last executing test programs: 6m2.915183835s ago: executing program 2 (id=733): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000000b2ef5daa40bf85edaca8300000000"], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000c00)={0x84, &(0x7f0000000800)={0x0, 0x0, 0x1, "9d"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0xff, 0x2d80) readv(r1, &(0x7f0000000200)=[{&(0x7f0000000180)=""/45, 0x2d}], 0x1) syz_open_dev$video(&(0x7f0000000140), 0xd, 0x0) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r2, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000003300)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="71b4", 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000340)='&r', 0x2}], 0x1}}], 0x2, 0x400c404) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000003c0)=0x11) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 5m56.926809027s ago: executing program 2 (id=755): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc00000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000885000000a000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xd80, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$l2tp6(0xa, 0x2, 0x73) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x8, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000000600), 0x6828, 0x0) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000000)={0x5, 0xe, 0x9, 0x8, "c400523a6f29960fce66e2e7aadce2988b5ec056b7577f87586a324b565ffcbb"}) socket$nl_route(0x10, 0x3, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffebe}, 0x90) r3 = syz_io_uring_setup(0x24fa, &(0x7f0000000b80)={0x0, 0x0, 0x10100, 0x0, 0x33a}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) ioctl$SNDCTL_SEQ_GETOUTCOUNT(r6, 0x80045104, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='8'], 0x38}}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r7, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r7, 0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r3, 0x2d3e, 0x0, 0x0, 0x0, 0x0) fsopen(&(0x7f0000000080)='romfs\x00', 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e24, @broadcast}, 0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r7, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x3}, &(0x7f0000000240)=0x8) 5m52.118852401s ago: executing program 0 (id=768): syz_usb_connect$uac1(0x0, 0xb5, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa3, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{}, [@feature_unit={0xd, 0x24, 0x6, 0x0, 0x0, 0x3, [0x0, 0xa, 0x0]}, @extension_unit={0x8, 0x24, 0x8, 0x0, 0x0, 0x0, 'P'}, @input_terminal={0xc, 0x24, 0x2, 0x0, 0x0, 0x3}, @feature_unit={0x13, 0x24, 0x6, 0x0, 0x6, 0x6, [0x0, 0x7, 0x9, 0x0, 0x0, 0x0]}, @output_terminal={0x9, 0x24, 0x3, 0x0, 0x0, 0x0, 0x5}, @feature_unit={0x2, 0x24, 0x6, 0x5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x80}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x81, 0x8}}}}}}}]}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000140)) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000007c0)={'filter\x00', 0x7, 0x4, 0x3e0, 0x210, 0x0, 0x0, 0x2f8, 0x2f8, 0x2f8, 0x4, &(0x7f00000000c0), {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0xff000000, 0xff, 0x6, 0x10, {@mac, {[0x0, 0xff, 0x0, 0xff, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x0, 0x7, 0x40, 0x38e, 0x5, 0x1, 'pim6reg1\x00', 'pim6reg1\x00', {}, {}, 0x0, 0x4}, 0xc0, 0x100}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x2, {0xffffffffffffffc0}}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, 0x1, 0xffffffff}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffb}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='\x00', 0x81000) symlinkat(&(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', r1, &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a30000000501ba95c7b8d3443df2700080003400000000414000000110001000000"], 0x64}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200), 0x4000000004002, 0x0) r4 = dup(r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r4, 0x0) capset(&(0x7f0000000080)={0x20071026}, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$bt_hci(r5, 0x84, 0x1, &(0x7f0000000080)=""/4057, &(0x7f0000000000)=0xfd9) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02"], 0x48) read$FUSE(r4, &(0x7f0000000580)={0x2020}, 0x2020) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, 0x0, 0x0, 0x5}, 0x94) madvise(&(0x7f0000000000/0x600000)=nil, 0x100000, 0x9) 5m52.044855656s ago: executing program 1 (id=769): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0xfffffffc) r1 = socket(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000240)=@ethtool_ringparam={0x10, 0x8, 0x10, 0x6, 0x40000, 0x4, 0x2, 0x81, 0xffffff19}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, 0xfffffffffffffffe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) r6 = socket$inet_tcp(0x2, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) r7 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) read$midi(r7, 0x0, 0x14) close_range(r6, 0xffffffffffffffff, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0)={0x0, 0x6}, 0x8) 5m51.750571966s ago: executing program 2 (id=770): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0xfffffffc) r1 = socket(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000240)=@ethtool_ringparam={0x10, 0x8, 0x10, 0x6, 0x40000, 0x4, 0x2, 0x81, 0xffffff19}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, 0xfffffffffffffffe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) 5m51.328616113s ago: executing program 4 (id=772): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r0, 0xfffffffc) r1 = socket(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000240)=@ethtool_ringparam={0x10, 0x8, 0x10, 0x6, 0x40000, 0x4, 0x2, 0x81, 0xffffff19}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, 0xfffffffffffffffe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) 5m50.339730707s ago: executing program 4 (id=774): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 5m50.219907639s ago: executing program 1 (id=775): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000340)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000080)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x8, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa210104, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp_addr={0x44, 0xc, 0xa, 0x1, 0x0, [{@multicast1}]}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x40}}}}}}, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, 0x0, 0x0) mount(&(0x7f0000000180)=@sg0, &(0x7f0000000040)='.\x00', &(0x7f0000000100)='ecryptfs\x00', 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS2(0xffffffffffffffff, 0xf, 0x0, 0x0) io_setup(0x1, 0x0) r4 = openat$random(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) io_submit(0x0, 0x1, &(0x7f0000000140)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x8, 0x0, r4, &(0x7f0000000080)="4e8f", 0x2, 0x200000000004}]) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000, 0x6}, 0x7c) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) bind$xdp(r5, &(0x7f0000000100)={0x2c, 0x18, r6}, 0x10) 5m49.293354443s ago: executing program 4 (id=777): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000400)=@file={0x1, './file0\x00'}, 0xfffffffffffffea3) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreqsrc(r3, 0x0, 0x27, &(0x7f0000000000)={@multicast1=0xe000bb00, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c971ba44d000100697036746e6c00000c0002800800070008000000"], 0x3c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) read$FUSE(r5, &(0x7f0000000340)={0x2020}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000002700)=""/102392, 0x18ff8) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={'sit0\x00', {0x2, 0x4e20, @multicast2}}) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000440)={0x7, 0x0, 0x0, 0x100}, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000002380)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x20050855}, 0x0) r8 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r8}, &(0x7f0000bbdffc)) 5m49.177126822s ago: executing program 1 (id=778): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000cc0)=@newtaction={0x84, 0x30, 0x12f, 0x0, 0x0, {0x0, 0x0, 0x1be}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x5c, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x0, 0x0, 0x60}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x0, 0x3f}}}}]}]}, 0x84}}, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x20201) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000380)=0x0, &(0x7f00000003c0)=0x4) sendmsg$can_raw(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x1d, r2}, 0x10, &(0x7f0000000500)={&(0x7f0000000640)=@canfd={{0x4, 0x1, 0x1, 0x1}, 0x10, 0x1, 0x0, 0x0, "39215e04a6862a5acc9043cad974df4dc08d90ea1f49a0976ff2321f038a935ec79217b5666bd81bd2bb5ced61ab9a57f465d179e7b8cffafcb3e58a395a2ca7"}, 0x48}, 0x1, 0x0, 0x0, 0x20010800}, 0x8050) syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000001000000080000000c"], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000d40)=ANY=[@ANYBLOB="180000000000e3ff000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000e00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r4}, 0x10) semtimedop(0x0, &(0x7f00000003c0)=[{0x2, 0x4, 0x1800}], 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r7 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000340)=0x10) shutdown(r7, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) r8 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x100000e, 0x11012, r8, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x4000000004002, 0x0) r10 = syz_io_uring_setup(0xa0, &(0x7f0000000240)={0x0, 0x89b8, 0x1, 0x0, 0x207}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000580)=0x41) syz_io_uring_submit(r11, r12, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r9, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(r10, 0x847ba, 0x0, 0xe, 0x0, 0x0) 5m49.173285308s ago: executing program 0 (id=779): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000cc0)=@newtaction={0x84, 0x30, 0x12f, 0x0, 0x0, {0x0, 0x0, 0x1be}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x5c, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x0, 0x0, 0x60}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x0, 0x3f}}}}]}]}, 0x84}}, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x20201) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000380)=0x0, &(0x7f00000003c0)=0x4) sendmsg$can_raw(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x1d, r2}, 0x10, &(0x7f0000000500)={&(0x7f0000000640)=@canfd={{0x4, 0x1, 0x1, 0x1}, 0x10, 0x1, 0x0, 0x0, "39215e04a6862a5acc9043cad974df4dc08d90ea1f49a0976ff2321f038a935ec79217b5666bd81bd2bb5ced61ab9a57f465d179e7b8cffafcb3e58a395a2ca7"}, 0x48}, 0x1, 0x0, 0x0, 0x20010800}, 0x8050) syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000001000000080000000c"], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000d40)=ANY=[@ANYBLOB="180000000000e3ff000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000e00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r4}, 0x10) semtimedop(0x0, &(0x7f00000003c0)=[{0x2, 0x4, 0x1800}], 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r7 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000340)=0x10) shutdown(r7, 0x0) read$msr(0xffffffffffffffff, 0x0, 0x0) r8 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x100000e, 0x11012, r8, 0x0) r9 = openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0), 0x4000000004002, 0x0) r10 = syz_io_uring_setup(0xa0, &(0x7f0000000240)={0x0, 0x89b8, 0x1, 0x0, 0x207}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000580)=0x41) syz_io_uring_submit(r11, r12, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r9, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(r10, 0x847ba, 0x0, 0xe, 0x0, 0x0) 5m49.130156716s ago: executing program 3 (id=780): r0 = syz_usb_connect(0x1, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xa8, 0xf4, 0xdd, 0x8, 0x46d, 0x8b1, 0x6d2a, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x15, 0xb3, 0x83}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000600)={0x20, 0x16, 0x100, "8e358781195bd1a6967437775c8ba93adf4792597e4b6be495802e06571cbedd0e5e6fea000000fb41da1d0d3aff47fa2387d7d8e50cde79ca10af14a3bd98770b5bd226a81df3d02c0a485effcb96661a48fdb268501fe8f15e61d3f87f9eab20d4f958d7fd397a6ee4ed74cb8e42115b4fe5a41c2a8ff4382a3ffe2f7fa96f28693a2be25e44eb81c764b2fa66b2b375ce8cfeecd34102a45dbe7f8dd91bfeba51ffefb87e93d459d7acfc9a8efd4a574dfcda4860ef4231fc910bad673be9e1ac08bc9252511736bc1de732fea53df2408627c84090eadd53819d4022774cae0432c6697723efba2ef7125a45019b00"/256}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0xf2}, &(0x7f0000000200)={0x0, 0x8, 0x1}, &(0x7f0000000240)={0x20, 0x1, 0xce, "9b87e509e7640dc8074d8a0b4366e4e972e6567681178b10c03ae8c96de5151c8e65637cc6a2a0ac65bd9db6b909a3bcb0932602e2940727491da2ead2ad5f9671da02f991e9bfaae0128908c0c2b324d97aa7e8380a9aef625fd21c170a25a726ba4eeddb9e9f768ebec450de6d0dd8097beaef03039464c9f78e455483d065b413f68b80aeeb1153f965bfe668365980276e494906fbd9bdc1c8dd60a8f77f9864672c6de6fa2a4b0a0d95fe40399b71a2f330052f2e218bbc8fc9ad0edbadf7798a7a6a267b9ba1b2df209ef2"}, &(0x7f0000000340)={0x20, 0x3, 0x1, 0x7}}) 5m48.293112116s ago: executing program 4 (id=781): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = syz_open_dev$video(&(0x7f00000004c0), 0x81, 0xa082) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="34000000021501080000000000000000000000030c000300686108"], 0x34}}, 0x0) sendto(0xffffffffffffffff, &(0x7f00000002c0)='%', 0x300000, 0x0, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x10, 0x0, 0x0) clock_adjtime(0x3, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x1, 0x8, 0xb}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)={@map=r7, r6, 0x7}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r7, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r5}, 0x20) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000140)=[{&(0x7f0000000440)="5800000014001d2340834b80040d8d560a067ee500ff000000000000000058000b4824ca945f64009400140425010ebc000000000000008000f0fffeffe809005300fff5dd80000010000100080c10000a00000000000100", 0x58}], 0x1) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[], 0x14}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELRULE={0xe0, 0x8, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_USERDATA={0xa3, 0x7, 0x1, 0x0, "7c426818c488eb4ee2721d19877bc9bced19e2669f4549787cb0af301f053faab03de14296b1c2afeacea773d822ec32c2d45a7b66cd3b2c999f49e36a7fc40b07c85eb66912fdaa6c806f4f8b374b63e5c5d640fcae97d8fe2bf3038e3110e03cc1b76b89e9e42e38930de1421a1878a015240dc7ff634c995bb770e953cdbd2d0590c9a0442592d53524ab600b35fa271dede7766c50506f2a425962fdca"}, @NFTA_RULE_COMPAT={0x1c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6006}, @NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x1}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x11c}, 0x1, 0x0, 0x0, 0x4}, 0x24000800) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000080)={&(0x7f00000000c0)=""/112, 0xffffffffffffff90}) ioctl$VIDIOC_G_FMT(r1, 0xc0d05605, &(0x7f0000000380)={0xd, @sdr={0x47425247, 0x8}}) r9 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCXONC(r9, 0x5608, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r0, 0x4112, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000100)="8a", 0x1}], 0x1, &(0x7f0000000080)=ANY=[@ANYBLOB="20000000000000008400000002000000000041000900000000000002", @ANYRES32=0x0, @ANYBLOB="300000000000000084000000010000000101090003020000e1de00000300000005"], 0x50}, 0x0) 5m47.796449037s ago: executing program 1 (id=782): pipe(&(0x7f0000000380)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, &(0x7f00000002c0)=0x100000001, 0x4) lsetxattr$security_evm(&(0x7f0000004d40)='.\x00', &(0x7f0000004d80), &(0x7f0000004dc0)=ANY=[@ANYBLOB="d131"], 0x2, 0x0) connect$inet(r0, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) sendto$inet(r1, &(0x7f0000000200)="e1", 0xfea8, 0x0, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) r2 = syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f00000000c0)=@multiplanar_mmap={0x7, 0xa, 0x4, 0x100000, 0x3, {0x0, 0x2710}, {0x1, 0xc, 0x7, 0x7, 0x80, 0x5, "2852dfcf"}, 0x8, 0x1, {&(0x7f0000000040)=[{0x0, 0x80000001, {0xc54}, 0x1}, {0x7, 0x80, {0x1000}, 0x6}]}, 0x5}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x101440, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000000)={0x0, 0x0, 0x401, 0x0, 0x1, "0062ba7d82000000000000000000f7ffffff00"}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = dup3(0xffffffffffffffff, r3, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000280)=0xd) read(r4, 0x0, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x26, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x16, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/key-users\x00', 0x0, 0x0) preadv2(r5, &(0x7f00000004c0)=[{&(0x7f0000000200)=""/100, 0x64}], 0x1, 0x2b, 0x4c3a, 0x0) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x5, 0x8, 0x7fe2, 0x1}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000900)={{r6}, &(0x7f0000000880), &(0x7f00000008c0)='%-010d \x00'}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000002240)={r6, &(0x7f0000002140)='a,', 0x0}, 0x20) ioctl$I2C_SLAVE(0xffffffffffffffff, 0x703, 0x3eb) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) 5m47.270181703s ago: executing program 0 (id=783): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000e00)=ANY=[@ANYBLOB="1201000000000040de28021100000000000109022400010000d00009040004010300000009210100f90122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'pimreg\x00', 0x5083}) 5m47.222613142s ago: executing program 2 (id=784): syz_usb_connect(0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x4, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0xa000}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c810}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r5 = syz_open_dev$vim2m(&(0x7f0000000240), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0x1, {0x0}}) close_range(r4, 0xffffffffffffffff, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) 5m46.381022486s ago: executing program 1 (id=785): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="00000100000022"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, 0x0, &(0x7f00000005c0)) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f0000000100)=ANY=[@ANYRES8=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) arch_prctl$ARCH_SHSTK_LOCK(0x5003, 0x2) r2 = socket$kcm(0x29, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x26, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15e}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x82}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @exit, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000000c0)='syzkaller\x00', 0x5, 0xda, &(0x7f0000000300)=""/218, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000400)={0x4, 0xa, 0x3d8ac00, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x4, &(0x7f0000000440)=[0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1], &(0x7f0000000480)=[{0x5, 0x4, 0xa, 0x4}, {0x2, 0x5, 0x1, 0xb}, {0x1, 0x4, 0xe, 0xb}, {0x3, 0x5, 0x5, 0x4}]}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000580)={r1, r3}) r4 = syz_usb_connect$uac1(0x5, 0xbc, &(0x7f0000000600)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x18, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xaa, 0x3, 0x1, 0x3, 0x80, 0x7, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xd}, [@extension_unit={0x9, 0x24, 0x8, 0x3, 0x9528, 0x0, "b18c"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0x8, 0x3, 0x4, 0xc, "05"}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x2, 0x3, 0x7, 0x0, "c17f32ff13c0"}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x3c3, 0x4, 0x0, "dbeff0c5"}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x8, 0x3, 0x1, {0x7, 0x25, 0x1, 0x2, 0x3, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x1f, 0x5a}, @as_header={0x7, 0x24, 0x1, 0x2, 0xb, 0x5}, @format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x97, 0x1, 0x1, 0x2, "ba970f562c1b7a13"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x8, 0x8, 0x6, {0x7, 0x25, 0x1, 0x81, 0x8a, 0x5}}}}}}}]}}, &(0x7f0000000c00)={0xa, &(0x7f00000006c0)={0xa, 0x6, 0x110, 0x6, 0x9, 0x1, 0xff, 0x2}, 0x31, &(0x7f0000000840)={0x5, 0xf, 0x31, 0x5, [@ext_cap={0x7, 0x10, 0x2, 0x30, 0x6, 0x5, 0x3}, @ext_cap={0x7, 0x10, 0x2, 0x2, 0x6, 0xe, 0x1}, @ptm_cap={0x3}, @ssp_cap={0x10, 0x10, 0xa, 0x1, 0x1, 0x7f, 0xf00f, 0x2, [0xc050]}, @wireless={0xb, 0x10, 0x1, 0x0, 0x8b, 0x8, 0x2, 0x7, 0xe}]}, 0x8, [{0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0x2001}}, {0x8e, &(0x7f00000008c0)=@string={0x8e, 0x3, "ac800ec70128b163606b7e56796fd4ab15271982ce214fc6dc896bbda229eacef32c6379ef181c7ce7ed36da0a20b7c61048fa6235e6409a9f85764c1a1b0549a0f7810fdcb0eb089ef2fa80645e2f4ad2b07a525892b4e4dc8dcf911e6477f6230357c9737ff26f7827b9a363fc1c81029c94dc33a0df0f2c0a5606f6c3a8c70891c4b65d2e947331b3c0e0"}}, {0x4, &(0x7f0000000980)=@lang_id={0x4, 0x3, 0x447}}, {0x13, &(0x7f0000000a00)=@string={0x13, 0x3, "b28d5cec4e3f0b532f85006b3e5f669fab"}}, {0x4, &(0x7f0000000a40)=@lang_id={0x4, 0x3, 0x429}}, {0x4, &(0x7f0000000a80)=@lang_id={0x4, 0x3, 0x4c3e}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x407}}, {0xf9, &(0x7f0000000b00)=@string={0xf9, 0x3, "5a8e773134978212850fdfbee39e733c4d2d64c3bf2cf397756ca8b6a72ec3941623471691885d6108e69704957b681497e3c8a1b09357e7da191c44c6b82c723068fdab5e9c7f5deb06dc18a12999957a83003cdafb65f0d56a1203d9aa05a6ad20b5a19f95da2ca138a4c6e4e937e6337affaca7530b60fef7dbaddbce816e0f1c342c327e97501ee27f59f72dfe51d926f21d4f195dec8004374ca76dcf50770ef4020f49970c1dba615e64ee6168c74b1d942bd82eb70fefcd0d85490717c30852c4c2034420f74e5fcdb790355865e5d2efa3c2446d3128cf33296d28827ac9b63e89a682751d5ae69bfd368a0bce502b9615259b"}}]}) syz_usb_control_io$uac1(r4, &(0x7f0000000dc0)={0x14, &(0x7f0000000c80)={0x0, 0x5, 0xd3, {0xd3, 0x22, "cec8e030b63c8de7314bfbc82c8bfd6a1dd81e350a13f1472de4c71f99b9cbbb4828f803a2c824c0e6260d97b8edc3bc232da3d8c80cb6502b6e71f97d7d35f5231bcd25926ce09039b98aae0eab62b0cfde831fcb99b0db973a11c5fdbd036b0bea93144612630a194da5f0d3054d2943ac3afb57df4cb3582fa12a7f430abbddc0140398fb29f2125e9d6afcd9b38d5e524793e2ba62ab55cb49fb9d337632e0baa253fe2830d98df3a0f9c3f53cac11fb35d7de4652243c72e803e4a474d390edf52f67ad0bbf5331df0d9c65b98554"}}, &(0x7f0000000d80)={0x0, 0x3, 0x19, @string={0x19, 0x3, "aa8bb5bdc4151cc1543c97c5c3dcb30fb73cb9a0df40ac"}}}, &(0x7f0000001100)={0x44, &(0x7f0000000e00)={0x0, 0x5, 0xff, "2d6eca6cad99b1ba77e77d60b7c8607f42a3539fd56af123942bf675a4e7f04ec766e55fc274f63066638aab91f762315281134c1f05f82b21e7d4209ca5a88ba549291751ab80462e23371caf1ae0786ebb5d9cc0bfcea2e5de269048748453eac830bce3a52d7436dfbd4203690cec28c59ed4852ab19ae1779249bc74d6f7213d95bb825b62af3229433f91d248604a3bf742da129af295f7dd58c950289c237a5c49c898581078652e60350c54f726d8cc86d6999967084acca52ca82ed786aea9429959d0684e49a0fcbcc77d3857b67294aa38b0d4d187c8a20a362f7ace70660b401bfc0aa4367c0131956bfb64dcafe265351f40bc9bfd108420df"}, &(0x7f0000000f40)={0x0, 0xa, 0x1, 0x70}, &(0x7f0000000f80)={0x0, 0x8, 0x1, 0x30}, &(0x7f0000000fc0)={0x20, 0x81, 