)=@ethtool_test={0x1a, 0x7, 0x7, 0x2, [0x6, 0x400]}}) r9 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_readv(r9, &(0x7f0000000040)=[{&(0x7f0000000000)=""/10, 0xa}], 0x1, &(0x7f0000000780)=[{0xffffffffffffffff}, {&(0x7f0000000200)=""/160, 0xa0}], 0x2, 0x0) ptrace(0x10, 0x0) ptrace$setopts(0x4200, 0x0, 0x58880000000, 0x300051) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000000)={0x0, 0x2, 0x4, 0x8}) 19m37.538247105s ago: executing program 2 (id=1806): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000007040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000007000)={0x20}, 0x0}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r2, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) fcntl$setlease(r5, 0x400, 0x1) close_range(r5, 0xffffffffffffffff, 0x0) open_tree(r5, &(0x7f0000000080)='./file0\x00', 0x80101) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r6, 0x0) ioctl$KVM_X86_SETUP_MCE(r6, 0x4008ae9c, &(0x7f0000000000)={0x2c, 0xa7f084dd5657bbbf, 0x14}) sendmmsg$inet6(r4, &(0x7f0000003c00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000008090000002c0000000000119078000000000000000000004e200018907804000000030000000300000000000000"], 0x0) 19m36.649980296s ago: executing program 2 (id=1813): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) (async) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) ftruncate(r1, 0x8800000) r2 = open(&(0x7f00000001c0)='./bus\x00', 0x4c27e, 0x53) close(r2) sendfile(r2, r1, 0x0, 0x578410ed) openat2(r2, &(0x7f0000000000)='./file0/../file0/../file0/../file0\x00', &(0x7f00000001c0)={0x280, 0x28, 0x1}, 0x18) (async) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) (async) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') lsetxattr$security_capability(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240), &(0x7f0000000280)=@v2={0x2000000, [{0x3, 0x7}, {0x3, 0x7}]}, 0x14, 0x0) (async) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) (async) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') 19m36.438224525s ago: executing program 2 (id=1815): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x40, r4, 0x1, 0xfffffffc, 0xfffffffd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x18, 0x1, [0x5, 0x400, 0x2, 0xfff, 0xe038]}, @NL80211_ATTR_CQM_RSSI_HYST={0x8}]}]}, 0x40}}, 0x0) (async) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000480)={0x1f4, r4, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_REKEY_DATA={0x24, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "3b638209f6173ab9"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="c80ad5edc705c910f60e36ee2c842d99"}]}, @NL80211_ATTR_REKEY_DATA={0x2c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="d3a584cb1625aed6ae7e01028fbccf74845177832a145ded"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "bb2bce7770e1b561"}]}, @NL80211_ATTR_REKEY_DATA={0x70, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="8b60aad2b9f08c5cf277ad34931bafa8"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fa86bca77b41cb67e75da52efb0a1f72"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "8561b11ef80d514b"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="e8b84a892f6807db555a77a23fdf7ffc"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="fcc362090a1e0f4516209e31475df00d"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x6}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}]}, @NL80211_ATTR_REKEY_DATA={0x44, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="d438735f37501e956fba269c17a1595c"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e001b6e91f7402f2"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "2c2749a60def6005"}, @NL80211_REKEY_DATA_KCK={0x14, 0x2, @kck="f3de939ee801a57eae6e535c316e5c36"}]}, @NL80211_ATTR_REKEY_DATA={0x48, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="fc26ab6360c27bced7cb8e7b2dfe3e71285d1eeac3b2c4069d7537d96c363ffc"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "4597cfdbc099cb09"}, @NL80211_REKEY_DATA_KEK={0x14, 0x1, @kek="a43380dd99ca23a99dea8cc2e88be147"}]}, @NL80211_ATTR_REKEY_DATA={0x28, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_KCK={0x1c, 0x2, @kck_ext="0fd4d582268d8ac3a800"}]}, @NL80211_ATTR_REKEY_DATA={0x5c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x5}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="af210d8ff881c97f40d9c89258fff6d9760dff16470f948c7193304556fcf495"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x2}, @NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="c1c31cb7661bb8c022ca59cf2fa217bf5bb4a9130751bb91f6565d1ccad6e2be"}]}, @NL80211_ATTR_REKEY_DATA={0x10, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "0f6357d160114faa"}]}]}, 0x1f4}, 0x1, 0x0, 0x0, 0x40041}, 0xd83e511c9e8a590) (async, rerun: 64) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x4c, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_OURS={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x8, 0x4, '\x00\x00\x00\x00'}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x20}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000800}, 0x400d4) (async, rerun: 64) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4) (async) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000800}, 0x0) 19m36.299210241s ago: executing program 2 (id=1816): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffea6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x3, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x2, 0x0, 0x40, 0x0, 0x8}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) tee(r0, r1, 0x3, 0xe) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000ffff26bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15170000bcb7040008000a00", @ANYRES32=r3, @ANYBLOB="140012800c0001006d6163767461700004000280080005"], 0x44}, 0x1, 0x0, 0x0, 0x240448c5}, 0x8000002) 19m35.917263934s ago: executing program 32 (id=1816): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffea6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x3, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r1, 0x40505412, &(0x7f00000000c0)={0x2, 0x0, 0x40, 0x0, 0x8}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) tee(r0, r1, 0x3, 0xe) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000ffff26bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15170000bcb7040008000a00", @ANYRES32=r3, @ANYBLOB="140012800c0001006d6163767461700004000280080005"], 0x44}, 0x1, 0x0, 0x0, 0x240448c5}, 0x8000002) 17m21.897380398s ago: executing program 1 (id=2495): syz_clone(0x4010100, &(0x7f0000000000)="4f0958389bea95230f78efe92b858fe2069bc62612", 0x15, 0x0, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 17m21.344398528s ago: executing program 1 (id=2498): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000140)={0x4, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}, {0x5, 0xb, 0x7, 0xf00}, {0x1ff, 0xa3, 0x3, 0x7}, {0x58d, 0x40, 0x8, 0x51}]}) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) rt_sigaction(0xd, &(0x7f0000000180)={&(0x7f0000000000)="ca00d1c441ef196ec866400fe2de0fae4e0afaf2466ff00fc01ec422e10399c5c1202063df", 0xdc000006, 0x0, {[0x2]}}, 0x0, 0x8, &(0x7f0000000300)) poll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x80cd}], 0x1, 0x7) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109802, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000000)=0x400) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000002, 0x8012, r1, 0x0) syz_clone(0x20042400, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000040)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x12, r2, 0x0) close(0x3) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000000)={0x1a, 0x1, 0xc}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r0) r3 = socket$inet6(0xa, 0x80002, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_PIM(r4, 0x0, 0xcf, &(0x7f0000000100), 0x4) sendto$inet6(r3, 0x0, 0x0, 0x200c8804, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x12}}}, 0x1c) r5 = mq_open(&(0x7f0000000040)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!Tnux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x0, 0x1, 0x8}) mq_timedreceive(r5, 0x0, 0xfffffffffffffee3, 0x1, 0x0) mq_timedreceive(r5, &(0x7f0000000440)=""/30, 0x1e, 0x80000000, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000080), 0x4) 17m20.262490609s ago: executing program 1 (id=2509): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r1 = dup(r0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 17m19.461686773s ago: executing program 1 (id=2516): write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001040)={0xfc, {"a2e3ad09edfc09f91b44090987f70e06d038e7ff7fc6e5539b303d0e8b089b07323068090890e0879b0a0ac6e70a9b3361959b4b9a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b35070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2d8160f94e35f2d2d12913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516259e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc1943cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) move_mount(r2, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x226) r3 = syz_usb_connect(0x1, 0x1, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xd7, 0xf2, 0xbd, 0x10, 0x7a6, 0x8513, 0x4345, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0xff, 0x0, 0x4, [{{0x9, 0x4, 0x10, 0x0, 0x1, 0x8f, 0x52, 0xf6, 0x0, [], [{{0x9, 0x5, 0x7, 0x2, 0x8, 0x2, 0x6, 0x0, [@uac_iso={0x0, 0x25, 0x1, 0x0, 0xfb, 0x1001}, @uac_iso={0x0, 0x25, 0x1, 0x0, 0x1, 0x3ff}]}}]}}]}}]}}, 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r3, 0x82, 0xfffffffffffffefa, &(0x7f0000000180)=ANY=[]) 17m16.351532923s ago: executing program 1 (id=2529): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1}, 0x18) sendmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001640)="d22d4d545279ef3fbcd0f793aa606dff2a01c1540183b7b4b0638d7172e5f1d7c7e9fce9fe648c5f71e97a39a1014ac7558a000000a6d32d3fec2475e04b25ed0ec5effa8fb46cd1c1437fd023272c8d22b56f256e19c15b358c082b217874d124b391d8027e08f48e7aa072a679c90d339bc00923a5b13a5660d6be8c2d227733ebf29d5f013fbdd8072855aa86abcdb2b11e12b1d63b04805eb5072a1d07813c9e77645c8c254335afd872", 0xac}, {&(0x7f0000000180)="0000000000000000d1eeeecbb1b37dd15edb0895202e2bbcb45dc9a5a3bc68fd4dd8af", 0x23}, {&(0x7f0000000640)="807ff4e5ae93412c7e74b8cdd1ba61a90ef56b547da1f3edc032bb451895a7c65a57959abf6dbcf4034b278d4d3bce1a2a16f4d52f8f584a1e9be44ad0b5a5f1393fb3a5d9d8ee8c2ab7b55cdae5f7485120a3d426ad7e0a24f0892b97630a8c5571343d2c7a0099f4ea6060ff9947966446bc8d374bc1ce2e0965ca0d07a5b088a8ab47d6b18e8562bf56115b50490203c669778c761391a88fcba7eb2b02c1bdd51761889b05df4b99f9633a584ce104701940fe9188df32548f164cdc4eb1aea6f419f3e0ee1047bbb94567a5b4c02bb2c3672e4ab3a96861d3234d3845bdf02b2746d2e8a13070e89d445475a2002673cdcc9283faddf3658a812c60244ef5250de41d25818295f32bfb8ea1365702e6f9d00181f0ff0a93d8fd3e7af8963363ac1e3c5f160a91ef67d7377a2469ec2a7bdece080c68fd5b1fc115922e523708d1accd6329e0036ebf8a926e970148876a3e24dd017d4dfb4014e4195a95ad7ebd04f0feafdfc0d9bc432cec47def6139b8a8fe92c75eaae3028e9e2a13823be429469d30cb4656daf38f75b5cf72a77e76818ce4539e6cfbe80121da44b86ba7a1ada19e786769a679290e81501264a35894a02d5a7e196604f9a85c71687d79d582c2307682a57419edb3cd7dd651a77b65c72b011377449dbfbd6ca23daec0df9f3a9eb2550e12be057e9f84fe196dd629d32bf60bd9e0b147840673f6028b38ba59aac50877a115834dd7e36ffcb6111647cdb88adb2faad7631e80f9b2ea6c2b434befe934d2012c87521dfbaad86f4012bd2289b57a539c62545d51d69fbdabad79e2d972900c37d7e907c2ae746f7759881ade38015288aa99918813d6d19d266097ff105c912cf45c2698a19d33ba5e3ec70127c1fd4d9d4b3a1368cad5af74bdd30c0123b7d64b8fccc4e17937223c11e2a5049b880ee9d4c9636dd1cc040075a6ff19b2c99650a65f66b2a8fa0c759230c7600c6fef69a746a725b8762034a9cc99141f660e8e21c2c5d4365d5a3edf1367290224fa680ec5f8511624d68ebf812d18d85a52c45d9cde943649a6f063a94b41b88160c59aab625f9f765fda3120bf9b601466cc5216baf7968b11d2d79dea417905d34828e2cdcf4e554f1538c234466f861522bf114c25f95d50d68dd266066716d4b0d32120be2f359dda35b4310399cfaae68266c49eb368d5db4b5919321ab2d23a2cc85a237cb631df71a16a00f7ca4c9c0009bff7a0d6f9bc3651413c903078dc7dcf5cc3737109abced7d5f7953564ffe3d9fcbb26b7c6304b3db8be0d45110920a34d41fc361d54da222990fd44aee859e951da11c419e4184a86b32b010b2c09f1274292e7f9f7738e4e53344f3eb3d796b7e0de5164c30bf8777c169e042891a3feaa0d7cfa9b0a157a421c919aa027716d66d797b1cad25dee18f0e98c2d1905f88635d3fb3578cb12e1cad18fe215ad0005b824268d24af3a15a059ccb34dca8434dd294d42595a436e6b66b990b5ff44754aa42c7a265c3978d42f4381d4ecb01d058887ff88d2d078b47c857445d14a8e944918c9c0319e11c4d153b15a78695fc76db2809043c0ba479df0ba2d9cb51034830e0f97fc7c99bbcf2d5b2d09cc9a53dc2a359c1f86133dccb7caea697a2532b383b6ce489d505b3197c95d45a08c68c255402314b048ba451cfa00f351b1a1739f957fa85a2ae385ff4889e1fd28abbeea7a7c176ae34457f5674292a2b4864d4628be74a6005071ec79edfaff82b68dd6129608099b33fce983f5668577e12fb91c7daf2a15ca1b8b6f798aef4f22eba82771d167a0d2974a327c7fb8917042598d76403b2f51aa4b3738ccd2b88bd868c049cdb3498baed7ee86139eca9227682c65c073559355ceb866ae506aaa2122ebfb436511d326e3911ea370f656ac88fba8c42498fa2542201fa820da04f41349ea8fdd0e262bada5d815700feae9409a1e8a9549b02ae6199cfb6c036573a836d1cc42ec2fd0f1dc6c692fc5f7b4a2b817f215fd3a127d9afc1b27996ac08dc97b0f5c272ff6181a2011d453f54e9da0993c46cafb9c8f49b26b16de77e3530146d9b951e52021ff4239d9ae0fa56b10cbbd440b13bd246336af5616258ff90500946c4b45c561c053daa6163a8cce11505eb606e045061a3732b881adfe84933ea740276a7903e558cb54f1033ccfc071f88492a1edb34433a3c24b897a39dd0bb4a36f6e806e12cde0adb119e09b74c8b139d9e78fd7798274bd9c378cb26241d0029fe72df5e639d40538025bec0539e96c55fb6f440c971739b6da41d201c6cbb5ff6a8a1767dd2fbde90e2b7147e914a57d57e2eeeb606c5a5d29283ba9e451f8f0a079cbac18e170a6a781fdce931b45270b6362c6b92c86255e7fb42b9af87ada79cf86b36c36a9bbd2838a5e0b091110f883b772929971abc1b7cf2de469f69e68ec46acd6777b4b6185f2eb0dc3636511127b4f091ed43d7a39db072051d071c7db881edca0d488c9b936c74d9df4c77ced8ebf05f4671ee88fdce1261097704c0d3f170d88f469f54d93f43b98c223ad59b18dc755f400bffda74bd7dcdbd8eaa74505e6d6584898cfa2f841a1c4f3e15b0a4c0dcd63644ee003317cd25c6dd6c113cce017ecaebbf09930116bf5dcbb629d7f6129233813aa735dd6a19a4efd3591c07c5fb8a9f933cf4841f1eb0799b5b14034afe839b176fbcb05ac5e312c3fc164feff26ec749154a16a67b78c466f32224a694c1ac7ca6de911f82d285dff04716a3a12ecd1d77b5cffcf8174ffcbefa66b9d00aeaff5cd64ddd807374ca6298f9812995c851241edb879a3b6b95ef5e3a8327ae0cf09bcc4a740bf834612eee7b838d4cbe22ce1e309465f1a9445667429f44a3f595782a1c699c524bd94f7bed0da586c6d7620762d7cdb930ccb46f17214577c4d484eeacdf4eab753cf5903c79103f3a61b0e73091bd7ff860f1a7ba53cfc8dd881c4a38cbdfd0ab9431b5e26b3d3adf10d01638022d93cb2dcdb4aff98999a9d3083c7d751835055bf57f63ac61a3664e36ae5566b344c2ca089d5644eab32243300db0ce561599807c87f30d251022a5cebc47c4f7645b0f3b953e9bc9b6e6936f396816d079eba4c456c065f915e76a3cfa7d27e5e2887a1fb9b88a3f0fd2ea3d93228a5befbff1723ccd629860eda214db68983556f2a2b8199ebe26fc284c0bc364fa17a542074fb1ed528d91262bcd84fdfec77baf6a8d9a8044e6e234ba6487cdb7420d8da1af8d2aac3b02cb2e3a58dbad7babda875079a5852862a143ca414d0240b447f53782d68fd5fc8f240235cbe316a0bc9df1e62229bce7e2d81223ed4e99d9fcb1e1de72c79c5b6470f491241817579e8480211528dc2cc3dcdfe377427a32539e1e3e8c3f3f29ee83124cf60a98530ba073d1f4c2ed6da241c3f32c222341ee371b660abcc9733f1c72b427cc1d942a49253d63ca446afe23d8e5896d8bd4d16c4b0a97bc66b575f026715027739b30157bbb6852987b4f8fa01a6496ccd4b6e296277fb414dfa20fdfc1b2413bd58a1b057586cbe633775d5ec5352e7b481aefb80809902ced463d96216adf72dc0b352a735782133a0ecd0a5ea480d04c5b9fb2a43e2272b300ab703484c5ce91094c9b1647fbb72602280588355b21ef753d1f49facf1af0b3c661a5c9e83dac4937537205fe3de2ec2bf04caad6dc4a01eb8b6d69af767b0ab1f742b8523f421e5218247eb66b92f1dc9b10fbc06a6330ee006e2fbaafa30326e342ba45fbabff080e365fd2b604fd7271bf2c44b50d900031b04a040228ce5328f485e9a21ca2dfded6bad985a6fb5c66ab80079dc9285cff07a8a104237bcf3911e8b70156029f21fb0420560f897e2da4e6685d78f62594df67caf5ffca863df58118db8f9fbf7fed6b69673623d21c8f900856d45506a2f883acdb08d94619a6892c92d6575584f7a4d2461381b577fe383a595d80d08cead95197faa44bc78886896259c67a596b2e7e31459e3d3e92bfdfb58e837c886878df5ca4c816036d206bb113922e56be0721cc423dbf8ac69fe08e7fb498e840c49390640dbab0ed4b71528bb58e850cb15092ab356f39c5f9fa60cde4cde043d0b9b837c02b3576be766c45ea8068a6f3571d50e6ce683144fbf942a0368ae4c635ce452800a83da242e571aa81e654d907ece500e07615421fc39ecd84be509e5735ea17f0ee8bc4975e3c4da97e143085cdc8ff5bb2b05362e955f521ddad3a434944939ccb23ae7fbb68196af789a1543797418d7a6a18a45acac6ba258aaa34dca7539687445cad9c811e7a4406c2c716da2bb22ba21415016343a35f1bb30a88bc03a826c725acd68a72fc8bf43d72cde68945652c1f525d193c5da1d81f435ed3547dfff1d3fab43fa988f20e345e13d40127db389b9bb3cb024b37604f340f1280d3e1f4a512bc9ab5de0c40c2d7cd9e311818546d1bbdad2a6732c42e24039256a5a3bd8ac88c6a1980e4273f88dfba5fc6b46bd2df66e2830aca63750e48d0174873311a81a8437af3a990e20317bb71194c52137f8de65c36ef50045082f796f7232e688261e1f1e6a93c0709e926c6b300e94b2ffb8e2b4e18aecfdf29d1eee39d6cf64f0de85d03583c80f14847b7045bf768648d4b694b1a418ea47c06ea6981ff54bac1fdaaa591e0642fdbd704b941074bf976c5de1e82eda8c7ea92a965c3145a156b0403649f643c0a1a113b30", 0xd23}], 0x3, &(0x7f0000001700)=ANY=[@ANYBLOB="b00000000000000003010000060000003e89af80c9912c75bc8809a914b15d413a4084d9ef3127b9b296c6a91ba0a49bbd7acc13dcd0873b48aa8148f6089310eec2abe7d4e46c30fcf9334cb04c6a303eb6cf7f40d4077e434af79a9b8fe102621566f4079baa40e4169c6a069d66dc1ed7437915443d0fbd24cb5fd4ab9979cce63fb9ea719b1251f00e7ad25c624790752d288d6750ad7994d08089da672a0ae07c9330ec037d1b965546c1097e7af100000000f8000000000000001901000002000000949d18e11bdf4f9d5d8c3f19b6a5d108808e668f9843f2217d0928009a5c0a882451cb3d7946a32f0a279692741c4ab79d1e8f2edae605156eae8a06ec65ca6ea1ca7b073a5cf3f30cd1b211ff3c2ebf7f1d4d691c1da8f914cd7b8e4f22ed0f3f06e0f6d0bdb452bb2322e66392e2e37d790b6ee5008c3d1309a671371b3c1a43cc2602e3a27221ee72ad5eab0a04fb5c14d0412ff2d5142917bd19ecaaedaa184a85fd3d67c1c246cd8cfe0ecab5efa685b18797b052487c40b337051db585ff5c956ee4fb8c54f0404b85b819e1dcb91ae15788000000001785cd3e4f2a69c6d4810804ef5ede308b8e0d15b20f2dc1f99cef778734f9cdd8657155082653aeb440598433d2b488fb37f1c39b5afdd9f3d27258d3a021393a30f862066d91c8be2c6db616f88fb1e0441392f32f9e7efc8bbdbb77b08ee739e0d5e63bfce56b43af7eff891cc97b0a27aa3620b4a8db905f2e4e9b7027f6d7c3fcbe73c8752b635c71f06592b4ea08c14888cd36a28f418c222946e4549c9aaae2be85e7791b41886ffd017f529710c34983eebdde2c1a40ff09099cc9e809d0"], 0x1a8}}], 0x2, 0x1) 17m15.946071737s ago: executing program 1 (id=2532): syz_usb_connect(0x2, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x98, 0x70, 0x31, 0x8, 0x681, 0x10, 0xabe9, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x26, 0xaf, 0x7}}]}}]}}, 0x0) 17m15.058232927s ago: executing program 33 (id=2532): syz_usb_connect(0x2, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x98, 0x70, 0x31, 0x8, 0x681, 0x10, 0xabe9, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x26, 0xaf, 0x7}}]}}]}}, 0x0) 16m45.470012822s ago: executing program 0 (id=2648): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f00009bf000/0x3000)=nil, 0x3000, 0xf, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000e39000/0x3000)=nil, 0x3000, 0x0, 0x4, 0x100) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000000c0), 0x6dda87c55c1b1fc, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000180)={0xc}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=@newtfilter={0x4a0, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r7, {0xfff2, 0x12}, {}, {0xffff, 0x8}}, [@filter_kind_options=@f_bpf={{0x8}, {0x474, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x4}, {0x24, 0x5, [{0x40, 0x8d, 0x80, 0xb7eb}, {0x9, 0x83, 0x8a, 0x8}, {0x6aa, 0x42, 0x1, 0x8}, {0x4, 0xe, 0x3, 0x3}]}}, @TCA_BPF_POLICE={0x444, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x343, 0xe9fb, 0x1000005, 0x5b91, 0x4, 0x1, 0x800, 0x5, 0x3, 0x3, 0x8000, 0x4, 0x6, 0x3, 0x0, 0x1ff, 0x77, 0x43, 0x4, 0x2, 0x5d, 0x8, 0x8001, 0x4, 0x3, 0x0, 0xfffff989, 0x8, 0x6, 0x71dbd584, 0x2, 0x7, 0xd8, 0x9, 0x4, 0x3, 0xfffffffe, 0x5, 0x9a, 0x1, 0x3, 0x80000001, 0x1, 0x2, 0xfffffffb, 0x7fffffff, 0x2, 0x8, 0x8, 0x10, 0x10, 0x1, 0x2, 0x4, 0x8, 0x7fff, 0x5, 0x0, 0x2000000, 0x6, 0x9, 0x2, 0x0, 0x3, 0x7, 0x91400, 0x8b9d, 0xff, 0x80, 0xfffffffa, 0xb, 0x8000, 0xb26f, 0x6, 0x4c, 0xff, 0x7d, 0x36, 0x81, 0x80000100, 0xfc9, 0x6, 0xfffffff0, 0x9, 0x5, 0x9, 0x80008010, 0xe, 0x2, 0x80000000, 0xff, 0x3, 0x7, 0x1, 0xa6dd, 0x7, 0xfffffff9, 0x8, 0x82, 0x101, 0x9, 0x3, 0xbdb, 0x1ff, 0x1, 0xc, 0x40, 0xffff8001, 0xffff, 0x8, 0x7fff, 0x402, 0x2, 0x2, 0x7, 0x2, 0xbce, 0x8, 0xd, 0x80, 0x4, 0xacda, 0x4, 0x3542, 0x7, 0xf79, 0x7, 0x3, 0x6, 0x0, 0x7, 0x6, 0x5, 0x100, 0x1, 0x2, 0x80000001, 0x200, 0x1, 0x9, 0x4, 0x0, 0xe200000, 0x6, 0x80000001, 0xaf6, 0x3, 0x10001, 0xe47b, 0x8, 0x3, 0x4, 0x4, 0x5, 0x0, 0x985, 0x5, 0xd, 0xf4d, 0x7, 0x8001, 0x1c4fd68f, 0x1, 0x5, 0x7fff, 0x0, 0xc2, 0x0, 0x5, 0x81, 0x3, 0x1c37, 0x3, 0xab, 0x2, 0x3, 0xb171, 0x8, 0xf, 0x2cb6, 0x6, 0x2, 0x2, 0x70, 0x80, 0x2, 0xfd, 0x5, 0xb417, 0x2, 0x400, 0x6d, 0xb, 0x401, 0x4, 0x2223, 0x2, 0x200, 0x1, 0x4, 0x1, 0x1, 0xab0, 0xd, 0x80, 0x3ff, 0xcdf6, 0x7, 0x7, 0x7, 0xfffffffa, 0xc54, 0xfffffd18, 0x9, 0x7, 0x7, 0x2, 0x3, 0x9, 0x6, 0x7fff, 0x4, 0xffff, 0x1, 0x381, 0x400, 0x4, 0x274, 0x8001, 0x5, 0x4, 0x5, 0x8, 0x1, 0x8000, 0x2, 0xc9a6, 0xfff, 0x0, 0x4, 0x9, 0x4a78, 0xdf5, 0x5, 0xfffffffe, 0x5, 0x7ff, 0x6, 0xdb, 0x4d, 0x19, 0x7ff, 0x2, 0x5, 0xff6d, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x3, 0x4, 0x1000, 0x4, 0x3, {0xb, 0x2, 0x1ff, 0x4684, 0x80, 0xfffffffe}, {0x0, 0x2, 0x4, 0x1ff, 0x7b}, 0xfb, 0x3, 0x5}}]}]}}]}, 0x4a0}, 0x1, 0x0, 0x0, 0x1}, 0x800) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)=ANY=[@ANYBLOB='fd=', @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0, @ANYBLOB='\x00\x00']) syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) statx(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x100, 0x800, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[], 0x74}}, 0x0) read$FUSE(r2, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000001200)={0x50, 0x0, r9, {0x7, 0x2b, 0x0, 0x0, 0x0, 0x3}}, 0x50) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r11 = openat$cgroup_ro(r10, &(0x7f00000000c0)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r11, &(0x7f0000000040)=0x1, 0x12) 16m42.954496857s ago: executing program 0 (id=2656): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0xfffc, 0x40000000, @mcast1, 0x9}, {0xa, 0x0, 0x0, @loopback}, 0xffffffffffffffff, 0x27}}, 0x48) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x100240, 0x0) ioctl$SNDCTL_TMR_CONTINUE(r3, 0x5404) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x20001, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 16m41.846403136s ago: executing program 0 (id=2663): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000480)={0x0, @in6={{0xa, 0x4e22, 0xa9e9, @local, 0x11400}}, 0x7, 0x5, 0x6, 0x100, 0xffffbcdb}, &(0x7f0000000180)=0x98) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) r2 = syz_io_uring_setup(0x3aec, &(0x7f0000000240)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x3d}) io_uring_enter(r2, 0x7a98, 0x0, 0x0, 0x0, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001900)=@newlink={0x58, 0x10, 0x403, 0x300, 0x2000000, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x1e, 0xf}}, @IFLA_VLAN_ID={0x6, 0x1, 0xffe}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x58}, 0x1, 0x0, 0x0, 0x4044000}, 0x8000) 16m41.478296151s ago: executing program 0 (id=2666): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x400, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) 16m41.032630836s ago: executing program 0 (id=2669): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@loopback, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000002}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x2, 0x4, 0x3}]}]}, 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=@migrate={0xec, 0x21, 0x1, 0x0, 0x0, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x3a}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0xa0, 0x2e}}, [@migrate={0x9c, 0x11, [{@in=@loopback=0xac1414aa, @in=@loopback, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, @in6=@loopback, 0x3c, 0x4, 0xfdff, 0x0, 0xa, 0xa}, {@in=@private=0xa010101, @in6=@rand_addr=' \x01\x00', @in=@dev={0xac, 0x14, 0x14, 0x39}, @in6=@private2, 0x3c, 0x4, 0x0, 0x0, 0x8, 0x2}]}]}, 0xec}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 16m40.63223775s ago: executing program 0 (id=2672): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'veth0_to_bond\x00', 0x0}) r4 = socket$inet6(0xa, 0x2, 0x0) preadv2(r1, &(0x7f0000000080)=[{&(0x7f0000000240)=""/191, 0xbf}, {&(0x7f0000000380)=""/169, 0xa9}, {&(0x7f0000000440)=""/71, 0x47}, {&(0x7f00000005c0)=""/128, 0x80}], 0x4, 0x3, 0x401, 0x18) sendmmsg$inet6(r4, &(0x7f0000007240)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0xfe60}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000), 0x1}}], 0x3, 0x1c000) shutdown(r4, 0x0) ppoll(&(0x7f00000000c0)=[{r4, 0x832308415e7c5548}], 0x1, 0x0, 0x0, 0xfffffe96) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x40, 0x32b}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x80100, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x1, 0xb}, {0xd, 0x5}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x8021}, 0x4008000) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@qipcrtr={0x2a, 0x4, 0x1}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="27031c00160014000000002f1eafacf706e10500000086dd00050003ee0b80558ddbba9b37786fd808252372a31e4939884f0abc3c", 0x35}], 0x1}, 0x4) 16m40.062258917s ago: executing program 34 (id=2672): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'veth0_to_bond\x00', 0x0}) r4 = socket$inet6(0xa, 0x2, 0x0) preadv2(r1, &(0x7f0000000080)=[{&(0x7f0000000240)=""/191, 0xbf}, {&(0x7f0000000380)=""/169, 0xa9}, {&(0x7f0000000440)=""/71, 