last executing test programs: 2m32.891379877s ago: executing program 4 (id=436): r0 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) openat$kvm(0x0, &(0x7f00000002c0), 0xa600, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xe) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) (async) ioctl$KVM_CAP_SPLIT_IRQCHIP(r1, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd23, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x10, 0xb}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x1, 0x8}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000d2}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r5, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x1, r4, 0x1, 0xd8, 0x6, @random="000863ee0a3d"}, 0x14) (async) sendto$packet(r5, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x1, r4, 0x1, 0xd8, 0x6, @random="000863ee0a3d"}, 0x14) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bond0\x00', 0x0}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000000)) (async) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000880)=ANY=[@ANYBLOB="440000001000ffff2cbd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="2911010020100000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x44}, 0x1, 0x0, 0x0, 0x8014}, 0x40040) (async) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000880)=ANY=[@ANYBLOB="440000001000ffff2cbd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="2911010020100000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x44}, 0x1, 0x0, 0x0, 0x8014}, 0x40040) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000040)={0x1, 0x0, [{0x4, 0x3, 0x0, 0x0, @irqchip={0x8000, 0x7}}]}) (async) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000040)={0x1, 0x0, [{0x4, 0x3, 0x0, 0x0, @irqchip={0x8000, 0x7}}]}) r9 = eventfd2(0x7fff, 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r9, 0x4}) write$eventfd(r9, &(0x7f0000000080)=0x430f, 0x8) (async) write$eventfd(r9, &(0x7f0000000080)=0x430f, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) ioctl$sock_ifreq(r3, 0x8910, &(0x7f0000000040)={'gre0\x00', @ifru_mtu=0x1}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00dce0140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc9", 0x26, 0x0, 0x0, 0x0) (async) sendto$packet(0xffffffffffffffff, &(0x7f00000000c0)="3f031c00dce0140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc9", 0x26, 0x0, 0x0, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000440)=ANY=[@ANYBLOB="aaa8aaaaaaaa0380c200000108004680002c0000000000069078ac141400ac1e000107030800000000006f97b3fb30c62e29d9bc4bb57914f6ede2244b7ac43871401a9ae9d487b6f69ed4d1923c711bda3bb72e30a6ab5c6ad5f288560e4341f4396a1a731eae", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], 0x0) (async) syz_emit_ethernet(0x3a, &(0x7f0000000440)=ANY=[@ANYBLOB="aaa8aaaaaaaa0380c200000108004680002c0000000000069078ac141400ac1e000107030800000000006f97b3fb30c62e29d9bc4bb57914f6ede2244b7ac43871401a9ae9d487b6f69ed4d1923c711bda3bb72e30a6ab5c6ad5f288560e4341f4396a1a731eae", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], 0x0) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) (async) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf0002010650000900000000020d00000524060001082400a9b30d240f010a0000000300ff000606241a05001407240a050905580c240c00000000a90c0900030424020204240200042406024424"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000380)=ANY=[@ANYBLOB="f841bfef5e6303fa8b0e9b6acf33b15246fc17f1baa10f81005003eb6621cee89e5c920aa03edfd3c8b9ea0bb0d8eda308"], 0x0) r11 = syz_open_dev$dri(&(0x7f0000000140), 0x3, 0x2d8a02) ioctl$DRM_IOCTL_IRQ_BUSID(r11, 0xc0106403, &(0x7f0000000280)={0x0, 0x0, 0x3, 0x595}) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, &(0x7f00000004c0)={0x0, 0x3e, r10, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000600)={0x0, 0x0, r10, r12, 0x3, 0x6, 0x7ff, 0x1, {0xaba8, 0x0, 0x2, 0x106, 0xffff, 0x8, 0x84, 0x0, 0xf, 0x4, 0x0, 0x5, 0x49, 0x1, "3cbc5b8c9598cff6cffdb26b84595919c0686e494223aa5db3e5e050b399d71c"}}) 2m32.067821556s ago: executing program 4 (id=440): unshare(0x8040480) socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sysvipc/sem\x00', 0x41, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1f, 0x0, &(0x7f0000000200)) ioctl$KDGKBDIACR(r0, 0x4b4a, &(0x7f0000000200)=""/175) mlock2(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) munlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001200)=ANY=[@ANYRESDEC=r2, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="b56b6e000000000010000a002dbd70202dbd700007000000", @ANYRES16=r0], 0x60}}, 0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001140)=ANY=[@ANYBLOB="00000000220002002cbd7000fddbdf25865720570700f00102000000"], 0x34}, 0x1, 0x0, 0x0, 0x8400}, 0xc080) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001180)=ANY=[@ANYRESOCT=r4, @ANYRES32=r3, @ANYBLOB="07000000000000c0"], 0x10) futex(&(0x7f000000cffc)=0x1, 0xd, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="400000001e000000"], 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000440)='blkio.bfq.dequeue\x00', 0x275a, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r5, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r6, 0x300, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x20008080) syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r7, &(0x7f0000000000)={0xfc, {"a2e3ad09ed0d09f91b5e071887f70e09d038e7ff7fc6e5539b0d670a8b089b3f363563030890e0879b0af8c6e70a9b334a959b669a9b2f200af3988f7ef319520100ffe8d178708c523c921b1b5b31070d073b090acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b6f0be129305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669114e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f141f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e0b231d6f040dc19283b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80425d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813491ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203715ba49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a3289d24825642891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eb4581f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab9640071550027697b52160687461602f88df165d884b36ec2b6c25a2f33c71568009d4afb96d6861aca73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c513a9177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f411254c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb57412500005488efeee327415cc19451432c6f14c27693100c3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603f56935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486229e5b2e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df7227dfdb0d2b9e935c5af3cf474bed79dfc24ab0f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78c8fa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb06afa88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000026347ee80000000000f9ffffff00", 0x1000}}, 0x1006) 2m31.15592256s ago: executing program 4 (id=451): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000280), 0x480, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r0, 0x0, 0x4d, 0xb3, &(0x7f00000002c0)="d79120f1ae5e83ac34b0648b70d9f461d2f27df2d7b80ad822f5599f9e701659a54fb72e136a2c1f5c414d3e061bc6400b232fca2d90e12fc32bb43a2a79fcc35430b718713da7a78ff4712a7b", &(0x7f0000000340)=""/179, 0x5, 0x0, 0x5, 0x6, &(0x7f0000000400)="f81a3c4c5d", &(0x7f0000000440)="6503b446ed9d", 0x4, 0x0, 0x3}, 0x50) syz_io_uring_setup(0x3ff0, &(0x7f0000000140)={0x0, 0xfaf8, 0x10, 0x2, 0x11a}, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000140)='15', 0x2}], 0x8) sendmsg$IPSET_CMD_SAVE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x34, 0x8, 0x6, 0x3, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0xc1}, 0x80) r1 = io_uring_setup(0xc61, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0x0, 0x20002f7}) socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2m30.371848784s ago: executing program 4 (id=452): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000040)) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x40400) ppoll(&(0x7f0000000380)=[{r2, 0x4}], 0x1, &(0x7f0000000300)={0x0, 0x989680}, 0x0, 0x0) write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000d178000000aaff02000000000000000000000000000104"], 0xfdef) 2m29.735558693s ago: executing program 4 (id=453): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect(r1, &(0x7f0000000000)=@nfc={0x27, 0x0, 0xffffffffffffffff, 0x3}, 0x80) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000380)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000340)=0x1, r4, 0x0, 0x1, 0x4}}, 0x20) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x80c02, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000140)={0x48}) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/ip_mr_cache\x00') preadv(r7, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/20, 0x14}], 0x1, 0x10000009, 0xffffffff) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r7, 0x0, 0x0}, 0x10) ioctl$FBIO_WAITFORVSYNC(r6, 0x40044620, 0x0) socket(0x1e, 0x1, 0x0) r8 = socket$netlink(0x10, 0x3, 0x4) writev(r8, &(0x7f0000000300)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c561e117436c379000000000000000058000b4824ca945f6400d40f6a0325010ebc000000000000008000f0fffeffd809005300fff5dd00000010000100070c060000000000224e0000", 0x58}], 0x1) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x24, 0x4, 0x8, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x6006}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) 2m28.680468038s ago: executing program 4 (id=456): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7) r2 = openat$cgroup_procs(r0, &(0x7f00000001c0)='tasks\x00', 0x2, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000880)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001e000100feff00ffff00000007000092", @ANYRESOCT=r6, @ANYBLOB="000004000a000200aaaaaaaaaa0c0000"], 0x28}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) r8 = dup3(r7, r3, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x2, 0x7, &(0x7f0000000000)) fspick(r1, 0x0, 0x0) fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r9, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x68, 0x0, &(0x7f0000000400)=[@decrefs={0x40046307, 0x1}, @acquire, @request_death={0x400c630e, 0x1}, @enter_looper, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000580)={@fd={0x66642a85, 0x0, r5}, @fda={0x66646185, 0x5, 0x0, 0x27}, @flat=@weak_handle={0x77682a85, 0x1, 0x3}}, &(0x7f00000002c0)={0x0, 0x18, 0x38}}}], 0x0, 0x0, 0x0}) r10 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) write$cgroup_pid(r2, &(0x7f00000004c0)=r10, 0x12) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r11, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000140)=[{0x30, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) write$cgroup_freezer_state(r1, &(0x7f0000000080)='THAWED\x00', 0x7) bpf$PROG_LOAD(0x5, 0x0, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000001800), 0xc0241, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4401}) 2m13.317742488s ago: executing program 32 (id=456): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_freezer_state(r1, &(0x7f0000000040)='FROZEN\x00', 0x7) r2 = openat$cgroup_procs(r0, &(0x7f00000001c0)='tasks\x00', 0x2, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000880)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001e000100feff00ffff00000007000092", @ANYRESOCT=r6, @ANYBLOB="000004000a000200aaaaaaaaaa0c0000"], 0x28}}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@increfs], 0x0, 0x0, 0x0}) r8 = dup3(r7, r3, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x2, 0x7, &(0x7f0000000000)) fspick(r1, 0x0, 0x0) fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r9, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x68, 0x0, &(0x7f0000000400)=[@decrefs={0x40046307, 0x1}, @acquire, @request_death={0x400c630e, 0x1}, @enter_looper, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000580)={@fd={0x66642a85, 0x0, r5}, @fda={0x66646185, 0x5, 0x0, 0x27}, @flat=@weak_handle={0x77682a85, 0x1, 0x3}}, &(0x7f00000002c0)={0x0, 0x18, 0x38}}}], 0x0, 0x0, 0x0}) r10 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) write$cgroup_pid(r2, &(0x7f00000004c0)=r10, 0x12) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r11, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000140)=[{0x30, 0x0, 0x0, 0xfffff00c}, {0x6}]}, 0x10) write$cgroup_freezer_state(r1, &(0x7f0000000080)='THAWED\x00', 0x7) bpf$PROG_LOAD(0x5, 0x0, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000001800), 