last executing test programs: 1m14.038757441s ago: executing program 2 (id=3123): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000180)) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x101800, 0x0) ioctl$FBIOBLANK(r4, 0x4611, 0x3) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[], 0x38}}, 0x240088c0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x11, &(0x7f0000000200)=0x79, 0x4) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0xfba) preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000000)=""/216, 0xd8}, {&(0x7f00000003c0)=""/55, 0x37}, {&(0x7f0000000180)=""/29, 0x1d}, {&(0x7f00000001c0)=""/81, 0x51}, {&(0x7f0000000240)=""/181, 0xb5}, {&(0x7f0000000300)=""/37, 0x25}], 0x6, 0x142, 0xfffffffc) 1m12.545482996s ago: executing program 2 (id=3128): r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = fanotify_init(0x202, 0x0) r2 = dup2(r1, r0) syz_usb_connect(0x6, 0x0, 0x0, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f0000000c40)) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'veth0_virt_wifi\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x10, [0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x2], 0x0, [0x0, 0x2, 0x5, 0x0, 0x7eb2, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r6, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bcb7f620e90f01d55023010203010902120001000000000904"], 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0xae00) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x0) 1m10.312041695s ago: executing program 2 (id=3136): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x18, r1, 0x1, 0x0, &(0x7f00000001c0)=[{0x0, 0x1}]}) r2 = fsopen(&(0x7f00000003c0)='befs\x00', 0x1) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000400)='uid', &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c) syz_io_uring_setup(0xbdc, &(0x7f0000000000)={0x0, 0x4ec25, 0x400, 0x1, 0x40000333}, 0x0, 0x0) syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x100008, &(0x7f0000000000)) unshare(0x8040480) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000001440)='/sys/power/pm_debug_messages', 0x1, 0x5) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f0000000000)={0x2, 0x0, 0x3, 0x0, 0x3}) lseek(r3, 0x0, 0x0) 1m9.826861737s ago: executing program 2 (id=3137): link(0x0, &(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) setrlimit(0x40000000000008, &(0x7f0000000000)) mlockall(0x1) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) add_key(&(0x7f0000000440)='dns_resolver\x00', 0x0, &(0x7f00000004c0)="a079394a04954e2d1523cd274d954f18a7b1235d2023e670955c12e7265fa97c2cfb7ba5f67d4a0f06d00c089c2dbb7034ddf203c4f50b4d19d6ab0b49d345571461f3c9bc2be016252397574e61cd9b5fc6337f92b077112e9d69d5f0d761e584bd5f7a22aa334740193d174c89a6670c1c0a98533ebffcb043f72e876d30dc59b400", 0x83, 0xffffffffffffffff) truncate(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x80000001) 1m9.492617331s ago: executing program 2 (id=3138): bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'/16], 0x50) 1m9.152173544s ago: executing program 2 (id=3139): r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x40000000}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x90) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001600010325bd7000fcffffff2000000008000380"], 0x1c}, 0x1, 0x0, 0x0, 0x440d3}, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x800000000001e8, 0x12) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB], 0x5c}}, 0x0) sendmsg$nl_route(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000220000012bbd7000ffdbdf250280d4d55714e5da04"], 0x1c}, 0x1, 0x0, 0x0, 0x20000010}, 0x8000) madvise(&(0x7f000072a000/0x4000)=nil, 0x4000, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}}], 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) socket$inet(0x2, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x0, 0x11, 0x148, 0x1d8, 0x0, 0x2d8, 0x2a8, 0x2a8, 0x2d8, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x190, 0x1d8, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x7}}}, @common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@broadcast, [0xff, 0xff, 0x0, 0xff], @ipv6=@mcast2, [0xffffffff, 0xffffff00, 0x0, 0xffffffff], @ipv6=@dev={0xfe, 0x80, '\x00', 0x27}, [0xffffffff, 0x0, 0x0, 0xff000000], @ipv4=@multicast2, [0x0, 0x0, 0x0, 0xffffff00], 0x6, 0x6, 0x0, 0x4e23, 0x4e24, 0x4e22, 0x4e23, 0x81}, 0x0, 0x480, 0x0, 0x0, 0x0, 0x4e20}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00'}}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) 1m8.160743857s ago: executing program 32 (id=3139): r0 = socket$inet_tcp(0x2, 0x1, 0x0) close(r0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x40000000}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x90) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001600010325bd7000fcffffff2000000008000380"], 0x1c}, 0x1, 0x0, 0x0, 0x440d3}, 0x0) write$cgroup_int(r3, &(0x7f0000000040)=0x800000000001e8, 0x12) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB], 0x5c}}, 0x0) sendmsg$nl_route(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000220000012bbd7000ffdbdf250280d4d55714e5da04"], 0x1c}, 0x1, 0x0, 0x0, 0x20000010}, 0x8000) madvise(&(0x7f000072a000/0x4000)=nil, 0x4000, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}}], 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) socket$inet(0x2, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000a80)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x0, 0x11, 0x148, 0x1d8, 0x0, 0x2d8, 0x2a8, 0x2a8, 0x2d8, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x190, 0x1d8, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x7}}}, @common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@broadcast, [0xff, 0xff, 0x0, 0xff], @ipv6=@mcast2, [0xffffffff, 0xffffff00, 0x0, 0xffffffff], @ipv6=@dev={0xfe, 0x80, '\x00', 0x27}, [0xffffffff, 0x0, 0x0, 0xff000000], @ipv4=@multicast2, [0x0, 0x0, 0x0, 0xffffff00], 0x6, 0x6, 0x0, 0x4e23, 0x4e24, 0x4e22, 0x4e23, 0x81}, 0x0, 0x480, 0x0, 0x0, 0x0, 0x4e20}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00'}}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00', {}, {}, 0x0, 0x2}, 0x0, 0xd0, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) 9.338548155s ago: executing program 4 (id=3331): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/address_bits', 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) unshare(0x8000000) shmget$private(0x0, 0xfffffffffeffffff, 0x4800, &(0x7f0000ffc000/0x3000)=nil) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000300)='/proc/sys/net/ipv4/tcp_sack\x00', 0x1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0xfffffffffffffffe) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) writev(r3, &(0x7f0000000240)=[{&(0x7f0000000640)="d88b22e41c79469fbcbedde69e7ded43dc0389445bb1a925030d2356cdcefda6b69bcb58c912cdef599ea062050fd4ddb7999042299655e268352be255b6fc669d9826765d7e73932db14b068ca17ca90e5693cd97ae7f2dab19a2c33d2b7299229abba241d5cb54f4a0c50957c17966878a3f22d350acde589e37f44af202c091c7a72a96367b2f3b86cba81290091881d23bdb69884dc40106bde3704e717fb734ec98f8233c2708f9cc67978c437133b66d029ebd0e8589b7c33945a230050c", 0xc1}, {&(0x7f0000000440)="3adacb9cb7f36576a1e2a49234dcab4b87ff25a91089bda69ac3515bc6ec1809cf3a3a9b9f97013933566753480886f9f101ccd6e3b42fe042ce9a1c5888929d3eb6bb793666860d61bf00f5265b35daecbc2837e037da9976123b10c7a7ccf361e7fca584a18dd05d6b99b6604351c4ceab6536bbbf91a4ebe02601dae2bb11d5ac282fbd584a82743d50b6cd238a641fb2173b5ce2811371663de96bffff647baf68ae6e946246d8848755e5045ceb7f80808b04a4d245e7b0d65108777a2981218e28da51a6cfba", 0xc9}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000540)={0x2, @meta={0x44564956, 0x52f1e11a, 0xf95d, 0x7f1a, 0x3c00d2c}}) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 8.48130591s ago: executing program 3 (id=3333): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x4, @remote, 0x528}, {0xa, 0x4e23, 0x4068d6a4, @mcast2, 0x9da}, 0xffffffffffffffff, 0x3}}, 0x48) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket(0x2, 0x3, 0xf8) sendto$unix(r3, 0x0, 0xffffffffffffff84, 0x48850, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r4, 0x29, 0x2e, &(0x7f0000000200)={0x6, {{0xa, 0x3, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0xfffd, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r5, &(0x7f0000000d40)={0x16, 0x98, 0xfa00, {0x0, 0x2, 0xffffffffffffffff, 0x10, 0x1, @in={0x2, 0x4e21, @private=0xa010102}}}, 0xa0) 6.975370194s ago: executing program 1 (id=3337): pipe(&(0x7f0000000600)) io_setup(0x40000100, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$sequencer(0xffffffffffffff9c, 0x0, 0x420b41, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000080)={0xa04c, 0x35e8b534, 0x1, 0x18, 0x13, "53af0f0b4ece6c29bf81c173f4a8f5f73eb62f"}) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) epoll_create(0xaf2) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40086602, 0x0) r2 = mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbdOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91@\x00\x00\x00\x00\x00\x00\x00\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xb5{\xa0k\x95s\xa8l\xd4\b|m\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_\xfbR\xaf\xaa^\xb6\x99\x13\x0f\x87\xa8P.\x97yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3C7c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe2\xd9\xb8 xC\xf5N\x04s(\xdaR\x1f\xbe\x12Q*\xd9u\xb4\xde\xc9\xf8\xc2o|\xfd.\x83\xc4s\xa9b,\xd3\xc2\x88nP\x9f\xed\xfe\xc61\xd0\xeb\x92\xe0\xc8\xd6\xd7eb&\x84\xd2z+\xddW\xac\xba\x89\xa8\x17Ga,\xf7:l\x86\xa3\x95\xa1e\xdc\xed\xac\x06V\x01\xb7&.\xda\ni\x82\xc1\xad\x1f\x83\xe7\xec\xbe\xc4\xcd\xe6O\xb0\x12`\x03\xd5g\xb4\x9f\xeb\xddeq\x1a\x95 \xfb\x91\xc5\xb3\xc34\x86)\a\x91\xe9\t\xdf\xb7\xff\f\x96S\xf1\xb5oQ\x99\x8e\xdd\x14\x0f\x18\xe4\x03^\x12\x9c\xffA\xc0\xa8#L_\x00\xc81\xf8u\xf4\xc5\x01n\x92M^r\xa9\x01\xe5\xc6I|c8j`j`\xd9\xfd`\xcei\xa0f', 0x1, 0x0, 0x0) mq_timedsend(r2, 0x0, 0x0, 0x26aadf42, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x20) mq_unlink(&(0x7f0000000000)='eth0\x00') pread64(0xffffffffffffffff, &(0x7f0000000040)=""/54, 0x36, 0x0) close(r2) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000000)=0x9) connect$inet(r3, &(0x7f0000000280)={0x2, 0x80, @remote}, 0x10) close(r3) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="020300030e000000002800000000000004000900a800b0f453bb467d04f14562c5f463273ef4a720564f485af200000003000600000000000200100000000000000000000000000002000100000000000000060d00000000030005000000000002000000ac1414000000000000000000"], 0x70}, 0x1, 0x7}, 0x0) 6.261591196s ago: executing program 3 (id=3339): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = syz_usb_connect$cdc_ecm(0x0, 0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000402505a1a4400001020301090248000101570040090400000002060000052406000005240000000d240f01000800000000000000042402000905810310"], 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e"], 0x0) syz_usb_disconnect(r2) syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[], 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 5.926828643s ago: executing program 4 (id=3340): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r3 = add_key(&(0x7f0000000000)='cifs.idmap\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd000000000000000000bbfe8000000000000000000000004600aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5002000090780000"], 0x0) syz_emit_ethernet(0x7c, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x6e, 0x40, 0x0, 0x1, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0x0, 0x0, 0x1}, {"35b4c3257e3d86c7c0639ee1c51681e07215721ab073024b6db0fd86672255bacbcaabdb9602fcdad03a51195d41dd7b2f3780cb643c9d8ef3e5c3e5887d1a03fddf149c82fe"}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6056040000140600fe8000000000000000000000000000aafe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="38c20000468e0000"], 0x0) r5 = fcntl$dupfd(r2, 0x0, r2) write$sndseq(r5, 0x0, 0x0) r6 = dup(r1) setsockopt$MRT6_FLUSH(r6, 0x29, 0xd4, &(0x7f0000000180)=0x4, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_MOVE(0x1e, r8, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x1) keyctl$KEYCTL_MOVE(0x1e, r3, r3, r8, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r6, 0x28, 0x2, &(0x7f0000001680)=""/56, &(0x7f0000000280)=0x38) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x42, 0x0, 0x0) sendmsg$inet6(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)="944cf7", 0x3}], 0x1}, 0x20000010) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r9, 0x5423) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$packet(0x11, 0x3, 0x300) 5.306725761s ago: executing program 4 (id=3341): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000008340)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0xfa, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x90000010}) dup2(r2, r0) 5.09586317s ago: executing program 4 (id=3342): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xdc3, 0x0) syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00') setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_GUEST_DEBUG_x86(0xffffffffffffffff, 0x4048ae9b, &(0x7f0000000180)={0x80001, 0x0, {[0x7, 0x10000, 0x100000000, 0x7fff, 0xfffffffffffffffa, 0x9, 0x7, 0xffffffffffffffff]}}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r2) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r2, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000006c0)=ANY=[@ANYRESDEC=r0, @ANYRES16=r3, @ANYBLOB="010326bd7000000000002b992d9300000c00018008"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040814) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x69, 0x0, &(0x7f0000000100)="b9ff030f6044238cb89e14f088a820ff43052f002000636777fbac141443e000000d62079f4b4d2f87e56dca6aab845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) fsopen(&(0x7f0000000080)='xfs\x00', 0x0) 4.510202389s ago: executing program 1 (id=3345): ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, &(0x7f0000000940)={0xa, 0x0, 0x7, {0x3, 0x1000, 0xfc, 0x870}}) 4.424499507s ago: executing program 0 (id=3346): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000180)) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x101800, 0x0) ioctl$FBIOBLANK(r4, 0x4611, 0x3) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x11, &(0x7f0000000200)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0xfba) preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000000)=""/216, 0xd8}, {&(0x7f00000003c0)=""/55, 0x37}, {&(0x7f0000000180)=""/29, 0x1d}, {&(0x7f00000001c0)=""/81, 0x51}, {&(0x7f0000000240)=""/181, 0xb5}, {&(0x7f0000000300)=""/37, 0x25}], 0x6, 0x142, 0xfffffffc) 4.423730866s ago: executing program 5 (id=3347): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) unshare(0x24020400) open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_int(r0, 0x0, 0xc, 0x0, &(0x7f0000000780)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0xa, 0x8000, 0x0, 0x9, 0x7, 0xfffffdffffffffff, 0x8000, 0xffffffff}, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000540), 0x2008c0, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000140)=0xffffffffffdffffa, 0xa, 0x3) get_mempolicy(0x0, 0x0, 0x206, &(0x7f0000394000/0x3000)=nil, 0x3) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) io_setup(0x3, 0x0) pipe2$watch_queue(&(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r4 = add_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r3, 0x0) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r3, 0x5760, 0x6) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r3, 0xffffffffffffffff) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)=0x9) io_submit(0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x18, 0x25, 0x301, 0x270bd24, 0x25dfdbff, {0x1}, [@nested={0x4, 0xae}]}, 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) 4.376427477s ago: executing program 1 (id=3348): pipe(&(0x7f0000000600)) io_setup(0x40000100, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$sequencer(0xffffffffffffff9c, 0x0, 0x420b41, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000080)={0xa04c, 0x35e8b534, 0x1, 0x18, 0x13, "53af0f0b4ece6c29bf81c173f4a8f5f73eb62f"}) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) epoll_create(0xaf2) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40086602, 0x0) r2 = mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbdOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91@\x00\x00\x00\x00\x00\x00\x00\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xb5{\xa0k\x95s\xa8l\xd4\b|m\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_\xfbR\xaf\xaa^\xb6\x99\x13\x0f\x87\xa8P.\x97yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3C7c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe2\xd9\xb8 xC\xf5N\x04s(\xdaR\x1f\xbe\x12Q*\xd9u\xb4\xde\xc9\xf8\xc2o|\xfd.\x83\xc4s\xa9b,\xd3\xc2\x88nP\x9f\xed\xfe\xc61\xd0\xeb\x92\xe0\xc8\xd6\xd7eb&\x84\xd2z+\xddW\xac\xba\x89\xa8\x17Ga,\xf7:l\x86\xa3\x95\xa1e\xdc\xed\xac\x06V\x01\xb7&.\xda\ni\x82\xc1\xad\x1f\x83\xe7\xec\xbe\xc4\xcd\xe6O\xb0\x12`\x03\xd5g\xb4\x9f\xeb\xddeq\x1a\x95 \xfb\x91\xc5\xb3\xc34\x86)\a\x91\xe9\t\xdf\xb7\xff\f\x96S\xf1\xb5oQ\x99\x8e\xdd\x14\x0f\x18\xe4\x03^\x12\x9c\xffA\xc0\xa8#L_\x00\xc81\xf8u\xf4\xc5\x01n\x92M^r\xa9\x01\xe5\xc6I|c8j`j`\xd9\xfd`\xcei\xa0f', 0x1, 0x0, 0x0) mq_timedsend(r2, 0x0, 0x0, 0x26aadf42, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x20) mq_unlink(&(0x7f0000000000)='eth0\x00') pread64(0xffffffffffffffff, &(0x7f0000000040)=""/54, 0x36, 0x0) close(r2) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r3, 0x5421, &(0x7f0000000000)=0x9) connect$inet(r3, &(0x7f0000000280)={0x2, 0x80, @remote}, 0x10) close(r3) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB="020300030e000000002800000000000004000900a800b0f453bb467d04f14562c5f463273ef4a720564f485af200000003000600000000000200100000000000000000000000000002000100000000000000060d00000000030005000000000002000000ac1414000000000000000000"], 0x70}, 0x1, 0x7}, 0x0) 3.429103192s ago: executing program 5 (id=3349): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="14000000000000002900000000000014000000000000002900000034000000fdffffff00000000180000000000000029000000040000000400000000000000d80000000000000029000000360000005e17000000000000000100000100010800000000000000000728000000030800ff0f66090000000000000700000000000000010000000000000001000000000000000864c8a110995d439fbfac9716a99c357bcb2d59a850490739"], 0x188}}], 0x1, 0x810) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000300)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) pwritev(0xffffffffffffffff, &(0x7f0000000d80)=[{&(0x7f0000000780)="42ebe7f5d8dde5f3e9c5c7e7bc09d8d80f373ae4dc85e6cb597bd322663b986ff272399bec41d811a763bcd2cdc221d2ac6cdeeca815ce250ce959444e7f296cb11433530cfccd0c6f450147b46eb5bbe281810c76577aaf554801815d1ee516cc0752832233d7610ce165a593e43cbaa4f52db28e5aead94767ad0d0ccf1cd422fc", 0x82}, {0x0}, {0x0}, {0x0}, {&(0x7f0000000d00)="7cedc13b1cbf2308b2000d3d62b333c7c3b9f321ef7bd8e0e1e323da70d8d5", 0x1f}], 0x5, 0x4d9e, 0x8) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3.143122477s ago: executing program 4 (id=3350): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x8) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000300)={0x1, 0x0, @ioapic={0x25000, 0x400, 0x5, 0x7, 0x0, [{0x7, 0x7, 0x7, '\x00', 0x4}, {0x21, 0x3, 0x7, '\x00', 0xf7}, {0xb1, 0x5, 0xc8, '\x00', 0x1}, {0x81, 0x6, 0x9, '\x00', 0x8}, {0x6, 0x8, 0x9, '\x00', 0x4}, {0x3, 0x2, 0x4, '\x00', 0xb}, {0x0, 0x9, 0x80, '\x00', 0x1}, {0x0, 0x3, 0xcf, '\x00', 0x3d}, {0x1, 0x6, 0x1, '\x00', 0x9d}, {0x4, 0x3, 0x4, '\x00', 0x5}, {0x2, 0x0, 0x4, '\x00', 0x1}, {0xd, 0xc5, 0x3, '\x00', 0xea}, {0xb4, 0x0, 0x6, '\x00', 0xfb}, {0xf, 0xa, 0x6, '\x00', 0x5}, {0x0, 0x4, 0x3, '\x00', 0x9}, {0x9, 0x6, 0x6, '\x00', 0x74}, {0x4, 0x4, 0x7f, '\x00', 0xee}, {0x3, 0x3, 0xf1, '\x00', 0x4}, {0xaf, 0x8, 0x2, '\x00', 0x2}, {0x5, 0x8, 0x0, '\x00', 0x6c}, {0x6, 0x0, 0x1, '\x00', 0x9}, {0x7, 0x5f, 0x10, '\x00', 0x5}, {0x0, 0x6f, 0x1, '\x00', 0x7}, {0x81, 0x1, 0x1, '\x00', 0x81}]}}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000002c0)={0x40, 0xa, 0x1, 'A'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xffffff33}, 0x1, 0x0, 0x0, 0x80}, 0x20040894) r3 = accept4$packet(r2, 0x0, &(0x7f0000000000), 0x1000) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r4, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_usb_control_io$printer(r0, &(0x7f0000000180)={0x14, &(0x7f0000000540)={0x0, 0x21, 0xee, {0xee, 0xc, "ccd7fd8d634dc820bd450cb59f0426254d3246db1aa7890ca1d900a8510d7b7b278d0a368e38476455dd078f4b07d44a7b20683e2c2d0f0724c721b13fd34b6d8231cdc7852eef1f6b2e3c48e201515f305997d76ef8d10acaf373a9c8c8ad2b9bce61effa1ea15016766ac4f76db087f4383374f637f37d5fa281a5ab4525a440ef77890499747c63fc9e3b21c6f709e0397a9639e7fa278a1a79800a91ea129def32c0573e58e92486bf72b1a3a481f8598311a0ce61942dd3bbd6105acba0f5d5727e9e6531f48c7b69e960a5ca2b9dda43d3586b76a87a79d9e7deecd6d8a1dc07a9acce31bf24210c01"}}, &(0x7f0000000640)={0x0, 0x3, 0xde, @string={0xde, 0x3, "4db1769946cfe45606cb74b318408ddff53be411c40aa0160c7c435c70860c229dd6ffd693b8aec86a80939a6c1d59aa452c2e7fbb037e76ea05ab4234f834a7370e2e7353f145fcf5bd3df4537a34cbb5def96065eae64ce362322d67c9024078bd03b521d53cbe753cf4de1868a52cf66d0fdffda391359f6a827c0caac2356cf796f74fe26e3c901de8f2fcdc93c2bcd5f86644d201011f4076e678ea377872db18697adbfb859b5c0096b4285909332f1c7eade421d80c328132a05808098493581dfb8627c9243cca16f0615a7ea3d5544bd5b6b0398335434a"}}}, &(0x7f0000000980)={0x34, &(0x7f0000000840)={0x0, 0x7, 0x77, "eba1fd8680dd370048b4f32a1ef1cd13841b0d0bf45bd9d5ddfd180819f3e42e8f7d012ea3e0d1d5721c36de05c8400e0fc7b1d4bdb193da90973b87cc1f9b9821bf13d1f0fb5b9abbc683278950620a881457a7efeafe654c727553a53c2728c3f4fb658798c927af50e46eed430e5d7298d7539355cc"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0x6}, &(0x7f0000000740)={0x0, 0x8, 0x1, 0x7}, &(0x7f00000008c0)={0x20, 0x0, 0xa, {0x8, "3e0521507e429281"}}, &(0x7f0000000900)={0x20, 0x1, 0x1, 0x9}, &(0x7f0000000940)={0x20, 0x0, 0x1, 0x71}}) syz_usb_control_io(r0, 0x0, 0x0) 3.138626054s ago: executing program 3 (id=3351): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = syz_io_uring_setup(0x239, &(0x7f0000000380)={0x0, 0xf691, 0x10100, 0x0, 0x2b4}, 0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) bind$can_j1939(r1, &(0x7f00000002c0)={0x1d, 0x0, 0x3, {0x2}, 0xfe}, 0x18) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x100000a, 0x5d032, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x801) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000440)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x0, &(0x7f0000000100), 0xc06620, 0x4) timer_settime(0x0, 0x0, 0x0, &(0x7f0000000240)) r5 = socket(0x10, 0x803, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001880)=@newtfilter={0x8c4, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x890, 0x2, [@TCA_U32_POLICE={0x868, 0x6, [@TCA_POLICE_RATE={0x404, 0x2, [0x80000, 0x3, 0xf, 0xfdb, 0x1, 0x80, 0x7, 0x7, 0x40000000, 0xaa04, 0x80000001, 0x99, 0x8000, 0x1000, 0x3, 0x0, 0x7fffffff, 0x80, 0x1, 0x7, 0x0, 0x9, 0x4, 0x5, 0x80000001, 0x2, 0xe0, 0x9, 0x1, 0x80000000, 0x1, 0xffff8001, 0x9, 0x10001, 0x7, 0x10000, 0x30, 0x803, 0x1000, 0xfff, 0x7, 0x2, 0x5, 0x48a, 0x9, 0x1000, 0x7, 0x7198, 0x8, 0x80000001, 