0x1, "8c"}, &(0x7f0000001000)={0x20, 0x82, 0x3, "69c967"}, &(0x7f0000001040)={0x20, 0x83, 0x1, "d0"}, &(0x7f0000001080)=ANY=[@ANYBLOB="2c8ed676d5bd78b22a"], &(0x7f00000010c0)={0x20, 0x85, 0x3, "8bc42d"}}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_open_dev$video4linux(&(0x7f0000000480), 0xd, 0x123002) ioctl$VIDIOC_SUBDEV_S_FMT(r6, 0xc0585605, &(0x7f0000000000)={0x1, 0x0, {0x7f, 0xfffffffc, 0x1014, 0x4, 0x0, 0x6, 0x0, 0x4}}) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000009c0)={0x18, 0x2d, 0x9, 0x70bd26, 0x0, {0x4}, [@nested={0x4, 0x19}]}, 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x84) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="201104060000000101"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5m46.380474746s ago: executing program 4 (id=786): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f00000001c0)={0x0, 0xd, 0x68, {0x68, 0x2, "5ee0ff49fc3449df87e1ea3d17d0cb60ce23ecc5b5c88ff5cae294e188798abd22f3a47325ba02170ef0f2e1410342670d464bb67d327afc4c3f9e718ce39e60034e84779d4ad6787b587831ca1098dffea48f05b835a422aa238ced86807eebb7525140b75e"}}, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2009}}, &(0x7f0000000240)={0x0, 0xf, 0x19, {0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x2, "9e1fcf82891aad5e84f959e6409ba754"}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x92, 0x1, 0x5, 0x7, "eaee9abd", "9811c332"}}, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x10, 0x2, 0xa0, 0x3, 0x5}}}, &(0x7f00000009c0)={0x84, &(0x7f0000000380)={0x20, 0x31, 0x35, "4a9c2e83afec8312bfbf5676d8bace8f6e516c81394d403555ff765d371cd379fb91626f13db43d8b59177564cf8cca8fdc0571d92"}, &(0x7f0000000400)={0x0, 0xa, 0x1}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x2}}, &(0x7f00000004c0)={0x20, 0x0, 0x8, {0x4, 0x10, [0xf0ff]}}, &(0x7f0000000500)={0x40, 0x7, 0x2, 0x76a9}, &(0x7f0000000540)={0x40, 0x9, 0x1, 0xff}, &(0x7f0000000580)={0x40, 0xb, 0x2, 'b^'}, &(0x7f00000005c0)={0x40, 0xf, 0x2, 0x7fff}, &(0x7f0000000600)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000680)={0x40, 0x17, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "d1c4"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x3}, &(0x7f00000007c0)={0x40, 0x1c, 0x1, 0x24}, &(0x7f0000000800)={0x40, 0x1e, 0x1}, &(0x7f0000000840)={0x40, 0x21, 0x1, 0x9}}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, &(0x7f00000003c0)={0x0, 0x5, 0x4, "abe763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000180)={0x60, 0x10, 0x4, "e34207b4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)={0x20, 0x1, 0x4, "ad610d13"}, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000013c0)={0x44, &(0x7f00000011c0)={0x20, 0x14, 0x4, "0426fd98"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0xca, &(0x7f0000000000)={0x20, 0x0, 0x4, "f670e000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000640)={0x0, 0x16, 0x4, "92e7415f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5m45.731476607s ago: executing program 2 (id=787): syz_usb_connect(0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d80050006000000000014000500714abbd2547de97cbbf6efb226f19bf90d0002003a288e5e5b5b5a40000000006000078014000400293a02149f3b75a67093c28fd6f55a2314000400e48f01e49713f0c2d839f940d9f088d8050006000000003bd00002006272696467655f736c6176655f30000007000200293a00000500060000000000080001000000000018002580140004004d2906d0880fc8acc30fe2020f9849675000028004000500a1085e7df341b9dc3d8008a2fe5bdaad140004009c7e472c916020fe41bcc5aa8f56c9471400050080ab8be51421cfa3c9e5cbfe8217e0af0800010000000000080001000000000060001a803f0003"], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r5 = syz_open_dev$vim2m(&(0x7f0000000240), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0x1, {0x0}}) close_range(r4, 0xffffffffffffffff, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) 5m45.638795588s ago: executing program 3 (id=788): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 5m45.228875376s ago: executing program 0 (id=789): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000cc0)=@newtaction={0x84, 0x30, 0x12f, 0x0, 0x0, {0x0, 0x0, 0x1be}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x5c, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x4, 0x0, 0x0, 0x60}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x0, 0x3f}}}}]}]}, 0x84}}, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x20201) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000380)=0x0, &(0x7f00000003c0)=0x4) sendmsg$can_raw(r1, &(0x7f0000000540)={&(0x7f0000000400)={0x1d, r2}, 0x10, &(0x7f0000000500)={&(0x7f0000000640)=@canfd={{0x4, 0x1, 0x1, 0x1}, 0x10, 0x1, 0x0, 0x0, "39215e04a6862a5acc9043cad974df4dc08d90ea1f49a0976ff2321f038a935ec79217b5666bd81bd2bb5ced61ab9a57f465d179e7b8cffafcb3e58a395a2ca7"}, 0x48}, 0x1, 0x0, 0x0, 0x20010800}, 0x8050) syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000001000000080000000c"], 0x50) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000d40)=ANY=[@ANYBLOB="180000000000e3ff000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000e00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r4}, 0x10) semtimedop(0x0, &(0x7f00000003c0)=[{0x2, 0x4, 0x1800}], 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000340)=0x10) shutdown(r6, 0x0) r7 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x100000e, 0x11012, r7, 0x0) 5m44.798633093s ago: executing program 3 (id=790): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b40)=ANY=[@ANYBLOB="780200003c0007010000000000000000017c00004402fc8040020880afca5ff5d515226501d9fac3908ff02f8d09509c26adb6b5d864484d04d69b4da5d7a52bfaaaad3a5c25aa473a0456cf81bd4d74603377984679d221e2a018985f995b9c1787285a3068593180b924ed8d0940610e751d4177f4fdaa3b647713ec058a87aa46f52171df898c7a05121abccd3e66c0d455d5497f9b88f86e97ac669b2ac8acdde2137a259ace56f95c5e39e7db5a34433901da46f369c5dd5ca3e90600b07d4664e1d96191edfaa947604e2f1f75db049bd8923e183ceaf32e67fb16888c806403ecd4458012965b4bf87d769bf5e030474a90f0f8b743003256111a88037a5489878dc68d48348280c55d31a3ea6fc747a0cf299e10637fbc9a618a6bcadf0f6caf923a1dfbd1f2ba8fa08ddffc28b9a387e3b2b35d8a4ac3ea722e6f6089cc683eecda71ba25b3f72797dc417fca84d9d8f8baa94057192947b92000ba5770c7b084403a03adc1a2f42acd35c860b6d2150d1d0a70f422e4f73eac96a9de66ddc93cb95cbfce68d52b80505ad2cb11893f86e6c26ea10f484762e841ee827d794612312cd37ad973b2ab2986bb65f84b670790bad3776ef66f76955009f71065c51850d6b375827b6e3666e469312a118278044cc8c60724f9c11c75aee12f40a3f53f995cc20d3fef674b2e46dfdf9d48685be6be74cf4374ae2c3627d82fb3523b86a6b5eecc7c852e62b45b72141293a9e3fb1096a448ff5bce3586b50be5d12cbf9a80bca166f0e79ebd68b11bafb7f0fcc690fd1895afce6ae42d8ab38b9ebbfedf6d80c37c89ead9c8af0ec8b3f4a81f88d00c00018006000600800a00000900028097f09726550000000800050009"], 0x278}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$SIOCRSSL2CALL(r1, 0x89e2, 0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='netlink_extack\x00', r2}, 0x10) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r4}, 0x10) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r5, 0x4008af13, &(0x7f0000000300)) 5m44.556189198s ago: executing program 2 (id=791): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x10000, {{0x2, 0x0, @multicast2}}}, 0xfffffffffffffef1) syz_usb_connect(0x3, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0xe0, 0xf4, 0x4b, 0x40, 0xaf0, 0xd013, 0xcf13, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xf9, 0x8, 0x80, 0x0, [{{0x9, 0x4, 0x93, 0x3, 0x0, 0xa8, 0xf5, 0x5d, 0x5}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @dev={0xac, 0x14, 0x14, 0xf}, @multicast1}, 0xc) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000300)=ANY=[@ANYBLOB="020000000000000002004e21e0000002"], 0x90) 5m44.106668216s ago: executing program 3 (id=792): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) accept4(r0, 0x0, 0x0, 0x0) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) bind$unix(r1, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a}, 0x28) read$msr(r2, &(0x7f000000abc0)=""/102392, 0x18ff8) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) 5m43.76145105s ago: executing program 3 (id=793): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000000)={0x48, 0x2, r3}) sendmsg$inet6(r1, &(0x7f0000000140)={&(0x7f0000000080)={0xa, 0x4e26, 0x80000, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000071"], 0x18}, 0x810) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000032680)=""/102392, 0x18ff8) r6 = fsopen(&(0x7f0000000100)='ocfs2_dlmfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) fsmount(r6, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x24, &(0x7f0000000000)=0x1, 0x4) recvmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x220, 0x100, 0x0) 5m43.7532568s ago: executing program 0 (id=794): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r1 = epoll_create1(0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) mlock(&(0x7f0000ffa000/0x4000)=nil, 0x4000) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000d00)=@mangle={'mangle\x00', 0x64, 0x6, 0x600, 0x310, 0x1d0, 0x440, 0x310, 0x0, 0x530, 0x530, 0x530, 0x530, 0x530, 0x6, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @multicast2}, [], [], 'vcan0\x00', 'veth1_virt_wifi\x00'}, 0x0, 0xa8, 0xe8, 0x0, {0x7a00000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x9}}}, {{@ipv6={@mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'syzkaller1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@private0}}}, {{@ipv6={@rand_addr=' \x01\x00', @mcast2, [], [0xffffff00], 'veth1_to_batadv\x00', 'vlan1\x00'}, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@inet=@ecn={{0x28}}, @common=@ipv6header={{0x28}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty}}}, {{@ipv6={@private0, @mcast2, [], [], 'veth1_to_team\x00', 'veth0_macvtap\x00'}, 0x0, 0xf0, 0x130, 0x0, {}, [@common=@hbh={{0x48}, {0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe760]}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@remote}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2f}, @mcast2, [0xff, 0x0, 0x7f, 0xff], [0xffffffff, 0xff, 0xffffffff, 0xff], 'veth1_to_batadv\x00', 'rose0\x00', {}, {0xff}, 0x29, 0x4c, 0x2, 0x65}, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4=@local}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x660) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, &(0x7f0000000100)=0x40000002, 0xd) getpid() prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r5 = socket$isdn_base(0x22, 0x3, 0x0) bind$isdn_base(r5, &(0x7f00000077c0)={0x22, 0xf8, 0x40, 0xaf, 0x4}, 0x59) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x80000002}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) socket$netlink(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) 5m43.212739312s ago: executing program 4 (id=795): syz_usbip_server_init(0x1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000002, 0x8010, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x476b, &(0x7f0000000040)={0x0, 0x7def, 0x2010, 0x3, 0x375}, &(0x7f00000000c0), &(0x7f0000000100)) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010002"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0xc0a2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r4 = accept$inet6(r0, &(0x7f00000004c0), &(0x7f0000000500)=0x1c) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r1) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000940)={{0x1, 0x1, 0x18, r4, {0x5}}, './file0\x00'}) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="4b00000a000000ddff00d82800"/25, @ANYRES32=0x1, @ANYBLOB="47b100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000000000000200"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x1f, 0x17, &(0x7f0000000c00)=ANY=[@ANYBLOB="180000000700080000000000334108000000985400000200000000000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ff00008500000006000000181100000000000400000000000000000000000080c7985ce74cc676fc9d79d6f3611d065e434bb14b14bba895ef9f45a5dd881c3aa9bf5c4704a5240901e2bd58f7e3b32f4e923bf513b0796746109bd14a81bde57f54", @ANYRES32, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000dd3a5000f0ffffff9500000000000000"], &(0x7f00000007c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41100, 0x16, '\x00', r2, @fallback=0xb, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x0, 0x1, 0x2, 0x9}, 0x10, 0x0, 0xffffffffffffffff, 0x2, &(0x7f0000000a00)=[0xffffffffffffffff, r6, r7], &(0x7f0000000a40)=[{0x0, 0x1, 0xf, 0x8}, {0x1, 0x4, 0xc, 0x9}], 0x10, 0x7}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_STATION(r8, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16, @ANYBLOB="cf0400000000fcffffff1200000008000300", @ANYRES32, @ANYBLOB="0a00060008021100000100000c004300"], 0x34}}, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r1, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0xb0, r5, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffff8, 0xa}}}}, [@NL80211_ATTR_REKEY_DATA={0x10, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "b965a0412ebafc8a"}]}, @NL80211_ATTR_REKEY_DATA={0x2c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x5d3e}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e6b7c11f9e0a2667"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "c2ffa5ca9c1121a1"}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="8474d1b4ea4f13b3dc2f66758f8d5864c26fdd1b3f3ce51c507af2e8eb05a86f"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7c6f}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "125773b91fb6e3ac"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x6}, @NL80211_REKEY_DATA_AKM={0x8}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4c804}, 0x8040) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000d00)={0xe8, r5, 0x10, 0x70bd26, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x9, 0x26}}}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x3}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x54, 0x50, 0x0, 0x1, [@NL80211_KEY_MODE={0x5}, @NL80211_KEY_MODE={0x5, 0x9, 0x2}, @NL80211_KEY_SEQ={0xb, 0x4, "bee818292c62df"}, @NL80211_KEY_SEQ={0x11, 0x4, "ee48bde71fe255d8791b43b013"}, @NL80211_KEY_DEFAULT_TYPES={0xc, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "217be6c4a690f9a2ad4be81eb4"}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x24, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x24, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "ffd4c1e574"}]}, 0xe8}, 0x1, 0x0, 0x0, 0x24000011}, 0x4000884) syz_emit_vhci(&(0x7f0000000240)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@any, "9ff586"}}}, 0xd) socket$nl_generic(0x10, 0x3, 0x10) 5m43.211617244s ago: executing program 0 (id=796): r0 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0xc1, 0x9a, 0x0) mq_timedreceive(r0, 0x0, 0x44, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000200), 0x4) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x3, 0x7, 0x2, 0x17d, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x5, 0x6, 0x8001, 0xbdb], 0xffff1001, 0x120182}) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c643c, &(0x7f0000000300)) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000045000000040000000fa2"], 0x45}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) 5m43.167864519s ago: executing program 1 (id=797): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000380)=ANY=[], 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x88001) poll(&(0x7f0000000340)=[{r2, 0xc400}], 0x1, 0x3) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000000000), 0x71, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r4, 0xc0585605, &(0x7f0000000540)={0x0, 0x1, @stop_pts=0x6f}) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) bpf$PROG_LOAD(0x5, &(0x7f0000019200)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ffb7000000bfa100000000000007010000f8ffffffb7020000cf000000b703000000008fd8850000000400000095"], &(0x7f00000192c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) dup3(0xffffffffffffffff, r3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050000e22dcbc80b47befa0000000900010073797a30000000002c000000030a01020000000000000000010000030900030073797a30000000000900010073797a3000000000540000001a0a"], 0xc8}, 0x1, 0x0, 0x0, 0x18014}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="2800000010000100"/20, @ANYRES32=0x0, @ANYBLOB="000200001900000001002e0000000000"], 0x28}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000080), 0xfecc) 5m42.839697843s ago: executing program 3 (id=798): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/custom1\x00', 0x0, 0x0) r2 = epoll_create1(0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102389, 0xffffffd8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, &(0x7f0000000100)=0x40000002, 0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x9, &(0x7f0000006680)=0x3) r5 = io_uring_setup(0x4bea, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, 0x0, 0x0) madvise(&(0x7f0000204000/0x3000)=nil, 0x3000, 0x64) sendmsg$NFT_BATCH(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x80000002}) r6 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0x1a) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0x2, &(0x7f0000000000)=0x18, 0x4) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan1\x00'}) socket$netlink(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) 5m23.804816821s ago: executing program 32 (id=796): r0 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0xc1, 0x9a, 0x0) mq_timedreceive(r0, 0x0, 0x44, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000200), 0x4) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x3, 0x7, 0x2, 0x17d, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x5, 0x6, 0x8001, 0xbdb], 0xffff1001, 0x120182}) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c643c, &(0x7f0000000300)) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000045000000040000000fa2"], 0x45}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) 4m58.427595742s ago: executing program 33 (id=797): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000380)=ANY=[], 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x1, 0x88001) poll(&(0x7f0000000340)=[{r2, 0xc400}], 0x1, 0x3) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000000000), 0x71, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r4, 0xc0585605, &(0x7f0000000540)={0x0, 0x1, @stop_pts=0x6f}) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) bpf$PROG_LOAD(0x5, &(0x7f0000019200)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ffb7000000bfa100000000000007010000f8ffffffb7020000cf000000b703000000008fd8850000000400000095"], &(0x7f00000192c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) dup3(0xffffffffffffffff, r3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050000e22dcbc80b47befa0000000900010073797a30000000002c000000030a01020000000000000000010000030900030073797a30000000000900010073797a3000000000540000001a0a"], 0xc8}, 0x1, 0x0, 0x0, 0x18014}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="2800000010000100"/20, @ANYRES32=0x0, @ANYBLOB="000200001900000001002e0000000000"], 0x28}}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000080), 0xfecc) 4m58.204085012s ago: executing program 34 (id=791): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x10000, {{0x2, 0x0, @multicast2}}}, 0xfffffffffffffef1) syz_usb_connect(0x3, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0xe0, 0xf4, 0x4b, 0x40, 0xaf0, 0xd013, 0xcf13, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xf9, 0x8, 0x80, 0x0, [{{0x9, 0x4, 0x93, 0x3, 0x0, 0xa8, 0xf5, 0x5d, 0x5}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000000)={@multicast1, @dev={0xac, 0x14, 0x14, 0xf}, @multicast1}, 0xc) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000300)=ANY=[@ANYBLOB="020000000000000002004e21e0000002"], 0x90) 4m58.129993813s ago: executing program 35 (id=798): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs2/custom1\x00', 0x0, 0x0) r2 = epoll_create1(0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102389, 0xffffffd8) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, &(0x7f0000000100)=0x40000002, 0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x9, &(0x7f0000006680)=0x3) r5 = io_uring_setup(0x4bea, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, 0x0, 0x0) madvise(&(0x7f0000204000/0x3000)=nil, 0x3000, 0x64) sendmsg$NFT_BATCH(r4, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0x80000002}) r6 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r6, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0x1a) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r6, 0x10e, 0x2, &(0x7f0000000000)=0x18, 0x4) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan1\x00'}) socket$netlink(0x10, 0x3, 0x9) socket$nl_netfilter(0x10, 0x3, 0xc) 4m57.970996895s ago: executing program 36 (id=795): syz_usbip_server_init(0x1) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2000002, 0x8010, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x476b, &(0x7f0000000040)={0x0, 0x7def, 0x2010, 0x3, 0x375}, &(0x7f00000000c0), &(0x7f0000000100)) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010002"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0xc0a2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) r4 = accept$inet6(r0, &(0x7f00000004c0), &(0x7f0000000500)=0x1c) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r1) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000940)={{0x1, 0x1, 0x18, r4, {0x5}}, './file0\x00'}) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="4b00000a000000ddff00d82800"/25, @ANYRES32=0x1, @ANYBLOB="47b100"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000000000000200"/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x1f, 0x17, &(0x7f0000000c00)=ANY=[@ANYBLOB="180000000700080000000000334108000000985400000200000000000000000000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ff00008500000006000000181100000000000400000000000000000000000080c7985ce74cc676fc9d79d6f3611d065e434bb14b14bba895ef9f45a5dd881c3aa9bf5c4704a5240901e2bd58f7e3b32f4e923bf513b0796746109bd14a81bde57f54", @ANYRES32, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000082000000dd3a5000f0ffffff9500000000000000"], &(0x7f00000007c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41100, 0x16, '\x00', r2, @fallback=0xb, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x5, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x0, 0x1, 0x2, 0x9}, 0x10, 0x0, 0xffffffffffffffff, 0x2, &(0x7f0000000a00)=[0xffffffffffffffff, r6, r7], &(0x7f0000000a40)=[{0x0, 0x1, 0xf, 0x8}, {0x1, 0x4, 0xc, 0x9}], 0x10, 0x7}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_STATION(r8, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16, @ANYBLOB="cf0400000000fcffffff1200000008000300", @ANYRES32, @ANYBLOB="0a00060008021100000100000c004300"], 0x34}}, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r1, &(0x7f00000006c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0xb0, r5, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffff8, 0xa}}}}, [@NL80211_ATTR_REKEY_DATA={0x10, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "b965a0412ebafc8a"}]}, @NL80211_ATTR_REKEY_DATA={0x2c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x8}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x5d3e}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "e6b7c11f9e0a2667"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "c2ffa5ca9c1121a1"}]}, @NL80211_ATTR_REKEY_DATA={0x4c, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="8474d1b4ea4f13b3dc2f66758f8d5864c26fdd1b3f3ce51c507af2e8eb05a86f"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x7c6f}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "125773b91fb6e3ac"}, @NL80211_REKEY_DATA_AKM={0x8, 