0xc0241, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4401}) 8.067365028s ago: executing program 3 (id=1026): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="931b453f", 0x4}], 0x1}}, {{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000cc0)="9c", 0x1}], 0x1}}], 0x2, 0x2090) (fail_nth: 2) 7.653686501s ago: executing program 3 (id=1027): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) rename(0x0, 0x0) syz_open_procfs(0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000480)=ANY=[], 0x0, 0x0}) 6.631829455s ago: executing program 1 (id=1032): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x104, 0x3}, 0x18, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000180)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000560900a1004daf25cee2d5d1c1"], 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGPHYS(r2, 0x80404812, &(0x7f0000000080)) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x10000000007, 0x2102) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="dffd00a34e00010006000000000000001c000000"], 0x14}}, 0x0) syz_usb_disconnect(r3) close(r4) landlock_restrict_self(r0, 0xa) r6 = syz_open_procfs(0x0, &(0x7f0000008240)='attr\x00') openat(r6, &(0x7f0000000740)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xe2342, 0x16b) 6.181650959s ago: executing program 0 (id=1034): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x20, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000791000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000b40)=@delqdisc={0x154, 0x25, 0x8, 0x70bd29, 0x25dfdbf5, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff1}, {0x9, 0xd}, {0x4, 0x4}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3d, 0x7, 0xfffd, 0x8, 0x2, 0x8, 0x1}}, {0x4}}]}, @TCA_STAB={0x104, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x6, 0x5, 0x5, 0x1, 0x4, 0x6, 0x5}}, {0xe, 0x2, [0x5, 0xff, 0x80, 0x1, 0x14]}}, {{0x1c, 0x1, {0x8, 0x7, 0x3ff, 0xfffffffe, 0x1, 0x5, 0x5, 0x3}}, {0xa, 0x2, [0x1ff, 0x5, 0x4]}}, {{0x1c, 0x1, {0x8, 0x10, 0x40, 0x5, 0x0, 0x2, 0x3, 0x1}}, {0x6, 0x2, [0x1]}}, {{0x1c, 0x1, {0x2, 0x4, 0x6, 0x8, 0x1, 0x0, 0x7, 0x1}}, {0x6, 0x2, [0xfb]}}, {{0x1c, 0x1, {0x1, 0x40, 0x7, 0x979f, 0x0, 0x4000000, 0x6, 0x1}}, {0x6, 0x2, [0x5]}}, {{0x1c, 0x1, {0x3, 0x5, 0x0, 0x100, 0x0, 0xffffffff, 0x1}}, {0x4}}, {{0x1c, 0x1, {0x2, 0x1, 0xe, 0x482, 0x0, 0x1, 0x5}}, {0x4}}]}, @TCA_RATE={0x6, 0x5, {0x8}}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000880}, 0x20008004) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/106, 0x6a}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x7, &(0x7f0000000600)=""/191, 0xbf, 0xa1}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) 6.146455657s ago: executing program 0 (id=1035): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r2, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsopen(&(0x7f0000000700)='affs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') pread64(r3, 0x0, 0x0, 0x200) getsockname$packet(r3, &(0x7f0000000140), &(0x7f0000000280)=0x14) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f00000000c0)) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) r6 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) 4.530982847s ago: executing program 0 (id=1038): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000000200)={0x2020, 0x0, 0x0}, 0x2020) open(&(0x7f00000000c0)='./file1\x00', 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000002300)={0x50, 0x0, r1, {0x7, 0x9, 0x0, 0x31835003, 0xffff, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x20}}, 0x50) read$FUSE(r0, &(0x7f0000004580)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r2}, 0x10) r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0), 0xc1, 0x0) dup3(r3, r0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1cd042, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x6, 0x13, r4, 0x0) 4.520763119s ago: executing program 3 (id=1039): socket$nl_xfrm(0x10, 0x3, 0x6) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) execveat$binfmt(r2, 0x0, 0x0, &(0x7f0000000400)={[&(0x7f0000000300)='$\x00', &(0x7f0000000340)='proc\x00', &(0x7f00000003c0)='proc\x00']}, 0x1000) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(r2, &(0x7f0000000140)='./file0\x00', 0x40) io_setup(0xffffffff, 0x0) io_setup(0x3, &(0x7f00000001c0)=0x0) io_submit(r3, 0x0, &(0x7f0000000140)) r4 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r4, &(0x7f00000000c0)={0x2, 0x0, @private=0xa010100}, 0x10) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x1) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0xa82, 0x0) write$cgroup_int(r5, &(0x7f0000000040)=0x900, 0x12) 4.299020993s ago: executing program 1 (id=1041): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f00000001c0)=ANY=[], 0x0}, 0x94) syz_emit_ethernet(0x3a, &(0x7f00000004c0)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x28, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x60000100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a010200000000"], 0x122}}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443", 0x67}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00fcff", 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 4.185871084s ago: executing program 1 (id=1042): r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040), 0x183001, 0x0) r1 = io_uring_setup(0x3c96, &(0x7f0000000900)={0x0, 0xe883, 0x400, 0x3, 0x1000db, 0x0, r0}) socket$alg(0x26, 0x5, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x200100, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) close_range(r1, 0xffffffffffffffff, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0xc0a85352, &(0x7f0000000140)={{0xe2, 0x9}, 'port0\x00', 0xc8, 0x8, 0x5d, 0x4, 0x2, 0x5, 0xffffff7f, 0x0, 0x7, 0x2}) 4.044103199s ago: executing program 1 (id=1044): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000f2d07c40501d89601dd0000000010902120001000000"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000400)={0x1c, &(0x7f0000000540)=ANY=[], 0x0, 0x0}) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) r2 = io_uring_setup(0x5d09, &(0x7f0000000100)={0x0, 0x2881, 0x10, 0x0, 0x59}) io_uring_register$IORING_REGISTER_IOWQ_AFF(r2, 0x25, &(0x7f0000000000)="01", 0x1) sendto$packet(0xffffffffffffffff, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x14) syz_usb_control_io(r0, &(0x7f0000001340)={0x2c, &(0x7f0000001040)={0x0, 0x7, 0xca, {0xca, 0x23, "a31c0b131d405724ba874470398e9d66c82dfdd77b3132791a1fb414ce6071ba53724b842de4fabb4985bd533d4f34b62a2118c8e9f27cf39956ca33efb943d6289f8aa07830c7fc9bf9aa77e239ad4816873e87e7a28e8eb1891500ab867e1e499a41895ebf14ee3f87aa4936d5f0096688ea8fbee0b8a9add445cc988f74da01ef6e53f75c37615aaa212d55cff47faa4700951b6eb4794de539f5bc3b8da29ec756e144ffb239fac2e0157afe1f13279420a3be9fda099b07a90b4f21188329c5a0ff8f07bc74"}}, &(0x7f0000001140)={0x0, 0x3, 0x13, @string={0x13, 0x3, "9562020fb9f9b965360874dcc31c292d13"}}, &(0x7f0000001180)={0x0, 0xf, 0x105, {0x5, 0xf, 0x105, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x5, "4a862182f7a2763be3cf4d457a6c65b2"}, @generic={0xec, 0x10, 0xb, "8a93b7771dc233715ce1339b13e821c353d2858ee18ab0c6c08408bedd1a514b1b939cf741fca22b3e1caa89bbfef24c43a70821212f162c05a3ed3324a123a55ec4ed78811de7de0b7cac683bb4d3ee2706269082056c8cf82399d85344e1d594a09013fa08430fe5113ec6a018843cdb00869fbeb4d5d9089ba9565ce0e44492b3777152683e6fedf5dd5aafcf26fcd2a001a34bedff096d50fa740b4296a34f2b64851005af719af39386c0d98fea0aac9d2aa19133c8968c2517dabba5babadd8478e73829acd66689a96a3c8c4ada7e1f690c3af378e2f21092c949aa736c86605e2a7de5f915"}]}}, &(0x7f00000012c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x3, 0x0, 0x6, 0xf0, "7c66df4c", "6f8b48fb"}}, &(0x7f0000001300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xe, 0x10, 0x5, 0x3, 0xed, 0x76, 0x2}}}, &(0x7f0000001840)={0x84, &(0x7f0000001380)={0x40, 0x8, 0xf8, "0dd8112deeef73ebb24d04015ce4f3a2710ea9ea7d196137c833c4599fdfd0df0245467db53d8db0fc32b1373e1c72deac10d1c28d1428f724b372af80f38bcfc108e5805a0739922c46ebde0d8602fc0c7ba6f465ebbe08a3ddaf2130d86eb19c4ad1c99fe6e7aa805089a8bd21cad42a37cef314c28ec472457911a40973d174686cb219e018de11cd62152041448f4979be3d21940d6e786ff5fe836b2bfb9dd2db56ca67e414a638c104117391ab0988f415d777621feed2b4d06c8f3df7709674ae27c5c4407b3ec958fe4214799f6b7d518602e6f5642e1e880e72c15dfb381a556b29df36b4d52e7b2c7be2b62c64fa1a90ed7a34"}, &(0x7f0000001480)={0x0, 0xa, 0x1, 0x4}, &(0x7f00000014c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000001500)={0x20, 0x0, 0x4, {0x1, 0x3}}, &(0x7f0000001540)={0x20, 0x0, 0x4, {0x400, 0x20}}, &(0x7f0000001580)={0x40, 0x7, 0x2, 0x9}, &(0x7f00000015c0)={0x40, 0x9, 0x1, 0x73}, &(0x7f0000001600)={0x40, 0xb, 0x2, "d327"}, &(0x7f0000001640)={0x40, 0xf, 0x2, 0x8}, &(0x7f0000001680)={0x40, 0x13, 0x6}, &(0x7f00000016c0)={0x40, 0x17, 0x6, @random="490712bf2f40"}, &(0x7f0000001700)={0x40, 0x19, 0x2, "2ead"}, &(0x7f0000001740)={0x40, 0x1a, 0x2, 0x7c}, &(0x7f0000001780)={0x40, 0x1c, 0x1, 0x4}, &(0x7f00000017c0)={0x40, 0x1e, 0x1, 0x9}, &(0x7f0000001800)={0x40, 0x21, 0x1, 0x3}}) rt_sigtimedwait(&(0x7f0000001900)={[0x101]}, &(0x7f0000001940), &(0x7f0000001a00), 0x8) statx(0xffffffffffffffff, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x7100, 0x1, 0x0) 3.86464513s ago: executing program 5 (id=1046): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)={{0x14}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0xf}}}, 0x28}}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000006b00)={&(0x7f00000051c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0xc800}, 0x10840) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) recvmmsg(r3, &(0x7f00000054c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004040)}, 0x1}, {{&(0x7f0000000080)=@tipc=@name, 0x80, &(0x7f0000000200)=[{0x0}, {&(0x7f0000000140)=""/45, 0x2d}, {&(0x7f0000001480)=""/4096, 0x1000}, {&(0x7f0000002480)=""/4096, 0x1000}], 0x4, &(0x7f0000000280)=""/142, 0x8e}, 0x46}, {{&(0x7f0000000340)=@nfc, 0x80, &(0x7f0000000400)=[{&(0x7f00000003c0)=""/27, 0x1b}], 0x1, &(0x7f0000003480)=""/4096, 0x1000}, 0x6}, {{0x0, 0x0, &(0x7f0000004780)=[{&(0x7f0000004480)=""/21, 0x15}, {&(0x7f00000044c0)=""/151, 0x97}, {&(0x7f0000004640)=""/125, 0x7d}, {&(0x7f00000046c0)=""/136, 0x88}], 0x4, &(0x7f0000004800)=""/20, 0x14}, 0xb6600000}, {{&(0x7f0000004840)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000004a40)=[{&(0x7f00000048c0)=""/101, 0x65}, {&(0x7f0000004940)=""/233, 0xe9}], 0x2, &(0x7f0000004a80)=""/64, 0x40}, 0x3}, {{&(0x7f0000004ac0)=@un=@abs, 0x80, &(0x7f0000004d40)=[{&(0x7f0000004b40)=""/238, 0xee}, {&(0x7f0000004c40)=""/234, 0xea}], 0x2}, 0x1000}, {{&(0x7f0000004d80)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast}, 0x80, &(0x7f0000005400)=[{0x0}, {&(0x7f00000050c0)=""/235, 0xeb}, {&(0x7f0000005680)=""/87, 0x57}, {&(0x7f0000005240)=""/185, 0xb9}, {&(0x7f0000005300)=""/211, 0xd3}], 0x5}, 0x8}], 0x7, 0x40010022, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004107f540f30c7593de1a000000010902240001000000000904000002bee4f90009050305"], 0x0) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0xa0, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x44, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x4}]}, 0xa0}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)={0xb4, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @local}}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xb4}}, 0x0) write(r4, &(0x7f0000000000)="240000005800410f9c00f4f90085b3a85c91fddf080001000501009f0800028001000000", 0x24) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="540000001000ffff26bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="14140000212000002c0012800c0001006d6163766c616e001c0002800800010010000000080007007df0ffff080003000200000008000500", @ANYRES32=r7], 0x54}, 0x1, 0x0, 0x0, 0x1}, 0xc008006) r8 = socket(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f0000000000), 0x4000000000001f2, 0x0) socket$key(0xf, 0x3, 0x2) modify_ldt$write2(0x11, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c0000002e0009700000000000040000000800180005ac0f00"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 3.714610113s ago: executing program 2 (id=1048): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r2, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsopen(&(0x7f0000000700)='affs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') pread64(r3, 0x0, 0x0, 0x200) getsockname$packet(r3, &(0x7f0000000140), &(0x7f0000000280)=0x14) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f00000000c0)) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) setsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) r6 