0x47}, {&(0x7f00000005c0)=""/128, 0x80}], 0x4, 0x3, 0x401, 0x18) sendmmsg$inet6(r4, &(0x7f0000007240)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0xfe60}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000), 0x1}}], 0x3, 0x1c000) shutdown(r4, 0x0) ppoll(&(0x7f00000000c0)=[{r4, 0x832308415e7c5548}], 0x1, 0x0, 0x0, 0xfffffe96) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x40, 0x32b}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x80100, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x1, 0xb}, {0xd, 0x5}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x8021}, 0x4008000) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@qipcrtr={0x2a, 0x4, 0x1}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="27031c00160014000000002f1eafacf706e10500000086dd00050003ee0b80558ddbba9b37786fd808252372a31e4939884f0abc3c", 0x35}], 0x1}, 0x4) 12.564560609s ago: executing program 7 (id=6928): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, 0x0}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8fb, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0f, 0xffffffff}, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xe) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r0, 0xf7) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, 0x0) ioctl$TCFLSH(r3, 0x400455c8, 0x4) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000100)={0xb, 0x8}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8004) rseq(&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x4, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x70bd29, 0x40, {0x2, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x3100}, [@RTA_UID={0x8}, @RTA_MARK={0x8, 0x10, 0x5}]}, 0x2c}}, 0x0) setrlimit(0x7, &(0x7f0000000380)={0x1, 0x9}) accept4(r4, 0x0, 0x0, 0x800) io_submit(0x0, 0x0, 0x0) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) syslog(0x3, &(0x7f00000004c0)=""/164, 0xa4) 11.030810125s ago: executing program 7 (id=6931): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001300), 0x28200, 0x0) r3 = dup(r2) (async) r4 = syz_io_uring_setup(0xc0f, &(0x7f00000000c0)={0x0, 0x6efd, 0x80, 0xffffffff, 0x1a}, &(0x7f00000003c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x50, 0x7, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x48080}, 0x40) (async) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x5, r3, 0x0, 0x0, 0x0, 0x80000}) (async) io_uring_enter(r4, 0x47f5, 0x0, 0x0, 0x0, 0x0) read$FUSE(r3, &(0x7f0000000fc0)={0x2020}, 0x2020) 9.45923013s ago: executing program 7 (id=6938): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0x2, 0x0, 0xff, 0x0, 0x651, 0xfffffffffffffff9, 0x8000009657, 0x5, 0x7fffffff, 0x0, 0x10, 0xb, 0x80000000000003, 0xcc0, 0x1, 0x1, 0x94d6, 0x9, 0x0, 0x1000809, 0x0, 0xffffffffffff7ffa, 0x3, 0x4}) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/bus/input/devices\x00', 0x0, 0x0) read$hiddev(r1, &(0x7f0000000000)=""/149, 0x95) preadv(r1, 0x0, 0x0, 0xf2, 0x207fff) signalfd4(r0, &(0x7f0000000340)={[0x100]}, 0x8, 0x80000) r2 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r3, 0x0, 0x0) syz_usb_ep_write(r2, 0x81, 0x4, &(0x7f0000000080)="00012c61") syz_usb_disconnect(r2) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, 0x0, 0x0) 7.462117267s ago: executing program 6 (id=6947): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYBLOB="0000000000000000b702000014000000b70200000000000085"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00000000000000000000000000000500", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 7.332322235s ago: executing program 6 (id=6948): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pipe(0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmsg(r2, &(0x7f0000000040)={0x0, 0x4a, 0x0}, 0x4) ioctl$EXT4_IOC_GETFSUUID(r0, 0x8008662c, &(0x7f0000000000)) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xe}}, './file0\x00'}) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000140)=0x29c, 0x4) syz_usb_connect(0x0, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='io\x00') read$FUSE(r4, &(0x7f0000002b40)={0x2020}, 0x2020) ioctl$SOUND_PCM_READ_CHANNELS(0xffffffffffffffff, 0x80045006, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x40c040, 0x19) write$6lowpan_control(r4, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) sendmsg$key(r4, 0x0, 0x4008810) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = syz_io_uring_setup(0x49e, &(0x7f0000000400)={0x0, 0xe7a8, 0x400, 0x3, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r8 = eventfd2(0xff, 0x80001) io_uring_register$IORING_REGISTER_EVENTFD(r5, 0x4, &(0x7f0000000300)=r8, 0x1) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x40, 0x0, r5, 0x0, 0x0, 0x0, 0x2}) io_uring_enter(r5, 0x3d0e, 0x4c1, 0x43, 0x0, 0x0) 7.183076607s ago: executing program 4 (id=6950): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "7f"}]}], {0x14}}, 0x80}}, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x250, 0x98, 0x4, 0x4e, 0x20, 0xdba, 0x3000, 0x5170, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x26, 0x40, 0x1, [{{0x9, 0x4, 0x5e, 0x0, 0x0, 0x57, 0x95, 0xbf, 0x3}}]}}]}}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) 6.35174495s ago: executing program 4 (id=6951): openat$vicodec0(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f000087b000/0x2000)=nil, 0x2000, 0xd, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r3, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r3, 0xc03864bc, &(0x7f0000000500)={0x601, 0x1, &(0x7f0000000180)=[r5], &(0x7f0000000480)=[0x2], &(0x7f0000000440)=[r4], &(0x7f0000000040), 0x0, 0x8}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, &(0x7f0000002140)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) recvmsg(r6, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, {0xa, 0x0, 0x0, @empty}}, 0x5c) 6.351158659s ago: executing program 7 (id=6952): r0 = socket$l2tp6(0xa, 0x2, 0x73) recvmsg(r0, &(0x7f0000001580)={&(0x7f0000000000)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000080)=""/31, 0x1f}, {&(0x7f00000000c0)=""/129, 0x81}, {&(0x7f0000000180)=""/4096, 0x1000}, {&(0x7f0000001180)=""/253, 0xfd}, {&(0x7f0000001280)=""/102, 0x66}, {&(0x7f0000001300)=""/136, 0x88}, {&(0x7f00000013c0)=""/186, 0xba}, {&(0x7f0000001480)=""/110, 0x6e}], 0x8}, 0x100) syz_emit_ethernet(0x10a, &(0x7f00000015c0)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x17}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@x25={0x805, {0x0, 0x4, 0xf, "012cdaa58ade4d92fb50586d81c34510060da6b90f6166e9a26a296477343685284e1721634b59cfc535c41d0132c5eac1deb1dbfca9b3153a8531fb65fe8e6a54749a8d7cd423fb3fd369a2055484845c70f89166d18ce5e4e6a049e572b42a4501a20b95148830dea493c1fd8555f4c81935895264a87491c6832909316c3d827d5f0534f8fbc750fa9de44ec8ed282c92eba38ac07b24e7a8763879dde30e3d8daf3bc7c4fcd86ec751bff0b9fa6b2e63861f6f971475faac6fa19dcf6f6ea0d94a7510fc4c67257fdff69b00ee82177deffbf99af50fa5e5d4180d36a144fee5797f08aac5c6d45b9dd99907ac2dc8ef4eade46024a47d"}}}}, &(0x7f0000001700)={0x1, 0x4, [0xcd, 0x672, 0xa1d, 0x339]}) r2 = syz_clone3(&(0x7f0000001a00)={0x100100000, &(0x7f0000001780), &(0x7f00000017c0)=0x0, &(0x7f0000001800)=0x0, {0x2d}, &(0x7f0000001840)=""/75, 0x4b, &(0x7f00000018c0)=""/219, &(0x7f00000019c0)=[0xffffffffffffffff, 0x0], 0x2}, 0x58) r5 = getpgrp(0x0) sendmsg$nl_generic(r0, &(0x7f0000002d80)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000002d40)={&(0x7f0000001a80)={0x129c, 0x36, 0x200, 0x70bd2d, 0x25dfdbfe, {0x7}, [@typed={0x9, 0xd1, 0x0, 0x0, @str='\xaa\xaa\xaa\xaa\xaa'}, @nested={0x1121, 0xed, 0x0, 0x1, [@generic="49a52498472cd10e73f248e25312afb17730771eade7515dfce7807719c76da8a395042fb6023579215a15e5b8b1ceabfa658b338c258da2b07e4fc52f21242f85fc84bc7a00c67cd8d7e6e50d0c4f1b346cac0772450b8b0d25fc2ddfe817c610bf23f7d54f6556273a12b17cc90ae760e9377a78aaa3bce95dc9420bc829d9f232d361e4b372fa17409122c536f193963ffdfe3bde8fcce53854efde59f663570cac83dcce655a937797ae6b9470a0098c24f20f5635fe33e5431d72ad4d52b4c38f23ba200396a99d79f74ad4690c88d626f91c845230019326e6b0ec9568a8f334000e9e3210c4c080b6a8b046600b77257ef2b8361512d2614a50c3411848c3921be956e7f859718c02662c980e02196a5a5c642e04d35db326932f0e58658c6bfc50a94d50eb673bf411a64442cc9ed4d89858078afea6b686de49179f37df4971d4d50b0056dac350673ab639b7b6db284f3cfe4bd1cd9f001a975fb4c3a8fe738a9c4e3cf84ba8798ce51d10c2d80f1d95b99e2e434f67a59d1f53ca6285d0e0f0b123809ff79b56f14790eed6caa09ab2a3a32bf4836ef5a9e4a689a80b39a96ddd7c5f3b53d92d3a536af3b0bf312c62d36a6549158e149d668e0b95193109c627646ca077e32997f2b6f7187a97ebc194b90a42d7666846f7b9ca312d53a81801e993ed036c6b5bf91e958fc0b0765ae7d6d4bf658417f08c54494c751806f97e33adba967344036706198b5b9ee79fc187b0196580fdf797e0207a1c810245cf599d5849e82e46b38eb1cb33583a9ffbd714ce753547b09363296cfa381e8dea24c9e53a50c0b9952bf190e89f3be197f8f7640a28ce852ae300dedc4e2255214a713d1aaff212ca49d6e53ac7ab5adcf94b2378c2c141fa8ec0a5c707c51fca33c08859351f566ccb4e30eeb85c057e53d4feeebdca77167715ea5a861b9b791f7c02db687c01f8ffdbf55413acef79698a843780b916521a7bb2d3b6067cc82991a05bc70bdea84deff5cd93aab469e44dc96ab9eff2c1cba829ecdc7b9e348fd14ad4f92b9f388a4f092e2b8f86a7cdcecb41f34ac4515c76a13c438d45c0416a4b5614efac612d5ed57067275d2e7c6692feb3e5f250babbdc1b7f5907a257304e935ccad261a468f6a1159e8797ff5a317f2f991bdc1b36a4003367d9d10c9bd44e2bddf7f7f46fa092782ad6c400379b4684a183faad74b423038892c9905168f00c8efa1e38e5194936ab8783251dcff14143212023ae6350371855a82ce5b25f6dd367853c5a5f7a9f9f1d275531663fdf14686e0c032d7a5f8c32107eaaafc23f24042e4f2fcbc583d65799c5f149a2db831360adc384f4c79d493eb561d52db10d9e3362dc53c1f14cc01af66de10700642b3273b074c5ad845bd8e9834564c0ab3782afa173c9878f1f425f8454b9c9a21046c1335b43d8996c02070822a56f2d9e2e450d35d369a560af258b7fda6bb2553a6dc377077a2d4fc19a1dde76274bd7a848d235740640eec1ad9a07b4fba2c28b2bd6954a4a2e9f702aec5e9dea8a923a71abf655768e4eb0a6cb0159661c6a4b4041e4b89872a90971bacd0e8b87088a1439cf530aa34a197aa9b6e9ee0426da3eb3019a4b7b7ae1217e66b72087f6b0d1efe1bc8bd7142cbcfb5ae8a61d67cbafa95498992c8a42f03a6cb70098a9945f9cebccb641242a07e2b5d790c54ee82e2e0b1ae8d9f7a10a030cf995ee4d5c3792fd4c9f227a4389d9d997eff2072cf408a45a871117f3da7fc7172657d0f680a39e2d22b302aface872022e38c1ae979afcfae522093ebe625fbd35ca9b1021b6876ef0c813d58d8c3fa25e857fb8a9f7e1ecdae56d8a40c6e646e5495aa32962900bb12e96330e63879766190ca35172bf12efa5747d93f86e01df9bda4ddb3404c1d9d1d66d3ff62d51e8afdcefb013e73ae3bb4e901af2211648127e97aa15b14ce0f5a0267004b881f47dd8c245f1544fad1245a24ac83c13b4c065cb4334541739d213793b52fd96513b6412e776ef152364a920c8904986c59e155c3b4f3bcdc36ff18b798b81f0588393570814bfef55480ab57c70d3c1668ae387cd477742c56f5d1dbfd9f44d3cb70e710a9be23564f4caa7283c39466b57784487548243faa5386c2441bfa62b8ec5dcfaad1dfeba54c381595baab227336611dd636080d03cbbce3008043b40492b48d3a5ab4f0c3906c83762b9f0b0fdb9e295fdb8d2389aff64f821cde7ab107bcd549e283e900c0780b754c848439d9cbc45c43c46a20ee8d401e8b137a3f0e29c803678dd5b46d4dd75619b9d7e87de21fde5e651df436b741b9acd8dc89e4ceb5a221c2c7a2fb63a434e7ae0cccb2621957b655b909cd4f33c527c38b6764c90a1d87e9e46d9433e659af0e721e475d5bddecc65a3721550ebcae9afa32fea559d2008d33f6c796245479a0c78600da790d868ca92a061845f325ac1c68d65213acfe2c3be3f517e9b269114d43267e060ec576e0c792186a28324df64d32327eddcec1b7085e729a690f8bf3fd5232579e57ad33fde7fcb630e333a77761b953fe97d4859c8dec6d13c019a298ea563dad1f14a71867d8fa210f9a9e3b82aaeeb39573fe34f8ddae3bf38f33e7c07fc71f3cc4bf192bcb3682a57f681044b335741be2168ab4da63761a5e7023e00045207a569a66e1c6169b504fa23fe3f8819ded2c1364dceab3a02e0b3d62242764eeb2dce5b1063c59ecae6e0fad96f7893548d5401041968ebab535cd491c327c5a69a586f1c46833493ebd997fed426e9a518af21f1022f420de032c121c7946b4f6ce8c9e092ea66fec88e8951235399e52716ddd842ab4d9c460e812b58a8568fe61b96d1b98dd199bde34f39454e574f017bd2b599ea17eb09ea7e792f5e7729a9af8b611061b527815043d32c2b3a39d4d01c4a94fb3c36d09ac55bfde9dcb72b43b8b6e69da0c6893d5138ffb0febd06563f3b2da5ccdb5765005bfcb1036d7d52e51cbcb21ba3666482045801aa8ff1869fb513150f12dc7e2ae8162997b7c28f5d24797eae3b9ce6302d87d4a9fe57b2a2ac3753c323a5b5f8dde1d585d1b00b5b35b1c7cd08e98cc452f097157629bedb62911b1a6613297d9696b43dcf9a2f63e9d91b509de2f74cb72d435e3e83f59e43f9bbe5d0306a607520d10cd0f6f7f38c661ec9109aa8d10e0d21b6887be618801bd639e1de955aaf72b9cefe40b7b2b2cb7ffdc9d5fd85cdbcf981d52e2cf4d90f1f27c181dec7c50f032c24b5a4ede70585b5019bac1968cfcd7f7ffce91b05c455a95033fab1517bbd04a20366707dcff32e96f897272a7c38b8be7ae983093581c432da5e70b819609c552b12d061c2cf28f0bbbc382482ea8def89edd7cc4562431362a539a52ad2e7256331651f807724434d54f5467d551215001b583beb4bbaafd5c675d69061a59b48c838203cd964bdcc886d228bcc0edc11945ae90f958606fb2808cb4e618ae1c21b509716f946715d942ec9caedf6fbf103dbb190107df584e5364dbb804b04a72964bba56370e9cb53699ffd39afde912d45c238a120aac371cb14855b0ce456d7f77b45b9a01fc2d96ec927060d5c5241bccc1ab62a5126a98e48f5829f1c2d9e493a5d44b3129a18dc9cecf8a945d4d796f017489395345dcee1fd3b1cec67c6caaef02b5471dfbd4bd5a414a22cb9e13fb3291c8f74a47ac37fd3d3c89fd910bb3c96061a81152a97b50770af9dd1fec86a4cdabb32da39366883fa13379f154fe72efb8ac564a57866d1640bbbf57f7bf91abdaef5dd12aff32f590d3d58b9d23ed98c1144ed27fe75868e1eabf2880466c508b4bc22cde46ad48f3a8c2ff6b0179b2b38ec6a7e2d61cdf9f07c6861d064ac250c23f0887c45f261a5b88b4e28552f3e4c1adcb512bd21647ea2b64ad69b0e6886169fc3304a75820b60e9ed62f68905a90a3787c3bbab9bd236a2313988976020b449406f057e64d5a88cb62a96e86a530d487360bc8c53c02312cce243f64214e37dfb8dfd6df9c8a03cc763fc0fe0592e3e056cdb02b3c398d38046e584290d3207396cbe8e7212e3e46b930a3227e564712a487f7855a8f6ccceeaca5cbdc89b5fddf0a6b834956442bfe5cef001db57def4a2063602791021bb1b143dd74bbdbf16f6f323d6070f2266fc4aec4853a68c043d2c2be8178726dbc208c09dbeeba35de017d523e44abec2eac636eef870795bf26654617ec47a06c3f679df3f9b92a3245734b41e53aecd8051dcd1685977e5cef99b0477a6d4e48a14a0eaee22e0518ca31ec700c76bee6a12747325539e0ce5bc17835f1df544d6728c0f0ba4333f53121c357d9451f3c85082ddd17e4878093af37460c6ac6767bba66560d8f27fc01b3cd857684d768787a6662ce037e69a8a361dd85acd828a9c9d308b1ca00919f2370f981a70cafc8c9f2549cf0b760394c49ccf6524a138aec15d790c0d00733d011871d6951609480f0fd063b43c79dc9f6279693bd9b0fd1784970fb4acd59f4153eee1d6eb690b3f91492a7a0bec9b07c602c0f0621926677bbdf8214f8310fff487f198e118590fdb1ed4163b12e78884c1b648862d37a0f220d3a9afc4756068991ed9c9eef2f104a4a4410a09f6bc3f7013d22ac69b0e8ac7466c27d9fe52a842cf5fa72264a0b22edb49dfc712323d72f3506f55301a292f48218277b94b51108e13a65c729dc5fc752361a1200b0db2e5f6215875758e00c206c4bdfc9c982cec15d4bc96f9f37f3d8e053ce280bb7b0eb2231196ef2d7dcba36831100d417ec1472f7913a2463bc2a463c4c48d09463b4baa5393ecc0d9920f7b7b81f99a445b1b4f372018156bc17f6ebc0091c23b83a27759ff8a24f34d5e4139e7d66802b6319fd6bfde70b2d5152088d85304ecc1611dd0ee344cc45064e7ca7a0e1aa9e72b846c4c4d4cdf2f2269cffc66a8eb54c083ac7417d7767eb206e1cb1c1de803752e551d387c49ffc74cb6fa78da79bad9f5dd2cc93cc264ba38fe2dccc34e937acf75b3e36131534aa95305e66a3069ab22afe3015f9dd13929f79c35178830b63b358b1e1399a9a313e9cc1bca158a95d79cd551dc618e1947b9d5d4296060b377733447dee878a8d5be5800133f00d1a0e85d80e8155f8e1aa95ba98182e7fc1d35860915811cd8892548936c5e73061da20523adeb6e02f776e1fa0a9e972f14fad671be3e210b19b66ef55a61f0c2830ade8679ee5d40408af9d8e92a88fa2aff0066b7042a34f9cc6f04aec2cf38bb3b74ef698d52de2f13bfe8ec1e5c8c5da970137e1cd0c6677c8e16dd7fce8864322daac659ed3095a7d114d87f806ac9cbbc83e83b2bbb2be3812d958624dd252b6ca1d08cfeab9debf74d67bb4fa643001dbe12673d6fa6d306f3cf843ff593f5dc2ea15952a3ceba53f96e5cc84bc47bbfbe2033b40d4b117f20f6cdd0b7e372d67e3ee6435967894a34b5e8ef5383c98edaf580a299223d7514453d338a791281bf0e25549f81d3100143e39ea8f304880fafc45f3f552ddc991c74d256524d50b0395da29f4f42719aa4fb721962903fcb1f230ed0a31882eeadf094b9878a7065728145e6c9155207224777c57f1a04d105b67c627d220bb454f7ddab0cc0ef2ee382a7936509d9b1837009ffb1cfddbb2b2c31b6a3f4a0c92e276a06e0f09630ed112b4c41e976295b389b1ebf844b431588d85cec953893505b22f8c4c856e07636996cf413b9e9304cb7c3b3e509dd54a5a11f34763ffb39291c", @typed={0x8, 0x13e, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x44}}, @generic="0ed07cbb72cb20fce4c31c4cf7389396349fe6baee172d9d09fa43ff0d01ab52c73dae8f0f620125ad", @nested={0x4, 0x24}, @typed={0xe7, 0xae, 0x0, 0x0, @binary="f0626ffef287ba7b31ac8ec057d606e8ad81fd8836f263f3214c2a0e8cde6b644ae200b6891c5e3bb02e9049b638e11c2cae3c568979ecac4f0da30c2cbcd14f4dea291aa422166546231817addc9bece76545970cd8cc8c363bf4fae192ca04afff5b30b9ae9d460ff77627a1b7f38ba69a2e292d84efab67c6567f00b662546e0e1c4402b0dfd18a4bfb1e299e0ac43172c918e7e66e22bed8564cf7c42f0de4a16a9339641867abff8573ff27d5736aa683d132f35f2b1a96b67a16e745b386532932a1c838bfa06b3e14f68f8a0a82fc00126244e0f87b652de517b3bc7bd2605a"}]}, @typed={0x8, 0xfb, 0x0, 0x0, @pid=r2}, @generic="8e489ab6135ac1f2040e80625caa4a8e3c683fd4501324a08114134412d79dcf475f93fe8e31e982981d1eae7be074a28aabeeb5235949e5cb0c1c36eb4ab146a49bc5e871e8000991464732430361529eab732a4841418210d9b7e18213aeb56a", @generic="729c9bfb7fde09711bd4d5b4f5e65a54b8011802107a392d70107aaed5463af29ac2199b84620de7f2128f8b35d09c13159bd7b5ff3642dde200a09c5d27c5d2bc8d52859c966aac1732c4b19f6b1c18f293f83c8afe9942d2a0935a59eda79bd730549d5df1ae6d9433b16ccd4f255859750fdcf28b4d3457f62180e51dc3ba02ea92fd6a8d371bb9f008fdfe030490bfe18f6d672f2b3c046b68b9fe7809d84265ecf446ef8bd0adc9c6011c7d60", @typed={0x8, 0x23, 0x0, 0x0, @pid=r5}, @typed={0x4, 0xf4}, @generic="a9305505d7a623e3221e98ccaecfda8d28db93342b171e25b3968de6620828c7d266f96fd2ccc71299feafc1eb0cf34b2e5b"]}, 0x129c}, 0x1, 0x0, 0x0, 0x40000}, 0x80c0) r6 = openat2$dir(0xffffffffffffff9c, &(0x7f0000002dc0)='./file0\x00', &(0x7f0000002e00)={0x40000, 0x8, 0x10}, 0x18) ptrace$ARCH_SET_GS(0x1e, r2, &(0x7f0000002e40), 0x1001) socket$vsock_stream(0x28, 0x1, 0x0) ptrace(0x4208, r3) r7 = openat$cuse(0xffffffffffffff9c, &(0x7f0000002f00), 0x2, 0x0) r8 = getgid() newfstatat(0xffffffffffffff9c, &(0x7f0000002f40)='./file0\x00', &(0x7f0000002f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400) r11 = syz_mount_image$fuse(&(0x7f0000002e80), &(0x7f0000002ec0)='./file0\x00', 0x2210411, &(0x7f0000003000)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, 0xffffffffffffffff}, 0x2c, {'group_id', 0x3d, r8}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}, {@max_read={'max_read', 0x3d, 0x5}}, {@allow_other}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0x200}}], [{@func={'func', 0x3d, 'FILE_CHECK'}}, {@fsname={'fsname', 0x3d, '\xaa\xaa\xaa\xaa\xaa'}}, {@subj_role={'subj_role', 0x3d, '\xf2:'}}, {@uid_eq={'uid', 0x3d, r9}}, {@smackfstransmute={'smackfstransmute', 0x3d, '@#*@'}}, {@flag='mand'}, {@pcr={'pcr', 0x3d, 0x12}}, {@fowner_gt={'fowner>', 0xffffffffffffffff}}, {@pcr={'pcr', 0x3d, 0x5}}]}}, 0x1, 0x0, &(0x7f00000031c0)="f5421fcb9d1a5b0aca90ee7fda9054dd9838db4df4b1962f18c77b9ba7a32894827148173f04a1073a1e51181fd4880f0e67a1d73a36c751f7d4fd027ff06f94e00cb481b2e8a3ad326dd9d7318d0cf73ca9f00a030aed9c19c9d997b973cb91cf9523485dfbcc17e9cdb038a21ddee22e8caf93f1e39d4cb8bed0499bd7cb1aa09256dae1c15674fd941a255b280b87cc367cfdecf7703912471a9b533db7ba50e2a8c914cff0095354653cd767272485bb23553e86ffc0ea3cd30562fd0718bb79111589adc12b310618befc96ebb6b2e842113c16d85730e4bdd7a1764b48c435a546db396e9689f51769711ea5ac851ad4a27529e7fa3d2acb6ae6cadba53ced81fe18abc6de677f81d0db8a14205814dbec796df5e833a52423aaf2ae79912ec5c2affcd95d017ec0eb6d746b3a2d80200a034bf8ed3596e0fc57278123eacfd060d709d0cfc1b1d3223398aec668fb632a41f7cac2b4b13fd7e4c7f401ce284b02f6c0f86bd672ef6ce59614bac7371ebd17238677cd67f104e2a8ba2baf2f13f175e785b947a23baf3df78a67bea79669375401298aba2a23d0457ec26447af511aebfd2477d24b8f2fa32e6addf9a3466e66e6012c3971e5854fe89da054fb68876e26cbfc3a9c20d3e45bc6ce0200797e550f7e1502c4e3d8d6f48efffe686c3250d0c6fdbb5c08040e93d6fa6cc9901821d2bf1233cf13035e88a7dfd25b5c9d308265ecb4206042d3484f4ce9bc30463b0489913988d0cc066d4e98a34ed54771d68689b643a95de38a2efbef0fe1e57b44d675e70959dd5553765f9e1c9f124eebeac795db253eb24edc39a603dba982c71ffb8cb5b81371cea40988c701449d029453a330196839a48c3aaa753fb48cef1133520e97100d2a972b104f5dc2b92ac1951e8011d86ab7c99251074e273c387d8d45a4ba9fac8b6b7372294852db01349764915bb1dd3dbb6b5552b35b078817ee50690503fb35fdff014101423a7ed0cfdc7214026431162a50e8ec4b25bade8acc8338f89efffc5825dde13ad4c90d122f281f0be45dc1c57bfc5463a389e30d1756b045bcc9e4b8a335dd5f082b26137770a77a2b820e6303279ae29df16ca1c0ba835d49eb03c85dfe46de0767368fa9f78467b8bd2036dbb48beb20c8076b468ee420a82c4f64a135ea1b5311cecb8d517b778201d991334091c8fa4829159200c2ef1a588bc9bba41c876f612e9f7d5c9142289227b8e474416e3985363a77c7db0c16b335bb006c253c8eeaf18ff43d7c0b7b4858174c1a53a9baa66057761ad739598da29863b1de57f80cfa2e6068d8534e72f466d79c6a401c9eb6e5d63c7622a5df0ce3b758487354735e8addbc4f9c18b5fc351ebf5924c8b14b37c1e154bcbd8fe1463d415dd4d1de0281c57cc12f8206bda4ef8f14353cfe54c73d53f9658aa6c20875cd174060c700b659a786537427a7dd5ce9a344450a5860855df6f662c823635f6baf080968eea73de18d68b910ba06c8d67c9cee857c39538dcf5b5c47bc1f9f47e6dbbce7c6c3c74f92f3b37e26bb2d314d0ced1323019ba054d9002ae0abed90dec24b5f35de36f342953869a47486ebeb578cf9f267274e2998b0762bcb06b9bcb244c00fec7d2124bf9745ae24cbe151a0816460d8994d1ad15ff1a7f634eb2da194a56df5339b598a8836c7489c3f5b611f170886e4187b4922f37b7c2ed9e10742b0f25916f0a4b0c73219b659f60cd46265a6b09875cc5dc7afe10d857b81124f89476ab7d2babf738722324d8b699a0c4e6c4725801c6dbaed7a30cd37e1f0377096b8599904d7a34512175a28281ec877b5511f5fab82897226a81f5e2bddc215d934d299605a2879f2734b4bb7d4c2e8f2ba2b76d92c67b669e0e3aa115166fb98ac627398b3b81d0d381cf3aa8965a0f4dd1a78954fbd9737c9f10b90563814269b72421b805b0e8ee4d387727bb3b701f598b9518c813b320273cdcaf2bec2899c5facb5e155d1ad067f91a4dc7b4b2b557a6241ccebe6a95059b5fca5b24f30ed2914c59dd33883db36c5b428e9bebb00f6f58b74e2130082edb9c6cbc24eb785e3765ba3db4aab5ff16f471b8d79ea6920f1fdba63fded19237f339bbf54f59aee148048a51fc72d27d8243cb9afe1be858f0c144d152085e42ce362a7077dccb0fdd36be0af5451cd3877fd8eed566cf4d0bca9b6af29c96fa29b7d922601930d6ffcc33885a844687883f48f0e4d9a1627551ee909bf30b5a91f89b3c569b837eca55c32255a586ff8e04d4fbac3d5ff5bd9235a7b25820533330b5166564e85a1cc0976647494b3944fd6609074acf868397e487f71ed4f83907ce4a15f3ed726210a9c3b42fbd9f069b8783bfbdc292e07112912f04c4d666d61c3410ff3a50d56f54b12a2d781a7c2eab8d551cb8d7eedc5c7b4e4706b158700871e9df1f3388bc3dd8788876ed91152c5b5b6ded30c0e0c1a0615b219ad218cdb9c65688b44b094001221b8fb741fb5001f2c8ee808e5df394d15fb195579b9e227a5145adf19944a145ebdc43f8d0279af8e62e52b47f55e5b2c822bae40baae80476c5d998183dcd06583c07c77fee339d79a08daccc37219932ec0ea8bd27dd778056dd1e6c9a50b3b0dbb1f442cd71f0d8e395359604aac55288f50e818bee5731d6f04337c686c9380aa2e52fc8206b776ae3023557c9d0d94f2df7212ec3ac5464559c261f73bf3bd3807575364d75c8ab4b15289c1051b25a5ea41cfb311e85d50c2e2c02e374a0d40f7efd201b81f296b3a5d138d83dc93e312fefafedf71c40ea9fe49d45698b8f8de903bb8881435ab44c40cff108afb5438cbd0144e51158b88ee64ddc80c9444be8a9cd807f2e0cacc119b7baa637b6ef819d204300c56a3aea6b918bd284cc0ce7d63789e279b0ae553fca84b964c768b0b5051313471d941cf223f09bb1df272c9cd3398ea675d5b54e580caea8802f3183752d9d4c5ae892272e33947bb06e52744825f95fe947ae534dfc5901f399e81eb3355ecbd8c0cbe390f9ffe2360064d7705145268ed2baee92b9236032346abe523849ac5e5aaf35cda24e2760c76d3012039d5db6d9b77ac6ab76ba86658900b18cd9093765a0d84ae1b5d8a1d8638918a77e7e7b829e53c3b54b94f40740240395707a4ca3744d47802178f2832e95f8a728b6a2c482747c94643e83b885a75dc17c7ec5ccd4f6148410b63ebbef0440c0f2b7b44929a1776cd145afab11f4ddde7fa97ee20c25cad1d81e52331e2d2a756fc9ad591746d6dfd2d946248ce058115901ad495a9308430d2052588ddd005070f087de74dea2955bbd5cb13ffa56a980175ac0def54f7a282e5fd22a918567f67bcce94695cbff8356010809f096c2773efddad0f30483e82555fc6a1fb9ac1b8d2e9d3021c953c2129d1a0c0fbf84d80b0016faf8aba9115f67f9b458f1efa1ea2a0b26e66766e52a360984851d8993e43ac54641cb7a6c426c8ab84682a255cc9e7d0ba57300443ecda069ef677fe9456eceba54ea9ced5647d93708547f0cdb5d5ed8cc07186960a6e9a44d6994fb9d0c3efa91e83bc037cef93dbbf4c39a17c9dae5610666466b14e2d8da455f46c7b3e2653c94ec0da5451ea842006fc1066d24b344fe08ab164f8212be1b1191a0a43d3da48c405b52672f283868e964b3c5f99a1a8400e2c273df158f21e571d9b916b4c2ab236e9009355b0d8ac5d79cc42bda96afe5b1df1dd17f4ad4863d60b6b744d821ae845f52f8ee418a893c37dd430aab77bdf8af8e06b16f32ccf339113b9f64226515a149c9b6ef494e2b4dd0b55543054a41a18ea98d29768f2bfcd2cc32451a0bd29598887ddcbb06d97d3bd928844e148c5fdc54996b7bd17e2e9d5a60acaf62e27a4f3287da40ac96682819ad5d0e1dfd1f8aa2878930ae1b6b25fc84a67e554fca280419c65106e2b276c3a9b14d5ee656ad47f9ef48cdccd18d6aa32042cc4ee843786be181b3cdc25a424638e1e080f1bc8542bbd770da1db9e161fac51f719d997e180b6543c8346526a1ba38e07edf0aecd68609e5582a709affaeaea4c7117e52e35640249d2612e2b83c2f8c790e4b1b2a38dc0a7f567ec051a578880404123c0e99c0444fdab9cdfe2ba7f487ca73efe93662d38ae97137e612ee84ee4b081be3b1cfa3cd7b07961a32097e22625279b41d98c955861eafbaa4cd2d78a173a93b02817cfaf8e619620e44ad51e3ada289149f2245d7481ccc3d182649e25c46745307975e9cbbdd8c3a0061858f844b42375f18a7a68f131249061f7d55193efb7978d29845664ce2fc0d537f75c3bc99274fe4fb1d87cd05653ba9a152d1558e7c919e9a5b4e99102630870b1c98ad67c3516b092c8114a720c5df36c8caf39da72ae44c276c82bd79132e8028773dcb71a060d0d4636fc899e609283dc838a8cb4993fd21f555fbf614e51fdc04573d28b586fc5108881f4d182d31ce2ce36d2a98ad10ec7b32154fae139e538634ea19bb51e4f417f7628a6c0346eef9ac18521fc79740d30b426a23d147522a1d9b15a7317d7681cc58b565781e2b97bd874ee3606619a1e9466a8a7f0c9682f2e41f98bedda1a02af183acc8fca4dc8be4039dcb5a132a42b843fb10d5d7e90da5a7100ac07fd84b41be9f1612cf494b3a8b858a66886be456178347c0fc0ea6687208a4df6b119891fcf7dff9180e3189443e295226f6b0415389b8097db77ab10a4e0fcd37b5af35cf9922f15a4f2087a87ff7d321462e71a53ec2feb17b528cce45464f7223f1392bce62f8b82c90f41c78831357980d1105f8cc5fc575c227e19916758a8ca8864ec253cd53446038beec834956934eb1012d992efe436f9f44ab72bacacded2cda6f2fa127c1ae405f5d73865a2ab9a1ab6adad241cbc022223777f207ebc2a9e11eeae2c5a50d73db3a4457905939f87841de765946c1f6534952b6d4ea039ebee29e731ec2819ca453e899976f9e56a97824937084c5c246e728a4db4b0065a6c8d96bede3dccf755aed75d805e28d4b3cb18865490d58c354db007538168913350bf9449539b8e9fef39db5847396d69a49c396ba875618667400aa33b2ed6989c39a65b42bcdc891acac890541e936311ea285a59167d6c1279e5234586777c4ac1817f076dbf5a0dd9bb5cf06ed368f4dd8bc64b5c8440163a0ab14ad725cbf9a2f212b043ec9802361b413acdec6c5dd606600bc338a29e5bfda6b3a7f86e06461f9e1e106ca28f79a274d7b564008ef4828659d1fe0b03e47f9b9e35387a49318aa8a748b7bc63499f76dd7c8bec62eb6e71cd226396236956018788710a5739ca34ca3ec9f005a4f3216ff434cc280e20943bcab480638eca18ed228b2acbf038d1cad17d21e7e7987d69d7a8978103b85fb7ef266a6c85407945ea7f2b34aed1022c04c4c33baf4b26e7e71138231927c37894941a8dca54de085f7439f96fea012ae9ae3e3c0972afcfbf6d87a6f9b836369d2edc3622c74d446f0785c43edebd0d02ced6127affa368a7ffacf85a826be58f8d49a8048bd5e5103d5168855e6fdee0a067d639a975b65f10c04b917d69bec0e8cc94d6b2763596c67e9c737bf968854b381fd0705f8ecefbe49df15ed5c6eaf5c107879ce1876a714a2f19774c969a99873c385d006daf94c53f4689e6cb25614823bbf269ff4169b1293820b57559112bcbb8d38bed979b4a9c471e012ebe89801cb150d1f43d9b27c63b8b3a7940bf8cb9c83076b208d839d7f00d") ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r4, 0x0, &(0x7f00000041c0)=""/163) syz_open_dev$tty20(0xc, 0x4, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r5, 0x6220, &(0x7f0000004280)=""/211) mount$fuse(0x0, &(0x7f0000004380)='./file0\x00', &(0x7f00000043c0), 0x0, &(0x7f0000004400)={{'fd', 0x3d, r7}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r9}, 0x2c, {'group_id', 0x3d, r10}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x83}}, {@max_read={'max_read', 0x3d, 0x2}}], [{@fowner_eq={'fowner', 0x3d, r9}}, {@obj_user={'obj_user', 0x3d, 'allow_other'}}, {@fowner_eq={'fowner', 0x3d, r9}}, {@smackfsroot}, {@fowner_eq={'fowner', 0x3d, r9}}, {@dont_appraise}, {@fsmagic={'fsmagic', 0x3d, 0x2}}]}}) prlimit64(r4, 0xa, &(0x7f0000004580)={0x4, 0x1000}, &(0x7f00000045c0)) capget(&(0x7f0000004600)={0x19980330, r3}, &(0x7f0000004640)={0x0, 0x8, 0x3, 0x80000001, 0x2a5, 0x4}) r12 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000046c0)={0x7, &(0x7f0000004680)=[{0xf8, 0xcb, 0xa}, {0x2, 0x5, 0xe, 0x1}, {0xc, 0x0, 0x5e, 0x1}, {0x7, 0x7, 0x14, 0x3}, {0xffff, 0x8, 0xfd, 0x5}, {0xff81, 0xa}, {0x33, 0x53, 0x1, 0xfffffff9}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000004700)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r12, 0x40182103, &(0x7f0000004780)={r13, 0x3, r11, 0x40, 0x80000}) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004800), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r14, &(0x7f0000004a00)={&(0x7f00000047c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000049c0)={&(0x7f0000004840)={0x164, r15, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x7}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0xbf}, @ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x4}, @ETHTOOL_A_LINKINFO_HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x1}, @ETHTOOL_A_LINKINFO_HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dummy0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_LINKINFO_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @ETHTOOL_A_LINKINFO_HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}]}]}, 0x164}, 0x1, 0x0, 0x0, 0x4000000}, 0x20488c0) r16 = syz_open_procfs$userns(r3, &(0x7f0000004a80)) mount_setattr(r6, &(0x7f0000004a40)='./file0\x00', 0x1000, &(0x7f0000004ac0)={0x8, 0x80, 0x60000, {r16}}, 0x20) openat2(r11, &(0x7f0000004b00)='./file0\x00', &(0x7f0000004b40)={0x100, 0x40, 0x10}, 0x18) 5.981773318s ago: executing program 3 (id=6953): r0 = socket(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x5, 0xffffff84}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x64}, 0x48) (async) r1 = socket$packet(0x11, 0x2, 0x300) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000005c0), 0x8240, 0x0) sendmmsg$unix(r2, 0x0, 0x0, 0x90) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=@newqdisc={0x78, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x3, 0x0, 0x7ff, 0x1}, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0xfffffffc, 0x0, 0xff}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40}, 0x0) 5.758910155s ago: executing program 3 (id=6954): syz_open_dev$video4linux(&(0x7f0000000000), 0x2000002000000403, 0x400) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x440000, 0x0) syz_open_pts(r0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002d40)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) io_uring_setup(0x93, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) add_key$keyring(&(0x7f0000000340), &(0x7f0000000380), 0x0, 0x0, 0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x3000)=nil, 0x930, 0x6000002, 0x4018831, 0xffffffffffffffff, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x10031, 0xffffffffffffffff, 0x65be1000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x5, 0x13, 0x1, 0x0, 0x5f, 0x3, 0x0, 0xa3, 0x4, 0x5, 0x6, 0x8}, {0xfffffff7, 0x4004, 0x0, 0x0, 0x0, 0x4, 0xe0, 0x8, 0x3, 0xff, 0x4, 0x0, 0x800000000000000}, {0xffffff01, 0x35, 0x0, 0xfe, 0x4, 0x5, 0x7, 0xfe, 0x5, 0xab, 0x0, 0x4}]}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="380000003e00070127bd700000000000017c00000400fc800c00018008000600", @ANYRES32=0x0, @ANYBLOB="0c000280725eb862cec9a478", @ANYRES32=0x0, @ANYBLOB="357a1e6fe9079dd310fe0e016897d3bc543898e12077979bb1be16de911910df812016bca2e02bee4cbc039a27b8a3822a1aecc229c9947ff67b0619cf18b4393f155e3ac8bc6a61e8c8241e93"], 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x0, 0x8000, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0x0, 0xd, 0x7fff, 0x1000200004, 0x4, 0x2, 0x0, 0x1], 0x8080000, 0x289014}) 5.065116028s ago: executing program 7 (id=6956): syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043c07ffffffffffff0f6fdb"], 0xa) setrlimit(0x9, &(0x7f00000001c0)={0x5, 0xdbc}) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept$alg(r1, 0x0, 0x0) sendmsg$alg(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)='[', 0x1}], 0x1, 0x0, 0x0, 0x30008040}, 0x40080d1) accept(r2, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'veth1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=@newqdisc={0x54, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x9, 0xd}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x2, 0x7, 0x2, 0x0, 0x6d, 0x8}}, {0x4}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000}, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000010902240001000040000904000000092105000001220500090581"], 0x0) syz_usb_control_io$hid(r5, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00222200000096231306e53f070d0000002a940183"], 0x0}, 0x0) r6 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r6) read$FUSE(r0, &(0x7f0000000640)={0x2020}, 0x2020) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000a40)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) 4.96001538s ago: executing program 5 (id=6957): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) syz_io_uring_setup(0x5b0f, &(0x7f0000000000)={0x0, 0xfffffffc, 0x1000, 0x0, 0x359}, &(0x7f00000002c0), &(0x7f0000ff4000)) close_range(r2, r2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x22, 0x3a0, 0x5, 0x101}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f0000000080), &(0x7f0000000240), 0x1800, r3, 0x0, 0x500}, 0x38) 4.208806266s ago: executing program 4 (id=6958): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, 0x0) ioctl$BTRFS_IOC_START_SYNC(r1, 0x80089418, &(0x7f00000001c0)) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f00000000c0)={0x0}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000004c0), 0x48100) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f0000000040)={0x0, 0xfffffffe, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r2, 0xc05c5340, &(0x7f0000000340)={0x0, 0x1, 0xffffffff, {0x7e, 0x9}, 0x2, 0xff}) 3.88249349s ago: executing program 5 (id=6959): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYBLOB="0000000000000000b702000014000000b70200000000000085"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00000000000000000000000000000600", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 3.818172785s ago: executing program 5 (id=6960): unshare(0x66000080) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800060000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES64], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x88010) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000100), 0x4) r3 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write$tcp_congestion(r3, &(0x7f0000000100)='reno\x00', 0x5) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r5, &(0x7f0000000d80)=[{{&(0x7f0000000280)={0x2, 0x4e20, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000880)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000900)=[{&(0x7f00000008c0)='w', 0x1}], 0x1}}, {{&(0x7f00000004c0)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000600)=[{&(0x7f0000000500)="ad", 0x1}], 0x1}}], 0x3, 0x8080) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f0000000000)={0x2, 0xab51, 0x4, 0x0, 0x0, 0x6, 0x7, 0x3, r6}, 0x20) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000000)={r6, 0xc, 0x6, [0xffff, 0xcc, 0x4, 0x5, 0x8, 0x400]}, 0x14) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc010203010902"], 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000140)={'vxcan1\x00', 0x0}) r8 = gettid() sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="2800000010000100"/20, @ANYRES32=r7, @ANYBLOB="6d3082610000000008001300", @ANYRES32=r8], 0x28}}, 0x0) 3.650426474s ago: executing program 3 (id=6961): mmap$IORING_OFF_SQ_RING(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x2172, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r3, 0x8982, &(0x7f0000000200)) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) setsockopt$inet_MCAST_MSFILTER(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000540)=ANY=[@ANYBLOB="020000000000000002004e24ac1e0001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000002004e24640101410000000000000000000000000000000000000000000000008a150000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e2200"/400], 0x190) r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) write$6lowpan_control(r6, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x100000004001000) ioctl$DRM_IOCTL_MODE_SETPLANE(0xffffffffffffffff, 0xc03064b7, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f00000000c0)="0fdf8bc95b0000b9a2030000b800000000ba000000800f3066b81f008ee066ba430066ed66b8e4000f00d0b8010000000f01c12e260f01b50a000000c4e27d785670360f011866baf80cb8d6603f8eef66bafc0c66ed", 0x56}], 0x1, 0x4b, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'veth1_macvtap\x00', 0x0}) r10 = socket$netlink(0x10, 0x3, 0x0) removexattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300)=ANY=[@ANYRES32=r0, @ANYRES64=r5, @ANYRES32=r10, @ANYRES8=r4, @ANYRESHEX=r10]) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r9, {0x1, 0x6}, {0x7}, {0x3}}}, 0x24}}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="4400000091f7f15c00"/31, @ANYRES32=0x0, @ANYBLOB="a5fdad88000000002400128009000100626f6e64000000001400028006001800000000000500160001000000"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 3.146303017s ago: executing program 6 (id=6962): openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0x2, 0x0, 0xff, 0x0, 0x651, 0xfffffffffffffff9, 0x8000009657, 0x5, 0x7fffffff, 0x0, 0x10, 0xb, 0x80000000000003, 0xcc0, 0x1, 0x1, 0x94d6, 0x9, 0x0, 0x1000809, 0x0, 0xffffffffffff7ffa, 0x3, 0x4}) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/bus/input/devices\x00', 0x0, 0x0) read$hiddev(r1, &(0x7f0000000000)=""/149, 0x95) preadv(r1, 0x0, 0x0, 0xf2, 0x207fff) signalfd4(r0, &(0x7f0000000340)={[0x100]}, 0x8, 0x80000) r2 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r3, 0x0, 0x0) syz_usb_ep_write(r2, 0x81, 0x6, &(0x7f0000000080)="00012c615bc2") syz_usb_disconnect(r2) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, 0x0, 0x0) 2.634778879s ago: executing program 4 (id=6963): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.io_serviced_recursive\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000040)=ANY=[], 0x118) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f00000011c0), r1) sendmsg$SMC_PNETID_FLUSH(r1, &(0x7f00000012c0)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20048010}, 0xc040) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(0xffffffffffffff9c, 0x0, r3, 0x0, 0x260) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029bd7200fbdbdf253900000008000300", @ANYRES8=r3, @ANYBLOB="1800070000b70aecd4866e7012aa0d1b7eeba13480050001a2953c5edd53058eb02c8c00306defe2b9e1f6b46d001694a4a6bec128d2f705ca4ac244b0451dc4d5de90929eb02e3c49bdd1e648900db22b83b258d339d994f3323750d2fad8afde4c0b6d75b9b57db2507e1db1db4369cda9c0d9"], 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) ioctl$KVM_X86_SETUP_MCE(r0, 0x4008ae9c, &(0x7f0000000000)={0x14, 0x984995b43da11a79, 0x4}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000200)={0x0, 0x9}) r4 = mq_open(&(0x7f0000000580)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xe6\xe6\v\x888\x91\x81w2\x93a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\xbb\x06\x00\x00\x00\x00\x00\x00\x00\xd2\xf9yx\xb2\x1b\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.tT\xcfY\xca\x9d\xaes\xab\n/\x82z\x887O\xf3\xd6\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|m\x97\x14\xe9\x91\xc4\xb2,\ak\x037\b\x83?\xceK\x0e\xc1R%\x8ah\xe4\xdb`\x9cm\xd4\xc9.k\x85\x1b\xd4\xc6]\xb1\xf6\xab\xe2!\x94h\x80\xa7\x1f\xbd\x1dN\np \xba\xd3\r_\xd3\x8f\xf6\xa7\x81\xa1\xe4\x1d,Qj\xce\xb5\x1b\xc0\x9ddc(\xc4\xe9\x82\xd0\x80\xf0\t{\x80h:\\V!\xaa\xc58\x135X#\xd5\xb6\xee\xc9kj\xa9\x1c\xfb\"', 0x42, 0x7a0f9196067dbc38, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="44000000200025a729bd70000100df250a0010cd0000000000000008090002002001"], 0x44}, 0x1, 0x0, 0x0, 0x20000005}, 0x0) lseek(r4, 0xf8, 0x2) 2.586418042s ago: executing program 4 (id=6964): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004a40)=ANY=[@ANYBLOB="d01000003f0007012dbd7000fbdbdf25047d00000400fc800c000180060006"], 0x10d0}, 0x1, 0x0, 0x0, 0x4000000}, 0x60044810) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x4008032, 0xffffffffffffffff, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x60600, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) write$FUSE_NOTIFY_RESEND(r0, &(0x7f0000000000)={0x14}, 0x14) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f00000000c0)={0x100000, 0x21d000}) 2.220034154s ago: executing program 6 (id=6965): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000001140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffd}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x88}}, 0x0) 2.077506131s ago: executing program 3 (id=6966): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000000), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0xfffc, 0x4, @mcast1, 0x16c}, 0x1c) (async) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e24, 0xa, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x5}, 0x1c) (async) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x80000, 0x0) read$dsp(r2, &(0x7f0000000080)=""/2, 0x2) (async) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e20, 0xd6, @loopback, 0x4}}, 0x7f, 0x8}, &(0x7f0000000480)=0x90) (async) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f0000000100)={0x0, 0xd7, "3022faba160127f53290e1ff5cc097137b2cc8d19cfd9a613b9a39ecdd914f8271262e84cdc729a956686cfe3f9d2cff58721662f59105505092674609b9fffd58854a3eac4f4381ffa2fa1fe448f6949c4a7349ffbb59a0c2a888e94057498420a69c1c494d2d1d9e80d89dfe06151684bb9f67ada75197f184aa22dafcb929e878fa2f8474f1692cd7cff0769175a8db35155798492621edae924ab9f862e152326d266f1d03e2d9c77b4a27e158c960e2a8441767d17737c27ed15b4abf65ca3566f5db603d7e6c3d816abca3000000000000000000"}, &(0x7f0000000000)=0xdf) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000200)={r3, @in6={{0xa, 0x4e24, 0x9c, @private1, 0x81}}, 0x80000001, 0x3, 0xff2, 0x1, 0xb0, 0x100, 0x6}, 0x9c) (async) socket$inet(0x2, 0x80000, 0x7fdc) (async) close_range(0xffffffffffffffff, r1, 0x2) r4 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c4000000000010902247251000000000904000012070103000905010200000000"], 0x0) msgctl$MSG_STAT(0x0, 0xb, 0x0) (async) syz_usb_control_io(r4, 0x0, 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[], 0x0) (async) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) poll(&(0x7f0000000080)=[{r5, 0x5}], 0x1, 0x7ff) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002c00ef5f"], 0x14}, 0x1, 0x0, 0x0, 0x20008081}, 0x800) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000300)) (async) unshare(0x8000000) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x8090}, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) syz_open_procfs(0x0, 0x0) 2.076987709s ago: executing program 6 (id=6967): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)={0x30, r5, 0x1, 0x70bd2c, 0x1, {{0x2}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x2, 0x25}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x143c}]]}, 0x30}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) sendmsg$NL80211_CMD_GET_COALESCE(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r5, 0x200, 0x70bd26, 0x25dfdbff, {{}, {@void, @void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x80000) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x58, 0x10, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x28031, 0x1048}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x4}, @IFLA_MACVLAN_FLAGS={0x6}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'macvlan0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20}, 0x8000) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@bridge_newvlan={0x24, 0x70, 0x1, 0x800000, 0x0, {0x7, 0x0, 0x0, r9}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x2, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_MCAST_ROUTER={0x5, 0x6, 0x9}}]}, 0x24}, 0x1, 0x0, 0x0, 0x200000b1}, 0x0) r10 = socket(0x1, 0x5, 0x83) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r11 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r11, 0x40045532, &(0x7f0000000100)) r12 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{0x0}], 0x1, 0x7000, 0x0, 0x3) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r12, 0xc2604111, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r10, 0x8933, 0x0) r13 = syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') pread64(r13, &(0x7f0000000500)=""/31, 0x1f, 0x40000000009) 2.002365176s ago: executing program 3 (id=6968): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, 0x0) ioctl$UI_SET_ABSBIT(0xffffffffffffffff, 0x40045567, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, 0x0) openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x100004, 0xffff, 0xb, 0x1, 0x1}, 0x50) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, &(0x7f00000000c0)={&(0x7f0000000040)}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000180)=[0x0, 0x0]}) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_trace_dev_match', 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_tracing={0x1a, 0x39, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000600000000000000ffffff7f18310000010000000000000000000000b7080000000000007b8af8ff00000000b7080000070000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a500000085200000020000001845000001000000007d573e0617ff0000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000100007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000185600000b0000000000000000000000185800000400000000000000000000001859000006000000000000000000000018390000020000000000000000000000186a000001000000000000000800000018560000090000000000000000000000185500000e0000000000000000000000b7080000000000007b8af8ff00000000b7080000050000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a50000009500000000000000"], 0x0, 0x2, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xf475, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) r3 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0x14, &(0x7f0000000000), 0x4) sendmsg$kcm(r3, &(0x7f0000001780)={&(0x7f00000003c0)=@caif, 0x80, 0x0, 0x0, 0x0, 0x0, 0xf00}, 0x0) read$FUSE(r2, &(0x7f00000034c0)={0x2020}, 0x2020) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2}, 0x14) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) r5 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000040)={0x1, r5}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000680)) 1.87965696s ago: executing program 7 (id=6969): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x118d7, &(0x7f0000000040)={0x0, 0xe472, 0x2, 0x0, 0x25a}, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) pwritev(r2, &(0x7f0000000280)=[{&(0x7f0000000000)="2d31115fd9", 0x2}], 0x1, 0x4, 0xa) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, 0x0, 0x20000000) r3 = socket(0x840000000002, 0x3, 0xfa) getsockname$inet(r3, 0x0, &(0x7f0000002280)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000300)={0xfffffffe, 0x1, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES8=r0], 0x50) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r6, 0x0, &(0x7f0000d47000/0x2000)=nil, 0x2000, 0x3}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r6, 0x0, 0xffffffffffffffff, 0x1}) unshare(0x2000000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r7, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r7, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x3d3b4e}) ioctl$IOMMU_IOAS_UNMAP$ALL(r5, 0x3b86, &(0x7f00000000c0)={0x18, r6}) openat$random(0xffffffffffffff9c, &(0x7f0000000280), 0x40000, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r4, 0x29, 0x41, &(0x7f0000000440)=ANY=[@ANYBLOB="66696c74657200000000000000200000000000000000000000000000000000000400"/104], 0x68) fsopen(0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='cpuset.effective_cpus\x00', 0x275a, 0x0) 743.755921ms ago: executing program 5 (id=6970): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYBLOB="0000000000000000b702000014000000b70200000000000085"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00000000000000000000000000000700", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 712.345617ms ago: executing program 5 (id=6971): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) userfaultfd(0x80001) munmap(&(0x7f0000ff3000/0xb000)=nil, 0xb000) personality(0x87bf5ac905ea0f7f) brk(0x200000ffc000) 382.157812ms ago: executing program 5 (id=6972): openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=@gettclass={0xfffffec6, 0x2a, 0x10, 0x70bd26, 0x25dfdc02, {0x0, 0x0, 0x0, 0x0, {0x2, 0xfff2}, {0xffff, 0x2}, {0x1, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x4080) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect$uac1(0x6, 0x71, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x99, 0x20, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x50, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x7, 0x4, 0x4, {0x7, 0x25, 0x1, 0x1, 0x8, 0x6db}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x1, 0x8, 0x2, {0x7, 0x25, 0x1, 0x81, 0x0, 0x1}}}}}}}]}}, 0x0) (async) syz_usb_connect$uac1(0x6, 0x71, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x99, 0x20, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x50, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x7, 0x4, 0x4, {0x7, 0x25, 0x1, 0x1, 0x8, 0x6db}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x10, 0x1, 0x8, 0x2, {0x7, 0x25, 0x1, 0x81, 0x0, 0x1}}}}}}}]}}, 0x0) syz_usb_connect$cdc_ecm(0x2, 0x100, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xee, 0x1, 0x1, 0x63, 0xc0, 0x7, [{{0x9, 0x4, 0x0, 0x9, 0x3, 0x2, 0x6, 0x0, 0x2, {{0x7, 0x24, 0x6, 0x0, 0x0, "88cf"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x3, 0x6, 0x3}, [@obex={0x5, 0x24, 0x15, 0x22c0}, @mdlm={0x15}, @mbim={0xc, 0x24, 0x1b, 0x3, 0x4, 0x5, 0x7f, 0x24ba, 0x85}, @mdlm_detail={0x82, 0x24, 0x13, 0xff, "85d6c814c6289dad7c7a589a1134901346748c0919ee6aaa9a635c2235e4d910175db039b08a29092a2e2e53bc09b4887edc5beae106a7d6635e25a1ad6ca3ee873e7508c5660644acf9ca2c31c21232f4e76d3c973d910c10df3b0e5f5788d61b04aed71980525d2fb7cf1378b45f16cdd865b23032b2c7957f70f8100d"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0xb, 0x7}}], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x9, 0xe, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x3c3, 0x2, 0x7f, 0x7}}}}}]}}]}}, &(0x7f0000000480)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x250, 0x40, 0xc, 0x40, 0xc7, 0x1}, 0x24, &(0x7f0000000280)={0x5, 0xf, 0x24, 0x2, [@ssp_cap={0x18, 0x10, 0xa, 0xe8, 0x3, 0x9, 0xf000, 0xeb, [0x1fe3fff, 0xf, 0xc0c0]}, @ext_cap={0x7, 0x10, 0x2, 0x12, 0x8, 0x8, 0x5f04}]}, 0x2, [{0x7, &(0x7f00000002c0)=@string={0x7, 0x3, "4a048180c9"}}, {0xe1, &(0x7f0000000300)=@string={0xe1, 0x3, "c6baada6c7d485bb6a4ced999852631e453ea93fde496aca4c5634355ea708d1b9811a59b15a0d9b0020169f79fe1ff1a20a576c99c06005f400a7b52f5bfa800646d37cbc3c5458779a60a7368207128975267e1008988d727d8332e79b08c0aedaad3827423396595b19df440c3a2acb27efbcf2db053bf9c8e22e2492a4ebe669c4b5da24003eb1cfe97ad027e4048e9e0d901c0a9c96e5c16f533f15bb002ad29647be7596ac3f5b67f462c4e4d79c75e834e51ef8ab5f65900b02ea1415ad65e65b91567d344944e89f9957e4140662b935d788ba18795c1c7d91fa22"}}]}) (async) syz_usb_connect$cdc_ecm(0x2, 0x100, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0xff, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xee, 0x1, 0x1, 0x63, 0xc0, 0x7, [{{0x9, 0x4, 0x0, 0x9, 0x3, 0x2, 0x6, 0x0, 0x2, {{0x7, 0x24, 0x6, 0x0, 0x0, "88cf"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x3, 0x6, 0x3}, [@obex={0x5, 0x24, 0x15, 0x22c0}, @mdlm={0x15}, @mbim={0xc, 0x24, 0x1b, 0x3, 0x4, 0x5, 0x7f, 0x24ba, 0x85}, @mdlm_detail={0x82, 0x24, 0x13, 0xff, "85d6c814c6289dad7c7a589a1134901346748c0919ee6aaa9a635c2235e4d910175db039b08a29092a2e2e53bc09b4887edc5beae106a7d6635e25a1ad6ca3ee873e7508c5660644acf9ca2c31c21232f4e76d3c973d910c10df3b0e5f5788d61b04aed71980525d2fb7cf1378b45f16cdd865b23032b2c7957f70f8100d"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0xb, 