0x4, 0x6}, @NL80211_REKEY_DATA_AKM={0x8}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4c804}, 0x8040) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000001c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000d00)={0xe8, r5, 0x10, 0x70bd26, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x9, 0x26}}}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x3}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY={0x54, 0x50, 0x0, 0x1, [@NL80211_KEY_MODE={0x5}, @NL80211_KEY_MODE={0x5, 0x9, 0x2}, @NL80211_KEY_SEQ={0xb, 0x4, "bee818292c62df"}, @NL80211_KEY_SEQ={0x11, 0x4, "ee48bde71fe255d8791b43b013"}, @NL80211_KEY_DEFAULT_TYPES={0xc, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "217be6c4a690f9a2ad4be81eb4"}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x24, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x24, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "ffd4c1e574"}]}, 0xe8}, 0x1, 0x0, 0x0, 0x24000011}, 0x4000884) syz_emit_vhci(&(0x7f0000000240)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@any, "9ff586"}}}, 0xd) socket$nl_generic(0x10, 0x3, 0x10) 10.130024963s ago: executing program 5 (id=1502): syz_usb_connect(0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x4, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0xa000}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c810}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a0000000000000000070000", @ANYRES32=r2, @ANYBLOB], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r5 = syz_open_dev$vim2m(&(0x7f0000000240), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0x1, {0x0}}) close_range(r4, 0xffffffffffffffff, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) 9.736102353s ago: executing program 5 (id=1503): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xd80, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$l2tp6(0xa, 0x2, 0x73) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x8, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000600), 0x6828, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x5, 0xe, 0x9, 0x8, "c400523a6f29960fce66e2e7aadce2988b5ec056b7577f87586a324b565ffcbb"}) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffebe}, 0x90) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) fsopen(&(0x7f0000000080)='romfs\x00', 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e24, @broadcast}, 0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x3}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={r2, 0x100}, 0x8) 8.424533776s ago: executing program 6 (id=1506): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r1 = syz_open_dev$swradio(&(0x7f00000065c0), 0x0, 0x2) ioctl$VIDIOC_G_TUNER(r1, 0xc054561d, &(0x7f0000006600)={0x4, "8c8119a6deac0c194a6bbf51dda69535bed276bc2f69c2be09318c06f8cc822d", 0x1, 0x1, 0x0, 0x7f, 0x2, 0x1, 0x4, 0x1}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r5, 0x84, 0x84, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') ioctl$FS_IOC_MEASURE_VERITY(r4, 0xc0046686, 0x0) lseek(r6, 0x10000000005, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r7 = socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_ethernet(0x3a, &(0x7f0000001080)={@broadcast, @dev, @void, {@mpls_uc={0x8847, {[{0x2}, {0xfff81}, {0x8893, 0x0, 0x1}, {0x8, 0x0, 0x1}], @llc={@snap={0x0, 0xab, "9c", "a0718b", 0x88fb, "16716c0c69aea4cb0b1422dd7423e80c509b1712"}}}}}}, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r7, 0x84, 0xa, &(0x7f0000000140)={0x0, 0x5, 0x20c, 0x9, 0x3ff, 0x3, 0x181, 0x4, r8}, 0x20) 8.059359228s ago: executing program 8 (id=1507): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r1 = syz_io_uring_setup(0x10b, &(0x7f0000000580)={0x0, 0x9736, 0x220, 0x3, 0xbffffff9}, &(0x7f0000000540)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f00000002c0)=0x9, 0x0, 0x4) io_uring_enter(r1, 0x1c3a, 0xe176, 0x22, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x1b, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000901fefffffffffffffd58c7b196995d61", @ANYRES32=r3, @ANYRESHEX=r3, @ANYRES32=r3], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r5 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x802) ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000100)={0xc0b2, 0x5, 0x1, 0xd, 0x1, 0x44e, "586f9bb5a781fdee0b851ce91bf49570", 0x7, 0x5, 0x1, 0x6, 0x8, 0x6, 0x9}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0xff43, &(0x7f00000002c0)=0x2) socket$rds(0x15, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYRES64=r3, @ANYRESHEX=0x0, @ANYRES64, @ANYRES16=r8, @ANYRESOCT], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xd, &(0x7f0000000500)=ANY=[@ANYRES32=r4], &(0x7f00000004c0)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r9, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f00000000c0)) read$dsp(r9, &(0x7f0000000440)=""/102, 0x66) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x18, 0x3, r6, r7, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000280)}) syz_io_uring_setup(0x891, &(0x7f0000000140)={0x0, 0xaee2, 0x80, 0x3, 0x8b6}, 0x0, 0x0) move_pages(0x0, 0x20a0, &(0x7f0000000040), &(0x7f0000001180), &(0x7f0000000000), 0x0) 7.53798016s ago: executing program 7 (id=1510): sched_setscheduler(0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x5f49, &(0x7f0000000140)={0x0, 0x1, 0x100, 0x0, 0x112}, &(0x7f00000001c0), &(0x7f00000000c0)) syz_io_uring_setup(0x3c5f, &(0x7f0000000240)={0x0, 0x0, 0x27, 0x2, 0x0, 0x0, r0}, 0x0, 0x0) socket(0x22, 0x2, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x870bd2d, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x8, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0xc}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x408, 0x4000000, 0x2, 0xff, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x4800}, 0x20048000) mkdir(0x0, 0x92) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}]}) chdir(0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2382, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r3}, 0x18) r4 = socket(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x6) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r6) getsockname$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x2, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7fffffff, 0x1}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newtfilter={0x6c, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xc, 0x6}, {0xfffb}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x38, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_ctinfo={0x30, 0x1c, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xfa}}]}, 0x6c}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f00000002c0)={'syztnl1\x00', &(0x7f0000000480)={'syztnl0\x00', r7, 0x29, 0x7, 0x3, 0xa, 0x2, @local, @empty, 0x700, 0x7, 0x81}}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', r8, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x5}, 0x8, 0x10, &(0x7f0000000100)={0x100, 0x0, 0xfffffffc}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0xffffffffffffff56) r10 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_ERR(r10, 0x4008af22, 0x0) r11 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r11, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @empty}}}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r11, 0x89f5, &(0x7f00000001c0)={'syztnl0\x00', &(0x7f0000000140)={'ip_vti0\x00', r12, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @dev={0xac, 0x14, 0x14, 0xd}, @multicast2}}}}) socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r9, 0x702, 0xe, 0x0, &(0x7f0000000540)="e460334470b8d480eb00c15286dd", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 6.932940624s ago: executing program 5 (id=1511): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000001000000080000000c"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000d40)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000e00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r1}, 0x10) r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x100000e, 0x11012, r2, 0x0) 6.611978669s ago: executing program 5 (id=1513): syz_usb_connect(0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x4, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0xa000}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c810}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(r0, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r5 = syz_open_dev$vim2m(&(0x7f0000000240), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0x1, {0x0}}) close_range(r4, 0xffffffffffffffff, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) 6.600025978s ago: executing program 8 (id=1514): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000240)=@ethtool_ringparam={0x10, 0x8, 0x10, 0x6, 0x40000, 0x4, 0x2, 0x81, 0xffffff19}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, 0xfffffffffffffffe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) read$midi(r7, 0x0, 0x14) close_range(r6, 0xffffffffffffffff, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f00000000c0)={0x0, 0x6}, 0x8) 6.416532271s ago: executing program 7 (id=1515): mprotect(&(0x7f00000c3000/0x3000)=nil, 0x3000, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_CHAIN_HOOK={0x4}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffc}]}], {0x14}}, 0x5c}, 0x1, 0x0, 0x0, 0x48001}, 0x0) socket$netlink(0x10, 0x3, 0xc) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f00000000c0)=0x81) r3 = syz_io_uring_setup(0x66e, &(0x7f0000000240)={0x0, 0x29cc, 0x10100}, &(0x7f0000000380)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x567, 0x0, 0x0, 0x0, 0x0) readv(r2, &(0x7f0000000640)=[{&(0x7f0000002480)=""/4082, 0xff2}], 0x1) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000480)={{0xffffffff, 0x0, 0x0, 0xfffffffc, 'syz0\x00'}, 0x2, 0x30, 0x5, 0x0, 0x0, 0x1ff, 'syz0\x00', 0x0}) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000040)='veth1_virt_wifi\x00', 0x10) setsockopt$sock_int(r6, 0x1, 0x28, &(0x7f00000001c0)=0x7004, 0x4) r7 = dup(r6) sendmsg$inet(r7, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000001600)=[{&(0x7f0000000000)="be39", 0xffeb}], 0x1, &(0x7f0000000c80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private}}}], 0xf}, 0x0) read$msr(r7, &(0x7f0000000240)=""/66, 0x42) ioctl$HCIINQUIRY(r0, 0x800448d4, &(0x7f0000000000)={0x1004, 0x2, '@\x00', 0x0, 0x4}) socket$inet(0x2, 0x5, 0x0) 6.363396071s ago: executing program 9 (id=1516): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r1 = syz_open_dev$swradio(&(0x7f00000065c0), 0x0, 0x2) ioctl$VIDIOC_G_TUNER(r1, 0xc054561d, &(0x7f0000006600)={0x4, "8c8119a6deac0c194a6bbf51dda69535bed276bc2f69c2be09318c06f8cc822d", 0x1, 0x1, 0x0, 0x7f, 0x2, 0x1, 0x4, 0x1}) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r5, 0x84, 0x84, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='status\x00') ioctl$FS_IOC_MEASURE_VERITY(r4, 0xc0046686, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r6 = socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_ethernet(0x3a, &(0x7f0000001080)={@broadcast, @dev, @void, {@mpls_uc={0x8847, {[{0x2}, {0xfff81}, {0x8893, 0x0, 0x1}, {0x8, 0x0, 0x1}], @llc={@snap={0x0, 0xab, "9c", "a0718b", 0x88fb, "16716c0c69aea4cb0b1422dd7423e80c509b1712"}}}}}}, 0x0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000140)={0x0, 0x5, 0x20c, 0x9, 0x3ff, 0x3, 0x181, 0x4, r7}, 0x20) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0xc7) close(0x3) 5.572638708s ago: executing program 8 (id=1517): syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='ns\x00') prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000010a80)=@raw={'raw\x00', 0x8, 0x3, 0xa08, 0x100, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x970, 0xffffffff, 0xffffffff, 0x970, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @private, 0x0, 0x0, 'batadv0\x00', 'batadv_slave_0\x00', {}, {}, 0x21}, 0x6, 0xa0, 0x100, 0x0, {}, [@common=@inet=@dccp={{0x30}, {[], [], 0x3d8}}]}, @common=@SET={0x60}}, {{@ip={@loopback, @dev, 0x0, 0x0, 'veth0_virt_wifi\x00', 'bond_slave_0\x00'}, 0x0, 0x850, 0x870, 0x0, {}, [@common=@unspec=@u32={{0x7e0}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xa68) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r8, 0x1, 0x70bd2b, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20000090}, 0x40000) getpeername$netrom(r2, &(0x7f0000000100)={{0x3, @rose}, [@bcast, @bcast, @bcast, @rose, @remote, @null, @null, @netrom]}, &(0x7f00000001c0)=0x48) 4.735116688s ago: executing program 9 (id=1518): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109025f0003010000000904000000010100000a24010000000201020904010000010200000904010101010200000905010900000000000725010000000009"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x24008884) r1 = syz_io_uring_setup(0x369e, &(0x7f0000000300)={0x0, 0xf36e, 0x10100, 0x0, 0xfffffffc}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='>'], 0x38}}, 0x80) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_FALLOCATE={0x11, 0x10, 0x0, @fd_index=0x8, 0x40, 0x0, 0x6, 0x0, 0x1}) io_uring_enter(r1, 0x2d3e, 0x2936, 0x0, 0x0, 0x0) 4.731596194s ago: executing program 6 (id=1519): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) syz_emit_vhci(&(0x7f0000000580)=ANY=[@ANYBLOB="040f0402001304c702a6e8e9b2641c4e9f2aa3376800b61823d1e2efef99bf837851c47d7255b97d5801754ad204fc061a6a612badea14fde723a2cfa58e9861d339e56d2a45aa80c79d8e9627759682f0c94914831a615c0faa01a1"], 0x7) setsockopt$CAIFSO_REQ_PARAM(0xffffffffffffffff, 0x116, 0x80, 0x0, 0x0) socket(0x1, 0x1, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0xf59}, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc1105518, &(0x7f0000000040)={{0x22, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x7, 0xfffffffffffffffc, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5fa, 0x0, 0x0, 0x8000000000000, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x7, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x40000, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7ff, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x6, 0x4, 0x6, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x8001]}) io_uring_setup(0x1abf, &(0x7f0000000000)={0x0, 0xa4ec, 0x400, 0x1, 0x102a8}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, 0x0}) timerfd_create(0x7, 0x81000) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$get_persistent(0x16, 0x0, r3) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x258}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x100, 0x0) lseek(r4, 0xaea, 0x3) socket(0x10, 0x803, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x2c) setuid(0xee00) 4.313249724s ago: executing program 7 (id=1520): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0) ioctl$BLKRRPART(r0, 0x125f, 0x0) 3.865605546s ago: executing program 7 (id=1521): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xd80, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$l2tp6(0xa, 0x2, 0x73) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x22, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x8, '\f\x00'}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x0, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000600), 0x6828, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000000)={0x5, 0xe, 0x9, 0x8, "c400523a6f29960fce66e2e7aadce2988b5ec056b7577f87586a324b565ffcbb"}) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffebe}, 0x90) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) fsopen(&(0x7f0000000080)='romfs\x00', 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e24, @broadcast}, 0x10) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x3}, &(0x7f0000000240)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000280)=@assoc_value={r2, 0x100}, 0x8) 3.798699067s ago: executing program 8 (id=1522): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1, 0x38011, r2, 0x9988000) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x1, @broadcast, 'lo\x00'}}, 0x1e) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) fadvise64(r1, 0x18, 0x0, 0x4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) 3.772909927s ago: executing program 5 (id=1523): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000001000000080000000c"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000d40)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000e00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r1}, 0x10) r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x100000e, 0x11012, r2, 0x0) 3.766584677s ago: executing program 6 (id=1524): openat$mixer(0xffffffffffffff9c, &(0x7f00000018c0), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) socket(0x848000000015, 0x805, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) 3.506510911s ago: executing program 5 (id=1525): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_open_dev$usbfs(&(0x7f0000000340), 0x206, 0x8401) ioctl$USBDEVFS_ALLOW_SUSPEND(r1, 0x5522) ioctl$USBDEVFS_BULK(r1, 0x5523, 0x0) ioctl$USBDEVFS_FORBID_SUSPEND(r1, 0x5521) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r0}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket(0x2b, 0x1, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f00000003c0), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r3}) io_uring_enter(0xffffffffffffffff, 0xdb4, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_SYNC_CANCEL(0xffffffffffffffff, 0x18, &(0x7f0000000000)={0xfeffffff, r3, 0x23, {0x3b4, 0x6d3}, 0x6}, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x2000000, 0x0) gettid() fcntl$lock(0xffffffffffffffff, 0x25, 0x0) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r4, &(0x7f00000001c0)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x10) r5 = socket(0x28, 0x1, 0x0) sendmsg$nl_generic(r5, 0x0, 0x0) 3.505318775s ago: executing program 8 (id=1526): prlimit64(0x0, 0xe, &(0x7f0000000180)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getpgid(r0) syz_pidfd_open(r0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x10}], 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) r3 = syz_open_dev$sndpcmp(0x0, 0x4000000002, 0x22882) ioctl$SNDRV_PCM_IOCTL_START(r3, 0x4142, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) close(r5) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r6 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r6) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000000640)={0x2020}, 0x2020) execve(&(0x7f0000000180)='./file0\x00', 0x0, &(0x7f0000000800)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01']}) 2.6250503s ago: executing program 6 (id=1527): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x0) 2.182622252s ago: executing program 8 (id=1528): r0 = mq_open(&(0x7f000084dff0)='\xa1sxt\x1a\x00\x00\x00\x00\x00\x00\x00\x01\x88\xbdd', 0xc1, 0x9a, 0x0) mq_timedreceive(r0, 0x0, 0x44, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000200), 0x4) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x3, 0x7, 0x2, 0x17d, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x0, 0x9, 0x5, 0x6, 0x8001, 0xbdb], 0xffff1001, 0x120182}) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000000000000045000000040000000fa2"], 0x45}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x43, &(0x7f0000000040)=0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) 2.075965586s ago: executing program 9 (id=1529): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002"], 0x44}}, 0x0) (fail_nth: 9) 2.0206029s ago: executing program 6 (id=1530): r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r2, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0x1e1c}, {&(0x7f00000000c0)=""/250, 0x4}], 0x2, 0x0, 0xd64}}], 0x300, 0x34000, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}}, 0x0) r3 = inotify_init1(0x0) fcntl$getownex(r3, 0x5, &(0x7f0000000080)) connect$can_bcm(r0, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/pm_debug_messages', 0x8000, 0x144) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_open_dev$MSR(0x0, 0x4, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket(0x2b, 0x1, 0x0) syz_io_uring_setup(0x110, &(0x7f0000001280)={0x0, 0xfad6, 0x400}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7b130000000000001c0012800b00010067656e09006500000c000280060005004e200000"], 0x3c}}, 0x40800) r9 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r9, 0x40045532, &(0x7f0000000040)) r10 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r11 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r11, 0xc0884113, &(0x7f0000000240)={0x1, 0x800, 0x0, 0x10001, 0x0, 0x0, 0x4, 0x800000, 0x0, 0x0, 0xfffffffe, 0x5}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r5}) socket(0x10, 0x803, 0x2) 1.925589842s ago: executing program 9 (id=1531): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x2, 0x101400) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$TIPC_SRC_DROPPABLE(0xffffffffffffffff, 0x10f, 0x80, 0x0, 0x0) syz_open_dev$media(&(0x7f0000000080), 0x34, 0x0) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x48b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000001a40)=""/102392, 0x18ff8) bind$netlink(0xffffffffffffffff, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x4b5, 0x0) syz_init_net_socket$netrom(0x6, 0x5, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, 0x0, 0x4000080) syz_emit_ethernet(0x0, 0x0, 0x0) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x7, 0x0) mount(&(0x7f00000000c0)=@filename='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00', &(0x7f00000001c0)='btrfs\x00', 0x10, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r5, 0x0, &(0x7f0000ff6000/0xa000)=nil, 0xa000}) 405.244835ms ago: executing program 9 (id=1532): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x80000006, 0x48002) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0) ioctl$BLKRRPART(r0, 0x125f, 0x0) 295.862673ms ago: executing program 7 (id=1533): socket(0x2b, 0x80801, 0x1) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) rseq(&(0x7f0000000240)={0x0, 0x0, 0x0, 0x6}, 0x20, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x1, 0x84) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioperm(0x0, 0x6, 0x2da3b9f3) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000e80)={'filter\x00', 0xb001, 0x4, 0x3ac, 0x10c, 0x0, 0x1ec, 0x2cc, 0x2cc, 0x2cc, 0x7fffffe, 0x0, {[{{@arp={@empty, @local, 0xff000000, 0xff000000, 0xd, 0x6, {@mac=@broadcast, {[0xff, 0xff]}}, {@mac=@remote, {[0x0, 0xff, 0xff, 0x0, 0xff]}}, 0x1, 0x2, 0x7ff, 0x2, 0xfffb, 0x7f6, 'wlan1\x00', 'veth0_vlan\x00', {0xff}, {}, 0x0, 0x28}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@local, @rand_addr=0x64010111, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x2}}}, {{@uncond, 0xbc, 0xe0, 0x0, {0x0, 0x1e03}}, @unspec=@STANDARD={0x24, '\x00', 0x0, 0x10c}}, {{@uncond, 0xbc, 0xe0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0x31caf518}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3fc) r2 = openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) fchown(r2, 