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) 3.391116908s ago: executing program 0 (id=1049): syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) rename(0x0, 0x0) syz_open_procfs(0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000480)=ANY=[], 0x0, 0x0}) 2.929521054s ago: executing program 3 (id=1050): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f0000000040)={@private2={0xfc, 0x2, '\x00', 0x1}}, 0x14) syz_emit_ethernet(0x32, &(0x7f0000000000)={@multicast, @empty, @void, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @multicast1}, {{0x0, 0x6558, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d8621b", 0x0, "2c17a9"}}}}}}, 0x0) (async) syz_emit_ethernet(0x32, &(0x7f0000000000)={@multicast, @empty, @void, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @multicast1}, {{0x0, 0x6558, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d8621b", 0x0, "2c17a9"}}}}}}, 0x0) 2.754021903s ago: executing program 3 (id=1051): socket$nl_xfrm(0x10, 0x3, 0x6) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0x61, 0xffffffff}, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_create_resource$binfmt(&(0x7f0000000200)='./file0\x00') execveat$binfmt(r2, r3, &(0x7f0000000240), 0x0, 0x1000) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(r2, &(0x7f0000000140)='./file0\x00', 0x40) io_setup(0xffffffff, 0x0) io_setup(0x3, &(0x7f00000001c0)=0x0) io_submit(r4, 0x0, &(0x7f0000000140)) r5 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r6 = socket$inet(0x2b, 0x801, 0x0) connect$inet(r6, &(0x7f00000000c0)={0x2, 0x0, @private=0xa010100}, 0x10) listen(r2, 0x7) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x1) flock(r2, 0x8) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x900, 0x12) socket$inet_icmp_raw(0x2, 0x3, 0x1) 2.354246514s ago: executing program 5 (id=1052): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f00000001c0)=ANY=[], 0x0}, 0x94) syz_emit_ethernet(0x3a, &(0x7f00000004c0)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x28, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x60000100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a010200000000"], 0x122}}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443", 0x67}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00fcff", 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 2.186940506s ago: executing program 5 (id=1053): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001f80)=ANY=[@ANYBLOB="ec10000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00002000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000100000000000000ffffffffffffffff00000000000000000000000000000000feffffffffffffff02000000000000000000000000804000000000000000000800000000000000000000000000000000331003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000587f00002e7e08b4aa0af67661a6aab8060ef55c5b8c181b56f38b569f98a9465916b86ce7876fe69c9729ed3f59c01e840904975a2772ce4ebfeb4a209f32c6126c6ff2bcbe632e37c440c1aeb184ff5de81db4587c3f09024c45c120fbb6f56c6ea2234cb13d553b65fc1646a39eb9f79ff32ab98f19283c5bc1ba108e4c30906135d98354974951fc40cd8caaa794b1dd9562bd99014aecb4de51b83cdbd015f2d27e37f81847ed56b5cbe2d6eb35286d4195c03f6e94bb2dce4df4bf93bfa788c705da4b59aee8c06980ed0633beb9ac4e0ccb8e26e0673d6ce48662bc477c9a075a9a82b0bbce4181ba9cbd42d49d449b15a432c535a5d4958dd397dbfaeba866e82461f2d9e84aa5af47e7f98827d38708b35601000000000000008cfd9bd3c5999de68603031a728c9c0182d69908dcf776b9d50a334d5d63d4f0d98486dcb5f57b3e1aad261b8821b3ab7320e25adc8a1eaf415266333742b3c20ae75b1db50ca55f17fd09743c9600381ef198544180791859af406865b36e31dc3e94e1c08cbfc404b34c5d65f835b75832705f06a049e136da12b9e9bf378f2f132166fb4113a0c9d1873513e60cc9cfaf6a81689c29f30ff64842014b33dc42022aab75b76612e8b8d152587cf84727c05fc6502e0a0af3a33a7c5fe7fc6340dee7cc1c2c3443990bd4b823ed4547c796e3d0a0afe80fa642ad9f56c1e2832b655d4409c11aa53849f90693a60d975c1da5c0d879ded68a2adc5554deb0edbe8542f2fdb5ad221c0e18d0a910b7d9bb1e8db31e949dea48237ba90b59f359fdd7607b78ad757c38cdddb3d41bca7497d84c26edd7599f48ffd2f628b95491c9e5fe3a44750091f1354bd31ae98187f189ef0fc8bf021cc0bda8c27a4b8c5d94ab09b3aa340bcfb8f15986c17b6cdb1964ae7b7d57b6ac035e736ae16ffccd1180a53eadc68b9402d50cd8cb552e2a4bed774f9dbf81d44e7a568793fc04c0224cef7384b4e1ea130bac3eaf6fee5629f33f80e6dbb37d588b568a4af7702300b7d98802abf0c41b82f06a0dc11dd6e79576301d186c01cf44b2686a0082a70461982ebc558d39c7e31e7eb5489360ba237ea5316077e5880f342e2e01e7a3589c8c397c06472cca4abd9bfddca5b5c80adff1dbbe1f2d0f2241d78a565fc3a549456e1b5c008171abe0c225a5604df37f871c49ba2e2f18f60fb15019b7df19ca9d82ccc16ce673e0dacde1d0203cb52bd8d8228e1bafd9d92fd3faee70893b4774d641e89364ea364aa65d4e1026fb7b470b3681ce14acaf68125bccafb9387d399e5401de9262f9d9b1858e9570eef3db81c9cc76cde76808441b7e183811a70b2c5b421e99d258ef921e943423b2baa030f3fdcd3b99537311f21da0ca95bed4000ca59fb830a4e8bc827faec9567017e0284c8d279e2d3bd92a44504ce908fb717130b835d3577ac64f76ca52576ee200cae5489d3010261fcae925d662e5cef45c97725f9e59618dab27480f63b863dc6886103bd004c71c83f940e694afd6fb1e1001b839e3db65c4d09d265a8919e51d036ba7c41f4a378307298cb351c491dd6460677811fca3575eb013fdbe8b75fbab97f7104f352fab91bedec2f81ed68ecfb138bef1aad8e3b1c82ba8c9fa936aded3db8865df550051a70efe5bf6c0b8acfd06e189623d2d2640479185a32676aea1279134ef016ad91f5f55ec2e1ff7ca5e6703323b232d9c060ac101b7d3ec5e5edf567b1b6adeaaf2c9cebb6e4a64ffcd852cf2da358d5ef9b92f43395258c352a316a30fc92b7f4dc049fbafc5a6b4e18ffcab06062e586e9b3a60589931f30507b02ade0dc25337ec9e46e266b4acd05ca8dc4fd58fb83f4ec9a265b5cf0f15cbeaf4e4ab851c4b48c73d406687594a2bbdc06fd4dda0d0287c0ae0f3148b12d1fdec4c45654678a287f2b7d63aaa3c328ae29d00801767e4af31f6f5f2544ae877ad402ba43f0109af89f8077c43d86242cdea320c514687e8a2eaf994adfdc00100c9342f43746d75ed3715ef6a604486682705fa619e9a8e8678407be7db15fdf13ab356e4065a112f0770e7e39414076c02d1d28a15d58b2ec550ad127a3741320635119e26425136d7f8bb80c24915a12278b8efd1ed4516c7a5cc33137935950535013c17323668e28e533655b49cf0559458c1ef3bb4247d78911d82c8f705f0218547918043458db4dc508cd860a0bcfca2f776e9a73e76d56482e769b01bee41f32f83d50c9ea2725b6ec7456fd3b1672b34e5a2b9de1d69b21580e959f9999a192eedb931787c5224cdc1e52977b29bbc3099cf106af282bc82486d43b10268e9a5edcac97e25528d64b3e842d83bec52ed4f65c11366618d8c7ea86709ea6e2c4d37db36be9e080a966636a436658d05cc69cef78fd254185a112563d1a0ab0c24ed51eb521755a4db4e5427f994921207f803189ca5031b7fdba5633c9cad629169d8cea90553205f4a3829eb0beae7d9cace0b4cca42d78e5c4baff5f622c95ffdcf493cd67f51c939f40298d2335c4284a9b7da8e583df45de7e98cf2c06d78214528e2437442f08585fb33281ebe8b515381fa197a123b2fe3537b0a9ba794c045a51689dbd53107145b8a507c9fede9b21846f1fb35ae12dee97f9cdde678f42e9e68a3c41d94a47d955f00c8f287ca281a8911ae4629d5710f078574eff31c3716f2d0a72f8cdff0499287912029f4b66c2e34f462a2309edd2684c0089e3616a20279eebad8b83c68d7ddc80efc76b3e517b2b2931c676322f17bcbd47d6ff1c1ae660dff558d9c0801d120c274089d83e2480aaaeec4c502682539d11410a88d11a42146f3e11d724e6fa9ffa918517ab8a399011e1fa638f3203a2d5c473fbb4262b9ac38d3e3b4d6faf18468fa8c55c17c52662dde37e53d4c2817629c95d9bf4b763bd1096453eb5dc54b834dac74ee33f187bd27c6b701683abce4cea38958f3d4fad584458475f4c28a7982065b6cbb550fe8ab3daa61c052b9b71f201bfad544318b62aece3e13f59ed6b4a8531be135e19f5c9b838581850f84080d6ea73deefed2013511cc04286b65ddc4758dc8342a17f58f0c38d37bc1a4fe01550fa18f632ae8a0718e8eaff4ed40eff4c06b2c033bc211360271f6f6fcb5a72b6269d680540190dbd58c38fb6d4d7f5bb430229047c3d04e0a69bbc6af3fd11ca934d66f5dd7069e3d547827207ad2bbf37232aec59c48265dbc9bf636854e1018c0ad2f6754c4dc9d812507972b3ecf8e977b14be5d36b45482071571bae5df6d17212eb58205317acf5e301066b5327ec266f516776ca1ef99c056b45b1b5679415350d2f551b1c2eb501386b2d9ef539acb635620333a7b98bd228748cb4232eb0d1e49ddaed57c941c943d61d6faaa5312398f724c3ac1ff816dbf1bdc8a978f2425662558ceaca33f1161d78908872150292eb655b01b67acbc2caa82daff699d66312c51195db47368aa561748460bd63e7508d11f0e6b7528e91cde57988589c0a7b9577136ca637ec025cf303d10afff55c6119861497b2b18a464712c5c60af6f380d63d69c8ae4ba66ac00509e97789ffcb42d22fe5d165d361cd435e12c0b6602051f0425cb976cea6a66c2ca54c997cb77b5586955a37688eced359b97d0a25b65378675447c1d0f3dc72778c110f27b846e56b3a17340b8f4c6d7a0085ad734e9bb1098986a6e06d6d4f912437170782e44d2fd19ac5bc66e1c510d47033739d40a356c1c261c149e8dbf84523afd80c2eb21a5ac7e31d33a9545208fe442f4c53898864a05bb6c90cabd8816e14d2ddc5937e66023df0461e2fc5c1b26ad733bcaa4def1253f3206ef95547886116fd6b2d9af6e2a87ca71121d8b3c61a024d71032030a4bdd916ff939ce67291d433cddf3bcdae886ce93776e2b0e82018bd7de9d8ab5e108dc1af13a618677a4fe454536515d2ee2bbbcbca1e001c1613f6d43bbd2f24b574c2bdd3f61e468cd78380790fb1cc84d1415cccf994ba8cb28a74c429064c3f0f5e4a01e572cdf9473aa70a1413bf4bbef2be6fcfde71ee7f819c1c2cedac1ed1274e738094ecef7205b4778ab8fcfefbd16ee94a742aac63554ccc5f804b0d79a96fcb4cc2206616dee298c3d828ee002f30ca4e1b207bd03b13cbb80d5bce5e605b958ac16a65baf95b5d158dcfe61d7c2090c11d9e8d69fdf9f4588fae7d6b9f4b57dc7bf7247e1aeb6626200796e0b7538dba373c163c0445247f544ab8c5ec51b6530c4ccd4ed5f9810b471ca67b91b06895df4ce4e7512e88033ce3cbf10d61a99bf543d38563bf3464a46e18c8bb6195bd7c8b8a3f618a2faa9ba0885fa0402c7781e77ca325f7bae30fbdb6735a4c462c8218c2125ea6fd1f47added1d4553dd7f99a06eddc10896bebb7d68556711fc7e069b17a1d6800c2b25f65a68ef7b849476871b9c263cc01fe538f80ae6a9c96514b5d0fc405f6d4343fcb95923d9b9e871da753eeaac351b9b7a39c487cb984b9dc462c7a5749ed1b9a09d1dc91a8465f1a482417107f05cf41675d9addc5a6007eeda456aa64d6ac24b0437abbc1b4f834a6005e4b19c5e3455ae44d546c2c4cbf7ab1cebe4237f881d8e0d9834bd2dde704226ac65f8f374767ec7f40b3cf51506c09925f71f5ab92c36f784d98fa03f41fb2bcf49cee156ae4121f2d276b4e502b17421e0d2376f8614927a4c6ed45ed92779a9f15269d441d2f70c218e04dabf9ca243927fb87cd86dd72fdd92c9f23fcf5e02de2cacdd01ab8094b47eec019a2b46bb5e924b9fc4598347a27282f6ab9a5ce60dd26a5908b21624915b8655d7c788dfe10fb26b3c8424e7260aaecee22e0803d15b8a0c9010cf26f37204913c031d8b2d3d9adf8c701d64a523c52a31370c3846b6d9c5758fc804c6186c84d99d9c0333d6cb1ee128e9c1e5e5a92efe0e358de351dc3ab1081b2540645efa4a7fb5d1aaa9a10e0cef44418913e4cb2d6499457821a50d691f811a3d156f359b73f36367e6cdaf595c84814cb8539b70b5564ef74ffb591a04f90091eb698815e1daca14d2c8c82d6735d66f9a36272ce4602a8443d3b1de918acb56efe196c19a6bccf0e7971461a09813715252d0aeacfb3b5346f083e49289deb83b869840b4e1478311fae89d11829b2d73d3293af1673901a8d92d2c4f109ca27a3a3b99a2b2ffe1b78c72de02b619eb0a7afe200a26048e120a8ed27229e84aef2c3bef071978d5c6d567f9ad552204720ba5ff1ac42521ebf81747e1d82e6123296041d20d8c4572dbcf1fdd7e44895a8ef39f76c3d8c353bb0316ec0f938a4bfa5efffb4f95fa2795d9f30b2cf5df29d53970886a6206c6441c47d1760fdad5b0a92df40a0ee349db45aa86e89c9fa30714b7dde4fb53c4dae424320961dbadc04175b620fc9c6212465e51afb61ce16fb3e91ac58b6773071e76713d7c9934662dd349d0444e03ccf040ec2abe8883ce52d8e746d1c5e45b0d932894a44f6667599148d2f35aaeff1db9db17636e587ac8936c832b166468a929be045512e259d6daae12480c39186042bfca5c0b77d81462134ca4524a8bce45d60ed7a7efe4399ac24db884478ee3fbaaa1077a14e16b0a4e0af7a481a3d7137a4209a1f073a6d146d523b86d8bbd70cb287aa1e419d5fb9eb91a5eafcce481360110a00fb066ba2855a5e876bff8883ad3359e3919dc8c07fe20f0843325e9c3321f67e3ba123c8d13979fa0a5d18d65351b329fffe2e0392d51"], 0x10ec}}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0x184, 0x21, 0x1, 0x0, 0x4, {{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa}}, [@migrate={0x134, 0x11, [{@in6=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@rand_addr=' \x01\x00', @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2b, 0x2, 0x0, 0x3501, 0x2, 0x2}, {@in=@multicast1, @in=@local, @in6=@private2, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x33, 0x4, 0x0, 0x34ff, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@dev={0xfe, 0x80, '\x00', 0x35}, @in=@local, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x3c, 0x0, 0x0, 0x0, 0xa, 0x8}, {@in=@loopback, @in6=@remote, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x33, 0x4, 0x0, 0x3503, 0xa, 0x2}]}]}, 0x184}}, 0x0) bind$tipc(0xffffffffffffffff, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r7 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r7, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) r8 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) pread64(r8, &(0x7f00000003c0)=""/159, 0x9f, 0x0) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(0xffffffffffffffff, 0x0, 0x0) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}, 0x0) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r9, 0x5433, 0x0) 2.171619368s ago: executing program 2 (id=1054): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x1c}], 