last executing test programs: 3m39.135026562s ago: executing program 2 (id=1796): r0 = socket(0x10, 0x80002, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @multicast1, @private}, &(0x7f0000000040)=0xc) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$random(0xffffffffffffff9c, &(0x7f0000000140), 0x10d802, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file1/file3\x00', 0x0) r3 = syz_clone(0x23802400, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x6a000000) socket$alg(0x26, 0x5, 0x0) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000240), 0x4080, 0x0) syz_io_uring_setup(0x37a2, 0x0, &(0x7f0000000200), &(0x7f00000001c0)) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000380)={0x353, 0x78, 0x300, 0x0, 0xa, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x0, 0x0, 0x1, 0x1, 0x4, 0x9f6, 0x3, 0x1ff, 0x803d, 0x1, 0x7, 0x5f, 0x202, 0x1, 0xc}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x5885, 0x100, 0x0, 0xffeffc03}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r6, 0x80, &(0x7f00000000c0)=@un=@file={0x1, './file1/file3\x00'}}) io_uring_enter(r7, 0x3516, 0x67f, 0x64, 0x0, 0x0) 3m37.97786197s ago: executing program 2 (id=1800): r0 = socket$inet6(0xa, 0x80000, 0x6) setsockopt$inet6_int(r0, 0x29, 0x4b, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r3 = getpid() openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x4480, 0x0) syz_pidfd_open(r3, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x1f, &(0x7f0000000240)={r6, @in={{0x2, 0x4e24, @private=0xa010101}}, 0x0, 0x45}, 0x90) syz_open_dev$sndmidi(0x0, 0xa, 0x147b42) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f00000007c0)={0x48, 0x2, r7}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x100, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x161) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20400}, 0x0) r10 = open$dir(0x0, 0x80, 0x100) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x1) fsetxattr$security_ima(r10, 0x0, &(0x7f0000000500)=ANY=[], 0x1009, 0x0) llistxattr(&(0x7f0000000200)='./file1\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) socket$inet(0x2, 0x2, 0x1) 3m36.816105167s ago: executing program 2 (id=1804): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100, 0x3}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r5, 0xc018620c, &(0x7f0000000000)={0x2}) r6 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x1) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000180)={0x53, 0xfffffffffffffffe, 0x6, 0x9, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000040)="a28944dc00ca", 0x0, 0x9, 0x2, 0x2, 0x0}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2a, 0x8000002, {0x0, 0x0, 0x0, r8, {0x0, 0x6}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_RSHIFT={0x8, 0x4, 0x616d}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24008004}, 0x0) 3m36.74965184s ago: executing program 2 (id=1805): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="30000000030805000000000000000000000000000c0004800800014000000000060002400000000005000300ff"], 0x30}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async) mkdir(&(0x7f00000002c0)='./file0\x00', 0x2) (async, rerun: 32) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x80101) (rerun: 32) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10) (async) chroot(&(0x7f0000000780)='./file0\x00') (async, rerun: 64) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) (rerun: 64) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') (async) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sendmsg(r6, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) (async) r7 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) ioctl$MON_IOCX_MFETCH(r7, 0xc0109207, &(0x7f00000001c0)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x3}) (async) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42800) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0xf, &(0x7f00000004c0)=ANY=[@ANYBLOB="18080000ff00000000000000fbffffff18110000", @ANYRES32=r8, @ANYBLOB="0000000000aa0000b702000014000000b7030000030000008500000005000000bf0900000000000055090100000000e8bd73c1a4376c1921ea85b3e36a009500000000000000bf9800000000000056080000020000008500000007000000b7000000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) dup3(r7, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) (async) r9 = socket(0x2b, 0x1, 0x8) getsockopt(r9, 0x200000000114, 0x271d, 0x0, &(0x7f0000000000)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 3m36.475990705s ago: executing program 2 (id=1806): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x2) (async) connect$unix(r0, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) (async, rerun: 64) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) r2 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) r3 = socket(0x10, 0x803, 0x0) (rerun: 64) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) (async) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r4, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) (async) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newlink={0x20, 0x10, 0x403, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r4, 0xff7f}}, 0x20}}, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x3c}}, 0x0) (async) r8 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$6lowpan_enable(r8, &(0x7f0000000280)='1', 0x1) (async) r9 = socket(0x18, 0x800, 0x4) write(r9, &(0x7f0000000080)="1400000052004f030e789e7ee2ce2fa4ff612d27", 0x14) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) (rerun: 64) sendmsg$DEVLINK_CMD_GET(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000000001f0000540000000e0001006e657464657673696d0000000f0002"], 0x34}}, 0x0) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="14000000", @ANYRES16=r12, @ANYBLOB="0100c1cb098700000000540000004b1393f1d9425efb5239e8b169bf8685f1d2d4f91c1a4ce941b25edbe44911def10a6a63381c45c4fa3571b10a9bb91cb8493764afdc019edd8fc12b1f9f4fe2cfb6d35e4c9d479ea3cb2c4ea60223b4b8d89d270eeffd0c2a7d3158132a2fda6f0d72dc5cb34a97131ed1e12b406f36690d1f12c27a629ae3f8330f4c5f21fd28f7189b04e6a7"], 0x14}}, 0x0) recvmmsg(r9, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) (async) r13 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r13, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r13, &(0x7f0000000000), 0x0) 3m36.124500901s ago: executing program 2 (id=1810): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, &(0x7f0000000040)}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000400)={0x2020}, 0x2020) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000002900)=[{{&(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000580)=[{&(0x7f0000002680)}, {&(0x7f0000000380)}], 0x2, 0x0, 0x0, 0x10}}], 0x1, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r4, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000500)={0x28, 0x6, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0x80000001}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x10, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000013ff0000b7030000000000008500000083000000bf09000000000000550901000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x60083, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000440)={0x28, 0x5, r7, 0x0, &(0x7f0000000480)='L', 0x1, 0x400000001}) ioctl$IOMMU_IOAS_UNMAP(r6, 0x3b86, &(0x7f0000000000)={0x18, r7, 0x0, 0x10001}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r4}) 3m35.865979753s ago: executing program 32 (id=1810): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, r0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, &(0x7f0000000040)}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000400)={0x2020}, 0x2020) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000002900)=[{{&(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000580)=[{&(0x7f0000002680)}, {&(0x7f0000000380)}], 0x2, 0x0, 0x0, 0x10}}], 0x1, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r4, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000500)={0x28, 0x6, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0x80000001}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x10, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000013ff0000b7030000000000008500000083000000bf09000000000000550901000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x60083, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r6, 0x3b85, &(0x7f0000000440)={0x28, 0x5, r7, 0x0, &(0x7f0000000480)='L', 0x1, 0x400000001}) ioctl$IOMMU_IOAS_UNMAP(r6, 0x3b86, &(0x7f0000000000)={0x18, r7, 0x0, 0x10001}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r4}) 1m20.324158512s ago: executing program 4 (id=2364): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000100)) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000580)=0xe) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000080)=0x7f) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) socket$l2tp(0x2, 0x2, 0x73) r3 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) ioctl$VIDIOC_G_SELECTION(r7, 0xc040565e, &(0x7f00000003c0)={0xa, 0x0, 0x0, {0x80000002, 0x1, 0x2, 0x8800001}}) sendto$inet6(r6, &(0x7f0000000180)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e5fa424ac4d31c4f7a1", 0x90, 0x0, 0x0, 0xf) syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f00000000c0)=0x6) dup3(r2, r3, 0x80000) capget(&(0x7f0000000140)={0x20080522, 0xffffffffffffffff}, &(0x7f0000000180)={0x7, 0x8, 0x6, 0x8, 0x1, 0xffffffff}) read$dsp(r1, &(0x7f00000011c0)=""/4117, 0x200021d5) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) r8 = syz_open_procfs(0x0, &(0x7f00000005c0)='timers\x00') lseek(r8, 0x2000, 0x0) ioctl$SNDCTL_SEQ_GETINCOUNT(r8, 0x80045105, &(0x7f0000000000)) 1m18.882121821s ago: executing program 4 (id=2371): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m18.687664469s ago: executing program 4 (id=2373): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4e, &(0x7f00000000c0)=0x8, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@getqdisc={0x38, 0x26, 0x200, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x9, 0x7}, {0xfff1, 0x4}, {0x5, 0xc}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x38}}, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e) r3 = socket$inet6(0xa, 0x2, 0x0) r4 = dup(r3) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x21, 0x0, 0x77ed42, 0x0, 0x80}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x26, 0x0, 0x0, 0x0, 0xfffffffffffffefa}, 0x40) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x58840}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYRES64=r0, @ANYRES16=0x0, @ANYBLOB="08d4e550c13e61964a3305a0d520f3fba59211301a07e731eaa440410e9ba9a2a407b80b0ea9d9cb28ac4987a322852010cb0d6f12d7ec87423bed6b04390c99314ac06159827df670e081040e294209f34b3a9c0594a8995f40a3f241828bd7f75d7fea55567637ca04bb307c7e8e388e266e2836188890dbce1998270ed2d1aa31c33b02f2d8a87e7bcf5e52fe67eee4ba79f5a636ae85a087608d205a09", @ANYRES16=0x0, @ANYRESDEC=r4], 0x1c}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r6, 0x0, 0x1, &(0x7f0000000000)=0x80020000, 0x4) listen(r6, 0x2) r7 = socket$netlink(0x10, 0x3, 0x8000000004) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x10140, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0xfbffffffffffff7c) r9 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_SIGNAL_MASK(r9, 0x4004ae8b, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES8=r5, @ANYBLOB="52ff3f23a62917708f6812ee03485b34b32ab7bba878c0c6a91e768d62bdd0"]) ioctl$KVM_RUN(r9, 0xae80, 0x0) writev(r7, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff000000000000000458000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) 1m17.188195884s ago: executing program 4 (id=2377): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000000000)=@newtaction={0x44, 0x30, 0x216822a75a8bdd29, 0x0, 0x0, {}, [{0x30, 0x1, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904080001030000000905", @ANYBLOB="8fcf"], 0x0) 1m14.056208679s ago: executing program 4 (id=2392): mknod(&(0x7f0000000080)='./bus\x00', 0x1000, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x143142, 0xa2) write$FUSE_INIT(r0, &(0x7f0000000140)={0x50}, 0xffd3) write$apparmor_current(r0, &(0x7f0000000300)=@hat={'permhat ', 0x3}, 0x1b) read$FUSE(r0, &(0x7f00000079c0)={0x2020}, 0x2020) 1m13.82741933s ago: executing program 4 (id=2396): syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) r4 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x46d, 0xc513, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f00000003c0)={0x2c, &(0x7f0000000440)=ANY=[@ANYBLOB='\x00\x00\b\x00\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000040)=0x800003) r5 = socket$netlink(0x10, 0x3, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/bus/input/devices\x00', 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) r6 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0x334f, 0x10, 0x3, 0x801}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) r9 = syz_open_dev$radio(&(0x7f00000000c0), 0x2, 0x2) ioctl$VIDIOC_S_TUNER(r9, 0xc0405627, &(0x7f0000000100)={0x0, "02c0cf0c629c527e5162bf1cab3223b02749791e5c7465e0caa7b1214ac1efe3", 0x5, 0x100, 0x1aa35bb2, 0x4b70, 0x4, 0x2, 0x80000001, 0x401}) r10 = syz_io_uring_setup(0x10d2, &(0x7f0000000340)={0x0, 0x6bf6, 0x100, 0x5, 0x12}, &(0x7f00000000c0), &(0x7f0000000300)=0x0) r12 = io_uring_register$IORING_REGISTER_PERSONALITY(r10, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r11, &(0x7f0000000200)=@IORING_OP_FADVISE={0x18, 0x0, 0x0, @fd_index=0x7, 0x0, 0x0, 0x3fffe, 0x2, 0x0, {0x0, r12}}) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x9, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, r12}}) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100}) io_uring_enter(r6, 0x7277, 0x0, 0x28, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x2}, &(0x7f0000bbdffc)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x1c}}, 0x0) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000000)=0x2) setsockopt$sock_int(r2, 0x1, 0x3e, &(0x7f0000fee000)=0x3fa, 0x4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 1m13.062602906s ago: executing program 33 (id=2396): syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) r4 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x46d, 0xc513, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x5, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f00000003c0)={0x2c, &(0x7f0000000440)=ANY=[@ANYBLOB='\x00\x00\b\x00\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000040)=0x800003) r5 = socket$netlink(0x10, 0x3, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000580)='/proc/bus/input/devices\x00', 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) r6 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0x334f, 0x10, 0x3, 0x801}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) r9 = syz_open_dev$radio(&(0x7f00000000c0), 0x2, 0x2) ioctl$VIDIOC_S_TUNER(r9, 0xc0405627, &(0x7f0000000100)={0x0, "02c0cf0c629c527e5162bf1cab3223b02749791e5c7465e0caa7b1214ac1efe3", 0x5, 0x100, 0x1aa35bb2, 0x4b70, 0x4, 0x2, 0x80000001, 0x401}) r10 = syz_io_uring_setup(0x10d2, &(0x7f0000000340)={0x0, 0x6bf6, 0x100, 0x5, 0x12}, &(0x7f00000000c0), &(0x7f0000000300)=0x0) r12 = io_uring_register$IORING_REGISTER_PERSONALITY(r10, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r11, &(0x7f0000000200)=@IORING_OP_FADVISE={0x18, 0x0, 0x0, @fd_index=0x7, 0x0, 0x0, 0x3fffe, 0x2, 0x0, {0x0, r12}}) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x9, 0x0, r9, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, r12}}) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100}) io_uring_enter(r6, 0x7277, 0x0, 0x28, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x2}, &(0x7f0000bbdffc)) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x1c}}, 0x0) ioctl$TIOCPKT(r3, 0x5420, &(0x7f0000000000)=0x2) setsockopt$sock_int(r2, 0x1, 0x3e, &(0x7f0000fee000)=0x3fa, 0x4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 8.424157622s ago: executing program 5 (id=2704): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000004300), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000100)={0x1, 0x0, @ioapic={0x8082801, 0x5fa, 0x8, 0x1ff, 0x0, [{0x3, 0x6, 0x9, '\x00', 0xe}, {0x5, 0xb, 0x72, '\x00', 0x6}, {0xfe, 0x5, 0x9, '\x00', 0x5}, {0x81, 0x3, 0x8, '\x00', 0x5}, {0xb, 0x50, 0x7f, '\x00', 0x60}, {0x0, 0x0, 0x2}, {0x6, 0x9, 0x1, '\x00', 0xa}, {0xd, 0x7, 0xb, '\x00', 0x45}, {0x8, 0x5, 0x0, '\x00', 0xff}, {0x6, 0x3, 0x0, '\x00', 0x6}, {0x40, 0x4, 0x2, '\x00', 0x1}, {0x8, 0x4, 0x19, '\x00', 0xff}, {0x3, 0x86, 0xc, '\x00', 0xf9}, {0x5, 0x4f, 0x2}, {0x64, 0x87, 0x96, '\x00', 0x7}, {0xb, 0x0, 0x23, '\x00', 0x7b}, {0x3, 0x7, 0xd1}, {0x68, 0x3, 0x2, '\x00', 0x10}, {0x8, 0x9e, 0xc0, '\x00', 0x2}, {0x3e, 0x48, 0xa, '\x00', 0x2}, {0x7, 0x1, 0x2, '\x00', 0x1}, {0x3, 0x7, 0x6, '\x00', 0x4}, {0x93, 0x9, 0x4, '\x00', 0xe6}, {0x3, 0x7f, 0xe0, '\x00', 0x47}]}}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000100)={0x2, 0x0, @pic={0x0, 0x7, 0x5, 0x93, 0x0, 0x0, 0x4, 0xbb, 0x2, 0xc0, 0x6d, 0x26, 0x61, 0x7, 0x95, 0xd}}) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000480)={0x4, 0x5, 0x5}) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000000)=ANY=[@ANYRESHEX=r0]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 8.264369655s ago: executing program 5 (id=2706): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x12, 0x613, 0x70bd26, 0x25dfdbfd, {0x6, 0xff, 0x1, 0xfc, {0x4e24, 0x4e21, [0x4, 0xfffffffa, 0x6, 0x6], [0x400007, 0x8, 0x61, 0x7], 0x0, [0x1, 0x4]}, 0x1, 0x8005}, [@INET_DIAG_REQ_BYTECODE={0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) landlock_restrict_self(0xffffffffffffffff, 0xe837cd994334571b) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') fchdir(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) close(r2) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)={0x3c, r4, 0x1, 0x0, 0x80000, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_BSS_BASIC_RATES={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x800) sendmsg$NL80211_CMD_SET_PMKSA(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r4, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}, @NL80211_ATTR_PMKID={0x14, 0x55, "e0076daea4acc09b2fc35d61db1ad89b"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @random="f7764d6c6a56"}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x1) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000440)=0x9, 0x4) recvfrom(r1, &(0x7f0000000340)=""/203, 0xcb, 0x40000043, &(0x7f0000000280)=@l2tp={0x2, 0x0, @private=0xa010102, 0x1}, 0x80) sendmsg$nl_generic(r2, &(0x7f0000000240)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000680)={0x1f4, 0x17, 0x1c, 0x70bd2b, 0x25dfdbfb, {0xc}, [@generic="bdee7e575d00131b4c4e88dfe485bab52bebc682853f55fc6e2b401f7f6653b74d16fa04590a30810aab3d32cea4be4db80185810b9cc7d0c119b3d54516e3ecbc1fd417a976d8a1a75a72166f4a840ec45cc1e202a2264d9b0df29fbe056e4f8204be4dba7a321ee1f32425608fb71b39cb80ad5bb76000331066d59dd744a7dff80bff2128165a697e09193ef3e8f304d6efc9972a43fb32b7fc777d87ed6c7532c8b692118e5946f719f1161eb56b3b9b607012a200534dd281e8158b5c9f249470665da37fc14401", @generic="fcae66287dd4e6601a3d94cf68894f2646a4ba2f5d5f2a0af2d2674be8048afda412d234e625319f697e8d435bb6158119e96e16326ea7efecad01c1cb946ad536c11ed59dfbd14ebfde83380bdc217d2925b4beca1c6b34f3841b3e34581803995f686d1c53bf42330dd9f7d2e52d624b44192134a354703b9bc76fe1e551b106a0bcee7084b4c1f74eacb68c28bcfe551a1903f084bc35a08a3d23d4e4f9266d32596b0dfb3841", @generic="9a9260fdf11aea23f80f0f9874ca3b6314637a054528d7caeb0ae5d1243696cc22b394e1b163bbf23b9be4f48044f0216a84ad7e1518644ec214e938527d45add268cbb9d352f9a36cb7f950a28a4bf9389eb38856c330095fc0c334c3bf7e9999e062b9a96873410a55aebea9c5"]}, 0x1f4}, 0x1, 0x0, 0x0, 0x20040009}, 0x8004) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0x4c, 0x20, 0x100, 0x70bd28, 0x25dfdbfb, {0xa, 0x10, 0x80, 0x4, 0xb, 0x0, 0x0, 0x0, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7}, @FRA_DST={0x14, 0x1, @loopback}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) (async) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x12, 0x613, 0x70bd26, 0x25dfdbfd, {0x6, 0xff, 0x1, 0xfc, {0x4e24, 0x4e21, [0x4, 0xfffffffa, 0x6, 0x6], [0x400007, 0x8, 0x61, 0x7], 0x0, [0x1, 0x4]}, 0x1, 0x8005}, [@INET_DIAG_REQ_BYTECODE={0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) landlock_restrict_self(0xffffffffffffffff, 0xe837cd994334571b) (async) syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') (async) fchdir(r2) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) close(r2) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_JOIN_IBSS(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)={0x3c, r4, 0x1, 0x0, 0x80000, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_BSS_BASIC_RATES={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x800) (async) sendmsg$NL80211_CMD_SET_PMKSA(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r4, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}, @NL80211_ATTR_PMKID={0x14, 0x55, "e0076daea4acc09b2fc35d61db1ad89b"}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @random="f7764d6c6a56"}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x1) (async) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000440)=0x9, 0x4) (async) recvfrom(r1, &(0x7f0000000340)=""/203, 0xcb, 0x40000043, &(0x7f0000000280)=@l2tp={0x2, 0x0, @private=0xa010102, 0x1}, 0x80) (async) sendmsg$nl_generic(r2, &(0x7f0000000240)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000680)={0x1f4, 0x17, 0x1c, 0x70bd2b, 0x25dfdbfb, {0xc}, [@generic="bdee7e575d00131b4c4e88dfe485bab52bebc682853f55fc6e2b401f7f6653b74d16fa04590a30810aab3d32cea4be4db80185810b9cc7d0c119b3d54516e3ecbc1fd417a976d8a1a75a72166f4a840ec45cc1e202a2264d9b0df29fbe056e4f8204be4dba7a321ee1f32425608fb71b39cb80ad5bb76000331066d59dd744a7dff80bff2128165a697e09193ef3e8f304d6efc9972a43fb32b7fc777d87ed6c7532c8b692118e5946f719f1161eb56b3b9b607012a200534dd281e8158b5c9f249470665da37fc14401", @generic="fcae66287dd4e6601a3d94cf68894f2646a4ba2f5d5f2a0af2d2674be8048afda412d234e625319f697e8d435bb6158119e96e16326ea7efecad01c1cb946ad536c11ed59dfbd14ebfde83380bdc217d2925b4beca1c6b34f3841b3e34581803995f686d1c53bf42330dd9f7d2e52d624b44192134a354703b9bc76fe1e551b106a0bcee7084b4c1f74eacb68c28bcfe551a1903f084bc35a08a3d23d4e4f9266d32596b0dfb3841", @generic="9a9260fdf11aea23f80f0f9874ca3b6314637a054528d7caeb0ae5d1243696cc22b394e1b163bbf23b9be4f48044f0216a84ad7e1518644ec214e938527d45add268cbb9d352f9a36cb7f950a28a4bf9389eb38856c330095fc0c334c3bf7e9999e062b9a96873410a55aebea9c5"]}, 0x1f4}, 0x1, 0x0, 0x0, 0x20040009}, 0x8004) (async) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newrule={0x4c, 0x20, 0x100, 0x70bd28, 0x25dfdbfb, {0xa, 0x10, 0x80, 0x4, 0xb, 0x0, 0x0, 0x0, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8, 0x6, 0x7}, @FRA_DST={0x14, 0x1, @loopback}, @FRA_SRC={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) (async) 8.095966582s ago: executing program 5 (id=2707): r0 = socket$inet6(0xa, 0x80000, 0xfcf) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = dup(r2) write$UHID_INPUT(r3, &(0x7f00000030c0)={0x765, {"a2e3ad21ed0d09f91b48090987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f39006e090890e0878f0e1ac6e7049b074a959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074a0936cd3b78130daa61d8e8040000095802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1bb5a7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b7293ffff00009af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) sendmsg$nl_route_sched(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000005b80)=@delchain={0x24, 0x26, 0xf31, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x0, 0xf}, {0x9}, {0xffff}}}, 0x24}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r4 = syz_open_dev$dri(&(0x7f0000000a40), 0x1, 0x0) socket$kcm(0xa, 0x3, 0x87) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(r4, 0xc01064ac, &(0x7f0000000000)={0x0, 0x1000, &(0x7f0000002a80)=""/4096}) r5 = syz_usb_connect(0x2, 0x4a, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0x6d, 0xf5, 0x71, 0x8, 0x4e2, 0x1424, 0xc7eb, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x38, 0x2, 0x96, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xcc, 0x7, 0x0, 0x2, 0x59, 0x61, 0x5, [@cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x890, 0x0, 0x7, 0x8}, {0x6, 0x24, 0x1a, 0x5, 0x11}}]}}, {{0x9, 0x4, 0x1, 0xff, 0x0, 0x6e, 0xb8, 0xc1}}]}}]}}, 0x0) syz_usb_control_io$printer(r5, &(0x7f0000000000)={0x14, 0x0, &(0x7f0000000580)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) recvmmsg(r0, &(0x7f00000009c0)=[{{0x0, 0x0, 0x0}, 0x4}], 0x65942126f3d7b6a8, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)=ANY=[@ANYBLOB="880000001000210400"/20, @ANYRES32=r7, @ANYBLOB="0000000060040000380012800b000100677265746170000028000280060010004e00000006000f"], 0x88}}, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r9 = dup(0xffffffffffffffff) write$6lowpan_enable(r9, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x4754, &(0x7f0000000740)={0x0, 0xdc0b, 0x1, 0x3, 0x10a, 0x0, r9}, &(0x7f0000000180), &(0x7f00000006c0)) ioctl$IOMMU_IOAS_MAP$PAGES(r9, 