0x7}}], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x9, 0xe, 0x10}}, {{0x9, 0x5, 0x3, 0x2, 0x3c3, 0x2, 0x7f, 0x7}}}}}]}}]}}, &(0x7f0000000480)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x250, 0x40, 0xc, 0x40, 0xc7, 0x1}, 0x24, &(0x7f0000000280)={0x5, 0xf, 0x24, 0x2, [@ssp_cap={0x18, 0x10, 0xa, 0xe8, 0x3, 0x9, 0xf000, 0xeb, [0x1fe3fff, 0xf, 0xc0c0]}, @ext_cap={0x7, 0x10, 0x2, 0x12, 0x8, 0x8, 0x5f04}]}, 0x2, [{0x7, &(0x7f00000002c0)=@string={0x7, 0x3, "4a048180c9"}}, {0xe1, &(0x7f0000000300)=@string={0xe1, 0x3, "c6baada6c7d485bb6a4ced999852631e453ea93fde496aca4c5634355ea708d1b9811a59b15a0d9b0020169f79fe1ff1a20a576c99c06005f400a7b52f5bfa800646d37cbc3c5458779a60a7368207128975267e1008988d727d8332e79b08c0aedaad3827423396595b19df440c3a2acb27efbcf2db053bf9c8e22e2492a4ebe669c4b5da24003eb1cfe97ad027e4048e9e0d901c0a9c96e5c16f533f15bb002ad29647be7596ac3f5b67f462c4e4d79c75e834e51ef8ab5f65900b02ea1415ad65e65b91567d344944e89f9957e4140662b935d788ba18795c1c7d91fa22"}}]}) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) 379.370008ms ago: executing program 4 (id=6973): socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000340)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) getsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x20, 0x0, &(0x7f0000001040)=0x5d) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000017c00000400c2800c0001800600060065580000971b0280540211"], 0x1bbc}, 0x1, 0x0, 0x0, 0x40440d0}, 0x24048800) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000020000000000100072e6096284ca7e9dfbabb71dc0f720fed342d746ccdfed42624659eee8f70b961531bf371b238b1a1ae7a28295e4bb553cf5c427f27c01640bbc5a0bd077218bd293acf29e1973a2e75f00fbecf99d6f02cea794b7ff59be533c43e5b01768ec41a530058a4bd586dbbf23d31838387b8aa832f7c0bfa3d59275b979daa648d33dd49fb653c764dc7e290b2826b42c23040d6ddf353fdaf910a917c128280077c6bb5c2a43bf6698f5ad496500f401428279e99abced6d", @ANYRES32=r0, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000000000000200"/28], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r3, &(0x7f0000000480)="ec4b815149105c1e144e6568ef127bc6a8600a7bced9de8db56a329861928543c48ab86326c9dc740c", 0x0}, 0x20) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000280), 0x22802, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xd) epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000080)={0x40000000}) r5 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$6lowpan_control(r5, 0x0, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x204d40, 0x123) r7 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r8 = socket(0x2b, 0x1, 0xf) write(r8, &(0x7f0000000200)="240000001e005f80004000000000000003000000000000000000080008000100000000ff", 0x24) sendfile(r7, r6, 0x0, 0x4) setsockopt$ALG_SET_AEAD_AUTHSIZE(0xffffffffffffffff, 0x117, 0x5, 0x0, 0x800000000006) recvmsg$can_bcm(r6, 0x0, 0x40002000) openat$snapshot(0xffffffffffffff9c, 0x0, 0x40000, 0x19) 188.734456ms ago: executing program 6 (id=6974): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x6, 0x1, '6'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) r2 = socket$netlink(0x10, 0x3, 0x6) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff1}, {0x0, 0x9}}}, 0x24}}, 0x0) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000080)={&(0x7f00000000c0)=[{0x7fff, 0x5850, 0x1, &(0x7f0000000780)="e0"}], 0x1}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000816000001"], 0x48) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x400, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xd}, {0x4, 0x7}, {0xffff, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x48050}, 0x40004) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000b7080000000000007b8af8ff00000000b508000000000000638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r3, @ANYRES32=r4], &(0x7f00000000c0)='GPL\x00', 0x808d, 0x0, 0x0, 0x0, 0x0, '\x00', r5}, 0x94) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f00000002c0)={0x20, 0x6, 0x1, '6'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_open_dev$I2C(&(0x7f0000000100), 0x2, 0x1) (async) socket$netlink(0x10, 0x3, 0x6) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@gettclass={0x24, 0x25, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff1}, {0x0, 0x9}}}, 0x24}}, 0x0) (async) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000080)={&(0x7f00000000c0)=[{0x7fff, 0x5850, 0x1, &(0x7f0000000780)="e0"}], 0x1}) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000816000001"], 0x48) (async) socket$unix(0x1, 0x5, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x400, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xd}, {0x4, 0x7}, {0xffff, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x48050}, 0x40004) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000b7080000000000007b8af8ff00000000b508000000000000638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018240000", @ANYRES32=r3, @ANYRES32=r4], &(0x7f00000000c0)='GPL\x00', 0x808d, 0x0, 0x0, 0x0, 0x0, '\x00', r5}, 0x94) (async) 0s ago: executing program 3 (id=6975): openat$vicodec1(0xffffffffffffff9c, &(0x7f0000002280), 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000040)={0x4, {{0xa, 0x4e22, 0xe274, @loopback, 0x919}}}, 0x88) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x5502000000000000}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = socket(0x2, 0x80805, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000100)='a', 0x1}], 0x1, 0x0, 0x0, 0x44}], 0x1, 0x0) sendmmsg$inet_sctp(r2, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x40, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="300000000000000084000000010000000000000004"], 0x30}], 0x1, 0x0) sendmmsg$unix(r1, &(0x7f000000bbc0)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000001180)="dd9e41970d", 0x5}], 0x1, &(0x7f00000003c0), 0x0, 0x20000041}}], 0x1, 0xc004) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r0, &(0x7f00003a1000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000000)="9a01000000f800b8d58800000f23d00f21f8351000000d0f23f864640f79ea66baf80cb8c85f5480ef66bafc0cecc4c2adac17b9550200000f320f2860c7c4e11751df0f2e2d00000080b9800000c00f3235008000000f30", 0x58}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r9, 0x4048ae9b, &(0x7f0000000080)={0xe0003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x83, 0xffffffffefffff15, 0x3, 0x4, 0x4, 0x4]}}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2c, &(0x7f0000000000)=0x7, 0x4) ioctl$KVM_RUN(r9, 0xae80, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) kernel console output (not intermixed with test programs): ar_bhb_loop+0x60/0xb0 [ 1531.839292][T30055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1531.839309][T30055] RIP: 0033:0x7f6b4678f6c9 [ 1531.839326][T30055] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1531.839340][T30055] RSP: 002b:00007f6b475c6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1531.839359][T30055] RAX: ffffffffffffffda RBX: 00007f6b469e6090 RCX: 00007f6b4678f6c9 [ 1531.839373][T30055] RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000004 [ 1531.839384][T30055] RBP: 00007f6b475c6090 R08: 0000000000000000 R09: 0000000000000000 [ 1531.839396][T30055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1531.839407][T30055] R13: 00007f6b469e6128 R14: 00007f6b469e6090 R15: 00007f6b46b0fa28 [ 1531.839438][T30055] [ 1531.865022][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 1531.865036][ T30] audit: type=1326 audit(1762325886.328:7793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1531.865749][T27040] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 1531.872710][ T30] audit: type=1326 audit(1762325886.348:7794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1531.881028][T27040] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1531.891418][ T30] audit: type=1326 audit(1762325886.348:7795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1531.893475][T27040] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1531.897989][ T30] audit: type=1326 audit(1762325886.348:7796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1531.903686][T27040] usb 4-1: Product: syz [ 1531.909615][ T30] audit: type=1326 audit(1762325886.348:7797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1531.927234][T27040] usb 4-1: Manufacturer: syz [ 1532.211993][ T30] audit: type=1326 audit(1762325886.368:7798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1532.331526][ T30] audit: type=1326 audit(1762325886.368:7799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1532.356508][ T30] audit: type=1326 audit(1762325886.368:7800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1532.380274][ T30] audit: type=1326 audit(1762325886.368:7801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1532.433140][T30060] netlink: 'syz.7.6310': attribute type 1 has an invalid length. [ 1532.519150][ T30] audit: type=1326 audit(1762325886.368:7802): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30056 comm="syz.7.6310" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f1378f6c9 code=0x7ffc0000 [ 1532.582006][T30060] bond1: entered promiscuous mode [ 1532.588941][T30060] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1532.654671][T30045] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1532.668350][T27040] cdc_wdm 4-1:1.0: skipping garbage [ 1532.673775][T27040] cdc_wdm 4-1:1.0: skipping garbage [ 1532.679068][T27040] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1532.883046][T19404] usb 4-1: USB disconnect, device number 54 [ 1532.996394][T30072] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1533.966399][T19404] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1534.187710][T19404] usb 4-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice=31.00 [ 1534.197033][T19404] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1534.212923][T19404] usb 4-1: Product: syz [ 1534.216940][T30093] fuse: Invalid uid '00000000000000000003' [ 1534.221481][T19404] usb 4-1: Manufacturer: syz [ 1534.243293][T19404] usb 4-1: SerialNumber: syz [ 1534.269857][T19404] usb 4-1: config 0 descriptor?? [ 1534.292985][T19404] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected [ 1534.301238][T19404] usb 4-1: Detected FT4232HP [ 1534.491858][T30077] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1534.505770][T30077] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1534.520161][T19404] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 1534.744755][T19404] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1534.875994][T30103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1534.886998][T30103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1534.940694][T19404] usb 4-1: USB disconnect, device number 55 [ 1534.951204][T19404] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1534.977526][T19404] ftdi_sio 4-1:0.0: device disconnected [ 1535.088633][T30108] loop9: detected capacity change from 0 to 7 [ 1535.092917][T27040] usb 6-1: new high-speed USB device number 121 using dummy_hcd [ 1535.106209][T12145] Dev loop9: unable to read RDB block 7 [ 1535.112936][T12145] loop9: AHDI p1 p2 [ 1535.116947][T12145] loop9: partition table partially beyond EOD, truncated [ 1535.126491][T12145] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1535.140299][T30108] Dev loop9: unable to read RDB block 7 [ 1535.161793][T30108] loop9: AHDI p1 p2 [ 1535.320659][T30108] loop9: partition table partially beyond EOD, truncated [ 1535.393957][T27040] usb 6-1: Using ep0 maxpacket: 32 [ 1535.401013][T27040] usb 6-1: config 0 has an invalid interface number: 38 but max is 0 [ 1535.414344][T27040] usb 6-1: config 0 has no interface number 0 [ 1535.437017][T30108] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1535.449061][T27040] usb 6-1: config 0 interface 38 has no altsetting 0 [ 1535.507760][T27040] usb 6-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=7f.b3 [ 1535.568999][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1535.610891][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1535.731407][T27040] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1535.750899][T27040] usb 6-1: Product: syz [ 1535.762457][T27040] usb 6-1: Manufacturer: syz [ 1535.767754][T27040] usb 6-1: SerialNumber: syz [ 1535.783610][T27040] usb 6-1: config 0 descriptor?? [ 1535.794343][T27040] gspca_main: gspca_pac7302-2.14.0 probing 093a:2622 [ 1535.932671][T28022] usb 7-1: new high-speed USB device number 85 using dummy_hcd [ 1535.984640][T30117] IPVS: set_ctl: invalid protocol: 50 172.20.20.187:20001 [ 1536.185096][T28022] usb 7-1: Using ep0 maxpacket: 16 [ 1536.195116][T28022] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1536.197664][T30118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1536.211924][T28022] usb 7-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 1536.273186][T30118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1536.345581][T27040] gspca_pac7302: reg_w() failed i: 78 v: 40 error -71 [ 1536.352417][T27040] gspca_pac7302 6-1:0.38: probe with driver gspca_pac7302 failed with error -71 [ 1536.361884][T28022] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1536.378399][T27040] usb 6-1: USB disconnect, device number 121 [ 1536.395275][T28022] usb 7-1: config 0 descriptor?? [ 1536.619515][T28022] uclogic 0003:28BD:0042.0043: interface is invalid, ignoring [ 1536.655719][T30124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1536.686916][T30124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1536.754315][T30140] loop9: detected capacity change from 0 to 7 [ 1536.761348][T30140] Dev loop9: unable to read RDB block 7 [ 1536.767443][T30140] loop9: AHDI p1 p2 [ 1536.771379][T30140] loop9: partition table partially beyond EOD, truncated [ 1536.779851][T30140] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1536.809378][T28022] usb 7-1: USB disconnect, device number 85 [ 1536.870489][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1538.763341][T30181] netlink: 'syz.6.6344': attribute type 1 has an invalid length. [ 1538.773569][T30181] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1539.315980][T30188] vlan2: entered allmulticast mode [ 1539.321157][T30188] veth0_to_bond: entered allmulticast mode [ 1539.714326][T30192] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6347'. [ 1539.942686][T30196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1539.981318][T30196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1540.193884][T30198] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1540.394018][T30211] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1540.872703][T28022] usb 7-1: new high-speed USB device number 86 using dummy_hcd [ 1541.010198][T30225] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6357'. [ 1541.038852][T30225] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6357'. [ 1541.345271][T28022] usb 7-1: Using ep0 maxpacket: 16 [ 1541.356118][T28022] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1541.390185][T28022] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1541.429170][T28022] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1541.511431][T28022] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1541.529931][T28022] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1541.685471][T28022] usb 7-1: config 0 descriptor?? [ 1541.950822][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 1541.950840][ T30] audit: type=1400 audit(1762325896.428:7822): apparmor="DENIED" operation="stack" class="file" info="label not found" error=-2 profile="unconfined" name=",-" pid=30214 comm="syz.6.6354" [ 1542.184383][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.191777][T28022] microsoft 0003:045E:07DA.0044: ignoring exceeding usage max [ 1542.207531][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.217584][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.225532][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.233305][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.240591][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.248473][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.256034][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.263630][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.270897][T28022] microsoft 0003:045E:07DA.0044: unknown main item tag 0x0 [ 1542.280216][T28022] microsoft 0003:045E:07DA.0044: unsupported Resolution Multiplier 0 [ 1542.311657][T28022] microsoft 0003:045E:07DA.0044: unsupported Resolution Multiplier 0 [ 1542.333647][T28022] microsoft 0003:045E:07DA.0044: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 1542.351092][T28022] microsoft 0003:045E:07DA.0044: no inputs found [ 1542.361992][T28022] microsoft 0003:045E:07DA.0044: could not initialize ff, continuing anyway [ 1542.388081][T30231] veth0_to_team: entered promiscuous mode [ 1542.800843][T30240] syz.5.6362 (30240): drop_caches: 2 [ 1543.131889][T30247] netlink: 'syz.5.6363': attribute type 1 has an invalid length. [ 1543.562946][ T89] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 1543.641179][ T9] usb 7-1: USB disconnect, device number 86 [ 1543.717121][ T89] usb 4-1: config 252 has an invalid interface number: 107 but max is 0 [ 1543.725755][ T89] usb 4-1: config 252 has no interface number 0 [ 1543.732127][ T89] usb 4-1: config 252 interface 107 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 1543.753622][ T89] usb 4-1: config 252 interface 107 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1543.870745][ T89] usb 4-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=d7.67 [ 1543.896748][ T89] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1543.905947][T30257] tipc: Started in network mode [ 1543.910809][T30257] tipc: Node identity 5ab93e547c, cluster identity 4711 [ 1543.918000][T30257] tipc: Enabled bearer , priority 0 [ 1543.937460][T30257] tipc: Resetting bearer [ 1543.971158][ T89] usb 4-1: Product: syz [ 1543.980767][T30257] tipc: Disabling bearer [ 1543.980985][ T89] usb 4-1: Manufacturer: syz [ 1544.001570][ T89] usb 4-1: SerialNumber: syz [ 1544.857558][T30275] netlink: 'syz.4.6370': attribute type 5 has an invalid length. [ 1544.877582][T30275] binder: 30274:30275 ioctl c0306201 200000000080 returned -14 [ 1545.094942][T30276] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1545.150724][T30276] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1545.176049][T30276] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1545.202499][T30276] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1545.249886][T30280] IPv6: NLM_F_REPLACE set, but no existing node found! [ 1545.465600][T30287] tipc: Cannot configure node identity twice [ 1545.504927][T30288] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1545.571111][T30290] syzkaller0: entered promiscuous mode [ 1545.576841][T30290] syzkaller0: entered allmulticast mode [ 1545.602696][T19404] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 1545.784161][T19404] usb 6-1: config 0 has an invalid interface number: 50 but max is 0 [ 1545.808028][T19404] usb 6-1: config 0 has no interface number 0 [ 1545.829354][T19404] usb 6-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1545.835934][ T89] usb 7-1: new high-speed USB device number 87 using dummy_hcd [ 1545.856211][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.865648][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1545.895264][T19404] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1545.915677][T19404] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1545.934541][T19404] usb 6-1: Product: syz [ 1545.954064][T19404] usb 6-1: Manufacturer: syz [ 1545.966548][T19404] usb 6-1: SerialNumber: syz [ 1546.010071][T19404] usb 6-1: config 0 descriptor?? [ 1546.013579][ T89] usb 7-1: Using ep0 maxpacket: 8 [ 1546.048021][T19404] yurex 6-1:0.50: USB YUREX device now attached to Yurex #0 [ 1546.056910][ T89] usb 7-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1546.075166][ T89] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.126858][ T89] usb 7-1: Product: syz [ 1546.142473][ T89] usb 7-1: Manufacturer: syz [ 1546.159127][ T89] usb 7-1: SerialNumber: syz [ 1546.204155][ T89] usb 7-1: config 0 descriptor?? [ 1546.220513][ T89] gspca_main: sq930x-2.14.0 probing 2770:930c [ 1546.247225][T30292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1546.258341][T30292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1546.385087][ T9] usb 4-1: USB disconnect, device number 56 [ 1546.419550][T30290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1546.433328][T30290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1546.456061][T21829] usb 6-1: USB disconnect, device number 122 [ 1546.500836][T21829] yurex 6-1:0.50: USB YUREX #0 now disconnected [ 1546.508109][ T89] gspca_sq930x: reg_r 001f failed -71 [ 1546.527903][ T89] sq930x 7-1:0.0: probe with driver sq930x failed with error -71 [ 1546.587623][ T89] usb 7-1: USB disconnect, device number 87 [ 1547.229212][T30310] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6383'. [ 1547.257944][T30310] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6383'. [ 1547.282703][T30312] netlink: 'syz.6.6382': attribute type 1 has an invalid length. [ 1547.326737][T30310] ip6gretap2: entered allmulticast mode [ 1547.345049][T30312] netlink: 4268 bytes leftover after parsing attributes in process `syz.6.6382'. [ 1547.502970][T21829] usb 6-1: new high-speed USB device number 123 using dummy_hcd [ 1547.652971][ T89] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1547.706524][T21829] usb 6-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.05 [ 1547.719184][T21829] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1547.747892][T21829] usb 6-1: Product: syz [ 1547.752101][T21829] usb 6-1: Manufacturer: syz [ 1547.780252][T21829] usb 6-1: SerialNumber: syz [ 1547.828931][T21829] usb 6-1: config 0 descriptor?? [ 1547.847060][T21829] go7007 6-1:0.0: probe with driver go7007 failed with error -12 [ 1548.082157][T21829] usb 6-1: USB disconnect, device number 123 [ 1548.200438][T30327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1548.210858][T30327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1548.238843][T30327] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6385'. [ 1548.418162][T30327] bond3: option ad_actor_system: mode dependency failed, not supported in mode balance-rr(0) [ 1548.514013][T30327] bond3 (unregistering): Released all slaves [ 1549.133794][T30335] Cannot find add_set index 0 as target [ 1549.151393][T30335] netlink: 'syz.5.6387': attribute type 1 has an invalid length. [ 1549.253681][T30339] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1549.601017][T30343] fuse: Bad value for 'fd' [ 1549.837203][T30345] loop9: detected capacity change from 0 to 7 [ 1549.844879][T30345] Dev loop9: unable to read RDB block 7 [ 1549.860161][T30345] loop9: AHDI p1 p2 [ 1549.881407][T30345] loop9: partition table partially beyond EOD, truncated [ 1549.929678][T30345] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1550.498217][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1551.082662][ T9] usb 7-1: new high-speed USB device number 88 using dummy_hcd [ 1551.235399][T30361] netlink: 'syz.3.6397': attribute type 10 has an invalid length. [ 1551.258356][T30361] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1551.283896][T19404] usb 6-1: new high-speed USB device number 124 using dummy_hcd [ 1551.322754][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 1551.335889][ T9] usb 7-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1551.345325][ T9] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1551.356606][ T9] usb 7-1: Product: syz [ 1551.360769][ T9] usb 7-1: Manufacturer: syz [ 1551.367150][ T9] usb 7-1: SerialNumber: syz [ 1551.377376][ T9] usb 7-1: config 0 descriptor?? [ 1551.399569][ T9] gspca_main: se401-2.14.0 probing 047d:5003 [ 1551.458544][T19404] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1551.471696][T19404] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1551.485521][T30367] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1551.525374][T30367] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1551.539233][T19404] usb 6-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 1551.573867][T19404] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1551.623512][T19404] usb 6-1: config 0 descriptor?? [ 1551.686582][ T10] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1551.811017][T30367] netlink: 'syz.4.6398': attribute type 2 has an invalid length. [ 1551.944234][ T9] input: se401 as /devices/platform/dummy_hcd.6/usb7/7-1/input/input117 [ 1552.011559][ T9] usb 7-1: USB disconnect, device number 88 [ 1552.112365][T30379] netlink: 'syz.6.6401': attribute type 1 has an invalid length. [ 1552.120669][T30379] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1552.375844][T19404] lenovo 0003:17EF:60EE.0045: hidraw0: USB HID v0.00 Device [HID 17ef:60ee] on usb-dummy_hcd.5-1/input0 [ 1552.515491][T30387] netlink: 'syz.7.6402': attribute type 1 has an invalid length. [ 1552.541784][T30387] netlink: 4268 bytes leftover after parsing attributes in process `syz.7.6402'. [ 1552.572027][T30359] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1552.597323][T30359] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1552.613479][T19404] usb 6-1: USB disconnect, device number 124 [ 1552.925238][T30390] loop9: detected capacity change from 0 to 7 [ 1552.942371][T30390] Dev loop9: unable to read RDB block 7 [ 1552.952450][T30390] loop9: AHDI p1 p2 [ 1552.961871][T30390] loop9: partition