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r3, &(0x7f0000000200)=[{&(0x7f0000000380)="2612e96fea22b0919a78829125e2c63c035c1d5e86c4ade871dcae3527a57b0f1f2a799d8e5e342cf423ce4ee4a96bf746f558d2a0736aa384ec584f5d6d82db20f73f27900311a484f1bdacaa497476bc86b767d54fe577c4ebcda16f59d439f8bab422c7c7e388f0002e1eb8273ae0a32e2bd64127cfe155f4d5f4072f64e7b7bead40db5ccf028dc1dcfb76d08e4cc6a16ec455dbb351e59ddc4bea1fb701a6b6ea92153b6a22d04172ccc552107af8de82b390a568b55d12fe4a88baec9a2c1de4818b63219d0cef21c732ddcbfcffdbc88d40d260b9264c0d441066cd2b9add8f54fae7d363f3b1e3f8405b30a06abf41903549e067eefeff161dab874a4f13aafef418638d7c0ab9eb032e46c2572bba036b1e0417bfaa1ee300d083a5cd3f9ab9d6ea60bee5c409e61e67fa9464f151cd0112272946b17f3caea3ec8ab11be803ac5c57cc4cef394c2ff7b0634ed0c805f06669331b491dac7df43263bcd8fd45aac18869d40f822cbb30ba704f7b5794ff19c88d27adcfc29ecab3733c4b2ae0e5d71dc38cf163c3473d2b9005e092f0843f4e316fea864af3eaa65657f43b2c1dff3e1831090e0f54972cf9c8791cb2d04149c8d91d6651848ec356c7a83d1a3a7828bfbd0f6a6dbef1810d99e1afbcc5f6fd0919d358911e2afd12143f11ce50d35b1e0070e6752de29d13e4681ade5ad6a5f38cfcffeaf0a8a2205414e67043d06afe4fc0cf437756124ce1a6edc85ce34421e7e17523970525883904ceec8e58cb16c042f421ef4893749077a4e4789954d2c3efaa8b520efc61cbed393a6e51c35e5973e9d929f762c5a9badf072c1e9a7a14e7158674d4d3d6763840b328a1f704ac9eda428e433036c0d936830a58a9fa468344a9d23640d99bc818e5f23346bdb1f6fcb46b0ac1fa68951dca534f7aa2afe541c130c9184b88450722f395e3d2222d963193686163dc0e5b107b03770303feab7d6929d125b37d9ce47ab3c939c8073b1e78be6e6684f27f7e420a597db39303729c22d939cc46218a1894f98bcbf5cecf61ac76c3b3830366aa032440bcdcbcd095e5e343cacffb2f19c4f97535fec9c43c01229bffd6c87716ab85c7104d0a57fe64f03e69c528792c7e81501008a9a8006301256401920ebfef11f162cd870587bc742d511fcc9ecb4bfc4883a6e7eae683ae67210c7d6e834fb9b15d588a0784b042b1d853b8d4208fac1784ced318b4bb972a02303babd12cb8b7aeca81da1311e8fe765a920c6e6a178fbf506a6311cccba4caec961af7195d8c6e3033ab58589473165198ca27aa1cc791e93170b8e02d671c514bf8885dc9ff1c40d91425c6cc1d3bd95306d2046c4c12862a66ae239a20a00a119bfe4241f1e798cad9e82c32abb2afd2645560cde66f16564ab0c8b3df195e36a6ca67c568755140c2ba0803cdb7efaf2166e91b554acaec1168c1deabbde681cb71628cd2929b504d520057e9433cf102ef3e6b43d77bbac9497f71891f1982ed7029879a236999c7d2fe75166475cfe2e11a0e11624842b5e724cf59956cfd2675713e89448291d89289a4027b077dc03fee4e08712c9c015d96fc2357c61c15b764b193f9faf16a1dda43d02fd01dca039c4278faa2ec7023a68678751a3f0aa5c23cda7e69dbbd710d2e96910426046cbb78b60057095ca2ba1d3d2df658c5e8c22430aea770a6458bb7a3a05d0473998061759df782685856fd8cf6725c5d5e7bfeb3cf5630fd9ceefc35e9b9f003ce4400f3e7e44d36e3aa279b40", 0x4f1}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) (async) readv(r1, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x1c}], 0x4) (async) socket$kcm(0x2, 0xa, 0x2) (async) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) writev(r3, &(0x7f0000000200)=[{&(0x7f0000000380)="2612e96fea22b0919a78829125e2c63c035c1d5e86c4ade871dcae3527a57b0f1f2a799d8e5e342cf423ce4ee4a96bf746f558d2a0736aa384ec584f5d6d82db20f73f27900311a484f1bdacaa497476bc86b767d54fe577c4ebcda16f59d439f8bab422c7c7e388f0002e1eb8273ae0a32e2bd64127cfe155f4d5f4072f64e7b7bead40db5ccf028dc1dcfb76d08e4cc6a16ec455dbb351e59ddc4bea1fb701a6b6ea92153b6a22d04172ccc552107af8de82b390a568b55d12fe4a88baec9a2c1de4818b63219d0cef21c732ddcbfcffdbc88d40d260b9264c0d441066cd2b9add8f54fae7d363f3b1e3f8405b30a06abf41903549e067eefeff161dab874a4f13aafef418638d7c0ab9eb032e46c2572bba036b1e0417bfaa1ee300d083a5cd3f9ab9d6ea60bee5c409e61e67fa9464f151cd0112272946b17f3caea3ec8ab11be803ac5c57cc4cef394c2ff7b0634ed0c805f06669331b491dac7df43263bcd8fd45aac18869d40f822cbb30ba704f7b5794ff19c88d27adcfc29ecab3733c4b2ae0e5d71dc38cf163c3473d2b9005e092f0843f4e316fea864af3eaa65657f43b2c1dff3e1831090e0f54972cf9c8791cb2d04149c8d91d6651848ec356c7a83d1a3a7828bfbd0f6a6dbef1810d99e1afbcc5f6fd0919d358911e2afd12143f11ce50d35b1e0070e6752de29d13e4681ade5ad6a5f38cfcffeaf0a8a2205414e67043d06afe4fc0cf437756124ce1a6edc85ce34421e7e17523970525883904ceec8e58cb16c042f421ef4893749077a4e4789954d2c3efaa8b520efc61cbed393a6e51c35e5973e9d929f762c5a9badf072c1e9a7a14e7158674d4d3d6763840b328a1f704ac9eda428e433036c0d936830a58a9fa468344a9d23640d99bc818e5f23346bdb1f6fcb46b0ac1fa68951dca534f7aa2afe541c130c9184b88450722f395e3d2222d963193686163dc0e5b107b03770303feab7d6929d125b37d9ce47ab3c939c8073b1e78be6e6684f27f7e420a597db39303729c22d939cc46218a1894f98bcbf5cecf61ac76c3b3830366aa032440bcdcbcd095e5e343cacffb2f19c4f97535fec9c43c01229bffd6c87716ab85c7104d0a57fe64f03e69c528792c7e81501008a9a8006301256401920ebfef11f162cd870587bc742d511fcc9ecb4bfc4883a6e7eae683ae67210c7d6e834fb9b15d588a0784b042b1d853b8d4208fac1784ced318b4bb972a02303babd12cb8b7aeca81da1311e8fe765a920c6e6a178fbf506a6311cccba4caec961af7195d8c6e3033ab58589473165198ca27aa1cc791e93170b8e02d671c514bf8885dc9ff1c40d91425c6cc1d3bd95306d2046c4c12862a66ae239a20a00a119bfe4241f1e798cad9e82c32abb2afd2645560cde66f16564ab0c8b3df195e36a6ca67c568755140c2ba0803cdb7efaf2166e91b554acaec1168c1deabbde681cb71628cd2929b504d520057e9433cf102ef3e6b43d77bbac9497f71891f1982ed7029879a236999c7d2fe75166475cfe2e11a0e11624842b5e724cf59956cfd2675713e89448291d89289a4027b077dc03fee4e08712c9c015d96fc2357c61c15b764b193f9faf16a1dda43d02fd01dca039c4278faa2ec7023a68678751a3f0aa5c23cda7e69dbbd710d2e96910426046cbb78b60057095ca2ba1d3d2df658c5e8c22430aea770a6458bb7a3a05d0473998061759df782685856fd8cf6725c5d5e7bfeb3cf5630fd9ceefc35e9b9f003ce4400f3e7e44d36e3aa279b40", 0x4f1}], 0x1) (async) 1.855459309s ago: executing program 2 (id=1055): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x20, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000791000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000b40)=@delqdisc={0x16c, 0x25, 0x8, 0x70bd29, 0x25dfdbf5, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff1}, {0x9, 0xd}, {0x4, 0x4}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3d, 0x7, 0xfffd, 0x8, 0x2, 0x8, 0x1}}, {0x4}}]}, @TCA_STAB={0xd8, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x6, 0x5, 0x5, 0x1, 0x4, 0x6, 0x5}}, {0xe, 0x2, [0x5, 0xff, 0x80, 0x1, 0x14]}}, {{0x1c, 0x1, {0x8, 0x7, 0x3ff, 0xfffffffe, 0x1, 0x5, 0x5, 0x3}}, {0xa, 0x2, [0x1ff, 0x5, 0x4]}}, {{0x1c, 0x1, {0x8, 0x10, 0x40, 0x5, 0x0, 0x2, 0x3}}, {0x4}}, {{0x1c, 0x1, {0x1, 0x40, 0x7, 0x979f, 0x0, 0x4000000, 0x6}}, {0x4}}, {{0x1c, 0x1, {0x3, 0x5, 0x0, 0x100, 0x0, 0xffffffff, 0x1}}, {0x4}}, {{0x1c, 0x1, {0x2, 0x1, 0xe, 0x482, 0x0, 0x1, 0x5}}, {0x4}}]}, @TCA_RATE={0x6, 0x5, {0x8}}, @qdisc_kind_options=@q_fq_codel={{0xd}, {0x34, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD_SELECTOR={0x5, 0xa, 0x10}, @TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x4}, @TCA_FQ_CODEL_LIMIT={0x8, 0x2, 0x700000}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x3ff}, @TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8}, @TCA_FQ_CODEL_INTERVAL={0x8, 0x3, 0xd}]}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x4000880}, 0x20008004) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000", 0xe, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x24}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0xa1}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.476162869s ago: executing program 2 (id=1056): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x20, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18000000000000000000000000000000791000000000000095"], 0x0, 0x3, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000b40)=@delqdisc={0x154, 0x25, 0x8, 0x70bd29, 0x25dfdbf5, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff1}, {0x9, 0xd}, {0x4, 0x4}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3d, 0x7, 0xfffd, 0x8, 0x2, 0x8, 0x1}}, {0x4}}]}, @TCA_STAB={0x104, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x6, 0x5, 0x5, 0x1, 0x4, 0x6, 0x5}}, {0xe, 0x2, [0x5, 0xff, 0x80, 0x1, 0x14]}}, {{0x1c, 0x1, {0x8, 0x7, 0x3ff, 0xfffffffe, 0x1, 0x5, 0x5, 0x3}}, {0xa, 0x2, [0x1ff, 0x5, 0x4]}}, {{0x1c, 0x1, {0x8, 0x10, 0x40, 0x5, 0x0, 0x2, 0x3, 0x1}}, {0x6, 0x2, [0x1]}}, {{0x1c, 0x1, {0x2, 0x4, 0x6, 0x8, 0x1, 0x0, 0x7, 0x1}}, {0x6, 0x2, [0xfb]}}, {{0x1c, 0x1, {0x1, 0x40, 0x7, 0x979f, 0x0, 0x4000000, 0x6, 0x1}}, {0x6, 0x2, [0x5]}}, {{0x1c, 0x1, {0x3, 0x5, 0x0, 0x100, 0x0, 0xffffffff, 0x1}}, {0x4}}, {{0x1c, 0x1, {0x2, 0x1, 0xe, 0x482, 0x0, 0x1, 0x5}}, {0x4}}]}, @TCA_RATE={0x6, 0x5, {0x8}}]}, 0x154}, 0x1, 0x0, 0x0, 0x4000880}, 0x20008004) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/106, 0x6a}, {0x0}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf, 0xa1}}], 0x1, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.035378582s ago: executing program 2 (id=1057): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller0\x00', 0x2}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newtclass={0x64, 0x28, 0x20, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x8, 0xfff3}, {0x8, 0xb}, {0x5, 0x4}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x1}}, @tclass_kind_options=@c_skbprio={0xc}, @tclass_kind_options=@c_red={0x8}, @tclass_kind_options=@c_multiq={0xb}, @TCA_RATE={0x6, 0x5, {0x8, 0x7}}, @TCA_RATE={0x6, 0x5, {0x8, 0xff}}, @tclass_kind_options=@c_mq={0x7}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008080}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r6, 0x89f0, &(0x7f00000003c0)={'erspan0\x00', &(0x7f0000000c80)={'syztnl2\x00', r5, 0x700, 0x8, 0x5f70, 0xa00f, {{0x13, 0x4, 0x1, 0x0, 0x4c, 0x67, 0x0, 0x10, 0x4, 0x0, @loopback, @multicast2, {[@ssrr={0x89, 0x3, 0xc}, @rr={0x7, 0x1f, 0xda, [@loopback, @loopback, @remote, @multicast2, @private=0xa010102, @broadcast, @dev={0xac, 0x14, 0x14, 0x44}]}, @end, @lsrr={0x83, 0x13, 0x42, [@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, @private=0xa010102]}]}}}}}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000d80)='./file0\x00', &(0x7f0000000dc0)={0x800, 0x0, 0x24}, 0x18) r8 = open_tree(r7, &(0x7f0000000d40)='./file0\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) setsockopt$TIPC_DEST_DROPPABLE(r8, 0x10f, 0x81, &(0x7f0000000040)=0x5, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) r9 = getpid() sched_getattr(r9, &(0x7f0000000d00)={0x38}, 0x38, 0x0) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000500)={0xffffffffffffffff}) r12 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r12, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r12, &(0x7f00000000c0)={0x1d, r13}, 0x10) sendmsg$can_bcm(r12, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="0100"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="000020670e241c55cd84af65969fdd000100003fcabee70000000500a5976ac6acd41fd8"], 0x48}}, 0x0) sendmsg$can_bcm(r12, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[@ANYBLOB="0200"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000000010000000000000000000001ee6a491530f050658171f6c275577ff8915c5dbcac9e66e74ba13862b02b911b902d6b9a72ae1e5ea5f5e6f65d957f81c50388bceac57ace7e100e128bad9620e4fbf91fd5022df76a8a1a83f8036871"], 0x48}}, 0x0) write$binfmt_misc(r10, &(0x7f00000001c0)="1e", 0x1) syz_emit_ethernet(0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaa0086dd6075e70000183afffe800000000000000000000000000000ff0200000000000071c8d443862932c45bbb00000000000000018800907800000000fe8000000000"], 0x0) splice(r11, 0x0, r10, 0x0, 0xffffffffffff8000, 0x0) 946.432471ms ago: executing program 1 (id=1058): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000140)={0x0, 0x5, 0x2, {0xa, @pix_mp={0x9, 0x2, 0x0, 0x8, 0xa, [{0xd, 0x2}, {0x3, 0x8001}, {0xa64a80ed, 0x7fffffff}, {0x4, 0x3ff}, {0x5, 0x1}, {0x8, 0x8}, {0x7ff, 0x9}, {0x6, 0xfffffffe}], 0x7, 0xff, 0x6, 0x1, 0x5}}, 0x4}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@const={0xc, 0x0, 0x0, 0xa, 0x1}]}}, 0x0, 0x26, 0x0, 0x1, 0x3, 0x10000}, 0x28) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001e000103020000200000000001000000080003"], 0x1c}, 0x1, 0x0, 0x0, 0x81}, 0x4004000) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f00000001c0)=0x8000, 0x4) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r3 = fanotify_init(0x8, 0x1) fanotify_mark(r3, 0x1, 0x11, 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') 823.01353ms ago: executing program 5 (id=1059): r0 = socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x18, 0x80000, 0x5) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@ipv6_newnexthop={0x20, 0x68, 0x1, 0x70bd26, 0x0, {0x2}, [@NHA_OIF={0x8, 0x5, r3}]}, 0x20}}, 0x0) socket$unix(0x1, 0x5, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000100)='net/unix\x00') pread64(r4, &(0x7f0000000480)=""/154, 0x9a, 