0x1, 0x101, 0x3, 0x7, 0x2, 0x8, 0x10001, 0x2, 0x1, 0x2, 0x6, 0x9, 0x13, 0x2, 0xffff, 0x80, 0xbf77, 0x8, 0xc52, 0x6, 0x9, 0x7, 0x9, 0x5, 0x8, 0x3, 0x8, 0x5, 0x8, 0x1, 0x3, 0x7fffffff, 0x8, 0x2845, 0x2, 0xe9, 0x2a, 0x3, 0x891, 0x7, 0x1, 0x12, 0x6, 0xfff, 0xffffc9b5, 0x4, 0x2, 0x6, 0x6, 0xaa, 0x0, 0x8, 0x0, 0x0, 0x5, 0x1, 0x2, 0x40, 0x4, 0x7, 0xa, 0x8000, 0x4, 0xffffff2d, 0x0, 0xffff7fff, 0x2, 0x3, 0x6, 0xebb, 0x8, 0xfcb, 0x8, 0x1, 0x9, 0x6fe68a84, 0x200, 0x1, 0xfffffff9, 0xb, 0x1, 0xab, 0x9, 0x7, 0x0, 0xe, 0x10001, 0x8, 0xa, 0x6, 0x0, 0xa1, 0x4, 0xffff519d, 0x9, 0x4, 0x2, 0x3, 0x1, 0x2, 0x9, 0x4ae, 0x8, 0x1e9, 0x9, 0x101, 0x200, 0x4, 0x4, 0x1, 0x5, 0x5, 0x7, 0x5, 0x0, 0x7, 0x80, 0x2, 0x2, 0x1, 0x5, 0x101, 0x7, 0x4, 0x9, 0x7e32, 0x8800, 0x4, 0xf85f, 0x10000, 0x800, 0xffffffff, 0x7, 0x4af, 0x7e21, 0x1, 0x5027, 0x8, 0x10000, 0x4, 0x3, 0x7, 0x680, 0xc1, 0x2, 0x7, 0x8, 0x401, 0x74dc, 0x400000, 0x401, 0x92c, 0xffff32d2, 0x4, 0xafcf, 0x7f, 0x5, 0xffff0000, 0x0, 0x8, 0x200, 0x4a, 0x4000, 0x0, 0x9, 0x10000, 0x4d4fbb35, 0xb2, 0x4, 0x5, 0x0, 0x100, 0x8001, 0x6, 0xfffffff8, 0x9, 0x2, 0x7f, 0x2, 0xc, 0xa, 0x94, 0x3b0, 0x401, 0x118966c9, 0xe56, 0x8, 0x4, 0x1800000, 0x6a, 0x9d6, 0x200, 0x2, 0x40, 0x7, 0x8000, 0x7e, 0x4, 0x5, 0x7, 0x4, 0x3, 0x400, 0xe, 0x4, 0x5]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x1, 0x5, 0x53e5, 0x7f, 0x4, 0x3000000, 0x0, 0xf0000000, 0x3, 0xfff, 0xe, 0x7, 0xf6, 0x1ff, 0x3, 0x800001, 0xfffffffb, 0x8001, 0xff, 0x0, 0xfff, 0x82, 0x1, 0x5, 0xffff, 0x6, 0x1, 0x7, 0x9, 0x10000, 0x0, 0x5, 0xe184, 0x4, 0x1, 0xadd, 0x1, 0x16, 0x4, 0xa35c, 0xc, 0x80, 0xff, 0x6, 0x2, 0xd, 0x4, 0x4003, 0x5, 0x4, 0x401, 0x4, 0x4, 0x1, 0x3, 0x8, 0xfffffffc, 0x3, 0xc1, 0x0, 0xffff, 0x80, 0xfffffff1, 0x7ff, 0x9, 0xfffffffe, 0x2, 0x6, 0x80, 0x200, 0x1000, 0xb11a, 0x0, 0x5, 0x8, 0xf49d, 0x5, 0x3361, 0x435, 0x7fffffff, 0x2, 0x6, 0xc4, 0x9, 0x0, 0xee2, 0x2, 0x401, 0xfffffffa, 0x8000, 0x2, 0x0, 0x5, 0x5dd3c81c, 0xffffffff, 0x7, 0x3, 0x81, 0x9, 0x5, 0xfffffffc, 0x2, 0x1, 0x8, 0x6, 0x0, 0x6, 0xc, 0x8, 0x6, 0x100, 0x1, 0xb5a, 0xa, 0x4, 0x18, 0x8, 0x31, 0x1ff, 0x4, 0x9, 0x400, 0x2, 0x6, 0x7, 0x9, 0x91e7, 0x5, 0x7, 0x81eb, 0x400, 0xffff, 0x9, 0x9, 0x6, 0x7, 0x6, 0xea, 0x3, 0x9, 0x4, 0x3, 0x7, 0x0, 0x8, 0x1, 0xbf0, 0x7, 0x7, 0x66, 0x7, 0x6, 0x3, 0x9, 0x0, 0x9c4, 0x7fff, 0x7, 0x800, 0x5, 0x9, 0x10001, 0x4, 0x2a64aeea, 0x0, 0x5, 0x2, 0x1, 0xf, 0x1ff, 0x400, 0x3, 0x3ff, 0xb, 0x39, 0x0, 0x8, 0xffffffff, 0x0, 0x8, 0x6, 0x9, 0x2, 0xffffffff, 0x401, 0x9, 0x800, 0x9, 0xeb, 0x8, 0x6ed, 0x5, 0x2004, 0x4c3e, 0x1bd, 0x381, 0x4282, 0x4, 0x7, 0x1, 0x4, 0xfffffff7, 0x5, 0x7, 0x0, 0x46, 0x9, 0x3, 0x3, 0x6, 0x9, 0x4, 0x1, 0x4, 0xfffeffff, 0xe, 0x3ff, 0x80000000, 0x7, 0x80, 0x7, 0x42b, 0x7, 0x7, 0xfff, 0x5, 0x8, 0xffffffff, 0xffff671f, 0x7, 0x4, 0x80, 0x6, 0x4, 0xd, 0x1, 0xff, 0x2, 0x5be228d5, 0x2, 0x0, 0x8, 0xaff0, 0x8001, 0x3, 0x1, 0x7, 0x0, 0x51e, 0x2, 0x6, 0x4, 0xfffffffc, 0xd97, 0xa8]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x4, 0x6, 0x0, {0x7, 0x2, 0x3, 0x10, 0x4, 0x8}, {0x6, 0x2, 0x9, 0xe23, 0x100, 0x5}, 0x7, 0x99, 0xef2}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xadd1}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x7fffffffffffffff}, @TCA_POLICE_RATE64={0xc, 0x8, 0xffffffffffffffff}]}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}, @TCA_RATE={0x6, 0x5, {0x2, 0xe}}]}, 0x8c4}, 0x1, 0x0, 0x0, 0x4000000}, 0x24040084) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) 2.824543976s ago: executing program 5 (id=3352): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB, @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x0, 0x34014c40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000008340)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0xfa, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000240)={0x90000010}) dup2(r2, r0) 2.497315717s ago: executing program 5 (id=3353): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000240)={0x0, "08000000000000000000000000000000000000b582000000010000000100", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r1, 0xc0303e03, &(0x7f0000000080)={"6739669f274d13b691ebe45b00e4f5b53e0ca34dd02acecdc67c5e3126628168", r1, 0xffffffffffffffff}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f0000000080)={"000c00816800df00"}) 2.335182872s ago: executing program 0 (id=3354): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x43}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) bind$tipc(r0, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x30, r2, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x1004) 2.287452355s ago: executing program 1 (id=3355): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_test', 0x80100, 0x9c) fsetxattr$security_capability(r3, &(0x7f0000000000), 0x0, 0x0, 0x1) fgetxattr(r3, &(0x7f0000000000)=ANY=[], 0x0, 0x3) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000065"], 0x78) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000bc0)=@delpolicy={0x68, 0x14, 0x1, 0x0, 0x25dfdbfb, {{@in6=@loopback, @in=@rand_addr=0x64010102, 0x0, 0x0, 0x7, 0x0, 0x2, 0x80, 0xa0, 0x3b}}, [@sec_ctx={0xc, 0x8, {0x8, 0x8, 0x0, 0x5}}, @mark={0xc, 0x15, {0x35075c, 0x2}}]}, 0x68}}, 0x4004040) sendmsg$IPSET_CMD_SWAP(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)={0x34, 0x6, 0x6, 0x301, 0x0, 0x0, {0x5}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008001}, 0x20008854) 2.2409112s ago: executing program 5 (id=3356): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) fanotify_mark(0xffffffffffffffff, 0x1, 0x4800003e, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) openat$ocfs2_control(0xffffffffffffff9c, 0x0, 0x26801, 0x0) syz_usb_connect(0x6, 0x0, 0x0, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x10, 0x0}]}) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x6c2, 0x80) ioctl$VIDIOC_QUERYSTD(r1, 0x8008563f, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000c40)) r2 = socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x10, [0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x2], 0x0, [0x0, 0x2, 0x5, 0x0, 0x7eb2, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) setsockopt$inet6_int(r4, 0x29, 0x4b, &(0x7f0000000400)=0x9, 0x4) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(0xffffffffffffffff, 0xc2604110, &(0x7f00000001c0)={0x0, [[0xffffffff, 0x0, 0xfffffff9, 0x8, 0x7, 0x6804, 0x0, 0xffffffff], [0x1, 0x20000ea, 0x0, 0x2], [0x7, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1000]], '\x00', [{0xfffffffc, 0xfffffffe}, {}, {0x0, 0x1}, {0x9, 0x4}, {0x4, 0x1}, {}, {}, {0x0, 0x100}, {}, {0x0, 0x4}, {0x200}], '\x00', 0x301}) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bcb7f620e90f01d55023010203010902120001000000000904"], 0x0) sendmsg$nl_route(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@bridge_getneigh={0x28, 0x1e, 0x3c964e403b131b43, 0x0, 0x0, {}, [@IFLA_MASTER={0x8}]}, 0x28}}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x0) syz_usb_connect$cdc_ncm(0x4, 0x76, 0x0, 0x0) 2.173408832s ago: executing program 0 (id=3357): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') preadv(r1, &(0x7f0000000580)=[{&(0x7f0000000040)=""/103, 0x67}], 0x1000000000000212, 0xc002a0, 0xcbea) r2 = inotify_init() inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x400017e) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x515001, 0x488) ioctl$XFS_IOC_FSBULKSTAT_SINGLE(r0, 0xc0205866, &(0x7f0000000180)={&(0x7f0000000100)=0x7, 0x6, &(0x7f0000000200)=[{}, {}, {}], &(0x7f0000000140)}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000014c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x68, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x3a}, @NFTA_SET_EXPR={0x2c, 0x11, 0x0, 0x1, @target={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x4}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0xa, 0x1, 'NFLOG\x00'}]}}}]}], {0x14, 0x10}}, 0xb0}}, 0x20000800) 2.13440941s ago: executing program 3 (id=3358): ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, &(0x7f0000000940)={0xa, 0x0, 0x7, {0x3, 0x1000, 0xfc, 0x870}}) 1.949450614s ago: executing program 3 (id=3359): syz_open_dev$video4linux(&(0x7f00000000c0), 0x100000010, 0x42003) unshare(0x22020600) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000002000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e0000001e6ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e20e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e210a0101000000000000c300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e21e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e22ac14142000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e220000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e1f00"/1295], 0x590) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8983, &(0x7f0000000240)={0x7, 'vlan0\x00', {0x8}, 0x1}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r1, 0xffffffffffffffff, 0x0) 1.913511438s ago: executing program 0 (id=3360): syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0xdc3, 0x0) syz_open_procfs(0x0, &(0x7f0000000600)='fd/4\x00') setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_SET_GUEST_DEBUG_x86(0xffffffffffffffff, 0x4048ae9b, &(0x7f0000000180)={0x80001, 0x0, {[0x7, 0x10000, 0x100000000, 0x7fff, 0xfffffffffffffffa, 0x9, 0x7, 0xffffffffffffffff]}}) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r2) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r2, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000006c0)=ANY=[@ANYRESDEC=r0, @ANYRES16=r3, @ANYBLOB="010326bd7000000000002b992d9300000c00018008"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040814) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x69, 0x0, &(0x7f0000000100)="b9ff030f6044238cb89e14f088a820ff43052f002000636777fbac141443e000000d62079f4b4d2f87e56dca6aab845013f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c", 0x0, 0xfe, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) fsopen(&(0x7f0000000080)='xfs\x00', 0x0) 1.899210906s ago: executing program 3 (id=3361): r0 = socket$l2tp6(0xa, 0x2, 0x73) recvfrom(r0, 0x0, 0x0, 0x2000, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000001000/0x3000)=nil, 0x30000, 0x0, 0x11, r1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000006000)=[{{0x0, 0x0, &(0x7f0000000500)=[{0x0}, {&(0x7f0000000340)=""/183, 0xb7}], 0x2}, 0x4}], 0x1, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r2, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xe2, &(0x7f0000001180)={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xd4, 0xfffd, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x1, 0x4e20, 0xc0, 0x0, @opaque="20cace031ff836314a5b7864e4c973d44ebf0ebe7d4b0c5cf10488690187d24275800c483561dd3caa3dd14d3e2392f85906e5809858a109703a17a82288034ea567930e793a5cb0eab3c4b7a8e777439b2b2fea578ec6a85ad0256309047ead4f9d937f9841e9101c5fae460e314eaeb2e7361a9987b91706a58945948a12ffee7a6a09e9a96526f175bb0c73c7bb4d0d82f28984e91f00c059fc38793e8618284e52dc4af0a0ca764e5abda8b0014f786df04ba5c097a8"}}}}}, 0x0) mremap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) r3 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000240)=ANY=[@ANYBLOB="12020000402505a1a440000102030109025c000201fcffffffffffffff01020d0000382406000105240000000d240f010000000000eb6700fe05241a0000000905810300020000000904010000020d00000904010102020d0000091b82020002000000090503020002000000", @ANYRESDEC=r0, @ANYRES16, @ANYRES32=r0], 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write(r3, 0x82, 0x5, &(0x7f0000002340)='hello') 1.865871388s ago: executing program 1 (id=3362): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x18, 0x2100000000000000, &(0x7f0000000580)=[@request_death={0x400c630e, 0x2}, @increfs], 0x0, 0x0, 0x0}) 1.782953747s ago: executing program 1 (id=3363): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) io_uring_register$IORING_REGISTER_RESTRICTIONS(0xffffffffffffffff, 0xb, &(0x7f0000000540)=[@ioring_restriction_register_op={0x0, 0x13}], 0x1) madvise(&(0x7f000072a000/0x4000)=nil, 0x4000, 0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000017c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}}], 0x1, 0x0) socket$inet(0x2, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x25, &(0x7f0000000080)=[@in={0x2, 0x0, @dev}], 0xffe2) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000002200), 0x400181, 0x0) getsockopt$MRT6(r4, 0x29, 0xcf, &(0x7f00000000c0), &(0x7f0000000140)=0x4) writev(r3, 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000000c0)={0x1, 0xaa4, 0x0, &(0x7f0000000100)}) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000180)={0x1, 0xaa4, 0x0, &(0x7f0000000340), 0x8}) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) read$FUSE(r5, &(0x7f0000006340)={0x2020, 0x0, 0x0}, 0x2058) write$FUSE_INIT(r5, &(0x7f0000002180)={0x50, 0x0, r6, {0x7, 0x27, 0x5, 0x1dd880, 0xffff, 0x81, 0x0, 0x4, 0x0, 0x0, 0x1, 0x2404}}, 0x50) read$FUSE(r5, &(0x7f0000000100)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_IOCTL(r5, &(0x7f0000002140)={0x20, 0x0, r7, {0x403, 0x4, 0x8, 0xfff}}, 0x20) syz_fuse_handle_req(r5, &(0x7f0000004340)="265ed300624cee917954148609d0f2ac52561da46fe5c8ce8b3d649d8b59dfb0c633a2151990de893de399d507986121aa114fd87163065d2988807d3e0953e6b084d8b607280f9207193bb76a79bb6d4f638d070435bddb76667d5dee6329e71b2c9befbb22bbde0c1b6da63b845f2c28d2c5f4deb07b4ae015fc576702112f75a755e76b6dc450719f63cd1939961e4c895f9054760c61f933bf74d185520f9aebaf3ab397a2089640ec41ab5cfe6c828b53c4cc544f9812034c719e712532763eff6e69ad7cc4d2f29f97ccce18f298ce417251430929d422e21cac05093609d97896d0beb7d4cce9f1975f01e7dd29ea061a868bb6607b7cf88a2e33dd5c5db31cbead98e06c2c7add9012b0483fe662532c81ab1a1ca8f20f1cd9020e06c2bdade3f311d08b47503b5b63b279a9be019006e6929670f53d5688c194e9f046d2322d71bc26245e698cd44d655c59b2e0ff43771a386abc38cd6e493e0a475ef525fa78671fd9954e7df71a3b7c7ed90379dffa4fd76f0367eca11c1d8de813979951eccc8c93b4f9fdb4785c0a9d207e65742bdd358e9dfbf29203c36b91fdd78db55b53ad1e713e32fc1f47bf3390f3db8dfbd514b4b31095c818e18b63ebad5cc3b406557f3a9380c5065ab11c64522b1752b2296bb00b7750ab82704ba197f26ab76e35da02ae87d25669d54d212aa680b579773c889902782d1c8067b16ff957bfa70cd8af4c366c1629e871cfb033d46c0d308c3ff5072fd8e23ee02986a128051b8e6dbaa2bc46bdc8772d923f2906eef68015bdb4cd66a2525269a91cbd7336c930c08190a8606d762c768d164d05eea38d63e99e1fab83ce2683b885e1619065acb1bed0bfd63e3cea5c9d7c9994df4036aa17f9eb0850f9eb42b17b19926fd9d814529c3cf4397e3f38f9626f0bb4f229b51c35773cbecc42ba22f8346c9c3a6f3ca7d8b25d0bbf30baf48bde92ea192e2484ef9b2160492edb5f2ce296b0b6b420d020b7d14d780db436b1a23b733051369536eae7c7148927c3ba3a968516039b0b14d9918a41a1bdd5002847e1c3d02f0dc2235857a9797038d164591757820e7d74dbadd42b8903f20434c6ac0f401fdbfcbed5dd3c5b5fb0ce1f9c81e8d1037fde8dd3fef1d5d7af6af8f36c0f4462909dbf694cc6fe80070bd5fac5a5ca4dffae4b2c67892f7c53af3644ffec29ab3d791bd7934ad38929a9d5fb9ecf10b9dec62e315ccb0e0de60bb1620daa8154a4cdec98d94d42ac1a4b5f8da6afcb7dfb53544fbbcaa3aa444182ff25064ace51a825fe89236e850a2c90e1c7db17871ea809c4a11a26f49b213cab87d4a42b747546fb9b15068faf1a8556f909f2c47202e7b65cddc708ded90bdde68725b787bdc2d4eeda60204bd0028f07ffc3052f93eb6343d1b2a9a5292e6574baa4a096fda6dd54f6d39e9462b6839b8ee2426e3fbf42a016dc0963145e602f2b0c351f123df48f608f74b04fc7e9cd018e7ab25bc1c12f8f58c0b2dce5714faa54820ef72f38566e3d776ea2d5b061a2e94710176f15d2221420abad8b8b733de253e602277848e7f1e0eb4d07f5eb0cc4d9f874e632007cbca23a5d7e4109cf5c4fafe5f607149bac37938734b77d9b183cf76014aa61507bd4eb44524e8326c58932c8b9f6a10e334cc602b5b8c956c7cb5ffa099274b599fc9c58327f85553e00263e548c93c89edf7a7c83cc10348662fc344c85378572a40b49ae65972fb40abd5e0a38af48207983f86c7bb6bf9b7853c4b1fb522d135a83bbdbb78130b4df3aa7cfa930868cd5a2d995ca9fe4f64c79485ab19d85b0c82a72f4a09ccab267320a61208ccef13c3546ab0f16e34cdc56d6e48a6d9c14c626528a3b191e3723b19d4388d5b9b61c7aec726b8752455f96e888ba7af82c127796e9b67432d1f60a3470c7bf4b924cf10f06a3e3f64c60c7c2b0fba4d1ebe4e52014b4052c2ba0d5b649c46e5cdc6c7159faff2adad2db2d3db9f4f9e9735ba28b7aa1c6c2fea9dab6c9617160d182dfc13e18f44e73c4377df42080d08a87fcfd46b4a4f30205457ad19ddd473fc3a67153d04e960f1dc7556fb158a1d584eb2bde917792892a30e9cd25d37a318cf06bd6541463adaf5d12adc50252f364ba05f89182018ded2179c23a1fc0b31d87139da39298b8d387446c70c4577a27f6df841d9f43106bc1bf44f5c7a41460e2afc9eea98f8e256919c0befd53d7d015412391963c9ad39a19aad265cdbd609628e1913adc2467b69c00865a88635c46a851e7252cf3dc5c3cc5dcb04e97c0742d1a844556744036c97710dd9b55f661506f36cfef2c6b7305b63f5c33469b33ad09e1b593a7ddfc97777954c71c8e4857ca49aa7e5de0d25d760f633660e1fd783cdc43b00a0ec149cc9c8385807c2f6b4cb255d6a15ac75ef63d0871b176d503f332c069ccfa7a2bacd11999ea792024b35c9faae5bf02bd5c844d04d9680c1fe35c2d90ce808b45932e754e4e1dd142ba5a7bd9ecdf7717094ed4359eba666fbdc1e849ccede72b0b37f0b8bc4f76b99222f8d199de11dbd0ff396236f4a37aab955126a60c9f0d457c7a394920aa9014611e5d994c8373516f061dcc5ac881bdda5132b5ee984b15fd007828401c72df63c2efbc5f0e8545310ce65d0635dc73f0cb1c796c24b7ee62616116c13369ceb74ff8bda64a98e903dfcfd88b3c0c5f86191bcc8342578f23dc70fa6ceebde822ffedb7587a3f204d330be4977bbbc2529cf0ddf4c85b17f1088f48d878e72fb00e15a6144231108be816d2718c360e2fa8a236691c775a9a0ef3559696f5b8f85eec0aa2b1c4f01a2df6065bd31b23dd37718613fcbbb1566dc0607bf487c1a91f2b39a83755a6048e46d02ede0f5aaea8ee9e245d6c37891f5ebc9bb7ad2462b4ea4f1167b8c8e97e2f7b62c1c98ae0b808ee6033818d28a00ee72120820b2227da50d7f66d3318f6acc6398c81e529c5cb0df75e303954c2fa828760c1133fdbdf1fd7675b8634bdb496b054b91672fc7ac344a37bf60988870d54e5baf91334db883b2c69acb50676c2f871fd577747dd1d26c00a56e757b6a0edcd609ef5c3b3ef669ced2af5f19ad19194d04f23ff23546df47bc67ad596672a40cca2e87f8fcc3a318e37c73f9f50bd06926c74078356ddddba42ee273e0c33c2fc6cdd1fd50daa6ed3b7b6ce558f89449fca6d8b05c90639283d44e14a854eb29d65ce5b9552597072cb148ccea15ef430630559293afaf204f22a890fc3009a2bc1b0844a49668354a940fbd0d5919faadfe5cb80e4c93d138ae28269a99c877426298b9ec7f01e9005da2d7977f34103de38b2f65bdc1c899ba96745ca977c46db6003b1ab840e677f0d8960b4e9f71e82fb89a8cc0702739276ec7a040c69e6dc0e439658d420737a2f6cbe7cb1ce904f4a39dbe8284971e527ef50976c89855f75d5e129a09a117a5c042411696f8a3bf02879a287b2b1ea2a6e1adaed0374341113bb8363f33aacd361339c9c06b4bd6e04f8fbf1f120f1992856608426d44abb6cc429a075c7bd22bdffc9493f218286f8eb585001fdf79327c8c17d462cc2ca5b435d444659767150c6e1000a74f001be398a1bb48863d3a4d4a71a4623e1721b003d7d2c038fdb405b814f37a95a6a53bbb365dddeefb83451676c7b57a23dd1d523958e2e2eb8d889c47cb7aa515e9b11b2c3accfe6739a8ef56b7a02adfd63ec9f9232c38e2aef3773a9a7d6f4844ea1d609f146f19e6c46fb6b961b8037e5d9ba34c0ca5c10a668ddc5d6f4c7951732f68c56ad9c1b3e53e09d33d9b377258ab2de957c8adcd4b68923ed6eaf2441e2d888d1d4653c5686ab712a82ca16cf475009e238e5a8df04ca2fa719e6308bd60026deea44355a6e878157ffc7f14a8d34275a9ed5f810ea4ed1827e4c91998aebe9aacbae14d95eed96a9de17463ae852f53d2bf3e92df959564e9550c1eeb0b052c00cd44c07b7f021cdad5c70908a74bca9ec4fa372f491aeadb297e8f571de1b376ef1b7194d8e434ba3867940606521399595be0ec4daab0b45c42e439adc5cbecc7310025ed8761a1d78adf3ee6b223577e473423cece99cde0807269de6929624ed1739b2380ed4688779ce9808595e9b87ed6f42d89b1676014cb8c9a3f7484aacdf794f056439fd1e5233de23141d5b87ca95b54721a01212666e8067cf683025f1219f4d0569c8cfb2d6ed67e7f051e2ef9d0b70a390ac7d53bf9c4e537c74afd223e311341583282ac6e4ab209a591ab0f4d7205512a74a01cd33b57d993fc5c548a757d757e1f32272c22b86fb2428b338eac75c21e4ce3fbfdc6f04a62856610308e65dca82a7637d7113a48c6ce0357fa454f6d58a1b61698c7b65dc9b8678f9d279b883f76e04ad1f1154e2f490afb7e397ce65ce297f6599b0671f3129bc87cf4221d8ce101f71a1df23b6343dc3d6e35ee2eb0a1e37e67e091fab994b8948e956320d7e512308641a129526ff2e73ba026fb72fd3da3482fde5374d54bc3ed6ae53f2b9b4d222db5f3126760285683ecbbd0f8b5bb964e5a1cfe404ce21588a21c2244e0f76520e139992f65a15299548f4dc5e4d1e54acf7592ee1f04e36987606bf10e4632c79d00e1ed985553b00a8e828dd193f5cbd7101cd36745804d474532fc51e708c7f124bf9231b9a7bd1ca4446060535054b4bfd5a61607f3ae45cf1deebfb9d8710e5523c8cd03565cd378e77b1b3323a7d97f28fd1a13aa40626abf69d7b66ee9db3d604b293966347a4fb36d089078f9808bc209109690ea47941ad7c141767b78eee93131a57b5e12690b7288ffecf22f39f308a80457ac6052b8f477bafc15a3ab30cfa3cbd7dda9803e5a5664694e77f528087de197c02fd4d133ea9133b9aa4377bcc0b62801982b999b6e7f76dff371dfd998704e340b4e5da88384fa8cf08d747c977105e4574bda02c56361338a0a9bd800e94c861a31d5d64d71cb65c0655f5b5cf5f900e348d7cc05d9c2dcf711859cbb8ffa54065e2e5462f4c1d80d28e5d5400090d4bf61565422b8df0f34f7a7c1e153d39c9d7340d15b8db226d323b4e3c50fd8aaa87ec9e5c3fbb3ad66462c6ec5ff31877024d119fdb7a16e69d324ca9819512c45c3852409f4899a41a4d16ca77dc3dba1ffbdc2af2fccaba1f04e048444154d5019a267bbcd440d7bb3516e9741e5f9c3ef1135e8c0d70e3c7800c10c000e9cfbddbb5aba9e43b3dc0164f92733590f6921bfb53aa1466a53b6146113795fc13d1621b3cbe0eadec02c469a4899232c23a5a88a9d659984c22ee523b5c5de84223a0f0f9bf1fcdb1efb4709252c0fab477823bf2505f9a2e4a36d0bdae824ecad15a4c313f0c9eb4423ea249710e353e61264630927f778c01978f5b50213d71fd746e40009432bf50b7932b7659942f0d1b6375b87d9b038ce271d7333ed282beb3925a330d881ac7611d3e8b869601b146fd82c06b340ae4823c4c429af4c15f2a2a2bdf383788e86b68c001866a86188cfd71b02bc8abef13703264f3ad08ff6602e15ff84715b7796541c87e26b0c6e086211943e52629f8c1e71fdaec972ab5a2c690c78b08d65651ae4b64070f7bb37931119881ef14c4c8e228d67d34f1c9eb855b39ad6e615bf24f7b453a76547edf2fa025c53bda95d783fb3f735852f28318a8a67c8ceb5279d380d724ee6eb2e76ba8807a0865fcafac50d09a92b85d27a238e4461a80cbbeaed62a844c17e498f6457aa642ebbd0aaeabf127b8f8fbdc2e28ff7fafaafe3016603461f256d7fca690a8643b9697800b3cd59e09ecae48baabccb63cad4a627f6bfba0759f1c186977e9698e6fbc16ec9d1c95ca8e2e075a1eed3ba6223e4df44be7da59a444715a78fdb90a1645c069ca0fd1609b7dce29ffa11f17266c32856f9ebc853c0c7cbbbd82667a5106b5b63f5328ae9d653dc5dd53194988f0e421db3851eee53c557e40a7ad293a22ffd3445d296347cef4187aab3c9c3c2a8e40be66919c30cef3de8125f3cc7342a43791cf1b3b117af99b04e0fd8170f17f4ba25bdcb24965501025188a430df86239d369a6e2c9245e914fe4be3a1eb48e22e2e1c72caeb4b0d1b69e8a817cc7ddf644d33e56ae32215604f267a80754619440ddb3621280a4b388c14ca19dfd398d744977849247d0bbc55d5a54ef062ad3cb3689168b28a0981946fa01737e081101b9c571d0ec4e5775159daccc110588fbd35bf6f0d55f99da967a3d3db1999e158958d7ce128571efaabc09c1aa7137c35f3edf7cfff386a79ba5acfa974366c442207a39ce67afc8469c2ddc6f45413dd654d9f59ae7fd31115dfeccc43c27bbcffab119106735b7782f9694a3e30159aee341f04540a54443562cafad5cf3336c6e900332b053d7c93bab45d8846cb5b880e11b979c13dfea06267932d89e258ef30768ec2ce1d7b020609a5ea6ad9eda78219542567029d1d4d2ffe797b7f95f16b8f599390b0b630decdc6e17593b7e4992d48e62c27cca2e423eded85cd4b436065496984d59044d38f317d0ba649837e5377ab3793c3f66c0509eb37ba365c94273b3cad97c5f607bcd312cdf3c8605dd5569e293d21c588969d7bfb17a228b53f2cd0387995945253c6ec8fad3777cafafcbb9151a54e653a142b5ad0c62682b8ec4b99f525dd853f75c17ae6264b7bf975138de9932d40be9f35ce25dd2a1e307fcf506eb6db8803c19b9880f96299ef58a6bdf32708346db540dae112b0f7ebfbe6f3f46635b7d98e232cc91eff2aa9c7fed6dd53d448db2fb8fc4c0dd661d47585c7966f9338f165e53b3d7777dd844be6a6c8885d95b839a32ea0bc83ec0ef8a5bd11b666d11fd8e27561d8afc4686e978ba31ff2f812f81a6a82956b95a0cce2966a37a4b9e33bd297ab8b1667f6ca5a6be65e4485a305651a4230b7a010a960b035dfb7a8474dec1965c6a9177f62484817807e0dc43ab2770b27adcb40f76c0e78639c55fdecb6c008f2e859ed496818b48e5fbe32376fb3c434afc0ff780867e7374a8d659cc1580e49678f4542e5cd3e54d5f4bd1ff6d186827d588ace5a8adf437dea11def7b57b6b8c992b86695d09c65aaf532d6b8cf12686df8b07bfb5a8aef7944f04c8bd00d500b8b7eb24516dbec0f5514dc48f70eb26a2b78042fb6b4726a20fcf73ccc9a14b75bb82e558e8bc4f7ff5453850f83d12896e9abf322e5b81b6efe679c8c98ee092e06302f9f1472931dbe5a815ac38b1bff79363c4f846caa755ab3ed5b60a938d5f1a9e10950aaa0c5d10c5c4f09abb8ce6b98867e6f8644e3b9d603f07f9c2d1044600635d432ce796b0b96baf572238711302f8fe486f3bd4b5a0463eefb0cb04271393cb1b47b033db62840b4c535da356de3db90961deefbf43060d57b303489aaf9c3bed935f8750d47b8e6aed8eba71f08d93246c92c7cfddea99f6e052bf18e787aca4cc04779dda1f67a420cbb5fbcee2f2ae28be664fad18b478e171dc3699116ae71421b86a5fa9732767c994f38519874b33f07b12b8baa5bc672017cb1e2c8e8897e541358da9a9e3bf8bf57ad3541fb434534190ddb95a5ad701e20548b269268fef7c20c15adb8a86dc8ed756f760370ef2bfff1261349b535b77f67a4118dc8f95c70e977ae39c7c77f2d4e2248028439b72325c033c68684fc8dd6050f0449e2c87debc00fb8bd5d1d9b9f31219b4243cb089362b345f2b9aa7089eb618e1407223ef1022dbaa856197f6cd8dcb7fc53afc16731e0f21b45a17fdc2c49bfd9f14e454c98536c507c3aca95ad57be395ea9d737a4a3237825cf102ca080e013230cd7a46e91237b2214a2b175ffb390ac9f12e5dd3124ffe1e152e148371425c6ae5c603715d5439e0f9e49e8048b56489ce79c26df2dab6ad0c8ac0b37e5d4fe10061f44f3d2314e1ee6245ed600c62a9c448faf905267cdb125ed7dd2a7a539770bd1ddeefd13a521991cae16160cadef434edc23fec333ec7b328c4a6213c5040848e835c6b3e0aebcae1d5884f7e8f654adb512c2f0227fae83ddae0dfa848e0ba9344404ef1d6da880f8eac71fb7e02f197859fdc1ec634dca3f46932e5f022689ed253e60f232e1acd96fce398961d62c4d63d7f37d48c26175298658c224bc1db73b8baaeab139065a9bd004bcaa24493c17f09961c09bd0cb828a8cb3cab56df2991646ff370040bc8507d3d16e66dc075c8d302c6586dbee27b32f93ea563a2692f65ada174e35bcd8cd3214c1a38cc00c90067828b9980da7dec04fbeaa2e550c8d06358ab446853e7daf007b0de5c9e361d75c40ad5f9f2923c10ea479e5852ad35f232d6d141ca7b4328c9d72dc5c247d1431688b2a325d88582733953ee50f997a5d8324cdcb01fda11a773093f344fb38b55c5f9e7706e1024cfb4f2e47544ebbaf792de3c4d8f1522e9d9ce73fdaf1740d3dc134a78b53c6167aec45c730016b8ad9d9bc4042b6835a5ff34c9d36da7418719a86be6637c896fa4a4eda862a9e73ab97e5a977aebf0fe64a7d507dc210a677873e155fe4b2cc3a96e558f4d54db6fc5fcdf166c4cd58bb5d1721378ccff170c0eba14b990ef610606909c205e34aabd15eb7a60406df5451871b18ae3cfb5af37b7f7bb2be80590d3be02c5d0c4143be66efcbe13c6927f54ed27884b3d6a73e90516552a0bbd81f7c76ed5f84ecfef2225e52b9cf6021895716aa29b540750eb64b31cd7be1e9fdaaf132681b23cfb2742fbeb4d1f40fd0bb1d13ba044b252f2f04b0d5fcb121977486c5754a569b81be7577cc0c9e918affbf9abc1b6dd567aab66b7e2aca396e79d53ced9695a65a704bbd9700b55ac8c968c5f43557060c6507a3557c8762a7dc8263eaba22d51fb7df435e20beeaa700609d774d1e212e7493b672324e1a907fc1546cdf7d4ff88029dd7e9c92fc530e3f55b6c1b103c69f14859524d07e454a3c5f987e01d21d9a5a6f842370cc3dadcde1b5822b0d0c47883dfee62b9b7209c3a7c399ed34604e164f806e68a5a24a53d0c5beccdc1389e87a5894061f95e7e8e8bf84ead6e7fb155938230f22b426d9041e8bea72dae14911824db9b65bb0ea0d0404cc8fabcb8f1863e13c8475beb68138e043dd67bf1b0d7e038f9f3d25c8ab1a52173af6b46d8260d677bf066058e89dd18b03fa20e79938dab01876102992f9df49dbe983526b9e0bc83c15cb9d52511eff20d18dcdd316bf334b98aed9024051b87bd3d767054470f4b7f59a207e9b9f17827497bec146aa1b0d18ef54ae5927c64b05f34c8508a0cfea02cf59b3c97a1d3e83a00b7ca495167f411b3f41c1409a8ac007e1cb08ef83c4cbe38117d4b1ef9b58dc0092371b1dbb1a1834f780282dc2f3b6bf36fd0dcc7619c28785b76910757376adfb014ca9ff8bfa3e291e7cba2caa05efad48b1506337b61f74b7b0f4abc18846af682f34708bbee9dee76837bcd192876d1861a20b3e77c9984aff5ebf0a2a4741d6e43b4ac056ea138e79230144578bfd4ae82b84ed109e4d5ff0f955ca481ac0231cae963b7d4db76d89d07e265973a16899fb3a6f8dba53473954589134b520e680f4c5e707fd056e75edb194004b81a40bce0407b6c294078b77e8abd8873c01f6918b2c7c6095c9f23b9841e90e8acde53ba60cd78911cac6fc2ef6bb5fcbb0d3da3e63d70b47495f2177afce5da37c59efde49aae133761847a6f0c8aa374790522ba04d466bd1f7860f53371f5eb2f506c5bc7bb6ab449e4a5c37866c31684b285cf5da17f36434b809f69c542c989449fd0eca50f5eacf8080cbbe8b84d1183095ae7416b8f2b98311451cf7cad2d8fb721e589f9e611376430359cf855444fd1415011e8c313834bf0e217ac7b03f8add941427b0d15b56378b2cd1e3925008c16cd5f95dd149c7e050e0a153e4333e63bd14816b4357fbaa5f706af6ee225057eb599bbe5714c9ff23204d1902230569839d8836e6b2525570b00eca8534aa0c29cf62dce61ec66d9c195be81279b698ec8565fd6754f636b9288247657efdb2b6356a82f014a1e6b24926fdd67810ef0a01295c664980f2057ca17362b0a5888c23ac21842f931a7d57cdeea73c4848c6c1cce20be979faa611f86509ce031fb4102a0fd30bea4f4f840c75d238362a2c4f8de16e81733ca90119f8c1ae148b184d0b113685594088ad8a947455dcfb782f8beb69e255dbed46ae2ee6f094168a52501fc68ed669fac390cd9320ba16d69c86d6f642aea836bb1d7c14593f15d8d33d452d8c87003d7ada1995e2b43f788b4ab00ec6f58869968f098218a3ca21a6f369d47a14cd3de7de8357902e8ecfb5f2e6beb5d3d32a6a6224fe3d6dc5c06eb117af0ab396acfcae58b2b1b9981cc71cc1cde07491b6b6d97e04c10ff216393dd28737d31c8f2cc9ebe161b96d407088b2bc456c331b676a0d7dca3df7f7080697d154fa14f351fd467e30b4ac3f4eb7b4adfb173ff20594cfe539c775c4275795d54782bae4b59cc64a45740ff73d21f5d6cf39e10bae4fbc48ac7799023796d7408ff9220a07a49552b18c5e35f98082297d2b4a0932e4d224c6807d49bf9b5de2eff1a8130da56124ecb5509241fe95be11eb0df066f5f819bc7db0f1ee90ea0aaf4ca4458ae7b5105d574de028c82714ad0d53bfc8ffab31c57762b38e433d6991d83ba5616162e27e8ac122c145547c4abe18260c6d32c755a44390ed41241ef375e1f5a4311263881a02dae71f837206413fc37ddf40a9bb72256d1625ee0b94c1c5715809bdb24224cd0698a5802a83e2328dfa22b80e31b9a5c7dc2fe0c68545905368806c308334c194803eed4a24a96bc5021b837a293dde7ba22b9ed27369b3584deda6489bd1b3fa2925beeacb7d3be367fd014547f82b4561c0120978b6ec2b32ac2634589b819a2c94fd20c081fe9eac7b0745f73a1981e21b05b1bd97a9a1d7218c0e6d0e473e15a1a7465cea98ba0c72af2f270b6a61bc51d1a0a9603b91fcdcc7314fe7aa007ecffe6c7eebf5a65e82a96325e86f9aec39feac6eee9501495c74000ec1f0923e79ad1fbf6dc581539047537794151473e00be353b3b8dbb6da0053826c7bdf16c43867cc9cab9d1220466ca29ef2d6172c4c0ff9067eba9d9775225efaeab1b8c634b4001d2a5c01628bd5550c4573fa017afa3f501f1a6b7d7a483dc0885ab9c2ee959a596ffbb68c7ea99e48f4304697edf7fdba5567735ace3433c15aa59863f87e4605206a31ccf268588de7ed37fcacf6bde80c68ad53de63feb4399cce137c5776abd15395402af07250938aa1c466511bd5754f9cf2f938faa37a683996c801c8fc8aae36a706c5d6e2d36e96ab77eec817ce4d56d2bcf5a43702a883b127a1da8b6ceae1b82573a9e9e9e297560f8d65a1f5fd4bf3d45af0841e691b6e637bd8b9f7c8e51b813b818b0baf2d9c5c9d116781d327b4b43309c7265612089f1dce60a41fd0aff4bcd1335d696f01cee7b371e13584c731a3c3ef7e1b9f3f41f91c4dc647b948c93a99c1ae79f5f530c68c3cc28bbd", 0x2000, &(0x7f0000003840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002440)={0x78, 0x0, 0x7, {0x1, 0x0, 0x0, {0xffffffffffffffff, 0x0, 0x3, 0x8, 0x2, 0x0, 0x200800, 0x0, 0x0, 0x4000, 0xbca4, 0x0, r8}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 677.766783ms ago: executing program 5 (id=3364): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/tcp6\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000180)) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x4, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x101800, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, 0x0, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x11, &(0x7f0000000200)=0x79, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0xfba) preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000000)=""/216, 0xd8}, {&(0x7f00000003c0)=""/55, 0x37}, {&(0x7f0000000180)=""/29, 0x1d}, {&(0x7f00000001c0)=""/81, 0x51}, {&(0x7f0000000240)=""/181, 0xb5}, {&(0x7f0000000300)=""/37, 0x25}], 0x6, 0x142, 0xfffffffc) 207.459656ms ago: executing program 0 (id=3365): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0xfffffffffffffe38, 0x2, 0x6, 0x5, 0x0, 0x0, {0x7}, [@IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x0, 0x7, 0x0, 0x1, [@IPSET_ATTR_PROTO={0x0, 0x7, 0x31}, @IPSET_ATTR_IP_TO={0x0, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x0, 0x2, 0x1, 0x0, @empty}}, @IPSET_ATTR_IP={0x0, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x0, 0x2, 0x1, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}, @IPSET_ATTR_MARKMASK={0x0, 0xb, 0x1, 0x0, 0x5}, @IPSET_ATTR_HASHSIZE={0x0, 0x12, 0x1, 0x0, 0x7}, @IPSET_ATTR_BUCKETSIZE={0x0, 0x15, 0x2}, @IPSET_ATTR_CIDR, @IPSET_ATTR_TIMEOUT={0x0, 0x6, 0x1, 0x0, 0x8}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x5c}}, 0x2000c000) 16.203428ms ago: executing program 0 (id=3366): r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065ff1"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) r3 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x100) lseek(r3, 0x1, 0x1) getdents64(r3, 0x0, 0x0) syz_usb_connect(0x9, 0x335, &(0x7f00000007c0)={{0x12, 0x1, 0xc8092c742eac96e, 0x25, 0x98, 0x79, 0x40, 0x1b3d, 0x189, 0x9d31, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x323, 0x1, 0x1, 0xfa, 0x80, 0x99, "", [{{0x9, 0x4, 0x49, 0x5, 0xd, 0x7d, 0x74, 0x67, 0xff, [@generic={0xa4, 0xf, "09cfb468ed051bfc27567fc8d5a6def96651830797085b024a7311da606d436ac13d5b19941b0de9b2a3906434ee922248c0e85f96e8863986792d1e3b1de3cde362fd682e12f0e5ec161dd3c54ab37f53f193f25f8e8de570b52da5318b2dcb1c06db79ea387f03e7f102b906e0563774c16eeaec09c4994a943ded5e1d454e1b08c0441e30a9ab9b008be14e87240953e777865441bbca199568b852aa72c72146"}], [{{0x9, 0x5, 0xc, 0x10, 0x3ff, 0x2, 0x46, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xc, 0x4}]}}, {{0x9, 0x5, 0x80, 0x10, 0x20, 0x3, 0x9, 0x32, [@generic={0xc4, 0x21, "b9fe32f7f0d6871237b2fc526ca9644a947389c1f436c1b8ca1dca1c11b407b8036dfbbb9c3d194cf7ae2bbb1350467c392278f4496de654cc517cae2bf9de06ec8616af49ef9ff24694367afd00adf41a478c71e74cdc47e46b218de6e51f9a88c36af28e32523eed8b08b8c3205283a106c53f5674e75f09ffab8ea226d7c8d9a129fb8ab711fb33036a70504dc620f0ad0ca04dffedea5688719b63f30b99553b6105686ecaa3259488a680969a3c362bc494862d080946e919001f16b8321948"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x4, 0x1}]}}, {{0x9, 0x5, 0x3, 0x0, 0x8, 0x46, 0x7, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x2, 0x6}]}}, {{0x9, 0x5, 0x6, 0x2, 0x1ef, 0x26, 0x6, 0x80, [@generic={0x2b, 0xf, "8a7a47ecccb24cceb9b9c7381e36b1b5a4d6f23f7e6de6ea85bb4e17d90fc1ab192b82b6416b90cb98"}, @generic={0x4a, 0x3, "01f68dbb462ce51798d30f9202e146f0088b3f986d2bb88f7092a0c01e239cf7b3e125ac9adea89d64183faaaf0f8a6b6a055ee91dda59bc1c620158d6874c991ecb48bd31cdd04c"}]}}, {{0x9, 0x5, 0x8, 0x3, 0x400, 0x9, 0x1, 0x4}}, {{0x9, 0x5, 0x9, 0x2, 0x10, 0x0, 0xd, 0x6}}, {{0x9, 0x5, 0xf, 0x0, 0x40, 0x3f, 0x9, 0xc}}, {{0x9, 0x5, 0xf, 0x0, 0x400, 0xe4, 0x1}}, {{0x9, 0x5, 0xc, 0x10, 0x200, 0xf8, 0xf8, 0x98}}, {{0x9, 0x5, 0xf, 0x2, 0x400, 0x9, 0x9, 0x4, [@generic={0x5c, 0x7, "1c0555d07aaa4b23728cc87ec87e94716d8a0f7d88503fc3ebc37dfef603e2b5e5c39abae5b4ebc3287cb1b92267ba2ca6f0079b5dbe6fa72a9393eeabfa1a13433989b5fb1082194e4d881020eef2975f0105cba2942690b394"}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0x6, 0x2}]}}, {{0x9, 0x5, 0x9, 0x8, 0x0, 0x2f, 0xb, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0xe3, 0x7ea}, @generic={0x39, 0x23, "b6c360321f55672b15de01a8a6d3f7650566f0f930a8aa71de7d9c92907de9d72d7422095fd90a57c458b89c3df391fdaba461568692c5"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x3f7, 0x3, 0xf7, 0x72}}, {{0x9, 0x5, 0xc, 0x8, 0x40, 0x3, 0xca, 0xe, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x5, 0xd15}]}}]}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x250, 0x0, 0x0, 0x6, 0x10, 0x1}, 0xc, &(0x7f0000000080)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x6, 0x3, 0xf, 0x8}]}, 0xa, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x44f}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x83e}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x40f}}, {0x31, &(0x7f0000000100)=@string={0x31, 0x3, "7fe48941877d5444505b9227650b1d36ef68e4ad135abbaafdf5c171171bedd0ede621d8c81cd7bbc3ba832d13bdf6"}}, {0x7c, &(0x7f0000000480)=@string={0x7c, 0x3, "1127733364d12c5f107277b0be5f92a21733c192015f5ff0bd705cb1182412ca3e68e84a5eec1cb379efb8a9f7a8e7bdbabfd35488e29d231854a531029eaae67aaa926a44d82c4ef9500f4c09ea1fd5f6dd1ae2b44b75f44bfa62343009bc300b65abc8643d0e43c27b060f4518f1446c477552264effe8b115"}}, {0x28, &(0x7f0000000400)=@string={0x28, 0x3, "2911bf73df6e44ab7bd2143e89a92d3f353c5ac3b9b70cc0103139415cd530d6bed4559191e4"}}, {0x68, &(0x7f0000000500)=@string={0x68, 0x3, "f8f3d15350dbf1311fb8f436f6f09585577a00fe3515a142c7db45357859ea13fb68a9c7019c0746a53bd367726dfd48da380cb93d2136d704e26e0c791061903f521165c2f903d3731fe4bab15f244c75919e6ac46ee0c11343c910bf641687bf8f7eb70ca9"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x3409}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x810}}, {0x8e, &(0x7f0000000700)=@string={0x8e, 0x3, "f8d0b130a5fb8ea8016561bd5c5662786260a0cfa5076d68da1ed5dbefa99f61798720427f1c41a12ffa4259816c122f2ccddb5e967ec7d2146c38a8891a6fa8f33984fbd2b541f560dddc90d46a99d63aa72b03b41b131b91ffc52155f97609aff7ba5a9668394b569bf522b74ed59d5ffdd2d54b897ead06edcfcdedfd03c48da422191d75259258fd6918"}}]}) 0s ago: executing program 4 (id=3367): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x43}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) bind$tipc(r0, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x30, r2, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x1004) kernel console output (not intermixed with test programs): z [ 1344.459968][T17134] usb 1-1: Manufacturer: syz [ 1344.469015][T17134] usb 1-1: SerialNumber: syz [ 1344.606293][T18678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1344.812841][T18678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1344.875740][T18678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1344.897251][T18678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1344.917065][T17136] usb 5-1: string descriptor 0 read error: -71 [ 1344.948647][T17136] usb 5-1: USB disconnect, device number 57 [ 1345.410883][T17136] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1345.451224][T18684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1345.473201][T18684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1345.564016][T17136] usb 5-1: config index 0 descriptor too short (expected 33727, got 441) [ 1345.574224][T17136] usb 5-1: config 215 has too many interfaces: 202, using maximum allowed: 32 [ 1345.584355][T17136] usb 5-1: config 215 has an invalid descriptor of length 0, skipping remainder of the config [ 1345.594982][T17135] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1345.617690][T17136] usb 5-1: config 215 has 0 interfaces, different from the descriptor's value: 202 [ 1345.638994][T17136] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1345.659259][T17136] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1345.688363][T17134] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1345.695742][T17134] cdc_ncm 1-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 1345.705104][T17134] cdc_ncm 1-1:1.0: setting rx_max = 2048 [ 1345.751014][T17137] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 1345.758926][T17135] usb 4-1: Using ep0 maxpacket: 32 [ 1345.767462][T17135] usb 4-1: config 157 has too many interfaces: 246, using maximum allowed: 32 [ 1345.776685][T17135] usb 4-1: config 157 has 1 interface, different from the descriptor's value: 246 [ 1345.786674][T17135] usb 4-1: config 157 has no interface number 0 [ 1345.793700][T17135] usb 4-1: config 157 interface 224 has no altsetting 0 [ 1345.804051][T17135] usb 4-1: New USB device found, idVendor=1039, idProduct=2120, bcdDevice= 2.a7 [ 1345.813916][T17135] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1345.822462][T17135] usb 4-1: Product: syz [ 1345.828367][T17135] usb 4-1: Manufacturer: syz [ 1345.835595][T17135] usb 4-1: SerialNumber: syz [ 1345.909506][T17136] usb 5-1: string descriptor 0 read error: -71 [ 1345.931970][T17136] usb 5-1: USB disconnect, device number 58 [ 1345.940551][T17137] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1345.954605][T17137] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1345.977254][T17137] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1345.990610][T17137] usb 2-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 1346.000013][T17137] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1346.026304][T17137] usb 2-1: config 0 descriptor?? [ 1346.056647][T17135] usb 4-1: [ueagle-atm] ADSL device founded vid (0X1039) pid (0X2120) Rev (0X2A7): Eagle II [ 1346.107734][T17134] cdc_ncm 1-1:1.0: setting tx_max = 88 [ 1346.138732][T17134] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1346.184237][T17134] usb 1-1: USB disconnect, device number 36 [ 1346.205681][T17134] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM (NO ZLP) [ 1346.241887][T17125] usb 2-1: USB disconnect, device number 67 [ 1346.753119][T17135] usb 4-1: reset high-speed USB device number 54 using dummy_hcd [ 1346.910820][T17123] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1347.249714][T18712] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2983'. [ 1347.261275][T18712] syzkaller1: entered promiscuous mode [ 1347.266923][T18712] syzkaller1: entered allmulticast mode [ 1347.304217][T17123] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 128, changing to 7 [ 1347.329604][T17123] usb 5-1: New USB device found, idVendor=0763, idProduct=1033, bcdDevice= 0.40 [ 1347.343038][T17123] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1347.351314][T17123] usb 5-1: Product: syz [ 1347.355619][T17123] usb 5-1: Manufacturer: syz [ 1347.360421][T17123] usb 5-1: SerialNumber: syz [ 1347.522372][T17135] usb 4-1: failed to restore interface 224 altsetting 169 (error=-71) [ 1347.531628][T17134] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 1347.549728][T17135] ueagle-atm 4-1:157.224: usbatm_usb_probe: bind failed: -19! [ 1347.557539][T17136] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1347.570561][T17135] usb 4-1: USB disconnect, device number 54 [ 1347.605195][T17123] usb 5-1: Audio class v2/v3 interfaces need an interface association [ 1347.691951][T17134] usb 2-1: Using ep0 maxpacket: 8 [ 1347.708173][T17123] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 1347.712042][T17136] usb 3-1: Using ep0 maxpacket: 16 [ 1347.742470][T17134] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1347.743027][T17123] usb 5-1: USB disconnect, device number 59 [ 1347.766612][T17136] usb 3-1: config 1 has an invalid interface number: 105 but max is 0 [ 1347.777505][T16359] udevd[16359]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1347.780997][T17134] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1347.805578][T17136] usb 3-1: config 1 has 2 interfaces, different from the descriptor's value: 1 [ 1347.823890][T17136] usb 3-1: config 1 has no interface number 1 [ 1347.830305][T17136] usb 3-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1347.840761][T17134] usb 2-1: Product: syz [ 1347.844985][T17134] usb 2-1: Manufacturer: syz [ 1347.849677][T17134] usb 2-1: SerialNumber: syz [ 1347.857445][T17136] usb 3-1: config 1 interface 105 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1347.873783][T17136] usb 3-1: config 1 interface 105 has no altsetting 0 [ 1347.881857][T17134] usb 2-1: config 0 descriptor?? [ 1347.899286][T17136] usb 3-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 1347.914168][T17136] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1347.924567][T17136] usb 3-1: Product: syz [ 1347.928844][T17136] usb 3-1: Manufacturer: syz [ 1347.934950][T17136] usb 3-1: SerialNumber: syz [ 1347.949984][T18712] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1348.169942][T18712] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2983'. [ 1348.189609][T17134] usb 2-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1348.225426][T18712] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2983'. [ 1348.480858][T17135] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1348.580094][T17136] aqc111 3-1:1.105: probe with driver aqc111 failed with error -22 [ 1348.669588][T18714] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1348.681115][T17135] usb 4-1: Using ep0 maxpacket: 32 [ 1348.701272][T17135] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1348.726488][T17135] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1348.766493][T17135] usb 4-1: Product: syz [ 1348.803346][T17136] usb 3-1: USB disconnect, device number 62 [ 1348.853647][T17135] usb 4-1: Manufacturer: syz [ 1348.938531][T17135] usb 4-1: SerialNumber: syz [ 1348.959578][T17135] usb 4-1: config 0 descriptor?? [ 1348.987940][T17135] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1349.067826][T17135] dvb-usb: bulk message failed: -22 (2/0) [ 1349.078945][T18730] tipc: Failed to remove unknown binding: 66,0,0/2324152034:1095852692/1095852693 [ 1349.103213][T17135] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1349.112358][T18730] tipc: Failed to remove unknown binding: 66,0,0/2324152034:1095852692/1095852693 [ 1349.114515][T18730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2989'. [ 1349.124189][T17135] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1349.141454][T17135] usb 4-1: media controller created [ 1349.147172][T17134] usb write operation failed. (-71) [ 1349.161804][T17134] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1349.194343][T17135] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1349.205446][T17134] dvbdev: DVB: registering new adapter (Terratec H7) [ 1349.220935][T17134] usb 2-1: media controller created [ 1349.230398][T17134] usb read operation failed. (-71) [ 1349.236320][T17135] usb 4-1: selecting invalid altsetting 7 [ 1349.243908][T17135] cxusb: set interface failed [ 1349.248897][T17134] usb write operation failed. (-71) [ 1349.255334][T17135] dvb-usb: bulk message failed: -22 (1/0) [ 1349.266429][T17134] dvb_usb_az6007 2-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1349.301580][T17134] usb 2-1: USB disconnect, device number 68 [ 1349.318648][T18736] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2990'. [ 1349.354372][T17135] DVB: Unable to find symbol lgdt330x_attach() [ 1349.362323][T17135] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1349.414449][T18736] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2990'. [ 1349.493192][T17135] rc_core: IR keymap rc-dvico-portable not found [ 1349.503924][T17135] Registered IR keymap rc-empty [ 1349.518567][T17135] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 1349.543090][T17135] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input92 [ 1349.598266][T17135] dvb-usb: schedule remote query interval to 100 msecs. [ 1349.616966][T17135] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1349.722911][T17134] dvb-usb: bulk message failed: -22 (1/0) [ 1349.782493][T17135] usb 4-1: USB disconnect, device number 55 [ 1349.963647][T18746] netlink: 'syz.3.2993': attribute type 2 has an invalid length. [ 1350.041716][T17135] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1350.092490][T18749] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2993'. [ 1350.192499][T17137] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1350.241131][T17134] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1350.380840][T17125] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 1350.389597][T17137] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1350.423203][T17134] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1350.435228][T17137] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1350.450856][T17134] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1350.464068][T17137] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1350.472391][T17137] usb 