table partially beyond EOD, truncated [ 1552.987460][T30390] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1553.120771][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1553.880836][T30405] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1553.900613][T30406] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1553.910657][T30405] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1553.968678][T30406] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1555.199670][T30420] syzkaller0: entered promiscuous mode [ 1555.208066][T30420] syzkaller0: entered allmulticast mode [ 1555.653490][T30443] loop9: detected capacity change from 0 to 7 [ 1555.654694][T11823] Dev loop9: unable to read RDB block 7 [ 1555.654721][T11823] loop9: AHDI p1 p2 [ 1555.654749][T11823] loop9: partition table partially beyond EOD, truncated [ 1555.654943][T11823] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1555.686611][T30440] Cannot find add_set index 0 as target [ 1555.686951][T30440] netlink: 'syz.3.6413': attribute type 1 has an invalid length. [ 1555.687256][T30440] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1555.689226][T30443] Dev loop9: unable to read RDB block 7 [ 1555.689255][T30443] loop9: AHDI p1 p2 [ 1555.689282][T30443] loop9: partition table partially beyond EOD, truncated [ 1555.690253][T30443] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1555.824672][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1555.858613][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1556.357687][T30459] netlink: 'syz.4.6422': attribute type 1 has an invalid length. [ 1556.383171][T30459] netlink: 4268 bytes leftover after parsing attributes in process `syz.4.6422'. [ 1556.412731][ T9] usb 7-1: new high-speed USB device number 89 using dummy_hcd [ 1556.690644][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 1556.730661][ T9] usb 7-1: config 0 has an invalid descriptor of length 158, skipping remainder of the config [ 1556.771760][ T9] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1556.859828][ T9] usb 7-1: New USB device found, idVendor=6043, idProduct=00c3, bcdDevice= 0.00 [ 1556.878821][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1556.892324][ T9] usb 7-1: config 0 descriptor?? [ 1556.905928][ T9] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 1558.090189][T30479] loop9: detected capacity change from 0 to 7 [ 1558.104275][T30479] Dev loop9: unable to read RDB block 7 [ 1558.118155][T30479] loop9: AHDI p1 p2 [ 1558.123354][T30479] loop9: partition table partially beyond EOD, truncated [ 1558.131070][T30479] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1558.172255][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1558.189017][T30482] FAULT_INJECTION: forcing a failure. [ 1558.189017][T30482] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1558.202764][T30482] CPU: 0 UID: 0 PID: 30482 Comm: syz.4.6428 Not tainted syzkaller #0 PREEMPT(full) [ 1558.202785][T30482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1558.202794][T30482] Call Trace: [ 1558.202801][T30482] [ 1558.202809][T30482] dump_stack_lvl+0x189/0x250 [ 1558.202838][T30482] ? __pfx____ratelimit+0x10/0x10 [ 1558.202868][T30482] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1558.202889][T30482] ? __pfx__printk+0x10/0x10 [ 1558.202907][T30482] ? fs_reclaim_acquire+0x7d/0x100 [ 1558.202939][T30482] should_fail_ex+0x414/0x560 [ 1558.202967][T30482] prepare_alloc_pages+0x213/0x610 [ 1558.202992][T30482] __alloc_frozen_pages_noprof+0x123/0x370 [ 1558.203012][T30482] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1558.203032][T30482] ? __pfx__copy_from_iter+0x10/0x10 [ 1558.203050][T30482] ? policy_nodemask+0x27c/0x720 [ 1558.203070][T30482] alloc_pages_mpol+0x232/0x4a0 [ 1558.203092][T30482] alloc_pages_noprof+0xa9/0x190 [ 1558.203109][T30482] anon_pipe_write+0xbf0/0x1460 [ 1558.203127][T30482] ? aa_file_perm+0x13a/0x1550 [ 1558.203165][T30482] ? __pfx_anon_pipe_write+0x10/0x10 [ 1558.203181][T30482] ? __pfx_aa_file_perm+0x10/0x10 [ 1558.203211][T30482] do_iter_readv_writev+0x623/0x8c0 [ 1558.203241][T30482] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 1558.203263][T30482] ? common_file_perm+0x1b5/0x230 [ 1558.203290][T30482] ? bpf_lsm_file_permission+0x9/0x20 [ 1558.203308][T30482] ? security_file_permission+0x75/0x290 [ 1558.203331][T30482] ? rw_verify_area+0x255/0x4d0 [ 1558.203357][T30482] vfs_writev+0x31a/0x960 [ 1558.203379][T30482] ? __lock_acquire+0xab9/0xd20 [ 1558.203398][T30482] ? __pfx_vfs_writev+0x10/0x10 [ 1558.203431][T30482] ? __fget_files+0x2a/0x420 [ 1558.203453][T30482] ? __fget_files+0x3a0/0x420 [ 1558.203468][T30482] ? __fget_files+0x2a/0x420 [ 1558.203493][T30482] do_writev+0x14d/0x2d0 [ 1558.203514][T30482] ? __pfx_do_writev+0x10/0x10 [ 1558.203536][T30482] ? do_syscall_64+0xbe/0xfa0 [ 1558.203562][T30482] do_syscall_64+0xfa/0xfa0 [ 1558.203582][T30482] ? lockdep_hardirqs_on+0x9c/0x150 [ 1558.203603][T30482] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1558.203621][T30482] ? clear_bhb_loop+0x60/0xb0 [ 1558.203641][T30482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1558.203657][T30482] RIP: 0033:0x7f453578f6c9 [ 1558.203674][T30482] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1558.203689][T30482] RSP: 002b:00007f453660b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1558.203736][T30482] RAX: ffffffffffffffda RBX: 00007f45359e6090 RCX: 00007f453578f6c9 [ 1558.203749][T30482] RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000004 [ 1558.203760][T30482] RBP: 00007f453660b090 R08: 0000000000000000 R09: 0000000000000000 [ 1558.203772][T30482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1558.203783][T30482] R13: 00007f45359e6128 R14: 00007f45359e6090 R15: 00007f4535b0fa28 [ 1558.203812][T30482] [ 1558.534313][ T10] usb 6-1: new high-speed USB device number 125 using dummy_hcd [ 1558.682986][ T10] usb 6-1: device descriptor read/64, error -71 [ 1558.820506][T30486] fuse: Bad value for 'fd' [ 1558.826817][ T30] audit: type=1326 audit(1762325913.308:7823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30485 comm="syz.7.6430" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f1378f6c9 code=0x7fc00000 [ 1558.891013][T30499] Cannot find add_set index 0 as target [ 1558.897585][T30499] netlink: 'syz.4.6434': attribute type 1 has an invalid length. [ 1558.917305][T30499] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1558.929770][ T10] usb 6-1: new high-speed USB device number 126 using dummy_hcd [ 1559.063002][ T10] usb 6-1: device descriptor read/64, error -71 [ 1559.179139][T19404] usb 7-1: USB disconnect, device number 89 [ 1559.185485][ T10] usb usb6-port1: attempt power cycle [ 1559.663266][ T10] usb 6-1: new high-speed USB device number 127 using dummy_hcd [ 1559.695072][ T10] usb 6-1: device descriptor read/8, error -71 [ 1559.803079][ T9] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 1559.863439][T19404] usb 7-1: new high-speed USB device number 90 using dummy_hcd [ 1559.877387][T30512] loop9: detected capacity change from 0 to 7 [ 1559.884712][T30512] Dev loop9: unable to read RDB block 7 [ 1559.890337][T30512] loop9: AHDI p1 p2 [ 1559.897760][T30512] loop9: partition table partially beyond EOD, truncated [ 1559.906780][T30512] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1559.952764][ T10] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1559.961906][ T9] usb 4-1: config 0 has an invalid interface number: 37 but max is 0 [ 1559.973102][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1559.973389][ T10] usb 6-1: device descriptor read/8, error -71 [ 1559.990304][ T9] usb 4-1: config 0 has no interface number 0 [ 1560.009392][ T9] usb 4-1: New USB device found, idVendor=2639, idProduct=0003, bcdDevice=fd.62 [ 1560.024472][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1560.029030][T19404] usb 7-1: Using ep0 maxpacket: 32 [ 1560.040776][ T9] usb 4-1: Product: syz [ 1560.050865][T19404] usb 7-1: config 1 has an invalid interface number: 50 but max is 0 [ 1560.059354][T19404] usb 7-1: config 1 has no interface number 0 [ 1560.060457][ T9] usb 4-1: Manufacturer: syz [ 1560.072935][ T9] usb 4-1: SerialNumber: syz [ 1560.073365][T19404] usb 7-1: config 1 interface 50 has no altsetting 0 [ 1560.102237][T19404] usb 7-1: New USB device found, idVendor=04f1, idProduct=3012, bcdDevice=b5.94 [ 1560.111708][T19404] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1560.113428][ T9] usb 4-1: config 0 descriptor?? [ 1560.125040][T19404] usb 7-1: Product: syz [ 1560.129294][T19404] usb 7-1: Manufacturer: syz [ 1560.130928][ T10] usb usb6-port1: unable to enumerate USB device [ 1560.135528][T19404] usb 7-1: SerialNumber: syz [ 1560.154417][T19404] ipaq 7-1:1.50: PocketPC PDA converter detected [ 1560.327256][T30517] FAULT_INJECTION: forcing a failure. [ 1560.327256][T30517] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1560.341989][T30517] CPU: 0 UID: 0 PID: 30517 Comm: syz.7.6441 Not tainted syzkaller #0 PREEMPT(full) [ 1560.342013][T30517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1560.342023][T30517] Call Trace: [ 1560.342031][T30517] [ 1560.342039][T30517] dump_stack_lvl+0x189/0x250 [ 1560.342068][T30517] ? __pfx____ratelimit+0x10/0x10 [ 1560.342089][T30517] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1560.342112][T30517] ? __pfx__printk+0x10/0x10 [ 1560.342130][T30517] ? __might_fault+0xb0/0x130 [ 1560.342165][T30517] should_fail_ex+0x414/0x560 [ 1560.342190][T30517] _copy_from_iter+0x1de/0x1790 [ 1560.342201][T30517] ? trace_mm_page_alloc+0x3e/0x150 [ 1560.342213][T30517] ? __alloc_frozen_pages_noprof+0x1d6/0x370 [ 1560.342227][T30517] ? __pfx__copy_from_iter+0x10/0x10 [ 1560.342241][T30517] ? policy_nodemask+0x27c/0x720 [ 1560.342264][T30517] ? page_copy_sane+0x4e/0x280 [ 1560.342286][T30517] copy_page_from_iter+0xdd/0x170 [ 1560.342310][T30517] anon_pipe_write+0x9f8/0x1460 [ 1560.342328][T30517] ? aa_file_perm+0x13a/0x1550 [ 1560.342352][T30517] ? __pfx_anon_pipe_write+0x10/0x10 [ 1560.342362][T30517] ? __pfx_aa_file_perm+0x10/0x10 [ 1560.342378][T30517] do_iter_readv_writev+0x623/0x8c0 [ 1560.342403][T30517] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 1560.342425][T30517] ? common_file_perm+0x1b5/0x230 [ 1560.342454][T30517] ? bpf_lsm_file_permission+0x9/0x20 [ 1560.342477][T30517] ? security_file_permission+0x75/0x290 [ 1560.342491][T30517] ? rw_verify_area+0x255/0x4d0 [ 1560.342505][T30517] vfs_writev+0x31a/0x960 [ 1560.342517][T30517] ? __lock_acquire+0xab9/0xd20 [ 1560.342529][T30517] ? __pfx_vfs_writev+0x10/0x10 [ 1560.342558][T30517] ? __fget_files+0x2a/0x420 [ 1560.342579][T30517] ? __fget_files+0x3a0/0x420 [ 1560.342592][T30517] ? __fget_files+0x2a/0x420 [ 1560.342616][T30517] do_writev+0x14d/0x2d0 [ 1560.342636][T30517] ? __pfx_do_writev+0x10/0x10 [ 1560.342664][T30517] ? do_syscall_64+0xbe/0xfa0 [ 1560.342690][T30517] do_syscall_64+0xfa/0xfa0 [ 1560.342710][T30517] ? lockdep_hardirqs_on+0x9c/0x150 [ 1560.342733][T30517] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1560.342750][T30517] ? clear_bhb_loop+0x60/0xb0 [ 1560.342771][T30517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1560.342787][T30517] RIP: 0033:0x7f3f1378f6c9 [ 1560.342802][T30517] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1560.342817][T30517] RSP: 002b:00007f3f119f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1560.342834][T30517] RAX: ffffffffffffffda RBX: 00007f3f139e6090 RCX: 00007f3f1378f6c9 [ 1560.342848][T30517] RDX: 0000000000000001 RSI: 0000200000000200 RDI: 0000000000000004 [ 1560.342860][T30517] RBP: 00007f3f119f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1560.342871][T30517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1560.342881][T30517] R13: 00007f3f139e6128 R14: 00007f3f139e6090 R15: 00007f3f13b0fa28 [ 1560.342909][T30517] [ 1560.360872][T19404] usb 7-1: PocketPC PDA converter now attached to ttyUSB0 [ 1560.371459][T30507] netlink: 'syz.3.6437': attribute type 1 has an invalid length. [ 1560.558500][T19404] usb 7-1: USB disconnect, device number 90 [ 1560.750613][T19404] ipaq ttyUSB0: PocketPC PDA converter now disconnected from ttyUSB0 [ 1560.781944][T28020] usb 4-1: USB disconnect, device number 59 [ 1560.794576][T19404] ipaq 7-1:1.50: device disconnected [ 1560.879225][T30523] tipc: Started in network mode [ 1560.887143][T30528] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1560.889982][T30523] tipc: Node identity 76e2481cdb07, cluster identity 4711 [ 1560.897693][T30528] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1560.907875][T30523] tipc: Enabled bearer , priority 0 [ 1561.029034][T30526] tipc: Disabling bearer [ 1561.068163][T30533] netlink: 'syz.5.6446': attribute type 1 has an invalid length. [ 1561.136362][T30533] bond9: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1561.147928][T30533] bond9: (slave vxcan1): Error -95 calling set_mac_address [ 1561.351961][T30544] Cannot find add_set index 0 as target [ 1561.386174][T30544] netlink: 'syz.7.6448': attribute type 1 has an invalid length. [ 1561.403251][T30544] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1561.447640][T19404] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1561.699067][T19404] usb 6-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1561.716613][T19404] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1561.732482][T19404] usb 6-1: Product: syz [ 1561.757882][T19404] usb 6-1: Manufacturer: syz [ 1561.764955][T19404] usb 6-1: SerialNumber: syz [ 1561.774007][T19404] usb 6-1: config 0 descriptor?? [ 1561.785044][T19404] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1561.918842][T30555] veth2: entered promiscuous mode [ 1561.924058][T30555] veth2: entered allmulticast mode [ 1561.971687][T30556] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1561.987235][T30556] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1562.831001][T30553] netlink: 88 bytes leftover after parsing attributes in process `syz.4.6451'. [ 1563.474718][T30571] netlink: 60 bytes leftover after parsing attributes in process `syz.6.6455'. [ 1563.591463][T30533] macvlan2: entered promiscuous mode [ 1563.607191][T30533] macvlan2: entered allmulticast mode [ 1563.618297][T30533] bond9: entered promiscuous mode [ 1563.833281][T30533] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1563.871790][T30533] bond9: left promiscuous mode [ 1563.913126][T19404] gspca_sunplus: reg_r err -110 [ 1563.918031][T19404] sunplus 6-1:0.0: probe with driver sunplus failed with error -110 [ 1564.016133][T30577] netlink: 'syz.4.6457': attribute type 23 has an invalid length. [ 1564.119033][ T10] usb 6-1: USB disconnect, device number 3 [ 1564.189892][T30587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1564.223298][T30587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1564.283415][T30587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1564.322919][T30587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1564.377443][T30587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1564.398665][T30587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1564.585809][T30587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1564.597061][T30593] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6461'. [ 1564.607979][T30593] openvswitch: netlink: Flow actions attr not present in new flow. [ 1564.616798][T30587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1564.650809][T30587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1564.698533][T30587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1564.813265][T30602] SET target dimension over the limit! [ 1565.707988][T30618] netlink: 'syz.6.6464': attribute type 1 has an invalid length. [ 1565.716854][T30615] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1566.496459][T30631] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6469'. [ 1567.123040][ T10] usb 7-1: new high-speed USB device number 91 using dummy_hcd [ 1567.349386][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 1567.437495][ T10] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 1567.454915][ T10] usb 7-1: config 0 has no interface number 0 [ 1567.477841][ T10] usb 7-1: config 0 interface 1 has no altsetting 0 [ 1567.502887][ T10] usb 7-1: New USB device found, idVendor=10c4, idProduct=eac1, bcdDevice=ff.7e [ 1567.513080][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1567.549849][ T10] usb 7-1: Product: syz [ 1567.593343][ T10] usb 7-1: Manufacturer: syz [ 1567.762662][ T10] usb 7-1: SerialNumber: syz [ 1567.824437][ T10] usb 7-1: config 0 descriptor?? [ 1568.054120][T30658] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1568.063762][T30658] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1568.274485][T28020] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 1568.458154][T28020] usb 4-1: Using ep0 maxpacket: 32 [ 1568.466011][T28020] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 1568.475327][T28020] usb 4-1: config 0 has no interface number 0 [ 1568.481549][T28020] usb 4-1: config 0 interface 184 has no altsetting 0 [ 1568.490650][T30660] syzkaller0: entered promiscuous mode [ 1568.496846][T30660] syzkaller0: entered allmulticast mode [ 1568.504752][T28020] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1568.516324][T28020] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1568.542333][T28020] usb 4-1: Product: syz [ 1568.546906][T28020] usb 4-1: Manufacturer: syz [ 1568.551693][T28020] usb 4-1: SerialNumber: syz [ 1568.616349][T28020] usb 4-1: config 0 descriptor?? [ 1568.643337][T28020] smsc75xx v1.0.0 [ 1569.287641][T30677] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6481'. [ 1569.474455][T30656] syzkaller0: entered promiscuous mode [ 1569.480098][T30656] syzkaller0: entered allmulticast mode [ 1569.693157][T30677] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.6481'. [ 1570.782738][T28020] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1570.829820][T28020] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1570.880173][T28020] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 1570.988814][T28020] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -71 [ 1571.086244][T28020] usb 4-1: USB disconnect, device number 60 [ 1571.123467][T30682] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 1571.131325][T30682] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1571.616919][ T10] i2c-cp2615 7-1:0.1: probe with driver i2c-cp2615 failed with error -71 [ 1571.772105][ T10] usb 7-1: USB disconnect, device number 91 [ 1572.253214][ T10] usb 7-1: new full-speed USB device number 92 using dummy_hcd [ 1572.405132][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1572.417245][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1572.430318][ T10] usb 7-1: New USB device found, idVendor=0e8f, idProduct=0003, bcdDevice= 0.00 [ 1572.440223][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1572.452252][ T10] usb 7-1: config 0 descriptor?? [ 1572.665763][T30700] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6489'. [ 1572.676000][T30700] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6489'. [ 1572.910374][ T10] hid_parser_main: 1 callbacks suppressed [ 1572.910396][ T10] pantherlord 0003:0E8F:0003.0046: unknown main item tag 0x0 [ 1572.975332][ T10] pantherlord 0003:0E8F:0003.0046: unknown main item tag 0x0 [ 1572.991395][ T10] pantherlord 0003:0E8F:0003.0046: hidraw0: USB HID v0.00 Device [HID 0e8f:0003] on usb-dummy_hcd.6-1/input0 [ 1573.003730][ T10] pantherlord 0003:0E8F:0003.0046: no output reports found [ 1573.095107][T30695] syzkaller0: entered promiscuous mode [ 1573.107723][T30695] syzkaller0: entered allmulticast mode [ 1573.115380][T30707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1573.131065][ T9] usb 7-1: USB disconnect, device number 92 [ 1573.146423][T30707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1573.187966][T30705] fido_id[30705]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 1573.941431][T30714] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1573.963800][T30714] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1574.707918][T21829] usb 7-1: new high-speed USB device number 93 using dummy_hcd [ 1574.779951][T30736] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6500'. [ 1574.946674][T21829] usb 7-1: config 0 has an invalid interface number: 37 but max is 0 [ 1574.959394][T21829] usb 7-1: config 0 has no interface number 0 [ 1574.983800][T21829] usb 7-1: New USB device found, idVendor=2639, idProduct=0003, bcdDevice=fd.62 [ 1574.993143][T21829] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1575.036058][T21829] usb 7-1: Product: syz [ 1575.052759][T19404] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1575.064866][T21829] usb 7-1: Manufacturer: syz [ 1575.077342][T21829] usb 7-1: SerialNumber: syz [ 1575.091119][T21829] usb 7-1: config 0 descriptor?? [ 1575.326068][T19404] usb 6-1: config 0 has an invalid interface number: 255 but max is 0 [ 1575.344933][T19404] usb 6-1: config 0 has no interface number 0 [ 1575.351088][T19404] usb 6-1: config 0 interface 255 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1575.371710][T30726] netlink: 'syz.6.6499': attribute type 1 has an invalid length. [ 1575.479269][T19404] usb 6-1: config 0 interface 255 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1575.552804][T19404] usb 6-1: New USB device found, idVendor=10cf, idProduct=8065, bcdDevice=91.79 [ 1575.561880][T19404] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1575.568177][T30747] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6504'. [ 1575.757533][ T9] usb 7-1: USB disconnect, device number 93 [ 1575.800790][T19404] usb 6-1: Product: syz [ 1575.827526][T19404] usb 6-1: Manufacturer: syz [ 1575.854796][T19404] usb 6-1: SerialNumber: syz [ 1575.898145][T19404] usb 6-1: config 0 descriptor?? [ 1575.930186][T19404] vmk80xx 6-1:0.255: driver 'vmk80xx' failed to auto-configure device. [ 1575.948911][T19404] vmk80xx 6-1:0.255: probe with driver vmk80xx failed with error -22 [ 1577.537029][T21829] usb 6-1: USB disconnect, device number 4 [ 1577.648507][T30773] xt_time: unknown flags 0xc [ 1577.656065][T30773] program syz.4.6510 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1578.602832][ T89] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1578.742672][ T89] usb 4-1: device descriptor read/64, error -71 [ 1578.831905][T30793] netlink: 'syz.7.6517': attribute type 3 has an invalid length. [ 1578.902744][T30793] netlink: 666 bytes leftover after parsing attributes in process `syz.7.6517'. [ 1578.982748][ T89] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 1579.153023][ T89] usb 4-1: device descriptor read/64, error -71 [ 1579.160235][T30808] syz.5.6521 (30808): attempted to duplicate a private mapping with mremap. This is not supported. [ 1579.263112][ T89] usb usb4-port1: attempt power cycle [ 1579.272716][T21829] usb 7-1: new low-speed USB device number 94 using dummy_hcd [ 1579.515944][T30807] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6520'. [ 1579.532631][T21829] usb 7-1: device descriptor read/64, error -71 [ 1579.627952][ T89] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 1579.683153][ T89] usb 4-1: device descriptor read/8, error -71 [ 1579.792798][T21829] usb 7-1: new low-speed USB device number 95 using dummy_hcd [ 1579.922700][T21829] usb 7-1: device descriptor read/64, error -71 [ 1580.016008][ T89] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 1580.043994][T21829] usb usb7-port1: attempt power cycle [ 1580.072664][ T89] usb 4-1: device descriptor read/8, error -71 [ 1580.182982][ T89] usb usb4-port1: unable to enumerate USB device [ 1580.402793][T21829] usb 7-1: new low-speed USB device number 96 using dummy_hcd [ 1580.423631][T21829] usb 7-1: device descriptor read/8, error -71 [ 1580.552728][ T89] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 1580.672688][T21829] usb 7-1: new low-speed USB device number 97 using dummy_hcd [ 1580.693152][T21829] usb 7-1: device descriptor read/8, error -71 [ 1580.704463][ T89] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 1580.717894][ T89] usb 6-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1580.730579][ T89] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1580.748807][ T89] usb 6-1: config 0 descriptor?? [ 1580.754592][T30820] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 1580.803219][T21829] usb usb7-port1: unable to enumerate USB device [ 1581.175377][ T89] elan 0003:04F3:0755.0047: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.5-1/input0 [ 1581.529365][T30825] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1581.560636][T30825] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1582.693759][ T89] usb 6-1: reset full-speed USB device number 5 using dummy_hcd [ 1582.741459][T30838] netlink: 'syz.6.6529': attribute type 23 has an invalid length. [ 1583.592976][ T10] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1583.689746][T30851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1583.740115][T30851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1583.748270][ T10] usb 4-1: device descriptor read/64, error -71 [ 1583.776307][T30849] netlink: 16 bytes leftover after parsing attributes in process `syz.6.6531'. [ 1583.858574][T30853] netlink: 20 bytes leftover after parsing attributes in process `syz.7.6527'. [ 1583.943746][T27040] usb 6-1: USB disconnect, device number 5 [ 1584.000442][ T10] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1584.142755][ T10] usb 4-1: device descriptor read/64, error -71 [ 1584.267198][ T10] usb usb4-port1: attempt power cycle [ 