0x0, 0xffffffffffffffff) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0xe2981) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x48, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x34, 0x1, [@m_sample={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc, 0x4, {0x3}}}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r3, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32={[0x2600, 0x0, 0x2000]}}], 0xffc8) 293.30124ms ago: executing program 9 (id=1534): syz_usb_connect(0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x4, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0xa000}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c810}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r2, @ANYBLOB], 0x270}, 0x1, 0x0, 0x0, 0x8015}, 0x4) sendmmsg(r0, 0x0, 0x0, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r5 = syz_open_dev$vim2m(&(0x7f0000000240), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r5, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r5, 0x40045612, &(0x7f0000000000)=0x1) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0x1, {0x0}}) close_range(r4, 0xffffffffffffffff, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) 234.671659ms ago: executing program 6 (id=1535): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000e00)=ANY=[@ANYBLOB="1201000000000040de28021100000000000109022400010000d00009040004010300000009210100f90122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) syz_usb_control_io(r0, &(0x7f0000000040)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="200b4000000028b1"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'pimreg\x00', 0x5083}) io_setup(0x6, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000000040)=[&(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x8, r1, &(0x7f00000000c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00D', 0xa, 0x7, 0x0, 0x2}]) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[], 0xec}, 0x1, 0x0, 0x0, 0x8040}, 0x0) 0s ago: executing program 7 (id=1536): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000001000000080000000c"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000d40)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000e00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r1}, 0x10) r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x100000e, 0x11012, r2, 0x0) kernel console output (not intermixed with test programs): mufd_mock0: Adding to iommu group 0 [ 543.977803][T11700] 9pnet_virtio: no channels available for device syz [ 545.843204][T11718] FAULT_INJECTION: forcing a failure. [ 545.843204][T11718] name failslab, interval 1, probability 0, space 0, times 0 [ 545.878278][ T9781] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 546.029295][T11718] CPU: 1 UID: 0 PID: 11718 Comm: syz.8.1119 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 546.029324][T11718] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 546.029336][T11718] Call Trace: [ 546.029343][T11718] [ 546.029350][T11718] dump_stack_lvl+0x16c/0x1f0 [ 546.029384][T11718] should_fail_ex+0x512/0x640 [ 546.029409][T11718] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 546.029435][T11718] should_failslab+0xc2/0x120 [ 546.029463][T11718] __kmalloc_cache_noprof+0x6a/0x3e0 [ 546.029484][T11718] ? drm_mode_setcrtc+0x695/0x1de0 [ 546.029516][T11718] drm_mode_setcrtc+0x695/0x1de0 [ 546.029546][T11718] ? avc_has_extended_perms+0x33a/0x1090 [ 546.029585][T11718] ? avc_has_extended_perms+0x47c/0x1090 [ 546.029603][T11718] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 546.029648][T11718] ? drm_is_current_master+0x2c/0x40 [ 546.029671][T11718] ? do_raw_spin_unlock+0x172/0x230 [ 546.029699][T11718] drm_ioctl_kernel+0x1f4/0x3e0 [ 546.029725][T11718] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 546.029750][T11718] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 546.029783][T11718] drm_ioctl+0x5c9/0xc30 [ 546.029811][T11718] ? __pfx_drm_mode_setcrtc+0x10/0x10 [ 546.029835][T11718] ? __pfx_drm_ioctl+0x10/0x10 [ 546.029870][T11718] ? selinux_file_ioctl+0x180/0x270 [ 546.029893][T11718] ? selinux_file_ioctl+0xb4/0x270 [ 546.029916][T11718] ? __pfx_drm_ioctl+0x10/0x10 [ 546.029940][T11718] __x64_sys_ioctl+0x18e/0x210 [ 546.029965][T11718] do_syscall_64+0xcd/0x4c0 [ 546.029998][T11718] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.030017][T11718] RIP: 0033:0x7f3d6b38e929 [ 546.030032][T11718] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 546.030049][T11718] RSP: 002b:00007f3d6c203038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 546.030068][T11718] RAX: ffffffffffffffda RBX: 00007f3d6b5b5fa0 RCX: 00007f3d6b38e929 [ 546.030079][T11718] RDX: 0000200000000180 RSI: 00000000c06864a2 RDI: 0000000000000003 [ 546.030091][T11718] RBP: 00007f3d6c203090 R08: 0000000000000000 R09: 0000000000000000 [ 546.030101][T11718] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 546.030111][T11718] R13: 0000000000000000 R14: 00007f3d6b5b5fa0 R15: 00007ffd08b0dad8 [ 546.030136][T11718] [ 546.528785][ T30] audit: type=1400 audit(1751877451.295:629): avc: denied { create } for pid=11728 comm="syz.8.1123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 546.955811][T11737] overlayfs: failed to resolve './file1': -2 [ 547.075958][ T30] audit: type=1400 audit(1751877451.295:630): avc: denied { getopt } for pid=11728 comm="syz.8.1123" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 547.511024][ T9781] usb 10-1: Using ep0 maxpacket: 32 [ 547.525625][ T9781] usb 10-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8 [ 547.538176][ T9781] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 547.558581][ T9781] usb 10-1: Product: syz [ 547.563279][ T9781] usb 10-1: Manufacturer: syz [ 547.567992][ T9781] usb 10-1: SerialNumber: syz [ 547.606585][ T9781] empeg 10-1:1.0: empeg converter detected [ 547.836751][ T5947] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 548.017070][ T9781] usb 10-1: empeg converter now attached to ttyUSB0 [ 548.220437][ T5947] usb 7-1: Using ep0 maxpacket: 16 [ 548.228263][ T5947] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 548.250561][ T5947] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 548.260579][ T5947] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 548.273635][ T5947] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 548.847726][ T5947] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.866129][ T5947] usb 7-1: config 0 descriptor?? [ 549.297872][ T5947] shield 0003:0955:7214.002E: unknown main item tag 0x0 [ 549.322648][ T5947] shield 0003:0955:7214.002E: unknown main item tag 0x0 [ 549.341863][ T5947] shield 0003:0955:7214.002E: unknown main item tag 0x0 [ 549.349116][ T5947] shield 0003:0955:7214.002E: unknown main item tag 0x0 [ 549.356545][ T5947] shield 0003:0955:7214.002E: unknown main item tag 0x0 [ 549.559125][ T5947] input: HID 0955:7214 Haptics as /devices/virtual/input/input49 [ 549.614863][T11784] netlink: 244 bytes leftover after parsing attributes in process `syz.6.1125'. [ 549.674283][ T5947] shield 0003:0955:7214.002E: Registered Thunderstrike controller [ 549.702571][ T5947] shield 0003:0955:7214.002E: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.6-1/input0 [ 549.907067][ T10] usb 10-1: USB disconnect, device number 20 [ 549.930732][ T10] empeg ttyUSB0: empeg converter now disconnected from ttyUSB0 [ 549.939117][ T10] empeg 10-1:1.0: device disconnected [ 549.975845][T11791] fuse: Bad value for 'user_id' [ 549.999268][T11791] fuse: Bad value for 'user_id' [ 550.597799][ T10] usb 7-1: USB disconnect, device number 16 [ 550.601080][ T5943] shield 0003:0955:7214.002E: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 550.775091][ T5943] shield 0003:0955:7214.002E: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 550.793728][T11801] netlink: 212376 bytes leftover after parsing attributes in process `syz.8.1132'. [ 551.070600][ T5943] shield 0003:0955:7214.002E: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 551.092378][ T5943] shield 0003:0955:7214.002E: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 551.361279][ T5943] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 551.997716][ T5943] usb 8-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 552.065255][ T5943] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 552.101188][ T5943] usb 8-1: Product: syz [ 552.119017][ T5943] usb 8-1: Manufacturer: syz [ 552.130649][ T5943] usb 8-1: SerialNumber: syz [ 552.165984][ T5943] usb 8-1: config 0 descriptor?? [ 552.319034][ T5943] i2c-tiny-usb 8-1:0.0: version 6d.cc found at bus 008 address 012 [ 552.441985][T11830] overlayfs: failed to resolve './file1': -2 [ 552.865144][ T30] audit: type=1400 audit(1751877457.655:631): avc: denied { connect } for pid=11828 comm="syz.8.1138" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 553.278853][ T5943] (null): failure reading functionality [ 553.295030][ T5943] i2c i2c-1: failure reading functionality [ 553.329034][ T5943] i2c i2c-1: connected i2c-tiny-usb device [ 553.403421][ T10] libceph: connect (1)[c::]:6789 error -101 [ 553.415582][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 553.501779][ T10] usb 8-1: USB disconnect, device number 12 [ 553.566693][T11838] ceph: No mds server is up or the cluster is laggy [ 553.759270][ T10] libceph: connect (1)[c::]:6789 error -101 [ 553.795237][ T10] libceph: mon0 (1)[c::]:6789 connect error [ 554.205879][T11861] xt_TCPMSS: Only works on TCP SYN packets [ 554.262053][T11861] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 554.624717][T11864] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 554.656432][T11864] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 555.406804][ T10] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 556.411075][ T10] usb 10-1: config index 0 descriptor too short (expected 45, got 36) [ 556.631047][ T30] audit: type=1400 audit(1751877461.385:632): avc: denied { ioctl } for pid=11874 comm="syz.6.1146" path="socket:[36252]" dev="sockfs" ino=36252 ioctlcmd=0x89e4 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 556.632667][ T10] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 556.751306][T11876] No source specified [ 556.812336][ T10] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 556.864445][ T10] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 556.864485][ T10] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 556.864532][ T10] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 556.864552][ T10] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 556.867723][ T10] usb 10-1: config 0 descriptor?? [ 556.868402][T11872] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 557.620336][ T10] plantronics 0003:047F:FFFF.002F: unknown main item tag 0x0 [ 557.734769][ T10] plantronics 0003:047F:FFFF.002F: unknown main item tag 0x0 [ 557.829543][ T10] plantronics 0003:047F:FFFF.002F: unknown main item tag 0x0 [ 557.889557][ T10] plantronics 0003:047F:FFFF.002F: unknown main item tag 0x0 [ 557.977562][ T10] plantronics 0003:047F:FFFF.002F: unknown main item tag 0x0 [ 558.561408][ T10] plantronics 0003:047F:FFFF.002F: unknown main item tag 0x0 [ 558.688349][ T10] plantronics 0003:047F:FFFF.002F: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.9-1/input0 [ 558.970210][T11920] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=11920 comm=syz.5.1154 [ 559.181302][ T10] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 559.263903][ T5893] usb 6-1: new full-speed USB device number 14 using dummy_hcd [ 559.361869][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 559.384075][ T10] usb 7-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 559.400230][ T10] usb 7-1: config 0 interface 0 has no altsetting 0 [ 559.420232][ T10] usb 7-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00 [ 559.458545][ T5893] usb 6-1: device descriptor read/64, error -71 [ 559.484195][ T10] usb 7-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 559.495660][ T10] usb 7-1: Product: syz [ 559.514307][ T10] usb 7-1: config 0 descriptor?? [ 559.611017][ T9781] usb 10-1: USB disconnect, device number 21 [ 559.744351][ T5893] usb 6-1: new full-speed USB device number 15 using dummy_hcd [ 559.957820][ T5893] usb 6-1: device descriptor read/64, error -71 [ 560.004460][ T10] waterforce 0003:1044:7A4D.0030: unknown main item tag 0x0 [ 560.022868][ T10] waterforce 0003:1044:7A4D.0030: unknown main item tag 0x0 [ 560.030415][ T10] waterforce 0003:1044:7A4D.0030: unknown main item tag 0x0 [ 560.038564][ T10] waterforce 0003:1044:7A4D.0030: unknown main item tag 0x0 [ 560.131349][ T5893] usb usb6-port1: attempt power cycle [ 560.138785][ T10] waterforce 0003:1044:7A4D.0030: unknown main item tag 0x0 [ 560.289740][ T10] waterforce 0003:1044:7A4D.0030: hidraw0: USB HID v0.05 Device [syz] on usb-dummy_hcd.6-1/input0 [ 560.364244][T11962] /dev/nullb0: Can't open blockdev [ 560.723161][T11961] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 560.741673][T11961] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 560.772034][ T5893] usb 6-1: new full-speed USB device number 16 using dummy_hcd [ 560.791555][ T10] waterforce 0003:1044:7A4D.0030: fw version request failed with -38 [ 561.005453][ T5893] usb 6-1: device descriptor read/8, error -71 [ 561.511166][ T5893] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 561.715265][ T5893] usb 6-1: device descriptor read/8, error -71 [ 561.835164][ T5893] usb usb6-port1: unable to enumerate USB device [ 562.160200][ T9781] usb 7-1: USB disconnect, device number 17 [ 562.524186][T12003] input: syz1 as /devices/virtual/input/input50 [ 562.581004][ T30] audit: type=1326 audit(1751877467.355:633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 562.687870][ T30] audit: type=1326 audit(1751877467.355:634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 562.767264][ T30] audit: type=1326 audit(1751877467.355:635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 562.804796][ T30] audit: type=1326 audit(1751877467.355:636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 562.832219][ T5893] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 562.842908][ T30] audit: type=1326 audit(1751877467.365:637): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 562.866365][ C0] vkms_vblank_simulate: vblank timer overrun [ 562.925863][ T30] audit: type=1326 audit(1751877467.365:638): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 562.949514][ C0] vkms_vblank_simulate: vblank timer overrun [ 562.958394][ T30] audit: type=1326 audit(1751877467.365:639): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 562.981877][ C0] vkms_vblank_simulate: vblank timer overrun [ 563.030944][ T5893] usb 7-1: Using ep0 maxpacket: 32 [ 563.084351][ T30] audit: type=1326 audit(1751877467.365:640): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 563.109792][ T5893] usb 7-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 563.197699][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 563.223296][ T5893] usb 7-1: New USB device found, idVendor=0403, idProduct=97c1, bcdDevice= 0.00 [ 563.298092][T12023] input input51: cannot allocate more than FF_MAX_EFFECTS effects [ 563.680601][ T5893] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 563.689016][ T30] audit: type=1326 audit(1751877467.365:641): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 563.716014][ T30] audit: type=1326 audit(1751877467.365:642): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11994 comm="syz.5.1164" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f74d098e929 code=0x7ffc0000 [ 563.744851][ T5893] usb 7-1: config 0 descriptor?? [ 563.826798][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.837083][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.163193][ T5893] hid-retrode 0003:0403:97C1.0031: unknown main item tag 0x0 [ 564.180947][ T5893] hid-retrode 0003:0403:97C1.0031: unknown main item tag 0x0 [ 564.195150][ T5893] hid-retrode 0003:0403:97C1.0031: unknown main item tag 0x0 [ 564.215573][ T5893] hid-retrode 0003:0403:97C1.0031: unknown main item tag 0x0 [ 564.337480][ T5893] hid-retrode 0003:0403:97C1.0031: unknown main item tag 0x0 [ 564.369343][ T5893] hid-retrode 0003:0403:97C1.0031: hidraw0: USB HID v0.02 Device [HID 0403:97c1] on usb-dummy_hcd.6-1/input0 [ 564.444095][T12035] overlayfs: failed to resolve './file1': -2 [ 564.555892][ T5893] usb 7-1: USB disconnect, device number 18 [ 564.989460][T12036] fido_id[12036]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 565.480891][ T5893] usb 8-1: new full-speed USB device number 13 using dummy_hcd [ 565.534764][ T92] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 565.643287][ T5893] usb 8-1: config index 0 descriptor too short (expected 2075, got 27) [ 565.665830][ T5893] usb 8-1: config 0 has an invalid interface number: 232 but max is 0 [ 565.686870][ T5893] usb 8-1: config 0 has no interface number 0 [ 565.712808][ T5893] usb 8-1: config 0 interface 232 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 565.731348][ T92] usb 6-1: Using ep0 maxpacket: 32 [ 565.739985][ T5893] usb 8-1: New USB device found, idVendor=2040, idProduct=651b, bcdDevice=29.5a [ 565.752643][ T5893] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.769977][ T5893] usb 8-1: Product: syz [ 565.771731][ T92] usb 6-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8 [ 565.790487][ T92] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.793822][ T5893] usb 8-1: Manufacturer: syz [ 565.800224][ T92] usb 6-1: Product: syz [ 565.809846][ T92] usb 6-1: Manufacturer: syz [ 565.813279][ T5893] usb 8-1: SerialNumber: syz [ 565.830440][ T92] usb 6-1: SerialNumber: syz [ 565.930652][ T5893] usb 8-1: config 0 descriptor?? [ 565.968488][ T92] empeg 6-1:1.0: empeg converter detected [ 565.979418][ T5893] em28xx 8-1:0.232: New device syz syz @ 12 Mbps (2040:651b, interface 232, class 232) [ 566.434908][ T92] usb 6-1: empeg converter now attached to ttyUSB0 [ 566.441065][ T5893] em28xx 8-1:0.232: Device initialization failed. [ 566.739655][ T5893] em28xx 8-1:0.232: Device must be connected to a high-speed USB 2.0 port. [ 567.644354][T12075] vhci_hcd vhci_hcd.0: pdev(9) rhport(0) sockfd(9) [ 567.650892][T12075] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 567.658536][T12075] vhci_hcd vhci_hcd.0: Device attached [ 567.667565][T12077] vhci_hcd: connection closed [ 567.670101][ T13] vhci_hcd: stop threads [ 567.689872][ T13] vhci_hcd: release socket [ 567.700838][ T13] vhci_hcd: disconnect device [ 567.834961][ T10] usb 8-1: USB disconnect, device number 13 [ 567.871167][ T5886] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 568.041669][ T5886] usb 7-1: Using ep0 maxpacket: 32 [ 568.051563][ T5886] usb 7-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 568.073211][ T5886] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 568.107183][ T5886] usb 7-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 568.119381][ T5886] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.133383][ T5886] usb 7-1: config 0 descriptor?? [ 568.143510][ T5886] hub 7-1:0.0: bad descriptor, ignoring hub [ 568.165202][ T5886] hub 7-1:0.0: probe with driver hub failed with error -5 [ 568.203341][ T5886] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 568.491557][ T5886] usb 6-1: USB disconnect, device number 18 [ 568.521387][ T5886] empeg ttyUSB0: empeg converter now disconnected from ttyUSB0 [ 568.547078][T12076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 568.579360][ T5886] empeg 6-1:1.0: device disconnected [ 568.612055][T12076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 568.649985][ T5846] Bluetooth: hci2: unexpected event for opcode 0x0413 [ 568.660578][T12076] bridge2: entered promiscuous mode [ 569.035871][ T10] usb 7-1: USB disconnect, device number 19 [ 569.132270][ T5886] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 569.281235][ T5886] usb 6-1: Using ep0 maxpacket: 16 [ 569.289302][ T5886] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 569.335112][ T5886] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 569.466618][ T5886] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 569.509469][T12111] FAULT_INJECTION: forcing a failure. [ 569.509469][T12111] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 569.523215][T12111] CPU: 0 UID: 0 PID: 12111 Comm: syz.7.1182 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 569.523242][T12111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 569.523253][T12111] Call Trace: [ 569.523259][T12111] [ 569.523266][T12111] dump_stack_lvl+0x16c/0x1f0 [ 569.523303][T12111] should_fail_ex+0x512/0x640 [ 569.523331][T12111] _copy_from_user+0x2e/0xd0 [ 569.523356][T12111] copy_msghdr_from_user+0x98/0x160 [ 569.523393][T12111] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 569.523424][T12111] ___sys_sendmsg+0xfe/0x1d0 [ 569.523447][T12111] ? __pfx____sys_sendmsg+0x10/0x10 [ 569.523467][T12111] ? __lock_acquire+0x622/0x1c90 [ 569.523509][T12111] ? __sys_sendmsg_sock+0x20/0x40 [ 569.523538][T12111] __sys_sendmsg+0x16d/0x220 [ 569.523562][T12111] ? __pfx___sys_sendmsg+0x10/0x10 [ 569.523583][T12111] ? __pfx___schedule+0x10/0x10 [ 569.523622][T12111] do_syscall_64+0xcd/0x4c0 [ 569.523651][T12111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 569.523671][T12111] RIP: 0033:0x7fbef3d8e929 [ 569.523687][T12111] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 569.523705][T12111] RSP: 002b:00007fbef4c7e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 569.523723][T12111] RAX: ffffffffffffffda RBX: 00007fbef3fb6080 RCX: 00007fbef3d8e929 [ 569.523734][T12111] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000004 [ 569.523744][T12111] RBP: 00007fbef4c7e090 R08: 0000000000000000 R09: 0000000000000000 [ 569.523755][T12111] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 569.523765][T12111] R13: 0000000000000000 R14: 00007fbef3fb6080 R15: 00007ffedf8f7408 [ 569.523788][T12111] [ 569.866039][ T5886] usb 6-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 569.886952][ T5886] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 569.927515][ T5886] usb 6-1: config 0 descriptor?? [ 570.068049][ T30] kauditd_printk_skb: 8 callbacks suppressed [ 570.068071][ T30] audit: type=1326 audit(1751877474.845:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12104 comm="syz.9.1183" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 570.220356][ T30] audit: type=1326 audit(1751877474.855:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12104 comm="syz.9.1183" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 570.357034][ T5886] shield 0003:0955:7214.0032: unknown main item tag 0x0 [ 570.499157][T12134] overlayfs: failed to resolve './file1': -2 [ 570.876111][ T5886] shield 0003:0955:7214.0032: unknown main item tag 0x0 [ 570.885819][ T5886] shield 0003:0955:7214.0032: unknown main item tag 0x0 [ 570.892898][ T5886] shield 0003:0955:7214.0032: unknown main item tag 0x0 [ 570.900860][ T5886] shield 0003:0955:7214.0032: unknown main item tag 0x0 [ 570.914483][ T5886] input: HID 0955:7214 Haptics as /devices/virtual/input/input52 [ 570.969534][ T5886] shield 0003:0955:7214.0032: Registered Thunderstrike controller [ 571.084685][T12097] netlink: 