5-1: Product: syz [ 1350.484983][T17134] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1350.500787][T17137] usb 5-1: Manufacturer: syz [ 1350.505629][T17134] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1350.514294][T17137] usb 5-1: SerialNumber: syz [ 1350.530982][T17134] usb 3-1: Product: syz [ 1350.541828][T17134] usb 3-1: Manufacturer: syz [ 1350.550899][T17134] usb 3-1: SerialNumber: syz [ 1350.563737][T17125] usb 2-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1350.587748][T17125] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1350.621518][T17125] usb 2-1: New USB device found, idVendor=05ac, idProduct=025b, bcdDevice= 0.40 [ 1350.640806][T17125] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1350.653129][T17125] usb 2-1: Product: 㖘戕꯫Ւ欟ﱖ왛녧Ȍꊴ좠⹶묛㋈関껶왶䮀ëªè¸¶â­æ¨½ìŒçœá¢èˆ³î³«ïƒ˜ã¹éˆˆæ“™æ«ªîª’眖歠툚æºç‘–踾åœëˆ¶æ±ƒæ…—蔭痟죲îœè«šç€”ç³»î‡â­†êœ„ꌬ [ 1350.694250][T17125] usb 2-1: Manufacturer: 긼岡彧௱룛ê¹ä§¼â “阓풽꛼늽é‡è¿ಫâ§ìˆ¯î›„莧ᆿƻ↖솚홬惞ïힷ䀑ä䭮⒆럕㨩뭂ꡤ襠野Ⅺᗟ繴㨆উ䞬⛚冑⇞ᬄᮋ⛂逸჻Ἡ箖㩙䲔ä¯ì‡›æ—…훤ﬥ秷ꨰ蘽໦갼䃺鴘찓ﶭ쪓ç¢îŽ›ëªì§Šî¤¼ë“¢èŽ [ 1350.728865][T17125] usb 2-1: SerialNumber: ã  [ 1350.765900][T18748] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1350.820325][T18744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1350.860878][T18744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1350.893543][T17134] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 1350.932660][T17134] usb 3-1: USB disconnect, device number 63 [ 1351.034399][T17125] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input93 [ 1351.056868][ T5182] bcm5974 2-1:1.0: could not read from device [ 1351.074662][ T5182] bcm5974 2-1:1.0: could not read from device [ 1351.101604][ T5182] bcm5974 2-1:1.0: could not read from device [ 1351.116727][T17125] usb 2-1: USB disconnect, device number 69 [ 1351.141999][ T5182] bcm5974 2-1:1.0: could not read from device [ 1351.359313][T18745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1351.384676][T18745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1351.400991][T17135] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1351.571087][T17135] usb 3-1: Using ep0 maxpacket: 8 [ 1351.581760][T17135] usb 3-1: config index 0 descriptor too short (expected 301, got 72) [ 1351.602900][T17135] usb 3-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1351.614520][T17135] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1351.626135][T17137] cdc_ncm 5-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1351.633913][T17135] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1351.645860][T17137] cdc_ncm 5-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 1351.653955][T17137] cdc_ncm 5-1:1.0: setting rx_max = 2048 [ 1351.660880][T17135] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1351.671794][T17135] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1351.686855][T17135] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1351.696580][T17135] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1351.923759][T17135] usb 3-1: usb_control_msg returned -32 [ 1351.940969][T17135] usbtmc 3-1:16.0: can't read capabilities [ 1351.941050][T18744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1352.000314][T18744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1352.036490][T17137] cdc_ncm 5-1:1.0: setting tx_max = 88 [ 1352.076420][ T5906] usb 3-1: USB disconnect, device number 64 [ 1352.087707][T17137] cdc_ncm 5-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.4-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1352.146589][T17137] usb 5-1: USB disconnect, device number 60 [ 1352.198684][T17137] cdc_ncm 5-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.4-1, CDC NCM (NO ZLP) [ 1352.297247][T18770] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3001'. [ 1352.723039][T18782] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3003'. [ 1353.026295][T18792] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3006'. [ 1353.036099][T18792] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3006'. [ 1353.062866][T17136] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 1353.370770][T17136] usb 5-1: Using ep0 maxpacket: 8 [ 1353.421717][T17136] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1353.440960][T17136] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.486907][T17136] usb 5-1: Product: syz [ 1353.496868][T17136] usb 5-1: Manufacturer: syz [ 1353.511840][T17136] usb 5-1: SerialNumber: syz [ 1353.543036][T17136] usb 5-1: config 0 descriptor?? [ 1353.870554][T17136] usb 5-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1354.324367][T18784] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1354.764417][T17136] usb write operation failed. (-71) [ 1354.773007][T17136] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1354.811309][T17136] dvbdev: DVB: registering new adapter (Terratec H7) [ 1354.838461][T17136] usb 5-1: media controller created [ 1354.864410][T17136] usb read operation failed. (-71) [ 1354.900512][T17136] usb write operation failed. (-71) [ 1354.948258][T17136] dvb_usb_az6007 5-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1355.014754][T17136] usb 5-1: USB disconnect, device number 61 [ 1355.251004][T17137] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 1355.444758][T17137] usb 4-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1355.488878][T17137] usb 4-1: config 1 interface 0 has no altsetting 0 [ 1355.512670][T17137] usb 4-1: New USB device found, idVendor=05ac, idProduct=025b, bcdDevice= 0.40 [ 1355.532106][T17137] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1355.558985][T17137] usb 4-1: Product: 㖘戕꯫Ւ欟ﱖ왛녧Ȍꊴ좠⹶묛㋈関껶왶䮀ëªè¸¶â­æ¨½ìŒçœá¢èˆ³î³«ïƒ˜ã¹éˆˆæ“™æ«ªîª’眖歠툚æºç‘–踾åœëˆ¶æ±ƒæ…—蔭痟죲îœè«šç€”ç³»î‡â­†êœ„ꌬ [ 1355.601798][T17137] usb 4-1: Manufacturer: 긼岡彧௱룛ê¹ä§¼â “阓풽꛼늽é‡è¿ಫâ§ìˆ¯î›„莧ᆿƻ↖솚홬惞ïힷ䀑ä䭮⒆럕㨩뭂ꡤ襠野Ⅺᗟ繴㨆উ䞬⛚冑⇞ᬄᮋ⛂逸჻Ἡ箖㩙䲔ä¯ì‡›æ—…훤ﬥ秷ꨰ蘽໦갼䃺鴘찓ﶭ쪓ç¢îŽ›ëªì§Šî¤¼ë“¢èŽ [ 1355.850805][T17137] usb 4-1: SerialNumber: ã  [ 1355.893034][T18806] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1356.028012][ T5906] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 1356.133483][T17137] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/input/input94 [ 1356.211785][ T5906] usb 1-1: Using ep0 maxpacket: 32 [ 1356.351749][ T5906] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1356.382349][ T5906] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1356.541638][ T5182] bcm5974 4-1:1.0: could not read from device [ 1356.621505][ T5906] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1356.721915][ T5906] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1356.741996][T17137] usb 4-1: USB disconnect, device number 56 [ 1356.744774][ T5906] usb 1-1: Product: syz [ 1356.756709][ T5906] usb 1-1: Manufacturer: syz [ 1356.761734][ T5906] usb 1-1: SerialNumber: syz [ 1356.791419][ T5906] usb 1-1: config 0 descriptor?? [ 1356.918077][ T5182] bcm5974 4-1:1.0: could not read from device [ 1357.143437][T18836] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3014'. [ 1357.530511][ T5906] usb 1-1: can't set config #0, error -71 [ 1357.592867][ T5906] usb 1-1: USB disconnect, device number 37 [ 1358.209262][T18845] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1358.600951][ T5906] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1358.709596][T18856] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3019'. [ 1358.719550][T18856] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3019'. [ 1359.036840][ T5906] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1359.061982][ T5906] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 1359.088887][ T5906] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1359.117780][ T5906] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 1359.143185][ T5906] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 1359.172176][ T5906] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1359.212371][ T5906] usb 3-1: config 0 descriptor?? [ 1359.310792][T17125] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1359.477482][ T5906] hdpvr 3-1:0.0: firmware version 0x15 dated Š–¸&S¶3;¨“Ãx&X^„œ wÒΖŠ g/ƒ µn#»† [ 1359.491325][T17125] usb 4-1: Using ep0 maxpacket: 32 [ 1359.502594][T17125] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1359.569279][T17125] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1359.593293][ T5906] hdpvr 3-1:0.0: device init failed [ 1359.598799][ T5906] hdpvr 3-1:0.0: probe with driver hdpvr failed with error -12 [ 1359.641533][T17125] usb 4-1: Product: syz [ 1359.649890][T17125] usb 4-1: Manufacturer: syz [ 1359.658830][ T5906] usb 3-1: USB disconnect, device number 65 [ 1359.680549][T17125] usb 4-1: SerialNumber: syz [ 1359.722080][T17125] usb 4-1: config 0 descriptor?? [ 1359.744234][T17125] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1359.772719][T17125] dvb-usb: bulk message failed: -22 (2/0) [ 1359.819499][T17125] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1359.850195][T17125] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1359.869083][T17125] usb 4-1: media controller created [ 1359.900270][T17125] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1359.940537][T17125] usb 4-1: selecting invalid altsetting 7 [ 1359.946630][T17125] cxusb: set interface failed [ 1359.970860][T17137] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 1359.983778][T17125] dvb-usb: bulk message failed: -22 (1/0) [ 1360.084880][T17125] DVB: Unable to find symbol lgdt330x_attach() [ 1360.100757][ T5906] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1360.110823][T17125] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1360.121746][T17137] usb 2-1: Using ep0 maxpacket: 8 [ 1360.151146][T17137] usb 2-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1360.180898][T17137] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.210726][T17137] usb 2-1: Product: syz [ 1360.214976][T17137] usb 2-1: Manufacturer: syz [ 1360.219675][T17137] usb 2-1: SerialNumber: syz [ 1360.256476][T17137] usb 2-1: config 0 descriptor?? [ 1360.270848][T17125] rc_core: IR keymap rc-dvico-portable not found [ 1360.280707][ T5906] usb 3-1: Using ep0 maxpacket: 32 [ 1360.290965][T17125] Registered IR keymap rc-empty [ 1360.302474][T17125] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 1360.312623][ T5906] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 1360.340988][ T5906] usb 3-1: config 0 has no interface number 0 [ 1360.347971][ T5906] usb 3-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1360.369341][T17125] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input95 [ 1360.405650][ T5906] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1360.420927][T17125] dvb-usb: schedule remote query interval to 100 msecs. [ 1360.438327][T17125] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1360.447457][ T5906] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.477626][ T5906] usb 3-1: Product: syz [ 1360.520453][T17125] usb 4-1: USB disconnect, device number 57 [ 1360.529625][ T5906] usb 3-1: Manufacturer: syz [ 1360.545783][ T5906] usb 3-1: SerialNumber: syz [ 1360.601061][ T5906] usb 3-1: config 0 descriptor?? [ 1360.634523][T18870] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1360.677931][T17137] usb read operation failed. (-32) [ 1360.837711][T17125] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1360.900871][T18880] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3025'. [ 1361.058802][T18868] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1361.116595][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 1361.116636][ T30] audit: type=1800 audit(1774317951.048:310): pid=18886 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3023" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=90905 res=0 errno=0 [ 1361.289280][T17137] usb 2-1: dvb_usb_v2: found a 'Terratec H7' in cold state [ 1361.372806][T17137] usb 2-1: Direct firmware load for dvb-usb-terratec-h7-az6007.fw failed with error -2 [ 1361.410190][T17137] usb 2-1: Falling back to sysfs fallback for: dvb-usb-terratec-h7-az6007.fw [ 1361.692992][T18891] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3027'. [ 1361.897049][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.907034][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1363.295331][ T5906] asix 3-1:0.188: probe with driver asix failed with error -71 [ 1363.373176][ T5906] usb 3-1: USB disconnect, device number 66 [ 1363.581257][T18903] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3029'. [ 1363.853116][T18908] fuse: Bad value for 'user_id' [ 1363.888451][T18908] fuse: Bad value for 'user_id' [ 1365.310887][ T5906] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 1365.590757][ T5906] usb 5-1: Using ep0 maxpacket: 32 [ 1365.607059][ T5906] usb 5-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1365.616653][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1365.687012][ T5906] usb 5-1: Product: syz [ 1365.705401][ T5906] usb 5-1: Manufacturer: syz [ 1365.715423][ T5906] usb 5-1: SerialNumber: syz [ 1365.743190][ T5906] usb 5-1: config 0 descriptor?? [ 1365.759743][ T5906] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1365.854432][ T5906] dvb-usb: bulk message failed: -22 (2/0) [ 1365.906582][ T5906] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1365.939065][ T5906] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1365.978411][ T5906] usb 5-1: media controller created [ 1366.080363][ T5906] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1366.202446][ T5906] usb 5-1: selecting invalid altsetting 7 [ 1366.208369][ T5906] cxusb: set interface failed [ 1366.216018][ T5906] dvb-usb: bulk message failed: -22 (1/0) [ 1366.269792][ T5906] DVB: Unable to find symbol lgdt330x_attach() [ 1366.281026][ T5906] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1366.421910][ T5906] rc_core: IR keymap rc-dvico-portable not found [ 1366.431710][T17123] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1366.459980][ T5906] Registered IR keymap rc-empty [ 1366.472163][ T5906] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 1366.493397][ T5906] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input96 [ 1366.506715][ T5906] dvb-usb: schedule remote query interval to 100 msecs. [ 1366.538441][ T5906] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1366.573888][ T5906] usb 5-1: USB disconnect, device number 62 [ 1366.588348][T18939] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3040'. [ 1366.603581][T17123] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1366.673317][T17123] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1366.700047][T17123] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.721645][T17123] usb 3-1: Product: syz [ 1366.741415][ T5906] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1366.755591][T17123] usb 3-1: Manufacturer: syz [ 1366.760277][T17123] usb 3-1: SerialNumber: syz [ 1366.873268][T18945] fuse: Bad value for 'user_id' [ 1366.878454][T18945] fuse: Bad value for 'user_id' [ 1367.350824][ T5906] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 1367.390797][T17125] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1367.500806][ T5906] usb 1-1: Using ep0 maxpacket: 32 [ 1367.508590][ T5906] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1367.523102][ T5906] usb 1-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 1367.532993][ T5906] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1367.541161][T17125] usb 5-1: Using ep0 maxpacket: 32 [ 1367.546555][ T5906] usb 1-1: Product: syz [ 1367.551382][ T5906] usb 1-1: Manufacturer: syz [ 1367.556206][ T5906] usb 1-1: SerialNumber: syz [ 1367.562915][T17125] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 1367.574237][T17125] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1367.585825][T17125] usb 5-1: config 0 has no interface number 0 [ 1367.597205][ T5906] snd-ua101 1-1:1.1: invalid format type [ 1367.604751][T17125] usb 5-1: config 0 interface 89 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1367.618248][ T5906] snd-ua101 1-1:1.0: invalid num_altsetting [ 1367.636564][T18935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1367.643558][T17125] usb 5-1: New USB device found, idVendor=12d1, idProduct=7ef3, bcdDevice=54.68 [ 1367.657527][T17125] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1367.665884][T17125] usb 5-1: Product: syz [ 1367.677567][T17125] usb 5-1: Manufacturer: syz [ 1367.678894][T18935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1367.684795][T17125] usb 5-1: SerialNumber: syz [ 1367.712901][T17125] usb 5-1: config 0 descriptor?? [ 1367.720114][T17125] hub 5-1:0.89: bad descriptor, ignoring hub [ 1367.729271][T17125] hub 5-1:0.89: probe with driver hub failed with error -5 [ 1367.741950][T17125] option 5-1:0.89: GSM modem (1-port) converter detected [ 1367.822989][T18953] netlink: 'syz.0.3046': attribute type 1 has an invalid length. [ 1367.867641][T18953] bond3: entered promiscuous mode [ 1367.875696][T18953] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1367.911686][T17123] cdc_ncm 3-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1367.923904][T18958] bond3: (slave veth3): making interface the new active one [ 1367.931685][T17123] cdc_ncm 3-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 1367.939998][T17123] cdc_ncm 3-1:1.0: setting rx_max = 2048 [ 1367.959807][T18958] veth3: entered promiscuous mode [ 1367.973739][T18958] bond3: (slave veth3): Enslaving as an active interface with an up link [ 1368.116630][T17123] cdc_ncm 3-1:1.0: setting tx_max = 88 [ 1368.149639][T17123] cdc_ncm 3-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.2-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1368.183051][T17123] usb 3-1: USB disconnect, device number 67 [ 1368.213497][T17123] cdc_ncm 3-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.2-1, CDC NCM (NO ZLP) [ 1368.401725][T18970] usb usb1: usbfs: interface 0 claimed by hub while 'syz.3.3049' sets config #0 [ 1368.592041][T18979] usb usb1: usbfs: interface 0 claimed by hub while 'syz.3.3049' sets config #1 [ 1369.565151][T19014] fuse: Bad value for 'fd' [ 1369.718971][T19021] kernel read not supported for file / œ7³ÏüâW)ës“§Ç!Qöì¥fsõl{T‡rÒ)r§ÖOš˜õ2:"ôÀT+ÍŸv|Õ²DvcŽ“ØÖ Å6Òxãc: (pid: 19021 comm: syz.1.3057) [ 1369.774502][ T30] audit: type=1800 audit(1774317959.708:311): pid=19021 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3057" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=91898 res=0 errno=0 [ 1370.499451][T17123] usb 1-1: USB disconnect, device number 38 [ 1371.033835][T17136] usb 5-1: USB disconnect, device number 63 [ 1371.058849][T17136] option 5-1:0.89: device disconnected [ 1371.360790][T17123] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 1371.492478][T19064] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3064'. [ 1371.555289][T17123] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1371.564892][T17123] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1371.573175][T17123] usb 1-1: Product: syz [ 1371.580753][T17123] usb 1-1: Manufacturer: syz [ 1371.585432][T17123] usb 1-1: SerialNumber: syz [ 1371.622583][T17123] usb 1-1: config 0 descriptor?? [ 1371.926059][T17134] usb 1-1: USB disconnect, device number 39 [ 1372.006495][T15782] udevd[15782]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1372.415845][T19074] fuse: Bad value for 'fd' [ 1373.011020][T17123] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 1373.227866][T17123] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1373.261193][T17123] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1373.290896][T19089] syzkaller0: entered promiscuous mode [ 1373.296589][T19089] syzkaller0: entered allmulticast mode [ 1373.369825][T17123] usb 3-1: New USB device found, idVendor=172f, idProduct=0501, bcdDevice= 0.00 [ 1373.458609][T17123] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1373.516214][T17123] usb 3-1: config 0 descriptor?? [ 1373.542243][T19092] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3073'. [ 1374.850162][T19114] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3080'. [ 1374.941494][ T5906] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1375.240413][ T5906] usb 4-1: Using ep0 maxpacket: 8 [ 1375.427659][ T5906] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1375.440054][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1375.450817][ T5906] usb 4-1: Product: syz [ 1375.456415][ T5906] usb 4-1: Manufacturer: syz [ 1375.463567][ T5906] usb 4-1: SerialNumber: syz [ 1375.502717][ T5906] usb 4-1: config 0 descriptor?? [ 1375.789127][ T5906] usb 4-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1376.094301][T17123] usbhid 3-1:0.0: can't add hid device: -71 [ 1376.111696][T17123] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1376.153416][T17123] usb 3-1: USB disconnect, device number 68 [ 1376.211359][T19117] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1376.417551][T19111] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1377.161332][ T5906] usb write operation failed. (-71) [ 1377.252376][ T5906] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1377.319099][ T5906] dvbdev: DVB: registering new adapter (Terratec H7) [ 1377.340031][T19134] syzkaller0: entered promiscuous mode [ 1377.349563][T19134] syzkaller0: entered allmulticast mode [ 1377.376104][ T5906] usb 4-1: media controller created [ 1377.396780][ T5906] usb read operation failed. (-71) [ 1377.409055][ T5906] usb write operation failed. (-71) [ 1377.535815][ T5906] dvb_usb_az6007 4-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1377.567605][ T5906] usb 4-1: USB disconnect, device number 58 [ 1378.527568][T17136] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1378.692619][T17136] usb 5-1: Using ep0 maxpacket: 32 [ 1378.732698][T17136] usb 5-1: config 0 has an invalid interface number: 188 but max is 0 [ 1378.747451][T17136] usb 5-1: config 0 has no interface number 0 [ 1378.771266][T17136] usb 5-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1378.836336][T17136] usb 5-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1378.858257][T17136] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1378.877002][T17136] usb 5-1: Product: syz [ 1378.890775][T17136] usb 5-1: Manufacturer: syz [ 1378.895579][T17136] usb 5-1: SerialNumber: syz [ 1378.984795][T19152] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3089'. [ 1379.182329][T17136] usb 5-1: config 0 descriptor?? [ 1379.190037][T19148] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1379.514160][ T30] audit: type=1800 audit(1774317969.438:312): pid=19155 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3088" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=75213 res=0 errno=0 [ 1380.030824][T17135] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 1380.221147][T17135] usb 3-1: Using ep0 maxpacket: 32 [ 1380.231802][T17135] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1380.268856][T17135] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1380.318568][T17135] usb 3-1: Product: syz [ 1380.341699][T17135] usb 3-1: Manufacturer: syz [ 1380.356832][T17135] usb 3-1: SerialNumber: syz [ 1380.422666][T17135] usb 3-1: config 0 descriptor?? [ 1380.451933][T17135] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1380.481630][T17135] dvb-usb: bulk message failed: -22 (2/0) [ 1380.517673][T17135] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1380.560526][T17135] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1380.580413][T17135] usb 3-1: media controller created [ 1380.636459][T17135] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1380.660539][T19157] dvb-usb: bulk message failed: -22 (77/0) [ 1380.945979][T17135] usb 3-1: selecting invalid altsetting 7 [ 1380.969949][T17135] cxusb: set interface failed [ 1380.990305][T17135] dvb-usb: bulk message failed: -22 (1/0) [ 1381.195689][T17135] DVB: Unable to find symbol lgdt330x_attach() [ 1381.233077][T17135] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1381.370814][T17138] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 1381.548027][T17136] asix 5-1:0.188: probe with driver asix failed with error -71 [ 1381.584775][T17138] usb 1-1: Using ep0 maxpacket: 32 [ 1381.612580][T17138] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1381.623286][T17136] usb 5-1: USB disconnect, device number 64 [ 1381.645255][T17138] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1381.658952][T17138] usb 1-1: Product: syz [ 1381.665027][T17138] usb 1-1: Manufacturer: syz [ 1381.669924][T17138] usb 1-1: SerialNumber: syz [ 1381.678553][T17138] usb 1-1: config 0 descriptor?? [ 1381.710737][T17135] rc_core: IR keymap rc-dvico-portable not found [ 1381.728356][T17135] Registered IR keymap rc-empty [ 1381.735491][T17138] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1381.755311][T17135] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 1381.770723][T17138] dvb-usb: bulk message failed: -22 (2/0) [ 1381.803427][T17135] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input97 [ 1381.818241][T17138] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1381.848105][T17138] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1381.861257][T17135] dvb-usb: schedule remote query interval to 100 msecs. [ 1381.871529][T17138] usb 1-1: media controller created [ 1381.876917][T17135] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1381.920214][T17135] usb 3-1: USB disconnect, device number 69 [ 1381.944857][T17138] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1381.981878][T17134] dvb-usb: bulk message failed: -22 (1/0) [ 1382.036830][T17138] usb 1-1: selecting invalid altsetting 7 [ 1382.056503][T17138] cxusb: set interface failed [ 1382.070699][T17138] dvb-usb: bulk message failed: -22 (1/0) [ 1382.211985][T17135] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1382.238868][T17138] DVB: Unable to find symbol lgdt330x_attach() [ 1382.261550][T17138] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1382.420317][T17138] rc_core: IR keymap rc-dvico-portable not found [ 1382.430739][ T5906] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1382.451259][T17138] Registered IR keymap rc-empty [ 1382.468585][T17138] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 1382.493391][T17138] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input98 [ 1382.507570][T17138] dvb-usb: schedule remote query interval to 100 msecs. [ 1382.517595][T17138] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1382.568834][T17138] usb 1-1: USB disconnect, device number 40 [ 1382.581095][T17135] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 1382.610754][ T5906] usb 5-1: Using ep0 maxpacket: 32 [ 1382.638934][ T5906] usb 5-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1382.655436][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1382.680410][ T5906] usb 5-1: Product: syz [ 1382.776924][ T5906] usb 5-1: Manufacturer: syz [ 1382.790198][T19200] bridge_slave_1: vlans aren't supported yet for dev_uc|mc_add() [ 1382.801935][T17135] usb 3-1: Using ep0 maxpacket: 8 [ 1382.803049][ T5906] usb 5-1: SerialNumber: syz [ 1382.821133][T17135] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1382.844636][ T5906] usb 5-1: config 0 descriptor?? [ 1382.855969][T17135] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1382.868054][T17138] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1382.890505][T17135] usb 3-1: Product: syz [ 1382.901319][ T5906] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1382.909810][T17135] usb 3-1: Manufacturer: syz [ 1382.925580][T17135] usb 3-1: SerialNumber: syz [ 1382.934938][ T5906] dvb-usb: bulk message failed: -22 (2/0) [ 1382.958567][T17135] usb 3-1: config 0 descriptor?? [ 1383.024891][ T5906] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1383.112187][ T5906] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1383.209975][T17135] usb 3-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1383.405466][ T5906] usb 5-1: media controller created [ 1383.491438][ T5906] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1383.523794][ T5906] usb 5-1: selecting invalid altsetting 7 [ 1383.529601][ T5906] cxusb: set interface failed [ 1383.534969][ T5906] dvb-usb: bulk message failed: -22 (1/0) [ 1383.625312][ T5906] DVB: Unable to find symbol lgdt330x_attach() [ 1383.631986][ T5906] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1383.721073][T17123] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 1383.843619][T19173] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1383.871059][T17123] usb 1-1: Using ep0 maxpacket: 32 [ 1383.897198][T17123] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1383.915780][T17123] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1383.938852][T17123] usb 1-1: Product: syz [ 1383.953480][T17123] usb 1-1: Manufacturer: syz [ 1383.974702][T17123] usb 1-1: SerialNumber: syz [ 1383.981533][ T5906] rc_core: IR keymap rc-dvico-portable not found [ 1383.988436][ T5906] Registered IR keymap rc-empty [ 1384.015161][T17123] usb 1-1: config 0 descriptor?? [ 1384.027290][ T5906] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 1384.044463][T19222] FAULT_INJECTION: forcing a failure. [ 1384.044463][T19222] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1384.064722][T17123] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1384.094386][ T5906] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input99 [ 1384.108436][T17123] dvb-usb: bulk message failed: -22 (2/0) [ 1384.123906][ T5906] dvb-usb: schedule remote query interval to 100 msecs. [ 1384.144468][T17123] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1384.161626][ T5906] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1384.182082][T17123] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1384.190163][T17123] usb 1-1: media controller created [ 1384.206605][ T5906] usb 5-1: USB disconnect, device number 65 [ 1384.221915][T19222] CPU: 0 UID: 0 PID: 19222 Comm: syz.1.3111 Tainted: G L syzkaller #0 PREEMPT(full) [ 1384.221949][T19222] Tainted: [L]=SOFTLOCKUP [ 1384.221958][T19222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1384.221972][T19222] Call Trace: [ 1384.221982][T19222] [ 1384.221992][T19222] dump_stack_lvl+0xe8/0x150 [ 1384.222029][T19222] should_fail_ex+0x412/0x560 [ 1384.222067][T19222] _copy_from_iter+0x1d3/0x1670 [ 1384.222109][T19222] ? rcu_is_watching+0x15/0xb0 [ 1384.222146][T19222] ? __pfx__copy_from_iter+0x10/0x10 [ 1384.222188][T19222] ? netlink_sendmsg+0x650/0xb40 [ 1384.222210][T19222] ? skb_put+0x11b/0x210 [ 1384.222238][T19222] netlink_sendmsg+0x6c0/0xb40 [ 1384.222268][T19222] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1384.222293][T19222] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1384.222329][T19222] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1384.222360][T19222] ____sys_sendmsg+0x972/0x9f0 [ 1384.222395][T19222] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1384.222429][T19222] ? import_iovec+0x73/0xa0 [ 1384.222458][T19222] ___sys_sendmsg+0x2a5/0x360 [ 1384.222489][T19222] ? __pfx____sys_sendmsg+0x10/0x10 [ 1384.222550][T19222] ? __fget_files+0x2a/0x420 [ 1384.222582][T19222] ? __fget_files+0x3a0/0x420 [ 1384.222625][T19222] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1384.222654][T19222] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1384.222689][T19222] ? __pfx_ksys_write+0x10/0x10 [ 1384.222724][T19222] do_syscall_64+0x14d/0xf80 [ 1384.222749][T19222] ? trace_irq_disable+0x3b/0x150 [ 1384.222780][T19222] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1384.222803][T19222] ? clear_bhb_loop+0x40/0x90 [ 1384.222830][T19222] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1384.222851][T19222] RIP: 0033:0x7f797779c799 [ 1384.222885][T19222] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1384.222905][T19222] RSP: 002b:00007f7978740028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1384.222930][T19222] RAX: ffffffffffffffda RBX: 00007f7977a15fa0 RCX: 00007f797779c799 [ 1384.222947][T19222] RDX: 0000000004040000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1384.222961][T19222] RBP: 00007f7978740090 R08: 0000000000000000 R09: 0000000000000000 [ 1384.222976][T19222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1384.222989][T19222] R13: 00007f7977a16038 R14: 00007f7977a15fa0 R15: 00007f7977b3fa48 [ 1384.223022][T19222] [ 1384.476163][T17123] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1384.492879][T17135] usb write operation failed. (-71) [ 1384.501032][T17135] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1384.517730][T17123] usb 1-1: selecting invalid altsetting 7 [ 1384.531423][T17135] dvbdev: DVB: registering new adapter (Terratec H7) [ 1384.538255][T17135] usb 3-1: media controller created [ 1384.547773][T17135] usb read operation failed. (-71) [ 1384.553573][T17135] usb write operation failed. (-71) [ 1384.571005][T17135] dvb_usb_az6007 3-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1384.590676][T17135] usb 3-1: USB disconnect, device number 70 [ 1384.662698][T17123] cxusb: set interface failed [ 1384.667470][T17123] dvb-usb: bulk message failed: -22 (1/0) [ 1384.711747][ T5906] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1384.762627][T15782] udevd[15782]: setting owner of /dev/bus/usb/005/065 to uid=0, gid=0 failed: No such file or directory [ 1384.822150][T17123] DVB: Unable to find symbol lgdt330x_attach() [ 1384.828366][T17123] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1385.000723][T17123] rc_core: IR keymap rc-dvico-portable not found [ 1385.007538][T17123] Registered IR keymap rc-empty [ 1385.021262][T17123] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 1385.054421][T17123] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input100 [ 1385.111949][T17123] dvb-usb: schedule remote query interval to 100 msecs. [ 1385.119654][T17123] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1385.179238][T17123] usb 1-1: USB disconnect, device number 41 [ 1385.222720][ T5906] usb 5-1: new full-speed USB device number 66 using dummy_hcd [ 1385.315044][T17123] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1385.415395][ T5906] usb 5-1: config 1 interface 0 altsetting 6 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1385.446297][ T5906] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1385.483427][ T5906] usb 5-1: New USB device found, idVendor=05ac, idProduct=025b, bcdDevice= 0.40 [ 1385.501936][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1385.546201][ T5906] usb 5-1: Product: 㖘戕꯫Ւ欟ﱖ왛녧Ȍꊴ좠⹶묛㋈関껶왶䮀ëªè¸¶â­æ¨½ìŒçœá¢èˆ³î³«ïƒ˜ã¹éˆˆæ“™æ«ªîª’眖歠툚æºç‘–踾åœëˆ¶æ±ƒæ…—蔭痟죲îœè«šç€”ç³»î‡â­†êœ„ꌬ [ 1385.624602][ T5906] usb 5-1: Manufacturer: 긼岡彧௱룛ê¹ä§¼â “阓풽꛼늽é‡è¿ಫâ§ìˆ¯î›„莧ᆿƻ↖솚홬惞ïힷ䀑ä䭮⒆럕㨩뭂ꡤ襠野Ⅺᗟ繴㨆উ䞬⛚冑⇞ᬄᮋ⛂逸჻Ἡ箖㩙䲔ä¯ì‡›æ—…훤ﬥ秷ꨰ蘽໦갼䃺鴘찓ﶭ쪓ç¢îŽ›ëªì§Šî¤¼ë“¢èŽ [ 1385.675804][ T5906] usb 5-1: SerialNumber: ã  [ 1385.708263][T19230] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1385.955688][ T5906] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input101 [ 1385.983351][ T5182] bcm5974 5-1:1.0: could not read from device [ 1386.001818][ T5182] bcm5974 5-1:1.0: could not read from device [ 1386.009101][ T5906] usb 5-1: USB disconnect, device number 66 [ 1386.018503][ T5182] bcm5974 5-1:1.0: could not read from device [ 1386.026219][ T5182] bcm5974 5-1:1.0: could not read from device [ 1386.161855][T17136] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 1386.330698][T17136] usb 4-1: Using ep0 maxpacket: 32 [ 1386.341720][T17136] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1386.351026][T17136] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1386.368978][T17136] usb 4-1: Product: syz [ 1386.422753][T17136] usb 4-1: Manufacturer: syz [ 1386.427853][T17136] usb 4-1: SerialNumber: syz [ 1386.453079][T17136] usb 4-1: config 0 descriptor?? [ 1386.477137][T17136] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1386.485333][T17136] dvb-usb: bulk message failed: -22 (2/0) [ 1386.496200][T17136] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1386.512468][T17136] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1386.522816][T17136] usb 4-1: media controller created [ 1386.559103][T17136] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1386.604228][T17136] usb 4-1: selecting invalid altsetting 7 [ 1386.615566][T17136] cxusb: set interface failed [ 1386.632584][T17136] dvb-usb: bulk message failed: -22 (1/0) [ 1386.677451][T19260] dvb-usb: bulk message failed: -22 (77/0) [ 1386.835686][T17136] DVB: Unable to find symbol lgdt330x_attach() [ 1386.841986][T17136] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1387.091238][T17136] rc_core: IR keymap rc-dvico-portable not found [ 1387.098903][T17136] Registered IR keymap rc-empty [ 1387.104977][T17136] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 1387.128809][T17136] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input102 [ 1387.143055][T17136] dvb-usb: schedule remote query interval to 100 msecs. [ 1387.151033][T17136] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1387.168084][T17136] usb 4-1: USB disconnect, device number 59 [ 1387.270993][T17136] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1387.442172][T19274] netlink: 'syz.4.3126': attribute type 5 has an invalid length. [ 1387.450877][T19274] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3126'. [ 1388.020822][T17136] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 1388.038965][T17123] IPVS: starting estimator thread 0... [ 1388.141890][T19285] IPVS: using max 37 ests per chain, 88800 per kthread [ 1388.200771][T17136] usb 3-1: Using ep0 maxpacket: 32 [ 1388.231237][T17136] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1388.362936][T19289] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1388.561019][T17136] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1388.570750][T17136] usb 3-1: Product: syz [ 1388.575026][T17136] usb 3-1: Manufacturer: syz [ 1388.602978][T17136] usb 3-1: SerialNumber: syz [ 1388.642007][T17136] usb 3-1: config 0 descriptor?? [ 1388.667422][T17136] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1388.693917][T17136] dvb-usb: bulk message failed: -22 (2/0) [ 1388.722692][T17136] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1388.746845][T17136] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1388.757301][T17136] usb 3-1: media controller created [ 1388.957598][T17136] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1388.994008][T17136] usb 3-1: selecting invalid altsetting 7 [ 1389.024022][T17136] cxusb: set interface failed [ 1389.034994][T17136] dvb-usb: bulk message failed: -22 (1/0) [ 1389.091123][T17138] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1389.118834][T17136] DVB: Unable to find symbol lgdt330x_attach() [ 1389.128772][T17136] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1389.245740][T17136] rc_core: IR keymap rc-dvico-portable not found [ 1389.254378][T17136] Registered IR keymap rc-empty [ 1389.262924][T17136] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 1389.288508][T17136] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input103 [ 1389.300774][T17138] usb 5-1: Using ep0 maxpacket: 8 [ 1389.359893][T17138] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 1389.370336][T17138] usb 5-1: config 0 has no interface number 0 [ 1389.377815][T17138] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1389.396000][T17136] dvb-usb: schedule remote query interval to 100 msecs. [ 1389.444895][T17136] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1389.457790][T17138] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1389.484179][T17138] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1389.514961][T17136] usb 3-1: USB disconnect, device number 71 [ 1389.545953][T17138] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1389.597180][T17138] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1389.877072][T17138] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1389.932326][T17136] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1389.958267][T17138] usb 5-1: config 0 descriptor?? [ 1390.166563][T17138] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1390.261154][T19311] Option 'Í'M•O§±' to dns_resolver key: bad/missing value [ 1390.412889][T17138] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 1390.595375][T17138] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1390.611637][T17138] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1390.627935][T17138] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1390.672269][T17138] usb 1-1: Product: syz [ 1390.684766][T17138] usb 1-1: Manufacturer: syz [ 1390.695457][T17138] usb 1-1: SerialNumber: syz [ 1391.111295][ T6948] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1391.140873][ T6948] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.282844][ T6948] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1391.304559][ T6948] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.447451][ T6948] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1391.461388][ T6948] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.571952][T19309] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1391.605347][T19309] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1391.634747][T17138] cdc_ncm 1-1:1.0: bind() failure [ 1391.649308][T17138] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 1391.660838][T17138] cdc_ncm 1-1:1.1: bind() failure [ 1391.674740][T17138] usb 1-1: USB disconnect, device number 42 [ 1391.701983][T16359] udevd[16359]: setting owner of /dev/bus/usb/001/042 to uid=0, gid=0 failed: No such file or directory [ 1391.802761][ T6948] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1391.821444][ T6948] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.904164][T17123] usb 5-1: USB disconnect, device number 67 [ 1391.932248][T17123] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 1392.447296][T19321] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1392.464051][T19321] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1392.475323][T19321] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1392.489750][T19321] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1392.499461][T19321] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1392.517798][ T6948] bridge_slave_1: left allmulticast mode [ 1392.533453][ T6948] bridge0: port 2(bridge_slave_1) entered disabled state [ 1392.535867][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1392.550339][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1392.559804][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1392.569088][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1392.599527][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1392.613574][ T6948] bridge_slave_0: left allmulticast mode [ 1392.619360][ T6948] bridge_slave_0: left promiscuous mode [ 1392.662216][T19323] fuse: Invalid rootmode [ 1392.696422][ T6948] bridge0: port 1(bridge_slave_0) entered disabled state [ 1393.601584][ T6948] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1393.623518][ T6948] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1393.634879][ T6948] bond0 (unregistering): Released all slaves [ 1393.853283][T17136] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1394.072580][T17136] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1394.086762][T17136] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1394.165289][T17136] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1394.175957][T17136] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1394.211558][T17136] usb 5-1: SerialNumber: syz [ 1394.671599][T19354] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3148'. [ 1394.700778][T19321] Bluetooth: hci2: command tx timeout [ 1394.700871][T17123] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 1395.100815][T17123] usb 4-1: Using ep0 maxpacket: 32 [ 1395.182031][T17123] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1395.193173][T17123] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1395.214266][T17136] usb 5-1: 0:2 : does not exist [ 1395.251456][T17123] usb 4-1: Product: syz [ 1395.255708][T17123] usb 4-1: Manufacturer: syz [ 1395.305512][T17136] usb 5-1: USB disconnect, device number 68 [ 1395.325305][T17123] usb 4-1: SerialNumber: syz [ 1395.396334][T17123] usb 4-1: config 0 descriptor?? [ 1395.418150][T17123] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1395.456876][T17123] dvb-usb: bulk message failed: -22 (2/0) [ 1395.475086][T16359] udevd[16359]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1395.501386][T17123] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1395.541985][T17123] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1395.589881][T17123] usb 4-1: media controller created [ 1395.640446][T19341] dvb-usb: bulk message failed: -22 (77/0) [ 1395.766852][T19324] chnl_net:caif_netlink_parms(): no params data found [ 1395.785977][T17123] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1396.204639][T17123] usb 4-1: selecting invalid altsetting 7 [ 1396.232195][T17123] cxusb: set interface failed [ 1396.268575][T17123] dvb-usb: bulk message failed: -22 (1/0) [ 1396.498063][ T6948] hsr_slave_0: left promiscuous mode [ 1396.533642][ T6948] hsr_slave_1: left promiscuous mode [ 1396.548897][ T6948] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1396.616140][ T6948] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1396.623802][T17123] DVB: Unable to find symbol lgdt330x_attach() [ 1396.630033][T17123] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1396.654580][ T6948] batman_adv: batadv0: Removing interface: dummy0 [ 1396.686807][ T6948] veth1_macvtap: left promiscuous mode [ 1396.697466][ T6948] veth0_macvtap: left promiscuous mode [ 1396.716702][ T6948] veth1_vlan: left promiscuous mode [ 1396.751005][ T6948] veth0_vlan: left promiscuous mode [ 1396.770805][T19321] Bluetooth: hci2: command tx timeout [ 1396.902950][T17123] rc_core: IR keymap rc-dvico-portable not found [ 1396.919310][T17123] Registered IR keymap rc-empty [ 1396.932778][T17123] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 1396.969701][T17123] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input104 [ 1397.005148][T17123] dvb-usb: schedule remote query interval to 100 msecs. [ 1397.026032][T17123] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1397.056237][T17123] usb 4-1: USB disconnect, device number 60 [ 1397.244994][T17123] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1397.513536][ T6948] team0 (unregistering): Port device team_slave_1 removed [ 1397.545397][ T6948] team0 (unregistering): Port device team_slave_0 removed [ 1397.765203][T19324] bridge0: port 1(bridge_slave_0) entered blocking state [ 1397.775689][T19324] bridge0: port 1(bridge_slave_0) entered disabled state [ 1397.786877][T19376] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1397.801773][T19324] bridge_slave_0: entered allmulticast mode [ 1397.810934][T19376] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1397.824475][T19324] bridge_slave_0: entered promiscuous mode [ 1397.841957][T19324] bridge0: port 2(bridge_slave_1) entered blocking state [ 1397.850825][T19324] bridge0: port 2(bridge_slave_1) entered disabled state [ 1397.877054][T19324] bridge_slave_1: entered allmulticast mode [ 1397.887595][T19376] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1397.896483][T19324] bridge_slave_1: entered promiscuous mode [ 1397.923472][T19392] fuse: Unknown parameter '00000000000000000000' [ 1398.008806][T19324] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1398.074595][T19324] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1398.160763][T17136] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 1398.278542][T19324] team0: Port device team_slave_0 added [ 1398.326353][T19324] team0: Port device team_slave_1 added [ 1398.391410][T17136] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1398.424365][T17136] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1398.474261][T17136] usb 1-1: config 0 descriptor?? [ 1398.504508][T19324] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1398.544629][T19324] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1398.771670][T19324] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1398.811703][T17136] udl 1-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1398.849833][T19324] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1398.861851][T19324] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1398.890229][T19324] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1399.023422][T17136] [drm:udl_init] *ERROR* Selecting channel failed [ 1399.030714][T17135] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1399.056317][T17136] [drm] Initialized udl 0.0.1 for 1-1:0.0 on minor 2 [ 1399.092737][T17136] [drm] Initialized udl on minor 2 [ 1399.107180][T17136] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1399.258588][T17135] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1399.290103][T17135] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1399.302219][T19324] hsr_slave_0: entered promiscuous mode [ 1399.315241][T17136] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 1399.323530][T19324] hsr_slave_1: entered promiscuous mode [ 1399.330031][T19324] debugfs: 'hsr0' already exists in 'hsr' [ 1399.349832][T17138] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1399.362545][T17138] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 1399.392105][T17135] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1399.400857][T19324] Cannot create hsr debugfs directory [ 1399.414300][T17136] usb 1-1: USB disconnect, device number 43 [ 1399.428220][T17135] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1399.460897][T17135] usb 4-1: Product: syz [ 1399.465160][T17135] usb 4-1: Manufacturer: syz [ 1399.496568][T17135] usb 4-1: SerialNumber: syz [ 1399.733773][T19412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1399.755217][T19412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1399.792269][T19412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1399.812512][T19321] Bluetooth: hci2: command 0x0419 tx timeout [ 1399.830495][T19412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1399.907415][T17135] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 1400.035950][T17135] usb 4-1: USB disconnect, device number 61 [ 1400.532991][T19324] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1400.622528][T19324] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1400.663167][T19324] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1400.722965][T19324] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1401.383143][T19462] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3166'. [ 1401.495185][T19324] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1401.528506][T19324] 8021q: adding VLAN 0 to HW filter on device team0 [ 1401.608172][T19442] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1401.614852][ T6952] bridge0: port 1(bridge_slave_0) entered blocking state [ 1401.622284][ T6952] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1401.772004][ T1144] bridge0: port 2(bridge_slave_1) entered blocking state [ 1401.779230][ T1144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1401.928779][T19324] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1402.154727][T19324] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1402.357978][T19324] veth0_vlan: entered promiscuous mode [ 1402.471498][T19324] veth1_vlan: entered promiscuous mode [ 1402.498234][T19475] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3169'. [ 1402.610411][T19324] veth0_macvtap: entered promiscuous mode [ 1402.690089][T19324] veth1_macvtap: entered promiscuous mode [ 1402.841096][T19324] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1402.851001][T19321] Bluetooth: hci2: command 0x0419 tx timeout [ 1402.902407][T19484] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3170'. [ 1402.963405][T19324] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1402.992132][T19484] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1403.056854][ T6952] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1403.130552][T19490] FAULT_INJECTION: forcing a failure. [ 1403.130552][T19490] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1403.193458][T19490] CPU: 1 UID: 0 PID: 19490 Comm: syz.1.3172 Tainted: G L syzkaller #0 PREEMPT(full) [ 1403.193499][T19490] Tainted: [L]=SOFTLOCKUP [ 1403.193509][T19490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1403.193524][T19490] Call Trace: [ 1403.193535][T19490] [ 1403.193546][T19490] dump_stack_lvl+0xe8/0x150 [ 1403.193587][T19490] should_fail_ex+0x412/0x560 [ 1403.193628][T19490] _copy_from_user+0x2d/0xb0 [ 1403.193656][T19490] __se_sys_add_key+0x2af/0x420 [ 1403.193689][T19490] ? __pfx___se_sys_add_key+0x10/0x10 [ 1403.193728][T19490] ? __x64_sys_add_key+0x20/0xc0 [ 1403.193757][T19490] do_syscall_64+0x14d/0xf80 [ 1403.193786][T19490] ? trace_irq_disable+0x3b/0x150 [ 1403.193820][T19490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.193845][T19490] ? clear_bhb_loop+0x40/0x90 [ 1403.193874][T19490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.193898][T19490] RIP: 0033:0x7f797779c799 [ 1403.193921][T19490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1403.193942][T19490] RSP: 002b:00007f7978740028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1403.193969][T19490] RAX: ffffffffffffffda RBX: 00007f7977a15fa0 RCX: 00007f797779c799 [ 1403.193987][T19490] RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000200000000000 [ 1403.194004][T19490] RBP: 00007f7978740090 R08: ffffffffffffffff R09: 0000000000000000 [ 1403.194021][T19490] R10: 0000000000001001 R11: 0000000000000246 R12: 0000000000000001 [ 1403.194036][T19490] R13: 00007f7977a16038 R14: 00007f7977a15fa0 R15: 00007f7977b3fa48 [ 1403.194071][T19490] [ 1403.563111][ T6952] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1403.617481][ T6952] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1403.776544][ T6952] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1403.858762][ T6954] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1403.903029][ T6954] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1404.114572][ T6954] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1404.127679][T19496] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1404.159301][ T6954] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1404.668220][T17123] IPVS: starting estimator thread 0... [ 1404.772144][T19507] IPVS: using max 37 ests per chain, 88800 per kthread [ 1404.951451][T19321] Bluetooth: hci2: command 0x0419 tx timeout [ 1406.222622][T19531] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3178'. [ 1407.012120][T19321] Bluetooth: hci2: command 0x0419 tx timeout [ 1408.173131][T19551] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3182'. [ 1408.284064][T19551] netlink: 84 bytes leftover after parsing attributes in process `syz.3.3182'. [ 1409.538675][T19574] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3189'. [ 1409.731099][ T5906] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1409.910898][ T5906] usb 6-1: Using ep0 maxpacket: 8 [ 1409.921837][ T5906] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1409.936594][ T5906] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1409.945285][ T5906] usb 6-1: Product: syz [ 1409.950236][ T5906] usb 6-1: Manufacturer: syz [ 1409.959032][ T5906] usb 6-1: SerialNumber: syz [ 1410.012751][ T5906] usb 6-1: config 0 descriptor?? [ 1410.490884][ T5906] usb 6-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1410.645041][T19584] fuse: Unknown parameter 'user00000000000000000000' [ 1411.018972][T19572] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1411.720762][ T5906] usb write operation failed. (-71) [ 1411.763857][ T5906] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1411.785023][ T5906] dvbdev: DVB: registering new adapter (Terratec H7) [ 1411.794859][ T5906] usb 6-1: media controller created [ 1411.801182][ T5906] usb read operation failed. (-71) [ 1411.953636][ T5906] usb write operation failed. (-71) [ 1411.963029][ T5906] dvb_usb_az6007 6-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1411.985681][ T5906] usb 6-1: USB disconnect, device number 2 [ 1411.992669][T19603] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3197'. [ 1413.460741][T17125] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 1413.621245][T17125] usb 1-1: Using ep0 maxpacket: 32 [ 1413.652812][T17125] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 1413.720957][T17125] usb 1-1: config 0 has no interface number 0 [ 1413.727257][T17125] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1413.753054][T17125] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1413.762519][T17125] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1413.771057][T17125] usb 1-1: Product: syz [ 1413.775370][T17125] usb 1-1: Manufacturer: syz [ 1413.780020][T17125] usb 1-1: SerialNumber: syz [ 1413.796355][T17125] usb 1-1: config 0 descriptor?? [ 1413.806550][T19614] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1414.116400][ T30] audit: type=1800 audit(1774318004.038:313): pid=19625 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.3200" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=96087 res=0 errno=0 [ 1414.622114][T19633] fuse: Unknown parameter 'user_i00000000000000000000' [ 1414.711207][ T5906] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 1414.894526][ T5906] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1414.955248][ T5906] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1414.987359][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1415.007875][ T5906] usb 4-1: Product: syz [ 1415.025971][ T5906] usb 4-1: Manufacturer: syz [ 1415.046006][ T5906] usb 4-1: SerialNumber: syz [ 1415.167770][T17134] hid-generic 0000:0000:0000.0022: unknown main item tag 0x0 [ 1415.198027][T17134] hid-generic 0000:0000:0000.0022: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1415.241068][T17123] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1415.532444][T17123] usb 5-1: Using ep0 maxpacket: 8 [ 1415.557257][T17123] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1415.575708][ T30] audit: type=1326 audit(1774318005.498:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19652 comm="syz.1.3210" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f797779c799 code=0x0 [ 1415.634564][T17123] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1415.646503][T17123] usb 5-1: Product: syz [ 1415.652438][T17123] usb 5-1: Manufacturer: syz [ 1415.662720][T17123] usb 5-1: SerialNumber: syz [ 1415.688087][T17123] usb 5-1: config 0 descriptor?? [ 1415.972018][T17123] usb 5-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1416.181701][ T5906] cdc_ncm 4-1:1.0: failed to get mac address [ 1416.200241][ T5906] cdc_ncm 4-1:1.0: bind() failure [ 1416.282157][ T5906] cdc_ncm 4-1:1.1: probe with driver cdc_ncm failed with error -71 [ 1416.325545][ T5906] cdc_mbim 4-1:1.1: probe with driver cdc_mbim failed with error -71 [ 1416.366110][ T5906] usbtest 4-1:1.1: probe with driver usbtest failed with error -71 [ 1416.396301][T17125] asix 1-1:0.188: probe with driver asix failed with error -71 [ 1416.426990][ T5906] usb 4-1: USB disconnect, device number 62 [ 1416.436196][T17125] usb 1-1: USB disconnect, device number 44 [ 1416.492931][T15969] udevd[15969]: setting owner of /dev/bus/usb/004/062 to uid=0, gid=0 failed: No such file or directory [ 1416.595658][T19647] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1416.912303][T17125] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 1417.051546][ T5906] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 1417.125037][T17125] usb 1-1: Using ep0 maxpacket: 16 [ 1417.148831][T17125] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1417.167143][T17125] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1417.184001][T17125] usb 1-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1417.193513][T17125] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1417.221147][T17123] usb write operation failed. (-71) [ 1417.229453][T17123] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1417.251550][T17125] usb 1-1: config 0 descriptor?? [ 1417.265357][T17123] dvbdev: DVB: registering new adapter (Terratec H7) [ 1417.274044][T17123] usb 5-1: media controller created [ 1417.279907][T17123] usb read operation failed. (-71) [ 1417.289810][T17123] usb write operation failed. (-71) [ 1417.389620][ T5906] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1417.404050][T17123] dvb_usb_az6007 5-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1417.422649][ T5906] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1417.432832][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1417.443549][ T5906] usb 4-1: Product: syz [ 1417.453958][T17123] usb 5-1: USB disconnect, device number 69 [ 1417.461688][ T5906] usb 4-1: Manufacturer: syz [ 1417.474523][ T5906] usb 4-1: SerialNumber: syz [ 1418.534291][ T5906] cdc_ncm 4-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1418.554159][ T5906] cdc_ncm 4-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 1418.588402][ T5906] cdc_ncm 4-1:1.0: setting rx_max = 2048 [ 1418.736741][T19674] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3213'. [ 1418.745821][T19674] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3213'. [ 1418.962718][ T5906] cdc_ncm 4-1:1.0: setting tx_max = 88 [ 1418.979034][ T5906] cdc_ncm 4-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.3-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1419.005082][ T5906] usb 4-1: USB disconnect, device number 63 [ 1419.031842][ T5906] cdc_ncm 4-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.3-1, CDC NCM (NO ZLP) [ 1419.050725][T17125] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 1419.079993][T19694] netlink: 'syz.5.3219': attribute type 64 has an invalid length. [ 1419.156936][T19694] netlink: 51 bytes leftover after parsing attributes in process `syz.5.3219'. [ 1419.213872][T17125] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1419.230077][T17125] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1419.245285][T17125] usb 5-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 1419.254878][T17125] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1419.268141][T17125] usb 5-1: config 0 descriptor?? [ 1419.382914][ T30] audit: type=1326 audit(1774318009.318:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19698 comm="syz.1.3220" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f797779c799 code=0x0 [ 1419.591398][T17125] usb 1-1: USB disconnect, device number 45 [ 1419.868930][T19692] netlink: 'syz.4.3218': attribute type 10 has an invalid length. [ 1419.876953][T19692] batadv0: entered promiscuous mode [ 1419.884409][T19692] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1419.896620][T19692] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1420.152240][T17125] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 1420.173439][T17134] hid-generic 0000:0000:0000.0023: unknown main item tag 0x0 [ 1420.241525][T17134] hid-generic 0000:0000:0000.0023: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1420.364046][T17125] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1420.421122][ T5906] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 1420.464451][T17125] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1420.534335][T17125] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1420.614280][T17125] usb 1-1: Product: syz [ 1420.618558][T17125] usb 1-1: Manufacturer: syz [ 1420.633831][ T5906] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1420.668981][ T5906] usb 4-1: can't read configurations, error -61 [ 1420.683750][T17125] usb 1-1: SerialNumber: syz [ 1420.831622][ T5906] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1421.007438][ T5906] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1421.017485][ T5906] usb 4-1: can't read configurations, error -61 [ 1421.063187][ T5906] usb usb4-port1: attempt power cycle [ 1421.420756][ T5906] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1421.454255][ T5906] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1421.463983][ T5906] usb 4-1: can't read configurations, error -61 [ 1421.620920][ T5906] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1421.667461][ T5906] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1421.683998][ T5906] usb 4-1: can't read configurations, error -61 [ 1421.720301][ T5906] usb usb4-port1: unable to enumerate USB device [ 1421.743593][T17125] cdc_ncm 1-1:1.0: failed to get mac address [ 1421.753130][T17125] cdc_ncm 1-1:1.0: bind() failure [ 1421.770532][T17125] cdc_ncm 1-1:1.1: probe with driver cdc_ncm failed with error -71 [ 1421.801388][T17125] cdc_mbim 1-1:1.1: probe with driver cdc_mbim failed with error -71 [ 1421.810940][T17118] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1421.830830][T17125] usbtest 1-1:1.1: probe with driver usbtest failed with error -71 [ 1421.871118][T17125] usb 1-1: USB disconnect, device number 46 [ 1421.971397][T17118] usb 6-1: Using ep0 maxpacket: 32 [ 1421.985580][T17118] usb 6-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1422.011050][T17118] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1422.029531][T17118] usb 6-1: Product: syz [ 1422.049938][T17118] usb 6-1: Manufacturer: syz [ 1422.060138][T17118] usb 6-1: SerialNumber: syz [ 1422.084401][T17118] usb 6-1: config 0 descriptor?? [ 1422.113573][T17118] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1422.127845][T17125] usb 5-1: USB disconnect, device number 70 [ 1422.166434][T17118] dvb-usb: bulk message failed: -22 (2/0) [ 1422.183107][T17118] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1422.193581][T17118] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1422.203197][T17118] usb 6-1: media controller created [ 1422.226878][T17118] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1422.257331][T17118] usb 6-1: selecting invalid altsetting 7 [ 1422.281037][T17118] cxusb: set interface failed [ 1422.286016][T17118] dvb-usb: bulk message failed: -22 (1/0) [ 1422.404668][T17118] DVB: Unable to find symbol lgdt330x_attach() [ 1422.411089][T17118] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1422.630892][T17118] rc_core: IR keymap rc-dvico-portable not found [ 1422.672222][T17118] Registered IR keymap rc-empty [ 1422.686045][T17118] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 1422.709813][T17118] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input105 [ 1422.736986][T17118] dvb-usb: schedule remote query interval to 100 msecs. [ 1422.990300][T17118] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1423.019160][T17118] usb 6-1: USB disconnect, device number 3 [ 1423.156228][T17118] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1423.278217][T19762] fuse: Unknown parameter 'user_id00000000000000000000' [ 1423.338062][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.350824][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.399380][T17137] usb 2-1: dvb_usb_v2: Did not find the firmware file 'dvb-usb-terratec-h7-az6007.