1584.352682][T27040] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1584.410260][T30866] netlink: 'syz.6.6536': attribute type 10 has an invalid length. [ 1584.489351][T30866] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 1584.529672][T30866] team0: Failed to send options change via netlink (err -105) [ 1584.551986][T27040] usb 6-1: Using ep0 maxpacket: 8 [ 1584.552680][T30866] team0: Port device netdevsim0 added [ 1584.642998][ T10] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1584.707473][T27040] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1584.747549][ T10] usb 4-1: device descriptor read/8, error -71 [ 1584.770957][T27040] usb 6-1: config 4 interface 0 has no altsetting 0 [ 1584.795055][T27040] usb 6-1: string descriptor 0 read error: -22 [ 1584.801362][T27040] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1584.833870][T27040] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1584.939339][T27040] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1584.953851][T30869] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 1585.008499][ T10] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 1585.043399][ T10] usb 4-1: device descriptor read/8, error -71 [ 1585.134792][T27040] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1585.151920][T27040] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1585.160472][ T10] usb usb4-port1: unable to enumerate USB device [ 1585.167831][T27040] usb 6-1: media controller created [ 1585.376181][T30871] loop9: detected capacity change from 0 to 7 [ 1585.398462][T27040] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1585.407469][T30871] Dev loop9: unable to read RDB block 7 [ 1585.422173][T30871] loop9: AHDI p1 p2 [ 1585.449357][T30871] loop9: partition table partially beyond EOD, truncated [ 1585.466104][T30871] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1585.740036][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1586.574488][T27040] zl10353_read_register: readreg error (reg=127, ret==0) [ 1586.836531][T28020] usb 6-1: USB disconnect, device number 6 [ 1587.201866][T30896] input: syz1 as /devices/virtual/input/input118 [ 1587.446769][T30905] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 1587.463149][T30905] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1587.476266][T30896] netlink: 52 bytes leftover after parsing attributes in process `syz.5.6542'. [ 1587.783860][T30911] program syz.3.6546 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1587.896854][T30913] netlink: 'syz.3.6546': attribute type 10 has an invalid length. [ 1587.905656][T30913] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6546'. [ 1588.271465][T30915] FAULT_INJECTION: forcing a failure. [ 1588.271465][T30915] name failslab, interval 1, probability 0, space 0, times 0 [ 1588.284249][T30915] CPU: 0 UID: 0 PID: 30915 Comm: syz.6.6547 Not tainted syzkaller #0 PREEMPT(full) [ 1588.284264][T30915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1588.284271][T30915] Call Trace: [ 1588.284277][T30915] [ 1588.284282][T30915] dump_stack_lvl+0x189/0x250 [ 1588.284300][T30915] ? __pfx____ratelimit+0x10/0x10 [ 1588.284313][T30915] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1588.284325][T30915] ? __pfx__printk+0x10/0x10 [ 1588.284342][T30915] should_fail_ex+0x414/0x560 [ 1588.284360][T30915] should_failslab+0xa8/0x100 [ 1588.284371][T30915] kmem_cache_alloc_noprof+0x74/0x6e0 [ 1588.284385][T30915] ? __send_signal_locked+0x22a/0xeb0 [ 1588.284398][T30915] ? sig_get_ucounts+0x26/0x450 [ 1588.284406][T30915] ? sig_get_ucounts+0x3e4/0x450 [ 1588.284417][T30915] __send_signal_locked+0x22a/0xeb0 [ 1588.284434][T30915] send_sig+0x88/0xf0 [ 1588.284448][T30915] sk_stream_error+0xa9/0x120 [ 1588.284462][T30915] tcp_sendmsg_locked+0x4ea5/0x5540 [ 1588.284488][T30915] ? look_up_lock_class+0x74/0x170 [ 1588.284502][T30915] ? register_lock_class+0x51/0x320 [ 1588.284515][T30915] ? __lock_acquire+0xab9/0xd20 [ 1588.284530][T30915] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 1588.284542][T30915] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1588.284556][T30915] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1588.284572][T30915] tcp_sendmsg+0x2f/0x50 [ 1588.284586][T30915] __sock_sendmsg+0xe5/0x270 [ 1588.284600][T30915] ____sys_sendmsg+0x52d/0x830 [ 1588.284613][T30915] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1588.284628][T30915] ? import_iovec+0x74/0xa0 [ 1588.284642][T30915] ___sys_sendmsg+0x21f/0x2a0 [ 1588.284653][T30915] ? __pfx____sys_sendmsg+0x10/0x10 [ 1588.284666][T30915] ? __lock_acquire+0xab9/0xd20 [ 1588.284690][T30915] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 1588.284707][T30915] __sys_sendmmsg+0x227/0x430 [ 1588.284720][T30915] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1588.284729][T30915] ? lockdep_hardirqs_on+0x9c/0x150 [ 1588.284755][T30915] ? ksys_write+0x1e1/0x250 [ 1588.284769][T30915] ? __pfx_ksys_write+0x10/0x10 [ 1588.284784][T30915] __x64_sys_sendmmsg+0xa0/0xc0 [ 1588.284796][T30915] do_syscall_64+0xfa/0xfa0 [ 1588.284808][T30915] ? lockdep_hardirqs_on+0x9c/0x150 [ 1588.284820][T30915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1588.284830][T30915] ? clear_bhb_loop+0x60/0xb0 [ 1588.284841][T30915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1588.284851][T30915] RIP: 0033:0x7faefdb8f6c9 [ 1588.284861][T30915] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1588.284870][T30915] RSP: 002b:00007faefea1a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1588.284882][T30915] RAX: ffffffffffffffda RBX: 00007faefdde5fa0 RCX: 00007faefdb8f6c9 [ 1588.284889][T30915] RDX: 0000000000000001 RSI: 0000200000003c00 RDI: 0000000000000003 [ 1588.284896][T30915] RBP: 00007faefea1a090 R08: 0000000000000000 R09: 0000000000000000 [ 1588.284902][T30915] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 1588.284908][T30915] R13: 00007faefdde6038 R14: 00007faefdde5fa0 R15: 00007faefdf0fa28 [ 1588.284924][T30915] [ 1589.043579][T30921] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6549'. [ 1590.146059][T30935] FAULT_INJECTION: forcing a failure. [ 1590.146059][T30935] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1590.160132][T30935] CPU: 0 UID: 0 PID: 30935 Comm: syz.3.6552 Not tainted syzkaller #0 PREEMPT(full) [ 1590.160155][T30935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1590.160166][T30935] Call Trace: [ 1590.160173][T30935] [ 1590.160181][T30935] dump_stack_lvl+0x189/0x250 [ 1590.160206][T30935] ? __pfx____ratelimit+0x10/0x10 [ 1590.160227][T30935] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1590.160247][T30935] ? __pfx__printk+0x10/0x10 [ 1590.160264][T30935] ? __might_fault+0xb0/0x130 [ 1590.160298][T30935] should_fail_ex+0x414/0x560 [ 1590.160314][T30935] ? __pfx_do_set_msr+0x10/0x10 [ 1590.160325][T30935] _copy_from_user+0x2d/0xb0 [ 1590.160338][T30935] msr_io+0xa2/0x570 [ 1590.160351][T30935] ? kvm_arch_vcpu_ioctl+0x6e9/0x2b40 [ 1590.160362][T30935] ? __pfx_msr_io+0x10/0x10 [ 1590.160377][T30935] kvm_arch_vcpu_ioctl+0x723/0x2b40 [ 1590.160388][T30935] ? kvm_arch_vcpu_ioctl+0x6e9/0x2b40 [ 1590.160401][T30935] ? __pfx_kvm_arch_vcpu_ioctl+0x10/0x10 [ 1590.160412][T30935] ? __lock_acquire+0xab9/0xd20 [ 1590.160433][T30935] ? is_bpf_text_address+0x26/0x2b0 [ 1590.160447][T30935] ? is_bpf_text_address+0x292/0x2b0 [ 1590.160457][T30935] ? is_bpf_text_address+0x26/0x2b0 [ 1590.160469][T30935] ? kernel_text_address+0xa5/0xe0 [ 1590.160483][T30935] ? __kernel_text_address+0xd/0x40 [ 1590.160496][T30935] ? unwind_get_return_address+0x4d/0x90 [ 1590.160508][T30935] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1590.160521][T30935] ? arch_stack_walk+0xfc/0x150 [ 1590.160541][T30935] ? __pfx_stack_trace_save+0x10/0x10 [ 1590.160554][T30935] ? stack_depot_save_flags+0x40/0x860 [ 1590.160578][T30935] ? __lock_acquire+0xab9/0xd20 [ 1590.160592][T30935] ? __mutex_trylock_common+0x153/0x260 [ 1590.160605][T30935] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1590.160620][T30935] ? rcu_is_watching+0x15/0xb0 [ 1590.160632][T30935] ? trace_contention_end+0x39/0x120 [ 1590.160643][T30935] ? __mutex_lock+0x335/0x1350 [ 1590.160660][T30935] ? kasan_quarantine_put+0xdd/0x220 [ 1590.160673][T30935] ? lockdep_hardirqs_on+0x9c/0x150 [ 1590.160699][T30935] ? kvm_vcpu_ioctl+0x22e/0xe90 [ 1590.160715][T30935] ? __pfx___mutex_lock+0x10/0x10 [ 1590.160727][T30935] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1590.160743][T30935] ? do_vfs_ioctl+0xbe8/0x1430 [ 1590.160754][T30935] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1590.160767][T30935] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1590.160781][T30935] kvm_vcpu_ioctl+0x74d/0xe90 [ 1590.160797][T30935] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1590.160822][T30935] ? __fget_files+0x2a/0x420 [ 1590.160833][T30935] ? __fget_files+0x3a0/0x420 [ 1590.160842][T30935] ? __fget_files+0x2a/0x420 [ 1590.160852][T30935] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1590.160863][T30935] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1590.160876][T30935] __se_sys_ioctl+0xfc/0x170 [ 1590.160894][T30935] do_syscall_64+0xfa/0xfa0 [ 1590.160907][T30935] ? lockdep_hardirqs_on+0x9c/0x150 [ 1590.160919][T30935] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1590.160929][T30935] ? clear_bhb_loop+0x60/0xb0 [ 1590.160940][T30935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1590.160950][T30935] RIP: 0033:0x7f6d0ff8f6c9 [ 1590.160961][T30935] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1590.160969][T30935] RSP: 002b:00007f6d10e41038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1590.160981][T30935] RAX: ffffffffffffffda RBX: 00007f6d101e5fa0 RCX: 00007f6d0ff8f6c9 [ 1590.160989][T30935] RDX: 00002000000004c0 RSI: 000000004008ae89 RDI: 0000000000000005 [ 1590.160995][T30935] RBP: 00007f6d10e41090 R08: 0000000000000000 R09: 0000000000000000 [ 1590.161002][T30935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1590.161008][T30935] R13: 00007f6d101e6038 R14: 00007f6d101e5fa0 R15: 00007f6d1030fa28 [ 1590.161025][T30935] [ 1591.222775][ T10] usb 4-1: new full-speed USB device number 69 using dummy_hcd [ 1591.375181][ T10] usb 4-1: config 0 has an invalid interface number: 128 but max is 0 [ 1591.383942][ T10] usb 4-1: config 0 has no interface number 0 [ 1591.393730][T30951] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6557'. [ 1591.440308][T30951] netlink: 212368 bytes leftover after parsing attributes in process `syz.6.6557'. [ 1591.492814][ T10] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1591.506787][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1591.526471][ T10] usb 4-1: Product: syz [ 1591.545921][ T10] usb 4-1: Manufacturer: syz [ 1591.550744][ T10] usb 4-1: SerialNumber: syz [ 1591.613944][ T10] usb 4-1: config 0 descriptor?? [ 1591.678213][T30954] netlink: 'syz.4.6558': attribute type 1 has an invalid length. [ 1591.694769][T30954] netlink: 4268 bytes leftover after parsing attributes in process `syz.4.6558'. [ 1592.091084][ T10] usb 4-1: Firmware: major: 165, minor: 244, hardware type: UNKNOWN (159) [ 1592.292311][ T10] usb 4-1: failed to fetch extended address, random address set [ 1592.302529][ T10] usb 4-1: atusb_probe: initialization failed, error = -524 [ 1592.310498][ T10] atusb 4-1:0.128: probe with driver atusb failed with error -524 [ 1592.587037][ T10] usb 4-1: USB disconnect, device number 69 [ 1592.883040][T28022] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 1593.056178][T28022] usb 6-1: config 252 has an invalid interface number: 107 but max is 0 [ 1593.065195][T28022] usb 6-1: config 252 has no interface number 0 [ 1593.076005][T28022] usb 6-1: config 252 interface 107 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 1593.099279][T28022] usb 6-1: config 252 interface 107 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1593.118046][T28022] usb 6-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=d7.67 [ 1593.127542][T28022] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1593.148580][T28022] usb 6-1: Product: syz [ 1593.155261][T28022] usb 6-1: Manufacturer: syz [ 1593.160694][T28022] usb 6-1: SerialNumber: syz [ 1593.283824][T30969] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 1594.784389][T30995] netlink: 'syz.3.6571': attribute type 1 has an invalid length. [ 1594.795012][T30995] netlink: 4268 bytes leftover after parsing attributes in process `syz.3.6571'. [ 1595.044950][T30998] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1595.064164][T30999] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1595.065347][T30998] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1595.088665][T30999] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1596.269734][ T5910] usb 6-1: USB disconnect, device number 7 [ 1596.927086][ T5910] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1597.095299][ T5910] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1597.107701][ T5910] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1597.133397][ T5910] usb 6-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 1597.142993][ T5910] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1597.156077][ T5910] usb 6-1: config 0 descriptor?? [ 1597.445673][T31033] bridge0: entered allmulticast mode [ 1597.451684][T31033] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6581'. [ 1597.488868][T31033] bridge_slave_1: left allmulticast mode [ 1597.503068][T31033] bridge_slave_1: left promiscuous mode [ 1597.510305][T31033] bridge0: port 2(bridge_slave_1) entered disabled state [ 1597.531626][T31033] bridge_slave_0: left allmulticast mode [ 1597.537965][T31033] bridge_slave_0: left promiscuous mode [ 1597.544630][T31033] bridge0: port 1(bridge_slave_0) entered disabled state [ 1597.683181][T31033] bridge0 (unregistering): left allmulticast mode [ 1597.708832][T31038] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1597.719640][T31038] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1597.753744][ T5910] arvo 0003:1E7D:30D4.0048: unbalanced collection at end of report description [ 1597.784435][ T5910] arvo 0003:1E7D:30D4.0048: parse failed [ 1597.800016][ T5910] arvo 0003:1E7D:30D4.0048: probe with driver arvo failed with error -22 [ 1597.953026][ T5910] usb 6-1: USB disconnect, device number 8 [ 1598.270396][T31048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1598.279552][T31048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1598.466110][T31052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1598.475343][T31052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1599.070602][T27040] usb 6-1: new full-speed USB device number 9 using dummy_hcd [ 1599.250904][T27040] usb 6-1: config 252 has an invalid interface number: 107 but max is 0 [ 1599.260848][T27040] usb 6-1: config 252 has no interface number 0 [ 1599.330755][T27040] usb 6-1: config 252 interface 107 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 1599.381113][T27040] usb 6-1: config 252 interface 107 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 1599.419266][T27040] usb 6-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=d7.67 [ 1599.428702][T27040] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1599.436862][T27040] usb 6-1: Product: syz [ 1599.441052][T27040] usb 6-1: Manufacturer: syz [ 1599.459586][T27040] usb 6-1: SerialNumber: syz [ 1599.975531][T31087] loop9: detected capacity change from 0 to 7 [ 1600.097669][T12145] Dev loop9: unable to read RDB block 7 [ 1600.108461][T12145] loop9: AHDI p1 p2 [ 1600.112444][T12145] loop9: partition table partially beyond EOD, truncated [ 1600.139990][T12145] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1600.181975][T31087] Dev loop9: unable to read RDB block 7 [ 1600.188182][T31087] loop9: AHDI p1 p2 [ 1600.192256][T31087] loop9: partition table partially beyond EOD, truncated [ 1600.200142][T31087] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1600.363839][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1600.430519][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1601.713606][T27040] usb 7-1: new full-speed USB device number 98 using dummy_hcd [ 1601.905779][T27040] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1601.933018][T27040] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1601.941931][T27040] usb 7-1: config 1 has no interface number 0 [ 1601.988148][ T5910] usb 6-1: USB disconnect, device number 9 [ 1601.997145][T27040] usb 7-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1602.197605][T27040] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1602.208117][T27040] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.248234][T27040] usb 7-1: Product: syz [ 1602.253701][T27040] usb 7-1: Manufacturer: syz [ 1602.267905][T27040] usb 7-1: SerialNumber: syz [ 1602.277376][T31113] netlink: 64 bytes leftover after parsing attributes in process `syz.7.6602'. [ 1602.314279][T27040] cdc_ncm 7-1:1.1: NCM or ECM functional descriptors missing [ 1602.474776][T31115] input: syz0 as /devices/virtual/input/input121 [ 1602.508336][T27040] cdc_ncm 7-1:1.1: bind() failure [ 1602.637865][T21829] usb 7-1: USB disconnect, device number 98 [ 1603.525803][T31129] loop9: detected capacity change from 0 to 7 [ 1603.556814][T31129] Dev loop9: unable to read RDB block 7 [ 1603.593811][T31129] loop9: AHDI p1 p2 [ 1603.597753][T31129] loop9: partition table partially beyond EOD, truncated [ 1603.614396][T31129] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1603.669690][T31131] input: syz1 as /devices/virtual/input/input122 [ 1603.690495][T31131] binder: BINDER_SET_CONTEXT_MGR already set [ 1603.696940][T31131] binder: 31126:31131 ioctl 4018620d 200000000040 returned -16 [ 1603.738474][T31131] binder: 31126:31131 ioctl c0306201 0 returned -14 [ 1603.775084][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1603.820447][T31131] syz.4.6607 (31131): drop_caches: 2 [ 1604.232694][ T5910] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1604.262734][T21829] usb 7-1: new high-speed USB device number 99 using dummy_hcd [ 1604.415298][ T5910] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1604.426313][ T5910] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1604.502829][T21829] usb 7-1: device descriptor read/64, error -71 [ 1604.522856][ T5910] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1604.562631][ T5910] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1604.635628][ T5910] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1604.644911][ T5910] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1604.654517][ T5910] usb 6-1: Manufacturer: syz [ 1604.683551][ T5910] usb 6-1: config 0 descriptor?? [ 1604.742953][T21829] usb 7-1: new high-speed USB device number 100 using dummy_hcd [ 1604.872644][T21829] usb 7-1: device descriptor read/64, error -71 [ 1604.983470][T21829] usb usb7-port1: attempt power cycle [ 1605.085052][T31154] FAULT_INJECTION: forcing a failure. [ 1605.085052][T31154] name failslab, interval 1, probability 0, space 0, times 0 [ 1605.097924][T31154] CPU: 1 UID: 0 PID: 31154 Comm: syz.3.6617 Not tainted syzkaller #0 PREEMPT(full) [ 1605.097947][T31154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1605.097957][T31154] Call Trace: [ 1605.097966][T31154] [ 1605.097975][T31154] dump_stack_lvl+0x189/0x250 [ 1605.098003][T31154] ? __pfx____ratelimit+0x10/0x10 [ 1605.098026][T31154] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1605.098049][T31154] ? __pfx__printk+0x10/0x10 [ 1605.098071][T31154] ? __pfx___might_resched+0x10/0x10 [ 1605.098085][T31154] should_fail_ex+0x414/0x560 [ 1605.098103][T31154] should_failslab+0xa8/0x100 [ 1605.098115][T31154] __kmalloc_noprof+0xcb/0x7f0 [ 1605.098133][T31154] ? kfree+0x4d/0x6d0 [ 1605.098150][T31154] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1605.098182][T31154] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1605.098209][T31154] ? tomoyo_domain+0xd9/0x130 [ 1605.098226][T31154] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1605.098239][T31154] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1605.098252][T31154] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1605.098290][T31154] ? __fget_files+0x2a/0x420 [ 1605.098312][T31154] ? __fget_files+0x3a0/0x420 [ 1605.098328][T31154] ? __fget_files+0x2a/0x420 [ 1605.098349][T31154] security_file_ioctl+0xcb/0x2d0 [ 1605.098371][T31154] __se_sys_ioctl+0x47/0x170 [ 1605.098386][T31154] do_syscall_64+0xfa/0xfa0 [ 1605.098398][T31154] ? lockdep_hardirqs_on+0x9c/0x150 [ 1605.098418][T31154] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1605.098428][T31154] ? clear_bhb_loop+0x60/0xb0 [ 1605.098450][T31154] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1605.098467][T31154] RIP: 0033:0x7f6d0ff8f6c9 [ 1605.098484][T31154] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1605.098499][T31154] RSP: 002b:00007f6d10e41038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1605.098518][T31154] RAX: ffffffffffffffda RBX: 00007f6d101e5fa0 RCX: 00007f6d0ff8f6c9 [ 1605.098527][T31154] RDX: ffffffffffffffff RSI: 000000008040451a RDI: 0000000000000004 [ 1605.098534][T31154] RBP: 00007f6d10e41090 R08: 0000000000000000 R09: 0000000000000000 [ 1605.098540][T31154] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1605.098545][T31154] R13: 00007f6d101e6038 R14: 00007f6d101e5fa0 R15: 00007f6d1030fa28 [ 1605.098562][T31154] [ 1605.098567][T31154] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1605.402744][T21829] usb 7-1: new high-speed USB device number 101 using dummy_hcd [ 1605.423346][T21829] usb 7-1: device descriptor read/8, error -71 [ 1605.662816][T21829] usb 7-1: new high-speed USB device number 102 using dummy_hcd [ 1605.693455][T21829] usb 7-1: device descriptor read/8, error -71 [ 1605.803068][T21829] usb usb7-port1: unable to enumerate USB device [ 1606.147458][T31165] Cannot find add_set index 0 as target [ 1606.154710][T31165] netlink: 'syz.3.6619': attribute type 1 has an invalid length. [ 1606.164683][T31165] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1606.980235][ T5910] usbhid 6-1:0.0: can't add hid device: -71 [ 1606.986613][ T5910] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1606.996424][ T5910] usb 6-1: USB disconnect, device number 10 [ 1607.394661][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.402422][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.879122][T31178] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6621'. [ 1608.841889][T31201] netlink: 'syz.4.6628': attribute type 1 has an invalid length. [ 1608.861849][T31201] netlink: 4268 bytes leftover after parsing attributes in process `syz.4.6628'. [ 1609.462674][T24132] Bluetooth: hci2: command 0x0406 tx timeout [ 1611.336044][T31231] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6635'. [ 1611.802788][ T10] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1611.958159][ T10] usb 4-1: config 0 has an invalid interface number: 37 but max is 0 [ 1611.968439][ T10] usb 4-1: config 0 has no interface number 0 [ 1612.044458][ T10] usb 4-1: New USB device found, idVendor=2639, idProduct=0003, bcdDevice=fd.62 [ 1612.054490][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1612.092256][ T10] usb 4-1: Product: syz [ 1612.096885][ T10] usb 4-1: Manufacturer: syz [ 1612.102376][ T10] usb 4-1: SerialNumber: syz [ 1612.143212][ T10] usb 4-1: config 0 descriptor?? [ 1612.679978][T28020] usb 4-1: USB disconnect, device number 70 [ 1613.530598][T31276] netlink: 'syz.5.6649': attribute type 1 has an invalid length. [ 1613.620900][T31276] netlink: 4268 bytes leftover after parsing attributes in process `syz.5.6649'. [ 1613.721506][T31284] fuse: Bad value for 'rootmode' [ 1615.721181][T31305] ip_vti0: entered promiscuous mode [ 1615.735717][T31305] ip_vti0: entered allmulticast mode [ 1615.842772][ T89] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1616.000681][ T89] usb 6-1: config 0 has an invalid interface number: 37 but max is 0 [ 1616.013372][ T89] usb 6-1: config 0 has no interface number 0 [ 1616.034591][ T89] usb 6-1: New USB device found, idVendor=2639, idProduct=0003, bcdDevice=fd.62 [ 1616.045692][ T89] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1616.080420][ T89] usb 6-1: Product: syz [ 1616.096107][ T89] usb 6-1: Manufacturer: syz [ 1616.113864][ T89] usb 6-1: SerialNumber: syz [ 1616.140826][ T89] usb 6-1: config 0 descriptor?? [ 1616.306400][T31315] fuse: Bad value for 'rootmode' [ 1616.470938][T31321] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1616.484148][T31321] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1616.540249][ T89] usb 6-1: USB disconnect, device number 11 [ 1616.729515][T31323] netlink: 'syz.6.6666': attribute type 1 has an invalid length. [ 1616.741442][T31323] netlink: 4268 bytes leftover after parsing attributes in process `syz.6.6666'. [ 1617.304445][T31331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1617.325174][T31331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1617.923846][T31334] netlink: 6 bytes leftover after parsing attributes in process `syz.4.6669'. [ 1617.935754][T31334] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1619.332831][T21829] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1619.493137][T21829] usb 4-1: Using ep0 maxpacket: 16 [ 1619.559276][T21829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1619.598939][T21829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1619.616137][T21829] usb 4-1: New USB device found, idVendor=06a3, idProduct=0621, bcdDevice= 0.00 [ 1619.630583][T21829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1619.651920][T21829] usb 4-1: config 0 descriptor?? [ 1620.115058][T21829] saitek 0003:06A3:0621.0049: item