244 bytes leftover after parsing attributes in process `syz.5.1180'. [ 572.702619][ T5846] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 572.712483][ T5846] Bluetooth: hci2: Injecting HCI hardware error event [ 572.723752][ T5846] Bluetooth: hci2: hardware error 0x00 [ 573.164157][ T5886] shield 0003:0955:7214.0032: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.5-1/input0 [ 573.241459][ T974] shield 0003:0955:7214.0032: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 573.271862][ T974] shield 0003:0955:7214.0032: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 573.283241][ T5886] usb 6-1: USB disconnect, device number 19 [ 573.621968][ T974] shield 0003:0955:7214.0032: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 573.641480][ T974] shield 0003:0955:7214.0032: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 573.728634][T12148] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 574.082313][ T5943] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 574.240888][ T5943] usb 8-1: Using ep0 maxpacket: 32 [ 574.249164][ T5943] usb 8-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8 [ 574.250965][ T5886] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 574.258729][ T5943] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.298446][ T5943] usb 8-1: Product: syz [ 574.310069][ T5943] usb 8-1: Manufacturer: syz [ 574.327703][ T5943] usb 8-1: SerialNumber: syz [ 574.397783][ T5943] empeg 8-1:1.0: empeg converter detected [ 574.470892][ T5886] usb 6-1: Using ep0 maxpacket: 32 [ 574.495196][ T5886] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 574.513052][ T5886] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.550898][ T5886] usb 6-1: config 0 descriptor?? [ 574.598232][ T5886] as10x_usb: device has been detected [ 574.608930][ T5943] usb 8-1: empeg converter now attached to ttyUSB0 [ 574.649286][ T5886] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 574.726055][ T5886] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 574.781556][ T5846] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 574.783008][ T5886] as10x_usb: error during firmware upload part1 [ 574.936995][ T5886] Registered device nBox DVB-T Dongle [ 574.974581][ T5886] usb 6-1: USB disconnect, device number 20 [ 575.423815][ T5886] Unregistered device nBox DVB-T Dongle [ 575.429592][ T5886] as10x_usb: device has been disconnected [ 576.713900][T12194] xt_TCPMSS: Only works on TCP SYN packets [ 577.175549][ T5943] usb 8-1: USB disconnect, device number 14 [ 577.215931][ T5943] empeg ttyUSB0: empeg converter now disconnected from ttyUSB0 [ 577.241797][ T5943] empeg 8-1:1.0: device disconnected [ 579.278151][T12222] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 580.167330][T12226] netlink: 256 bytes leftover after parsing attributes in process `syz.7.1204'. [ 580.912964][T12240] netlink: 212376 bytes leftover after parsing attributes in process `syz.5.1206'. [ 581.430091][T12250] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 581.531012][ T974] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 581.700907][ T974] usb 6-1: Using ep0 maxpacket: 16 [ 581.710213][ T974] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 581.747168][ T974] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 581.794526][ T974] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 581.833307][ T974] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 581.863638][ T974] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.902364][ T974] usb 6-1: config 0 descriptor?? [ 583.037806][ T974] HID 045e:07da: Invalid code 65791 type 1 [ 583.085053][ T974] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0033/input/input53 [ 583.116567][ T974] microsoft 0003:045E:07DA.0033: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 584.196466][ T10] usb 6-1: USB disconnect, device number 21 [ 585.010940][ T974] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 585.310928][T12314] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 585.684228][ T974] usb 8-1: Using ep0 maxpacket: 32 [ 585.709403][ T974] usb 8-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 587.301533][ T974] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 587.363462][ T974] usb 8-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 587.416304][ T974] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 587.624850][ T974] usb 8-1: config 0 descriptor?? [ 587.833129][ T974] hub 8-1:0.0: bad descriptor, ignoring hub [ 587.861462][ T974] hub 8-1:0.0: probe with driver hub failed with error -5 [ 587.870263][ T974] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 588.004697][ T974] usb 8-1: USB disconnect, device number 15 [ 588.963969][ T30] audit: type=1326 audit(1751877493.705:653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 589.089968][ T30] audit: type=1326 audit(1751877493.705:654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=251 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 589.161407][ T30] audit: type=1326 audit(1751877493.705:655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 589.192534][ T30] audit: type=1326 audit(1751877493.705:656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 589.350925][ T30] audit: type=1326 audit(1751877493.705:657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 589.748282][ T30] audit: type=1326 audit(1751877493.705:658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 589.815226][ T30] audit: type=1326 audit(1751877493.705:659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 589.922893][ T30] audit: type=1326 audit(1751877493.705:660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 590.014051][ T30] audit: type=1326 audit(1751877493.705:661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 590.140964][ T30] audit: type=1326 audit(1751877493.705:662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12325 comm="syz.7.1221" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 591.150929][ T5886] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 592.110933][T12377] lo speed is unknown, defaulting to 1000 [ 592.125317][T12377] lo speed is unknown, defaulting to 1000 [ 593.160981][ T5886] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 593.188817][ T5886] usb 10-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 593.236584][ T5886] usb 10-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 593.766692][ T5886] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 593.776268][ T5886] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.784449][ T5886] usb 10-1: Product: syz [ 593.788735][ T5886] usb 10-1: Manufacturer: syz [ 593.793609][ T5886] usb 10-1: SerialNumber: syz [ 593.845067][ T5886] hub 10-1:1.0: bad descriptor, ignoring hub [ 593.930748][ T5886] hub 10-1:1.0: probe with driver hub failed with error -5 [ 593.967124][ T5886] usblp 10-1:1.0: usblp0: USB Unidirectional printer dev 22 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 594.000971][ T9781] usb 8-1: new full-speed USB device number 16 using dummy_hcd [ 594.049371][ T5886] usb 10-1: USB disconnect, device number 22 [ 594.086187][ T5886] usblp0: removed [ 594.900888][ T5886] usb 10-1: new high-speed USB device number 23 using dummy_hcd [ 595.171663][ T5886] usb 10-1: Using ep0 maxpacket: 32 [ 595.204010][ T5886] usb 10-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8 [ 595.244025][ T5886] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.341269][ T5947] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 595.341573][T12414] netlink: 212376 bytes leftover after parsing attributes in process `syz.5.1236'. [ 595.511020][ T5947] usb 7-1: Using ep0 maxpacket: 16 [ 595.634197][ T5886] usb 10-1: Product: syz [ 595.638582][ T5886] usb 10-1: Manufacturer: syz [ 595.670840][ T5886] usb 10-1: SerialNumber: syz [ 595.673875][ T5947] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 595.717642][ T5947] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 595.737660][ T5886] empeg 10-1:1.0: empeg converter detected [ 595.753941][ T9781] usb 8-1: unable to get BOS descriptor or descriptor too short [ 595.773745][ T5947] usb 7-1: New USB device found, idVendor=0458, idProduct=5012, bcdDevice= 0.00 [ 595.804329][ T5947] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.827615][ T9781] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 595.845596][ T9781] usb 8-1: can't read configurations, error -71 [ 595.872914][ T5947] usb 7-1: config 0 descriptor?? [ 595.934449][ T5886] usb 10-1: empeg converter now attached to ttyUSB0 [ 596.251562][ T9781] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 596.330145][ T5947] input: HID 0458:5012 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:0458:5012.0034/input/input55 [ 596.726556][T12431] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1240'. [ 596.851146][ T9781] usb 8-1: Using ep0 maxpacket: 16 [ 596.959060][ T9781] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 597.228906][ T5947] input: HID 0458:5012 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:0458:5012.0034/input/input56 [ 597.245426][ T9781] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 597.272913][ T9781] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 597.289642][ T9781] usb 8-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 597.304139][T12431] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 597.338705][ T5947] kye 0003:0458:5012.0034: input,hiddev0,hidraw0: USB HID v0.09 Device [HID 0458:5012] on usb-dummy_hcd.6-1/input0 [ 597.375393][ T9781] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 597.412992][ T9781] usb 8-1: config 0 descriptor?? [ 597.618959][ T974] usb 7-1: USB disconnect, device number 20 [ 597.836626][ T5841] usb 10-1: USB disconnect, device number 23 [ 597.938070][ T9781] shield 0003:0955:7214.0035: unknown main item tag 0x0 [ 597.957381][ T5841] empeg ttyUSB0: empeg converter now disconnected from ttyUSB0 [ 597.988608][ T9781] shield 0003:0955:7214.0035: unknown main item tag 0x0 [ 598.019672][ T5841] empeg 10-1:1.0: device disconnected [ 598.039341][ T9781] shield 0003:0955:7214.0035: unknown main item tag 0x0 [ 598.077781][ T9781] shield 0003:0955:7214.0035: unknown main item tag 0x0 [ 598.099408][T12417] netlink: 244 bytes leftover after parsing attributes in process `syz.7.1238'. [ 598.137549][ T9781] shield 0003:0955:7214.0035: unknown main item tag 0x0 [ 598.157522][T12454] bridge: RTM_NEWNEIGH with invalid ether address [ 598.228230][ T9781] input: HID 0955:7214 Haptics as /devices/virtual/input/input57 [ 598.396657][ T9781] shield 0003:0955:7214.0035: Registered Thunderstrike controller [ 598.418736][ T9781] shield 0003:0955:7214.0035: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.7-1/input0 [ 598.515572][ T5841] shield 0003:0955:7214.0035: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 598.530339][ T9781] usb 8-1: USB disconnect, device number 17 [ 598.582395][ T5947] thermal thermal_zone0: Temperature check failed (-19) [ 598.603480][ T5841] shield 0003:0955:7214.0035: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 598.666999][ T5841] shield 0003:0955:7214.0035: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 598.692012][ T5841] shield 0003:0955:7214.0035: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 599.011620][T12476] bridge_slave_0: left allmulticast mode [ 599.017374][T12476] bridge_slave_0: left promiscuous mode [ 599.023954][T12476] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.129546][T12476] bridge_slave_1: left allmulticast mode [ 599.181180][T12476] bridge_slave_1: left promiscuous mode [ 599.213936][T12476] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.436458][T12476] bond0: (slave bond_slave_0): Releasing backup interface [ 599.557689][T12491] netlink: 212376 bytes leftover after parsing attributes in process `syz.6.1248'. [ 599.801963][T12476] bond0: (slave bond_slave_1): Releasing backup interface [ 599.900298][T12476] team0: Port device team_slave_0 removed [ 599.920165][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 599.920185][ T30] audit: type=1400 audit(1751877504.705:720): avc: denied { read } for pid=12492 comm="syz.7.1249" path="socket:[38596]" dev="sockfs" ino=38596 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 600.038554][T12476] team0: Port device team_slave_1 removed [ 600.082449][T12476] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 600.090216][T12498] netlink: 20 bytes leftover after parsing attributes in process `syz.7.1251'. [ 600.107366][T12476] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 600.155214][T12476] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 600.182442][T12476] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 600.331019][ T5886] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 600.491248][ T5886] usb 6-1: Using ep0 maxpacket: 32 [ 600.526242][ T5886] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 600.537601][ T5886] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 600.559459][ T5886] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 600.568754][ T974] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 600.588532][ T5886] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.610726][ T5886] usb 6-1: config 0 descriptor?? [ 600.745970][ T974] usb 7-1: Using ep0 maxpacket: 32 [ 600.754501][ T974] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 600.784358][ T974] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 600.798551][ T974] usb 7-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 600.808050][ T974] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 600.848743][T12529] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1256'. [ 600.860212][ T974] usb 7-1: config 0 descriptor?? [ 600.875116][T12529] 8021q: adding VLAN 0 to HW filter on device bond1 [ 601.157840][ T30] audit: type=1400 audit(1751877505.935:721): avc: denied { create } for pid=12531 comm="syz.9.1257" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 601.299194][ T30] audit: type=1400 audit(1751877505.935:722): avc: denied { bind } for pid=12531 comm="syz.9.1257" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 601.890622][ T5886] usbhid 6-1:0.0: can't add hid device: -71 [ 601.909103][ T5886] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 601.924873][ T5886] usb 6-1: USB disconnect, device number 22 [ 601.967039][ T30] audit: type=1400 audit(1751877506.745:723): avc: denied { unmount } for pid=9686 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 602.014789][ T974] usbhid 7-1:0.0: can't add hid device: -71 [ 602.023937][ T974] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 602.059644][ T974] usb 7-1: USB disconnect, device number 21 [ 602.183938][ T30] audit: type=1400 audit(1751877506.975:724): avc: denied { accept } for pid=12553 comm="syz.9.1259" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 603.088095][T12574] overlayfs: failed to resolve './file1': -2 [ 603.383066][ T5947] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 603.692769][ T5947] usb 7-1: Using ep0 maxpacket: 8 [ 603.815989][ T5947] usb 7-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 603.921742][ T5947] usb 7-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 604.405013][ T5947] usb 7-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 604.426049][ T5947] usb 7-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 604.440679][T12593] netlink: 'syz.7.1268': attribute type 12 has an invalid length. [ 604.448684][T12593] netlink: 'syz.7.1268': attribute type 29 has an invalid length. [ 604.456503][T12593] netlink: 148 bytes leftover after parsing attributes in process `syz.7.1268'. [ 604.921365][ T5947] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.539707][ T5947] usb 7-1: string descriptor 0 read error: -71 [ 605.574862][ T5947] usb 7-1: USB disconnect, device number 22 [ 606.130178][T12607] kernel profiling enabled (shift: 7) [ 606.239703][T12608] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 606.266119][T12608] CIFS mount error: No usable UNC path provided in device string! [ 606.266119][T12608] [ 606.276663][T12608] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 606.688579][T12615] trusted_key: encrypted_key: keyword 'efault' not recognized [ 606.688901][T12613] vivid-001: disconnect [ 606.698761][ T30] audit: type=1400 audit(1751877511.485:725): avc: denied { wake_alarm } for pid=12614 comm="syz.6.1273" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 606.724090][T12612] vivid-001: reconnect [ 606.947223][ T30] audit: type=1326 audit(1751877511.735:726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12606 comm="syz.8.1271" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d6b38e929 code=0x7fc00000 [ 607.261170][ T5886] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 607.394496][T12634] overlayfs: failed to resolve './file1': -2 [ 607.402168][ T5893] usb 8-1: new full-speed USB device number 18 using dummy_hcd [ 607.662220][ T5886] usb 6-1: Using ep0 maxpacket: 32 [ 607.714737][ T5893] usb 8-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 607.928174][ T5886] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 607.967296][ T5893] usb 8-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 608.024129][ T5886] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 608.044264][ T5893] usb 8-1: config 0 interface 0 has no altsetting 0 [ 608.096670][ T5886] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 608.111002][ T5893] usb 8-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 608.147014][ T5886] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.164382][ T5893] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.214767][ T5886] usb 6-1: config 0 descriptor?? [ 608.225783][ T5893] usb 8-1: config 0 descriptor?? [ 608.719240][ T5893] hid-steam 0003:28DE:1102.0036: unknown main item tag 0x0 [ 608.733005][ T5893] hid-steam 0003:28DE:1102.0036: unknown main item tag 0x0 [ 608.747930][ T5893] hid-steam 0003:28DE:1102.0036: : USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.7-1/input0 [ 608.811731][ T5893] hid-steam 0003:28DE:1102.0036: Steam Controller 'XXXXXXXXXX' connected [ 608.872549][ T5893] input: Steam Controller as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:28DE:1102.0036/input/input58 [ 608.964400][T12659] netlink: 'syz.6.1281': attribute type 4 has an invalid length. [ 609.252026][ T5893] hid-steam 0003:28DE:1102.0037: unknown main item tag 0x0 [ 609.262922][ T5893] hid-steam 0003:28DE:1102.0037: unknown main item tag 0x0 [ 609.284789][ T5893] hid-steam 0003:28DE:1102.0037: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.7-1/input0 [ 609.316830][ T5886] usbhid 6-1:0.0: can't add hid device: -71 [ 609.325835][ T5886] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 609.363184][ T5841] lo speed is unknown, defaulting to 1000 [ 609.384276][ T5886] usb 6-1: USB disconnect, device number 23 [ 609.412828][ T5841] syz2: Port: 1 Link DOWN [ 609.515273][ T5841] usb 8-1: USB disconnect, device number 18 [ 609.577147][ T5841] hid-steam 0003:28DE:1102.0036: Steam Controller 'XXXXXXXXXX' disconnected [ 610.907002][ T30] audit: type=1400 audit(1751877515.685:727): avc: denied { relabelfrom } for pid=12672 comm="syz.9.1284" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 610.966242][T12673] netdevsim netdevsim9 netdevsim0: entered promiscuous mode [ 610.989665][ T30] audit: type=1400 audit(1751877515.735:728): avc: denied { relabelto } for pid=12672 comm="syz.9.1284" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 611.171166][ T92] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 611.341996][ T92] usb 7-1: Using ep0 maxpacket: 16 [ 611.393907][ T92] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 611.723962][ T92] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 611.759220][T12684] lo speed is unknown, defaulting to 1000 [ 611.775355][ T92] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 611.837266][T12684] lo speed is unknown, defaulting to 1000 [ 611.844992][ T92] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 611.879506][ T92] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.889345][ T92] usb 7-1: config 0 descriptor?? [ 612.412059][ T92] HID 045e:07da: Invalid code 65791 type 1 [ 612.568224][ T92] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.0038/input/input60 [ 612.680565][T12705] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1295'. [ 613.060951][T12691] overlayfs: failed to resolve './file0': -2 [ 613.071996][ T92] microsoft 0003:045E:07DA.0038: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 613.369960][ T92] usb 7-1: USB disconnect, device number 23 [ 613.425019][T12722] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1299'. [ 613.438515][T12721] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(5) [ 613.445105][T12721] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 613.455102][T12721] vhci_hcd vhci_hcd.0: Device attached [ 613.469145][T12726] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1298'. [ 613.752611][T12726] hsr_slave_1 (unregistering): left promiscuous mode [ 613.765330][ T30] audit: type=1400 audit(1751877518.555:729): avc: denied { append } for pid=12716 comm="syz.8.1297" name="event2" dev="devtmpfs" ino=922 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 613.831297][ T5841] usb 50-1: SetAddress Request (2) to port 0 [ 613.839052][ T5841] usb 50-1: new SuperSpeed USB device number 2 using vhci_hcd [ 613.865063][T12721] bridge0: port 1(bridge_slave_0) entered disabled state [ 613.886536][T12721] bridge0: port 2(bridge_slave_1) entered disabled state [ 614.139118][T12723] vhci_hcd: connection reset by peer [ 614.159660][ T3670] vhci_hcd: stop threads [ 614.168836][ T3670] vhci_hcd: release socket [ 614.183408][ T3670] vhci_hcd: disconnect device [ 614.635066][ T5893] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 614.792399][ T5893] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 614.802643][ T5893] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.826188][ T5893] usb 6-1: config 0 descriptor?? [ 614.843593][ T5893] cp210x 6-1:0.0: cp210x converter detected [ 615.391276][T12751] overlayfs: failed to resolve './file1': -2 [ 615.662061][ T5893] cp210x 6-1:0.0: failed to get vendor val 0x0010 size 3: -32 [ 615.709246][ T5893] usb 6-1: cp210x converter now attached to ttyUSB0 [ 616.329940][ T5893] usb 6-1: USB disconnect, device number 24 [ 616.430461][ T5893] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 616.492358][ T5893] cp210x 6-1:0.0: device disconnected [ 618.532780][T12795] Device name cannot be null; rc = [-22] [ 618.747393][T12795] overlayfs: overlapping lowerdir path [ 618.951649][ T5841] usb 50-1: device descriptor read/8, error -110 [ 619.855473][ T5841] usb usb50-port1: attempt power cycle [ 620.529184][T12792] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 620.601925][ T5841] usb usb50-port1: unable to enumerate USB device [ 620.650862][ T10] usb 8-1: new full-speed USB device number 19 using dummy_hcd [ 621.000567][T12810] overlay: filesystem on ./bus not supported as upperdir [ 621.901639][ T10] usb 8-1: device not accepting address 19, error -71 [ 622.849443][ T30] audit: type=1800 