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 1423.472800][T17137] dvb_usb_az6007 2-1:0.0: probe with driver dvb_usb_az6007 failed with error -110 [ 1423.522478][T17137] usb 2-1: USB disconnect, device number 70 [ 1423.810731][T17134] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1423.984128][T17134] usb 6-1: Using ep0 maxpacket: 16 [ 1424.012657][T17134] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1424.040011][T17134] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1424.066593][T17134] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1424.100677][T17134] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1424.138852][T17134] usb 6-1: config 0 descriptor?? [ 1424.521030][T17125] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 1424.671054][T17118] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 1424.690949][T17125] usb 4-1: Using ep0 maxpacket: 32 [ 1424.701920][T17125] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1424.725869][T17125] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.754240][T17125] usb 4-1: Product: syz [ 1424.859011][T17125] usb 4-1: Manufacturer: syz [ 1424.912894][T17125] usb 4-1: SerialNumber: syz [ 1424.924477][T17125] usb 4-1: config 0 descriptor?? [ 1424.934446][T17118] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1424.949894][T17125] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1424.959043][T17125] dvb-usb: bulk message failed: -22 (2/0) [ 1424.971313][T17118] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1424.981081][T17118] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.996052][T17125] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1425.005645][T17118] usb 2-1: Product: syz [ 1425.010017][T17118] usb 2-1: Manufacturer: syz [ 1425.029572][T17118] usb 2-1: SerialNumber: syz [ 1425.035508][T17125] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1425.049471][T17125] usb 4-1: media controller created [ 1425.199952][T17125] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1425.455307][T17125] usb 4-1: selecting invalid altsetting 7 [ 1425.479239][T17125] cxusb: set interface failed [ 1425.498773][T17125] dvb-usb: bulk message failed: -22 (1/0) [ 1425.693434][T17125] DVB: Unable to find symbol lgdt330x_attach() [ 1425.736603][T17125] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1426.020676][T17125] rc_core: IR keymap rc-dvico-portable not found [ 1426.080166][T17118] cdc_ncm 2-1:1.0: failed to get mac address [ 1426.117363][T17125] Registered IR keymap rc-empty [ 1426.159196][T17118] cdc_ncm 2-1:1.0: bind() failure [ 1426.171811][T17125] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 1426.221246][T17118] cdc_ncm 2-1:1.1: probe with driver cdc_ncm failed with error -71 [ 1426.234164][T17125] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input106 [ 1426.264819][T17118] cdc_mbim 2-1:1.1: probe with driver cdc_mbim failed with error -71 [ 1426.293113][T17125] dvb-usb: schedule remote query interval to 100 msecs. [ 1426.302709][T17118] usbtest 2-1:1.1: probe with driver usbtest failed with error -71 [ 1426.319053][T17125] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1426.339333][T17118] usb 2-1: USB disconnect, device number 71 [ 1426.362025][T17125] usb 4-1: USB disconnect, device number 68 [ 1426.537298][T17125] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1426.550826][T17136] usb 6-1: USB disconnect, device number 4 [ 1427.274108][T17136] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 1427.430703][T17136] usb 1-1: Using ep0 maxpacket: 8 [ 1427.440500][T17136] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1427.460446][T17136] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1427.487696][T17136] usb 1-1: Product: syz [ 1427.521187][T17136] usb 1-1: Manufacturer: syz [ 1427.576931][T17136] usb 1-1: SerialNumber: syz [ 1427.656135][T17136] usb 1-1: config 0 descriptor?? [ 1428.171663][T17136] usb 1-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1428.778048][T19830] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1428.960836][T17137] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 1429.177167][T17137] usb 2-1: Using ep0 maxpacket: 32 [ 1429.186848][T17137] usb 2-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1429.196919][T17137] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1429.298456][T17137] usb 2-1: Product: syz [ 1429.303257][T17137] usb 2-1: Manufacturer: syz [ 1429.343729][T17137] usb 2-1: SerialNumber: syz [ 1429.366763][T17137] usb 2-1: config 0 descriptor?? [ 1429.387213][T17137] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1429.413994][T17137] dvb-usb: bulk message failed: -22 (2/0) [ 1429.422954][T17134] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1429.497859][T17137] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1429.512402][T17136] usb write operation failed. (-71) [ 1429.518167][T17137] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1429.528936][T17136] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1429.564233][T17137] usb 2-1: media controller created [ 1429.571864][T17136] dvbdev: DVB: registering new adapter (Terratec H7) [ 1429.590701][T17136] usb 1-1: media controller created [ 1429.607875][T17136] usb read operation failed. (-71) [ 1429.622750][T17134] usb 6-1: Using ep0 maxpacket: 16 [ 1429.642356][T17134] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1429.780231][T17134] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1429.791372][T17137] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1429.810296][T17134] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1429.838957][T17134] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1429.862375][T17137] usb 2-1: selecting invalid altsetting 7 [ 1429.868872][T17136] usb write operation failed. (-71) [ 1429.880464][T17134] usb 6-1: config 0 descriptor?? [ 1429.889500][T17137] cxusb: set interface failed [ 1429.919382][T17136] dvb_usb_az6007 1-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1429.952281][T17137] dvb-usb: bulk message failed: -22 (1/0) [ 1429.974966][T17136] usb 1-1: USB disconnect, device number 47 [ 1430.281256][T19885] FAULT_INJECTION: forcing a failure. [ 1430.281256][T19885] name failslab, interval 1, probability 0, space 0, times 0 [ 1430.298285][T17137] DVB: Unable to find symbol lgdt330x_attach() [ 1430.304911][T17137] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1430.313427][T19885] CPU: 0 UID: 0 PID: 19885 Comm: syz.1.3257 Tainted: G L syzkaller #0 PREEMPT(full) [ 1430.313469][T19885] Tainted: [L]=SOFTLOCKUP [ 1430.313479][T19885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1430.313494][T19885] Call Trace: [ 1430.313504][T19885] [ 1430.313514][T19885] dump_stack_lvl+0xe8/0x150 [ 1430.313558][T19885] should_fail_ex+0x412/0x560 [ 1430.313600][T19885] should_failslab+0xa8/0x100 [ 1430.313636][T19885] __kmalloc_noprof+0xe8/0x760 [ 1430.313775][T19885] ? tomoyo_encode+0x28b/0x550 [ 1430.313819][T19885] tomoyo_encode+0x28b/0x550 [ 1430.313862][T19885] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1430.313913][T19885] ? tomoyo_path_number_perm+0x219/0x630 [ 1430.313945][T19885] tomoyo_path_number_perm+0x246/0x630 [ 1430.313977][T19885] ? rcu_is_watching+0x15/0xb0 [ 1430.314013][T19885] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1430.314044][T19885] ? __schedule+0x15f3/0x52d0 [ 1430.314073][T19885] ? __pfx___schedule+0x10/0x10 [ 1430.314144][T19885] security_file_ioctl+0xc3/0x2a0 [ 1430.314179][T19885] __se_sys_ioctl+0x47/0x170 [ 1430.314231][T19885] do_syscall_64+0x14d/0xf80 [ 1430.314258][T19885] ? trace_irq_disable+0x3b/0x150 [ 1430.314293][T19885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1430.314319][T19885] ? clear_bhb_loop+0x40/0x90 [ 1430.314348][T19885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1430.314391][T19885] RIP: 0033:0x7f797779c799 [ 1430.314419][T19885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1430.314439][T19885] RSP: 002b:00007f7978740028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1430.314465][T19885] RAX: ffffffffffffffda RBX: 00007f7977a15fa0 RCX: 00007f797779c799 [ 1430.314489][T19885] RDX: 0000200000000080 RSI: 00000000c0303e03 RDI: 0000000000000005 [ 1430.314508][T19885] RBP: 00007f7978740090 R08: 0000000000000000 R09: 0000000000000000 [ 1430.314523][T19885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1430.314537][T19885] R13: 00007f7977a16038 R14: 00007f7977a15fa0 R15: 00007f7977b3fa48 [ 1430.314575][T19885] [ 1430.314896][T19885] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1430.661745][T17136] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 1430.673067][T17137] rc_core: IR keymap rc-dvico-portable not found [ 1430.679538][T17137] Registered IR keymap rc-empty [ 1430.703822][T17137] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 1430.732657][T17137] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input107 [ 1430.746613][T17137] dvb-usb: schedule remote query interval to 100 msecs. [ 1430.753970][T17137] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1430.816450][T17137] usb 2-1: USB disconnect, device number 72 [ 1430.846597][T17136] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1430.860812][T17136] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1430.879661][T17136] usb 1-1: Product: syz [ 1430.897872][T17136] usb 1-1: Manufacturer: syz [ 1430.910716][T17136] usb 1-1: SerialNumber: syz [ 1430.936845][T17136] usb 1-1: config 0 descriptor?? [ 1430.953426][T17137] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1431.229400][T17136] usb 1-1: USB disconnect, device number 48 [ 1431.968252][T17136] usb 6-1: USB disconnect, device number 5 [ 1431.981727][T19892] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1432.241914][T17125] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1432.322963][T19918] loop5: detected capacity change from 0 to 7 [ 1432.337435][T16359] Dev loop5: unable to read RDB block 7 [ 1432.348343][T16359] loop5: AHDI p1 p2 p3 [ 1432.354834][T16359] loop5: partition table partially beyond EOD, truncated [ 1432.366804][T16359] loop5: p1 start 1601398130 is beyond EOD, truncated [ 1432.377457][T16359] loop5: p2 start 1702059890 is beyond EOD, truncated [ 1432.403909][T19918] Dev loop5: unable to read RDB block 7 [ 1432.410243][T19918] loop5: AHDI p1 p2 p3 [ 1432.421051][T17125] usb 5-1: Using ep0 maxpacket: 8 [ 1432.426518][T19918] loop5: partition table partially beyond EOD, truncated [ 1432.448508][T17125] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1432.461976][T17125] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1432.472347][T19918] loop5: p1 start 1601398130 is beyond EOD, truncated [ 1432.486540][T19918] loop5: p2 start 1702059890 is beyond EOD, truncated [ 1432.494707][T17125] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1432.511913][T17125] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1432.533267][T17125] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1432.570191][T17125] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1432.620145][T17125] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1432.648024][T17125] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1432.709366][T17125] usbtmc 5-1:16.0: probe with driver usbtmc failed with error -22 [ 1432.760793][T17136] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1432.921975][T17136] usb 6-1: Using ep0 maxpacket: 8 [ 1432.934057][T17136] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 1432.945120][T17136] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1432.957391][T17136] usb 6-1: Product: syz [ 1432.967491][T17136] usb 6-1: Manufacturer: syz [ 1432.977320][T17136] usb 6-1: SerialNumber: syz [ 1432.987076][T17136] usb 6-1: config 0 descriptor?? [ 1433.226269][T17136] usb 6-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 1433.501846][T19927] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1433.511686][T19896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1433.540203][T19896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1433.562817][T17118] usb 5-1: USB disconnect, device number 71 [ 1433.657342][T19936] FAULT_INJECTION: forcing a failure. [ 1433.657342][T19936] name failslab, interval 1, probability 0, space 0, times 0 [ 1433.676701][T19936] CPU: 1 UID: 0 PID: 19936 Comm: syz.1.3270 Tainted: G L syzkaller #0 PREEMPT(full) [ 1433.676738][T19936] Tainted: [L]=SOFTLOCKUP [ 1433.676747][T19936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1433.676761][T19936] Call Trace: [ 1433.676771][T19936] [ 1433.676781][T19936] dump_stack_lvl+0xe8/0x150 [ 1433.676819][T19936] should_fail_ex+0x412/0x560 [ 1433.676858][T19936] should_failslab+0xa8/0x100 [ 1433.676889][T19936] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1433.676914][T19936] ? __alloc_skb+0x186/0x7d0 [ 1433.676938][T19936] ? __alloc_skb+0x1d0/0x7d0 [ 1433.676957][T19936] ? __local_bh_enable_ip+0xd0/0x130 [ 1433.676992][T19936] __alloc_skb+0x1d0/0x7d0 [ 1433.677031][T19936] netlink_sendmsg+0x5d4/0xb40 [ 1433.677064][T19936] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1433.677089][T19936] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1433.677137][T19936] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1433.677167][T19936] ____sys_sendmsg+0x972/0x9f0 [ 1433.677204][T19936] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1433.677240][T19936] ? import_iovec+0x73/0xa0 [ 1433.677270][T19936] ___sys_sendmsg+0x2a5/0x360 [ 1433.677302][T19936] ? __pfx____sys_sendmsg+0x10/0x10 [ 1433.677366][T19936] ? __fget_files+0x2a/0x420 [ 1433.677399][T19936] ? __fget_files+0x3a0/0x420 [ 1433.677443][T19936] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1433.677473][T19936] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1433.677511][T19936] ? __pfx_ksys_write+0x10/0x10 [ 1433.677549][T19936] do_syscall_64+0x14d/0xf80 [ 1433.677574][T19936] ? trace_irq_disable+0x3b/0x150 [ 1433.677607][T19936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1433.677630][T19936] ? clear_bhb_loop+0x40/0x90 [ 1433.677658][T19936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1433.677681][T19936] RIP: 0033:0x7f797779c799 [ 1433.677703][T19936] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1433.677724][T19936] RSP: 002b:00007f7978740028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1433.677750][T19936] RAX: ffffffffffffffda RBX: 00007f7977a15fa0 RCX: 00007f797779c799 [ 1433.677767][T19936] RDX: 0000000004040000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1433.677784][T19936] RBP: 00007f7978740090 R08: 0000000000000000 R09: 0000000000000000 [ 1433.677798][T19936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1433.677812][T19936] R13: 00007f7977a16038 R14: 00007f7977a15fa0 R15: 00007f7977b3fa48 [ 1433.677848][T19936] [ 1433.943750][T19923] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1434.072475][T17137] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1434.134878][T19945] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3273'. [ 1434.144587][T19945] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3273'. [ 1434.241062][T17137] usb 4-1: Using ep0 maxpacket: 16 [ 1434.248502][T17137] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1434.259187][T17137] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1434.268752][T17137] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1434.282180][T17137] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1434.305018][T17137] usb 4-1: config 0 descriptor?? [ 1434.614120][T17136] usb write operation failed. (-71) [ 1434.624762][T17136] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1434.635557][T17136] dvbdev: DVB: registering new adapter (Terratec H7) [ 1434.648773][T17136] usb 6-1: media controller created [ 1434.660989][T17136] usb read operation failed. (-71) [ 1434.673067][T17136] usb write operation failed. (-71) [ 1434.689148][T17136] dvb_usb_az6007 6-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 1434.727401][T17136] usb 6-1: USB disconnect, device number 6 [ 1435.058891][T19947] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1435.093427][T19956] syzkaller0: entered promiscuous mode [ 1435.098980][T19956] syzkaller0: entered allmulticast mode [ 1435.310746][T17137] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 1435.318535][T17136] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 1435.470932][T17136] usb 5-1: Using ep0 maxpacket: 16 [ 1435.478869][T17137] usb 1-1: config 0 has no interfaces? [ 1435.485588][T17136] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1435.497938][T17136] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1435.510000][T17137] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1435.519674][T17136] usb 5-1: New USB device found, idVendor=046d, idProduct=c50c, bcdDevice= 0.00 [ 1435.528946][T17137] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1435.540245][T17137] usb 1-1: SerialNumber: syz [ 1435.545249][T17136] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1435.564264][T17137] usb 1-1: config 0 descriptor?? [ 1435.579308][T17136] usb 5-1: config 0 descriptor?? [ 1435.596277][T19970] binder: BINDER_SET_CONTEXT_MGR already set [ 1435.602536][T19970] binder: 19967:19970 ioctl 4018620d 200000000040 returned -16 [ 1435.776207][T17137] usb 1-1: USB disconnect, device number 49 [ 1436.097191][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.105702][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.113153][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.120760][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.129096][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.139401][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.148560][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.155974][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.163682][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.175416][T17136] logitech 0003:046D:C50C.0024: unknown main item tag 0x0 [ 1436.309036][T19321] Bluetooth: hci2: command 0x0419 tx timeout [ 1436.341779][T17136] logitech 0003:046D:C50C.0024: hidraw0: USB HID v0.81 Device [HID 046d:c50c] on usb-dummy_hcd.4-1/input0 [ 1436.700919][T17136] usb 4-1: USB disconnect, device number 69 [ 1437.130020][T19984] binder: 19978:19984 ioctl c0306201 200000000180 returned -22 [ 1437.343147][T19974] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1437.515351][T17118] usb 5-1: USB disconnect, device number 72 [ 1437.634956][T19993] netlink: 'syz.4.3288': attribute type 12 has an invalid length. [ 1437.643469][T17136] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1437.960866][T17137] usb 2-1: new full-speed USB device number 73 using dummy_hcd [ 1437.974543][T17136] usb 6-1: Using ep0 maxpacket: 32 [ 1437.997026][T17136] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 1438.035583][T17136] usb 6-1: config 0 has no interface number 0 [ 1438.049402][T17136] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1438.077470][T17136] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1438.095565][T17136] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1438.123761][T17136] usb 6-1: Product: syz [ 1438.135813][T17137] usb 2-1: config 1 interface 0 has no altsetting 0 [ 1438.157458][T17137] usb 2-1: New USB device found, idVendor=05ac, idProduct=025b, bcdDevice= 0.40 [ 1438.168376][T17136] usb 6-1: Manufacturer: syz [ 1438.188843][T17136] usb 6-1: SerialNumber: syz [ 1438.194117][T17137] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1438.217058][T17137] usb 2-1: Product: syz [ 1438.222595][T17136] usb 6-1: config 0 descriptor?? [ 1438.232461][T17137] usb 2-1: Manufacturer: syz [ 1438.242621][T19977] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1438.284215][T17137] usb 2-1: SerialNumber: syz [ 1438.573240][ T30] audit: type=1800 audit(1774318028.488:316): pid=19997 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3283" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=97807 res=0 errno=0 [ 1438.616850][T19321] Bluetooth: hci2: command 0x0419 tx timeout [ 1438.779271][T20000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1438.803762][T20000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1438.880781][T20002] fuse: Bad value for 'fd' [ 1439.092010][T20004] dlm: non-version read from control device 36 [ 1439.563492][T20012] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3292'. [ 1439.940861][T20017] binder: BINDER_SET_CONTEXT_MGR already set [ 1439.947110][T20017] binder: 20013:20017 ioctl 4018620d 200000000040 returned -16 [ 1440.554665][T17136] asix 6-1:0.188: probe with driver asix failed with error -71 [ 1440.631365][T17136] usb 6-1: USB disconnect, device number 7 [ 1440.653682][T17137] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input108 [ 1440.697138][ T5182] bcm5974 2-1:1.0: could not read from device [ 1440.716009][ T5182] bcm5974 2-1:1.0: could not read from device [ 1440.746115][T17137] usb 2-1: USB disconnect, device number 73 [ 1440.774424][ T5182] bcm5974 2-1:1.0: could not read from device [ 1440.954266][T15782] udevd[15782]: Error opening device "/dev/input/event4": No such file or directory [ 1441.005453][T15782] udevd[15782]: Unable to EVIOCGABS device "/dev/input/event4" [ 1441.030752][T17136] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1441.069251][T15782] udevd[15782]: Unable to EVIOCGABS device "/dev/input/event4" [ 1441.101988][T15782] udevd[15782]: Unable to EVIOCGABS device "/dev/input/event4" [ 1441.109769][T15782] udevd[15782]: Unable to EVIOCGABS device "/dev/input/event4" [ 1441.210845][T17136] usb 6-1: Using ep0 maxpacket: 16 [ 1441.220840][T15782] udevd[15782]: Assertion 'close_nointr(fd) != -EBADF' failed at util.c:228, function safe_close(). Aborting. [ 1441.241743][T17136] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1441.262376][T17136] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1441.310802][T17136] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1441.442434][ T5197] udevd[5197]: worker [15782] terminated by signal 6 (Aborted) [ 1441.450115][ T5197] udevd[5197]: worker [15782] failed while handling '/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input108/event4' [ 1441.464801][T17136] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1441.499410][T17136] usb 6-1: config 0 descriptor?? [ 1441.544404][T20023] syzkaller1: entered promiscuous mode [ 1441.558879][T20023] syzkaller1: entered allmulticast mode [ 1441.811122][T17136] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1441.973037][T17136] usb 4-1: Using ep0 maxpacket: 16 [ 1441.988158][T17136] usb 4-1: config 0 has an invalid interface number: 105 but max is 0 [ 1442.016466][T17136] usb 4-1: config 0 has an invalid descriptor of length 116, skipping remainder of the config [ 1442.041543][T17136] usb 4-1: config 0 has no interface number 0 [ 1442.051115][T17136] usb 4-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 1442.060725][T17136] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1442.068936][T17136] usb 4-1: Product: syz [ 1442.073497][T17136] usb 4-1: Manufacturer: syz [ 1442.079126][T17136] usb 4-1: SerialNumber: syz [ 1442.115933][T17136] usb 4-1: config 0 descriptor?? [ 1442.132114][T17136] uvcvideo 4-1:0.105: probe with driver uvcvideo failed with error -22 [ 1442.265519][T20042] fuse: Unknown parameter '0x0000000000000003' [ 1442.406440][T17136] usb 4-1: USB disconnect, device number 70 [ 1442.460751][T17118] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1442.703646][T17118] usb 2-1: Using ep0 maxpacket: 8 [ 1442.738302][T17118] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1442.749338][T17118] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1442.759451][T17118] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1442.769915][T17118] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1442.785467][T17118] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1442.796545][T17118] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1442.832841][T17118] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1442.891649][T17118] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1442.973019][T17118] usbtmc 2-1:16.0: probe with driver usbtmc failed with error -22 [ 1443.155098][T20050] netlink: 'syz.3.3305': attribute type 1 has an invalid length. [ 1443.201660][T20050] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1443.216379][T20050] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 1443.244487][T20052] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3305'. [ 1443.267207][T20052] bond1: (slave gretap1): making interface the new active one [ 1443.278544][T20052] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 1443.374669][T20033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1443.385206][T20033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1443.413906][T17137] usb 2-1: USB disconnect, device number 74 [ 1443.652283][T17137] usb 6-1: USB disconnect, device number 8 [ 1443.796592][T20056] dlm: non-version read from control device 36 [ 1444.092126][T20061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3309'. [ 1444.251133][T17137] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 1444.414058][T17137] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1444.425785][T17137] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1444.459963][T17137] usb 5-1: config 0 descriptor?? [ 1444.689228][T17137] udl 5-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1445.023485][T20075] binder: BINDER_SET_CONTEXT_MGR already set [ 1445.032355][T20075] binder: 20071:20075 ioctl 4018620d 200000000040 returned -16 [ 1445.140221][T17137] [drm:udl_init] *ERROR* Selecting