0x3b85, &(0x7f00000002c0)={0x28, 0x0, 0x0, 0x0, &(0x7f0000ff2000/0xc000)=nil, 0xc000, 0x7}) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) syz_usb_control_io$uac1(r5, &(0x7f0000000080)={0x14, &(0x7f0000000480)=ANY=[@ANYBLOB="200fbe000000be08e28cbd3cc080a3ed3d1f1c5dca1e76ecb4140c64603c5494e7c8e2f08f1deb8a33b77a4dbb60dc53f2eaf07ecf79a4ed2bd1bd8b4b5f881dc67a3be2fac3079e923885c11ef41381cd7ff65a74b89fc3c6b883da77fe8db7470fb1419dab55751e00000000e0e105ead28ac3c6587399d10f0656e38b020d73a5efecdec7a71b4b26b22f572dadcc1739bf1d5568c52b991eb35dc311ba0e688f51e18af20757601e86bce66481584ae3c895de4b4a8bf1d55919fbeef73a"], &(0x7f0000000100)={0x0, 0x3, 0x4e, @string={0x4e, 0x3, "bc3a5dbd2e3273352ca11336309bf41fddf4e9944487b29d43cd1379545ae8f92036a81ddf18d5cdd5c80609d16a6511e30495d011c864c57285d48d94b33827d0e58d00185f05df5389bdb4"}}}, &(0x7f0000000700)={0x44, &(0x7f00000007c0)=ANY=[@ANYBLOB="0003ef000000040fb312dd2157839a4292160ed1563b2122c64b08b8cee95562b22aad1c9dd5e71a2b1b4511d3bb32de306d019150562fa36d4468bbf2a3246417844ee99e84d32c4f96d85063c1714cc5f021ba41a502e20923dfe95742eafc9a1dbd764d825f9309b012462a8e1f3aa436d0bda6395d73b3d91f5e8043b761158953db3bdba6a26d5c5c50a38da963b8153fceceb0374b2aa74c08b151b8fd639b51bf4c05cc494d75d849fe0e40b1f128f187f6f8a7c214e0bd2258895fa5c97ef58f76f98dfbbaa750ad285812ae8d3d739c38570d6d59fb84718edc9f207713910d94a4f415f078b2d58a9bb690861aedf3f12cbf86d7764806772891e0170652"], &(0x7f0000000180)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000240)={0x0, 0x8, 0x1, 0xdc}, &(0x7f0000000600)=ANY=[@ANYBLOB="2081010000c92214488c073ed814edc56339840e1dce0ac79cf81af0f9c9148431c51c35b244e2db00db5097d10071f2762ae3825e9414d3283f5607ca221fcdf4263009d1f31c196d63a95877bb885e3c6e84f8dbd9564dcbabc9d2b73c0229672d65b5ba6a813041d2f8bf78287959231d2cdc1c644aa8b1ffc1986d9d07912461e9ec13ed88b9786d6aa7e874513122763bc8510243cc995889fac81c25b088475a6905d8cc9bd02abf165a5356f936e795b4aa58f1ac5bcaf80f"], 0x0, 0x0, 0x0, &(0x7f0000000400)={0x20, 0x85, 0x3, "001c10"}}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000380)=""/86, 0x328000, 0x1000, 0x100}, 0x20) 7.741468537s ago: executing program 6 (id=2708): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000040)=0x7) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040301, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r4, 0x80184132, &(0x7f0000000080)) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r5 = syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x2b94, 0x80, 0x4, 0x3cf}, &(0x7f0000000040)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000100)=@IORING_OP_TIMEOUT={0xb, 0x41, 0x0, 0x0, 0xd, 0x0, 0x1, 0xc, 0x1}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r9, &(0x7f00000056c0)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000380)="42153f", 0x3}], 0x1, &(0x7f000000c3c0)=[{0x78, 0x108, 0x0, "22dd070949fa019b2a16b8a4cbc7420917d08551a9b4c71a73d52ec8e27df6529b8fee3acfa4149add00b5969db8dc99ca472d2db672ea9a1df2cfc9e1d50c72be098bc84aa8baf54143f4cca64a3855507ce02daa01e5fcd6de24db9a993a4cfd"}, {0x28, 0x104, 0xf75, "2dd54002424ee1029220161742cec7fc4e"}, {0x1010, 0x107, 0x8, "c3d27059c9450a41e0f6f32d6f4377b349cb94fb749091e8bb3a9529e5c901468b13395f00ee2b066bd8e2d12ef97d451c0ca68bd9ff8b9040af186f158601040349b1999267ad6c91ec0968c08aa552ce6d84db6bfc6ec06edee052c7f962444ba0ec3044ec2e33400af5709d1a92053c3ea37f61fb46845521143c260c3fd0a01a97bd11f4f179dda60ca542ffb9463edd3ed0c3c32f792369a1996d8a403914d20e37df9c2894977e238372b0a8ac0a664b0624205d225548ce9034bc4348c55508ab15e42d0488f26f740a08f2c4a606e5f0a20b0818ee5046135a08fb9a82f5255b217f411bebc573fbcecbac2ead55a53306d2e13fe3777be1716f47faf418d8e5d48a8d22fe61d41f6fb50857839e3883defd190ebb238a5d37db0aedeebce1483ef139fe52e43317189aea61eb243a55eefc55e7d13b46722c8bfd02f28a36a38e0b163d169a14933f6cb9ab44208cbb765860030144f988c6d5ac27004561e291ba32bea6480d3095a15bda42e824f3bafd93270b062fe129dab75b95cb545a2e743c310982225b500631cee866ef0d2e37eab1cb8bedbf4a3714b0eaf45ed8c3f30d988a26f108ca6ce30bb86dd948e56ea975330a6457bdec41abdd61b39cfcb9a920596a7891b1da684f959ffe6ecef3ec364d83f30b9e21c196906d48ee08739059c2a21761872f37c37cffec78f6b16d7beb8fd90ed8ce8043cb65313efd4eff0ef6566116fe643e10dcca254ba4dd16556da71cca60b3a9d4fdced68dd35bdd46b9bc0887331500e58787f62e452e02f1e7cee6f0710e1596733937682a2fff9835b23ed99242a340d0ba8784ad62b80195541810b495287d7eb4795601819a41faf57168cc3d88f5f39541d67322a2eef93c71f3fa97e7e6ed7c4724e1e603ffffedd85edaa71fd4673c562d5ab9047de121f237e2520a35189aff8275dca47c9ed4f3ad49ef8ae21d6fcfc9d431b37c766a79b8022db02faca49d1e3513a2e97f287b02724ff17dea80e11497423efe426da79e9ef1aa096a2d5d1062c06ccadc5a28360a5867ff73cf3e0cb137ecb3c2643c85ecc8694b958b37cb151f4505fa0e134cbe807b8ba9176b555e5a705556c4e795d341ad0466e5753a30d1e19e48dc1b27d353784fdbe2be7898db74cb96ffd063902fb082dbade218ad874aedb75bc9b4bb1d3dc2eb186c3d3a0c6fe30fb194b048d93d9759a99f5b0f3a85b6636a7487c5bdecac1bb63758531a9055648452a944d62a76b2d5dd80c8ac21f4d32c548a8ee4f9d30b28d1362137cdd53a465f05ead8a9125f9ddfe43971f71a17f5b432a49cfe4f56a55676dad5e0a5c1985cba83f5178b287f51608306f05ac4849b0f5a5d08f317d198581bc83aadf0af0aa5dc2aaa87493edb0f88d474478164c9f7a5cfc0936f593a8c474d713855c919736d1e0852f4d1a701ffbfd076dab46c06f2cfd321b86ed31c39be94790f5f66d038ff2b59ec5cb3680f077bc9c0ce5698703b9142a36453432e1d072f213ce7ba4994e908bd23d1c7ec2934366eae615893c7f22c82c725d9c91a02357d916aa1833c6009271c566a8c3a1a653971c8921487ea19627ef443392590f25e8034d53a6f92ea7af2430bb4306049116d0c86bf44bcb2fea90323afca9e09c3b91cc599a37a6c0d4290fc6620cf03887820f1478d1879cce6228c47f1728c6f300669c8cd197c03cffb57f77417da9a330128f80beb0a206a55c58325f4e996367795a74244f56f5ff57a3e1fc73a9ac90ee44cfcff11c39f6c36c98c525669749bab4ab005d82d6edbb068ebc9100c49776262f80125c2c39b7b33b33b47e1536c6f34a3fe80c6568d082fdca814a18a61d8202a7d16d9cd704baa4d06bd36676df48a1b44fb6f0075b6039ae7e4894a72f112b1945dd7fb3082fed8dcf79baa344d20fc1388b8ba933bf80f1ffd4491de2821ffc70a209371b4c5fc90702920079bd4c18b50fed7b925151bc4d8ce7aa80728b2bf6dcc396bdce729fcf749e2d09cb56fc7975fe0c1b0aaf9b855648c6ed8e2d66665847980cb08d503dfb41c2869cb852571236c4232c7cca8d6f7e3b7cb27b47a34323b284f7287ca7b5feddc45ff23829edffeeb1e71a41ac716eac00579a0164f1d409517b10bf40280facef8bdf60f5eafa384a5a7c0a76a4b1ea6404748ff5c7d83e5b68649918ba86903fa587a832aa514231e81230effcb7c62c7cd3c9616515eaea8d1698999c4ab303d03cab2c655b5ddf9201e958821005f12c44aaeb455aa8dbc0375d33daea2bde0101a04882f7efc2f42cf4fb6ab07b1261df41eccf78bd6cdfa8d882f5caa6217284d58b367d4fb81bc40c5503f7fb977d766042fb5521be7421d4ae614b534f19c11bb7c919e0057051c5f6aa6aa3a6464a89c4a5f85ba8bcaad2f36e6ce2ef11443df8e82dbe40c06233a3c507dae3df0b59f88f017b07c5758bf06562cb8f23ab99ff4277647dc80d2d1dce96b749c8abbd58047e3219ae90faedd8132b059a9f30d2391ae3dfc37810f7c7aa0ec1686d570db45d230cb961a4d169a52876e0e61c5032b79dbdd2b9d232cbea992fc064484a394fbd9a744750da436431109091132057547d8ecc898a32462d2907c3a02dc7666c1eba6867274fefcbdaba9c3c923db22305bf5a8cd86df86260520d81140c64bcafa2fe37d16310a1877e6c91c74e422849406a9a2a12ababd838241a5643281d820a6cfc3fdfcb7ad7343921c6173302a081f822a01d43187a746a2306e9377c120ff30e214fa15daf85b6178305404f3c0b39aeaab73c8c4f750f0db4d0022f48fa9089794645c571883fe7c069e60a93dc5971c318d80fe33e0a4f9266b2e92522e057dca1abeba082a0c525335610993cc94a265136aef0a93300f59929d127a46d13a60c498a309b89bab4793478704f8983ff044fa511dae238896f83f54c94d65f519831a9aef911f88e264a17f194b4c5f3d238ff6498baa20614f460a5e8af8bd9a241e30ca4d7249618b1aea6793672edcc01ca3fdf3f2c226a15f08e7e13e3a582e498a215e9a5b3be5db6fe97b53f17de1ae6ce044236032c642d12d6570323c65d6eafb864cf46cb9e85ed140c5644b1efc16c0378e40d0b71ebde70b955567af77ef67b861a7b89d1274f162ce7f99c002c601154f7f4427e0dbc0ba402319071d2adc1f9e498eb4d41d754ce9cee7d3e416ceefe903abbbf07b9080e2e2034643b5f0cff26076b8092ee9584b65e770c4f91e6dd2a99cb3bb1c945d79c3d84ce298e01ed6109edb6d811e80690c77b14147e0fa6e3a3437abf8045c5057454771b2435868c27dbd6e8631492036d102ef8e377a4cf4092a47c31a025afa3dbe564050f27eb843f3fd8306950c073915c50b465123e225a65e4ab6feaeb4447612a4120c55b7c5511a3be5127f626716d8db8627a31fffd0e0b4162ef16096b324bf76ea565565a70d1bbef5fe14579f3866673689286bd27bd30557b33a6348dba8c08301b11cf3e779b290d81b34eed57d0f3fcaa26d03680ca3d5e0e4b1a3d97aadcb31c46367ab74e26a5de14dd3c5a1ac1ec5027b108cf5c4440fe6cb9f805859610c4b76dbe6f89b12abe4b634cdebfc930060f4ed7a2a2e193b5f60fd4bbd547fe502fda1a67ccf2e482437a011d9e9d1fa2410c0cffd2a2717fd71d40859cadf7674d894e1e8bd9b7881e5c646a493e8528f2eab4fc1b537c7eb5090bdf7b943cca02a6b33da8faea5c00da7ad61d38102d84ae10577c9d8d06dcbd2b8cfc3e2fd6a766d2e62434e3d9ff93fc830533594ebaf05a6e4894a0798e581b1c86da5b08684a14ffaff638d2e8426aa6d4b210ab8a4abb26ca6b6b2993875cf02b4d980eab485bce2676c868ffb7fecd99cb24527527cfbce5bf1ca304a7e78f6dbaa9b058848735188f6c65dc65f10b9bfd02b648aa639d9d9529d9a4723bec128f81232bb636f5e3689a95b05c7b64190e8a2dc029598cd03316813942e2334a35d3ab8fe06626b8dfc99d42063c44cd2a4ff2a2add7c67360f51622c55cbedf9871a89d9e5de454914f6ffd055ead749b3e22130c90f7168a07e7bc8297c36748549c84738da381a019dae5c1589db658bec6853e587c73809717d0cef408e80a991a0b4b86224f832e5471e0d1999c9311d31a2216532bf93a683e66af10b89bbf812a81e8bd72ea980d99bd410e842ba9ab9b0cc6469fd5a5dcaedda66fb60c9d94eaba22fb901b2beecaefe811653d7bca59112d072e01521cb060e24fee5f16a0b796db7e1e1da5331472359ff1e7eca9ad669fd8a7f79575d11ea1f87a31525900c98c2f7ced867f4397f8a25f8b1217d04373774b6e9c40ca4e17076c49299becfea0f4b5ddc4c9c016aab33746d00a7bc661305406de14a78f9de711704686392d6525fd294f09f36f2f6770bbf89969966daa28a59fac19e51ae443955fe59fd16c1ab84148434b0951478c974e63db6c16208525560fdaca7d2de5b4b8eea0afa6156f6812ea91e1dc9295f7acea16184b58d4c1030561b2767e4783fa5f6c5830922ce38158b492c0f85f4db4a26bef8df410ef595d16958ccc92c0e5ac424e4a7f418a21b6b719b3b3a7c62a2242fb11af892d21f8abe67cd44f950423212bf7513c11db41a0ace3e77347adc1a102051412be87339b2f8ebc7a4ce054f3c2663fded0da8db84bb586aa8adceca3cbe0468ae8171a06a09823eff789cd603c1199fe03c79bf8c90ba0c280abaeb3bcab96a3c280d971b7a6186de0f7388f02fb89bfc07cba7aa89b29d414269f309ccaf2cb16f2e38c2f4b31e701df145fa08c4102c33b4008954923e2cdb3201ee95e4c5dcec271962d3c9b8d5032de444182cf005eb2a816170f4a4825b75b8c88762986547e35afee90bc3b07a03a7863fc9ffa1420f01ac06ffb0985b61d6bfd4f472c34cb3ddb5c563840a3ea4915f9831fa42aca4f1e6f23431541977aeaaacabdffd8a20275bb229bbe40d0356dc92d6132b77193e97d80096751681e45477f234a668a19b85fcdac7322c8c85389cf780eaacc10e0dc3e12d813e88b51ba09061584bd795b5ebb7b83482fb7a6c6b78061a6c6d209eeb20d616bc1d2ee8d334fab501077fcdb08fa0fd93153359f3ab9a44905a54ba75797f05a9aa49f1eeb938145465dc91c91056b366d3758bccc37e04186468b74d19abd0919bf57c327c7bfaf03f58e1f9cb57d0c59a01ebfde042a1298928830e073d25d6abe94b571e6d5ee636a27a3fe10ba9eabe088e1ae6342c56e7194cf56116823a119c0e61e153589c03ae535a4a380697b45eed8180798648816473c93e2df9f07b5a52c1a1834fa3a95098b8d1907de20481a80b02a1612b333e4524dc8935b2ae64da921f22235cce3566febd79d61b0d46675d9ac06cbcf4ebc89581cfa37c534a7d18dd0675807e2b67da8c0e3cdb03ad99c295a80373b64931f125331bd6a62b2b87640ad83af62c876b2f192758ef30ed5ee6f518691c124e0c27c31bdaad2654ab34d783b7c90d4da53c1d4e0bf8e67055eba745bc2fe998ea34b90481310f348f3471ff75b8ce713a8c19236d689eb796d25db773b0cbe99c06f3618ab1d5cca4671d6bafc0a4a2e495e54d995e9c1904f21b75298ee02c2ddc234e12ddc8d43e4698a35b8eaa0d0013d134747f0ca5d2710e870d9c8c02e59876143998a3f4d2465c66ad61e3373c81143026d5bf737fb2a76f79240bc18d5d53ebf29bcc080ba368e94486322850e7"}, {0x30, 0x115, 0x4, "c670c612bd8a8e10f89c893ce3cc6bbbd07afac655d104a89a"}, {0x30, 0x6, 0x3, "9aa9b02b198b0d470db2e3af1220b21971641d9c0ce127b48a"}, {0xef8, 0x115, 0x6, "bd019a9081f1788d058802a530a83c43a7e0928d5db905a20e28d459f0a860e5c34b2b1e8445c6d7d02ed3bd5cd7c0138700b643f21d52e5d54fa2683cfffb9d7bac954fde6d9557ba9110a2d5419b5071eb90875fbff37d7c783d038677be0bc8783facadc5037a1a1b649b8ef7e2508ad33c066fdb061faa3d838f8a2288699498bc4bb007c346f727ace463d06afc3f214e6cfec7657d86cd3d693cae3a84a1d414e885f0d6e4f23f7aa7eadc10211691ed108da61c9f4ba298073eaafb2ae7ef3fd0bed05dd32789676ac715d5689685f8ea5d67e1b0d4859eb6ed8a97de4e9cd657a68d840d72ef59137c88a26074853362c35c6a0a1def2d89c32b3532b95ce603be6662e036d8e4e2bcef830816dc24beec5027de8cc202d9c03defa4a142a0fe4952a4cd378ff777d544f3defea152a09f02702eb15c3c109960855ad51ca8bab7a96784d6fa83bd3fe32b2725dfb66d89d4991dc2eaab37fbc47189af58e0a8f17cd1418aa33c58de339d12b6fc50c26377d250205639b2a686dd53a6757a82c39fc59f09def68711bb31bcf8c90abbc069d635818341d051cb6e2192117f05dfae934f1a8cc19ef3ee83072809f18097469578c98724c7404978292509ac633a1b8748cc28c6e71a1c73d0682d87e32c4d7a6bd43b5b9cde47227a3b08947ff7faf4e4966dfcb2ef852e8bb095f83c040771bc4af4038a3a524815df272ca2dce8682b977b42197c5ff83e3e5dc4d04745988a311e64e81b162527ada89e88f14aca62443b18d711b20a0b0071a0ad1fe4fb55f9511b05bfe3f7d68d10c105ba10668dcabe3d64c4230dde9f77afdbdd52bb63df8304c4dd6c66e829bf70385f02629ea5c58fdbe03808196941e53e61f61edf6a5ffc2c003e19615ee11bd4072a4ea27ff413958a679964535cb96c9f16849aefac4633870c59ac688e18e82856c090c691261612ed1ce00c2298dec5d32c0fc757904815b2f94c7f68b69e459bc1af932d22b3be239902fd620f1c3e403b31854fb85009a2850768247938ebf0947193801fbe6c4843619c897492475d777bb2d3d638612a09cf5fc57d7e2cdaec63fbc59bed664a735fa6cd37b949f887b3ce308281c37789df2e7d2d82a0a519c01499882cfef07fbcada592fbf0d2fa9fe8e3f10562a89059a7d6c8463ba3f16d445364988e61436b5bc0738462241a847df7470190fa56c63b867a6e414033f13bc466c0b460757dc54d7d5c8887e1ee61a89e5019d0dca95b0a402f9006c4556f62d7d170f31c1702b182bad6775800ffbb04acf50fc16f80fc167016069a5b95726a8616b2347e8c1ffca1bdc273837a71c921db8376cb38edcb895b9715b7b203af6f7cb3c5af48cf2a191618ebe205cde0c8399c763f7877e5d3bb04e0450f7cd6c90c3b5f7ed072e039a1c12515f5d4507189db69d6721c8f5441daad92077372ca26e53132d9514515c5c153b6eb208ddb36df749968533071d5d04153db94179d9d3648f10db5605ad01b11edfb6f356773206bbac441258af5e5b6910ce596e08a903341eea013cd4eac603c6247dd9eead676239387634f6cca50b1ffbf10c36088399423ff56c2b4daca6510a0ac81d6d988222563d66ea753ea25297980b00224dbdd1afcb75f138c5bbea68a6796b467caa928c3b73dca3d0522be3d20c8d003ee61e630d8f4c2d16a7adf993647f37d9b5d3efc585ba3206019490a4da959e39de00c1e2c2d8079767f16ae30b0ad9614239164a4324464bb6ad619626a2fd300ca9c31e484ea409ecff256af5ed665e8c80ce85a08906252eca61beb625ea6bb76f90afa54286ee975e998bc887d1f31b19b8ff08bb08671e7e30dd34cffd0e271fc78706fb21102c7a293e5213f233eb01686ed4c4b648da56d1b2ea1afb681084339d46ce86d606864e31ef70a946093076b1f40a83b105b01fd3443e95e351df0ca41ac47f47e1fe18141d43bea6867115182f768cd9adffe99ccab72559535c8b85fc641a1f2d3091b7ee259927d83b4e342f20305fa9f110b22f5f7f8d3256a9b481962e5c1821a063fb0c326c929e8619e1a34f6c2a53e4559eba868fa60aabb59e1e3840ec1c1e75a6679368cf9ea4d4dbd3344cfe6e1ed80a1a3caad17d5131e7aa99c64bb26dbc55879f14281c6b2a2fa8b849c33425cdcc5100ae374e7088a18cb04e6cd5d703dc6e6d571f463c49455eb3d259b799907383b42cf7a80c5a906a49c6876b4c4d60ce8750f5ae9e14b2b7493561143795df15d9fa10f23f6c08f0e707a8279be8cb77c198df424d38e164695ff68dcd6ae45dd3bc739e44c81e401fcf1fb7b8ed96b225df89e71213c177d89475ab3f91fde0a84dc751c72ac52137aba964f34003fccde105a77ed4354abf732ffb89ffb09728dd46b23c7b1909f63415ce7eea90dcc6e1b66adcdeab5e4b296c1422bca9f38fcbaed293f2352f4ff5bd345ebc730c4308b20c4802a0034cdaa383a41985c8a5514a7f5a2ac61498e027570498435096d74d6da8c50e9b8afbf23f846a4965c675328b19ea764cbf5fe7bcd79a4cf42ab67217140642e382b1d2fd8aa1996aa84b57e138ff114cf62bc3c4aa949b5cf506560de24f8ed6a5f073f8f172e05e0e83fab8ccd66356c13624968f3d833574567aef87dff50f2605c219e6421eb5d388f86ff1f27b684300ae900985e2b650eec62c9d5d8316b72e3d5094edad93b05cff416e191ef287f50eaee991a5f024934f2fc0abef7b7a01f27b17dd5b0f64de654944b5a2cc20c5f97e2d697069dd220dbd743075accb0be425a1b31936b028c0c31ee7a32a962d1774383ff068aa063cc3eab378c1f8fde5a6c11963a855a6653d823476ba227a0b453b924f1ef07d8c88b3894af66432e1381933f7c2edd93de7123a5b2ce7a32d92937f767bc25913b8a4fb8db5a8e9b3dc126644c383d0c12ddcb2147b347eddf17321092cd367da0cb614d25589e489e2acb4bec807c683a74fc9fa18acf1a2d1a5570a8f72269065e2ec8f2ba0846a5a545b9e83e3aba4fb78296ca55d82eba91db2b07c1cf2df34a937513f3aacb838208d19a6d34896d2873db7ccdd3e99899df5bc24e4a5fb8d6620d05827f9194644b8b78fea35857e9bc99cc67312399e53e3552ca83420a272261a1c1c1743c6e911b7441650c052858270956bdac3ad0348754f163a0fd2e6e05f7bbf0bd857162620a8a6616803eeafe4a06d9252e8e6c51621896b5dd411c77f363d42659534fc2967ec373fc903dc93412a79f15022ba00cea494440ac5cd88a65643b7405f3d730637613ba7aaea2addab661e0288956287dc35dd09307cb56155d802821af8f9be8e1de734278c296b35b14b9e8ae01545af45343c7c4e6585149f31374beebcc0f4a4b1ba4059393e8b984141e4a15fc94a55c2c8f1bb1cef672080664aa72d58c764d40833ca74476b0e7162dcbbea0ebd3956792206146dcd41379afc8e53cab8ef6ec863c977918e5c8f9873c7fe2bd655250d5e80d8b2dc452c1fd0729938a5a0941294ed8e6d1ccaa75d5cdbc80822ec8d5da008a927c3a93b589ab0dc25ac058b7dfbf5e2e760cdbab1e8cc16453be59128afde1b6ea2601d6ab631d47b0feea49299c4839ffc26c092fea555f699f9e4b3f989795e4d1e9fa3134be0b0f7656752f268e82ec36dc7ef804f962d1c7425166b23ac23cb910cdf2bec3dc83e31736f4db736e7db511d4e145a17ea3c0a96aabd62728d9e16f954c282a2f31edd3c4666c77b4d283231c4a6b25a7f2a186d56b5de1ee2283f6453a82964d39a1b839f7b1636415e4521f39753d3f0c091619a1d06100e2bf4f11e178b83e1d530e096432c2eb15f6022dcf1f70dd5e1594551a4e2f52815f8b6e3f4025bd1c78b509d36bb362645b7ee49d290eeb62b84d54d49f62cc909d502d7ea7672ab50b9cf149b67d586666d22c95e56d5b0db9792e19ecc5e1ad08a03ff7aa04bf08ac1642cf24ca49e80ebfe714e0b5e7cbf209116b8a3d0afb74ffda9a4b5e97c575a5c7a466a2ee52910cba2eb889af6faf7484e4351e4a73aabc4de05a0f83c8e747813c65fc419c62e79e3a4321dc7238c159526bced643a40e6523a3dc1f4217bd3aa7740b3acf79f771c0ec341478752d7f213ff6dc180df82910229c891e055b01840d0bbba483631ecf90aa131197724c41c30879c2950c74cfc8112521eb7c58916466155bf77837bfe2cc12327096d5ce4a8a1435080a77ecbaec8027aa30395baee2170c0573a9b8543cb96379a44525843aa9d56c62e38e0fff9b61b0f8d1907ce3d97c78b37ef83c4753fd4a732e12aafc592d79df81f57a2119ea04a6006bb165ddc67602277b768cc1255afdeb2adcaff80d3bcfbdee3e734042d533336044710fd7a6e9d4a757cce1c68e4b7fc72ff91e28e64696653b7ae370c8675343426395564e56dbd9a1be624222fad27f1e1be7679d389202588bd1db5d81eaf59aa5ce99afad3e50790345bfe162fcd23f09f00cb97328a57ef8438bceeb5ca6b0c1e313f58cf02d0a846d516157c2b3becf4775b55156dd926d2ef729cd6627b531852ed46aeeb97046b4e6cb55282fb98c40f7cb8cc55fe911feff0635fd4245fe5c97592554e31262de21ad809c973c9c049a034bae2b4ea1765b1bb29bf689e8508d278c9b58cb4f0ca478c99aa1f27cc698cb8995f7b07a65a60b53d761d49611502fa7aea16558802e7f59c04f9a03e63d52e44168a133a939da63d057de3e14548b1f6de7fd29d6f8902907d2c31002ac28d3687b0f8182ed627f943545875f85fb13dc7bd396889ceaf680400823119df68e4d85dd61c60f5964c9f64a6803f527844d73b84057c3e46eed7533a5a1429889488aae11c9ba64a80763742d5c811974a1e02e2e67f30052cf91c4fa358ecf436d4a3d8e4d5498e39427af006ba95c538c99fe6fe066b88220d2f68b742a3d398d92969089cba305fc9c3bf45cbaee3c4cb294fe8a732d86573c3922176a908236777f9c81e37dae04a9a2f84188fe221a3fd662b30dcd68f45fff02aae69a9b5b6369f171f721d15bfe0807d8bd11024877c3c3acd63de12122ebe9cc1a5aa794698de67f2b5fb8b56f31b210ecb1fb9c95a55a9722dd1f895592871480b66fad7ce6988b86f161ba83b69c8c7a5fa6cca4c3627ecc6191913f319eb4d9647d08579ded818c43ea6231a5e6ea879f1e0ac4119f86210c458fa5a643753ec5e4738be7f8822cf718cf31e6427c472c6d309f5790d75706e470365d935642c8afdadc5b119f305a549612f55a5084e4aa1c0f09a0d16f4e6b62b242976809e2ef55e525d04a3de8a378bb77c42523d77c890795db4f6a2ea0d83c"}], 0x2008}}, {{&(0x7f0000000500)=@rxrpc=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e21, @multicast2}}, 0x80, &(0x7f0000001640)=[{&(0x7f0000000580)="f5", 0x1}], 0x1, &(0x7f0000001680)=[{0x10, 0x3a, 0x60}], 0x10}}], 0x2, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), r9) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r8) io_uring_enter(r5, 0x3516, 0x0, 0x0, 0x0, 0x0) 7.709809896s ago: executing program 0 (id=2709): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="3800000018000100000000000000008002000000000300090000000006001500049581d47735f8336568c43c06d2001680100008800c0001"], 0x38}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000e9ffffff00000000000009000000108500000000009500000000000000"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="4000000010004b04002835000000000000007a00", @ANYRES32=0x0, @ANYBLOB="181401000040000014001280090001007866726d000000000400028004001a800800040020000000"], 0x40}, 0x1, 0x0, 0x0, 0x8800}, 0x40880) (async) r2 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3) (async) r3 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000300)=0x14) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), r0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=@deltfilter={0xa0, 0x2d, 0x20, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x1, 0x5}, {0xffea, 0x4}, {0x8, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x1, 0x7}}, @TCA_CHAIN={0x8}, @TCA_RATE={0x6, 0x5, {0x2, 0x6}}, @filter_kind_options=@f_fw={{0x7}, {0x54, 0x2, [@TCA_FW_ACT={0x50, 0x4, [@m_bpf={0x4c, 0x1e, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8, 0x5, r0}]}, {0x1b, 0x6, "31260c1ee78e2723eef009e7370cafac8c587f41372d39"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}, @TCA_CHAIN={0x8, 0xb, 0xc0b1}]}, 0xa0}, 0x1, 0x0, 0x0, 0x840}, 0x4004010) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000004c0)={'vxcan0\x00'}) (async) write$binfmt_script(r3, &(0x7f0000000240)={'#! ', './control/file0', [{0x20, '\\%'}, {0x20, '\x01\x00\x00'}, {}, {0x20, ']'}, {0x20, '#! '}], 0xa, "365f2490c3e2a283f32e2b697cc07c2f7c1662712b1aa3dd581d5e84a1ef46d10b7a6e967d46c6e1cf7598397c8f23e59cf56e268f16c8ee276da12d53cae7074c21df5ed1ac77d5e1f2d069807ed20db3"}, 0x72) (async) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) (async) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb0014"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 7.632020855s ago: executing program 0 (id=2710): r0 = io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x1ac}) (async) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) (async) getsockopt$SO_J1939_PROMISC(0xffffffffffffffff, 0x6b, 0x2, &(0x7f0000000380), &(0x7f0000000400)=0x4) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe001811", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r2, &(0x7f0000000080), &(0x7f0000000280)=@udp}, 0x20) (async) bpf$MAP_CREATE(0x200000000000001d, &(0x7f0000000b00)=@base={0x6, 0x4, 0x70be, 0x5c, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000340)={{0x1, 0x1, 0x18, r3, {0x1f4}}, './file0\x00'}) (async) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x3) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x2000004) (async) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000240)="00214717a70700000000030640710a069d317ebbaaa6", 0x16}], 0x1, 0x7, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) (async) syz_open_dev$vim2m(0x0, 0x0, 0x2) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) (async) r6 = accept4(r4, 0x0, 0x0, 0x0) recvmmsg(r6, &(0x7f0000002040)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000540)=""/242, 0xf2}], 0x1}, 0x18}], 0x1, 0x101, 0x0) r7 = io_uring_setup(0x2a42, &(0x7f0000000080)={0x0, 0x4f0c, 0x100, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS2(r7, 0xf, &(0x7f0000002700)={0x2, 0x0, 0x0, &(0x7f0000000200)=[{0x0}, {0x0}], 0x0}, 0x20) (async) io_uring_register$IORING_UNREGISTER_BUFFERS(r7, 0x1, 0x0, 0x0) sendmsg$TIPC_NL_NET_SET(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x4004}, 0x40) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) (async) getsockopt$SO_J1939_PROMISC(r6, 0x6b, 0x2, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) close_range(r0, 0xffffffffffffffff, 0x0) 7.601999566s ago: executing program 3 (id=2711): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x1, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x31}}, 0x1c) syz_emit_vhci(0x0, 0x7) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x7, 0x0, 0x0, 0x0, 0x4}, 0x94) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000340), 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00'}, 0x94) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b05, &(0x7f00000004c0)={'wlan0\x00'}) keyctl$read(0x1f, 0x0, &(0x7f0000000080)=""/61, 0x3d) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r4, 0x404c534a, &(0x7f0000000380)) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000400)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r6, 0x0, &(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x800}) ioctl$IOMMU_IOAS_COPY(r1, 0x3b83, &(0x7f0000000040)={0x28, 0x5, 0x0, r6, 0x3, 0x9, 0x3ffc}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, 0x0, 0x0) 7.195943245s ago: executing program 0 (id=2712): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'ipvlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@delqdisc={0x24, 0x26, 0x1, 0x60bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0xf, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) r2 = syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f00000003c0)={0x2c, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000000)=@gcm_128={{0x303}, "fb3009d256743a52", "79c0e1ae3ece162614b080b430270bb4", "6e848969", "43f22bd1f862d54f"}, 0x28) (async, rerun: 32) syz_usb_control_io(r2, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.522925623s ago: executing program 6 (id=2714): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000000000040580411500000000000010902240001000000000904000002030000000921feff000122050009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0x401, 0xfffffffc, 0x7c, {0x0, 0x0, 0x0, 0x0, 0x15703}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ES={0x5, 0xa, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2004d099}, 0x0) 6.350573726s ago: executing program 3 (id=2715): pipe2(&(0x7f0000000300)={0xffffffffffffffff}, 0x0) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0) syz_io_uring_setup(0x23c, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000180), &(0x7f0000000040)) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(0xffffffffffffffff, 0xc04c5349, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r5 = socket(0x15, 0x5, 0x0) getsockopt(r5, 0x200000000114, 0x2710, &(0x7f0000000600)=""/102388, &(0x7f0000000000)=0x18ff4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)="5c00000013006bff69b27a417d1027869ea32ecd9e3fe3dc6e48aa310b6b8703100000001f03000000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84d005d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x68}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4004805) r8 = socket$inet_tcp(0x2, 0x1, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c0000000206050000000000000000000000000005000100070000000900020073797a3200000000140007800800064000000000060005404e2000000d000300686173683a6e65740000000005000500020000000500040002000000e7220703c58ebfe589a41afb1d323bdaa27f4744eab310faccff2cd1158265ec530e55c4a4811a05139f27da51b0d41874e9befeba71abcddbc191dc268cfda04450027929b43adff1335a047d3ba55ac42d896c5314ffc6ee8a166af36b6409ea336ae45a46d7691edc7417551446b976158c83e32a75c4a65e0e8d"], 0x5c}}, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast2, @local}, 0xc) setsockopt$inet_MCAST_JOIN_GROUP(r8, 0x0, 0x2a, &(0x7f0000000500)={0x3, {{0x2, 0x0, @multicast2}}}, 0x88) 5.635899923s ago: executing program 6 (id=2716): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000106161154d0000000000f31016018d17d2ff000009040000010300000009210000000122f804090581030000000000e2dcadd7225cc0887be37560b70d"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x50000) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00030200000001f1"], 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000400)={0x2c, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1003023100000002"], 0x0, 0x0, 0x0}, 0x0) syz_open_dev$video4linux(&(0x7f00000007c0), 0x5, 0x20040) socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000040)=0x7ffc0000) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r5) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) close(0xffffffffffffffff) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newqdisc={0x64, 0x24, 0x100, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x9, 0xb}, {0xffff, 0xa}, {0x0, 0xf}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x38, 0x2, [@TCA_TBF_RATE64={0xc, 0x4, 0x51cf8d4f258ee1a4}, @TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0x1, 0x1, 0x6, 0x40}, {0x9e, 0x0, 0x2, 0x401, 0x1}, 0xd73, 0xb29, 0x983}}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x24000011}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8922, &(0x7f00000000c0)={'syzkaller0\x00', @random="2b0100004ec6"}) sched_setattr(0x0, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) 5.23558309s ago: executing program 3 (id=2719): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="0003230c1100"}) socket$kcm(0x10, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) r3 = fsopen(&(0x7f0000000040)='smb3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000940)='fus%xlk\x00\xf3\xb9#\x80\x81\x97\xaa_]\"\xfd\xfbz\xb7A\xc2\x1e\x89\xbc\xfe\x94\xa5\xf2\x16\x88\xa0\xcfy\xdaF\x9c\x9dX\x01\x00\x00\x00\xe7y\'=.\xee\xc5\x9b\xe7$Wh\xa4Q\xd6\xf9w\x99\xbcWh\"\xaa\x84\x0f\xc8\xb6_2m\xa1hJ_\xb3\xe0\x84\xd6Z\x8f\xfdhez\xcbR\xbe\x06C\xa85\x19\xe1+\xbfnY\x8f\xacX\x11jx\x16\x7fV,) \xa7\xbe\xad1\x9a$\x0f\xe84\xd0\x19\x82\xdfy\xcdn2e\x1e\x83\x87m\x86l\n\xfay\x95\n6\x14\xba\xf9_\xf8{)P\xd1\xd3P \x8dN\xb1GF\xcelO*\x9e\x81\x1a\xaa\xa6K\xf5\xa0\xede\x95\'\xd7\x88\xce\xf1\x80m\xca\xd6T{_\xe5\xcc}\x8c\xe5\xd7\xbf\xdfo\xc0', &(0x7f00000007c0)='\xde\x17\xdffS\x1d\x84P\x1c\xe6\xb5\x808\xcf\x85\x13\x1aL\xe3\xaf\xcbV\xb6\x9f9\xd1\xb9\xd8\xc3\xac\xf5\xac\xcb\xc5+\x80\xdd:\xfd\x1f?\xb2\xaa\x01\xce\xfe\xa2\xaf\xc1\x8d\xac6\xc6#[\xbc\x1f\x02\x00\x00\x0065\bz\xb5y\xee\xb9\x89\xc2\xc9U\xfc\xf1\x15\xdc\xde\xc2\x99\xa5!\x06]\xf2\xc33\x9f\xe3\xe4\x98\x91g\xf3!4:\t\x12F\xdae\xa3/\x9es\x14p\x10\xf4\x1d\xf0p\x9c\xdaX\xad\x97\f>H \xcdE\x7f\x82\xcb\xa7pAM\bP\xeb#U@VP\n\x06\xc1\x12\x1e\xa5{{\xe0\xba\xab\xdbb/\xc3C\xf4\x85\xd3U\x13\xf1\x8a~=\x98\xaf\xe6h7Q\x10\xc9o\xb8G\x81Y\xc7Q\xe3\x99\xfdZe\"w\xb7I\xae\x8d&W\xd4\xd5\xb2\x9a\x83\xcc\x03\"\a3\x13\x1c\xe6\xdd\xb5B7x5\xa9\x95\x8d\xceK0C\x87\xcc\x82\t\x87\x8f\xe5\x06\xfc\x06B:\x10\x85l\x92\xe8\x85\xe7\xa1\xcd\x0f\xa8\x9a\aU\xefR\x82\x16\x18\xee\'\x1b\xee\xa3\x96\xdc\x8c\xc0\xe9\xdefK\xd2\xa7\x97\xdb\x005\xe97\xe6\x1a\xe5\xe5\x86a\x9fb\xb8=\\\xf5t\xb5\x9bq\x01614c\xf4B\xee\'l\x1f\xbd\xbe\xdcNp\x94\xa8\xe4\xed9R\x04f\xf7\xee\b\x9a\x95i\xa9\xfe\x93\x04\xb3\xf5J\x018!zx\xe2;\xca\xee\xac\xa6FH\xd8\x1f\x839b?\xdd\xd5\r\xfd\xe81\xfd\xb1\x95\x8e$\xc6\x1c\vP\xcf\xa4\x80', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000140)='{:\'@-\x00', &(0x7f0000000180)='%*.\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f00000003c0)='\x00', &(0x7f0000000400)='(!\xef(.(\\-]\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000640)='fuseblk\x00', &(0x7f0000000100)='fuse\xb3sk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000200)='^,/\x15\x02\x00\x00\x00\x00\x00\x00\xf3\xa3Y\xe1\x90\nJ\x9c\xb7\x0f\x85z1\x80&\x04\xe1\x99\tmi\x1b\xcd\x9d\xf8i\xdc\xff \x02J\xa5\t\r\xc8\x1c\xed\xcd', &(0x7f0000000a80)='f}seblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000280)='\x1c@\\\x00', &(0x7f00000002c0)='\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000780)='g#^$\x00', 0x0, r2) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='(\xed\xef(.(\\-]\x00', &(0x7f0000000080)='\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r3, 0x5, &(0x7f0000000240)='fuseblk\x00', 0x0, r3) fsconfig$FSCONFIG_SET_PATH(r3, 0x3, &(0x7f0000000680)='\xc1J\xaf\xfd,\x86\xbc\xa9\x02\xf2\xf6\xe2\xcd\x9f\xf6\x83\xeb\xba_6\xfdR\xd0\x8d\xc1\xf6.$w\xab|*`\x11H+^\xbb\x8ar\xb1\x8ec\xec,\xd5\xfd,\xce`\x9f\x92\xb4\xbe\x06?\xaa\x16Q\x94\x15\xbe\x80E\x9c\x93Hq?<(+\xceb0\xcc\xad\xdd\x1c\xee\x19\x1b\x91Z\x85\xb7\x04\xe7\xaf\xe0W,G\xc8\xc0\xbcR\x90\x17\x19@m\xa5\x19\x16i\xc8\x99)\xa5\xb0\xba\xbc\xe0rV\x06\xd0B\x0f\xcdF\xbc\x8e\x8a^%8k\x849S\x15=kxS\x1c\xc1\xdaT\x9c\b\xb6\xd8\xa0st~\xf1\x93\xb8\xba\xa5gV\x18F\x8f\xe4b\xdc\x19_P\x81\xa4\xc3\\g\x11\xd1\xc8 U\xba\x03\xc9\xf17\x88\r\xb99]\xdfM\xc8AQB\xc3\xf0\xf7t\xee\x95&w\xc3;', &(0x7f0000000540)='./file0\x00', r0) read(r3, 0x0, 0x0) close(r3) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) personality(0xb) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000001c0), 0x13f, 0x1}}, 0x20) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) 4.884684448s ago: executing program 1 (id=2721): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, 0x0, 0x0) connect$l2tp6(r0, 0x0, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b700000018000000bfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff0000000015040000000002000f040000000000003404ffc101ed0a0065040000170000801f400000000000007b0a00fe000000002c0400ffffffc100c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3cea8bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abbef9fc92e3eb9560934de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc8de9bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e}, 0x48) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents64(r5, &(0x7f0000002f40)=""/4098, 0x1002) openat$fb0(0xffffffffffffff9c, 0x0, 0x2100c0, 0x0) r6 = getpid() r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r7, 0x5407, &(0x7f0000000100)={0xa, 0x7, 0x3, 0x6, 0x1b}) ioctl$TIOCMSET(r7, 0x5418, 0x0) r8 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, 0x0, 0xc804) ptrace$ARCH_MAP_VDSO_X32(0x1e, 0x0, 0x86f, 0x2001) close_range(r8, 0xffffffffffffffff, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) prlimit64(r6, 0x0, &(0x7f0000000000), 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, 0x0) 4.606375903s ago: executing program 5 (id=2722): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000002380)={&(0x7f0000002280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000002340)={&(0x7f0000002300)={0x38, 0x0, 0x800, 0x70bd28, 0x4, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_TYPE={0x5, 0x4, 0x2}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e23}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x20008010) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000006c0)={0x0, 0x6fbf, 0x0, {0x6000, 0x5}, {0x51, 0x2}, @period={0x5a, 0x7, 0x8001, 0xee5, 0xff, {0x8000, 0xff, 0x6, 0x8}, 0x2, &(0x7f0000000140)=[0xb, 0x2f7]}}) r2 = syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x822b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x12d8) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x6, 0x0, 0x0, 0xf, 0x400009, 0x8, 0xa}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r3, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ip6_mr_vif\x00') read$FUSE(r4, &(0x7f0000000240)={0x2020}, 0x2020) pread64(r4, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f00000001c0)=0x1) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f0000000040)=0x5) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x66000080) socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc010203010902"], 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000000540)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) r6 = userfaultfd(0x801) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3}) alarm(0x8000000000000001) r7 = syz_pidfd_open(0x0, 0x0) setns(r7, 0x2000000) syz_clone(0x16040000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 4.119883846s ago: executing program 0 (id=2723): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7}]}, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000002c0)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x80, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000180)={0x0, 0x9}, 0x8) sendto$inet6(r3, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="000086dd000311000400000000006eec00be10a42f01fe8000000000000000000000000000aaff020000000000000000000000000001330022eb"], 0x10da) 4.032364477s ago: executing program 0 (id=2724): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r1, 0xfffffffd, 0x0, 0x30, 0x0, @in6={0x1b, 0x0, 0x40000007, @loopback}, @ib={0x1b, 0x0, 0x0, {"7d0300"}, 0x0, 0x0, 0x2}}}, 0x118) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc)=0x4, 0x5, 0x4, 0x0, &(0x7f0000048000), 0x3000000) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000380)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_GET_HW_INFO(r2, 0x3b8a, &(0x7f0000000180)={0x28, 0x0, r4, 0x1000, &(0x7f0000001540)=""/4096}) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x73, 0x86, 0x40, 0x20, 0xc72, 0x14, 0x39ac, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0xa, [{{0x9, 0x4, 0x1d, 0xf3, 0x0, 0x71, 0x6c, 0x75}}]}}]}}, 0x0) r6 = syz_usb_connect(0x2, 0x5c, &(0x7f0000000400)=ANY=[@ANYBLOB="12010102c05f560882052001cd9c0102030109024a00020b0b60090904100900800c4c03090403050290c6a1e0052406000105240001800d240f0109000000000009000006248907000509050110200004000609050b0410003a007f98bd25e5c6c4f443de6f26ed2c96123e8b92fbf021fc4bc235f824a7666e3c"], &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, &(0x7f00000001c0)={0x84, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) 3.615888338s ago: executing program 3 (id=2725): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000380)=[@assoc={0x18, 0x117, 0x4, 0xf4}], 0x18}], 0x1, 0x0) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/73, 0x49}, {&(0x7f0000000200)=""/83, 0x53}], 0x3a}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r2) sendmsg$alg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004015}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYRESOCT, @ANYRES16=r0, @ANYRESHEX], 0x38}}, 0x0) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000380)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) syz_usb_control_io$rtl8150(r3, &(0x7f0000000140)={0x14, &(0x7f00000009c0)=ANY=[@ANYBLOB="2010fa000000fa0f70dad50526d71137cdb4d4bf53a7d7853cbe56e3803b02754be51755d4f53bf9a873f9abbfdd6a3617ec0c4fffae1fff4d779115ece311336e191deeb2f53c9ec62b9d7c6d903972b306ec1ed01f661c7654e9d0bb494da06880799ae189bf4f8824ab450c04faded3529470f3cbc606ca6b2a6b0e751ac4e808a3d1faf3fba3d67e242d7c6e6c08ad0f977b9ed8413ff72cdd37072031047254bd36ca08000000000000005b5e028dc393f458207983f9bd4987dc3e5d9eb1e7d9126d0985262041675d025ffe890572028bdfeb1516d9286cc63c7dc242b5e5cf73c6179acc242a8aa8e878104eb2cfdb5b97cf22743bebb3d8dd791aa7dbf5435dae107dadf542a282d00caa51422e181c6a750d1437b1a605ebd361e7fc7b21007378d9e72556daa3727f0e3b3a7de884ab980356ae553b7bb93cbc6fba9fa2671b2dddafc76a198ef08107c98fbccadcdde7786308e955ad3e3c565e999a719b01dbef1258e8c95d5be5e85e554fa1b9dba3e90a657003055b423c934387eb72884cd77c97ce23906eff32a139293661b0219e0393d9ec17a0be7195f22a3e21fce4470d787286ff202bfc8775826e3fcc303714b0e57a414353e930c76ed6728dd9b7eab47645e2aa6d0b44e20d429adf53c0e14ad15953dfd3f84cbfe3e0514e9e47fbcae4e5677ae2cfaf3a76ef8c911d8c916a31f61bff9ff405"], &(0x7f0000000500)=ANY=[@ANYBLOB="000e22e2030410010004357ef6113d5192ead5f36442b747a5b940d7e3e3c4d75175bcbff4e4"]}, &(0x7f0000000340)={0x2c, &(0x7f00000003c0)=ANY=[@ANYBLOB="4006a1000000a3f849a1fe8e0ea8f894282d5924a7501a57b469e44374fffa638c1cd9d0142f45b7395b54c7fdf36d11381e4255d83b0c31bca728ed186b21a0b84a1cf57fbe46929565234e85dd8857de4d70da8be8ac356c71ee530ee76afe1f1c349ba8862947926c7783a8b15f5dc95e894f6942ed9ba756a83720065572f8ca954698b0be13874f0e17b17b554be56c3546591d8f0005edc7b153e51e51cd2e345e8f72c0"], &(0x7f0000000240)={0x0, 0xa, 0x1, 0xe6}, &(0x7f0000000280)={0x0, 0x8, 0x1, 0xa}, &(0x7f00000004c0)=ANY=[@ANYBLOB="c0058a343bf90000000044fa7861a4b6076d978c4ec8ffcc0ffe48ac1e63a9e7f5878909d685a95a83e40615968f001d0000080000039e871badd13de7"], &(0x7f0000000300)={0x40, 0x5, 0x2, "a23d"}}) syz_usb_control_io$printer(r3, 0x0, 0x0) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000000300)=[{{&(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x1, 0x4000000) ioctl$VIDIOC_S_OUTPUT(0xffffffffffffffff, 0xc004562f, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, &(0x7f0000000900)={0x0, @bt={0xcde, 0x190, 0x1, 0x2, 0xdd9f83, 0x5, 0x9, 0x1, 0x2, 0x2800, 0x722, 0x13, 0x7, 0x7f, 0x3a, 0xb763599953cb0936, {0x1, 0x6fd8e84b}, 0x3, 0xed}}) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00000008c0)=@assoc_value={r6, 0x1}, 0x8) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/tcp_window_scaling\x00', 0x1, 0x0) write$binfmt_elf64(r7, &(0x7f0000000980)=ANY=[@ANYRESOCT], 0x219) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000200)={0x2, 0x1, 0x6, 0x74, r6}, &(0x7f0000000480)=0x10) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000900)={0x44, &(0x7f0000000700)={0x0, 0xf, 0x1, "b0"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r3, 0x0, 0x0) 3.401963722s ago: executing program 1 (id=2726): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000050000000000000000000024000a20000000000a1f000000000000000000010000000900010073797a300000000058000000030a0104000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c08000140000000020800014000000030080002400000000308000140000000120800034000000000080003400000000a"], 0x122}}, 0x4008090) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @local}, 0xfc, 0x0}, 0x30004001) sendmsg$sock(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)=[{0x0}, {&(0x7f0000000180)="89bf", 0x2}], 0x2}, 0x44850) 2.644295693s ago: executing program 6 (id=2727): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRESDEC], 0x0) open_tree(0xffffffffffffffff, &(0x7f0000000040)='./cgroup\x00', 0x1) (async) open_tree(0xffffffffffffffff, &(0x7f0000000040)='./cgroup\x00', 0x1) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xa) (async) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xa) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/pids.max\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000000), 0x12) (async) write$cgroup_pid(r3, &(0x7f0000000000), 0x12) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="00002cbd7000fedbde250100000067fd236327e07b0681c752762000b38f57a204a22648f606a6356e547edff45172f9ae50d1ff30bfb86089698fce8c21396be84cbdf2faf9959a5a4a06f7f1f2195d416c833ccf08013fce76dc8db8ff78e32c409b217c537af4e39520cdc5803dadd9f6f031690694db57f5a10fd4b05b1515bca47dfee5c537e702e920ddefaaa3ec521164957e3e7fa29b1e2e2a7d1c76be7bf20ca2be3ae4f94162f090d4dbcb4836b8a789750250667f09ff23052945d49aec7f"], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x24008010) syz_clone3(&(0x7f00000000c0)={0x200000400, 0x0, 0x0, 0x0, {0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, {r1}}, 0x58) syz_usb_control_io$hid(r0, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000040)=0x654a, 0x4) bind$inet(r4, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) (async) bind$inet(r4, &(0x7f0000000200)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) syz_emit_ethernet(0x76, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd0746d0c0df3ce0f51c60ad998cce4660e400ff00403a00fe800000000000000000000000000037fe8000000000000000000000000000aa01059078020000006fc897df0101330100000000000000000000000000009601fe80000000000000001c00000000003729"], 0x0) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f0000005b574e69622bf85eda07b3"], 0x0}, 0x0) r5 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGCOLLECTIONINDEX(r5, 0x40184810, &(0x7f00000006c0)={0x3, 0x100, 0x0, 0x8001, 0x0, 0x9ff}) (async) ioctl$HIDIOCGCOLLECTIONINDEX(r5, 0x40184810, &(0x7f00000006c0)={0x3, 0x100, 0x0, 0x8001, 0x0, 0x9ff}) execveat(0xffffffffffffffff, 0x0, &(0x7f00000002c0), 0x0, 0x800) unshare(0x6a040000) (async) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) 2.379883541s ago: executing program 6 (id=2728): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffc0000}]}) io_cancel(0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) syz_open_dev$sg(0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xa) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$SIOCSIFMTU(r4, 0x8922, &(0x7f0000000180)={'veth1_vlan\x00', 0x8a}) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, 0x0, 0x4c094) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x40702) ioctl$USBDEVFS_CONNECTINFO(r5, 0x80045505, &(0x7f0000002a40)) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r6, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r0], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) 2.379581326s ago: executing program 1 (id=2729): openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80882) r0 = syz_io_uring_setup(0x235, &(0x7f0000001240)={0x0, 0x10008cc8, 0x10100, 0x2, 0x75}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000007c0)=ANY=[@ANYBLOB="280300002d00090027bd700000000000040000001303178010"], 0x328}}, 0x84) syz_io_uring_submit(r1, r2, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x3b, 0x2, 0x1}) io_uring_enter(r0, 0x7a98, 0x0, 0x0, 0x0, 0xfffffffffffffc76) 2.265889393s ago: executing program 1 (id=2730): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/vmstat\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) close(r0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x82, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 2.139860549s ago: executing program 6 (id=2731): r0 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000002c0), 0x200000, 0x0) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) (async) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={0x0, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x36}}, {0x2, 0x4e20, @remote}, {0x2, 0x4e21, @multicast2}, 0x232, 0x0, 0x0, 0x0, 0x117, 0x0, 0x1, 0x1b, 0x100}) close(r0) (async) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000100)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000740)={0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, "65366a50432b7ee2c7feddd91df868e7cfc6fa7272f3bf0a71b5d0c19323a260"}}) (async) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x8, 0x0, 0xfe, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) (async) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0xff, 0xf, 0x7ff}, 0xc) 1.716103141s ago: executing program 1 (id=2732): mknod(&(0x7f0000000080)='./bus\x00', 0x1000, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x143142, 0xa2) write$FUSE_INIT(r0, &(0x7f0000000140)={0x50}, 0xffd3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_io_uring_setup(0x19d1, &(0x7f00000003c0)={0x0, 0x0, 0x10100, 0x8000000, 0x8000000}, &(0x7f0000000080)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r3, 0xa3d, 0x0, 0x0, 0x0, 0xff39) recvmmsg(r1, &(0x7f0000000400)=[{{0x0, 0xf5ffffff, 0x0, 0x0, 0x0, 0x4000000}}], 0xf00, 0x0, 0x0) shutdown(r2, 0x1) write$apparmor_current(r0, &(0x7f0000000300)=@hat={'permhat ', 0x3, 0x5e, ['t\t\r\x97\xc1\xf7\xcex[\xe4$\xcb\xed\x14\xebz\xa44a\x86\x8bC\x1fnaP[\xf0@r\xcb\xc1\xae\xb0S\xd3\x1b\xc7\x16\x10/&\xf8y\xed*\x88\x05I\x8e\xb5\xb3#\xdeC_\x06\xe1\xa9\xa2\xae\x92~\xbce\x83u$\xb0\xb1\xc4\xfc\xee<\xd7\xecX\xe1\xb3.u\"\x98\xb0']}, 0x6f) 1.405160297s ago: executing program 5 (id=2733): io_setup(0x42, &(0x7f0000000100)=0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) r2 = eventfd2(0x3, 0x801) io_submit(r0, 0x2, &(0x7f0000000140)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000, 0x1, 0x0, r1, &(0x7f0000000000)='e', 0x1, 0x0, 0x0, 0x2}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x0, r1, &(0x7f0000000040)="26cebd75edd112026427b75d4a572c78c0c1cd02bc35b7beb00424c0cf47b42ea531de9b66a8ee8f868d9645bc299b7182ec0bfb1bb2a9b048c8f190fd804886761642b33bfe361557818ddb59107e923e32a10cf26b4d6cde91353ca271ace8", 0x60, 0x8, 0x0, 0x0, r2}]) r3 = syz_usb_connect(0x2, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000840)={0x84, &(0x7f00000003c0)={0x0, 0xe, 0x5, "7bd31830a9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 961.815643ms ago: executing program 0 (id=2734): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009c323f08a504033007c8d1b93c010902120011000200000904"], 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x1, 0x2}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x800) 828.020441ms ago: executing program 1 (id=2735): openat$apparmor_thread_current(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, 0x0, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d0400", 0xc) r5 = accept$alg(r4, 0x0, 0x0) sendmsg$alg(r5, 0x0, 0x0) write$binfmt_script(r5, &(0x7f0000000600), 0xfec8) recvmmsg(r5, &(0x7f00000008c0)=[{{&(0x7f00000000c0)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/200, 0x6}, {&(0x7f0000000140)=""/9, 0xa}, {&(0x7f0000000300)=""/225, 0x2}, {&(0x7f0000000400)=""/41, 0xfeb2}, {&(0x7f0000000440)=""/123, 0x7b}, {&(0x7f00000004c0)=""/203, 0xcb}], 0x6, &(0x7f0000000640)=""/123, 0x7b, 0x2000000}}, {{&(0x7f00000006c0), 0x80, &(0x7f0000000840), 0x0, &(0x7f0000000880)=""/24, 0xffffffffffffffe0}}], 0x2, 0xcb, &(0x7f0000008000)={0x0, 0x989680}) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet(r6, &(0x7f0000000d00)=[{{&(0x7f0000000040)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)='e', 0x1}], 0x1}}, {{&(0x7f0000000880)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, &(0x7f0000000a80)}}], 0x2, 0x4000) shutdown(r6, 0x1) getsockopt$inet_sctp6_SCTP_MAXSEG(r6, 0x84, 0xd, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="02000000040000000100000027bf000000050000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000451b9f482c11ff77748d63bf076e24a9500920269cb127e4982c72352942a70100243902b39968bf95e29305a1e9886e674b0380d82dc30f785abfd2b818b00f71fe51832faf132b7a55e6075bd43b0e1a"], 0x48) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, r7, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000a40)={r7}, 0x4) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x33b, 0x4000000) 589.24947ms ago: executing program 5 (id=2736): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, 0x0, 0x0) connect$l2tp6(r0, 0x0, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000cc0)=ANY=[@ANYBLOB="b700000018000000bfa30000000000000703000028feffff7a0af0fff8ffffff61a4f0ff0000000015040000000002000f040000000000003404ffc101ed0a0065040000170000801f400000000000007b0a00fe000000002c0400ffffffd000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3cea8bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abbef9fc92e3eb9560934de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc8de9bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e}, 0x48) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents64(r5, &(0x7f0000002f40)=""/4098, 0x1002) openat$fb0(0xffffffffffffff9c, 0x0, 0x2100c0, 0x0) r6 = getpid() r7 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCSETAW(r7, 