audit(1751877527.635:730): pid=12832 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.7.1326" name="SYSV798dd82f" dev="tmpfs" ino=0 res=0 errno=0 [ 622.871255][ T9781] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 623.091116][ T9781] usb 7-1: Using ep0 maxpacket: 32 [ 623.131108][ T9781] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 623.162707][ T9781] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 623.170969][T12836] netlink: 'syz.7.1327': attribute type 10 has an invalid length. [ 623.175176][ T9781] usb 7-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 623.193233][ T9781] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.231063][ T9781] usb 7-1: config 0 descriptor?? [ 623.845402][ T30] audit: type=1326 audit(1751877528.625:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 623.870718][ T30] audit: type=1326 audit(1751877528.625:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 623.894315][ T30] audit: type=1326 audit(1751877528.625:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 623.923070][ T30] audit: type=1326 audit(1751877528.625:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 623.947642][ T30] audit: type=1326 audit(1751877528.625:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 623.973395][ T30] audit: type=1326 audit(1751877528.625:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 623.997582][ T30] audit: type=1326 audit(1751877528.625:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 624.021606][ T30] audit: type=1326 audit(1751877528.625:738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 624.045451][ T30] audit: type=1326 audit(1751877528.625:739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12833 comm="syz.7.1327" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7fc00000 [ 624.064266][ T9781] usbhid 7-1:0.0: can't add hid device: -71 [ 624.079765][ T9781] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 624.104290][ T9781] usb 7-1: USB disconnect, device number 24 [ 624.688058][T12840] FAULT_INJECTION: forcing a failure. [ 624.688058][T12840] name failslab, interval 1, probability 0, space 0, times 0 [ 624.718466][T12840] CPU: 0 UID: 0 PID: 12840 Comm: syz.6.1328 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 624.718496][T12840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 624.718507][T12840] Call Trace: [ 624.718514][T12840] [ 624.718521][T12840] dump_stack_lvl+0x16c/0x1f0 [ 624.718557][T12840] should_fail_ex+0x512/0x640 [ 624.718578][T12840] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 624.718599][T12840] should_failslab+0xc2/0x120 [ 624.718617][T12840] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 624.718631][T12840] ? __alloc_skb+0x2b2/0x380 [ 624.718651][T12840] __alloc_skb+0x2b2/0x380 [ 624.718665][T12840] ? __pfx___alloc_skb+0x10/0x10 [ 624.718680][T12840] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 624.718712][T12840] netlink_alloc_large_skb+0x69/0x130 [ 624.718724][T12840] netlink_sendmsg+0x6a1/0xdd0 [ 624.718737][T12840] ? __pfx_netlink_sendmsg+0x10/0x10 [ 624.718752][T12840] ____sys_sendmsg+0xa95/0xc70 [ 624.718765][T12840] ? copy_msghdr_from_user+0x10a/0x160 [ 624.718779][T12840] ? __pfx_____sys_sendmsg+0x10/0x10 [ 624.718796][T12840] ___sys_sendmsg+0x134/0x1d0 [ 624.718811][T12840] ? __pfx____sys_sendmsg+0x10/0x10 [ 624.718824][T12840] ? __lock_acquire+0x622/0x1c90 [ 624.718854][T12840] __sys_sendmsg+0x16d/0x220 [ 624.718868][T12840] ? __pfx___sys_sendmsg+0x10/0x10 [ 624.718892][T12840] do_syscall_64+0xcd/0x4c0 [ 624.718910][T12840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.718928][T12840] RIP: 0033:0x7f29b178e929 [ 624.718939][T12840] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 624.718950][T12840] RSP: 002b:00007f29b25e9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 624.718962][T12840] RAX: ffffffffffffffda RBX: 00007f29b19b5fa0 RCX: 00007f29b178e929 [ 624.718969][T12840] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 624.718975][T12840] RBP: 00007f29b25e9090 R08: 0000000000000000 R09: 0000000000000000 [ 624.718981][T12840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 624.718987][T12840] R13: 0000000000000000 R14: 00007f29b19b5fa0 R15: 00007fffe6b5a028 [ 624.719001][T12840] [ 625.282791][ T1298] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 625.297725][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.308922][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 628.097610][T12836] team0: Device hsr_slave_0 failed to register rx_handler [ 628.481779][T12855] netlink: 212376 bytes leftover after parsing attributes in process `syz.5.1333'. [ 628.886842][T12857] overlayfs: failed to resolve './file1': -2 [ 629.031846][T12862] netlink: 212376 bytes leftover after parsing attributes in process `syz.7.1336'. [ 629.590871][ T5886] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 629.600887][ T30] kauditd_printk_skb: 47 callbacks suppressed [ 629.600905][ T30] audit: type=1326 audit(1751877534.385:787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 629.643082][ T30] audit: type=1326 audit(1751877534.385:788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 629.672472][ T30] audit: type=1326 audit(1751877534.385:789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 629.696320][ T5841] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 629.717725][ T30] audit: type=1326 audit(1751877534.385:790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 629.753272][ T30] audit: type=1326 audit(1751877534.385:791): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 629.778111][T12875] Option 'D' to dns_resolver key: bad/missing value [ 629.811715][ T30] audit: type=1326 audit(1751877534.385:792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 629.840983][ T5886] usb 10-1: Using ep0 maxpacket: 32 [ 629.858965][ T5886] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 629.859893][ T30] audit: type=1326 audit(1751877534.385:793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 629.897051][ T5841] usb 8-1: Using ep0 maxpacket: 16 [ 629.912547][ T5841] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 629.923951][ T5841] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 629.935011][ T5841] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 629.948641][ T5841] usb 8-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 629.969856][ T30] audit: type=1326 audit(1751877534.385:794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 630.003448][ T5886] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 630.006525][ T5841] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.027021][ T5886] usb 10-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 630.047237][ T5841] usb 8-1: config 0 descriptor?? [ 630.047868][ T5886] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.069527][ T30] audit: type=1326 audit(1751877534.385:795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 630.093814][ T5893] usb 6-1: new full-speed USB device number 25 using dummy_hcd [ 630.155694][ T5886] usb 10-1: config 0 descriptor?? [ 630.203021][ T30] audit: type=1326 audit(1751877534.385:796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12866 comm="syz.8.1338" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f3d6b38e929 code=0x7ffc0000 [ 630.345565][ T5893] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 630.356993][ T5893] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 630.387427][ T5893] usb 6-1: config 0 interface 0 has no altsetting 0 [ 630.417803][ T5893] usb 6-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 630.438173][ T5893] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.477765][ T5841] shield 0003:0955:7214.0039: unknown main item tag 0x0 [ 630.493982][ T5841] shield 0003:0955:7214.0039: unknown main item tag 0x0 [ 630.503260][ T5841] shield 0003:0955:7214.0039: unknown main item tag 0x0 [ 630.575557][ T5893] usb 6-1: config 0 descriptor?? [ 630.583490][ T5841] shield 0003:0955:7214.0039: unknown main item tag 0x0 [ 630.590471][ T5841] shield 0003:0955:7214.0039: unknown main item tag 0x0 [ 630.608177][ T5886] ft260 0003:0403:6030.003A: unknown main item tag 0x0 [ 630.620661][ T5841] input: HID 0955:7214 Haptics as /devices/virtual/input/input64 [ 630.705386][T12869] netlink: 'syz.7.1339': attribute type 2 has an invalid length. [ 630.726272][ T5841] shield 0003:0955:7214.0039: Registered Thunderstrike controller [ 630.756689][T12869] netlink: 244 bytes leftover after parsing attributes in process `syz.7.1339'. [ 630.771468][ T5841] shield 0003:0955:7214.0039: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.7-1/input0 [ 631.005957][ T5886] ft260 0003:0403:6030.003A: chip code: afb7 d7b4 [ 631.006576][ T92] shield 0003:0955:7214.0039: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 631.178856][ T5841] usb 8-1: USB disconnect, device number 21 [ 631.186920][ T92] shield 0003:0955:7214.0039: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 631.202240][ T92] shield 0003:0955:7214.0039: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 631.215143][ T5893] hid-steam 0003:28DE:1102.003B: unknown main item tag 0x0 [ 631.219077][ T92] shield 0003:0955:7214.0039: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 631.222800][ T5886] ft260 0003:0403:6030.003A: failed to retrieve system status [ 631.275479][ T5893] hid-steam 0003:28DE:1102.003B: unknown main item tag 0x0 [ 631.297625][ T5893] hid-steam 0003:28DE:1102.003B: : USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.5-1/input0 [ 631.310240][ T5886] ft260 0003:0403:6030.003A: probe with driver ft260 failed with error -71 [ 631.329519][ T5886] usb 10-1: USB disconnect, device number 24 [ 631.487387][ T5893] hid-steam 0003:28DE:1102.003B: Steam Controller 'XXXXXXXXXX' connected [ 631.775333][ T5893] input: Steam Controller as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:28DE:1102.003B/input/input65 [ 631.825863][ T5893] hid-steam 0003:28DE:1102.003C: unknown main item tag 0x0 [ 631.854629][ T5893] hid-steam 0003:28DE:1102.003C: unknown main item tag 0x0 [ 631.878957][ T5893] hid-steam 0003:28DE:1102.003C: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.5-1/input0 [ 632.231854][ T5893] usb 6-1: USB disconnect, device number 25 [ 632.279177][ T5893] hid-steam 0003:28DE:1102.003B: Steam Controller 'XXXXXXXXXX' disconnected [ 632.298427][T12892] fido_id[12892]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 632.644915][T12903] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 632.846179][T12906] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1348'. [ 633.891125][ T5886] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 634.193867][ T5886] usb 8-1: Using ep0 maxpacket: 32 [ 635.123064][ T5886] usb 8-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 635.270342][ T5886] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 635.288307][ T974] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 635.410984][ T5886] usb 8-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 635.459689][ T5886] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 635.506786][ T5886] usb 8-1: config 0 descriptor?? [ 635.506966][T12926] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 635.534031][ T5886] hub 8-1:0.0: bad descriptor, ignoring hub [ 635.544829][ T5886] hub 8-1:0.0: probe with driver hub failed with error -5 [ 635.575876][ T5886] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 636.103033][T12934] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 636.116202][T12934] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 636.605320][T12912] bridge2: entered promiscuous mode [ 636.635691][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 636.635702][ T30] audit: type=1326 audit(1751877541.415:803): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 636.698892][ T30] audit: type=1326 audit(1751877541.415:804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 636.851174][ T5893] usb 8-1: USB disconnect, device number 22 [ 637.784254][ T30] audit: type=1326 audit(1751877541.415:805): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 637.838015][ T30] audit: type=1326 audit(1751877541.415:806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 637.865463][ T30] audit: type=1326 audit(1751877541.415:807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 637.889606][ T30] audit: type=1326 audit(1751877541.415:808): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 637.913688][ T30] audit: type=1326 audit(1751877541.415:809): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 637.938600][ T30] audit: type=1326 audit(1751877541.415:810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 638.030847][ T30] audit: type=1326 audit(1751877541.415:811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 638.469831][ T30] audit: type=1326 audit(1751877541.415:812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12932 comm="syz.9.1354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 638.523430][T12950] 9pnet: Could not find request transport: 0xffffffffffffffff [ 638.670873][ T5893] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 639.303799][T12961] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1360'. [ 639.322256][ T5893] usb 6-1: Using ep0 maxpacket: 32 [ 639.329131][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 639.343893][ T5893] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 639.356153][T12964] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 639.378211][ T5893] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 639.804994][ T5893] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 639.883380][ T5893] usb 6-1: config 0 descriptor?? [ 639.990269][T12975] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 640.112983][T12977] netlink: 830 bytes leftover after parsing attributes in process `syz.6.1364'. [ 640.768383][ T5893] ft260 0003:0403:6030.003D: unknown main item tag 0x0 [ 640.881194][ T5893] ft260 0003:0403:6030.003D: chip code: afb7 d7b4 [ 641.070166][T12988] loop4: detected capacity change from 0 to 7 [ 641.080567][ T5893] ft260 0003:0403:6030.003D: failed to retrieve system status [ 641.100168][ T5893] ft260 0003:0403:6030.003D: probe with driver ft260 failed with error -71 [ 641.127903][T12988] Dev loop4: unable to read RDB block 7 [ 641.179046][T12988] loop4: unable to read partition table [ 641.186324][T12988] loop4: partition table beyond EOD, truncated [ 641.196484][T12988] loop_reread_partitions: partition scan of loop4 (被x ) failed (rc=-5) [ 641.215034][ T5893] usb 6-1: USB disconnect, device number 27 [ 641.275284][T12989] Dev loop4: unable to read RDB block 7 [ 641.323930][T12989] loop4: unable to read partition table [ 641.394342][T12989] loop4: partition table beyond EOD, truncated [ 642.451552][T13002] netlink: 212376 bytes leftover after parsing attributes in process `syz.9.1372'. [ 643.095717][T13011] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 643.574999][T13020] overlayfs: missing 'lowerdir' [ 645.600934][ T977] usb 10-1: new high-speed USB device number 25 using dummy_hcd [ 646.122353][ T977] usb 10-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 646.133900][ T977] usb 10-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 646.144825][ T977] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 646.160546][ T977] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 646.175531][ T977] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 646.188902][ T977] usb 10-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 646.207423][ T977] usb 10-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 646.268776][ T977] usb 10-1: Product: syz [ 646.278639][ T977] usb 10-1: Manufacturer: syz [ 646.298202][ T977] cdc_wdm 10-1:1.0: skipping garbage [ 646.307132][ T977] cdc_wdm 10-1:1.0: skipping garbage [ 646.324987][ T977] cdc_wdm 10-1:1.0: cdc-wdm0: USB WDM device [ 646.333440][T13040] macvtap0: entered allmulticast mode [ 646.333907][ T977] cdc_wdm 10-1:1.0: Unknown control protocol [ 646.338944][T13040] veth0_macvtap: entered allmulticast mode [ 646.513617][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 646.513633][ T30] audit: type=1400 audit(1751877551.295:825): avc: denied { read write } for pid=13027 comm="syz.9.1382" name="cdc-wdm0" dev="devtmpfs" ino=3712 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 646.552981][ T977] usb 10-1: USB disconnect, device number 25 [ 646.563776][ T30] audit: type=1400 audit(1751877551.295:826): avc: denied { open } for pid=13027 comm="syz.9.1382" path="/dev/cdc-wdm0" dev="devtmpfs" ino=3712 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:modem_device_t tclass=chr_file permissive=1 [ 646.681319][ T9781] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 646.851076][ T9781] usb 8-1: Using ep0 maxpacket: 16 [ 646.900480][ T9781] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 646.917735][ T9781] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 646.933014][ T9781] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 646.949667][ T9781] usb 8-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 646.964132][ T9781] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.026063][ T9781] usb 8-1: config 0 descriptor?? [ 647.482376][T13061] netlink: 212376 bytes leftover after parsing attributes in process `syz.9.1389'. [ 647.643507][ T9781] shield 0003:0955:7214.003E: unknown main item tag 0x0 [ 647.675287][ T9781] shield 0003:0955:7214.003E: unknown main item tag 0x0 [ 647.713279][ T9781] shield 0003:0955:7214.003E: unknown main item tag 0x0 [ 647.738519][ T9781] shield 0003:0955:7214.003E: unknown main item tag 0x0 [ 647.748091][ T5846] Bluetooth: hci4: unexpected event for opcode 0x0413 [ 647.768387][ T9781] shield 0003:0955:7214.003E: unknown main item tag 0x0 [ 647.777136][ T9781] input: HID 0955:7214 Haptics as /devices/virtual/input/input67 [ 647.868229][ T9781] shield 0003:0955:7214.003E: Registered Thunderstrike controller [ 647.877286][ T9781] shield 0003:0955:7214.003E: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.7-1/input0 [ 647.942135][ T92] shield 0003:0955:7214.003E: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 648.164170][ T92] shield 0003:0955:7214.003E: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 648.196579][ T9781] usb 8-1: USB disconnect, device number 23 [ 648.220276][ T92] shield 0003:0955:7214.003E: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 648.291863][ T92] shield 0003:0955:7214.003E: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 648.695300][ T30] audit: type=1400 audit(1751877553.285:827): avc: denied { create } for pid=13071 comm="syz.5.1392" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 649.360842][ T92] usb 10-1: new full-speed USB device number 26 using dummy_hcd [ 649.380884][ T30] audit: type=1400 audit(1751877554.165:828): avc: denied { unlink } for pid=9676 comm="syz-executor" name="file0" dev="tmpfs" ino=615 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 649.534726][ T92] usb 10-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 649.551090][ T92] usb 10-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 649.583117][ T92] usb 10-1: config 0 interface 0 has no altsetting 0 [ 649.591717][ T92] usb 10-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 649.645085][ T92] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.688792][ T92] usb 10-1: config 0 descriptor?? [ 649.721316][ T977] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 649.751075][ T9781] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 649.871060][ T977] usb 6-1: Using ep0 maxpacket: 32 [ 649.910411][ T977] usb 6-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 649.930995][ T977] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 649.947497][ T977] usb 6-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 649.963455][ T9781] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 649.967279][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.987820][ T9781] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 650.006588][ T9781] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 650.018820][ T9781] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 650.053085][ T9781] usb 8-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 650.063323][ T9781] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.135417][ T92] hid-steam 0003:28DE:1102.003F: unknown main item tag 0x0 [ 650.145756][ T977] usb 6-1: config 0 descriptor?? [ 650.157923][ T92] hid-steam 0003:28DE:1102.003F: unknown main item tag 0x0 [ 650.166564][ T9781] usb 8-1: config 0 descriptor?? [ 650.179782][ T92] hid-steam 0003:28DE:1102.003F: : USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.9-1/input0 [ 650.180271][ T977] hub 6-1:0.0: bad descriptor, ignoring hub [ 650.238585][ T977] hub 6-1:0.0: probe with driver hub failed with error -5 [ 650.253700][ T977] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 650.260994][ T92] hid-steam 0003:28DE:1102.003F: Steam Controller 'XXXXXXXXXX' connected [ 650.757026][ T92] input: Steam Controller as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/0003:28DE:1102.003F/input/input68 [ 650.800936][T13089] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 650.830298][ T92] hid-steam 0003:28DE:1102.0040: unknown main item tag 0x0 [ 650.831163][T13089] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.851062][ T92] hid-steam 0003:28DE:1102.0040: unknown main item tag 0x0 [ 650.923236][ T92] hid-steam 0003:28DE:1102.0040: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.9-1/input0 [ 650.985015][ T92] usb 10-1: USB disconnect, device number 26 [ 651.087647][T13098] fido_id[13098]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.9/usb10/10-1/report_descriptor': No such file or directory [ 651.103434][ T9781] plantronics 0003:047F:FFFF.0041: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.7-1/input0 [ 651.159690][ T92] hid-steam 0003:28DE:1102.003F: Steam Controller 'XXXXXXXXXX' disconnected [ 651.342932][ T1138] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.524236][ T30] audit: type=1400 audit(1751877556.265:829): avc: denied { read } for pid=13099 comm="syz.6.1399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 651.844999][ T5846] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 651.854190][ T5846] Bluetooth: hci4: Injecting HCI hardware error event [ 651.883236][ T5846] Bluetooth: hci4: hardware error 0x00 [ 652.028711][T13089] bridge1: entered promiscuous mode [ 652.200866][T13106] can0: slcan on ttyS3. [ 652.279430][ T92] usb 6-1: USB disconnect, device number 28 [ 652.675262][ T1138] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.134881][ T1138] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.267093][ T51] Bluetooth: hci5: unexpected event for opcode 0x0413 [ 653.276845][T13116] netlink: 212376 bytes leftover after parsing attributes in process `syz.9.1402'. [ 653.326149][ T1138] bridge0: port 3(netdevsim0) entered disabled state [ 653.680596][ T1138] netdevsim netdevsim2 netdevsim0 (unregistering): left allmulticast mode [ 653.702299][ T1138] netdevsim netdevsim2 netdevsim0 (unregistering): left promiscuous mode [ 653.725791][ T1138] bridge0: port 3(netdevsim0) entered