0x73) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)="d8000000180081054e81f783db4cb9040a1da40006007c09e8fc55a10a0015000600142603600e1208000f00fff00401a800080008000c4004080000055c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb71b14d6d930dfe144ecc447c65e206d25b4084121d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300fc0d15", 0xd8}], 0x1}, 0x40000c0) recvfrom(r0, &(0x7f0000000040)=""/71, 0x47, 0x40000101, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x4, 0x0, 0x3, 0x0, {0xa, 0x4e22, 0x6, @dev={0xfe, 0x80, '\x00', 0x41}, 0x3}}}, 0x80) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000340)={0x5, 0x0, 0x2}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001a00012dc9fdc700030000000200000020"], 0x1c}}, 0x4) socket$inet6(0xa, 0xa, 0x4) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r6, &(0x7f0000001b40)=[{{&(0x7f00000002c0)={0xa, 0x4e20, 0x2, @remote, 0x8}, 0x1c, &(0x7f0000000800)=[{&(0x7f0000000080)="d6", 0x1}], 0x1}}], 0x1, 0x4004851) setsockopt(r6, 0x84, 0x14, &(0x7f0000000040)="020000000980ffff", 0x8) setsockopt$inet6_int(r6, 0x29, 0x33, &(0x7f00000002c0)=0x6, 0x4) 771.718118ms ago: executing program 1 (id=1060): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f0000000000)={'bond0\x00', @ifru_names='bond_slave_1\x00'}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000200)={0x40, 0x17, 0x1, "1f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac2(r0, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000640)={0x40, 0xb, 0x1, "e2"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, &(0x7f0000000080)={0x0, 0x22, 0x46, {0x46, 0x6, "30267079a2f90d21ab8c29673895eab4cea767084c4789b0ad2caeed45458f5611d4476513a55f3d4e8945b84ed28a36d0a81abcc96f4a8973f7babc4b7ce9fc2edf4ab9"}}, &(0x7f0000000100)={0x0, 0x3, 0x89, @string={0x89, 0x3, "b17388661fcb0b7eaa9dcd11fcd8e409b714a33f6e66d280e65b9e2099b8026c332bb17c2dbe6ba554cef49ec8f74a794f88c441c194b64bc8deccac9d9cb9cbf33359468c1ca154bf62329a8e638534ebb9abac07bfe7f32236cf420814f0ba11995c0d592afaec4f6e149718bbd4ed3ae741a47e3386515b0f287de4b1a751fb38bcb2e768ba"}}, &(0x7f00000001c0)={0x0, 0x22, 0x29, {[@global=@item_4={0x3, 0x1, 0x3, "31fbfd9d"}, @global=@item_4={0x3, 0x1, 0x6, "abd1c39f"}, @global=@item_4={0x3, 0x1, 0x5, "55d5096b"}, @main=@item_4={0x3, 0x0, 0xa, "88e4bde0"}, @main=@item_4={0x3, 0x0, 0x9, "957bf01e"}, @main=@item_4={0x3, 0x0, 0xb, "e24df5a4"}, @global=@item_012={0x2, 0x1, 0x4, "edf7"}, @local=@item_4={0x3, 0x2, 0x5, "460f0f9b"}, @main=@item_012={0x2, 0x0, 0xa, "d38b"}]}}, &(0x7f0000000240)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4, 0x5, 0x1, {0x22, 0xd66}}}}, &(0x7f00000004c0)={0x2c, &(0x7f00000002c0)={0x0, 0x3, 0xa6, "e0cd2e09deb996bb1dba1bdff85e1f35e878ce90a7d2071e59e20d6213dabf8736a630dfd5ac08999a92458bb9449dd350d97f5e19bfb2022a6cac351f35ce9c9f9d5fb4730196b7f1b98e74397f903fc096b795af3a73ebec6f5ad51dc15d9a6af86a793ce80b8a0b9f8d279467f3a4da4495e428a17d45dae937c70a2951a38fe247eb93cce9b15867e1918666554039734d2cb634a602d1504bae7689b1247f59db391e31"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000400)={0x20, 0x1, 0x2b, "c84c0510ba0b3788c6b792024851e7410c3e5ec2bf25f354ddb36fa6b8ff1cf119dc62231e2b823ffa35c3"}, &(0x7f0000000480)={0x20, 0x3, 0x1, 0x12}}) 605.771357ms ago: executing program 5 (id=1061): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'syzkaller0\x00', 0x2}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x2000001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x5}, @TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) (fail_nth: 2) 526.402078ms ago: executing program 3 (id=1062): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f0000000000)={'bond0\x00', @ifru_names='bond_slave_1\x00'}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000200)={0x40, 0x17, 0x1, "1f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="40050500000002"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000640)={0x40, 0xb, 0x1, "e2"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, &(0x7f0000000080)={0x0, 0x22, 0x46, {0x46, 0x6, "30267079a2f90d21ab8c29673895eab4cea767084c4789b0ad2caeed45458f5611d4476513a55f3d4e8945b84ed28a36d0a81abcc96f4a8973f7babc4b7ce9fc2edf4ab9"}}, &(0x7f0000000100)={0x0, 0x3, 0x89, @string={0x89, 0x3, "b17388661fcb0b7eaa9dcd11fcd8e409b714a33f6e66d280e65b9e2099b8026c332bb17c2dbe6ba554cef49ec8f74a794f88c441c194b64bc8deccac9d9cb9cbf33359468c1ca154bf62329a8e638534ebb9abac07bfe7f32236cf420814f0ba11995c0d592afaec4f6e149718bbd4ed3ae741a47e3386515b0f287de4b1a751fb38bcb2e768ba"}}, &(0x7f00000001c0)={0x0, 0x22, 0x29, {[@global=@item_4={0x3, 0x1, 0x3, "31fbfd9d"}, @global=@item_4={0x3, 0x1, 0x6, "abd1c39f"}, @global=@item_4={0x3, 0x1, 0x5, "55d5096b"}, @main=@item_4={0x3, 0x0, 0xa, "88e4bde0"}, @main=@item_4={0x3, 0x0, 0x9, "957bf01e"}, @main=@item_4={0x3, 0x0, 0xb, "e24df5a4"}, @global=@item_012={0x2, 0x1, 0x4, "edf7"}, @local=@item_4={0x3, 0x2, 0x5, "460f0f9b"}, @main=@item_012={0x2, 0x0, 0xa, "d38b"}]}}, &(0x7f0000000240)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4, 0x5, 0x1, {0x22, 0xd66}}}}, &(0x7f00000004c0)={0x2c, &(0x7f00000002c0)={0x0, 0x3, 0xa6, "e0cd2e09deb996bb1dba1bdff85e1f35e878ce90a7d2071e59e20d6213dabf8736a630dfd5ac08999a92458bb9449dd350d97f5e19bfb2022a6cac351f35ce9c9f9d5fb4730196b7f1b98e74397f903fc096b795af3a73ebec6f5ad51dc15d9a6af86a793ce80b8a0b9f8d279467f3a4da4495e428a17d45dae937c70a2951a38fe247eb93cce9b15867e1918666554039734d2cb634a602d1504bae7689b1247f59db391e31"}, &(0x7f0000000380)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000000400)={0x20, 0x1, 0x2b, "c84c0510ba0b3788c6b792024851e7410c3e5ec2bf25f354ddb36fa6b8ff1cf119dc62231e2b823ffa35c3"}, &(0x7f0000000480)={0x20, 0x3, 0x1, 0x12}}) 199.140105ms ago: executing program 0 (id=1063): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f00000001c0)=ANY=[], 0x0}, 0x94) syz_emit_ethernet(0x3a, &(0x7f00000004c0)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2d, 0x28, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}, 0x0) sendmsg$NL80211_CMD_SET_REG(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x60000100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000058000000030a010200000000"], 0x122}}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443", 0x67}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00fcff", 0x18, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 178.682853ms ago: executing program 5 (id=1064): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$xdp(0x2c, 0x3, 0x0) bind$xdp(r2, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000100)='mode\x00', &(0x7f0000000140)='7', 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') pread64(r4, 0x0, 0x0, 0x200) getsockname$packet(r4, &(0x7f0000000140), &(0x7f0000000280)=0x14) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, &(0x7f00000000c0)) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_mreq(r6, 0x29, 0x1b, &(0x7f0000000140)={@remote}, 0x14) setsockopt$inet6_mreq(r6, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) r7 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) 107.489475ms ago: executing program 0 (id=1065): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001f80)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x18000000, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000440)=@nat={'nat\x00', 0x670, 0x5, 0x408, 0x0, 0x210, 0xfeffffff, 0x0, 0x2e0, 0x3b8, 0x3b8, 0xffffffff, 0x3b8, 0x3b8, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0xffffff00, 'veth0_to_bond\x00', 'veth1_to_team\x00', {}, {}, 0x6}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@addrtype={{0x30}, {0x50, 0x0, 0x1, 0x1}}, @common=@inet=@tcp={{0x30}, {[0x4e24, 0x4e22], [0x4e23, 0x4e23], 0x8, 0x80, 0x8, 0xe}}]}, @common=@inet=@TCPMSS={0x28}}, {{@uncond, 0x0, 0xe0, 0x118, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x1], 0x2}}}, @common=@addrtype={{0x30}, {0x1, 0x522, 0x1, 0x1}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id=0x2, @gre_key=0x8}}}}, {{@ip={@loopback, @rand_addr, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00'}, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id}}}}, {{@ip={@loopback, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00', {}, {0xff}}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv6=@private2, @ipv4=@dev, @port=0xffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x40000021, 0x0, 0x0) r3 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$update(0x2, r3, &(0x7f0000000140)="c4", 0x1) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000080)={&(0x7f00006c6000/0x400000)=nil, &(0x7f000018b000/0x3000)=nil, 0x400000, 0x0, 0x6040000}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000580)={0x30, 0x1, 0x4, 0x301, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFULA_CFG_MODE={0xa, 0x2, {0x40}}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0xd477}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004000}, 0x4080) r6 = socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bind$unix(r7, &(0x7f00000000c0)=@abs={0x1, 0x5c}, 0x6e) sendmmsg$inet_sctp(r6, &(0x7f0000002ac0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB=' \x00#'], 0x20, 0x20008001}], 0x1, 0x24010000) 0s ago: executing program 2 (id=1066): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000085000000a000000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x4800) (fail_nth: 2) kernel console output (not intermixed with test programs): _noprof+0x10/0x10 [ 274.883376][ T8444] ? __pfx_policy_nodemask+0x10/0x10 [ 274.883393][ T8444] ? __pfx__copy_from_iter+0x10/0x10 [ 274.883409][ T8444] ? set_page_refcounted+0xa0/0x1e0 [ 274.883424][ T8444] ? page_copy_sane+0x4e/0x270 [ 274.883437][ T8444] copy_page_from_iter+0xdd/0x170 [ 274.883452][ T8444] tun_get_user+0x1d4b/0x3dd0 [ 274.883465][ T8444] ? tun_get_user+0x6ff/0x3dd0 [ 274.883487][ T8444] ? aa_file_perm+0x50e/0x15e0 [ 274.883499][ T8444] ? __pfx_tun_get_user+0x10/0x10 [ 274.883511][ T8444] ? aa_file_perm+0x192/0x15e0 [ 274.883532][ T8444] ? ref_tracker_alloc+0x35c/0x4c0 [ 274.883546][ T8444] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 274.883566][ T8444] ? tun_get+0x1c/0x2f0 [ 274.883586][ T8444] ? tun_get+0x1c/0x2f0 [ 274.883598][ T8444] ? tun_get+0x1c/0x2f0 [ 274.883613][ T8444] tun_chr_write_iter+0x113/0x200 [ 274.883628][ T8444] vfs_write+0x61d/0xb90 [ 274.883645][ T8444] ? __pfx_vfs_write+0x10/0x10 [ 274.883663][ T8444] ? __fget_files+0x2a/0x420 [ 274.883679][ T8444] ksys_write+0x150/0x270 [ 274.883693][ T8444] ? __pfx_ksys_write+0x10/0x10 [ 274.883712][ T8444] do_syscall_64+0x14d/0xf80 [ 274.883726][ T8444] ? trace_irq_disable+0x3b/0x150 [ 274.883737][ T8444] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.883750][ T8444] ? clear_bhb_loop+0x40/0x90 [ 274.883764][ T8444] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.883776][ T8444] RIP: 0033:0x7f5fb4b5d04e [ 274.883789][ T8444] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 274.883800][ T8444] RSP: 002b:00007f5fb5ab8fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 274.883815][ T8444] RAX: ffffffffffffffda RBX: 00007f5fb5ab96c0 RCX: 00007f5fb4b5d04e [ 274.883830][ T8444] RDX: 0000000000000036 RSI: 0000200000000240 RDI: 00000000000000c8 [ 274.883843][ T8444] RBP: 00007f5fb5ab9090 R08: 0000000000000000 R09: 0000000000000000 [ 274.883856][ T8444] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 274.883867][ T8444] R13: 00007f5fb4e16038 R14: 00007f5fb4e15fa0 R15: 00007f5fb4f3fa48 [ 274.883897][ T8444] [ 275.147851][ T5919] usb 6-1: Using ep0 maxpacket: 8 [ 275.172530][ T5919] usb 6-1: config 162 has an invalid interface number: 79 but max is 1 [ 275.180854][ T5919] usb 6-1: config 162 has an invalid interface number: 183 but max is 1 [ 275.189402][ T5919] usb 6-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 275.199691][ T5919] usb 6-1: config 162 has no interface number 0 [ 275.206294][ T5919] usb 6-1: config 162 has no interface number 1 [ 275.212836][ T5919] usb 6-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 275.225994][ T5919] usb 6-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 275.237059][ T5919] usb 6-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 275.249358][ T5919] usb 6-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 275.262073][ T5919] usb 6-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 275.272328][ T5919] usb 6-1: config 162 interface 79 has no altsetting 0 [ 275.279177][ T5919] usb 6-1: config 162 interface 183 has no altsetting 0 [ 275.299858][ T5919] usb 6-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 275.309085][ T5919] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 