0x5407, &(0x7f0000000100)={0xa, 0x7, 0x3, 0x6, 0x1b}) ioctl$TIOCMSET(r7, 0x5418, 0x0) r8 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, 0x0, 0xc804) ptrace$ARCH_MAP_VDSO_X32(0x1e, 0x0, 0x86f, 0x2001) close_range(r8, 0xffffffffffffffff, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) prlimit64(r6, 0x0, &(0x7f0000000000), 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, 0x0) 346.188483ms ago: executing program 3 (id=2737): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a48000000060a0904000000000000000002000005140700000000018008000100645a52a0c485a0757000040002800900010073797a30000000000900020073797a32000000000500074075000000140000001100010000000000000000000000000a"], 0x70}, 0x1, 0x0, 0x0, 0x40010}, 0x0) 0s ago: executing program 3 (id=2738): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000100)=[{0x20, 0x0, 0x0, 0xfffff00b}]}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80000006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYBLOB="001000008000000008000f002000000014003500726f7365300000000000000000000000a40034801400350070696d367265673000000020000000001400350076657468305f6d614176746170000000140035006d61637674617030020000000000000014003500677265300000000000000000000000001400350076657468305f746f5f626174616476001400350001657468315f6d6163767461700000001400350067726530000000000000000000000000140035006261746164765f736c6176655f31000008000f"], 0xe8}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) ioctl$TCSETSF(r5, 0x5404, &(0x7f0000000040)={0x1856, 0x4, 0xffff, 0xfffffff9, 0x11, "0e80706e6c06a79874342a0e0d13343972d01f"}) write$UHID_INPUT(r5, &(0x7f0000001040)={0xd, {"a2e3ad21ed6b0af99cfbf4c007f70eb4d04fe7ff7fc6e5539b0872fc8b546a1b4d09940f08900c878f0e1ac6e7049b4cb4956c409b3c2a0867f3988f7ef319520100ffe8d178708c523c921b1b0f5a0a169b50d336cd3b78130daa61d8f809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1010}}, 0x1b7) read$FUSE(r5, &(0x7f00000040c0)={0x2020}, 0xf4d) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=ANY=[@ANYBLOB="4800000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="0040040000c10000280012800900010076657468"], 0x48}, 0x1, 0x0, 0x0, 0x84}, 0x0) kernel console output (not intermixed with test programs): l+0x10/0x10 [ 601.313771][T15306] ? __fget_files+0x2a/0x420 [ 601.313805][T15306] ? bpf_lsm_file_ioctl+0x9/0x20 [ 601.313830][T15306] ? __pfx_blkdev_ioctl+0x10/0x10 [ 601.313859][T15306] __se_sys_ioctl+0xf9/0x170 [ 601.313903][T15306] do_syscall_64+0xfa/0x3b0 [ 601.313934][T15306] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.313956][T15306] ? clear_bhb_loop+0x60/0xb0 [ 601.313980][T15306] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.314003][T15306] RIP: 0033:0x7f1ae158ebe9 [ 601.314022][T15306] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 601.314044][T15306] RSP: 002b:00007f1ae24d9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 601.314068][T15306] RAX: ffffffffffffffda RBX: 00007f1ae17b5fa0 RCX: 00007f1ae158ebe9 [ 601.314085][T15306] RDX: 00002000000002c0 RSI: 0000000000004c0a RDI: 0000000000000003 [ 601.314099][T15306] RBP: 00007f1ae24d9090 R08: 0000000000000000 R09: 0000000000000000 [ 601.314114][T15306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 601.314128][T15306] R13: 00007f1ae17b6038 R14: 00007f1ae17b5fa0 R15: 00007f1ae18dfa28 [ 601.314153][T15306] [ 601.314268][T15306] loop6: detected capacity change from 0 to 1 [ 601.317575][T15292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 601.343790][T15306] Dev loop6: unable to read RDB block 1 [ 601.364218][T15292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 601.407862][T15306] loop6: unable to read partition table [ 601.412489][T15292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 601.428206][T15306] loop6: partition table beyond EOD, [ 601.490691][ T5945] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 601.498648][T15306] truncated [ 601.534861][ T5858] CoreChips 6-1:0.41: probe with driver CoreChips failed with error -71 [ 601.557008][T15306] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 601.611155][ T5858] usb 6-1: USB disconnect, device number 48 [ 602.045742][ T5945] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 602.054824][ T5945] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 602.066281][ T5945] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 602.083111][ T5945] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 602.111791][ T5945] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 602.133169][ T5945] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 602.142865][ T5945] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 602.160651][ T5945] usb 4-1: Product: syz [ 602.164899][ T5945] usb 4-1: Manufacturer: syz [ 602.173619][ T5945] cdc_wdm 4-1:1.0: skipping garbage [ 602.183443][ T5945] cdc_wdm 4-1:1.0: skipping garbage [ 602.189778][ T5945] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 602.195890][ T5945] cdc_wdm 4-1:1.0: Unknown control protocol [ 602.270000][T11409] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 602.277336][T11409] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 602.285140][T11409] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 602.293312][T11409] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 602.302523][T11409] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 602.380881][ T9] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 602.390976][ T5858] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 602.410698][T15304] veth1_to_batadv: entered promiscuous mode [ 602.419995][T15304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 602.429234][T15304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 602.435643][T15319] chnl_net:caif_netlink_parms(): no params data found [ 602.441819][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -75 [ 602.495041][T15319] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.502542][T15319] bridge0: port 1(bridge_slave_0) entered disabled state [ 602.509887][T15319] bridge_slave_0: entered allmulticast mode [ 602.517077][T15319] bridge_slave_0: entered promiscuous mode [ 602.525612][T15319] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.533179][T15319] bridge0: port 2(bridge_slave_1) entered disabled state [ 602.534766][ T9] usb 1-1: config 0 has an invalid interface number: 199 but max is 1 [ 602.542678][T15319] bridge_slave_1: entered allmulticast mode [ 602.548887][ T9] usb 1-1: config 0 has no interface number 1 [ 602.560613][ T9] usb 1-1: config 0 interface 199 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 602.560758][ T5858] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 602.570445][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 602.571654][ T9] usb 1-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 602.593176][T15319] bridge_slave_1: entered promiscuous mode [ 602.602205][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 602.615419][ T9] usb 1-1: SerialNumber: syz [ 602.618446][ T5858] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 602.629338][ T9] usb 1-1: config 0 descriptor?? [ 602.644688][ T5858] usb 6-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 8.00 [ 602.657190][ T5858] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 602.669318][T15319] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 602.673007][ T5858] usb 6-1: config 0 descriptor?? [ 602.682505][T15319] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 602.687843][ T5945] usb 4-1: USB disconnect, device number 41 [ 602.725042][T15319] team0: Port device team_slave_0 added [ 602.732767][T15319] team0: Port device team_slave_1 added [ 602.761043][T15319] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 602.768046][T15319] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 602.794142][T15319] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 602.806899][T15319] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 602.813950][T15319] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 602.840255][T15319] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 602.855131][ T9] usb 1-1: Found UVC 0.00 device (0002:0000) [ 602.862496][ T9] usb 1-1: No valid video chain found. [ 602.882054][ T9] usb 1-1: USB disconnect, device number 25 [ 602.907879][T15319] hsr_slave_0: entered promiscuous mode [ 602.916266][T15319] hsr_slave_1: entered promiscuous mode [ 602.922783][T15319] debugfs: 'hsr0' already exists in 'hsr' [ 602.928670][T15319] Cannot create hsr debugfs directory [ 602.968747][T15327] netlink: 'syz.1.2402': attribute type 3 has an invalid length. [ 602.976994][T15327] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2402'. [ 603.097987][T15319] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 603.114412][T15319] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 603.129464][T15319] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 603.149657][T15319] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 603.245985][T15319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 603.261744][ T5944] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 603.284237][T15319] 8021q: adding VLAN 0 to HW filter on device team0 [ 603.316446][T14831] bridge0: port 1(bridge_slave_0) entered blocking state [ 603.323598][T14831] bridge0: port 1(bridge_slave_0) entered forwarding state [ 603.352676][ T5858] usbhid 6-1:0.0: can't add hid device: -32 [ 603.358762][ T5858] usbhid 6-1:0.0: probe with driver usbhid failed with error -32 [ 603.428212][T14831] bridge0: port 2(bridge_slave_1) entered blocking state [ 603.435376][T14831] bridge0: port 2(bridge_slave_1) entered forwarding state [ 603.480654][T15310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 603.489404][T15310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 603.680386][T15319] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 603.715870][T15319] veth0_vlan: entered promiscuous mode [ 603.753101][T15350] loop6: detected capacity change from 0 to 1 [ 603.759243][T15350] FAULT_INJECTION: forcing a failure. [ 603.759243][T15350] name failslab, interval 1, probability 0, space 0, times 0 [ 603.792434][T15319] veth1_vlan: entered promiscuous mode [ 603.806642][T15350] CPU: 0 UID: 0 PID: 15350 Comm: syz.0.2407 Not tainted syzkaller #0 PREEMPT(full) [ 603.806661][T15350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 603.806672][T15350] Call Trace: [ 603.806678][T15350] [ 603.806684][T15350] dump_stack_lvl+0x189/0x250 [ 603.806704][T15350] ? __pfx____ratelimit+0x10/0x10 [ 603.806723][T15350] ? __pfx_dump_stack_lvl+0x10/0x10 [ 603.806738][T15350] ? __pfx__printk+0x10/0x10 [ 603.806756][T15350] ? _printk+0xcf/0x120 [ 603.806774][T15350] ? __pfx___might_resched+0x10/0x10 [ 603.806786][T15350] ? lock_acquire+0x5f/0x360 [ 603.806806][T15350] should_fail_ex+0x414/0x560 [ 603.806825][T15350] should_failslab+0xa8/0x100 [ 603.806845][T15350] __kmalloc_cache_noprof+0x70/0x3d0 [ 603.806863][T15350] ? kobject_uevent_env+0x27c/0x8c0 [ 603.806877][T15350] ? __pfx_dev_uevent_name+0x10/0x10 [ 603.806895][T15350] kobject_uevent_env+0x27c/0x8c0 [ 603.806911][T15350] loop_configure+0xcb7/0xf90 [ 603.806932][T15350] ? __pfx_loop_configure+0x10/0x10 [ 603.806953][T15350] ? lock_release+0x4b/0x3e0 [ 603.806972][T15350] ? __might_fault+0xb0/0x130 [ 603.806989][T15350] ? __might_fault+0xcc/0x130 [ 603.807008][T15350] lo_ioctl+0x7cc/0x1d00 [ 603.807028][T15350] ? kasan_save_track+0x4f/0x80 [ 603.807044][T15350] ? kasan_save_track+0x3e/0x80 [ 603.807059][T15350] ? __kasan_slab_free+0x5b/0x80 [ 603.807077][T15350] ? do_dentry_open+0x384/0x13f0 [ 603.807092][T15350] ? __pfx_lo_ioctl+0x10/0x10 [ 603.807107][T15350] ? process_measurement+0x3d8/0x1a40 [ 603.807122][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807135][T15350] ? lock_acquire+0x5f/0x360 [ 603.807154][T15350] ? ima_match_policy+0x10b/0x2150 [ 603.807170][T15350] ? __pfx_ima_match_policy+0x10/0x10 [ 603.807187][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807200][T15350] ? lock_release+0x4b/0x3e0 [ 603.807219][T15350] ? unwind_next_frame+0xa5/0x2390 [ 603.807233][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807246][T15350] ? unwind_next_frame+0xa5/0x2390 [ 603.807261][T15350] ? unwind_next_frame+0xa5/0x2390 [ 603.807276][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807289][T15350] ? unwind_next_frame+0xa5/0x2390 [ 603.807304][T15350] ? unwind_next_frame+0xa5/0x2390 [ 603.807317][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807331][T15350] ? unwind_next_frame+0xa5/0x2390 [ 603.807344][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807357][T15350] ? unwind_next_frame+0xa5/0x2390 [ 603.807372][T15350] ? unwind_next_frame+0xa5/0x2390 [ 603.807386][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807398][T15350] ? is_bpf_text_address+0x26/0x2b0 [ 603.807418][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807431][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807443][T15350] ? lock_release+0x4b/0x3e0 [ 603.807461][T15350] ? lock_release+0x4b/0x3e0 [ 603.807482][T15350] ? is_bpf_text_address+0x292/0x2b0 [ 603.807501][T15350] ? is_bpf_text_address+0x26/0x2b0 [ 603.807521][T15350] ? kernel_text_address+0xa5/0xe0 [ 603.807540][T15350] ? __kernel_text_address+0xd/0x40 [ 603.807558][T15350] ? unwind_get_return_address+0x4d/0x90 [ 603.807572][T15350] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 603.807588][T15350] ? arch_stack_walk+0xfc/0x150 [ 603.807608][T15350] ? stack_trace_save+0x9c/0xe0 [ 603.807622][T15350] ? __pfx_stack_trace_save+0x10/0x10 [ 603.807638][T15350] ? stack_depot_save_flags+0x40/0x860 [ 603.807658][T15350] ? kasan_save_track+0x4f/0x80 [ 603.807673][T15350] ? kasan_save_track+0x3e/0x80 [ 603.807688][T15350] ? kasan_save_free_info+0x46/0x50 [ 603.807701][T15350] ? __kasan_slab_free+0x5b/0x80 [ 603.807717][T15350] ? kfree+0x18e/0x440 [ 603.807732][T15350] ? tomoyo_path_number_perm+0x47a/0x5a0 [ 603.807750][T15350] ? security_file_ioctl+0xcb/0x2d0 [ 603.807766][T15350] ? __se_sys_ioctl+0x47/0x170 [ 603.807781][T15350] ? do_syscall_64+0xfa/0x3b0 [ 603.807799][T15350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.807820][T15350] ? __asan_memset+0x22/0x50 [ 603.807834][T15350] ? blk_get_meta_cap+0x140/0x710 [ 603.807853][T15350] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 603.807871][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.807885][T15350] ? blkdev_common_ioctl+0xff7/0x2550 [ 603.807906][T15350] ? kfree+0x18e/0x440 [ 603.807922][T15350] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 603.807942][T15350] ? do_vfs_ioctl+0xbe8/0x1430 [ 603.807969][T15350] ? lock_release+0x4b/0x3e0 [ 603.807987][T15350] ? __pfx_lo_ioctl+0x10/0x10 [ 603.808003][T15350] blkdev_ioctl+0x5a5/0x6d0 [ 603.808027][T15350] ? __pfx_blkdev_ioctl+0x10/0x10 [ 603.808046][T15350] ? __fget_files+0x2a/0x420 [ 603.808066][T15350] ? bpf_lsm_file_ioctl+0x9/0x20 [ 603.808082][T15350] ? __pfx_blkdev_ioctl+0x10/0x10 [ 603.808101][T15350] __se_sys_ioctl+0xf9/0x170 [ 603.808117][T15350] do_syscall_64+0xfa/0x3b0 [ 603.808135][T15350] ? rcu_is_watching+0x15/0xb0 [ 603.808147][T15350] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.808160][T15350] ? clear_bhb_loop+0x60/0xb0 [ 603.808174][T15350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.808187][T15350] RIP: 0033:0x7f1ae158ebe9 [ 603.808199][T15350] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 603.808211][T15350] RSP: 002b:00007f1ae24d9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 603.808225][T15350] RAX: ffffffffffffffda RBX: 00007f1ae17b5fa0 RCX: 00007f1ae158ebe9 [ 603.808236][T15350] RDX: 00002000000002c0 RSI: 0000000000004c0a RDI: 0000000000000003 [ 603.808244][T15350] RBP: 00007f1ae24d9090 R08: 0000000000000000 R09: 0000000000000000 [ 603.808253][T15350] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 603.808261][T15350] R13: 00007f1ae17b6038 R14: 00007f1ae17b5fa0 R15: 00007f1ae18dfa28 [ 603.808277][T15350] [ 604.365540][T15350] Dev loop6: unable to read RDB block 1 [ 604.511892][T11409] Bluetooth: hci3: command tx timeout [ 604.548445][T15350] loop6: unable to read partition table [ 604.556111][T15319] veth0_macvtap: entered promiscuous mode [ 604.566397][T15350] loop6: partition table beyond EOD, truncated [ 604.578397][T15319] veth1_macvtap: entered promiscuous mode [ 604.592206][T15319] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 604.602140][T15319] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 604.625028][T15350] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 604.646319][T14829] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.668795][T14829] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.706470][T14826] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 604.735364][T14826] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 604.807682][T14829] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.834539][T14829] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 604.844217][T14825] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 604.860791][ T9] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 604.892986][T14825] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 605.010998][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 605.026547][ T9] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 605.035842][ T9] usb 4-1: config 0 has no interface number 0 [ 605.044124][ T9] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 605.055881][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 605.115109][ T9] usb 4-1: Product: syz [ 605.143519][ T9] usb 4-1: Manufacturer: syz [ 605.183939][ T92] usb 6-1: USB disconnect, device number 49 [ 605.213714][T15367] netlink: 'syz.0.2411': attribute type 4 has an invalid length. [ 605.233840][ T9] usb 4-1: SerialNumber: syz [ 605.859798][ T9] usb 4-1: config 0 descriptor?? [ 606.222402][ T9] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 606.290624][ T92] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 606.420765][ T5858] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 606.432644][ T9] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 606.453991][ T9] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 606.463746][ T92] usb 6-1: device descriptor read/64, error -71 [ 606.542837][T11409] Bluetooth: hci3: command tx timeout [ 606.570676][ T5858] usb 1-1: Using ep0 maxpacket: 32 [ 606.578157][ T5858] usb 1-1: config 0 has an invalid interface number: 111 but max is 1 [ 606.586487][ T5858] usb 1-1: config 0 has no interface number 1 [ 606.595428][ T5858] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=4a.83 [ 606.604781][ T5858] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.613073][ T5858] usb 1-1: Product: syz [ 606.621887][ T5858] usb 1-1: Manufacturer: syz [ 606.626507][ T5858] usb 1-1: SerialNumber: syz [ 606.644532][ T5858] usb 1-1: config 0 descriptor?? [ 606.730006][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 606.730228][ T5978] usb 4-1: USB disconnect, device number 42 [ 606.738188][ T92] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 606.748858][ T5978] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 606.782002][ T5978] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 606.797566][ T5978] quatech2 4-1:0.51: device disconnected [ 606.886650][ T5858] snd-usb-6fire 1-1:0.111: unable to receive device firmware state. [ 606.898673][ T5858] snd-usb-6fire 1-1:0.111: probe with driver snd-usb-6fire failed with error -71 [ 606.910119][T15378] delete_channel: no stack [ 606.933902][ T5858] usb 1-1: USB disconnect, device number 26 [ 606.941887][ T92] usb 6-1: device descriptor read/64, error -71 [ 607.052665][ T92] usb usb6-port1: attempt power cycle [ 607.160704][ T5944] usb 2-1: device descriptor read/64, error -71 [ 607.401028][ T92] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 607.409056][ T5944] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 607.441625][ T92] usb 6-1: device descriptor read/8, error -71 [ 607.573699][ T5944] usb 2-1: config 0 interface 0 altsetting 32 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 607.588037][ T5944] usb 2-1: config 0 interface 0 altsetting 32 endpoint 0x81 has invalid wMaxPacketSize 0 [ 607.619391][ T5944] usb 2-1: config 0 interface 0 has no altsetting 0 [ 607.638546][ T5944] usb 2-1: New USB device found, idVendor=0b05, idProduct=1822, bcdDevice= 0.00 [ 607.672761][ T30] audit: type=1326 audit(1755870475.084:3949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 607.709123][ T5978] usb 1-1: new high-speed USB device number 27 using dummy_hcd [ 607.730665][ T92] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 607.754960][ T30] audit: type=1326 audit(1755870475.084:3950): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=209 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 607.780752][ T5944] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.798969][ T92] usb 6-1: device descriptor read/8, error -71 [ 607.806764][ T5944] usb 2-1: config 0 descriptor?? [ 607.861315][ T30] audit: type=1326 audit(1755870475.084:3951): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 607.902907][ T5978] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 607.914408][ T5978] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 607.931701][ T92] usb usb6-port1: unable to enumerate USB device [ 607.950473][ T5978] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 607.967373][ T30] audit: type=1326 audit(1755870475.084:3952): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 607.995436][ T5978] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.006332][T15402] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 608.023609][ T5978] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 608.030909][ T30] audit: type=1326 audit(1755870475.084:3953): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 608.122719][ T30] audit: type=1326 audit(1755870475.084:3954): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 608.231565][ T5978] usb 1-1: USB disconnect, device number 27 [ 608.284481][ T30] audit: type=1326 audit(1755870475.084:3955): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 608.316483][ T30] audit: type=1326 audit(1755870475.084:3956): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 608.347349][ T30] audit: type=1326 audit(1755870475.084:3957): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 608.370668][ T30] audit: type=1326 audit(1755870475.084:3958): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15393 comm="syz.6.2417" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd08ab8ebe9 code=0x7fc00000 [ 608.560870][ T9] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 608.621071][T11409] Bluetooth: hci3: command tx timeout [ 608.731447][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 608.743587][ T9] usb 4-1: config 63 has an invalid interface number: 66 but max is 0 [ 608.756853][ T9] usb 4-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 608.779778][ T9] usb 4-1: config 63 has no interface number 0 [ 608.786984][ T9] usb 4-1: config 63 interface 66 has no altsetting 0 [ 608.796398][ T9] usb 4-1: New USB device found, idVendor=174f, idProduct=8a31, bcdDevice=39.f4 [ 608.810607][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.833741][ T9] usb 4-1: Product: syz [ 608.844140][ T9] usb 4-1: Manufacturer: syz [ 608.860432][ T9] usb 4-1: SerialNumber: syz [ 609.060856][ T5855] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 609.132548][ T9] usb 4-1: Found UVC 0.07 device syz (174f:8a31) [ 609.151996][ T9] usb 4-1: No valid video chain found. [ 609.160860][ T9] usb 4-1: USB disconnect, device number 43 [ 609.169352][ T8830] udevd[8830]: setting mode of /dev/bus/usb/004/043 to 020664 failed: No such file or directory [ 609.188446][ T8830] udevd[8830]: setting owner of /dev/bus/usb/004/043 to uid=0, gid=0 failed: No such file or directory [ 609.215639][ T5855] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 609.226977][ T5855] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 609.237256][ T5855] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 609.246520][ T5855] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.267256][T15423] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 609.288836][ T5855] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 609.512815][ T5944] usbhid 2-1:0.0: can't add hid device: -71 [ 609.518798][ T5944] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 609.601860][ T5944] usb 2-1: USB disconnect, device number 30 [ 609.880813][ T5978] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 609.981341][ T5944] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 610.030988][ T5978] usb 6-1: device descriptor read/64, error -71 [ 610.132293][ T5944] usb 2-1: config 0 has an invalid interface number: 168 but max is 0 [ 610.140994][ T5944] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 610.151270][ T5944] usb 2-1: config 0 has no interface number 0 [ 610.157666][ T5944] usb 2-1: config 0 interface 168 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 610.167703][ T5944] usb 