disabled state [ 653.799117][ T1138] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 653.803304][ T5893] usb 8-1: USB disconnect, device number 24 [ 653.911361][ T977] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 654.071405][ T5841] usb 10-1: new high-speed USB device number 27 using dummy_hcd [ 654.084245][T13123] can0 (unregistered): slcan off ttyS3. [ 654.133727][ T977] usb 6-1: Using ep0 maxpacket: 32 [ 654.401347][ T5846] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 654.597827][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 654.667001][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 654.696339][ T977] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 654.750998][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 654.791344][T13143] FAULT_INJECTION: forcing a failure. [ 654.791344][T13143] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 654.810352][ T5841] usb 10-1: Using ep0 maxpacket: 16 [ 654.822082][ T977] usb 6-1: config 0 descriptor?? [ 654.835213][ T5841] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 654.858272][ T5841] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 654.868699][ T1138] bridge_slave_1: left allmulticast mode [ 654.874881][ T5841] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 654.890977][ T1138] bridge_slave_1: left promiscuous mode [ 654.898809][T13143] CPU: 1 UID: 0 PID: 13143 Comm: syz.7.1407 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 654.898835][T13143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 654.898846][T13143] Call Trace: [ 654.898854][T13143] [ 654.898862][T13143] dump_stack_lvl+0x16c/0x1f0 [ 654.898898][T13143] should_fail_ex+0x512/0x640 [ 654.898928][T13143] _copy_from_user+0x2e/0xd0 [ 654.898958][T13143] kstrtouint_from_user+0xd6/0x1d0 [ 654.898977][T13143] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 654.898996][T13143] ? __lock_acquire+0xb8a/0x1c90 [ 654.899027][T13143] proc_fail_nth_write+0x83/0x250 [ 654.899054][T13143] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 654.899083][T13143] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 654.899108][T13143] vfs_write+0x2a0/0x1150 [ 654.899136][T13143] ? __pfx___mutex_lock+0x10/0x10 [ 654.899163][T13143] ? __pfx_vfs_write+0x10/0x10 [ 654.899193][T13143] ? __fget_files+0x20e/0x3c0 [ 654.899225][T13143] ksys_write+0x12a/0x250 [ 654.899247][T13143] ? __pfx_ksys_write+0x10/0x10 [ 654.899278][T13143] do_syscall_64+0xcd/0x4c0 [ 654.899306][T13143] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.899325][T13143] RIP: 0033:0x7fbef3d8d3df [ 654.899341][T13143] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 654.899359][T13143] RSP: 002b:00007fbef4c7e030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 654.899378][T13143] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbef3d8d3df [ 654.899390][T13143] RDX: 0000000000000001 RSI: 00007fbef4c7e0a0 RDI: 0000000000000003 [ 654.899401][T13143] RBP: 00007fbef4c7e090 R08: 0000000000000000 R09: 0000000000000000 [ 654.899412][T13143] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 654.899422][T13143] R13: 0000000000000001 R14: 00007fbef3fb6080 R15: 00007ffedf8f7408 [ 654.899448][T13143] [ 655.098183][ T1138] bridge0: port 2(bridge_slave_1) entered disabled state [ 655.100195][ T5841] usb 10-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 655.114877][ T5841] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.230208][ T5841] usb 10-1: config 0 descriptor?? [ 655.531733][ T1138] bridge_slave_0: left allmulticast mode [ 655.537437][ T1138] bridge_slave_0: left promiscuous mode [ 655.551404][ T1138] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.602285][ T977] ft260 0003:0403:6030.0042: unknown main item tag 0x0 [ 655.674029][ T977] ft260 0003:0403:6030.0042: chip code: afb7 d7b4 [ 655.909548][ T977] ft260 0003:0403:6030.0042: failed to retrieve system status [ 656.047794][ T5841] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 656.049009][ T977] ft260 0003:0403:6030.0042: probe with driver ft260 failed with error -71 [ 656.058065][ T5841] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 656.093953][ T5841] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 656.157132][ T977] usb 6-1: USB disconnect, device number 29 [ 656.572126][ T5841] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 656.601289][ T5841] shield 0003:0955:7214.0043: unknown main item tag 0x0 [ 656.628190][ T5841] input: HID 0955:7214 Haptics as /devices/virtual/input/input70 [ 656.676439][ T5841] shield 0003:0955:7214.0043: Registered Thunderstrike controller [ 656.711936][ T5841] shield 0003:0955:7214.0043: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.9-1/input0 [ 656.795087][ T92] shield 0003:0955:7214.0043: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 656.808148][ T5841] usb 10-1: USB disconnect, device number 27 [ 656.814299][ T92] shield 0003:0955:7214.0043: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 656.827790][ T92] shield 0003:0955:7214.0043: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 656.871264][ T92] shield 0003:0955:7214.0043: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 656.987396][T13172] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 657.018146][T13172] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 657.341842][ T5846] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 657.376068][ T5846] Bluetooth: hci5: Injecting HCI hardware error event [ 657.394873][ T51] Bluetooth: hci5: hardware error 0x00 [ 658.510320][ T1138] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 658.537313][ T1138] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 658.596088][ T1138] bond0 (unregistering): Released all slaves [ 658.622237][T13145] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 658.631265][T13145] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 658.639924][T13145] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 658.648616][T13145] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 658.861446][T13194] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 659.500923][ T51] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 660.850899][ T30] audit: type=1400 audit(1751877565.635:830): avc: denied { accept } for pid=13220 comm="syz.6.1421" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 661.114666][ T1138] hsr_slave_0: left promiscuous mode [ 661.140951][ T1138] hsr_slave_1: left promiscuous mode [ 661.146981][ T1138] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 661.239387][T13236] CIFS mount error: No usable UNC path provided in device string! [ 661.239387][T13236] [ 661.249794][T13236] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 661.614296][ T1138] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 661.725045][ T1138] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 662.156281][ T1138] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 662.159382][T13244] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 662.273070][ T1138] veth1_macvtap: left promiscuous mode [ 662.294062][ T1138] veth0_macvtap: left promiscuous mode [ 662.303408][ T1138] veth1_vlan: left promiscuous mode [ 662.310189][ T1138] veth0_vlan: left promiscuous mode [ 662.610818][ T5841] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 662.781729][ T5841] usb 8-1: Using ep0 maxpacket: 16 [ 662.819423][ T5841] usb 8-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 662.834974][ T5841] usb 8-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 662.862591][ T5841] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 662.886497][ T5841] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 662.900447][ T5841] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.917609][ T5841] usb 8-1: Product: syz [ 662.928139][ T5841] usb 8-1: Manufacturer: syz [ 662.940645][ T5841] usb 8-1: SerialNumber: syz [ 663.664867][ T30] audit: type=1400 audit(1751877568.115:831): avc: denied { accept } for pid=13254 comm="syz.5.1428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 663.704669][ T5841] usb 8-1: 0:2 : does not exist [ 663.740937][ T5841] usb 8-1: USB disconnect, device number 25 [ 663.800257][ T9688] udevd[9688]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 664.695165][T13271] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 665.550247][T13275] syz.5.1433 (13275): /proc/13274/oom_adj is deprecated, please use /proc/13274/oom_score_adj instead. [ 666.148013][T13290] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 666.159800][ T5943] IPVS: starting estimator thread 0... [ 666.239868][ T1138] team0 (unregistering): Port device team_slave_1 removed [ 666.271026][T13292] IPVS: using max 41 ests per chain, 98400 per kthread [ 666.328510][ T1138] team0 (unregistering): Port device team_slave_0 removed [ 666.843977][ T9781] lo speed is unknown, defaulting to 1000 [ 666.861706][ T9781] syz0: Port: 1 Link DOWN [ 666.878731][T13287] syz_tun: entered allmulticast mode [ 666.926090][T13287] syz_tun: left allmulticast mode [ 667.276124][T13308] overlay: filesystem on ./bus not supported as upperdir [ 667.862158][ T977] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 668.260948][ T977] usb 8-1: Using ep0 maxpacket: 16 [ 668.300197][ T977] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 668.360014][ T977] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 668.422601][ T977] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 668.494271][T13320] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 668.500129][ T977] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 668.534034][ T977] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.538797][T13323] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 668.626006][ T977] usb 8-1: config 0 descriptor?? [ 668.947133][T13337] ptrace attach of "./syz-executor exec"[9686] was attempted by "./syz-executor exec"[13337] [ 669.195459][ T977] HID 045e:07da: Invalid code 65791 type 1 [ 669.378826][ T977] input: HID 045e:07da as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/0003:045E:07DA.0044/input/input73 [ 669.603273][ T977] microsoft 0003:045E:07DA.0044: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.7-1/input0 [ 669.684559][ T977] usb 8-1: USB disconnect, device number 26 [ 670.001264][T13343] fido_id[13343]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.7/usb8/report_descriptor': No such file or directory [ 670.411469][ T977] usb 10-1: new high-speed USB device number 28 using dummy_hcd [ 670.626676][ T977] usb 10-1: Using ep0 maxpacket: 16 [ 670.640670][ T977] usb 10-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 670.659511][T13365] overlayfs: failed to resolve './file1': -2 [ 670.672372][ T977] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.729408][ T30] audit: type=1326 audit(1751877575.495:832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 670.753788][ T977] usb 10-1: Product: syz [ 670.755695][ T30] audit: type=1326 audit(1751877575.495:833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 670.789064][ T30] audit: type=1326 audit(1751877575.495:834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 670.820895][ T30] audit: type=1326 audit(1751877575.495:835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 670.847401][ T30] audit: type=1326 audit(1751877575.495:836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 670.870845][ C1] vkms_vblank_simulate: vblank timer overrun [ 670.880319][ T30] audit: type=1326 audit(1751877575.495:837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 670.880392][ T977] usb 10-1: Manufacturer: syz [ 670.903920][ C1] vkms_vblank_simulate: vblank timer overrun [ 670.929494][ T30] audit: type=1326 audit(1751877575.495:838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 670.963659][ T30] audit: type=1326 audit(1751877575.495:839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 670.990468][ T30] audit: type=1326 audit(1751877575.495:840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 671.260945][ T30] audit: type=1326 audit(1751877575.495:841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13352 comm="syz.7.1449" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 671.287400][ T977] usb 10-1: SerialNumber: syz [ 671.295134][ T977] usb 10-1: config 0 descriptor?? [ 671.309125][ T977] as10x_usb: device has been detected [ 671.318034][ T977] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 671.441321][ T977] usb 10-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 671.487057][ T977] as10x_usb: error during firmware upload part1 [ 671.514390][ T977] Registered device Sky IT Digital Key (green led) [ 671.534312][ T977] usb 10-1: USB disconnect, device number 28 [ 671.650608][ T977] Unregistered device Sky IT Digital Key (green led) [ 671.659509][ T977] as10x_usb: device has been disconnected [ 671.720893][ T9781] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 671.890870][ T9781] usb 7-1: Using ep0 maxpacket: 8 [ 671.911226][ T9781] usb 7-1: unable to get BOS descriptor or descriptor too short [ 671.941250][ T9781] usb 7-1: config 7 has an invalid interface number: 190 but max is 0 [ 671.958689][ T9781] usb 7-1: config 7 has no interface number 0 [ 671.979336][ T9781] usb 7-1: config 7 interface 190 has no altsetting 0 [ 672.013896][ T9781] usb 7-1: New USB device found, idVendor=12d1, idProduct=a827, bcdDevice=fe.73 [ 672.029043][ T9781] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.058395][ T9781] usb 7-1: Product: ᰊ [ 672.068841][ T9781] usb 7-1: Manufacturer: Е [ 672.089003][ T9781] usb 7-1: SerialNumber: с [ 672.610378][T13373] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 672.694805][T13389] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1453'. [ 672.695338][T13373] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.082679][ T9781] qmi_wwan 7-1:7.190: bogus CDC Union: master=0, slave=1 [ 673.097015][ T9781] qmi_wwan 7-1:7.190: probe with driver qmi_wwan failed with error -22 [ 673.141144][ T9781] usb 7-1: USB disconnect, device number 25 [ 673.444711][T13402] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 673.491016][ T5893] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 673.664531][ T5893] usb 8-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 673.678858][ T5893] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 673.690926][ T9781] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 673.750010][T13408] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 673.847183][ T5893] usb 8-1: config 0 descriptor?? [ 673.878662][T13372] Process accounting resumed [ 673.891252][ T9781] usb 6-1: Using ep0 maxpacket: 32 [ 673.938332][ T9781] usb 6-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8 [ 674.004217][ T9781] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 674.109693][ T9781] usb 6-1: Product: syz [ 674.123952][ T9781] usb 6-1: Manufacturer: syz [ 674.207653][ T9781] usb 6-1: SerialNumber: syz [ 674.219880][ T9781] empeg 6-1:1.0: empeg converter detected [ 674.266467][ T977] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 674.372850][ T5893] hackrf 8-1:0.0: Board ID: 00 [ 674.377759][ T5893] hackrf 8-1:0.0: Firmware version: [ 674.427643][ T9781] usb 6-1: empeg converter now attached to ttyUSB0 [ 674.440917][ T977] usb 7-1: Using ep0 maxpacket: 16 [ 674.492678][ T977] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 674.570314][ T5893] hackrf 8-1:0.0: Registered as swradio24 [ 674.650650][ T5893] videodev: could not get a free minor [ 674.656960][ T977] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 674.690841][ T5893] hackrf 8-1:0.0: Failed to register as video device (-23) [ 674.854121][ T977] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 675.230883][ T977] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 675.240066][ T977] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.249177][ T5893] hackrf 8-1:0.0: probe with driver hackrf failed with error -23 [ 675.264359][ T5893] usb 8-1: USB disconnect, device number 27 [ 675.280383][ T977] usb 7-1: config 0 descriptor?? [ 675.704786][ T977] HID 045e:07da: Invalid code 65791 type 1 [ 675.750710][ T977] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.0045/input/input74 [ 675.801931][ T977] microsoft 0003:045E:07DA.0045: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 675.881622][T13441] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1461'. [ 675.917725][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 675.917747][ T30] audit: type=1400 audit(1751877580.705:849): avc: denied { rename } for pid=13428 comm="syz.7.1460" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 675.988034][ T977] usb 7-1: USB disconnect, device number 26 [ 676.172443][T13436] overlayfs: statfs failed on './file0' [ 676.366096][T13439] fido_id[13439]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 676.511628][ T5943] usb 6-1: USB disconnect, device number 30 [ 676.630963][ T5943] empeg ttyUSB0: empeg converter now disconnected from ttyUSB0 [ 676.639458][ T5943] empeg 6-1:1.0: device disconnected [ 676.657382][ T30] audit: type=1326 audit(1751877581.425:850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 677.222887][ T30] audit: type=1326 audit(1751877581.425:851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 677.361379][T13463] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1465'. [ 677.704783][ T30] audit: type=1326 audit(1751877581.425:852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 677.760571][ T30] audit: type=1326 audit(1751877581.425:853): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 677.919429][ T30] audit: type=1326 audit(1751877581.425:854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 678.204343][ T30] audit: type=1326 audit(1751877581.425:855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 679.214975][ T30] audit: type=1326 audit(1751877581.425:856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 679.428065][ T30] audit: type=1326 audit(1751877581.445:857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 679.486944][ T30] audit: type=1326 audit(1751877581.445:858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13443 comm="syz.9.1462" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 679.720269][T13487] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 680.000970][ T5893] usb 7-1: new full-speed USB device number 27 using dummy_hcd [ 680.448636][ T5893] usb 7-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 680.482167][T13501] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5153 sclass=netlink_route_socket pid=13501 comm=syz.5.1472 [ 680.537306][ T5893] usb 7-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 680.604777][ T5893] usb 7-1: config 0 interface 0 has no altsetting 0 [ 680.607604][T13501] binder: 13500:13501 ioctl c0306201 200000002800 returned -11 [ 680.620949][ T5893] usb 7-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 680.641055][ T5893] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 680.667849][ T5893] usb 7-1: config 0 descriptor?? [ 680.674828][T13501] binder: 13500:13501 ioctl c0306201 200000000540 returned -22 [ 681.030884][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 681.030898][ T30] audit: type=1400 audit(1751877585.805:869): avc: denied { setopt } for pid=13509 comm="syz.5.1474" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 681.120875][ T5893] hid-steam 0003:28DE:1102.0046: unknown main item tag 0x0 [ 681.138936][ T5893] hid-steam 0003:28DE:1102.0046: unknown main item tag 0x0 [ 681.154888][ T5893] hid-steam 0003:28DE:1102.0046: : USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.6-1/input0 [ 681.222165][ T5893] hid-steam 0003:28DE:1102.0046: Steam Controller 'XXXXXXXXXX' connected [ 681.284151][ T5893] input: Steam Controller as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:28DE:1102.0046/input/input76 [ 681.352602][ T977] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 681.371823][ T5893] hid-steam 0003:28DE:1102.0047: unknown main item tag 0x0 [ 681.424314][ T5893] hid-steam 0003:28DE:1102.0047: unknown main item tag 0x0 [ 681.478284][ T5893] hid-steam 0003:28DE:1102.0047: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.6-1/input0 [ 681.512280][ T977] usb 6-1: Using ep0 maxpacket: 16 [ 681.524944][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 681.558211][ T5893] usb 7-1: USB disconnect, device number 27 [ 681.576660][ T977] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 681.639228][ T977] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 681.676307][ T977] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 681.704102][ T977] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 681.753340][T13520] fido_id[13520]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/7-1/report_descriptor': No such file or directory [ 681.805024][ T977] usb 6-1: config 0 descriptor?? [ 682.368485][ T977] HID 045e:07da: Invalid code 65791 type 1 [ 682.442015][ T5893] hid-steam 0003:28DE:1102.0046: Steam Controller 'XXXXXXXXXX' disconnected [ 682.456488][ T977] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0048/input/input77 [ 682.590289][ T977] microsoft 0003:045E:07DA.0048: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 682.689329][ T977] usb 6-1: USB disconnect, device number 31 [ 682.979954][T13531] fido_id[13531]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/6-1/report_descriptor': No such file or directory [ 683.059926][T13541] netlink: 'syz.6.1479': attribute type 21 has an invalid length. [ 683.068155][T13541] netlink: 128 bytes leftover after parsing attributes in process `syz.6.1479'. [ 683.077591][T13541] netlink: 'syz.6.1479': attribute type 4 has an invalid length. [ 683.085374][T13541] netlink: 3 bytes leftover after parsing attributes in process `syz.6.1479'. [ 683.107626][T13541] hfsplus: unable to find HFS+ superblock [ 683.121919][ T30] audit: type=1400 audit(1751877587.845:870): avc: denied { getopt } for pid=13533 comm="syz.6.1479" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 683.855778][T13552] overlayfs: failed to resolve './file1': -2 [ 683.889463][T13550] CIFS mount error: No usable UNC path provided in device string! [ 683.889463][T13550] [ 683.899635][T13550] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 684.031421][T13555] CIFS mount error: No usable UNC path provided in device string! [ 684.031421][T13555] [ 684.041511][T13555] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 685.037235][ T30] audit: type=1326 audit(1751877589.805:871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 685.120829][ T30] audit: type=1326 audit(1751877589.805:872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 685.348919][ T30] audit: type=1326 audit(1751877589.805:873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 685.390149][ T977] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 685.548342][ T30] audit: type=1326 audit(1751877589.805:874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 685.645327][ T977] usb 6-1: Using ep0 maxpacket: 16 [ 685.719004][ T977] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 685.739656][ T977] usb 6-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 685.751590][ T5943] usb 10-1: new full-speed USB device