275.317129][ T5919] usb 6-1: Product: syz [ 275.321311][ T5919] usb 6-1: Manufacturer: syz [ 275.326269][ T5919] usb 6-1: SerialNumber: syz [ 275.460059][ T29] kauditd_printk_skb: 8 callbacks suppressed [ 275.460082][ T29] audit: type=1326 audit(1774932916.892:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 275.495267][ T29] audit: type=1326 audit(1774932916.892:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 275.578798][ T8441] loop5: detected capacity change from 0 to 16384 [ 275.621433][ T29] audit: type=1326 audit(1774932916.892:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 275.814450][ T8453] loop5: detected capacity change from 16384 to 0 [ 275.836440][ C1] I/O error, dev loop5, sector 11520 op 0x0:(READ) flags 0x80700 phys_seg 5 prio class 2 [ 275.862577][ T5919] pl2303 6-1:162.79: required endpoints missing [ 275.897352][ T29] audit: type=1326 audit(1774932916.892:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 275.936250][ T5919] pl2303 6-1:162.183: required interrupt-in endpoint missing [ 276.067149][ T29] audit: type=1326 audit(1774932916.972:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 276.128528][ T29] audit: type=1326 audit(1774932916.992:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 276.190858][ T5919] usb 6-1: USB disconnect, device number 14 [ 276.199075][ T29] audit: type=1326 audit(1774932916.992:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 276.290904][ T29] audit: type=1326 audit(1774932917.002:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 276.314000][ T29] audit: type=1326 audit(1774932917.002:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 276.411898][ T5905] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 276.496479][ T29] audit: type=1326 audit(1774932917.012:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8445 comm="syz.3.758" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 276.601517][ T5905] usb 4-1: Using ep0 maxpacket: 8 [ 276.609013][ T5905] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 276.629815][ T5905] usb 4-1: config 0 has an invalid interface number: 28 but max is 0 [ 276.654281][ T5905] usb 4-1: config 0 has no interface number 0 [ 276.685278][ T5905] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 276.695122][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 276.978779][ T5905] usb 4-1: Product: syz [ 276.986372][ T5905] usb 4-1: Manufacturer: syz [ 276.997497][ T5905] usb 4-1: SerialNumber: syz [ 277.017975][ T5905] usb 4-1: config 0 descriptor?? [ 277.037214][ T5905] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 277.049681][ T5905] usb 4-1: setting power ON [ 277.058443][ T5905] dvb-usb: bulk message failed: -22 (2/0) [ 277.078125][ T5905] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 277.109950][ T5905] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 277.129160][ T5905] usb 4-1: media controller created [ 277.178542][ T5905] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 277.224801][ T5905] usb 4-1: digital interface selection failed (-22) [ 277.240891][ T8462] syz_tun: entered allmulticast mode [ 277.247249][ T8460] syz_tun: left allmulticast mode [ 277.260229][ T5905] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 277.559784][ T5905] usb 4-1: setting power OFF [ 277.567703][ T5905] dvb-usb: bulk message failed: -22 (2/0) [ 277.578762][ T5905] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 277.588610][ T5905] (NULL device *): no alternate interface [ 277.743561][ T5905] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 277.803589][ T5905] usb 4-1: USB disconnect, device number 43 [ 278.327909][ T5905] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 278.484064][ T5905] usb 4-1: Using ep0 maxpacket: 8 [ 278.500338][ T5905] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 278.531277][ T5905] usb 4-1: config 0 has an invalid interface number: 28 but max is 0 [ 278.543857][ T5905] usb 4-1: config 0 has no interface number 0 [ 278.566506][ T5905] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 278.579675][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 278.640231][ T5905] usb 4-1: Product: syz [ 278.664829][ T5905] usb 4-1: Manufacturer: syz [ 278.683861][ T5905] usb 4-1: SerialNumber: syz [ 278.731613][ T24] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 278.744640][ T5905] usb 4-1: config 0 descriptor?? [ 278.774403][ T5905] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 278.843519][ T5905] usb 4-1: setting power ON [ 278.857552][ T5905] dvb-usb: bulk message failed: -22 (2/0) [ 278.882812][ T5905] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 278.913107][ T5905] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 278.928858][ T5905] usb 4-1: media controller created [ 278.936037][ T24] usb 2-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 278.946616][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 278.962091][ T24] usb 2-1: Product: syz [ 278.966529][ T24] usb 2-1: Manufacturer: syz [ 279.001983][ T24] usb 2-1: SerialNumber: syz [ 279.024682][ T24] r8152-cfgselector 2-1: Unknown version 0x0000 [ 279.031181][ T24] r8152-cfgselector 2-1: config 0 descriptor?? [ 279.047875][ T8500] syz_tun: entered allmulticast mode [ 279.074459][ T5905] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 279.139239][ T8484] syz_tun: left allmulticast mode [ 279.237304][ T5905] usb 4-1: digital interface selection failed (-22) [ 279.293075][ T5905] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 279.318261][ T5905] usb 4-1: setting power OFF [ 279.326661][ T5905] dvb-usb: bulk message failed: -22 (2/0) [ 279.345758][ T5905] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 279.400646][ T24] r8152-cfgselector 2-1: Unknown version 0x0000 [ 279.420957][ T24] r8152-cfgselector 2-1: bad CDC descriptors [ 279.431924][ T5905] (NULL device *): no alternate interface [ 279.517462][ T24] r8152-cfgselector 2-1: USB disconnect, device number 42 [ 279.582115][ T5905] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 279.626935][ T5905] usb 4-1: USB disconnect, device number 44 [ 279.761512][ T5891] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 279.822854][ T8511] FAULT_INJECTION: forcing a failure. [ 279.822854][ T8511] name failslab, interval 1, probability 0, space 0, times 0 [ 279.839663][ T8511] CPU: 1 UID: 0 PID: 8511 Comm: syz.0.777 Not tainted syzkaller #0 PREEMPT(full) [ 279.839691][ T8511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 279.839703][ T8511] Call Trace: [ 279.839711][ T8511] [ 279.839718][ T8511] dump_stack_lvl+0xe8/0x150 [ 279.839753][ T8511] should_fail_ex+0x412/0x560 [ 279.839786][ T8511] should_failslab+0xa8/0x100 [ 279.839812][ T8511] __kmalloc_noprof+0xe8/0x760 [ 279.839835][ T8511] ? do_sys_poll+0x313/0x1120 [ 279.839868][ T8511] do_sys_poll+0x313/0x1120 [ 279.839906][ T8511] ? __lock_acquire+0x6b5/0x2cf0 [ 279.839934][ T8511] ? __pfx_do_sys_poll+0x10/0x10 [ 279.839959][ T8511] ? is_bpf_text_address+0x26/0x2b0 [ 279.840083][ T8511] ? __pfx_timespec64_add_safe+0x10/0x10 [ 279.840120][ T8511] __x64_sys_poll+0x190/0x350 [ 279.840148][ T8511] ? __pfx___x64_sys_poll+0x10/0x10 [ 279.840184][ T8511] do_syscall_64+0x14d/0xf80 [ 279.840209][ T8511] ? trace_irq_disable+0x3b/0x150 [ 279.840226][ T8511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.840245][ T8511] ? clear_bhb_loop+0x40/0x90 [ 279.840296][ T8511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 279.840315][ T8511] RIP: 0033:0x7f5744f9c819 [ 279.840336][ T8511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 279.840352][ T8511] RSP: 002b:00007f5745f43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 [ 279.840375][ T8511] RAX: ffffffffffffffda RBX: 00007f5745215fa0 RCX: 00007f5744f9c819 [ 279.840389][ T8511] RDX: 0000000000000009 RSI: 20000000000000b5 RDI: 0000200000000000 [ 279.840402][ T8511] RBP: 00007f5745f43090 R08: 0000000000000000 R09: 0000000000000000 [ 279.840413][ T8511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 279.840424][ T8511] R13: 00007f5745216038 R14: 00007f5745215fa0 R15: 00007f574533fa48 [ 279.840455][ T8511] [ 280.031560][ T5891] usb 3-1: Using ep0 maxpacket: 8 [ 280.080482][ T5891] usb 3-1: config 162 has an invalid interface number: 79 but max is 1 [ 280.101591][ T5891] usb 3-1: config 162 has an invalid interface number: 183 but max is 1 [ 280.110011][ T5891] usb 3-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 280.193865][ T5891] usb 3-1: config 162 has no interface number 0 [ 280.201821][ T5891] usb 3-1: config 162 has no interface number 1 [ 280.208180][ T5891] usb 3-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 280.288445][ T5891] usb 3-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 280.341491][ T5891] usb 3-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 280.395878][ T5891] usb 3-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 280.426996][ T5891] usb 3-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 280.437353][ T5891] usb 3-1: config 162 interface 79 has no altsetting 0 [ 280.469983][ T29] kauditd_printk_skb: 86 callbacks suppressed [ 280.470003][ T29] audit: type=1326 audit(1774932921.942:374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8524 comm="syz.5.783" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf4199c819 code=0x7ffc0000 [ 280.629625][ T29] audit: type=1326 audit(1774932921.982:375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8524 comm="syz.5.783" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fcf4195d04e code=0x7ffc0000 [ 280.630027][ T5891] usb 3-1: config 162 interface 183 has no altsetting 0 [ 280.834708][ T5891] usb 3-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 280.846259][ T5891] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 280.855199][ T5891] usb 3-1: Product: syz [ 280.859631][ T5891] usb 3-1: Manufacturer: syz [ 280.866012][ T5891] usb 3-1: SerialNumber: syz [ 280.901533][ T29] audit: type=1326 audit(1774932922.002:376): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.1.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4c99c819 code=0x7ffc0000 [ 280.964883][ T29] audit: type=1326 audit(1774932922.002:377): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.1.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=50 compat=0 ip=0x7f1c4c99c819 code=0x7ffc0000 [ 281.100185][ T29] audit: type=1326 audit(1774932922.002:378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.1.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4c99c819 code=0x7ffc0000 [ 281.400359][ T8537] loop5: detected capacity change from 0 to 16384 [ 281.475438][ T29] audit: type=1326 audit(1774932922.002:379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.1.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=288 compat=0 ip=0x7f1c4c99c819 code=0x7ffc0000 [ 281.590082][ T8543] loop5: detected capacity change from 16384 to 0 [ 281.599500][ C0] I/O error, dev loop5, sector 7424 op 0x0:(READ) flags 0x80700 phys_seg 8 prio class 2 [ 281.620914][ T29] audit: type=1326 audit(1774932922.002:380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.1.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4c99c819 code=0x7ffc0000 [ 281.687097][ T5891] pl2303 3-1:162.79: required endpoints missing [ 281.766312][ T5891] pl2303 3-1:162.183: required interrupt-in endpoint missing [ 281.781594][ T29] audit: type=1326 audit(1774932922.002:381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.1.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f1c4c99c819 code=0x7ffc0000 [ 281.836144][ T5891] usb 3-1: USB disconnect, device number 48 [ 281.880770][ T29] audit: type=1326 audit(1774932922.002:382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.1.