2-1: config 0 interface 168 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 16 [ 610.181323][ T5944] usb 2-1: New USB device found, idVendor=0959, idProduct=2bd0, bcdDevice=48.98 [ 610.190412][ T5944] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.199878][ T5944] usb 2-1: config 0 descriptor?? [ 610.201199][ T5945] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 610.215195][ T5944] HFC-S_USB 2-1:0.168: probe with driver HFC-S_USB failed with error -5 [ 610.290684][ T5978] usb 6-1: new full-speed USB device number 55 using dummy_hcd [ 610.380899][ T5945] usb 4-1: Using ep0 maxpacket: 32 [ 610.389199][ T5945] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 610.399505][ T5945] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 610.412747][ T5945] usb 4-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 610.419043][ T5944] usb 2-1: USB disconnect, device number 31 [ 610.422633][ T5945] usb 4-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 610.422662][ T5945] usb 4-1: config 0 interface 0 has no altsetting 0 [ 610.422693][ T5945] usb 4-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 610.460167][ T5978] usb 6-1: device descriptor read/64, error -71 [ 610.468034][ T5945] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.482899][ T5945] usb 4-1: config 0 descriptor?? [ 610.571025][ T5978] usb usb6-port1: attempt power cycle [ 610.710621][T11409] Bluetooth: hci3: command tx timeout [ 610.894041][ T5945] hid-thrustmaster 0003:044F:B65D.003C: unknown main item tag 0x0 [ 610.908065][ T5945] hid-thrustmaster 0003:044F:B65D.003C: unknown main item tag 0x0 [ 610.917834][ T5945] hid-thrustmaster 0003:044F:B65D.003C: item fetching failed at offset 2/5 [ 610.927161][ T5978] usb 6-1: new full-speed USB device number 56 using dummy_hcd [ 610.938058][ T5945] hid-thrustmaster 0003:044F:B65D.003C: parse failed with error -22 [ 610.947559][ T5945] hid-thrustmaster 0003:044F:B65D.003C: probe with driver hid-thrustmaster failed with error -22 [ 610.965141][ T5978] usb 6-1: device descriptor read/8, error -71 [ 611.112702][ T5858] usb 4-1: USB disconnect, device number 44 [ 611.210679][ T5978] usb 6-1: new full-speed USB device number 57 using dummy_hcd [ 611.230878][ T5945] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 611.244921][ T5978] usb 6-1: device descriptor read/8, error -71 [ 611.361059][ T5978] usb usb6-port1: unable to enumerate USB device [ 611.403366][ T5945] usb 2-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 611.415339][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.426327][ T5945] usb 2-1: config 0 descriptor?? [ 611.446070][ T5945] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 611.644938][T15452] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 611.658684][T15452] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 611.670222][ T5945] gspca_cpia1: usb_control_msg 05, error -71 [ 611.678948][ T5945] gspca_cpia1: usb_control_msg 01, error -71 [ 611.687443][ T5945] cpia1 2-1:0.0: only firmware version 1 is supported (got: 0) [ 611.704599][ T5945] usb 2-1: USB disconnect, device number 32 [ 611.842627][ T9] usb 1-1: USB disconnect, device number 28 [ 612.020614][ T5944] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 612.060698][ T5855] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 612.181213][ T5944] usb 7-1: Using ep0 maxpacket: 8 [ 612.197431][ T5944] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 612.215535][ T5944] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 612.230950][ T5855] usb 4-1: Using ep0 maxpacket: 8 [ 612.240403][ T5944] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 612.251437][ T5855] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 612.274101][ T5944] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 612.292092][ T5855] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 612.302566][ T5855] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.310750][ T5944] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 612.323522][ T5855] usb 4-1: config 0 descriptor?? [ 612.329507][ T5944] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.344053][ T9] usb 1-1: new full-speed USB device number 29 using dummy_hcd [ 612.366603][T15475] binder: BINDER_SET_CONTEXT_MGR already set [ 612.399741][T15475] binder: 15473:15475 ioctl 4018620d 200000000100 returned -16 [ 612.545345][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 612.556554][ T9] usb 1-1: not running at top speed; connect to a high speed hub [ 612.574221][ T5855] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 612.590025][ T9] usb 1-1: config 9 has an invalid interface number: 198 but max is 0 [ 612.608347][ T9] usb 1-1: config 9 has no interface number 0 [ 612.618916][ T5944] usb 7-1: GET_CAPABILITIES returned 0 [ 612.636646][ T9] usb 1-1: config 9 interface 198 has no altsetting 0 [ 612.643974][ T5944] usbtmc 7-1:16.0: can't read capabilities [ 612.676530][ T9] usb 1-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=6f.2b [ 612.680941][ T5858] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 612.686314][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.705253][ T9] usb 1-1: Product: syz [ 612.709461][ T9] usb 1-1: Manufacturer: syz [ 612.715598][ T9] usb 1-1: SerialNumber: syz [ 612.883996][ T5858] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 612.893965][ T5858] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 612.909956][ T5858] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 612.925827][ T5858] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 612.952548][ T5858] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 612.962890][ T5858] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 612.974501][ T5858] usb 2-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 612.983983][ T5858] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.992363][ T5858] usb 2-1: Product: syz [ 612.998137][ T5858] usb 2-1: Manufacturer: syz [ 613.264067][ T5858] usb 2-1: SerialNumber: syz [ 613.281667][ T5855] usb 4-1: USB disconnect, device number 45 [ 613.285223][ T5858] usb 2-1: config 0 descriptor?? [ 613.300926][ T5858] ti_usb_3410_5052 2-1:0.0: TI USB 5052 2 port adapter converter detected [ 613.320265][ T5858] ti_usb_3410_5052 2-1:0.0: missing endpoints [ 613.754418][ T5858] usb 7-1: USB disconnect, device number 2 [ 613.883515][T15493] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 613.945497][T15491] kvm: requested 10057 ns i8254 timer period limited to 200000 ns [ 613.956133][T15491] kvm: requested 44419 ns i8254 timer period limited to 200000 ns [ 613.980014][T15491] kvm: requested 838 ns i8254 timer period limited to 200000 ns [ 613.994103][T15491] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 614.095689][ T5855] usb 2-1: USB disconnect, device number 33 [ 614.122209][T15491] kvm: requested 155885 ns i8254 timer period limited to 200000 ns [ 614.150990][T15491] kvm: requested 147504 ns i8254 timer period limited to 200000 ns [ 614.206511][T15491] kvm: requested 38552 ns i8254 timer period limited to 200000 ns [ 614.295905][T15491] kvm: requested 45257 ns i8254 timer period limited to 200000 ns [ 614.349117][T15491] kvm: requested 191923 ns i8254 timer period limited to 200000 ns [ 614.520978][ T5978] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 614.670878][ T5978] usb 2-1: Using ep0 maxpacket: 16 [ 614.687607][ T5978] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 614.702171][ T5978] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 614.740201][ T5978] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x2 has invalid wMaxPacketSize 0 [ 614.777430][ T5978] usb 2-1: config 7 interface 0 altsetting 5 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 614.817133][ T5978] usb 2-1: config 7 interface 0 has no altsetting 0 [ 614.848021][ T5978] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 614.952049][ T5978] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 614.967732][T15523] netlink: 'syz.3.2455': attribute type 6 has an invalid length. [ 615.110105][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.141460][ T9] dvb-usb: found a 'Hanftek UMT-010 DVB-T USB2.0' in warm state. [ 615.155642][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.173977][ T9] dvb-usb: bulk message failed: -22 (3/0) [ 615.186789][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.198756][ T9] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 615.212738][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.223683][ T9] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 error while loading driver (-19) [ 615.240998][ T5858] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 615.241343][ T9] dvb_usb_umt_010 1-1:9.198: probe with driver dvb_usb_umt_010 failed with error -22 [ 615.258516][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.272290][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.284777][ T9] usb 1-1: USB disconnect, device number 29 [ 615.296425][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.315415][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.329094][T15526] netlink: 'syz.5.2456': attribute type 3 has an invalid length. [ 615.382020][ T5858] usb 4-1: device descriptor read/64, error -71 [ 615.434393][T15531] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1408 (2816 ns) > initial count (2688 ns). Using initial count to start timer. [ 615.468072][T15531] ip6gre1: entered allmulticast mode [ 615.640676][ T9] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 615.640970][ T5858] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 615.800608][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 615.919139][ T5858] usb 4-1: device descriptor read/64, error -71 [ 616.017062][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 616.028342][ T9] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 616.041325][ T5858] usb usb4-port1: attempt power cycle [ 616.083389][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.100920][ T9] usb 1-1: config 0 descriptor?? [ 616.337893][T15517] ptrace attach of "./syz-executor exec"[15319] was attempted by " Àÿ Ðÿ ð¥ Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ  À5 \x22ÀÇißdg'Çnf|àà f8€„ÐíBþe.#ºJ©Ù .&( € 6"[15517] [ 616.399228][ T9] iowarrior 1-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 616.451004][ T5858] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 616.481267][ T5858] usb 4-1: device descriptor read/8, error -71 [ 616.771259][ T5858] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 616.793327][ T5858] usb 4-1: device descriptor read/8, error -71 [ 616.818328][ T9] usb 1-1: USB disconnect, device number 30 [ 616.914822][ T5858] usb usb4-port1: unable to enumerate USB device [ 617.130735][ T5855] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 617.226635][ T5978] usbhid 2-1:7.0: can't add hid device: -71 [ 617.234095][ T5978] usbhid 2-1:7.0: probe with driver usbhid failed with error -71 [ 617.246109][ T5978] usb 2-1: USB disconnect, device number 34 [ 617.262614][ T5855] usb 6-1: device descriptor read/64, error -71 [ 617.364537][T15552] tipc: Enabled bearer , priority 0 [ 617.376486][T15552] syzkaller0: entered promiscuous mode [ 617.425307][T15552] syzkaller0: entered allmulticast mode [ 617.820971][ T5855] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 617.980759][ T5855] usb 6-1: device descriptor read/64, error -71 [ 618.037616][T15554] tipc: Resetting bearer [ 618.056236][T15554] tipc: Disabling bearer [ 618.121004][ T5855] usb usb6-port1: attempt power cycle [ 618.342815][T15577] netlink: 9280 bytes leftover after parsing attributes in process `syz.0.2470'. [ 618.480845][ T5855] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 618.501170][ T5855] usb 6-1: device descriptor read/8, error -71 [ 618.601025][ T24] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 618.740612][ T5855] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 618.765526][ T24] usb 1-1: config 0 has an invalid interface number: 249 but max is 0 [ 618.774211][ T24] usb 1-1: config 0 has no interface number 0 [ 618.774299][ T5855] usb 6-1: device descriptor read/8, error -71 [ 618.794132][ T24] usb 1-1: config 0 interface 249 altsetting 0 endpoint 0x8 has invalid wMaxPacketSize 0 [ 618.832746][ T24] usb 1-1: config 0 interface 249 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 0 [ 618.880025][ T24] usb 1-1: config 0 interface 249 altsetting 0 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 618.919419][ T24] usb 1-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=be.87 [ 618.922414][ T5855] usb usb6-port1: unable to enumerate USB device [ 618.970172][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 618.985769][ T24] usb 1-1: config 0 descriptor?? [ 619.004841][ T24] port100 1-1:0.249: NFC: Could not find bulk-in or bulk-out endpoint [ 619.150669][ T5978] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 619.198080][T15598] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2477'. [ 619.214627][ T24] usb 1-1: USB disconnect, device number 31 [ 619.218663][T15598] macvtap1: entered promiscuous mode [ 619.227254][T15598] macvtap1: entered allmulticast mode [ 619.237352][T15598] erspan0: entered allmulticast mode [ 619.259290][T15598] erspan0: left allmulticast mode [ 619.321119][ T5978] usb 7-1: Using ep0 maxpacket: 8 [ 619.332725][ T5978] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 619.344220][ T5978] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 619.353722][ T5978] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.366812][ T5978] usb 7-1: config 0 descriptor?? [ 619.585243][ T5978] iowarrior 7-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 619.660239][T15599] ALSA: mixer_oss: invalid OSS volume '' [ 619.986776][ T5858] usb 7-1: USB disconnect, device number 3 [ 620.185614][T15620] validate_nla: 24 callbacks suppressed [ 620.185630][T15620] netlink: 'syz.0.2483': attribute type 1 has an invalid length. [ 620.395032][T15620] bond2: entered promiscuous mode [ 620.417654][T15620] 8021q: adding VLAN 0 to HW filter on device bond2 [ 620.447262][T15622] 8021q: adding VLAN 0 to HW filter on device bond2 [ 620.462197][T15622] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 620.473983][T15622] bond2: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 620.487688][T15622] bond2: (slave ip6gre1): making interface the new active one [ 620.514596][T15622] ip6gre1: entered promiscuous mode [ 620.534973][T15622] bond2: (slave ip6gre1): Enslaving as an active interface with an up link [ 620.640754][ T5858] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 620.770664][ T5858] usb 6-1: device descriptor read/64, error -71 [ 620.863938][ T5855] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 621.021643][ T5858] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 621.132084][ T5855] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 621.141473][ T5855] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.164401][ T5855] usb 4-1: config 0 descriptor?? [ 621.170938][ T5858] usb 6-1: device descriptor read/64, error -71 [ 621.184750][ T5855] cp210x 4-1:0.0: cp210x converter detected [ 621.280971][ T5858] usb usb6-port1: attempt power cycle [ 621.602125][ T5855] usb 4-1: cp210x converter now attached to ttyUSB0 [ 621.630611][ T5858] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 621.651249][ T5858] usb 6-1: device descriptor read/8, error -71 [ 621.696879][T15652] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 621.721926][T15654] : renamed from vlan1 [ 621.739145][T15654] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2493'. [ 621.761175][T15657] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2493'. [ 621.761603][ T30] kauditd_printk_skb: 3 callbacks suppressed [ 621.761619][ T30] audit: type=1326 audit(1755870489.204:3962): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15653 comm="syz.0.2493" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1ae158ebe9 code=0x0 [ 621.985733][ T5858] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 622.038970][ T5858] usb 6-1: device descriptor read/8, error -71 [ 622.191795][ T5858] usb usb6-port1: unable to enumerate USB device [ 622.331872][T15673] syzkaller0: entered promiscuous mode [ 622.337542][T15673] syzkaller0: entered allmulticast mode [ 622.540770][ T9] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 622.690766][ T9] usb 7-1: Using ep0 maxpacket: 8 [ 622.707201][ T9] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 622.722177][ T9] usb 7-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 622.732667][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.745165][ T9] usb 7-1: config 0 descriptor?? [ 622.956389][ T9] iowarrior 7-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 623.109124][T15686] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 623.185231][T15689] FAULT_INJECTION: forcing a failure. [ 623.185231][T15689] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 623.198515][T15689] CPU: 1 UID: 0 PID: 15689 Comm: syz.0.2502 Not tainted syzkaller #0 PREEMPT(full) [ 623.198540][T15689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 623.198552][T15689] Call Trace: [ 623.198560][T15689] [ 623.198567][T15689] dump_stack_lvl+0x189/0x250 [ 623.198596][T15689] ? __pfx____ratelimit+0x10/0x10 [ 623.198625][T15689] ? __pfx_dump_stack_lvl+0x10/0x10 [ 623.198646][T15689] ? __pfx__printk+0x10/0x10 [ 623.198672][T15689] ? rcu_is_watching+0x15/0xb0 [ 623.198706][T15689] should_fail_ex+0x414/0x560 [ 623.198725][T15689] strncpy_from_user+0x36/0x290 [ 623.198743][T15689] getname_flags+0xf3/0x540 [ 623.198766][T15689] __x64_sys_execveat+0xad/0xe0 [ 623.198791][T15689] do_syscall_64+0xfa/0x3b0 [ 623.198817][T15689] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.198835][T15689] ? clear_bhb_loop+0x60/0xb0 [ 623.198850][T15689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.198864][T15689] RIP: 0033:0x7f1ae158ebe9 [ 623.198876][T15689] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 623.198888][T15689] RSP: 002b:00007f1ae24d9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 623.198910][T15689] RAX: ffffffffffffffda RBX: 00007f1ae17b5fa0 RCX: 00007f1ae158ebe9 [ 623.198925][T15689] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 623.198936][T15689] RBP: 00007f1ae24d9090 R08: 0000000000000100 R09: 0000000000000000 [ 623.198948][T15689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 623.198959][T15689] R13: 00007f1ae17b6038 R14: 00007f1ae17b5fa0 R15: 00007f1ae18dfa28 [ 623.198980][T15689] [ 623.365334][ C1] vkms_vblank_simulate: vblank timer overrun [ 623.372123][ T5978] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 623.374362][ T9] usb 7-1: USB disconnect, device number 4 [ 623.530715][ T5978] usb 2-1: Using ep0 maxpacket: 8 [ 623.539156][ T5978] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 623.549189][ T5978] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 623.557743][ T5978] usb 2-1: Product: syz [ 623.565153][ T5978] usb 2-1: Manufacturer: syz [ 623.569954][ T5978] usb 2-1: SerialNumber: syz [ 623.576726][ T5978] usb 2-1: config 0 descriptor?? [ 623.635126][ T5858] usb 4-1: USB disconnect, device number 50 [ 623.652356][ T5858] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 623.673786][ T5858] cp210x 4-1:0.0: device disconnected [ 623.784986][ T5978] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 623.810735][ T5944] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 623.830741][ T9] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 623.971903][ T5944] usb 6-1: config 0 has no interfaces? [ 623.979288][ T5944] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 623.988425][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 623.993614][ T5944] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.002162][ T5944] usb 6-1: Product: syz [ 624.006374][ T5944] usb 6-1: Manufacturer: syz [ 624.011266][ T5944] usb 6-1: SerialNumber: syz [ 624.016468][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 52, changing to 7 [ 624.027733][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 9272, setting to 1024 [ 624.039695][ T5944] usb 6-1: config 0 descriptor?? [ 624.047318][ T9] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=58.16 [ 624.056571][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.066048][ T9] usb 1-1: Product: syz [ 624.070304][ T9] usb 1-1: Manufacturer: syz [ 624.075402][ T9] usb 1-1: SerialNumber: syz [ 624.083266][ T9] usb 1-1: config 0 descriptor?? [ 624.092599][ T9] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 624.151321][ T24] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 624.257253][T15699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 624.266084][T15699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 624.292417][T15701] netlink: 'syz.0.2505': attribute type 33 has an invalid length. [ 624.300367][T15701] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2505'. [ 624.312477][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 624.317982][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.320318][ T24] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 624.324650][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.344866][T15701] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2505'. [ 624.368731][ T24] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 624.378093][ T24] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 624.385087][ T9] usb 1-1: USB disconnect, device number 32 [ 624.391723][T14829] usb 1-1: Failed to submit usb control message: -71 [ 624.414364][T14829] usb 1-1: unable to send the bmi data to the device: -71 [ 624.426572][T14829] usb 1-1: unable to get target info from device [ 624.433718][T14829] usb 1-1: could not get target info (-71) [ 624.434630][ T24] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 624.451465][T14829] usb 1-1: could not probe fw (-71) [ 624.456768][ T24] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.465454][ T24] usb 7-1: Product: syz [ 624.469722][ T24] usb 7-1: Manufacturer: syz [ 624.478803][ T24] usb 7-1: SerialNumber: syz [ 624.499658][ T24] cdc_ncm 7-1:1.0: CDC Union missing and no IAD found [ 624.508077][ T24] cdc_ncm 7-1:1.0: bind() failure [ 624.700464][ T9] usb 7-1: USB disconnect, device number 5 [ 625.070986][ T24] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 625.220727][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 625.229325][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 625.240876][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 625.253737][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 625.264108][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 625.274196][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 625.288505][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 625.298190][ T24] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 625.306843][ T24] usb 4-1: Manufacturer: syz [ 625.314353][ T24] usb 4-1: config 0 descriptor?? [ 625.322065][ T5978] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 625.338903][ T5978] usb 2-1: USB disconnect, device number 35 [ 625.580737][ T24] rc_core: IR keymap rc-hauppauge not found [ 625.587709][ T24] Registered IR keymap rc-empty [ 625.594577][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.621068][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.642600][ T24] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 625.655662][ T24] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input55 [ 625.669585][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.690914][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.710975][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.730643][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.751740][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.771433][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.790661][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.810943][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.830954][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.861044][ T24] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 625.900495][ T24] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 625.910422][ T24] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 626.280836][ T5858] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 626.461170][ T5858] usb 2-1: Using ep0 maxpacket: 8 [ 626.478621][ T5858] usb 2-1: config 0 interface 0 has no altsetting 0 [ 626.494361][ T5858] usb 2-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 626.520666][ T5944] usb 6-1: USB disconnect, device number 66 [ 626.528045][ T5858] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 626.576372][ T5858] usb 2-1: Product: syz [ 626.598165][ T5858] usb 2-1: Manufacturer: syz [ 626.610733][ T5858] usb 2-1: SerialNumber: syz [ 626.626056][ T5858] usb 2-1: config 0 descriptor?? [ 626.642980][ T5858] snd_usb_toneport 2-1:0.0: Line 6 TonePort UX2 found [ 626.866203][T15746] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2516'. [ 