number 29 using dummy_hcd [ 685.754305][ T30] audit: type=1326 audit(1751877589.805:875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 685.886358][ T977] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 685.895849][ T30] audit: type=1326 audit(1751877589.805:876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 685.937905][ T977] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 685.953034][ T5943] usb 10-1: unable to get BOS descriptor or descriptor too short [ 685.954270][ T977] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 685.971612][ T30] audit: type=1326 audit(1751877589.805:877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 685.981526][ T5943] usb 10-1: not running at top speed; connect to a high speed hub [ 686.030129][ T977] usb 6-1: Product: syz [ 686.045222][ T977] usb 6-1: Manufacturer: syz [ 686.060251][ T977] usb 6-1: SerialNumber: syz [ 686.070576][ T30] audit: type=1326 audit(1751877589.805:878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 686.730084][ T1298] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 686.957755][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 687.128513][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.157804][ T30] audit: type=1326 audit(1751877589.805:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 687.161033][ T5943] usb 10-1: config 8 has an invalid interface number: 24 but max is 0 [ 687.181526][ T30] audit: type=1326 audit(1751877589.805:880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 687.213474][ T30] audit: type=1326 audit(1751877589.805:881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 687.247425][ T30] audit: type=1326 audit(1751877589.805:882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 687.306470][ T5943] usb 10-1: config 8 has no interface number 0 [ 687.316804][ T5943] usb 10-1: config 8 interface 24 altsetting 2 endpoint 0xE has invalid maxpacket 1535, setting to 64 [ 687.364141][ T5943] usb 10-1: config 8 interface 24 has no altsetting 0 [ 687.382016][ T5943] usb 10-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=75.af [ 687.393993][ T5943] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 687.409073][ T5943] usb 10-1: Product: syz [ 687.416425][ T5943] usb 10-1: Manufacturer: syz [ 687.425977][ T5943] usb 10-1: SerialNumber: syz [ 687.444196][T13575] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 687.514617][ T977] usb 6-1: 0:2 : does not exist [ 687.533239][ T30] audit: type=1326 audit(1751877589.805:883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 687.606446][ T977] usb 6-1: USB disconnect, device number 32 [ 687.654881][ T30] audit: type=1326 audit(1751877589.805:884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=295 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 687.701383][ T9688] udevd[9688]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 687.731114][T13593] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 687.752298][T13593] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 687.776079][ T30] audit: type=1326 audit(1751877589.805:885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 687.846354][ T30] audit: type=1326 audit(1751877589.805:886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13556 comm="syz.7.1482" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbef3d8e929 code=0x7ffc0000 [ 689.454351][ T5943] comedi comedi5: driver 'vmk80xx' has successfully auto-configured 'K8055 (VM110)'. [ 689.521002][ T9781] usb 6-1: new full-speed USB device number 33 using dummy_hcd [ 689.544690][ T5943] usb 10-1: USB disconnect, device number 29 [ 689.728886][ T9781] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 689.827097][T13626] CIFS mount error: No usable UNC path provided in device string! [ 689.827097][T13626] [ 689.837386][T13626] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 690.030448][ T9781] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 690.183127][ T9781] usb 6-1: config 0 interface 0 has no altsetting 0 [ 690.201350][ T9781] usb 6-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 690.218918][ T9781] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.295001][ T30] audit: type=1400 audit(1751877595.085:887): avc: denied { listen } for pid=13623 comm="syz.9.1494" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 690.401849][ T9781] usb 6-1: config 0 descriptor?? [ 690.453208][T13624] fuse: Unknown parameter 'uroup_id' [ 690.853029][T13636] overlayfs: failed to resolve './file1': -2 [ 690.974323][ T9781] hid-steam 0003:28DE:1102.0049: unknown main item tag 0x0 [ 691.040848][ T9781] hid-steam 0003:28DE:1102.0049: unknown main item tag 0x0 [ 691.069939][T13640] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 691.078887][ T9781] hid-steam 0003:28DE:1102.0049: : USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.5-1/input0 [ 691.209962][ T9781] hid-steam 0003:28DE:1102.0049: Steam Controller 'XXXXXXXXXX' connected [ 691.250081][ T9781] input: Steam Controller as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:28DE:1102.0049/input/input78 [ 691.401838][ T9781] hid-steam 0003:28DE:1102.004A: unknown main item tag 0x0 [ 691.409112][ T9781] hid-steam 0003:28DE:1102.004A: unknown main item tag 0x0 [ 691.536303][ T9781] hid-steam 0003:28DE:1102.004A: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.5-1/input0 [ 691.716552][ T9781] usb 6-1: USB disconnect, device number 33 [ 691.857877][ T9781] hid-steam 0003:28DE:1102.0049: Steam Controller 'XXXXXXXXXX' disconnected [ 691.978035][T13647] fido_id[13647]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 692.026162][T13638] vivid-002: disconnect [ 692.192361][T13632] vivid-002: reconnect [ 692.391705][T13656] openvswitch: netlink: nsh attribute has 8 unknown bytes. [ 692.820879][ T5893] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 692.893892][ T30] audit: type=1326 audit(1751877597.655:888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 692.929885][ T30] audit: type=1326 audit(1751877597.655:889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 693.144853][ T5893] usb 8-1: Using ep0 maxpacket: 16 [ 693.165142][ T5893] usb 8-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 693.261802][ T92] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 693.580986][ T5893] usb 8-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 693.594299][ T5893] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 693.600970][ T30] audit: type=1326 audit(1751877597.655:890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 693.636605][ T5893] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 693.645885][ T30] audit: type=1326 audit(1751877597.655:891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 693.669302][ T5893] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 693.669334][ T5893] usb 8-1: Product: syz [ 693.669352][ T5893] usb 8-1: Manufacturer: syz [ 693.669368][ T5893] usb 8-1: SerialNumber: syz [ 693.836526][T13678] netlink: 212376 bytes leftover after parsing attributes in process `syz.8.1505'. [ 693.904442][ T30] audit: type=1326 audit(1751877597.655:892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 694.030805][ T92] usb 6-1: Using ep0 maxpacket: 16 [ 694.075201][ T92] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 694.093010][ T30] audit: type=1326 audit(1751877597.665:893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 694.116664][ T92] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 694.131146][ T92] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 694.162682][ T5893] usb 8-1: 0:2 : does not exist [ 694.173290][ T92] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 694.183478][ T30] audit: type=1326 audit(1751877597.665:894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 694.207140][ T92] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 694.218392][ T30] audit: type=1326 audit(1751877597.665:895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 694.222525][ T5893] usb 8-1: USB disconnect, device number 28 [ 694.273230][ T92] usb 6-1: config 0 descriptor?? [ 694.379204][ T30] audit: type=1326 audit(1751877597.665:896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=32 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 694.465432][ T30] audit: type=1326 audit(1751877597.665:897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13657 comm="syz.9.1500" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb5e398e929 code=0x7ffc0000 [ 694.581539][T13682] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 694.709700][ T92] HID 045e:07da: Invalid code 65791 type 1 [ 694.731917][ T92] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.004B/input/input79 [ 694.796676][ T92] microsoft 0003:045E:07DA.004B: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 695.016532][ T92] usb 6-1: USB disconnect, device number 34 [ 695.304986][T13688] fido_id[13688]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 695.514970][T13693] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1510'. [ 698.604146][ T10] usb 10-1: new high-speed USB device number 30 using dummy_hcd [ 698.834122][ T10] usb 10-1: Using ep0 maxpacket: 16 [ 698.852790][ T10] usb 10-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 698.875716][ T10] usb 10-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 698.897204][ T10] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 698.923206][ T10] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 698.976025][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 699.030810][ T10] usb 10-1: Product: syz [ 699.053086][ T10] usb 10-1: Manufacturer: syz [ 699.062428][ T10] usb 10-1: SerialNumber: syz [ 699.230959][ T5943] usb 8-1: new high-speed USB device number 29 using dummy_hcd [ 700.245527][ T10] usb 10-1: 0:2 : does not exist [ 700.263117][ T10] usb 10-1: USB disconnect, device number 30 [ 700.341070][ T5943] usb 8-1: Using ep0 maxpacket: 16 [ 700.362368][ T5943] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 700.400392][ T9688] udevd[9688]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 700.403670][ T5943] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 700.507517][ T5943] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 700.546494][ T5943] usb 8-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 700.580260][T13777] FAULT_INJECTION: forcing a failure. [ 700.580260][T13777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 700.586889][ T5943] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 700.596175][T13777] CPU: 0 UID: 0 PID: 13777 Comm: syz.9.1529 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 700.596199][T13777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 700.596209][T13777] Call Trace: [ 700.596216][T13777] [ 700.596223][T13777] dump_stack_lvl+0x16c/0x1f0 [ 700.596261][T13777] should_fail_ex+0x512/0x640 [ 700.596289][T13777] _copy_to_user+0x32/0xd0 [ 700.596314][T13777] simple_read_from_buffer+0xcb/0x170 [ 700.596340][T13777] proc_fail_nth_read+0x197/0x270 [ 700.596362][T13777] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 700.596384][T13777] ? rw_verify_area+0xcf/0x680 [ 700.596403][T13777] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 700.596423][T13777] vfs_read+0x1e1/0xc60 [ 700.596446][T13777] ? __pfx___mutex_lock+0x10/0x10 [ 700.596470][T13777] ? __pfx_vfs_read+0x10/0x10 [ 700.596496][T13777] ? __fget_files+0x20e/0x3c0 [ 700.596524][T13777] ksys_read+0x12a/0x250 [ 700.596543][T13777] ? __pfx_ksys_read+0x10/0x10 [ 700.596569][T13777] do_syscall_64+0xcd/0x4c0 [ 700.596594][T13777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 700.596612][T13777] RIP: 0033:0x7fb5e398d33c [ 700.596627][T13777] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 700.596642][T13777] RSP: 002b:00007fb5e48d5030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 700.596659][T13777] RAX: ffffffffffffffda RBX: 00007fb5e3bb5fa0 RCX: 00007fb5e398d33c [ 700.596670][T13777] RDX: 000000000000000f RSI: 00007fb5e48d50a0 RDI: 0000000000000005 [ 700.596680][T13777] RBP: 00007fb5e48d5090 R08: 0000000000000000 R09: 0000000000000000 [ 700.596689][T13777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 700.596698][T13777] R13: 0000000000000000 R14: 00007fb5e3bb5fa0 R15: 00007ffcec8e4578 [ 700.596724][T13777] [ 702.330599][ T5943] usb 8-1: config 0 descriptor?? [ 702.353418][ T5943] usb 8-1: can't set config #0, error -71 [ 702.397811][ T5943] usb 8-1: USB disconnect, device number 29 [ 702.509423][T13796] netlink: 212376 bytes leftover after parsing attributes in process `syz.7.1533'. [ 702.852755][T13797] ------------[ cut here ]------------ [ 702.852912][T13797] WARNING: CPU: 0 PID: 13797 at drivers/gpu/drm/vkms/vkms_crtc.c:97 vkms_get_vblank_timestamp+0x167/0x1b0 [ 702.852981][T13797] Modules linked in: [ 702.853086][T13797] CPU: 0 UID: 0 PID: 13797 Comm: syz.9.1534 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 702.853124][T13797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 702.853152][T13797] RIP: 0010:vkms_get_vblank_timestamp+0x167/0x1b0 [ 702.853192][T13797] Code: b7 fb e8 5c af a4 fb 4c 89 e1 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c 11 00 75 43 49 89 04 24 eb c0 e8 9a 0b b7 fb 90 <0f> 0b 90 eb b5 e8 cf e6 1d fc e9 dc fe ff ff e8 55 e7 1d fc e9 14 [ 702.853227][T13797] RSP: 0018:ffffc90002ee7008 EFLAGS: 00010283 [ 702.853273][T13797] RAX: 00000000000060a8 RBX: ffff888146acc028 RCX: ffffc90020aa0000 [ 702.853302][T13797] RDX: 0000000000080000 RSI: ffffffff8604db16 RDI: 0000000000000006 [ 702.853330][T13797] RBP: 000000a3a35024bc R08: 0000000000000006 R09: 000000a3a35024bc [ 702.853357][T13797] R10: 000000a3a35024bc R11: 0000000000000001 R12: ffffc90002ee7170 [ 702.853385][T13797] R13: 000000a3a35024bc R14: 0000000000004e20 R15: ffffffff8604d9b0 [ 702.853412][T13797] FS: 00007fb5e48b46c0(0000) GS:ffff888124718000(0000) knlGS:0000000000000000 [ 702.853444][T13797] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 702.853473][T13797] CR2: 000000110c24c135 CR3: 0000000064155000 CR4: 00000000003526f0 [ 702.853500][T13797] Call Trace: [ 702.853523][T13797] [ 702.853564][T13797] drm_crtc_get_last_vbltimestamp+0x102/0x1b0 [ 702.853606][T13797] ? __pfx_drm_crtc_get_last_vbltimestamp+0x10/0x10 [ 702.853645][T13797] ? drm_crtc_next_vblank_start+0x7f/0x300 [ 702.853683][T13797] drm_crtc_next_vblank_start+0x182/0x300 [ 702.853727][T13797] drm_atomic_helper_wait_for_fences+0x203/0x830 [ 702.853788][T13797] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 702.853830][T13797] ? lockdep_hardirqs_on+0x7c/0x110 [ 702.853874][T13797] ? read_tsc+0x9/0x20 [ 702.853913][T13797] ? ktime_get+0x1a7/0x310 [ 702.853960][T13797] commit_tail+0x83/0x400 [ 702.854023][T13797] drm_atomic_helper_commit+0x2fd/0x380 [ 702.854065][T13797] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 702.854107][T13797] drm_atomic_commit+0x234/0x300 [ 702.854142][T13797] ? __pfx_drm_atomic_commit+0x10/0x10 [ 702.854173][T13797] ? __pfx___drm_printfn_info+0x10/0x10 [ 702.854228][T13797] ? drm_client_rotation+0x4da/0x6a0 [ 702.854287][T13797] drm_client_modeset_commit_atomic+0x69d/0x7e0 [ 702.854351][T13797] ? trace_contention_end+0xdd/0x130 [ 702.854386][T13797] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 702.854428][T13797] ? __mutex_lock+0x1ca/0xb90 [ 702.854534][T13797] drm_client_modeset_commit_locked+0x14d/0x580 [ 702.854571][T13797] drm_client_modeset_commit+0x4f/0x80 [ 702.854604][T13797] __drm_fb_helper_restore_fbdev_mode_unlocked+0x19f/0x200 [ 702.854651][T13797] drm_fb_helper_set_par+0xd8/0x120 [ 702.854689][T13797] ? __pfx_drm_fb_helper_set_par+0x10/0x10 [ 702.854732][T13797] fb_set_var+0x81f/0x1280 [ 702.854792][T13797] ? __pfx_fb_set_var+0x10/0x10 [ 702.854892][T13797] ? __pfx___schedule+0x10/0x10 [ 702.854927][T13797] ? lockdep_hardirqs_on+0x7c/0x110 [ 702.855032][T13797] ? fbcon_switch+0x3ed/0x14c0 [ 702.855070][T13797] ? fb_videomode_to_var+0x13/0x610 [ 702.855113][T13797] fbcon_switch+0x4dc/0x14c0 [ 702.855173][T13797] ? __pfx_fbcon_switch+0x10/0x10 [ 702.855251][T13797] ? __pfx_bit_cursor+0x10/0x10 [ 702.855288][T13797] ? fbcon_cursor+0x409/0x5f0 [ 702.855327][T13797] ? is_console_locked+0x9/0x20 [ 702.855368][T13797] ? con_is_visible+0x65/0x150 [ 702.855408][T13797] redraw_screen+0x2c1/0x760 [ 702.855448][T13797] ? __pfx_redraw_screen+0x10/0x10 [ 702.855487][T13797] ? fbcon_set_palette+0x401/0x640 [ 702.855528][T13797] fbcon_modechanged+0x456/0x700 [ 702.855584][T13797] fbcon_set_all_vcs+0x1d6/0x450 [ 702.855640][T13797] fbcon_update_vcs+0x2c/0x50 [ 702.855678][T13797] do_fb_ioctl+0x787/0x7e0 [ 702.855715][T13797] ? __pfx_do_fb_ioctl+0x10/0x10 [ 702.855765][T13797] ? do_vfs_ioctl+0x523/0x1a60 [ 702.855892][T13797] ? selinux_file_ioctl+0x180/0x270 [ 702.855937][T13797] fb_ioctl+0xe5/0x150 [ 702.855966][T13797] ? __pfx_fb_ioctl+0x10/0x10 [ 702.856000][T13797] __x64_sys_ioctl+0x18e/0x210 [ 702.856040][T13797] do_syscall_64+0xcd/0x4c0 [ 702.856069][T13797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 702.856090][T13797] RIP: 0033:0x7fb5e398e929 [ 702.856106][T13797] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 702.856124][T13797] RSP: 002b:00007fb5e48b4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 702.856163][T13797] RAX: ffffffffffffffda RBX: 00007fb5e3bb6080 RCX: 00007fb5e398e929 [ 702.856193][T13797] RDX: 0000200000000240 RSI: 0000000000004601 RDI: 0000000000000000 [ 702.856220][T13797] RBP: 00007fb5e3a10b39 R08: 0000000000000000 R09: 0000000000000000 [ 702.856247][T13797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 702.856275][T13797] R13: 0000000000000000 R14: 00007fb5e3bb6080 R15: 00007ffcec8e4578 [ 702.856345][T13797] [ 702.856372][T13797] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 702.856388][T13797] CPU: 0 UID: 0 PID: 13797 Comm: syz.9.1534 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) [ 702.856412][T13797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 702.856423][T13797] Call Trace: [ 702.856430][T13797] [ 702.856437][T13797] dump_stack_lvl+0x3d/0x1f0 [ 702.856460][T13797] panic+0x71c/0x800 [ 702.856481][T13797] ? __pfx_panic+0x10/0x10 [ 702.856500][T13797] ? show_trace_log_lvl+0x29b/0x3e0 [ 702.856527][T13797] ? vkms_get_vblank_timestamp+0x167/0x1b0 [ 702.856543][T13797] check_panic_on_warn+0xab/0xb0 [ 702.856565][T13797] __warn+0xf6/0x3c0 [ 702.856578][T13797] ? vkms_get_vblank_timestamp+0x167/0x1b0 [ 702.856594][T13797] report_bug+0x3c3/0x580 [ 702.856610][T13797] ? vkms_get_vblank_timestamp+0x167/0x1b0 [ 702.856625][T13797] handle_bug+0x184/0x210 [ 702.856643][T13797] exc_invalid_op+0x17/0x50 [ 702.856662][T13797] asm_exc_invalid_op+0x1a/0x20 [ 702.856673][T13797] RIP: 0010:vkms_get_vblank_timestamp+0x167/0x1b0 [ 702.856687][T13797] Code: b7 fb e8 5c af a4 fb 4c 89 e1 48 ba 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c 11 00 75 43 49 89 04 24 eb c0 e8 9a 0b b7 fb 90 <0f> 0b 90 eb b5 e8 cf e6 1d fc e9 dc fe ff ff e8 55 e7 1d fc e9 14 [ 702.856704][T13797] RSP: 0018:ffffc90002ee7008 EFLAGS: 00010283 [ 702.856714][T13797] RAX: 00000000000060a8 RBX: ffff888146acc028 RCX: ffffc90020aa0000 [ 702.856722][T13797] RDX: 0000000000080000 RSI: ffffffff8604db16 RDI: 0000000000000006 [ 702.856730][T13797] RBP: 000000a3a35024bc R08: 0000000000000006 R09: 000000a3a35024bc [ 702.856737][T13797] R10: 000000a3a35024bc R11: 0000000000000001 R12: ffffc90002ee7170 [ 702.856744][T13797] R13: 000000a3a35024bc R14: 0000000000004e20 R15: ffffffff8604d9b0 [ 702.856752][T13797] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 702.856769][T13797] ? vkms_get_vblank_timestamp+0x166/0x1b0 [ 702.856784][T13797] ? vkms_get_vblank_timestamp+0x166/0x1b0 [ 702.856800][T13797] drm_crtc_get_last_vbltimestamp+0x102/0x1b0 [ 702.856820][T13797] ? __pfx_drm_crtc_get_last_vbltimestamp+0x10/0x10 [ 702.856839][T13797] ? drm_crtc_next_vblank_start+0x7f/0x300 [ 702.856856][T13797] drm_crtc_next_vblank_start+0x182/0x300 [ 702.856873][T13797] drm_atomic_helper_wait_for_fences+0x203/0x830 [ 702.856896][T13797] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 702.856914][T13797] ? lockdep_hardirqs_on+0x7c/0x110 [ 702.856930][T13797] ? read_tsc+0x9/0x20 [ 702.856943][T13797] ? ktime_get+0x1a7/0x310 [ 702.856964][T13797] commit_tail+0x83/0x400 [ 702.856984][T13797] drm_atomic_helper_commit+0x2fd/0x380 [ 702.857002][T13797] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 702.857020][T13797] drm_atomic_commit+0x234/0x300 [ 702.857033][T13797] ? __pfx_drm_atomic_commit+0x10/0x10 [ 702.857045][T13797] ? __pfx___drm_printfn_info+0x10/0x10 [ 702.857061][T13797] ? drm_client_rotation+0x4da/0x6a0 [ 702.857083][T13797] drm_client_modeset_commit_atomic+0x69d/0x7e0 [ 702.857106][T13797] ? trace_contention_end+0xdd/0x130 [ 702.857118][T13797] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 702.857137][T13797] ? __mutex_lock+0x1ca/0xb90 [ 702.857168][T13797] drm_client_modeset_commit_locked+0x14d/0x580 [ 702.857185][T13797] drm_client_modeset_commit+0x4f/0x80 [ 702.857197][T13797] __drm_fb_helper_restore_fbdev_mode_unlocked+0x19f/0x200 [ 702.857218][T13797] drm_fb_helper_set_par+0xd8/0x120 [ 702.857234][T13797] ? __pfx_drm_fb_helper_set_par+0x10/0x10 [ 702.857251][T13797] fb_set_var+0x81f/0x1280 [ 702.857270][T13797] ? __pfx_fb_set_var+0x10/0x10 [ 702.857297][T13797] ? __pfx___schedule+0x10/0x10 [ 702.857311][T13797] ? lockdep_hardirqs_on+0x7c/0x110 [ 702.857341][T13797] ? fbcon_switch+0x3ed/0x14c0 [ 702.857357][T13797] ? fb_videomode_to_var+0x13/0x610 [ 702.857376][T13797] fbcon_switch+0x4dc/0x14c0 [ 702.857397][T13797] ? __pfx_fbcon_switch+0x10/0x10 [ 702.857420][T13797] ? __pfx_bit_cursor+0x10/0x10 [ 702.857436][T13797] ? fbcon_cursor+0x409/0x5f0 [ 702.857452][T13797] ? is_console_locked+0x9/0x20 [ 702.857469][T13797] ? con_is_visible+0x65/0x150 [ 702.857485][T13797] redraw_screen+0x2c1/0x760 [ 702.857501][T13797] ? __pfx_redraw_screen+0x10/0x10 [ 702.857517][T13797] ? fbcon_set_palette+0x401/0x640 [ 702.857534][T13797] fbcon_modechanged+0x456/0x700 [ 702.857553][T13797] fbcon_set_all_vcs+0x1d6/0x450 [ 702.857571][T13797] fbcon_update_vcs+0x2c/0x50 [ 702.857588][T13797] do_fb_ioctl+0x787/0x7e0 [ 702.857601][T13797] ? __pfx_do_fb_ioctl+0x10/0x10 [ 702.857616][T13797] ? do_vfs_ioctl+0x523/0x1a60 [ 702.857648][T13797] ? selinux_file_ioctl+0x180/0x270 [ 702.857666][T13797] fb_ioctl+0xe5/0x150 [ 702.857677][T13797] ? __pfx_fb_ioctl+0x10/0x10 [ 702.857689][T13797] __x64_sys_ioctl+0x18e/0x210 [ 702.857711][T13797] do_syscall_64+0xcd/0x4c0 [ 702.857738][T13797] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 702.857752][T13797] RIP: 0033:0x7fb5e398e929 [ 702.857764][T13797] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 702.857778][T13797] RSP: 002b:00007fb5e48b4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 702.857791][T13797] RAX: ffffffffffffffda RBX: 00007fb5e3bb6080 RCX: 00007fb5e398e929 [ 702.857798][T13797] RDX: 0000200000000240 RSI: 0000000000004601 RDI: 0000000000000000 [ 702.857806][T13797] RBP: 00007fb5e3a10b39 R08: 0000000000000000 R09: 0000000000000000 [ 702.857813][T13797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 702.857821][T13797] R13: 0000000000000000 R14: 00007fb5e3bb6080 R15: 00007ffcec8e4578 [ 702.857837][T13797] [ 702.858100][T13797] Kernel Offset: disabled