channel failed [ 1445.508085][T17137] [drm] Initialized udl 0.0.1 for 5-1:0.0 on minor 2 [ 1445.525735][T17137] [drm] Initialized udl on minor 2 [ 1445.541792][T17137] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1445.568139][T17137] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 1445.590123][T17138] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1445.612155][T17137] usb 5-1: USB disconnect, device number 73 [ 1445.623166][T17138] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 1446.087530][T20084] fuse: Unknown parameter '0x0000000000000003' [ 1446.750761][T17137] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1446.943732][T17137] usb 5-1: Using ep0 maxpacket: 16 [ 1446.956560][T17137] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1446.968879][T17137] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1446.978348][T17137] usb 5-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 1446.992418][T17137] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1447.009776][T17137] usb 5-1: config 0 descriptor?? [ 1447.051395][T17118] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 1447.262648][T17118] usb 1-1: Using ep0 maxpacket: 8 [ 1447.289182][T17118] usb 1-1: config 2 has an invalid interface number: 31 but max is 0 [ 1447.298319][T17118] usb 1-1: config 2 has no interface number 0 [ 1447.305303][T17118] usb 1-1: config 2 interface 31 has no altsetting 0 [ 1447.321976][T17118] usb 1-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 1447.455932][T17118] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1447.520808][T17118] usb 1-1: Product: syz [ 1447.527219][T17118] usb 1-1: Manufacturer: syz [ 1447.555149][T17118] usb 1-1: SerialNumber: syz [ 1449.015696][T17118] ch9200 1-1:2.31: probe with driver ch9200 failed with error -22 [ 1449.070832][T20124] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3323'. [ 1449.459055][T17137] usb 5-1: USB disconnect, device number 74 [ 1449.668237][T17125] usb 1-1: USB disconnect, device number 50 [ 1449.797933][T17118] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1450.131087][T17118] usb 4-1: Using ep0 maxpacket: 32 [ 1450.236564][T17118] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1450.267245][T17118] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1450.352298][T17118] usb 4-1: Product: syz [ 1450.455407][T17118] usb 4-1: Manufacturer: syz [ 1450.583369][T17118] usb 4-1: SerialNumber: syz [ 1450.661013][T17118] usb 4-1: config 0 descriptor?? [ 1450.731356][T17118] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1450.740324][T17118] dvb-usb: bulk message failed: -22 (2/0) [ 1450.819577][T17118] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1451.028600][T17118] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1451.058584][T17118] usb 4-1: media controller created [ 1451.089674][T17118] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1451.132966][T17118] usb 4-1: selecting invalid altsetting 7 [ 1451.143132][T17118] cxusb: set interface failed [ 1451.152510][T17118] dvb-usb: bulk message failed: -22 (1/0) [ 1451.218102][T17118] DVB: Unable to find symbol lgdt330x_attach() [ 1451.237024][T17118] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1451.493041][T20151] binder: BINDER_SET_CONTEXT_MGR already set [ 1451.499314][T20151] binder: 20144:20151 ioctl 4018620d 200000000040 returned -16 [ 1451.571267][T17118] rc_core: IR keymap rc-dvico-portable not found [ 1451.587929][T17118] Registered IR keymap rc-empty [ 1451.651774][T17118] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 1451.731256][T17118] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input109 [ 1452.121918][T17118] dvb-usb: schedule remote query interval to 100 msecs. [ 1452.164589][T17118] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1452.232763][T17118] usb 4-1: USB disconnect, device number 71 [ 1452.451473][T17118] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1453.019915][T20162] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3335'. [ 1454.283123][T20179] sg_write: process 2661 (syz.4.3340) changed security contexts after opening file descriptor, this is not allowed. [ 1454.371099][T17125] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1454.535076][T17125] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1454.567439][T17125] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1454.593722][T17125] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1454.621282][T17125] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1454.639785][T17125] usb 4-1: Product: syz [ 1454.654825][T17125] usb 4-1: Manufacturer: syz [ 1454.700833][T17125] usb 4-1: SerialNumber: syz [ 1454.884881][T20182] fuse: Unknown parameter '0x0000000000000003' [ 1454.948503][T20176] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1454.961604][T20176] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1455.022686][T17125] cdc_ether 4-1:1.0: probe with driver cdc_ether failed with error -22 [ 1455.060077][T17125] usb 4-1: USB disconnect, device number 72 [ 1455.240770][T17136] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1455.415273][T17136] usb 5-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1455.424800][T17136] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.453814][T17136] usb 5-1: Product: syz [ 1455.463543][T17136] usb 5-1: Manufacturer: syz [ 1455.468250][T17136] usb 5-1: SerialNumber: syz [ 1455.520799][T17125] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 1455.531124][T17136] usb 5-1: config 0 descriptor?? [ 1455.680705][T17125] usb 4-1: Using ep0 maxpacket: 8 [ 1455.693709][T17125] usb 4-1: config index 0 descriptor too short (expected 301, got 72) [ 1455.714879][T17125] usb 4-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1455.729028][T17125] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1455.739695][T17125] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1455.752776][T17125] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1455.839602][T17125] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1455.855395][T17125] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1455.868262][T17125] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1456.155485][T17137] usb 5-1: USB disconnect, device number 75 [ 1456.217165][T17125] usb 4-1: usb_control_msg returned -71 [ 1456.223474][T17125] usbtmc 4-1:16.0: can't read capabilities [ 1456.306310][T17125] usb 4-1: USB disconnect, device number 73 [ 1457.240851][T17136] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1457.355138][T20216] fuse: Unknown parameter '0x0000000000000003' [ 1457.400818][T17136] usb 5-1: Using ep0 maxpacket: 32 [ 1457.422545][T17136] usb 5-1: config 0 has an invalid interface number: 132 but max is 0 [ 1457.458668][T17136] usb 5-1: config 0 has no interface number 0 [ 1457.489376][T17136] usb 5-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1457.554722][T17136] usb 5-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1457.585755][T17136] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1457.610790][T17136] usb 5-1: Product: syz [ 1457.625396][T17136] usb 5-1: Manufacturer: syz [ 1457.634629][T17136] usb 5-1: SerialNumber: syz [ 1457.654134][T17136] usb 5-1: config 0 descriptor?? [ 1457.682607][T17136] em28xx 5-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1457.714857][T17136] em28xx 5-1:0.132: Video interface 132 found: [ 1458.076868][T17136] em28xx 5-1:0.132: chip ID is em2874 [ 1458.150688][T17125] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1458.311517][T17125] usb 6-1: Using ep0 maxpacket: 32 [ 1458.321125][T17125] usb 6-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 1458.330738][T17125] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1458.338878][T17125] usb 6-1: Product: syz [ 1458.343195][T17125] usb 6-1: Manufacturer: syz [ 1458.348089][T17125] usb 6-1: SerialNumber: syz [ 1458.358238][T17125] usb 6-1: config 0 descriptor?? [ 1458.376394][T17125] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 1458.381932][T17137] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1458.406768][T17125] dvb-usb: bulk message failed: -22 (2/0) [ 1458.420478][T17125] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1458.431279][T17125] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 1458.439523][T17125] usb 6-1: media controller created [ 1458.524958][T17125] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1458.540707][T17118] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1458.567137][T17137] usb 1-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1458.580866][T17137] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1458.583413][T17125] usb 6-1: selecting invalid altsetting 7 [ 1458.592996][T17137] usb 1-1: Product: syz [ 1458.608411][T17137] usb 1-1: Manufacturer: syz [ 1458.626812][T17137] usb 1-1: SerialNumber: syz [ 1458.632008][T17125] cxusb: set interface failed [ 1458.636816][T17125] dvb-usb: bulk message failed: -22 (1/0) [ 1458.649268][T17137] usb 1-1: config 0 descriptor?? [ 1458.729977][T20210] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3350'. [ 1458.740610][T17118] usb 4-1: device descriptor read/64, error -71 [ 1458.747355][T17136] em28xx 5-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 1458.775965][T17136] em28xx 5-1:0.132: board has no eeprom [ 1458.840694][T17136] em28xx 5-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1458.842026][T17125] DVB: Unable to find symbol lgdt330x_attach() [ 1458.858100][T17125] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 1458.858210][T17136] em28xx 5-1:0.132: analog set to bulk mode. [ 1458.918614][T17137] em28xx 5-1:0.132: Registering V4L2 extension [ 1458.990901][T17118] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1459.046090][T17125] rc_core: IR keymap rc-dvico-portable not found [ 1459.057981][T17125] Registered IR keymap rc-empty [ 1459.083085][T17125] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 1459.186689][T17118] usb 4-1: device descriptor read/64, error -71 [ 1459.246919][T17136] usb 1-1: USB disconnect, device number 51 [ 1459.295182][T17125] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input110 [ 1459.341300][T17118] usb usb4-port1: attempt power cycle [ 1459.347455][T17125] dvb-usb: schedule remote query interval to 100 msecs. [ 1459.375579][T17125] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 1459.406559][T17125] usb 6-1: USB disconnect, device number 9 [ 1459.436900][T17137] em28xx 5-1:0.132: failed to get i2c transfer status from bridge register (error=-5) [ 1459.449403][T17138] usb 5-1: USB disconnect, device number 76 [ 1459.460262][T17138] em28xx 5-1:0.132: Disconnecting em28xx [ 1459.641739][T17125] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 1459.735269][T17118] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1459.782006][T17118] usb 4-1: device descriptor read/8, error -71 [ 1459.854919][T17137] usb 5-1: Decoder not found [ 1459.920362][T17137] em28xx 5-1:0.132: failed to create media graph [ 1460.017460][T17137] em28xx 5-1:0.132: V4L2 device video103 deregistered [ 1460.030712][T17118] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1460.072569][T17118] usb 4-1: device descriptor read/8, error -71 [ 1460.116374][T20255] ================================================================== [ 1460.124520][T20255] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 1460.132053][T20255] Read of size 8 at addr ffff888045da8790 by task v4l_id/20255 [ 1460.139660][T20255] [ 1460.142027][T20255] CPU: 1 UID: 0 PID: 20255 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 1460.142059][T20255] Tainted: [L]=SOFTLOCKUP [ 1460.142066][T20255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1460.142077][T20255] Call Trace: [ 1460.142086][T20255] [ 1460.142094][T20255] dump_stack_lvl+0xe8/0x150 [ 1460.142121][T20255] print_report+0xba/0x230 [ 1460.142169][T20255] ? v4l2_fh_open+0xac/0x420 [ 1460.142190][T20255] kasan_report+0x117/0x150 [ 1460.142211][T20255] ? v4l2_fh_open+0xac/0x420 [ 1460.142234][T20255] v4l2_fh_open+0xac/0x420 [ 1460.142254][T20255] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1460.142277][T20255] em28xx_v4l2_open+0x157/0x9a0 [ 1460.142355][T20255] ? do_raw_spin_lock+0x12b/0x2f0 [ 1460.142375][T20255] v4l2_open+0x1bf/0x3a0 [ 1460.142423][T20255] chrdev_open+0x4cd/0x5e0 [ 1460.142445][T20255] ? __pfx_chrdev_open+0x10/0x10 [ 1460.142464][T20255] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 1460.142483][T20255] ? __pfx_chrdev_open+0x10/0x10 [ 1460.142501][T20255] do_dentry_open+0x785/0x14e0 [ 1460.142529][T20255] vfs_open+0x3b/0x340 [ 1460.142549][T20255] ? path_openat+0x2df0/0x3860 [ 1460.142567][T20255] path_openat+0x2e08/0x3860 [ 1460.142589][T20255] ? __pfx_stack_trace_save+0x10/0x10 [ 1460.142607][T20255] ? stack_depot_save_flags+0x33/0x810 [ 1460.142635][T20255] ? __pfx_path_openat+0x10/0x10 [ 1460.142650][T20255] ? __x64_sys_openat+0x138/0x170 [ 1460.142672][T20255] ? do_syscall_64+0x14d/0xf80 [ 1460.142689][T20255] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1460.142708][T20255] ? __lock_acquire+0x6b5/0x2cf0 [ 1460.142731][T20255] do_file_open+0x23e/0x4a0 [ 1460.142749][T20255] ? __pfx_do_file_open+0x10/0x10 [ 1460.142774][T20255] ? _raw_spin_unlock+0x28/0x50 [ 1460.142788][T20255] ? alloc_fd+0x64b/0x6c0 [ 1460.142814][T20255] do_sys_openat2+0x113/0x200 [ 1460.142843][T20255] ? __pfx_do_sys_openat2+0x10/0x10 [ 1460.142866][T20255] ? exc_page_fault+0x6a/0xc0 [ 1460.142884][T20255] ? do_user_addr_fault+0xc6f/0x1340 [ 1460.142907][T20255] __x64_sys_openat+0x138/0x170 [ 1460.142931][T20255] do_syscall_64+0x14d/0xf80 [ 1460.142948][T20255] ? trace_irq_disable+0x3b/0x150 [ 1460.142971][T20255] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1460.142987][T20255] ? clear_bhb_loop+0x40/0x90 [ 1460.143007][T20255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1460.143023][T20255] RIP: 0033:0x7f37340a7407 [ 1460.143038][T20255] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1460.143079][T20255] RSP: 002b:00007ffceeae0ea0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1460.143104][T20255] RAX: ffffffffffffffda RBX: 00007f3734832880 RCX: 00007f37340a7407 [ 1460.143121][T20255] RDX: 0000000000000000 RSI: 00007ffceeae1f1a RDI: ffffffffffffff9c [ 1460.143136][T20255] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1460.143150][T20255] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1460.143165][T20255] R13: 00007ffceeae10f0 R14: 00007f3734999000 R15: 000055b9f07924d8 [ 1460.143190][T20255] [ 1460.143196][T20255] [ 1460.446225][T20255] Allocated by task 17137: [ 1460.450665][T20255] kasan_save_track+0x3e/0x80 [ 1460.455430][T20255] __kasan_kmalloc+0x93/0xb0 [ 1460.460066][T20255] __kmalloc_cache_noprof+0x31c/0x660 [ 1460.465474][T20255] em28xx_v4l2_init+0x10b/0x2e70 [ 1460.470542][T20255] em28xx_init_extension+0x120/0x1c0 [ 1460.475890][T20255] process_scheduled_works+0xb6e/0x18c0 [ 1460.481488][T20255] worker_thread+0xa53/0xfc0 [ 1460.486129][T20255] kthread+0x388/0x470 [ 1460.490240][T20255] ret_from_fork+0x51e/0xb90 [ 1460.494880][T20255] ret_from_fork_asm+0x1a/0x30 [ 1460.499687][T20255] [ 1460.502052][T20255] Freed by task 17137: [ 1460.506151][T20255] kasan_save_track+0x3e/0x80 [ 1460.510857][T20255] kasan_save_free_info+0x46/0x50 [ 1460.515930][T20255] __kasan_slab_free+0x5c/0x80 [ 1460.520724][T20255] kfree+0x1c1/0x630 [ 1460.524647][T20255] em28xx_v4l2_init+0x1683/0x2e70 [ 1460.529711][T20255] em28xx_init_extension+0x120/0x1c0 [ 1460.535040][T20255] process_scheduled_works+0xb6e/0x18c0 [ 1460.540639][T20255] worker_thread+0xa53/0xfc0 [ 1460.545278][T20255] kthread+0x388/0x470 [ 1460.549393][T20255] ret_from_fork+0x51e/0xb90 [ 1460.554028][T20255] ret_from_fork_asm+0x1a/0x30 [ 1460.558882][T20255] [ 1460.561313][T20255] The buggy address belongs to the object at ffff888045da8000 [ 1460.561313][T20255] which belongs to the cache kmalloc-8k of size 8192 [ 1460.575429][T20255] The buggy address is located 1936 bytes inside of [ 1460.575429][T20255] freed 8192-byte region [ffff888045da8000, ffff888045daa000) [ 1460.589457][T20255] [ 1460.591810][T20255] The buggy address belongs to the physical page: [ 1460.598258][T20255] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x45da8 [ 1460.607067][T20255] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1460.615607][T20255] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1460.623207][T20255] page_type: f5(slab) [ 1460.627224][T20255] raw: 00fff00000000040 ffff88813fea6280 dead000000000100 dead000000000122 [ 1460.635834][T20255] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 1460.644448][T20255] head: 00fff00000000040 ffff88813fea6280 dead000000000100 dead000000000122 [ 1460.653154][T20255] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 1460.661861][T20255] head: 00fff00000000003 ffffea0001176a01 00000000ffffffff 00000000ffffffff [ 1460.670609][T20255] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1460.679318][T20255] page dumped because: kasan: bad access detected [ 1460.685783][T20255] page_owner tracks the page as allocated [ 1460.691528][T20255] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 18712, tgid 18710 (syz.2.2983), ts 1348746236814, free_ts 1340715005736 [ 1460.713453][T20255] post_alloc_hook+0x231/0x280 [ 1460.718259][T20255] get_page_from_freelist+0x24dc/0x2580 [ 1460.723900][T20255] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1460.729782][T20255] allocate_slab+0x77/0x660 [ 1460.734342][T20255] refill_objects+0x331/0x3c0 [ 1460.739054][T20255] __pcs_replace_empty_main+0x2e6/0x730 [ 1460.744640][T20255] __kmalloc_node_track_caller_noprof+0x572/0x7b0 [ 1460.751090][T20255] __alloc_skb+0x2c1/0x7d0 [ 1460.755563][T20255] sctp_packet_transmit+0x290/0x2ac0 [ 1460.760997][T20255] sctp_packet_singleton+0x234/0x340 [ 1460.766489][T20255] sctp_outq_flush+0x50d/0x31b0 [ 1460.771389][T20255] sctp_do_sm+0x54c7/0x5cf0 [ 1460.776007][T20255] sctp_primitive_ASSOCIATE+0x95/0xc0 [ 1460.781433][T20255] __sctp_connect+0x911/0xdc0 [ 1460.786271][T20255] sctp_getsockopt_connectx3+0x227/0x360 [ 1460.791939][T20255] sctp_getsockopt+0x984/0xb90 [ 1460.796998][T20255] page last free pid 18629 tgid 18629 stack trace: [ 1460.803932][T20255] __free_frozen_pages+0xc2b/0xdb0 [ 1460.809093][T20255] __slab_free+0x263/0x2b0 [ 1460.813561][T20255] qlist_free_all+0x97/0x100 [ 1460.818202][T20255] kasan_quarantine_reduce+0x148/0x160 [ 1460.823708][T20255] __kasan_slab_alloc+0x22/0x80 [ 1460.828605][T20255] kmem_cache_alloc_noprof+0x2bc/0x650 [ 1460.834181][T20255] do_getname+0x2e/0x250 [ 1460.838542][T20255] __se_sys_symlinkat+0x2e/0x2b0 [ 1460.843520][T20255] do_syscall_64+0x14d/0xf80 [ 1460.848315][T20255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1460.854262][T20255] [ 1460.856624][T20255] Memory state around the buggy address: [ 1460.862362][T20255] ffff888045da8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1460.870630][T20255] ffff888045da8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1460.878821][T20255] >ffff888045da8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1460.886941][T20255] ^ [ 1460.891578][T20255] ffff888045da8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1460.899751][T20255] ffff888045da8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1460.907840][T20255] ================================================================== [ 1460.922364][T17137] em28xx 5-1:0.132: Remote control support is not available for this card. [ 1460.931502][T17138] em28xx 5-1:0.132: Closing input extension [ 1460.980817][T17118] usb usb4-port1: unable to enumerate USB device [ 1461.077071][T20255] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1461.084371][T20255] CPU: 0 UID: 0 PID: 20255 Comm: v4l_id Tainted: G L syzkaller #0 PREEMPT(full) [ 1461.095011][T20255] Tainted: [L]=SOFTLOCKUP [ 1461.099374][T20255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1461.109472][T20255] Call Trace: [ 1461.112788][T20255] [ 1461.115756][T20255] vpanic+0x56c/0xa60 [ 1461.119908][T20255] ? __pfx_vpanic+0x10/0x10 [ 1461.124475][T20255] panic+0xc5/0xd0 [ 1461.128269][T20255] ? __pfx_panic+0x10/0x10 [ 1461.132761][T20255] ? preempt_schedule_thunk+0x16/0x30 [ 1461.138206][T20255] ? preempt_schedule_thunk+0x16/0x30 [ 1461.143737][T20255] ? v4l2_fh_open+0xac/0x420 [ 1461.148359][T20255] check_panic_on_warn+0x89/0xb0 [ 1461.153348][T20255] ? v4l2_fh_open+0xac/0x420 [ 1461.157966][T20255] end_report+0x73/0x180 [ 1461.162289][T20255] ? v4l2_fh_open+0xac/0x420 [ 1461.166930][T20255] kasan_report+0x128/0x150 [ 1461.171500][T20255] ? v4l2_fh_open+0xac/0x420 [ 1461.176233][T20255] v4l2_fh_open+0xac/0x420 [ 1461.180763][T20255] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1461.186799][T20255] em28xx_v4l2_open+0x157/0x9a0 [ 1461.191697][T20255] ? do_raw_spin_lock+0x12b/0x2f0 [ 1461.196764][T20255] v4l2_open+0x1bf/0x3a0 [ 1461.201073][T20255] chrdev_open+0x4cd/0x5e0 [ 1461.205554][T20255] ? __pfx_chrdev_open+0x10/0x10 [ 1461.210523][T20255] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 1461.217007][T20255] ? __pfx_chrdev_open+0x10/0x10 [ 1461.222009][T20255] do_dentry_open+0x785/0x14e0 [ 1461.226859][T20255] vfs_open+0x3b/0x340 [ 1461.230968][T20255] ? path_openat+0x2df0/0x3860 [ 1461.236345][T20255] path_openat+0x2e08/0x3860 [ 1461.241024][T20255] ? __pfx_stack_trace_save+0x10/0x10 [ 1461.246420][T20255] ? stack_depot_save_flags+0x33/0x810 [ 1461.251995][T20255] ? __pfx_path_openat+0x10/0x10 [ 1461.256980][T20255] ? __x64_sys_openat+0x138/0x170 [ 1461.262049][T20255] ? do_syscall_64+0x14d/0xf80 [ 1461.266846][T20255] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.273029][T20255] ? __lock_acquire+0x6b5/0x2cf0 [ 1461.278024][T20255] do_file_open+0x23e/0x4a0 [ 1461.282589][T20255] ? __pfx_do_file_open+0x10/0x10 [ 1461.287667][T20255] ? _raw_spin_unlock+0x28/0x50 [ 1461.292541][T20255] ? alloc_fd+0x64b/0x6c0 [ 1461.296903][T20255] do_sys_openat2+0x113/0x200 [ 1461.301718][T20255] ? __pfx_do_sys_openat2+0x10/0x10 [ 1461.307042][T20255] ? exc_page_fault+0x6a/0xc0 [ 1461.311768][T20255] ? do_user_addr_fault+0xc6f/0x1340 [ 1461.317105][T20255] __x64_sys_openat+0x138/0x170 [ 1461.322002][T20255] do_syscall_64+0x14d/0xf80 [ 1461.326642][T20255] ? trace_irq_disable+0x3b/0x150 [ 1461.331697][T20255] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.337795][T20255] ? clear_bhb_loop+0x40/0x90 [ 1461.342490][T20255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1461.348397][T20255] RIP: 0033:0x7f37340a7407 [ 1461.352949][T20255] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1461.372724][T20255] RSP: 002b:00007ffceeae0ea0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1461.381196][T20255] RAX: ffffffffffffffda RBX: 00007f3734832880 RCX: 00007f37340a7407 [ 1461.389201][T20255] RDX: 0000000000000000 RSI: 00007ffceeae1f1a RDI: ffffffffffffff9c [ 1461.397295][T20255] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1461.405294][T20255] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1461.413295][T20255] R13: 00007ffceeae10f0 R14: 00007f3734999000 R15: 000055b9f07924d8 [ 1461.421304][T20255] [ 1461.425003][T20255] Kernel Offset: disabled [ 1461.429349][T20255] Rebooting in 86400 seconds..