626.936973][T15748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.945805][T15748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 627.776719][ T24] usb 4-1: USB disconnect, device number 51 [ 627.840389][T11408] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 627.848484][T11408] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 627.855961][T11408] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 627.863838][T11408] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 627.871682][T11408] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 627.974491][T15755] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2519'. [ 627.993930][T15755] syzkaller0: entered promiscuous mode [ 627.999525][T15755] syzkaller0: entered allmulticast mode [ 628.686199][T15756] chnl_net:caif_netlink_parms(): no params data found [ 628.854620][T15756] bridge0: port 1(bridge_slave_0) entered blocking state [ 628.867990][T15756] bridge0: port 1(bridge_slave_0) entered disabled state [ 628.883135][T15756] bridge_slave_0: entered allmulticast mode [ 628.891190][T15756] bridge_slave_0: entered promiscuous mode [ 628.914101][T15756] bridge0: port 2(bridge_slave_1) entered blocking state [ 628.946972][T15772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 628.956392][ T5858] snd_usb_toneport 2-1:0.0: set_interface failed [ 628.962977][T15772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 628.975630][ T5858] snd_usb_toneport 2-1:0.0: Line 6 TonePort UX2 now disconnected [ 628.998421][T15756] bridge0: port 2(bridge_slave_1) entered disabled state [ 628.999663][ T5858] snd_usb_toneport 2-1:0.0: probe with driver snd_usb_toneport failed with error -71 [ 629.016710][T15756] bridge_slave_1: entered allmulticast mode [ 629.026321][T15756] bridge_slave_1: entered promiscuous mode [ 629.047782][ T5858] usb 2-1: USB disconnect, device number 36 [ 629.151088][T15756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 629.188907][T15756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 629.434729][T15756] team0: Port device team_slave_0 added [ 629.442101][T15756] team0: Port device team_slave_1 added [ 629.479824][T15756] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 629.486879][T15756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 629.519273][T15756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 629.531977][T15756] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 629.539035][T15756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 629.570973][T15756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 629.639156][T15756] hsr_slave_0: entered promiscuous mode [ 629.650170][T15756] hsr_slave_1: entered promiscuous mode [ 629.673890][T15756] debugfs: 'hsr0' already exists in 'hsr' [ 629.680130][T15756] Cannot create hsr debugfs directory [ 629.867477][T15785] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2524'. [ 629.910668][T11409] Bluetooth: hci0: command tx timeout [ 630.289400][T15756] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.361101][ T5945] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 630.455021][T15756] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.500980][ T5945] usb 6-1: device descriptor read/64, error -71 [ 630.575840][T15756] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.690801][T15756] bond0: (slave netdevsim0): Releasing backup interface [ 630.705245][T15756] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 630.770605][ T5945] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 630.940888][ T5945] usb 6-1: device descriptor read/64, error -71 [ 630.966884][T15756] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 630.981712][T15756] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 631.076690][T15756] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 631.083812][ T5945] usb usb6-port1: attempt power cycle [ 631.095978][T15756] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 631.431311][ T5945] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 631.445280][T15756] 8021q: adding VLAN 0 to HW filter on device bond0 [ 631.474276][ T5945] usb 6-1: device descriptor read/8, error -71 [ 631.615158][T15756] 8021q: adding VLAN 0 to HW filter on device team0 [ 631.686603][ T2913] bridge0: port 1(bridge_slave_0) entered blocking state [ 631.693789][ T2913] bridge0: port 1(bridge_slave_0) entered forwarding state [ 631.882898][ T2913] bridge0: port 2(bridge_slave_1) entered blocking state [ 631.890094][ T2913] bridge0: port 2(bridge_slave_1) entered forwarding state [ 631.970695][ T5945] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 631.985041][T11409] Bluetooth: hci0: command tx timeout [ 631.990637][ T9] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 632.002236][ T5945] usb 6-1: device descriptor read/8, error -71 [ 632.055364][T15756] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 632.128419][ T5945] usb usb6-port1: unable to enumerate USB device [ 632.188550][T15756] veth0_vlan: entered promiscuous mode [ 632.203426][T15756] veth1_vlan: entered promiscuous mode [ 632.203825][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 632.223498][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 632.250494][T15756] veth0_macvtap: entered promiscuous mode [ 632.264165][T15756] veth1_macvtap: entered promiscuous mode [ 632.278865][T15756] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 632.307145][T15756] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 632.324976][T14829] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.344452][T14829] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.357388][T14829] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.389043][T14829] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 632.426416][T14829] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 632.440055][ T9] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 632.456852][T14829] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 632.497805][T14831] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 632.515868][T14831] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 632.566326][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 632.620284][ T9] usb 2-1: Product: syz [ 632.636904][ T9] usb 2-1: Manufacturer: syz [ 632.654858][T11409] Bluetooth: hci0: Malformed MSFT vendor event: 0x02 [ 632.715418][ T9] usb 2-1: SerialNumber: syz [ 632.739494][ T9] usb 2-1: config 0 descriptor?? [ 633.006571][ T5855] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 633.060610][ T5944] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 633.103729][ T9] usb 2-1: USB disconnect, device number 37 [ 633.153250][ T6796] udevd[6796]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 633.172230][ T5855] usb 1-1: config 0 has no interfaces? [ 633.179526][ T5855] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 633.191823][ T5855] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 633.209219][ T5855] usb 1-1: Product: syz [ 633.239301][ T5855] usb 1-1: Manufacturer: syz [ 633.250594][T15837] FAULT_INJECTION: forcing a failure. [ 633.250594][T15837] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 633.265662][ T5944] usb 7-1: Using ep0 maxpacket: 32 [ 633.276713][T15837] CPU: 0 UID: 0 PID: 15837 Comm: syz.5.2537 Not tainted syzkaller #0 PREEMPT(full) [ 633.276739][T15837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 633.276750][T15837] Call Trace: [ 633.276758][T15837] [ 633.276766][T15837] dump_stack_lvl+0x189/0x250 [ 633.276793][T15837] ? __pfx____ratelimit+0x10/0x10 [ 633.276823][T15837] ? __pfx_dump_stack_lvl+0x10/0x10 [ 633.276844][T15837] ? __pfx__printk+0x10/0x10 [ 633.276867][T15837] ? __might_fault+0xb0/0x130 [ 633.276895][T15837] ? rcu_is_watching+0x15/0xb0 [ 633.276914][T15837] should_fail_ex+0x414/0x560 [ 633.276939][T15837] _copy_from_iter+0x1db/0x16f0 [ 633.276955][T15837] ? do_raw_spin_unlock+0x122/0x240 [ 633.276979][T15837] ? rcu_is_watching+0x15/0xb0 [ 633.276999][T15837] ? __pfx__copy_from_iter+0x10/0x10 [ 633.277015][T15837] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 633.277037][T15837] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 633.277061][T15837] ? rcu_is_watching+0x15/0xb0 [ 633.277081][T15837] tun_get_user+0x219/0x3e20 [ 633.277100][T15837] ? rcu_is_watching+0x15/0xb0 [ 633.277117][T15837] ? lock_release+0x4b/0x3e0 [ 633.277145][T15837] ? aa_file_perm+0x44d/0x1550 [ 633.277163][T15837] ? __pfx_tun_get_user+0x10/0x10 [ 633.277185][T15837] ? rcu_qs+0xc4/0x170 [ 633.277201][T15837] ? ref_tracker_alloc+0x318/0x460 [ 633.277228][T15837] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 633.277260][T15837] ? trace_rcu_utilization+0x47/0x1d0 [ 633.277281][T15837] ? tun_get+0x1c/0x2f0 [ 633.277295][T15837] ? tun_get+0x1c/0x2f0 [ 633.277311][T15837] ? rcu_is_watching+0x15/0xb0 [ 633.277328][T15837] ? tun_get+0x1c/0x2f0 [ 633.277343][T15837] ? lock_release+0x4b/0x3e0 [ 633.277385][T15837] ? common_file_perm+0x1b5/0x230 [ 633.277414][T15837] ? tun_get+0x1c/0x2f0 [ 633.277432][T15837] tun_chr_write_iter+0x113/0x200 [ 633.277482][T15837] vfs_write+0x5c9/0xb30 [ 633.277508][T15837] ? rcu_is_watching+0x15/0xb0 [ 633.277530][T15837] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 633.277582][T15837] ? __pfx_vfs_write+0x10/0x10 [ 633.277615][T15837] ? __fget_files+0x2a/0x420 [ 633.277651][T15837] ksys_write+0x145/0x250 [ 633.277677][T15837] ? __pfx_ksys_write+0x10/0x10 [ 633.277707][T15837] ? rcu_is_watching+0x15/0xb0 [ 633.277730][T15837] do_syscall_64+0xfa/0x3b0 [ 633.277761][T15837] ? rcu_is_watching+0x15/0xb0 [ 633.277782][T15837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.277804][T15837] ? clear_bhb_loop+0x60/0xb0 [ 633.277829][T15837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.277850][T15837] RIP: 0033:0x7fcc9858ebe9 [ 633.277870][T15837] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 633.277889][T15837] RSP: 002b:00007fcc9948b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 633.277912][T15837] RAX: ffffffffffffffda RBX: 00007fcc987b5fa0 RCX: 00007fcc9858ebe9 [ 633.277929][T15837] RDX: 00000000000010da RSI: 00002000000000c0 RDI: 0000000000000005 [ 633.277944][T15837] RBP: 00007fcc9948b090 R08: 0000000000000000 R09: 0000000000000000 [ 633.277958][T15837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 633.277971][T15837] R13: 00007fcc987b6038 R14: 00007fcc987b5fa0 R15: 00007fcc988dfa28 [ 633.277993][T15837] [ 633.279355][ T5944] usb 7-1: config 0 has an invalid interface number: 51 but max is 0 [ 633.605580][ T5855] usb 1-1: SerialNumber: syz [ 633.635042][ T5855] usb 1-1: config 0 descriptor?? [ 633.650287][ T5944] usb 7-1: config 0 has no interface number 0 [ 633.687483][ T5944] usb 7-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 633.698473][ T5944] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 633.710423][ T5944] usb 7-1: Product: syz [ 633.718637][ T5944] usb 7-1: Manufacturer: syz [ 633.726112][ T5944] usb 7-1: SerialNumber: syz [ 633.751228][ T5944] usb 7-1: config 0 descriptor?? [ 633.764898][ T5944] quatech2 7-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 633.987521][ T5944] usb 7-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 634.000643][ T5945] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 634.015175][ T5944] usb 7-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 634.061624][T11409] Bluetooth: hci0: command tx timeout [ 634.150638][ T5945] usb 6-1: Using ep0 maxpacket: 32 [ 634.157083][ T5945] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 634.176648][ T5945] usb 6-1: config 0 has no interface number 0 [ 634.206239][ T5945] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 634.307469][ T5945] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 634.374393][ T5945] usb 6-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 634.394214][ T5945] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 634.416225][ T5945] usb 6-1: config 0 descriptor?? [ 634.942832][T15846] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 635.077110][T15851] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2541'. [ 635.127221][ T5945] input: HID 28bd:0094 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.1/0003:28BD:0094.003D/input/input56 [ 635.140747][T15852] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2541'. [ 635.198370][ T5945] uclogic 0003:28BD:0094.003D: input,hidraw0: USB HID v0.00 Device [HID 28bd:0094] on usb-dummy_hcd.5-1/input1 [ 635.312894][T15855] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 635.582253][ T5978] usb 1-1: USB disconnect, device number 33 [ 635.620825][ T5945] usb 2-1: new low-speed USB device number 38 using dummy_hcd [ 635.697654][ T24] usb 6-1: USB disconnect, device number 71 [ 635.730683][ T5855] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 635.783511][ T5945] usb 2-1: config index 0 descriptor too short (expected 6427, got 27) [ 635.793371][ T5945] usb 2-1: config 0 has an invalid interface number: 21 but max is 0 [ 635.808932][ T5945] usb 2-1: config 0 has no interface number 0 [ 635.816459][ T5945] usb 2-1: config 0 interface 21 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 635.850011][ T5945] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 635.859522][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 635.870978][ T5945] usb 2-1: config 0 descriptor?? [ 635.903107][ T5855] usb 4-1: config 0 has an invalid interface number: 95 but max is 0 [ 635.912424][ T5855] usb 4-1: config 0 has no interface number 0 [ 635.918557][ T5855] usb 4-1: config 0 interface 95 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 635.930296][ T5855] usb 4-1: New USB device found, idVendor=7725, idProduct=b0a8, bcdDevice= 7.46 [ 635.939474][ T5855] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.947722][ T5855] usb 4-1: Product: syz [ 635.951976][ T5855] usb 4-1: Manufacturer: syz [ 635.956740][ T5855] usb 4-1: SerialNumber: syz [ 635.965375][ T5855] usb 4-1: config 0 descriptor?? [ 635.973983][T15863] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 636.050701][ T24] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 636.109756][ C0] usb 7-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 636.110184][ T5978] usb 7-1: USB disconnect, device number 6 [ 636.127398][ T5978] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 636.144128][T11409] Bluetooth: hci0: command tx timeout [ 636.156549][ T5978] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 636.172387][ T5978] quatech2 7-1:0.51: device disconnected [ 636.188498][T15863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 636.197812][T15863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 636.215497][ T24] usb 6-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 636.225243][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.233500][ T24] usb 6-1: Product: syz [ 636.243330][ T24] usb 6-1: Manufacturer: syz [ 636.250397][ T5855] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 636.257377][ T24] usb 6-1: SerialNumber: syz [ 636.260339][ T24] usb 6-1: config 0 descriptor?? [ 636.282298][ T24] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 636.308457][ T5855] usb 4-1: MIDIStreaming interface descriptor not found [ 636.341513][ T5945] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 636.343977][ T5855] usb 4-1: USB disconnect, device number 52 [ 636.380597][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 636.503366][ T5854] udevd[5854]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.95/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 636.519463][ T5945] usb 1-1: Using ep0 maxpacket: 8 [ 636.533846][ T5945] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 636.544043][ T5945] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 636.554627][ T5945] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 636.668500][ T5945] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 636.706417][ T5945] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 636.717355][ T5945] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 636.887524][ T24] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 636.898444][ T24] sq905c 6-1:0.0: probe with driver sq905c failed with error -71 [ 636.909406][ T24] usb 6-1: USB disconnect, device number 72 [ 637.013387][ T5945] usb 1-1: GET_CAPABILITIES returned 0 [ 637.018993][ T5945] usbtmc 1-1:16.0: can't read capabilities [ 637.252778][T15894] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2551'. [ 637.302199][T15894] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.356413][T15894] bridge_slave_1 (unregistering): left allmulticast mode [ 637.364877][T15894] bridge_slave_1 (unregistering): left promiscuous mode [ 637.376335][T15894] bridge0: port 2(bridge_slave_1) entered disabled state [ 637.420596][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 637.560805][ T5855] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 637.730843][ T5944] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 637.751501][ T5855] usb 7-1: unable to get BOS descriptor or descriptor too short [ 637.762621][ T5855] usb 7-1: config 3 has an invalid interface number: 19 but max is 0 [ 637.770850][ T5855] usb 7-1: config 3 has an invalid interface number: 4 but max is 0 [ 637.782724][ T5855] usb 7-1: config 3 has 2 interfaces, different from the descriptor's value: 1 [ 637.807355][ T5855] usb 7-1: config 3 has no interface number 0 [ 637.827261][ T5855] usb 7-1: config 3 has no interface number 1 [ 637.844474][ T5855] usb 7-1: config 3 interface 19 altsetting 9 has 4 endpoint descriptors, different from the interface descriptor's value: 6 [ 637.880375][ T5855] usb 7-1: too many endpoints for config 3 interface 4 altsetting 131: 175, using maximum allowed: 30 [ 637.891576][ T5944] usb 6-1: Using ep0 maxpacket: 16 [ 637.916750][ T5944] usb 6-1: unable to get BOS descriptor or descriptor too short [ 637.949423][ T5855] usb 7-1: config 3 interface 4 altsetting 131 bulk endpoint 0x8E has invalid maxpacket 32 [ 637.961916][ T5944] usb 6-1: config 8 has an invalid interface number: 101 but max is 0 [ 637.980183][ T5944] usb 6-1: config 8 has no interface number 0 [ 637.990345][ T5855] usb 7-1: config 3 interface 4 altsetting 131 endpoint 0xC has invalid wMaxPacketSize 0 [ 638.006701][ T5944] usb 6-1: too many endpoints for config 8 interface 101 altsetting 114: 112, using maximum allowed: 30 [ 638.029264][ T5855] usb 7-1: config 3 interface 4 altsetting 131 bulk endpoint 0xC has invalid maxpacket 0 [ 638.058669][ T5944] usb 6-1: config 8 interface 101 altsetting 114 has 0 endpoint descriptors, different from the interface descriptor's value: 112 [ 638.074708][ T5855] usb 7-1: config 3 interface 4 altsetting 131 has 2 endpoint descriptors, different from the interface descriptor's value: 175 [ 638.102356][ T5944] usb 6-1: config 8 interface 101 has no altsetting 0 [ 638.113408][ T5855] usb 7-1: config 3 interface 19 has no altsetting 0 [ 638.125661][ T5944] usb 6-1: New USB device found, idVendor=a257, idProduct=2013, bcdDevice=ab.34 [ 638.137915][ T5855] usb 7-1: config 3 interface 4 has no altsetting 0 [ 638.149071][ T5944] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.157803][ T5855] usb 7-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice=53.f5 [ 638.166903][ T5855] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.176739][ T5944] usb 6-1: Product: syz [ 638.184428][ T5944] usb 6-1: Manufacturer: syz [ 638.189352][ T5855] usb 7-1: Product: syz [ 638.195673][ T5944] usb 6-1: SerialNumber: syz [ 638.204210][ T5855] usb 7-1: Manufacturer: syz [ 638.212948][ T5855] usb 7-1: SerialNumber: syz [ 638.329627][ T5978] usb 2-1: USB disconnect, device number 38 [ 638.341200][ T24] usb 4-1: new full-speed USB device number 53 using dummy_hcd [ 638.425427][T15897] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2552'. [ 638.439846][T15897] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2552'. [ 638.449472][T15894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.449491][T15897] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2552'. [ 638.460834][T15894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.494092][ T24] usb 4-1: config index 0 descriptor too short (expected 24868, got 36) [ 638.506285][T15897] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2552'. [ 638.506289][ T24] usb 4-1: config 127 has too many interfaces: 186, using maximum allowed: 32 [ 638.518242][ T24] usb 4-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 638.561797][ T24] usb 4-1: config 127 has 1 interface, different from the descriptor's value: 186 [ 638.568396][ T5855] pl2303 7-1:3.19: required endpoints missing [ 638.571696][ T24] usb 4-1: config 127 has no interface number 0 [ 638.583270][ T5944] usb 6-1: USB disconnect, device number 73 [ 638.608880][ T5855] pl2303 7-1:3.4: required interrupt-in endpoint missing [ 638.614527][ T24] usb 4-1: config 127 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 10 [ 638.644577][ T24] usb 4-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 638.649847][ T5855] usb 7-1: USB disconnect, device number 7 [ 638.676011][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.684480][ T24] usb 4-1: Product: syz [ 638.689240][ T24] usb 4-1: Manufacturer: syz [ 638.695915][ T24] usb 4-1: SerialNumber: syz [ 638.913797][ T24] hso 4-1:127.2: Failed to find INT IN ep [ 638.922333][ T24] usb 4-1: USB disconnect, device number 53 [ 639.204714][T15921] fuse: Bad value for 'fd' [ 639.844662][ T5855] usb 1-1: USB disconnect, device number 34 [ 640.497436][T15950] batman_adv: batadv0: Adding interface: dummy0 [ 640.506060][T15950] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 640.539533][T15950] batman_adv: batadv0: Interface activated: dummy0 [ 640.951143][ T24] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 641.030763][ T5855] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 641.110747][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 641.117256][ T24] usb 6-1: unable to get BOS descriptor or descriptor too short [ 641.201368][ T5978] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 641.213169][ T24] usb 6-1: config 244 has an invalid interface number: 68 but max is 0 [ 641.214674][ T5855] usb 7-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=30.62 [ 641.224387][ T24] usb 6-1: config 244 has no interface number 0 [ 641.269598][ T24] usb 6-1: config 244 interface 68 altsetting 3 has an endpoint descriptor with address 0xF8, changing to 0x88 [ 641.290583][ T24] usb 6-1: config 244 interface 68 altsetting 3 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 641.298513][ T5855] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.321518][ T24] usb 6-1: config 244 interface 68 altsetting 3 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 641.333198][ T24] usb 6-1: config 244 interface 68 altsetting 3 endpoint 0xA has invalid wMaxPacketSize 0 [ 641.340690][ T5855] usb 7-1: Product: syz [ 641.344054][ T24] usb 6-1: config 244 interface 68 has no altsetting 0 [ 641.347359][ T5855] usb 7-1: Manufacturer: syz [ 641.361417][ T5978] usb 4-1: Using ep0 maxpacket: 16 [ 641.362760][ T5855] usb 7-1: SerialNumber: syz [ 641.368501][ T5978] usb 4-1: config 0 has an invalid interface number: 176 but max is 0 [ 641.379962][ T5978] usb 4-1: config 0 has no interface number 0 [ 641.382844][ T5855] usb 7-1: config 0 descriptor?? [ 641.388880][ T5978] usb 4-1: New USB device found, idVendor=1004, idProduct=61aa, bcdDevice=18.b3 [ 641.401138][ T24] usb 6-1: New USB device found, idVendor=0867, idProduct=9812, bcdDevice=24.0f [ 641.404660][ T5855] usb 7-1: selecting invalid altsetting 3 [ 641.417028][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.420499][ T5855] comedi comedi5: could not set alternate setting 3 in high speed [ 641.428722][ T5978] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.486283][ T5855] usbdux 7-1:0.0: driver 'usbdux' failed to auto-configure device. [ 641.496763][ T24] usb 6-1: Product: syz [ 641.506660][ T24] usb 6-1: Manufacturer: syz [ 641.507062][ T5855] usbdux 7-1:0.0: probe with driver usbdux failed with error -22 [ 641.527481][ T5978] usb 4-1: Product: syz [ 641.538395][ T24] usb 6-1: SerialNumber: syz [ 641.547839][ T5978] usb 4-1: Manufacturer: syz [ 641.558052][ T5978] usb 4-1: SerialNumber: syz [ 641.591061][ T5978] usb 4-1: config 0 descriptor?? [ 641.620667][ T5858] usb 7-1: USB disconnect, device number 8 [ 641.641119][ T5978] usb 4-1: bad CDC descriptors [ 641.826381][ T24] comedi comedi5: Endpoint has wrong direction [ 641.833402][ T24] dt9812 6-1:244.68: driver 'dt9812' failed to auto-configure device. [ 641.851445][ T24] usb 6-1: USB disconnect, device number 74 [ 641.866182][ T5858] usb 4-1: USB disconnect, device number 54 [ 642.236223][T15980] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2574'. [ 642.494333][T15988] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 642.502338][T15988] team0: Port device batadv1 added [ 642.720987][ T5978] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 642.821140][ T5855] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 642.884547][ T5978] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 642.930236][ T5978] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 642.948828][ T5978] usb 4-1: Product: syz [ 642.969362][ T5978] usb 4-1: Manufacturer: syz [ 642.980599][ T5855] usb 1-1: Using ep0 maxpacket: 32 [ 642.983675][ T5978] usb 4-1: SerialNumber: syz [ 642.988068][ T5855] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 643.002716][ T5978] usb 4-1: config 0 descriptor?? [ 643.014717][ T5855] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 643.016412][ T5978] ch341 4-1:0.0: ch341-uart converter detected [ 643.030632][ T5855] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 643.041214][ T5855] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.056075][ T5855] usb 1-1: config 0 descriptor?? [ 643.067061][ T5855] hub 1-1:0.0: USB hub found [ 643.263288][ T5855] hub 1-1:0.0: 1 port detected [ 643.660905][ T92] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 643.732590][T16019] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2585'. [ 643.734083][ T5858] usb 1-1: USB disconnect, device number 35 [ 643.829601][ T5978] usb 4-1: failed to send control message: -71 [ 643.839107][ T5978] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71 [ 643.858299][ T5978] usb 4-1: USB disconnect, device number 55 [ 643.911685][ T5978] ch341 4-1:0.0: device disconnected [ 643.933388][ T92] usb 2-1: device descriptor read/64, error -71 [ 644.314192][ T92] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 644.359823][T16030] input: syz1 as /devices/virtual/input/input57 [ 644.472394][ T9] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 644.485387][ T92] usb 2-1: device descriptor read/64, error -71 [ 644.725644][ T92] usb usb2-port1: attempt power cycle [ 644.811422][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 644.833780][ T9] usb 6-1: config index 0 descriptor too short (expected 1316, got 36) [ 644.842999][ T9] usb 6-1: config 0 has an invalid interface number: 157 but max is -1 [ 644.875008][ T9] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 644.889686][ T9] usb 6-1: config 0 has no interface number 0 [ 644.900206][ T9] usb 6-1: config 0 interface 157 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 16 [ 644.946645][T16061] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 644.957521][T16061] gretap1: entered allmulticast mode [ 644.980475][ T9] usb 6-1: config 0 interface 157 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 645.004120][ T9] usb 6-1: config 0 interface 157 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 645.023312][ T9] usb 6-1: New USB device found, idVendor=0483, idProduct=3746, bcdDevice=94.86 [ 645.035577][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.044124][ T9] usb 6-1: Product: syz [ 645.048466][ T9] usb 6-1: Manufacturer: syz [ 645.081189][ T92] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 645.097334][ T9] usb 6-1: SerialNumber: syz [ 645.122299][ T92] usb 2-1: device descriptor read/8, error -71 [ 645.145096][ T9] usb 6-1: config 0 descriptor?? [ 645.192759][T16028] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 645.430615][ T92] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 645.454005][ T92] usb 2-1: device descriptor read/8, error -71 [ 645.561233][ T92] usb usb2-port1: unable to enumerate USB device [ 645.708591][T16076] bridge0: port 3(macsec0) entered blocking state [ 645.715497][T16076] bridge0: port 3(macsec0) entered disabled state [ 645.726267][T16076] macsec0: entered allmulticast mode [ 645.756185][T16076] veth1_macvtap: entered allmulticast mode [ 645.770872][T16076] macsec0: entered promiscuous mode [ 646.682438][T16090] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2600'. [ 646.892723][T16098] ptrace attach of "./syz-executor exec"[15756] was attempted by "./syz-executor exec"[16098] [ 647.335380][ T9] ftdi_sio 6-1:0.157: FTDI USB Serial Device converter detected [ 647.384233][ T9] ftdi_sio ttyUSB0: unknown device type: 0x9486 [ 647.416963][ T9] usb 6-1: USB disconnect, device number 75 [ 647.451872][ T9] ftdi_sio 6-1:0.157: device disconnected [ 647.607923][T16108] netlink: 'syz.1.2606': attribute type 10 has an invalid length. [ 647.618265][T16108] dummy0: entered promiscuous mode [ 647.626168][T16108] dummy0: entered allmulticast mode [ 647.632006][T16108] team0: Port device dummy0 added [ 647.639806][T16108] netlink: 'syz.1.2606': attribute type 10 has an invalid length. [ 647.686030][T16108] team0 (unregistering): left allmulticast mode [ 647.692514][T16108] team_slave_0: left allmulticast mode [ 647.783007][T16108] team_slave_1: left allmulticast mode [ 647.790824][T16108] batadv1: left allmulticast mode [ 647.809522][T16108] dummy0: left allmulticast mode [ 647.819690][T16108] team0 (unregistering): left promiscuous mode [ 647.828903][T16108] team_slave_0: left promiscuous mode [ 647.834903][T16108] team_slave_1: left promiscuous mode [ 647.840512][T16108] batadv1: left promiscuous mode [ 647.849168][T16108] dummy0: left promiscuous mode [ 647.854854][T16108] bridge0: port 3(team0) entered disabled state [ 647.896995][T16108] tipc: Disabling bearer [ 647.913326][T16108] team0 (unregistering): Port device team_slave_0 removed [ 648.235808][T16108] team0 (unregistering): Port device team_slave_1 removed [ 648.271419][T16108] team0 (unregistering): Port device batadv1 removed [ 648.285030][T16108] team0 (unregistering): Port device dummy0 removed [ 648.389558][T16117] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2608'. [ 648.400331][T16117] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 648.541048][ T5945] usb 7-1: new low-speed USB device number 9 using dummy_hcd [ 648.705148][ T5945] usb 7-1: string descriptor 0 read error: -22 [ 648.711570][ T5945] usb 7-1: New USB device found, idVendor=1415, idProduct=0003, bcdDevice=65.5d [ 648.790655][ T5945] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 648.800205][ T5945] usb 7-1: config 0 descriptor?? [ 649.027272][T16115] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 649.049335][T16115] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 649.873170][T16153] netlink: 4400 bytes leftover after parsing attributes in process `syz.6.2617'. [ 649.946037][T16160] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2620'. [ 649.960169][T16160] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 650.080385][T16172] fuse: Bad value for 'fd' [ 650.087223][T16171] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 650.120765][ T5978] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 650.270701][ T5978] usb 4-1: Using ep0 maxpacket: 16 [ 650.277861][ T5978] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 650.294617][ T5978] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 650.332694][ T5978] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 650.342284][ T5978] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.350284][ T5978] usb 4-1: Product: syz [ 650.459445][ T5978] usb 4-1: Manufacturer: syz [ 650.465077][ T5978] usb 4-1: SerialNumber: syz [ 650.660627][ T24] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 650.811270][ T5858] usb 6-1: new full-speed USB device number 76 using dummy_hcd [ 650.840990][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 650.883508][T16156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 650.902253][T16156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.903138][ T5978] usb 4-1: 0:2 : does not exist [ 650.972487][ T5858] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 651.035511][ T5858] usb 6-1: New USB device found, idVendor=04b3, idProduct=3100, bcdDevice= 0.00 [ 651.059839][ T24] usb 1-1: unable to get BOS descriptor or descriptor too short [ 651.067588][T16200] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2629'. [ 651.089490][ T5978] usb 4-1: USB disconnect, device number 56 [ 651.134764][ T5858] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 651.298192][T16203] fuse: Bad value for 'fd' [ 651.318352][T16203] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 651.361652][ T9] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 651.380823][T16203] bond0: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 651.383389][ T5858] usb 6-1: config 0 descriptor?? [ 651.398950][T16203] bond0: (slave ipvlan0): Error -95 calling set_mac_address [ 651.413744][ T24] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E [ 651.427305][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 651.479416][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 651.520904][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 651.527527][ T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 651.538643][ T9] usb 2-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 651.592302][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 651.610918][ T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 651.620123][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.664286][ T9] usb 2-1: Product: syz [ 651.668574][ T9] usb 2-1: Manufacturer: syz [ 651.676203][ T9] usb 2-1: SerialNumber: syz [ 651.758089][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 651.908087][T13078] usb 2-1: USB disconnect, device number 43 [ 651.909722][ T24] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 0 [ 651.924784][ T5858] usbhid 6-1:0.0: can't add hid device: -71 [ 651.971755][ T5858] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 652.020733][ T9] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 652.099788][ T5858] usb 6-1: USB disconnect, device number 76 [ 652.116978][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 652.163113][ T9] usb 4-1: device descriptor read/64, error -71 [ 652.193743][T16219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 652.205054][T16219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 652.210589][ T24] usb 1-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 652.249850][ T24] usb 1-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84 [ 652.276110][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 652.290800][ T24] usb 1-1: Product: syz [ 652.297237][ T24] usb 1-1: Manufacturer: syz [ 652.305455][ T24] usb 1-1: SerialNumber: syz [ 652.311649][ T24] usb 1-1: config 0 descriptor?? [ 652.328455][ T24] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 652.357966][ T24] snd-usb-audio 1-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 652.396885][ T5872] udevd[5872]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 652.401212][ T9] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 652.572943][ T9] usb 4-1: device descriptor read/64, error -71 [ 652.663584][T16234] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2641'. [ 652.678236][T16234] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2641'. [ 652.687712][ T9] usb usb4-port1: attempt power cycle [ 652.696810][T16234] netlink: 'syz.1.2641': attribute type 7 has an invalid length. [ 652.786335][T16240] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2643'. [ 652.838685][T16240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 652.848011][T16240] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 653.030646][ T9] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 653.051199][ T9] usb 4-1: device descriptor read/8, error -71 [ 653.070759][ T24] usb 2-1: new full-speed USB device number 44 using dummy_hcd [ 653.200581][ T24] usb 2-1: device descriptor read/64, error -71 [ 653.290699][ T9] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 653.321261][ T9] usb 4-1: device descriptor read/8, error -71 [ 653.431048][ T9] usb usb4-port1: unable to enumerate USB device [ 653.471039][ T24] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 653.624424][T16187] usb 1-1: USB disconnect, device number 36 [ 653.630815][ T24] usb 2-1: device descriptor read/64, error -71 [ 653.751576][ T24] usb usb2-port1: attempt power cycle [ 653.912084][ T5945] dvb-usb: found a 'Sony PlayTV' in cold state, will try to load a firmware [ 653.932482][ T5945] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 653.957252][ T5945] dib0700: firmware download failed at 7 with -22 [ 654.180633][ T24] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 654.211450][ T24] usb 2-1: device descriptor read/8, error -71 [ 654.452317][ T24] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 654.612988][ T24] usb 2-1: device descriptor read/8, error -71 [ 654.684237][T16271] netlink: 'syz.6.2650': attribute type 3 has an invalid length. [ 654.791251][ T24] usb usb2-port1: unable to enumerate USB device [ 655.065445][T16278] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2651'. [ 655.410812][ T24] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 655.582555][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 655.589669][ T24] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 655.598767][ T24] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 655.612176][ T24] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 655.639862][ T24] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 655.667481][ T24] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 655.696547][ T24] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 655.708436][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.945754][ T24] usb 4-1: usb_control_msg returned -32 [ 655.955700][ T24] usbtmc 4-1:16.0: can't read capabilities [ 656.121035][T13078] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 656.345518][T13078] usb 6-1: Using ep0 maxpacket: 32 [ 656.367950][T13078] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 656.378983][T13078] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 656.389287][T13078] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 656.398457][T13078] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.409617][T13078] usb 6-1: config 0 descriptor?? [ 656.663949][T16292] batadv_slave_1: entered promiscuous mode [ 656.691941][T16310] netlink: 92 bytes leftover after parsing attributes in process `syz.0.2658'. [ 657.196928][T13078] koneplus 0003:1E7D:2D51.003E: unknown main item tag 0x0 [ 657.221036][T16314] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 657.236206][T13078] koneplus 0003:1E7D:2D51.003E: unknown main item tag 0x0 [ 657.244445][T16306] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2651'. [ 657.253637][T16306] netlink: 'syz.3.2651': attribute type 5 has an invalid length. [ 657.262434][T16306] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2651'. [ 657.314015][T13078] koneplus 0003:1E7D:2D51.003E: unknown main item tag 0x0 [ 657.331072][T13078] koneplus 0003:1E7D:2D51.003E: unknown main item tag 0x0 [ 657.332510][T16306] geneve2: entered promiscuous mode [ 657.344110][T16306] geneve2: entered allmulticast mode [ 657.441185][T16044] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 657.452943][T16042] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 657.467465][T16042] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 657.477080][T16042] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 657.486773][T13078] koneplus 0003:1E7D:2D51.003E: unknown main item tag 0x0 [ 657.495589][T13078] koneplus 0003:1E7D:2D51.003E: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.5-1/input0 [ 657.784522][T16292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 657.794022][T16292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 657.872943][T16292] batadv_slave_1: left promiscuous mode [ 657.899772][T13078] usb 6-1: USB disconnect, device number 77 [ 658.480179][ T30] audit: type=1326 audit(1755870525.914:3963): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16360 comm="syz.1.2670" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f50e858ebe9 code=0x0 [ 658.747460][T16370] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 658.770305][T16370] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 658.815838][ T5945] usb 4-1: USB disconnect, device number 61 [ 659.531034][ T5945] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 659.580297][T16389] geneve2: entered promiscuous mode [ 659.585802][T16389] geneve2: entered allmulticast mode [ 659.712367][T16400] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2680'. [ 659.721476][T16400] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 659.729079][T16400] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 659.930893][ T5945] usb 6-1: Using ep0 maxpacket: 32 [ 659.937500][ T5945] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 659.946595][ T5945] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 659.957905][ T5945] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 659.969579][ T5945] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 659.983531][ T5945] usb 6-1: config 0 interface 0 has no altsetting 0 [ 659.993352][ T5945] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 660.004901][ T5945] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 660.018075][ T5945] usb 6-1: Product: syz [ 660.022657][ T5945] usb 6-1: Manufacturer: syz [ 660.086992][ T5945] usb 6-1: SerialNumber: syz [ 660.173096][ T5945] usb 6-1: config 0 descriptor?? [ 660.181975][ T5945] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 660.203852][ T5945] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 660.499507][T16386] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=768 (1536 ns) > initial count (192 ns). Using initial count to start timer. [ 660.698390][ T5945] usb 6-1: USB disconnect, device number 78 [ 660.731796][ T5945] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 661.073973][T16413] tipc: Enabled bearer , priority 0 [ 661.083380][T16413] syzkaller0: entered promiscuous mode [ 661.097343][T16413] syzkaller0: entered allmulticast mode [ 661.123177][T16413] tipc: Resetting bearer [ 661.153126][T16413] tipc: Disabling bearer [ 661.310821][ T5945] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 661.450682][ T5945] usb 6-1: device descriptor read/64, error -71 [ 661.665361][T11408] Bluetooth: hci0: command 0x0405 tx timeout [ 661.720950][ T5945] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 661.770174][T16433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.787335][T16433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.850769][ T5945] usb 6-1: device descriptor read/64, error -71 [ 661.961301][ T5945] usb usb6-port1: attempt power cycle [ 662.023957][T16436] program syz.6.2688 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 662.033681][ T5858] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 662.280824][ T5858] usb 4-1: Using ep0 maxpacket: 32 [ 662.287273][ T5858] usb 4-1: config 0 has an invalid interface number: 183 but max is 0 [ 662.310682][ T5945] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 662.330090][ T5858] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 662.352854][ T5945] usb 6-1: device descriptor read/8, error -71 [ 662.361908][ T5858] usb 4-1: config 0 has no interface number 0 [ 662.369314][ T5858] usb 4-1: config 0 interface 183 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 528 [ 662.389616][ T5858] usb 4-1: config 0 interface 183 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 662.414575][ T5858] usb 4-1: New USB device found, idVendor=06d0, idProduct=0622, bcdDevice=70.f8 [ 662.427048][ T5858] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.442869][ T5858] usb 4-1: Product: syz [ 662.450551][ T5858] usb 4-1: Manufacturer: syz [ 662.462707][ T5858] usb 4-1: SerialNumber: syz [ 662.483722][ T5858] usb 4-1: config 0 descriptor?? [ 662.490350][T16431] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 662.503455][ T5858] net1080 4-1:0.183: probe with driver net1080 failed with error -22 [ 662.610698][ T5945] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 662.631155][ T5945] usb 6-1: device descriptor read/8, error -71 [ 662.743595][ T5945] usb usb6-port1: unable to enumerate USB device [ 663.581999][ T5945] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 663.830656][ T5945] usb 1-1: Using ep0 maxpacket: 8 [ 663.844214][ T5945] usb 1-1: config 0 has an invalid interface number: 31 but max is 0 [ 663.866956][ T5945] usb 1-1: config 0 has no interface number 0 [ 663.951207][ T5945] usb 1-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 664.027201][ T5945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.124722][ T5945] usb 1-1: Product: syz [ 664.140650][ T5945] usb 1-1: Manufacturer: syz [ 664.146583][ T5945] usb 1-1: SerialNumber: syz [ 664.161024][ T5945] usb 1-1: config 0 descriptor?? [ 664.176873][T16462] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2693'. [ 664.375651][ T5945] usb 1-1: Found UVC 0.04 device syz (046d:08c3) [ 664.382771][ T5858] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 664.404600][ T5945] usb 1-1: No valid video chain found. [ 664.422015][ T5945] usb 1-1: USB disconnect, device number 37 [ 664.552060][ T5858] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 664.562653][ T5858] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 664.589249][ T5858] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 664.604002][ T5858] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.612640][ T5858] usb 6-1: Product: syz [ 664.616915][ T5858] usb 6-1: Manufacturer: syz [ 664.625057][ T5858] usb 6-1: SerialNumber: syz [ 664.845089][ T5858] usb 6-1: Audio class v2/v3 interfaces need an interface association [ 664.914781][ T5945] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 664.972856][ T5858] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 665.035131][ T5858] usb 6-1: USB disconnect, device number 83 [ 665.113832][ T8830] udevd[8830]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 665.152728][ T5945] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 56, changing to 9 [ 665.213312][ T5945] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 8703, setting to 1024 [ 665.224954][ T5945] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 665.234411][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 665.245982][ T5945] usb 2-1: config 0 descriptor?? [ 665.370938][T13078] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 665.555502][ T92] usb 4-1: USB disconnect, device number 62 [ 666.033985][ T5945] ath6kl: Failed to submit usb control message: -71 [ 666.124315][ T5945] ath6kl: unable to send the bmi data to the device: -71 [ 666.144635][ T5945] ath6kl: Unable to send get target info: -71 [ 666.163525][ T5945] ath6kl: Failed to init ath6kl core: -71 [ 666.200877][ T5945] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 666.223749][T16492] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2701'. [ 666.254137][T16492] : entered promiscuous mode [ 666.434743][ T5945] usb 2-1: USB disconnect, device number 48 [ 666.749717][T16503] sctp: [Deprecated]: syz.6.2705 (pid 16503) Use of struct sctp_assoc_value in delayed_ack socket option. [ 666.749717][T16503] Use struct sctp_sack_info instead [ 666.772441][T16503] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 666.782505][T16503] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 666.801557][ T5945] usb 2-1: new full-speed USB device number 49 using dummy_hcd [ 667.001971][ T5945] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 667.002004][ T5945] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 667.002040][ T5945] usb 2-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 667.002056][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 667.003093][ T5945] usb 2-1: config 0 descriptor?? [ 667.004165][T16490] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 667.429655][ T5945] input: HID 041e:3100 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:041E:3100.003F/input/input59 [ 667.525664][ T5945] creative-sb0540 0003:041E:3100.003F: input,hidraw0: USB HID v0.05 Device [HID 041e:3100] on usb-dummy_hcd.1-1/input0 [ 667.703356][T16490] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 667.737685][T16490] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 667.852743][T13078] usb 2-1: USB disconnect, device number 49 [ 668.160659][ T9] usb 1-1: new full-speed USB device number 39 using dummy_hcd [ 668.260598][ T92] usb 6-1: new full-speed USB device number 84 using dummy_hcd [ 668.270855][T13078] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 668.290745][ T9] usb 1-1: device descriptor read/64, error -71 [ 668.411881][ T92] usb 6-1: config 150 has an invalid interface number: 204 but max is 1 [ 668.427381][ T92] usb 6-1: config 150 has no interface number 0 [ 668.437049][T13078] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 668.449202][T13078] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 668.458808][ T92] usb 6-1: config 150 interface 204 has no altsetting 0 [ 668.478180][T13078] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 668.486238][ T92] usb 6-1: config 150 interface 1 has no altsetting 0 [ 668.504175][ T92] usb 6-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 668.516813][ T92] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.525484][T13078] usb 2-1: config 0 descriptor?? [ 668.530963][ T9] usb 1-1: new full-speed USB device number 40 using dummy_hcd [ 668.567501][T13078] pwc: Askey VC010 type 2 USB webcam detected. [ 668.586450][ T92] usb 6-1: Product: syz [ 668.589619][T16543] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 668.594770][ T92] usb 6-1: Manufacturer: syz [ 668.601866][T16543] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 668.616172][ T92] usb 6-1: SerialNumber: syz [ 668.643562][T16543] bond_slave_0: entered promiscuous mode [ 668.649499][T16543] bond_slave_1: entered promiscuous mode [ 668.656912][T16543] macsec1: entered promiscuous mode [ 668.671407][T16543] bond0: entered promiscuous mode [ 668.677148][T16543] macsec1: entered allmulticast mode [ 668.686680][T16543] bond0: entered allmulticast mode [ 668.692101][T16543] bond_slave_0: entered allmulticast mode [ 668.700848][T16543] bond_slave_1: entered allmulticast mode [ 668.711014][T16543] bond0: left allmulticast mode [ 668.724853][T16543] bond_slave_0: left allmulticast mode [ 668.730642][ T9] usb 1-1: device descriptor read/64, error -71 [ 668.768392][T16543] bond_slave_1: left allmulticast mode [ 668.776884][T13078] pwc: recv_control_msg error -32 req 02 val 2b00 [ 668.797564][T16543] bond0: left promiscuous mode [ 668.797998][T13078] pwc: recv_control_msg error -32 req 02 val 2700 [ 668.808505][T16543] bond_slave_0: left promiscuous mode [ 668.811109][T13078] pwc: recv_control_msg error -32 req 02 val 2c00 [ 668.814628][T16543] bond_slave_1: left promiscuous mode [ 668.827487][T13078] pwc: recv_control_msg error -32 req 04 val 1000 [ 668.834878][T13078] pwc: recv_control_msg error -32 req 04 val 1300 [ 668.842856][ T92] xr_serial 6-1:150.204: xr_serial converter detected [ 668.851076][T13078] pwc: recv_control_msg error -32 req 04 val 1400 [ 668.857684][ T9] usb usb1-port1: attempt power cycle [ 668.864204][T13078] pwc: recv_control_msg error -32 req 02 val 2000 [ 668.881082][T13078] pwc: recv_control_msg error -32 req 02 val 2100 [ 668.888129][T13078] pwc: recv_control_msg error -32 req 04 val 1500 [ 668.902399][T13078] pwc: recv_control_msg error -32 req 02 val 2500 [ 668.913422][T13078] pwc: recv_control_msg error -32 req 02 val 2400 [ 669.123936][T13078] pwc: recv_control_msg error -71 req 02 val 2900 [ 669.138019][T13078] pwc: recv_control_msg error -71 req 02 val 2800 [ 669.145975][T13078] pwc: recv_control_msg error -71 req 04 val 1100 [ 669.153638][T13078] pwc: recv_control_msg error -71 req 04 val 1200 [ 669.166836][T13078] pwc: Registered as video103. [ 669.180033][T13078] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input60 [ 669.207129][T13078] usb 2-1: USB disconnect, device number 50 [ 669.213484][ T9] usb 1-1: new full-speed USB device number 41 using dummy_hcd [ 669.304492][ T9] usb 1-1: device descriptor read/8, error -71 [ 669.427502][T16555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 669.439949][T16555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 669.489552][T16509] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2707'. [ 669.499254][T16509] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2707'. [ 669.550638][ T9] usb 1-1: new full-speed USB device number 42 using dummy_hcd [ 669.571197][ T9] usb 1-1: device descriptor read/8, error -71 [ 669.681603][ T9] usb usb1-port1: unable to enumerate USB device [ 669.775668][ T92] xr_serial ttyUSB0: Failed to set reg 0x0e: -71 [ 669.785496][ T92] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 669.825611][ T92] usb 6-1: USB disconnect, device number 84 [ 669.846326][ T92] xr_serial 6-1:150.204: device disconnected [ 670.067073][ T30] audit: type=1326 audit(1755870537.484:3964): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.122681][ T30] audit: type=1326 audit(1755870537.484:3965): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.174430][ T30] audit: type=1326 audit(1755870537.484:3966): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.240368][ T30] audit: type=1326 audit(1755870537.484:3967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.263212][ T30] audit: type=1326 audit(1755870537.484:3968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.287456][ T30] audit: type=1326 audit(1755870537.484:3969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.372619][ T30] audit: type=1326 audit(1755870537.484:3970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.404419][ T30] audit: type=1326 audit(1755870537.484:3971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.433608][ T30] audit: type=1326 audit(1755870537.484:3972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 670.458909][ T30] audit: type=1326 audit(1755870537.484:3973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16564 comm="syz.3.2719" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7fd7c858ebe9 code=0x7ffc0000 [ 671.130604][ T92] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 671.250977][T16590] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 671.465727][ T92] usb 6-1: config 0 has no interfaces? [ 671.475180][ T92] usb 6-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 671.484531][ T92] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.494665][ T92] usb 6-1: Product: syz [ 671.502528][ T92] usb 6-1: Manufacturer: syz [ 671.513204][ T92] usb 6-1: SerialNumber: syz [ 671.520885][ T5945] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 671.536430][ T92] usb 6-1: config 0 descriptor?? [ 671.711879][ T5945] usb 1-1: Using ep0 maxpacket: 32 [ 671.785003][ T5945] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 671.793215][ T5945] usb 1-1: config 0 has no interface number 0 [ 671.799658][ T5945] usb 1-1: config 0 interface 29 has no altsetting 0 [ 671.821751][ T5945] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 671.848120][ T5945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.859445][ T5945] usb 1-1: Product: syz [ 671.864039][ T5945] usb 1-1: Manufacturer: syz [ 671.868810][ T5945] usb 1-1: SerialNumber: syz [ 671.876198][ T5945] usb 1-1: config 0 descriptor?? [ 671.883938][T16596] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 671.950763][ T92] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 672.085461][T16590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 672.094628][T16590] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 672.104496][ T5945] peak_usb 1-1:0.29 can0: unable to request usb[type=0 value=1] err=-32 [ 672.110709][ T92] usb 4-1: Using ep0 maxpacket: 32 [ 672.118116][ T5945] peak_usb 1-1:0.29: unable to read PCAN-USB X6 firmware info (err -32) [ 672.119572][ T92] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 672.137522][ T92] usb 4-1: config 0 has no interface number 0 [ 672.144048][ T92] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 672.156005][ T92] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 672.165457][ T92] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.173836][ T92] usb 4-1: Product: syz [ 672.178071][ T92] usb 4-1: Manufacturer: syz [ 672.181190][ T5945] peak_usb 1-1:0.29: probe with driver peak_usb failed with error -32 [ 672.183048][ T92] usb 4-1: SerialNumber: syz [ 672.197071][ T92] usb 4-1: config 0 descriptor?? [ 672.205122][ T92] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 672.218484][ T92] em28xx 4-1:0.132: Video interface 132 found: [ 672.456540][T16599] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 672.466295][T16599] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 672.488734][T16600] cgroup: fork rejected by pids controller in /syz6 [ 672.605169][ T92] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 672.793146][T16704] netlink: 'syz.1.2729': attribute type 23 has an invalid length. [ 672.933003][T13078] usb 7-1: USB disconnect, device number 9 [ 673.016276][T16594] sctp: [Deprecated]: syz.3.2725 (pid 16594) Use of struct sctp_assoc_value in delayed_ack socket option. [ 673.016276][T16594] Use struct sctp_sack_info instead [ 673.030707][ T92] em28xx 4-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 673.080441][ T9305] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.090580][ T92] em28xx 4-1:0.132: board has no eeprom [ 673.162555][ T9305] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.190677][ T92] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 673.215767][ T9305] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.229140][ T92] em28xx 4-1:0.132: analog set to bulk mode. [ 673.242710][ T9] em28xx 4-1:0.132: Registering V4L2 extension [ 673.279744][ T9305] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.448862][ T9305] bridge_slave_0: left allmulticast mode [ 673.455313][ T9305] bridge_slave_0: left promiscuous mode [ 673.461669][ T9305] bridge0: port 1(bridge_slave_0) entered disabled state [ 673.578321][T11408] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 673.587249][T11408] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 673.595569][T11408] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 673.607833][T11408] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 673.616507][T11408] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 673.639817][ T9305] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 673.667184][ T5945] usb 6-1: USB disconnect, device number 85 [ 673.694573][ T9305] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 673.717760][ T9305] bond0 (unregistering): Released all slaves [ 673.926559][T16715] chnl_net:caif_netlink_parms(): no params data found [ 674.025767][ T9305] hsr_slave_0: left promiscuous mode [ 674.034270][ T9305] hsr_slave_1: left promiscuous mode [ 674.041913][ T9305] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 674.049394][ T9305] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 674.065451][ T9305] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 674.073399][ T9305] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 674.081864][ T9305] batman_adv: batadv0: Interface deactivated: dummy0 [ 674.088703][ T9305] batman_adv: batadv0: Removing interface: dummy0 [ 674.099823][ T9305] veth1_macvtap: left promiscuous mode [ 674.105585][ T9305] veth0_macvtap: left promiscuous mode [ 674.112009][ T9305] veth1_vlan: left promiscuous mode [ 674.117353][ T9305] veth0_vlan: left promiscuous mode [ 674.129469][T13078] usb 1-1: USB disconnect, device number 43 [ 674.350052][ T9305] team0 (unregistering): Port device team_slave_1 removed [ 674.379528][T16743] sctp: [Deprecated]: syz.1.2735 (pid 16743) Use of int in maxseg socket option. [ 674.379528][T16743] Use struct sctp_assoc_value instead [ 674.396103][ T9] em28xx 4-1:0.132: reading from i2c device at 0x4a failed: couldn't get the received message from the bridge (error=-5) [ 674.410080][ T9] em28xx 4-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 674.420894][ T9305] team0 (unregistering): Port device team_slave_0 removed [ 674.440610][ T9] em28xx 4-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 674.453454][ T9] em28xx 4-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 674.490804][T13078] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 674.547933][ T9] em28xx 4-1:0.132: failed to trigger read from i2c address 0x84 (error=-5) [ 674.585971][ T9] em28xx 4-1:0.132: failed to trigger read from i2c address 0x86 (error=-5) [ 674.623816][ T9] em28xx 4-1:0.132: failed to trigger read from i2c address 0x94 (error=-5) [ 674.713682][T16187] usb 4-1: USB disconnect, device number 63 [ 674.716959][ T9] em28xx 4-1:0.132: failed to trigger read from i2c address 0x96 (error=-19) [ 674.720272][T16187] em28xx 4-1:0.132: Disconnecting em28xx [ 674.825124][T13078] usb 1-1: Using ep0 maxpacket: 8 [ 674.857801][T13078] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 17 [ 674.869985][T16754] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2737'. [ 674.941707][T13078] usb 1-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 674.951093][T13078] usb 1-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 674.959580][T13078] usb 1-1: Product: syz [ 674.966566][T13078] usb 1-1: Manufacturer: syz [ 674.995139][ T9] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 675.007008][T16715] bridge0: port 1(bridge_slave_0) entered blocking state [ 675.016646][T13078] usb 1-1: SerialNumber: syz [ 675.016688][T16715] bridge0: port 1(bridge_slave_0) entered disabled state [ 675.067154][ T9] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 675.073902][T16715] bridge_slave_0: entered allmulticast mode [ 675.075545][T13078] usb 1-1: config 0 descriptor?? [ 675.193743][T16715] bridge_slave_0: entered promiscuous mode [ 675.199883][ T9] em28xx 4-1:0.132: No AC97 audio processor [ 675.203610][T16715] bridge0: port 2(bridge_slave_1) entered blocking state [ 675.215655][ T9] usb 4-1: Decoder not found [ 675.242912][ T9] em28xx 4-1:0.132: failed to create media graph [ 675.246449][T16715] bridge0: port 2(bridge_slave_1) entered disabled state [ 675.278024][T16715] bridge_slave_1: entered allmulticast mode [ 675.289995][T16715] bridge_slave_1: entered promiscuous mode [ 675.303686][ T9] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 675.329840][ T9] em28xx 4-1:0.132: Remote control support is not available for this card. [ 675.333282][T16758] ================================================================== [ 675.346545][T16758] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xc7/0x430 [ 675.353926][T16758] Read of size 8 at addr ffff888031ca0740 by task v4l_id/16758 [ 675.361471][T16758] [ 675.363806][T16758] CPU: 1 UID: 0 PID: 16758 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 675.363829][T16758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 675.363841][T16758] Call Trace: [ 675.363849][T16758] [ 675.363856][T16758] dump_stack_lvl+0x189/0x250 [ 675.363875][T16758] ? rcu_is_watching+0x15/0xb0 [ 675.363890][T16758] ? __pfx_dump_stack_lvl+0x10/0x10 [ 675.363906][T16758] ? rcu_is_watching+0x15/0xb0 [ 675.363941][T16758] ? lock_release+0x4b/0x3e0 [ 675.363972][T16758] ? __virt_addr_valid+0x1c8/0x5c0 [ 675.363996][T16758] ? __virt_addr_valid+0x4a5/0x5c0 [ 675.364020][T16758] print_report+0xca/0x240 [ 675.364033][T16758] ? v4l2_fh_open+0xc7/0x430 [ 675.364054][T16758] kasan_report+0x118/0x150 [ 675.364077][T16758] ? v4l2_fh_open+0xc7/0x430 [ 675.364109][T16758] v4l2_fh_open+0xc7/0x430 [ 675.364138][T16758] em28xx_v4l2_open+0x157/0x9a0 [ 675.364168][T16758] v4l2_open+0x20c/0x360 [ 675.364190][T16758] chrdev_open+0x4c9/0x5e0 [ 675.364212][T16758] ? __pfx_chrdev_open+0x10/0x10 [ 675.364240][T16758] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 675.364273][T16758] ? __pfx_chrdev_open+0x10/0x10 [ 675.364301][T16758] do_dentry_open+0x950/0x13f0 [ 675.364323][T16758] vfs_open+0x3b/0x340 [ 675.364336][T16758] ? path_openat+0x2ecd/0x3830 [ 675.364353][T16758] path_openat+0x2ee5/0x3830 [ 675.364370][T16758] ? arch_stack_walk+0xfc/0x150 [ 675.364407][T16758] ? stack_depot_save_flags+0x40/0x860 [ 675.364439][T16758] ? __pfx_path_openat+0x10/0x10 [ 675.364461][T16758] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.364483][T16758] do_filp_open+0x1fa/0x410 [ 675.364500][T16758] ? __pfx_do_filp_open+0x10/0x10 [ 675.364524][T16758] ? _raw_spin_unlock+0x28/0x50 [ 675.364549][T16758] ? alloc_fd+0x64c/0x6c0 [ 675.364581][T16758] do_sys_openat2+0x121/0x1c0 [ 675.364602][T16758] ? __pfx_do_sys_openat2+0x10/0x10 [ 675.364620][T16758] ? lock_release+0x4b/0x3e0 [ 675.364642][T16758] ? do_user_addr_fault+0xc8a/0x1390 [ 675.364666][T16758] __x64_sys_openat+0x138/0x170 [ 675.364687][T16758] do_syscall_64+0xfa/0x3b0 [ 675.364718][T16758] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.364736][T16758] ? clear_bhb_loop+0x60/0xb0 [ 675.364757][T16758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.364773][T16758] RIP: 0033:0x7f51d90a7407 [ 675.364786][T16758] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 675.364800][T16758] RSP: 002b:00007ffe5c327c30 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 675.364815][T16758] RAX: ffffffffffffffda RBX: 00007f51d9843880 RCX: 00007f51d90a7407 [ 675.364828][T16758] RDX: 0000000000000000 RSI: 00007ffe5c329f1b RDI: ffffffffffffff9c [ 675.364843][T16758] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 675.364856][T16758] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 675.364868][T16758] R13: 00007ffe5c327e80 R14: 00007f51d99aa000 R15: 00005612af5194d8 [ 675.364889][T16758] [ 675.364896][T16758] [ 675.657456][T16758] Allocated by task 9: [ 675.661518][T16758] kasan_save_track+0x3e/0x80 [ 675.666201][T16758] __kasan_kmalloc+0x93/0xb0 [ 675.670794][T16758] __kmalloc_cache_noprof+0x230/0x3d0 [ 675.676171][T16758] em28xx_v4l2_init+0x10b/0x2e70 [ 675.681110][T16758] em28xx_init_extension+0x11d/0x1c0 [ 675.686403][T16758] process_scheduled_works+0xae1/0x17b0 [ 675.691944][T16758] worker_thread+0x8a0/0xda0 [ 675.696538][T16758] kthread+0x70e/0x8a0 [ 675.700606][T16758] ret_from_fork+0x3f9/0x770 [ 675.705198][T16758] ret_from_fork_asm+0x1a/0x30 [ 675.709964][T16758] [ 675.712283][T16758] Freed by task 9: [ 675.715995][T16758] kasan_save_track+0x3e/0x80 [ 675.720675][T16758] kasan_save_free_info+0x46/0x50 [ 675.725699][T16758] __kasan_slab_free+0x5b/0x80 [ 675.730462][T16758] kfree+0x18e/0x440 [ 675.734367][T16758] em28xx_v4l2_init+0x1683/0x2e70 [ 675.739401][T16758] em28xx_init_extension+0x11d/0x1c0 [ 675.744684][T16758] process_scheduled_works+0xae1/0x17b0 [ 675.750231][T16758] worker_thread+0x8a0/0xda0 [ 675.754830][T16758] kthread+0x70e/0x8a0 [ 675.758910][T16758] ret_from_fork+0x3f9/0x770 [ 675.763498][T16758] ret_from_fork_asm+0x1a/0x30 [ 675.768269][T16758] [ 675.770592][T16758] The buggy address belongs to the object at ffff888031ca0000 [ 675.770592][T16758] which belongs to the cache kmalloc-8k of size 8192 [ 675.784642][T16758] The buggy address is located 1856 bytes inside of [ 675.784642][T16758] freed 8192-byte region [ffff888031ca0000, ffff888031ca2000) [ 675.798610][T16758] [ 675.800934][T16758] The buggy address belongs to the physical page: [ 675.807340][T16758] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x31ca0 [ 675.816111][T16758] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 675.824612][T16758] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 675.832595][T16758] page_type: f5(slab) [ 675.836582][T16758] raw: 00fff00000000040 ffff88801a442280 0000000000000000 dead000000000001 [ 675.845163][T16758] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 675.853750][T16758] head: 00fff00000000040 ffff88801a442280 0000000000000000 dead000000000001 [ 675.862416][T16758] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 [ 675.871084][T16758] head: 00fff00000000003 ffffea0000c72801 00000000ffffffff 00000000ffffffff [ 675.879755][T16758] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 675.888424][T16758] page dumped because: kasan: bad access detected [ 675.894845][T16758] page_owner tracks the page as allocated [ 675.900561][T16758] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5505, tgid 5505 (rcS), ts 41942749454, free_ts 41876153434 [ 675.920368][T16758] post_alloc_hook+0x240/0x2a0 [ 675.925146][T16758] get_page_from_freelist+0x21e4/0x22c0 [ 675.930691][T16758] __alloc_frozen_pages_noprof+0x181/0x370 [ 675.936492][T16758] alloc_pages_mpol+0x232/0x4a0 [ 675.941344][T16758] allocate_slab+0x8a/0x370 [ 675.945849][T16758] ___slab_alloc+0xbeb/0x1410 [ 675.950533][T16758] __kmalloc_cache_noprof+0x296/0x3d0 [ 675.955906][T16758] tomoyo_init_log+0x111f/0x1f70 [ 675.960841][T16758] tomoyo_supervisor+0x340/0x1480 [ 675.965861][T16758] tomoyo_env_perm+0x149/0x1e0 [ 675.970629][T16758] tomoyo_find_next_domain+0x15cf/0x1aa0 [ 675.976261][T16758] tomoyo_bprm_check_security+0x11c/0x180 [ 675.981975][T16758] security_bprm_check+0x89/0x270 [ 675.987002][T16758] bprm_execve+0x8ee/0x1450 [ 675.991510][T16758] do_execveat_common+0x510/0x6a0 [ 675.996535][T16758] __x64_sys_execve+0x94/0xb0 [ 676.001212][T16758] page last free pid 5239 tgid 5239 stack trace: [ 676.007548][T16758] __free_frozen_pages+0xbc4/0xd30 [ 676.012671][T16758] __put_partials+0x156/0x1a0 [ 676.017358][T16758] put_cpu_partial+0x17c/0x250 [ 676.022125][T16758] __slab_free+0x2d5/0x3c0 [ 676.026543][T16758] qlist_free_all+0x97/0x140 [ 676.031136][T16758] kasan_quarantine_reduce+0x148/0x160 [ 676.036601][T16758] __kasan_slab_alloc+0x22/0x80 [ 676.041451][T16758] kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 676.046937][T16758] getname_flags+0xb8/0x540 [ 676.051438][T16758] do_sys_openat2+0xbc/0x1c0 [ 676.056023][T16758] __x64_sys_openat+0x138/0x170 [ 676.060873][T16758] do_syscall_64+0xfa/0x3b0 [ 676.065388][T16758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.071282][T16758] [ 676.073606][T16758] Memory state around the buggy address: [ 676.079228][T16758] ffff888031ca0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 676.087287][T16758] ffff888031ca0680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 676.095343][T16758] >ffff888031ca0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 676.103403][T16758] ^ [ 676.109546][T16758] ffff888031ca0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 676.117602][T16758] ffff888031ca0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 676.125656][T16758] ================================================================== SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 676.154978][T13078] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 676.184764][T11408] Bluetooth: hci3: command tx timeout [ 676.201179][T16187] em28xx 4-1:0.132: Closing input extension [ 676.210621][T16758] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 676.217921][T16758] CPU: 1 UID: 0 PID: 16758 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 676.226952][T16758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 676.237020][T16758] Call Trace: [ 676.240312][T16758] [ 676.243253][T16758] dump_stack_lvl+0x99/0x250 [ 676.247858][T16758] ? __asan_memcpy+0x40/0x70 [ 676.252450][T16758] ? __pfx_dump_stack_lvl+0x10/0x10 [ 676.257651][T16758] ? __pfx__printk+0x10/0x10 [ 676.262252][T16758] vpanic+0x281/0x750 [ 676.266233][T16758] ? preempt_schedule+0xae/0xc0 [ 676.271089][T16758] ? __pfx_vpanic+0x10/0x10 [ 676.275592][T16758] ? preempt_schedule_common+0x83/0xd0 [ 676.281058][T16758] ? preempt_schedule+0xae/0xc0 [ 676.285914][T16758] ? __pfx_preempt_schedule+0x10/0x10 [ 676.291290][T16758] panic+0xb9/0xc0 [ 676.295016][T16758] ? __pfx_panic+0x10/0x10 [ 676.299437][T16758] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 676.305335][T16758] ? v4l2_fh_open+0xc7/0x430 [ 676.309932][T16758] check_panic_on_warn+0x89/0xb0 [ 676.314880][T16758] ? v4l2_fh_open+0xc7/0x430 [ 676.319479][T16758] end_report+0x78/0x160 [ 676.323726][T16758] kasan_report+0x129/0x150 [ 676.328246][T16758] ? v4l2_fh_open+0xc7/0x430 [ 676.332843][T16758] v4l2_fh_open+0xc7/0x430 [ 676.337278][T16758] em28xx_v4l2_open+0x157/0x9a0 [ 676.342164][T16758] v4l2_open+0x20c/0x360 [ 676.346416][T16758] chrdev_open+0x4c9/0x5e0 [ 676.350839][T16758] ? __pfx_chrdev_open+0x10/0x10 [ 676.355789][T16758] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 676.362132][T16758] ? __pfx_chrdev_open+0x10/0x10 [ 676.367078][T16758] do_dentry_open+0x950/0x13f0 [ 676.371843][T16758] vfs_open+0x3b/0x340 [ 676.375911][T16758] ? path_openat+0x2ecd/0x3830 [ 676.380684][T16758] path_openat+0x2ee5/0x3830 [ 676.385279][T16758] ? arch_stack_walk+0xfc/0x150 [ 676.390138][T16758] ? stack_depot_save_flags+0x40/0x860 [ 676.395601][T16758] ? __pfx_path_openat+0x10/0x10 [ 676.400565][T16758] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.406638][T16758] do_filp_open+0x1fa/0x410 [ 676.411145][T16758] ? __pfx_do_filp_open+0x10/0x10 [ 676.416175][T16758] ? _raw_spin_unlock+0x28/0x50 [ 676.421025][T16758] ? alloc_fd+0x64c/0x6c0 [ 676.425379][T16758] do_sys_openat2+0x121/0x1c0 [ 676.430053][T16758] ? __pfx_do_sys_openat2+0x10/0x10 [ 676.435253][T16758] ? lock_release+0x4b/0x3e0 [ 676.439852][T16758] ? do_user_addr_fault+0xc8a/0x1390 [ 676.445141][T16758] __x64_sys_openat+0x138/0x170 [ 676.449996][T16758] do_syscall_64+0xfa/0x3b0 [ 676.454504][T16758] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.460567][T16758] ? clear_bhb_loop+0x60/0xb0 [ 676.465243][T16758] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.471130][T16758] RIP: 0033:0x7f51d90a7407 [ 676.475541][T16758] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 676.495142][T16758] RSP: 002b:00007ffe5c327c30 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 676.503555][T16758] RAX: ffffffffffffffda RBX: 00007f51d9843880 RCX: 00007f51d90a7407 [ 676.511522][T16758] RDX: 0000000000000000 RSI: 00007ffe5c329f1b RDI: ffffffffffffff9c [ 676.519579][T16758] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 676.527549][T16758] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 676.535518][T16758] R13: 00007ffe5c327e80 R14: 00007f51d99aa000 R15: 00005612af5194d8 [ 676.543495][T16758] [ 676.546873][T16758] Kernel Offset: disabled [ 676.551330][T16758] Rebooting in 86400 seconds..