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4c99c819 code=0x7ffc0000 [ 282.001088][ T29] audit: type=1326 audit(1774932922.002:383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8522 comm="syz.1.784" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1c4c99c819 code=0x7ffc0000 [ 282.222043][ T5919] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 282.273946][ T8561] netlink: 8 bytes leftover after parsing attributes in process `syz.5.794'. [ 282.451640][ T5919] usb 1-1: Using ep0 maxpacket: 16 [ 282.461658][ T5919] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 282.489312][ T5919] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 282.525686][ T5919] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 282.629322][ T5919] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 282.711628][ T5919] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.745640][ T5919] usb 1-1: config 0 descriptor?? [ 283.514701][ T5919] usbhid 1-1:0.0: can't add hid device: -71 [ 283.520998][ T5919] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 283.612818][ T5919] usb 1-1: USB disconnect, device number 41 [ 284.451494][ T5919] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 284.651198][ T5919] usb 1-1: Using ep0 maxpacket: 16 [ 284.664847][ T5919] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 284.789227][ T5919] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 284.845715][ T5919] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 284.867165][ T5919] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 284.876557][ T5919] usb 1-1: Product: syz [ 284.894646][ T5919] usb 1-1: Manufacturer: syz [ 284.906993][ T5919] usb 1-1: SerialNumber: syz [ 285.128503][ T5919] usb 1-1: 0:2 : does not exist [ 285.169451][ T5919] usb 1-1: unit 6 not found! [ 285.268678][ T5919] usb 1-1: USB disconnect, device number 42 [ 285.426509][ T6036] udevd[6036]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 285.941139][ T29] kauditd_printk_skb: 79 callbacks suppressed [ 285.941160][ T29] audit: type=1326 audit(1774932927.412:463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 286.023029][ T29] audit: type=1326 audit(1774932927.412:464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 286.052072][ T5251] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 286.116289][ T29] audit: type=1326 audit(1774932927.452:465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 286.170665][ T29] audit: type=1326 audit(1774932927.452:466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 286.254529][ T29] audit: type=1326 audit(1774932927.452:467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 286.279189][ T5919] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 286.286600][ T5251] usb 6-1: Using ep0 maxpacket: 8 [ 286.310358][ T5251] usb 6-1: config 162 has an invalid interface number: 79 but max is 1 [ 286.319516][ T5251] usb 6-1: config 162 has an invalid interface number: 183 but max is 1 [ 286.348052][ T5251] usb 6-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 286.367035][ T29] audit: type=1326 audit(1774932927.502:468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 286.423342][ T29] audit: type=1326 audit(1774932927.502:469): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 286.431418][ T5251] usb 6-1: config 162 has no interface number 0 [ 286.459607][ T29] audit: type=1326 audit(1774932927.532:470): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 286.482472][ T5919] usb 1-1: Using ep0 maxpacket: 8 [ 286.494218][ T5919] usb 1-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 286.506179][ T5919] usb 1-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 286.514946][ T5919] usb 1-1: Product: syz [ 286.525655][ T5251] usb 6-1: config 162 has no interface number 1 [ 286.525792][ T5919] usb 1-1: Manufacturer: syz [ 286.537701][ T29] audit: type=1326 audit(1774932927.532:471): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 286.560278][ T5891] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 286.570114][ T5251] usb 6-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 286.980456][ T5919] usb 1-1: SerialNumber: syz [ 286.985966][ T5251] usb 6-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 286.987227][ T29] audit: type=1326 audit(1774932927.532:472): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8606 comm="syz.3.808" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 287.020152][ T5919] usb 1-1: config 0 descriptor?? [ 287.037558][ T5919] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 287.064133][ T5251] usb 6-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 287.108181][ T5251] usb 6-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 287.121529][ T5891] usb 2-1: Using ep0 maxpacket: 8 [ 287.133400][ T5891] usb 2-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 287.149573][ T5891] usb 2-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 287.159602][ T5251] usb 6-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 287.168159][ T5891] usb 2-1: Product: syz [ 287.177979][ T5891] usb 2-1: Manufacturer: syz [ 287.190562][ T5891] usb 2-1: SerialNumber: syz [ 287.202844][ T5891] usb 2-1: config 0 descriptor?? [ 287.206499][ T5251] usb 6-1: config 162 interface 79 has no altsetting 0 [ 287.213351][ T5891] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 287.232754][ T5251] usb 6-1: config 162 interface 183 has no altsetting 0 [ 287.238311][ T5919] gspca_zc3xx: reg_w_i err -71 [ 287.253584][ T5251] usb 6-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 287.257846][ T5919] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 287.275870][ T5251] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 287.321449][ T5251] usb 6-1: Product: syz [ 287.325794][ T5251] usb 6-1: Manufacturer: syz [ 287.328138][ T5919] usb 1-1: USB disconnect, device number 43 [ 287.330538][ T5251] usb 6-1: SerialNumber: syz [ 287.597506][ T8603] loop5: detected capacity change from 0 to 16384 [ 287.635699][ T5891] gspca_zc3xx: reg_r err -71 [ 287.640617][ T5891] gspca_zc3xx 2-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 287.668698][ T5891] usb 2-1: USB disconnect, device number 43 [ 287.972287][ T8629] loop5: detected capacity change from 16384 to 0 [ 287.972551][ C0] I/O error, dev loop5, sector 4352 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 288.079767][ T5251] pl2303 6-1:162.79: required endpoints missing [ 288.119960][ T5251] pl2303 6-1:162.183: required interrupt-in endpoint missing [ 288.152004][ T5251] usb 6-1: USB disconnect, device number 15 [ 288.611559][ T5891] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 288.741546][ T5251] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 288.751895][ T5891] usb 2-1: device descriptor read/64, error -71 [ 288.901549][ T24] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 288.909751][ T5251] usb 1-1: Using ep0 maxpacket: 32 [ 288.957468][ T5251] usb 1-1: config 0 has an invalid interface number: 45 but max is 0 [ 288.984142][ T5251] usb 1-1: config 0 has no interface number 0 [ 288.990309][ T5251] usb 1-1: config 0 interface 45 has no altsetting 0 [ 289.009735][ T5891] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 289.061859][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 289.100275][ T5251] usb 1-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=52.85 [ 289.122087][ T24] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 289.141899][ T5891] usb 2-1: device descriptor read/64, error -71 [ 289.174756][ T24] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 289.186155][ T5251] usb 1-1: New USB device strings: Mfr=1, Product=0, SerialNumber=0 [ 289.232358][ T5251] usb 1-1: Manufacturer: syz [ 289.271801][ T5891] usb usb2-port1: attempt power cycle [ 289.284625][ T24] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 289.305329][ T5251] usb 1-1: config 0 descriptor?? [ 289.320828][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.341473][ T24] usb 4-1: Product: syz [ 289.358419][ T24] usb 4-1: Manufacturer: syz [ 289.365451][ T5251] usb_8dev 1-1:0.45 can0: sending command message failed [ 289.373578][ T24] usb 4-1: SerialNumber: syz [ 289.380876][ T5251] usb_8dev 1-1:0.45 can0: can't get firmware version [ 289.463920][ T5251] usb_8dev 1-1:0.45: probe with driver usb_8dev failed with error -22 [ 289.619648][ T24] usb 4-1: 0:2 : does not exist [ 289.634670][ T5891] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 289.655506][ T24] usb 4-1: unit 6 not found! [ 289.708755][ T5891] usb 2-1: device descriptor read/8, error -71 [ 289.971604][ T5891] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 289.992450][ T5891] usb 2-1: device descriptor read/8, error -71 [ 290.160414][ T5891] usb usb2-port1: unable to enumerate USB device [ 290.263539][ T24] usb 4-1: USB disconnect, device number 45 [ 290.349556][ T6036] udevd[6036]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 290.616851][ T8668] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 291.448034][ T5891] usb 1-1: USB disconnect, device number 44 [ 291.491528][ T5905] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 291.651487][ T5905] usb 6-1: Using ep0 maxpacket: 8 [ 291.660273][ T5905] usb 6-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 291.671113][ T5905] usb 6-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 291.689129][ T5905] usb 6-1: Product: syz [ 291.697000][ T5905] usb 6-1: Manufacturer: syz [ 291.706314][ T5905] usb 6-1: SerialNumber: syz [ 291.719447][ T5905] usb 6-1: config 0 descriptor?? [ 291.737574][ T5905] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 291.981663][ T5891] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 292.139656][ T5905] gspca_zc3xx: reg_r err -71 [ 292.147884][ T5251] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 292.161536][ T5891] usb 1-1: Using ep0 maxpacket: 8 [ 292.164034][ T5905] gspca_zc3xx 6-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 292.171962][ T8684] FAULT_INJECTION: forcing a failure. [ 292.171962][ T8684] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 292.182117][ T5905] usb 6-1: USB disconnect, device number 16 [ 292.194981][ T8684] CPU: 0 UID: 0 PID: 8684 Comm: syz.3.833 Not tainted syzkaller #0 PREEMPT(full) [ 292.195013][ T8684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 292.195025][ T8684] Call Trace: [ 292.195034][ T8684] [ 292.195042][ T8684] dump_stack_lvl+0xe8/0x150 [ 292.195077][ T8684] should_fail_ex+0x412/0x560 [ 292.195112][ T8684] _copy_from_user+0x2d/0xb0 [ 292.195137][ T8684] __copy_msghdr+0x3c5/0x5b0 [ 292.195165][ T8684] ___sys_sendmsg+0x213/0x360 [ 292.195194][ T8684] ? __pfx____sys_sendmsg+0x10/0x10 [ 292.195254][ T8684] ? __fget_files+0x2a/0x420 [ 292.195272][ T8684] ? __fget_files+0x3a0/0x420 [ 292.195302][ T8684] __x64_sys_sendmsg+0x1bd/0x2a0 [ 292.195331][ T8684] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 292.195366][ T8684] ? __pfx_ksys_write+0x10/0x10 [ 292.195409][ T8684] do_syscall_64+0x14d/0xf80 [ 292.195433][ T8684] ? trace_irq_disable+0x3b/0x150 [ 292.195450][ T8684] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.195470][ T8684] ? clear_bhb_loop+0x40/0x90 [ 292.195494][ T8684] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.195514][ T8684] RIP: 0033:0x7f495519c819 [ 292.195533][ T8684] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.195550][ T8684] RSP: 002b:00007f4955fa1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 292.195572][ T8684] RAX: ffffffffffffffda RBX: 00007f4955415fa0 RCX: 00007f495519c819 [ 292.195586][ T8684] RDX: 0000000004000004 RSI: 0000200000000100 RDI: 0000000000000003 [ 292.195599][ T8684] RBP: 00007f4955fa1090 R08: 0000000000000000 R09: 0000000000000000 [ 292.195612][ T8684] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 292.195623][ T8684] R13: 00007f4955416038 R14: 00007f4955415fa0 R15: 00007f495553fa48 [ 292.195654][ T8684] [ 292.196745][ T5891] usb 1-1: config 162 has an invalid interface number: 79 but max is 1 [ 292.368049][ T5251] usb 3-1: Using ep0 maxpacket: 8 [ 292.430196][ T5251] usb 3-1: config 4 has an invalid interface number: 244 but max is 0 [ 292.432956][ T8686] netlink: 'syz.3.834': attribute type 10 has an invalid length. [ 292.450382][ T5251] usb 3-1: config 4 has no interface number 0 [ 292.451062][ T8686] bridge0: port 2(bridge_slave_1) entered disabled state [ 292.463337][ T5251] usb 3-1: config 4 interface 244 altsetting 1 endpoint 0x1 has an invalid bInterval 41, changing to 7 [ 292.465134][ T8686] bridge0: port 1(bridge_slave_0) entered disabled state [ 292.475667][ T5251] usb 3-1: config 4 interface 244 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0 [ 292.486654][ T5891] usb 1-1: config 162 has an invalid interface number: 183 but max is 1 [ 292.495184][ T5251] usb 3-1: config 4 interface 244 has no altsetting 0 [ 292.508320][ T8686] bridge0: port 2(bridge_slave_1) entered blocking state [ 292.515652][ T8686] bridge0: port 2(bridge_slave_1) entered forwarding state [ 292.524085][ T8686] bridge0: port 1(bridge_slave_0) entered blocking state [ 292.531434][ T8686] bridge0: port 1(bridge_slave_0) entered forwarding state [ 292.531998][ T5251] usb 3-1: New USB device found, idVendor=05ac, idProduct=fa33, bcdDevice=cb.aa [ 292.540578][ T5891] usb 1-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 