fetching failed at offset 4/5 [ 1620.192502][T21829] saitek 0003:06A3:0621.0049: parse failed [ 1620.201015][T21829] saitek 0003:06A3:0621.0049: probe with driver saitek failed with error -22 [ 1620.452680][ T89] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1620.609672][ T89] usb 6-1: config 0 has an invalid interface number: 37 but max is 0 [ 1620.617917][ T89] usb 6-1: config 0 has no interface number 0 [ 1620.627516][ T89] usb 6-1: New USB device found, idVendor=2639, idProduct=0003, bcdDevice=fd.62 [ 1620.636737][ T89] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1620.644966][ T89] usb 6-1: Product: syz [ 1620.652048][ T89] usb 6-1: Manufacturer: syz [ 1620.732803][ T89] usb 6-1: SerialNumber: syz [ 1620.758726][ T89] usb 6-1: config 0 descriptor?? [ 1621.272380][T31380] fuse: Bad value for 'fd' [ 1621.535118][ T89] usb 6-1: USB disconnect, device number 12 [ 1622.453135][T21829] usb 4-1: USB disconnect, device number 71 [ 1623.827774][ T30] audit: type=1326 audit(1762325978.268:7824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6b4678f6c9 code=0x0 [ 1623.843651][T31402] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6685'. [ 1623.928320][ T30] audit: type=1326 audit(1762325978.398:7825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.000646][ T30] audit: type=1326 audit(1762325978.478:7826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.082630][ T30] audit: type=1326 audit(1762325978.488:7827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.194083][ T30] audit: type=1326 audit(1762325978.488:7828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.242771][ T30] audit: type=1326 audit(1762325978.608:7829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=68 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.331408][ T30] audit: type=1326 audit(1762325978.608:7830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.424835][ T30] audit: type=1326 audit(1762325978.608:7831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.505823][ T30] audit: type=1326 audit(1762325978.618:7832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.597660][ T30] audit: type=1326 audit(1762325978.618:7833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31391 comm="syz.5.6685" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b4678f6c9 code=0x7ffc0000 [ 1624.680843][T31433] netlink: 8 bytes leftover after parsing attributes in process `syz.7.6695'. [ 1625.007603][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805c4bf800: rx timeout, send abort [ 1625.016370][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805c4be000: rx timeout, send abort [ 1625.027269][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805c4bf800: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 1625.041678][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805c4be000: 0x00000: (3) A timeout occurred and this is the connection abort to close the session. [ 1625.130060][T31445] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1625.152779][T31446] netlink: 12 bytes leftover after parsing attributes in process `syz.6.6697'. [ 1625.192534][T31445] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1625.203009][T31446] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6697'. [ 1625.246448][T31446] IPv6: sit1: Disabled Multicast RS [ 1625.427913][T31448] netlink: 'syz.3.6700': attribute type 1 has an invalid length. [ 1625.435947][T31448] netlink: 4268 bytes leftover after parsing attributes in process `syz.3.6700'. [ 1626.316195][T31457] netlink: 60 bytes leftover after parsing attributes in process `syz.5.6702'. [ 1626.332680][T31457] netlink: 'syz.5.6702': attribute type 11 has an invalid length. [ 1626.632497][T31459] netlink: 232 bytes leftover after parsing attributes in process `syz.4.6703'. [ 1627.573743][T31471] random: crng reseeded on system resumption [ 1627.764190][ T89] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1628.036835][ T89] usb 4-1: config 0 has no interfaces? [ 1628.079066][ T89] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1628.116106][ T89] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1628.157682][ T89] usb 4-1: Product: syz [ 1628.167651][ T89] usb 4-1: Manufacturer: syz [ 1628.202634][ T89] usb 4-1: SerialNumber: syz [ 1628.225985][ T89] usb 4-1: config 0 descriptor?? [ 1628.583753][T27040] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 1628.744280][T27040] usb 6-1: config 0 has an invalid interface number: 9 but max is 0 [ 1628.758554][T27040] usb 6-1: config 0 has no interface number 0 [ 1628.779294][T27040] usb 6-1: New USB device found, idVendor=040a, idProduct=0002, bcdDevice=51.8f [ 1628.791330][T27040] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1628.813546][T27040] usb 6-1: Product: syz [ 1628.822913][T27040] usb 6-1: Manufacturer: syz [ 1628.835870][T27040] usb 6-1: SerialNumber: syz [ 1628.852968][T27040] usb 6-1: config 0 descriptor?? [ 1629.064412][T27040] gspca_main: spca501-2.14.0 probing 040a:0002 [ 1629.567653][T31511] netlink: 'syz.4.6720': attribute type 4 has an invalid length. [ 1629.579120][T31511] netlink: 17 bytes leftover after parsing attributes in process `syz.4.6720'. [ 1629.657645][T31516] xt_l2tp: v2 sid > 0xffff: 1114122 [ 1630.137996][T27040] gspca_spca501: reg write: error -71 [ 1630.144028][T27040] spca501 6-1:0.9: Reg write failed for 0x00,0x00,0x05 [ 1630.159714][T27040] spca501 6-1:0.9: probe with driver spca501 failed with error -22 [ 1630.212704][T21829] usb 7-1: new high-speed USB device number 103 using dummy_hcd [ 1630.316625][T27040] usb 6-1: USB disconnect, device number 13 [ 1630.372761][T21829] usb 7-1: Using ep0 maxpacket: 16 [ 1630.380408][T21829] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1630.396948][T21829] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1630.408514][T21829] usb 7-1: New USB device found, idVendor=06a3, idProduct=0621, bcdDevice= 0.00 [ 1630.541454][ T10] usb 4-1: USB disconnect, device number 72 [ 1630.554637][T21829] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1630.639706][T21829] usb 7-1: config 0 descriptor?? [ 1631.369520][T21829] saitek 0003:06A3:0621.004A: item fetching failed at offset 4/5 [ 1631.404969][T31537] loop9: detected capacity change from 0 to 7 [ 1631.417599][T21829] saitek 0003:06A3:0621.004A: parse failed [ 1631.429917][T31537] Dev loop9: unable to read RDB block 7 [ 1631.444984][T21829] saitek 0003:06A3:0621.004A: probe with driver saitek failed with error -22 [ 1631.454809][T31537] loop9: AHDI p1 p2 [ 1631.471893][T31537] loop9: partition table partially beyond EOD, truncated [ 1631.490824][T31537] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1631.761386][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1632.253590][T31547] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1633.045010][T19404] usb 7-1: USB disconnect, device number 103 [ 1633.210391][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 1633.210409][ T30] audit: type=1326 audit(1762325987.688:7849): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1633.332306][ T30] audit: type=1326 audit(1762325987.688:7850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1633.362738][ T30] audit: type=1326 audit(1762325987.688:7851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=7 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1633.581658][ C0] vkms_vblank_simulate: vblank timer overrun [ 1633.606283][T31559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1633.615455][T31559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1633.624657][ T30] audit: type=1326 audit(1762325987.728:7852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1633.647066][ C0] vkms_vblank_simulate: vblank timer overrun [ 1633.663920][ T30] audit: type=1326 audit(1762325987.728:7853): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1633.746523][ T30] audit: type=1326 audit(1762325987.728:7854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1633.900791][ T30] audit: type=1326 audit(1762325987.728:7855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1634.151504][ T30] audit: type=1326 audit(1762325987.728:7856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1634.212767][ T30] audit: type=1326 audit(1762325987.728:7857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1634.236431][ T30] audit: type=1326 audit(1762325987.728:7858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31558 comm="syz.4.6737" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1634.261123][T24558] Bluetooth: hci3: Unknown advertising packet type: 0x35 [ 1634.261188][T24558] Bluetooth: hci3: Unknown advertising packet type: 0x58 [ 1634.270261][T24558] Bluetooth: hci3: Malformed LE Event: 0x0d [ 1634.622221][T31587] netlink: 'syz.6.6744': attribute type 1 has an invalid length. [ 1634.630613][T31587] netlink: 4268 bytes leftover after parsing attributes in process `syz.6.6744'. [ 1635.115099][T31599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1635.125931][T31599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1635.776771][T19404] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1635.962931][T19404] usb 4-1: device descriptor read/64, error -71 [ 1636.212723][T19404] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1636.342722][T19404] usb 4-1: device descriptor read/64, error -71 [ 1636.453384][T19404] usb usb4-port1: attempt power cycle [ 1636.812183][T19404] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1636.880186][T19404] usb 4-1: device descriptor read/8, error -71 [ 1637.142713][T19404] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1637.167283][T19404] usb 4-1: device descriptor read/8, error -71 [ 1637.277830][T31626] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6752'. [ 1637.287677][T19404] usb usb4-port1: unable to enumerate USB device [ 1637.326507][ T10] usb 7-1: new high-speed USB device number 104 using dummy_hcd [ 1637.626717][ T10] usb 7-1: config 0 has too many interfaces: 253, using maximum allowed: 32 [ 1637.640326][ T10] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 253 [ 1637.724772][ T10] usb 7-1: New USB device found, idVendor=055f, idProduct=c630, bcdDevice=b6.ac [ 1637.734026][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1637.763062][ T10] usb 7-1: Product: syz [ 1637.783843][ T10] usb 7-1: Manufacturer: syz [ 1637.817516][ T10] usb 7-1: SerialNumber: syz [ 1637.945867][ T10] usb 7-1: config 0 descriptor?? [ 1637.973998][ T10] gspca_main: sunplus-2.14.0 probing 055f:c630 [ 1638.640159][ T10] gspca_sunplus: reg_r err -71 [ 1638.645383][ T10] sunplus 7-1:0.0: probe with driver sunplus failed with error -71 [ 1638.673832][ T10] usb 7-1: USB disconnect, device number 104 [ 1638.962843][T19404] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1639.013456][T31638] syzkaller0: entered promiscuous mode [ 1639.020677][T31638] syzkaller0: entered allmulticast mode [ 1639.164248][T31636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1639.175283][T31636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1639.178108][T19404] usb 4-1: device descriptor read/64, error -71 [ 1639.192924][ T10] usb 7-1: new full-speed USB device number 105 using dummy_hcd [ 1639.406538][ T10] usb 7-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1639.417880][ T10] usb 7-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1639.428231][ T10] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1639.435420][ T10] usb 7-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 1639.444610][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1639.452861][T19404] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1639.465669][ T10] usb 7-1: config 0 descriptor?? [ 1639.592672][T19404] usb 4-1: device descriptor read/64, error -71 [ 1639.703264][T19404] usb usb4-port1: attempt power cycle [ 1639.983719][ T10] hid-steam 0003:28DE:1102.004B: item fetching failed at offset 4/5 [ 1640.008308][ T10] hid-steam 0003:28DE:1102.004B: steam_probe:parse of hid interface failed [ 1640.022876][ T10] hid-steam 0003:28DE:1102.004B: probe with driver hid-steam failed with error -22 [ 1640.062814][T19404] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1640.096409][T19404] usb 4-1: device descriptor read/8, error -71 [ 1640.156869][T21829] usb 7-1: USB disconnect, device number 105 [ 1640.180274][T31649] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 1640.188425][T31649] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1640.352718][T19404] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1640.373201][T19404] usb 4-1: device descriptor read/8, error -71 [ 1640.483456][T19404] usb usb4-port1: unable to enumerate USB device [ 1640.700529][T31652] IPv6: syztnl1: Disabled Multicast RS [ 1640.819033][T31658] netlink: 'syz.6.6761': attribute type 1 has an invalid length. [ 1640.827839][T31658] netlink: 4268 bytes leftover after parsing attributes in process `syz.6.6761'. [ 1641.996207][T31668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1642.007508][T31668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1642.124442][T19404] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1642.286931][T19404] usb 4-1: config 0 has an invalid interface number: 37 but max is 0 [ 1642.297423][T19404] usb 4-1: config 0 has no interface number 0 [ 1642.308901][T19404] usb 4-1: New USB device found, idVendor=2639, idProduct=0003, bcdDevice=fd.62 [ 1642.318380][T19404] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1642.327769][T19404] usb 4-1: Product: syz [ 1642.332355][T19404] usb 4-1: Manufacturer: syz [ 1642.351774][T19404] usb 4-1: SerialNumber: syz [ 1642.366834][T19404] usb 4-1: config 0 descriptor?? [ 1642.753694][T19404] usb 4-1: USB disconnect, device number 81 [ 1642.961223][T31675] netlink: 296 bytes leftover after parsing attributes in process `syz.7.6766'. [ 1642.988456][T31675] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6766'. [ 1643.000021][T31675] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6766'. [ 1643.159048][T31680] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6767'. [ 1643.422754][ T10] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1643.584592][ T10] usb 6-1: too many configurations: 47, using maximum allowed: 8 [ 1643.594316][ T10] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1643.602039][ T10] usb 6-1: can't read configurations, error -61 [ 1643.762808][ T10] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1643.802238][T31685] netlink: 4 bytes leftover after parsing attributes in process `syz.7.6769'. [ 1643.934535][ T10] usb 6-1: too many configurations: 47, using maximum allowed: 8 [ 1643.943880][ T10] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1643.951522][ T10] usb 6-1: can't read configurations, error -61 [ 1643.958604][ T10] usb usb6-port1: attempt power cycle [ 1644.383065][ T10] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1644.404647][ T10] usb 6-1: too many configurations: 47, using maximum allowed: 8 [ 1644.414007][ T10] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1644.421684][ T10] usb 6-1: can't read configurations, error -61 [ 1644.507542][T31700] binder: 31697:31700 ioctl c018620c 2000000002c0 returned -1 [ 1644.574330][ T10] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 1644.614184][ T10] usb 6-1: too many configurations: 47, using maximum allowed: 8 [ 1644.630744][ T10] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1644.648063][ T10] usb 6-1: can't read configurations, error -61 [ 1644.656224][ T10] usb usb6-port1: unable to enumerate USB device [ 1644.689917][T31702] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6774'. [ 1644.792809][T21829] usb 7-1: new full-speed USB device number 106 using dummy_hcd [ 1645.011025][T21829] usb 7-1: config 0 has an invalid interface number: 224 but max is 0 [ 1645.030048][T21829] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1645.060653][T21829] usb 7-1: config 0 has no interface number 0 [ 1645.140145][ T30] kauditd_printk_skb: 62 callbacks suppressed [ 1645.140157][ T30] audit: type=1326 audit(1762325999.618:7921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31705 comm="syz.4.6776" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x0 [ 1645.179067][T31709] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1645.223287][T31711] random: crng reseeded on system resumption [ 1645.310051][T21829] usb 7-1: config 0 interface 224 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 10 [ 1645.356050][T21829] usb 7-1: config 0 interface 224 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1645.366166][T21829] usb 7-1: config 0 interface 224 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 14 [ 1645.412426][T21829] usb 7-1: New USB device found, idVendor=0f11, idProduct=2000, bcdDevice=c7.bc [ 1645.421937][T21829] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1645.430968][T21829] usb 7-1: Product: syz [ 1645.476342][T21829] usb 7-1: Manufacturer: syz [ 1645.556773][T21829] usb 7-1: SerialNumber: syz [ 1645.591137][T21829] usb 7-1: config 0 descriptor?? [ 1645.660425][T21829] ldusb 7-1:0.224: Interrupt in endpoint not found [ 1646.383398][T31721] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1646.403290][T31721] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1646.454795][T31724] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6779'. [ 1646.530032][T31724] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6779'. [ 1647.621267][T31733] trusted_key: encrypted_key: insufficient parameters specified [ 1647.784562][ T5910] usb 7-1: USB disconnect, device number 106 [ 1648.086808][T31743] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6784'. [ 1648.139493][T31743] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6784'. [ 1648.366756][T31752] ptrace attach of "./syz-executor exec"[29282] was attempted by "./syz-executor exec"[31752] [ 1648.562368][ T5910] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1648.882681][ T5910] usb 6-1: Using ep0 maxpacket: 16 [ 1648.890435][ T5910] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1648.902188][ T5910] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1648.971862][ T5910] usb 6-1: New USB device found, idVendor=06a3, idProduct=0621, bcdDevice= 0.00 [ 1649.029741][ T5910] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1649.369149][ T5910] usb 6-1: config 0 descriptor?? [ 1649.818013][T31765] netlink: 'syz.3.6790': attribute type 10 has an invalid length. [ 1649.859205][ T5910] saitek 0003:06A3:0621.004C: item fetching failed at offset 4/5 [ 1649.875222][ T5910] saitek 0003:06A3:0621.004C: parse failed [ 1649.889099][ T5910] saitek 0003:06A3:0621.004C: probe with driver saitek failed with error -22 [ 1651.392282][T31779] fuse: Unknown parameter '' [ 1651.653812][T21829] usb 6-1: USB disconnect, device number 18 [ 1651.749737][T31787] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6796'. [ 1652.906469][T31797] netlink: 'syz.4.6799': attribute type 12 has an invalid length. [ 1652.944696][ T30] audit: type=1326 audit(1762326007.268:7922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1652.996575][ T30] audit: type=1326 audit(1762326007.268:7923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.182718][ T30] audit: type=1326 audit(1762326007.268:7924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.205613][ T30] audit: type=1326 audit(1762326007.268:7925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.237274][ T30] audit: type=1326 audit(1762326007.268:7926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.282243][ T30] audit: type=1326 audit(1762326007.268:7927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.322848][ T30] audit: type=1326 audit(1762326007.268:7928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.419470][ T30] audit: type=1326 audit(1762326007.268:7929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.459997][ T30] audit: type=1326 audit(1762326007.268:7930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=189 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.484958][ T30] audit: type=1326 audit(1762326007.268:7931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31794 comm="syz.4.6799" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f453578f6c9 code=0x7ffc0000 [ 1653.863132][T19404] usb 7-1: new high-speed USB device number 107 using dummy_hcd [ 1654.121916][T19404] usb 7-1: Using ep0 maxpacket: 16 [ 1654.132115][T19404] usb 7-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1654.141764][T19404] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1654.165861][T19404] usb 7-1: Product: syz [ 1654.190280][T19404] usb 7-1: Manufacturer: syz [ 1654.237203][T19404] usb 7-1: SerialNumber: syz [ 1654.268288][T19404] usb 7-1: config 0 descriptor?? [ 1654.714037][T19404] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1654.911899][T19404] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1654.951589][T19404] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1655.024545][T19404] usb 7-1: media controller created [ 1655.176317][T19404] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1655.857446][T19404] zl10353_read_register: readreg error (reg=127, ret==0) [ 1655.865096][T19404] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1655.873288][T19404] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1657.654496][T31852] usb usb8: usbfs: process 31852 (syz.3.6813) did not claim interface 0 before use [ 1657.792968][T31857] netlink: 60 bytes leftover after parsing attributes in process `syz.6.6814'. [ 1658.018597][T31862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1658.027737][T31862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1658.585843][T31866] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6817'. [ 1658.838611][T31868] loop9: detected capacity change from 0 to 7 [ 1658.851504][T12145] Dev loop9: unable to read RDB block 7 [ 1658.875211][T12145] loop9: AHDI p1 p2 [ 1658.941086][T12145] loop9: partition table partially beyond EOD, truncated [ 1658.968995][T12145] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1658.995950][T31868] Dev loop9: unable to read RDB block 7 [ 1659.052742][T31868] loop9: AHDI p1 p2 [ 1659.057887][T31868] loop9: partition table partially beyond EOD, truncated [ 1659.074098][T31873] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6819'. [ 1659.097766][T31868] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1659.225561][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1659.243424][T31873] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6819'. [ 1659.511009][T31883] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6821'. [ 1659.596329][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1660.258325][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034212400: rx timeout, send abort [ 1660.758397][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034212800: rx timeout, send abort [ 1660.766781][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034212400: abort rx timeout. Force session deactivation [ 1661.186604][T31898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.227875][T31898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1661.266665][ C0] vcan0: j1939_tp_rxtimer: 0xffff888034212800: abort rx timeout. Force session deactivation [ 1661.292194][T31898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.305109][T31898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1662.193295][T31915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1662.207446][T31915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1662.721900][T31919] pimreg: entered allmulticast mode [ 1662.742710][T31919] pimreg: left allmulticast mode [ 1663.279335][T31937] netlink: 'syz.5.6839': attribute type 1 has an invalid length. [ 1663.291583][T31937] netlink: 4268 bytes leftover after parsing attributes in process `syz.5.6839'. [ 1663.523093][T19404] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1663.752258][T19404] usb 4-1: config 0 has an invalid interface number: 171 but max is 0 [ 1663.766640][T19404] usb 4-1: config 0 has no interface number 0 [ 1663.790569][T19404] usb 4-1: config 0 interface 171 has no altsetting 0 [ 1663.801853][T19404] usb 4-1: New USB device found, idVendor=10d6, idProduct=2200, bcdDevice= 1.00 [ 1663.811391][T19404] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1663.858565][T19404] usb 4-1: Product: syz [ 1663.869841][T19404] usb 4-1: Manufacturer: syz [ 1663.880282][T19404] usb 4-1: SerialNumber: syz [ 1663.937741][T19404] usb 4-1: config 0 descriptor?? [ 1663.979065][T19404] usb-storage 4-1:0.171: USB Mass Storage device detected [ 1664.214008][T19404] usb 4-1: USB disconnect, device number 82 [ 1664.366982][T31960] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1664.450808][T31960] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1664.502129][T31964] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1664.543898][T31964] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1664.821298][T31970] sch_tbf: burst 4 is lower than device lo mtu (65550) ! [ 1664.872526][T31974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1664.890712][T31974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1665.104284][ T10] usb 6-1: new full-speed USB device number 19 using dummy_hcd [ 1665.243398][T31987] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1665.264453][T31987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1665.273316][T31987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1665.285939][T31983] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1665.304413][T31983] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1665.307835][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1665.382279][ T10] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1665.413061][ T10] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1665.456565][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1665.492228][ T10] usb 6-1: config 0 descriptor?? [ 1665.524441][ T10] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1665.549299][ T10] dvb-usb: bulk message failed: -22 (3/0) [ 1665.581607][ T10] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1665.829753][ T10] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1665.874163][ T10] usb 6-1: media controller created [ 1665.889150][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1665.932973][ T10] dvb-usb: bulk message failed: -22 (6/0) [ 1665.953119][ T10] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1665.980015][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input123 [ 1666.033313][ T10] dvb-usb: schedule remote query interval to 150 msecs. [ 1666.073055][ T10] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1666.091284][T31992] netlink: 'syz.4.6853': attribute type 1 has an invalid length. [ 1666.103321][T31992] netlink: 4268 bytes leftover after parsing attributes in process `syz.4.6853'. [ 1666.232958][T27040] dvb-usb: bulk message failed: -22 (1/0) [ 1666.254737][T27040] dvb-usb: error while querying for an remote control event. [ 1666.350065][T27040] usb 6-1: USB disconnect, device number 19 [ 1666.408304][T27040] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1666.729125][T32007] fuse: Unknown parameter '0xffffffffffffffff1844674407370955161500000000000000000000ÕA&Hܬh^d' [ 1666.799962][T32010] veth1_to_hsr: mtu less than device minimum [ 1666.999695][T32011] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1667.533741][T32020] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6859'. [ 1668.003071][ T10] usb 4-1: new full-speed USB device number 83 using dummy_hcd [ 1668.167382][ T10] usb 4-1: config 3 has an invalid interface number: 61 but max is 0 [ 1668.176073][ T10] usb 4-1: config 3 has no interface number 0 [ 1668.182487][ T10] usb 4-1: config 3 interface 61 has no altsetting 0 [ 1668.195038][ T10] usb 4-1: string descriptor 0 read error: -22 [ 1668.201377][ T10] usb 4-1: New USB device found, idVendor=0499, idProduct=101a, bcdDevice=44.26 [ 1668.212009][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1668.392093][ T10] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1668.755492][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.763494][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1668.785752][ T10] snd-usb-audio 4-1:3.61: probe with driver snd-usb-audio failed with error -2 [ 1668.817456][ T10] usb 4-1: USB disconnect, device number 83 [ 1669.992397][T32064] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6872'. [ 1670.011099][T32064] bridge0: entered promiscuous mode [ 1670.516958][T24558] Bluetooth: hci1: SCO packet for unknown connection handle 200 [ 1670.908951][ T10] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1671.100422][ T10] usb 6-1: config 0 has an invalid interface number: 37 but max is 0 [ 1671.132617][ T10] usb 6-1: config 0 has no interface number 0 [ 1671.158679][ T10] usb 6-1: New USB device found, idVendor=2639, idProduct=0003, bcdDevice=fd.62 [ 1671.190171][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1671.207355][ T10] usb 6-1: Product: syz [ 1671.211883][ T10] usb 6-1: Manufacturer: syz [ 1671.216576][ T10] usb 6-1: SerialNumber: syz [ 1671.249718][ T10] usb 6-1: config 0 descriptor?? [ 1671.265514][T32096] loop9: detected capacity change from 0 to 7 [ 1671.274245][T11823] Dev loop9: unable to read RDB block 7 [ 1671.280223][T11823] loop9: AHDI p1 p2 [ 1671.284343][T11823] loop9: partition table partially beyond EOD, truncated [ 1671.292236][T11823] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1671.314622][T32096] Dev loop9: unable to read RDB block 7 [ 1671.320239][T32096] loop9: AHDI p1 p2 [ 1671.323000][T19404] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1671.324494][T32096] loop9: partition table partially beyond EOD, truncated [ 1671.325058][T32096] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1671.391733][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1671.448713][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1671.481924][T32089] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6881'. [ 1671.506757][T19404] usb 4-1: Using ep0 maxpacket: 8 [ 1671.518251][T19404] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1671.536672][T19404] usb 4-1: config 0 has no interfaces? [ 1671.542300][T19404] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1671.553171][T19404] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1671.568178][T19404] usb 4-1: config 0 descriptor?? [ 1671.747485][T19404] usb 6-1: USB disconnect, device number 20 [ 1672.211250][T32110] IPv6: NLM_F_CREATE should be specified when creating new route [ 1672.220307][T32110] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6887'. [ 1672.229984][T32110] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6887'. [ 1672.239274][T32110] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6887'. [ 1672.248142][T32110] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6887'. [ 1672.410398][T32119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1672.423355][T32119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1672.489011][T21829] usb 4-1: USB disconnect, device number 84 [ 1672.727288][T32131] loop9: detected capacity change from 0 to 7 [ 1672.735598][T12145] Dev loop9: unable to read RDB block 7 [ 1672.741320][T12145] loop9: AHDI p1 p2 [ 1672.756533][T12145] loop9: partition table partially beyond EOD, truncated [ 1672.770848][T12145] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1672.785630][T32131] Dev loop9: unable to read RDB block 7 [ 1672.797987][T32131] loop9: AHDI p1 p2 [ 1672.802503][T32131] loop9: partition table partially beyond EOD, truncated [ 1672.811775][T32131] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1672.890137][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1672.923086][T21829] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1672.995235][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1673.242739][T21829] usb 4-1: Using ep0 maxpacket: 16 [ 1673.311954][T21829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1673.341766][T32141] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6896'. [ 1673.392397][T21829] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1673.416053][T21829] usb 4-1: New USB device found, idVendor=06a3, idProduct=0621, bcdDevice= 0.00 [ 1673.421452][T32142] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1673.442959][T32144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1673.443294][T32142] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1673.461024][T32144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1673.497132][T21829] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1673.549990][T32146] netlink: 212368 bytes leftover after parsing attributes in process `syz.7.6899'. [ 1673.554120][T21829] usb 4-1: config 0 descriptor?? [ 1674.026119][T21829] saitek 0003:06A3:0621.004D: item fetching failed at offset 4/5 [ 1674.057483][T21829] saitek 0003:06A3:0621.004D: parse failed [ 1674.104363][T21829] saitek 0003:06A3:0621.004D: probe with driver saitek failed with error -22 [ 1674.280738][T32156] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6904'. [ 1674.390896][T32158] loop9: detected capacity change from 0 to 7 [ 1674.400319][T12145] Dev loop9: unable to read RDB block 7 [ 1674.407611][T12145] loop9: AHDI p1 p2 [ 1674.411621][T12145] loop9: partition table partially beyond EOD, truncated [ 1674.420557][T12145] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1674.438168][T32158] Dev loop9: unable to read RDB block 7 [ 1674.445005][T32158] loop9: AHDI p1 p2 [ 1674.449091][T32158] loop9: partition table partially beyond EOD, truncated [ 1674.457257][T32158] loop9: p1 size 4227858431 extends beyond EOD, truncated [ 1674.760150][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1674.773568][T32165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1674.783819][T32165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1674.810482][T12145] udevd[12145]: inotify_add_watch(7, /dev/loop9p1, 10) failed: No such file or directory [ 1676.222940][T21829] usb 4-1: USB disconnect, device number 85 [ 1676.785051][T32192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1676.808361][T32192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1677.023798][T21829] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1677.048594][T32196] Cannot find add_set index 0 as target [ 1677.056224][T32196] netlink: 'syz.7.6915': attribute type 1 has an invalid length. [ 1677.069516][T32196] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1677.082743][T19404] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1677.302707][T21829] usb 6-1: Using ep0 maxpacket: 8 [ 1677.468606][T21829] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1677.480710][T19404] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1677.527179][T19404] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1678.265758][T21829] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1678.289473][T19404] usb 4-1: config 0 descriptor?? [ 1678.310198][T21829] usb 6-1: New USB device found, idVendor=0458, idProduct=0153, bcdDevice= 0.00 [ 1678.492966][T21829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1678.514702][T32210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1678.545928][T32210] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1678.557669][T21829] usb 6-1: config 0 descriptor?? [ 1678.574487][T19404] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1678.778513][T19404] [drm:udl_init] *ERROR* Selecting channel failed [ 1678.841107][T21829] usbhid 6-1:0.0: can't add hid device: -71 [ 1678.850639][T19404] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 1678.872106][T21829] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1679.122647][T19404] [drm] Initialized udl on minor 2 [ 1679.137874][T21829] usb 6-1: USB disconnect, device number 21 [ 1679.152856][T19404] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1679.293299][T19404] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 1679.311624][T28021] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1679.336696][T19404] usb 4-1: USB disconnect, device number 86 [ 1679.362261][T28021] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 1679.427939][T28021] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 1679.542719][T21829] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1679.733244][T21829] usb 6-1: Using ep0 maxpacket: 8 [ 1679.857243][T21829] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEF, changing to 0x8F [ 1679.878288][T21829] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 256, setting to 64 [ 1679.912695][T21829] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1679.942733][T21829] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1679.963793][T21829] usb 6-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 1679.975807][T21829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1679.992909][T21829] usb 6-1: SerialNumber: syz [ 1680.010116][T21829] usb 6-1: config 0 descriptor?? [ 1680.025851][T21829] hso 6-1:0.0: Can't find BULK IN endpoint [ 1680.082408][T27040] usb 6-1: USB disconnect, device number 22 [ 1680.370851][T32233] netlink: 4 bytes leftover after parsing attributes in process `syz.6.6923'. [ 1680.613073][T27040] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1680.825046][T32237] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6925'. [ 1680.973617][T32239] fuse: Unknown parameter 'user_id`00000000000000000000' [ 1681.049524][T27040] usb 6-1: Using ep0 maxpacket: 16 [ 1681.103089][T27040] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1681.118235][T27040] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1681.137498][T27040] usb 6-1: New USB device found, idVendor=06a3, idProduct=0621, bcdDevice= 0.00 [ 1681.175536][T27040] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1681.432835][T27040] usb 6-1: config 0 descriptor?? [ 1681.925336][T27040] saitek 0003:06A3:0621.004E: item fetching failed at offset 4/5 [ 1681.937094][T27040] saitek 0003:06A3:0621.004E: parse failed [ 1681.945227][T27040] saitek 0003:06A3:0621.004E: probe with driver saitek failed with error -22 [ 1683.117404][T32251] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1683.127443][T32251] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1683.802242][ T5910] usb 6-1: USB disconnect, device number 23 [ 1684.055218][T32255] xt_ecn: cannot match TCP bits for non-tcp packets [ 1684.185979][T32259] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1684.202094][T32259] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1685.195057][T32273] netlink: 'syz.3.6937': attribute type 1 has an invalid length. [ 1685.203043][T32273] netlink: 4268 bytes leftover after parsing attributes in process `syz.3.6937'. [ 1685.244976][T32274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1685.257200][T32274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1685.319878][T32274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1685.393044][T32274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1686.068966][T32288] netlink: 8 bytes leftover after parsing attributes in process `syz.6.6941'. [ 1686.258208][T32293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1686.277614][T32293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1686.318627][T32293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1686.347986][T32293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1686.513006][T32293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1686.573046][T32293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1687.226530][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 1687.226548][ T30] audit: type=1326 audit(1762326041.708:7965): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32294 comm="syz.5.6943" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6b4678f6c9 code=0x0 [ 1687.746495][T32315] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1687.758400][T32315] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1688.247743][T28021] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1688.416295][T28021] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1688.429302][T28021] usb 6-1: New USB device found, idVendor=046d, idProduct=c087, bcdDevice= 0.00 [ 1688.439264][T28021] usb 6-1: New USB device strings: Mfr=248, Product=206, SerialNumber=0 [ 1688.461815][T28021] usb 6-1: Product: syz [ 1688.480354][T28021] usb 6-1: Manufacturer: syz [ 1688.491696][T28021] usb 6-1: config 0 descriptor?? [ 1688.706584][T28021] usb 6-1: USB disconnect, device number 24 [ 1689.575173][T32327] fuse: Bad value for 'user_id' [ 1689.580045][T32327] fuse: Bad value for 'user_id' [ 1689.590483][T32327] fuse: Unknown parameter 'fowner' [ 1689.926527][T32344] netlink: 'syz.3.6954': attribute type 2 has an invalid length. [ 1689.934482][T32344] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6954'. [ 1691.442742][T19404] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1691.451088][T32369] nvme_fabrics: missing parameter 'transport=%s' [ 1691.543673][T32369] nvme_fabrics: missing parameter 'nqn=%s' [ 1691.564725][T32369] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6961'. [ 1691.633768][T19404] usb 6-1: device descriptor read/64, error -71 [ 1691.722220][T32373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1691.735586][T32373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1691.875560][T19404] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1692.033298][T19404] usb 6-1: device descriptor read/64, error -71 [ 1692.143069][T19404] usb usb6-port1: attempt power cycle [ 1692.176674][T32375] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6963'. [ 1692.413098][T32377] netlink: 'syz.4.6964': attribute type 1 has an invalid length. [ 1692.421571][T32377] netlink: 4268 bytes leftover after parsing attributes in process `syz.4.6964'. [ 1692.542682][T19404] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1692.563375][T19404] usb 6-1: device descriptor read/8, error -71 [ 1692.823310][T19404] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1692.849994][T19404] usb 6-1: device descriptor read/8, error -71 [ 1692.901935][T32391] netlink: 'syz.6.6967': attribute type 6 has an invalid length. [ 1692.985039][T19404] usb usb6-port1: unable to enumerate USB device [ 1694.448995][T32414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1694.465069][T32414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1694.485206][T32414] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1694.497494][T32414] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1694.578756][T32416] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 1694.588728][T32416] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1694.702783][T27040] usb 6-1: new full-speed USB device number 29 using dummy_hcd [ 1694.834610][T32420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1694.844356][T27040] usb 6-1: device descriptor read/64, error -71 [ 1694.853048][T32420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1694.871210][T32420] netlink: 16 bytes leftover after parsing attributes in process `syz.6.6974'. [ 1694.907592][T32420] ------------[ cut here ]------------ [ 1694.913588][T32420] usb 7-1: BOGUS control dir, pipe 80006b80 doesn't match bRequestType c0 [ 1694.943165][T32420] WARNING: CPU: 1 PID: 32420 at drivers/usb/core/urb.c:414 usb_submit_urb+0x114d/0x18b0 [ 1694.953004][T32420] Modules linked in: [ 1694.957259][T32420] CPU: 1 UID: 0 PID: 32420 Comm: syz.6.6974 Not tainted syzkaller #0 PREEMPT(full) [ 1694.966735][T32420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1694.976971][T32420] RIP: 0010:usb_submit_urb+0x114d/0x18b0 [ 1694.982675][T32420] Code: df 0f b6 44 05 00 84 c0 0f 85 2a 06 00 00 45 0f b6 45 00 48 c7 c7 40 14 11 8c 48 8b 34 24 4c 89 fa 44 89 f1 e8 34 0c 90 fa 90 <0f> 0b 90 90 49 bf 00 00 00 00 00 fc ff df e9 95 f2 ff ff 89 e9 80 [ 1695.002340][T32420] RSP: 0018:ffffc9000475f800 EFLAGS: 00010246 [ 1695.008460][T32420] RAX: 98ea1c914ac12500 RBX: ffff888032779700 RCX: ffff888029bfdac0 [ 1695.016694][T32420] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 1695.024827][T32420] RBP: 1ffff11007349d30 R08: ffff8880b8824293 R09: 1ffff11017104852 [ 1695.032923][T32420] R10: dffffc0000000000 R11: ffffed1017104853 R12: ffff888079d7b100 [ 1695.040895][T32420] R13: ffff888039a4e980 R14: 0000000080006b80 R15: ffff8880283754e0 [ 1695.049009][T32420] FS: 00007faefea1a6c0(0000) GS:ffff88812623d000(0000) knlGS:0000000000000000 [ 1695.058048][T32420] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1695.065271][T32420] CR2: 00007faefe9f8f98 CR3: 00000000632f6000 CR4: 00000000003526f0 [ 1695.073285][T32420] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 1695.081430][T32420] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1695.089452][T32420] Call Trace: [ 1695.092746][T32420] [ 1695.095671][T32420] usb_start_wait_urb+0x114/0x4c0 [ 1695.100685][T32420] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1695.106250][T32420] usb_control_msg+0x232/0x3e0 [ 1695.111002][T32420] dtv5100_i2c_msg+0x250/0x330 [ 1695.115788][T32420] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 1695.120637][T32420] __i2c_transfer+0x874/0x2170 [ 1695.125430][T32420] ? preempt_schedule_thunk+0x16/0x30 [ 1695.130804][T32420] ? __pfx___i2c_transfer+0x10/0x10 [ 1695.136162][T32420] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 1695.141518][T32420] ? i2c_transfer+0x120/0x3a0 [ 1695.146251][T32420] i2c_transfer+0x25b/0x3a0 [ 1695.150770][T32420] ? __pfx_i2c_transfer+0x10/0x10 [ 1695.155996][T32420] ? _copy_from_user+0x94/0xb0 [ 1695.160764][T32420] i2cdev_ioctl_rdwr+0x460/0x740 [ 1695.165721][T32420] i2cdev_ioctl+0x64b/0x7f0 [ 1695.170213][T32420] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1695.175259][T32420] ? __fget_files+0x3a0/0x420 [ 1695.179916][T32420] ? __fget_files+0x2a/0x420 [ 1695.184534][T32420] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1695.189449][T32420] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1695.194494][T32420] __se_sys_ioctl+0xfc/0x170 [ 1695.199065][T32420] do_syscall_64+0xfa/0xfa0 [ 1695.203595][T32420] ? lockdep_hardirqs_on+0x9c/0x150 [ 1695.208784][T32420] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.214953][T32420] ? clear_bhb_loop+0x60/0xb0 [ 1695.219606][T32420] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.225491][T32420] RIP: 0033:0x7faefdb8f6c9 [ 1695.229884][T32420] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1695.249523][T32420] RSP: 002b:00007faefea1a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1695.257959][T32420] RAX: ffffffffffffffda RBX: 00007faefdde5fa0 RCX: 00007faefdb8f6c9 [ 1695.265930][T32420] RDX: 0000200000000080 RSI: 0000000000000707 RDI: 0000000000000004 [ 1695.273923][T32420] RBP: 00007faefdc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 1695.281873][T32420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1695.289861][T32420] R13: 00007faefdde6038 R14: 00007faefdde5fa0 R15: 00007faefdf0fa28 [ 1695.297876][T32420] [ 1695.300885][T32420] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1695.308142][T32420] CPU: 1 UID: 0 PID: 32420 Comm: syz.6.6974 Not tainted syzkaller #0 PREEMPT(full) [ 1695.317481][T32420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1695.327510][T32420] Call Trace: [ 1695.330766][T32420] [ 1695.333685][T32420] dump_stack_lvl+0x99/0x250 [ 1695.338256][T32420] ? __asan_memcpy+0x40/0x70 [ 1695.342824][T32420] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1695.347996][T32420] ? __pfx__printk+0x10/0x10 [ 1695.352577][T32420] vpanic+0x237/0x6d0 [ 1695.356557][T32420] ? __pfx_vpanic+0x10/0x10 [ 1695.361041][T32420] panic+0xb9/0xc0 [ 1695.364740][T32420] ? __pfx_panic+0x10/0x10 [ 1695.369139][T32420] __warn+0x31b/0x4b0 [ 1695.373096][T32420] ? usb_submit_urb+0x114d/0x18b0 [ 1695.378368][T32420] ? usb_submit_urb+0x114d/0x18b0 [ 1695.383378][T32420] report_bug+0x2be/0x4f0 [ 1695.387684][T32420] ? usb_submit_urb+0x114d/0x18b0 [ 1695.392683][T32420] ? usb_submit_urb+0x114d/0x18b0 [ 1695.397682][T32420] ? usb_submit_urb+0x114f/0x18b0 [ 1695.402685][T32420] handle_bug+0x84/0x160 [ 1695.406931][T32420] exc_invalid_op+0x1a/0x50 [ 1695.411415][T32420] asm_exc_invalid_op+0x1a/0x20 [ 1695.416240][T32420] RIP: 0010:usb_submit_urb+0x114d/0x18b0 [ 1695.421857][T32420] Code: df 0f b6 44 05 00 84 c0 0f 85 2a 06 00 00 45 0f b6 45 00 48 c7 c7 40 14 11 8c 48 8b 34 24 4c 89 fa 44 89 f1 e8 34 0c 90 fa 90 <0f> 0b 90 90 49 bf 00 00 00 00 00 fc ff df e9 95 f2 ff ff 89 e9 80 [ 1695.441438][T32420] RSP: 0018:ffffc9000475f800 EFLAGS: 00010246 [ 1695.447484][T32420] RAX: 98ea1c914ac12500 RBX: ffff888032779700 RCX: ffff888029bfdac0 [ 1695.455437][T32420] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 1695.463388][T32420] RBP: 1ffff11007349d30 R08: ffff8880b8824293 R09: 1ffff11017104852 [ 1695.471338][T32420] R10: dffffc0000000000 R11: ffffed1017104853 R12: ffff888079d7b100 [ 1695.479304][T32420] R13: ffff888039a4e980 R14: 0000000080006b80 R15: ffff8880283754e0 [ 1695.487274][T32420] usb_start_wait_urb+0x114/0x4c0 [ 1695.492290][T32420] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1695.497838][T32420] usb_control_msg+0x232/0x3e0 [ 1695.502592][T32420] dtv5100_i2c_msg+0x250/0x330 [ 1695.507359][T32420] dtv5100_i2c_xfer+0x1a4/0x3c0 [ 1695.512204][T32420] __i2c_transfer+0x874/0x2170 [ 1695.516952][T32420] ? preempt_schedule_thunk+0x16/0x30 [ 1695.522308][T32420] ? __pfx___i2c_transfer+0x10/0x10 [ 1695.527481][T32420] ? rt_mutex_lock_nested+0x15e/0x1e0 [ 1695.532830][T32420] ? i2c_transfer+0x120/0x3a0 [ 1695.537486][T32420] i2c_transfer+0x25b/0x3a0 [ 1695.542068][T32420] ? __pfx_i2c_transfer+0x10/0x10 [ 1695.547088][T32420] ? _copy_from_user+0x94/0xb0 [ 1695.551842][T32420] i2cdev_ioctl_rdwr+0x460/0x740 [ 1695.556765][T32420] i2cdev_ioctl+0x64b/0x7f0 [ 1695.561249][T32420] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1695.566250][T32420] ? __fget_files+0x3a0/0x420 [ 1695.570903][T32420] ? __fget_files+0x2a/0x420 [ 1695.575469][T32420] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1695.580383][T32420] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1695.585386][T32420] __se_sys_ioctl+0xfc/0x170 [ 1695.589957][T32420] do_syscall_64+0xfa/0xfa0 [ 1695.594447][T32420] ? lockdep_hardirqs_on+0x9c/0x150 [ 1695.599627][T32420] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.605672][T32420] ? clear_bhb_loop+0x60/0xb0 [ 1695.610333][T32420] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1695.616200][T32420] RIP: 0033:0x7faefdb8f6c9 [ 1695.620599][T32420] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1695.640196][T32420] RSP: 002b:00007faefea1a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1695.648586][T32420] RAX: ffffffffffffffda RBX: 00007faefdde5fa0 RCX: 00007faefdb8f6c9 [ 1695.656534][T32420] RDX: 0000200000000080 RSI: 0000000000000707 RDI: 0000000000000004 [ 1695.664484][T32420] RBP: 00007faefdc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 1695.672607][T32420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1695.680553][T32420] R13: 00007faefdde6038 R14: 00007faefdde5fa0 R15: 00007faefdf0fa28 [ 1695.688507][T32420] [ 1695.691759][T32420] Kernel Offset: disabled [ 1695.696074][T32420] Rebooting in 86400 seconds..