292.550168][ T5251] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 292.561235][ T5891] usb 1-1: config 162 has no interface number 0 [ 292.584092][ T8686] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 292.593735][ T5891] usb 1-1: config 162 has no interface number 1 [ 292.599402][ T5251] usb 3-1: Product: syz [ 292.607021][ T5251] usb 3-1: Manufacturer: syz [ 292.617675][ T5251] usb 3-1: SerialNumber: syz [ 292.626693][ T5891] usb 1-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 292.644996][ T5891] usb 1-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 292.676528][ T5891] usb 1-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 292.721477][ T5891] usb 1-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 292.741444][ T5891] usb 1-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 292.771441][ T5891] usb 1-1: config 162 interface 79 has no altsetting 0 [ 292.784077][ T5891] usb 1-1: config 162 interface 183 has no altsetting 0 [ 292.803111][ T5891] usb 1-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 292.831445][ T5891] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 292.851432][ T5891] usb 1-1: Product: syz [ 292.855682][ T5251] ipheth 3-1:4.244: Unable to find endpoints [ 292.857845][ T5891] usb 1-1: Manufacturer: syz [ 292.886163][ T5251] usb 3-1: USB disconnect, device number 49 [ 292.956527][ T5891] usb 1-1: SerialNumber: syz [ 293.194354][ T8677] loop5: detected capacity change from 0 to 16384 [ 293.352439][ T24] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 293.445162][ T8706] binder: BINDER_SET_CONTEXT_MGR already set [ 293.451675][ T8706] binder: 8703:8706 ioctl 4018620d 200000000040 returned -16 [ 293.494548][ T8705] loop5: detected capacity change from 16384 to 0 [ 293.511435][ C0] I/O error, dev loop5, sector 5632 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 293.543785][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 293.576394][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 293.579435][ T5891] pl2303 1-1:162.79: required endpoints missing [ 293.615099][ T24] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 293.619733][ T5891] pl2303 1-1:162.183: required interrupt-in endpoint missing [ 293.646787][ T24] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 293.781134][ T24] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 293.813288][ T24] usb 6-1: config 0 descriptor?? [ 293.835804][ T5891] usb 1-1: USB disconnect, device number 45 [ 294.235234][ T24] hid_parser_main: 28 callbacks suppressed [ 294.235254][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.289141][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.302230][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.339246][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.349642][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.361976][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.404292][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.428255][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.449359][ T24] plantronics 0003:047F:FFFF.0009: unknown main item tag 0x0 [ 294.513698][ T24] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 294.661694][ T5919] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 294.694981][ T24] usb 6-1: USB disconnect, device number 17 [ 294.834357][ T5919] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 294.847777][ T5919] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 294.859575][ T5919] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 294.872960][ T5919] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 294.892877][ T5919] usb 2-1: SerialNumber: syz [ 295.316239][ T5919] usb 2-1: 0:2 : does not exist [ 295.435232][ T5919] usb 2-1: USB disconnect, device number 48 [ 295.973705][ T5891] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 296.281920][ T5891] usb 6-1: Using ep0 maxpacket: 8 [ 296.293129][ T5891] usb 6-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 296.302689][ T5891] usb 6-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 296.310725][ T5891] usb 6-1: Product: syz [ 296.316333][ T5891] usb 6-1: Manufacturer: syz [ 296.321628][ T5891] usb 6-1: SerialNumber: syz [ 296.343515][ T5891] usb 6-1: config 0 descriptor?? [ 296.366528][ T5891] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 296.569846][ T5891] gspca_zc3xx: reg_w_i err -71 [ 296.581033][ T5891] gspca_zc3xx 6-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 296.609103][ T5891] usb 6-1: USB disconnect, device number 18 [ 297.094450][ T5251] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 297.377458][ T5251] usb 4-1: Using ep0 maxpacket: 8 [ 297.397439][ T5251] usb 4-1: config 162 has an invalid interface number: 79 but max is 1 [ 297.414135][ T5251] usb 4-1: config 162 has an invalid interface number: 183 but max is 1 [ 297.477464][ T5251] usb 4-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 297.504461][ T5251] usb 4-1: config 162 has no interface number 0 [ 297.536780][ T5251] usb 4-1: config 162 has no interface number 1 [ 297.558090][ T5251] usb 4-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 297.699303][ T5251] usb 4-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 297.710790][ T5251] usb 4-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 297.723360][ T5251] usb 4-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 297.757873][ T8761] netlink: 40 bytes leftover after parsing attributes in process `syz.2.858'. [ 297.797844][ T5251] usb 4-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 297.844438][ T5251] usb 4-1: config 162 interface 79 has no altsetting 0 [ 297.857860][ T5251] usb 4-1: config 162 interface 183 has no altsetting 0 [ 297.905568][ T5251] usb 4-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 297.918409][ T5251] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.931838][ T5251] usb 4-1: Product: syz [ 297.941623][ T5251] usb 4-1: Manufacturer: syz [ 297.950894][ T5251] usb 4-1: SerialNumber: syz [ 298.111502][ T42] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 298.281564][ T42] usb 3-1: Using ep0 maxpacket: 32 [ 298.290006][ T42] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 298.324243][ T42] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 298.510297][ T42] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 298.523743][ T42] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 298.556559][ T42] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 298.556897][ T8751] loop5: detected capacity change from 0 to 16384 [ 298.572392][ T42] usb 3-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 298.591712][ T42] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.600626][ T42] usb 3-1: Product: syz [ 298.641724][ T42] usb 3-1: Manufacturer: syz [ 298.647224][ T42] usb 3-1: SerialNumber: syz [ 298.701234][ T42] usb 3-1: config 0 descriptor?? [ 298.750695][ T8766] loop5: detected capacity change from 16384 to 0 [ 298.759897][ C1] I/O error, dev loop5, sector 1408 op 0x0:(READ) flags 0x80700 phys_seg 29 prio class 2 [ 298.801801][ T5251] pl2303 4-1:162.79: required endpoints missing [ 298.826077][ T5251] pl2303 4-1:162.183: required interrupt-in endpoint missing [ 298.852297][ T5251] usb 4-1: USB disconnect, device number 46 [ 299.121135][ T42] input input9: Device does not respond to id packet M [ 299.207058][ T8774] FAULT_INJECTION: forcing a failure. [ 299.207058][ T8774] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 299.230688][ T8774] CPU: 1 UID: 0 PID: 8774 Comm: syz.0.862 Not tainted syzkaller #0 PREEMPT(full) [ 299.230720][ T8774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 299.230733][ T8774] Call Trace: [ 299.230741][ T8774] [ 299.230749][ T8774] dump_stack_lvl+0xe8/0x150 [ 299.230788][ T8774] should_fail_ex+0x412/0x560 [ 299.230821][ T8774] _copy_from_user+0x2d/0xb0 [ 299.230845][ T8774] ___sys_sendmsg+0x1c6/0x360 [ 299.230879][ T8774] ? __pfx____sys_sendmsg+0x10/0x10 [ 299.230940][ T8774] ? __fget_files+0x2a/0x420 [ 299.230959][ T8774] ? __fget_files+0x3a0/0x420 [ 299.230987][ T8774] __x64_sys_sendmsg+0x1bd/0x2a0 [ 299.231016][ T8774] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 299.231050][ T8774] ? __pfx_ksys_write+0x10/0x10 [ 299.231086][ T8774] do_syscall_64+0x14d/0xf80 [ 299.231111][ T8774] ? trace_irq_disable+0x3b/0x150 [ 299.231142][ T8774] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.231163][ T8774] ? clear_bhb_loop+0x40/0x90 [ 299.231189][ T8774] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.231208][ T8774] RIP: 0033:0x7f5744f9c819 [ 299.231228][ T8774] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 299.231246][ T8774] RSP: 002b:00007f5745f43028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 299.231266][ T8774] RAX: ffffffffffffffda RBX: 00007f5745215fa0 RCX: 00007f5744f9c819 [ 299.231280][ T8774] RDX: 0000000000000000 RSI: 0000200000001180 RDI: 0000000000000003 [ 299.231292][ T8774] RBP: 00007f5745f43090 R08: 0000000000000000 R09: 0000000000000000 [ 299.231304][ T8774] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 299.231316][ T8774] R13: 00007f5745216038 R14: 00007f5745215fa0 R15: 00007f574533fa48 [ 299.231347][ T8774] [ 299.417169][ T42] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 299.435832][ T42] input input9: Device does not respond to id packet P [ 299.455365][ T42] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 299.461639][ T42] input input9: Device does not respond to id packet B [ 299.477361][ T42] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 299.483643][ T42] input input9: Device does not respond to id packet N [ 299.490857][ T42] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 299.497498][ T42] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 299.504081][ T42] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 299.511129][ T42] iforce 3-1:0.0: usb_submit_urb failed: -71 [ 299.528379][ T42] input: Unknown I-Force Device [%04x:%04x] as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input9 [ 299.567129][ T42] usb 3-1: USB disconnect, device number 50 [ 299.607653][ T29] kauditd_printk_skb: 50 callbacks suppressed [ 299.607674][ T29] audit: type=1326 audit(1774932941.082:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 299.710686][ T29] audit: type=1326 audit(1774932941.082:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 299.801554][ T8786] IPVS: set_ctl: invalid protocol: 1 0.0.0.0:0 [ 299.895496][ T29] audit: type=1326 audit(1774932941.082:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 299.943850][ T8784] FAULT_INJECTION: forcing a failure. [ 299.943850][ T8784] name failslab, interval 1, probability 0, space 0, times 0 [ 299.977441][ T8784] CPU: 1 UID: 0 PID: 8784 Comm: syz.3.867 Not tainted syzkaller #0 PREEMPT(full) [ 299.977472][ T8784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 299.977484][ T8784] Call Trace: [ 299.977492][ T8784] [ 299.977501][ T8784] dump_stack_lvl+0xe8/0x150 [ 299.977536][ T8784] should_fail_ex+0x412/0x560 [ 299.977572][ T8784] should_failslab+0xa8/0x100 [ 299.977600][ T8784] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 299.977622][ T8784] ? __alloc_skb+0x186/0x7d0 [ 299.977643][ T8784] ? __alloc_skb+0x1d0/0x7d0 [ 299.977662][ T8784] ? __local_bh_enable_ip+0xd0/0x130 [ 299.977693][ T8784] __alloc_skb+0x1d0/0x7d0 [ 299.977721][ T8784] netlink_sendmsg+0x5d4/0xb40 [ 299.977752][ T8784] ? __pfx_netlink_sendmsg+0x10/0x10 [ 299.977777][ T8784] ? aa_sock_msg_perm+0xf1/0x1b0 [ 299.977809][ T8784] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 299.977836][ T8784] ____sys_sendmsg+0x972/0x9f0 [ 299.977871][ T8784] ? __pfx_____sys_sendmsg+0x10/0x10 [ 299.977906][ T8784] ? import_iovec+0x73/0xa0 [ 299.977933][ T8784] ___sys_sendmsg+0x2a5/0x360 [ 299.977964][ T8784] ? __pfx____sys_sendmsg+0x10/0x10 [ 299.978025][ T8784] ? __fget_files+0x2a/0x420 [ 299.978043][ T8784] ? __fget_files+0x3a0/0x420 [ 299.978071][ T8784] __x64_sys_sendmsg+0x1bd/0x2a0 [ 299.978099][ T8784] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 299.978142][ T8784] ? __pfx_ksys_write+0x10/0x10 [ 299.978177][ T8784] do_syscall_64+0x14d/0xf80 [ 299.978201][ T8784] ? trace_irq_disable+0x3b/0x150 [ 299.978219][ T8784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.978239][ T8784] ? clear_bhb_loop+0x40/0x90 [ 299.978263][ T8784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.978283][ T8784] RIP: 0033:0x7f495519c819 [ 299.978303][ T8784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 299.978321][ T8784] RSP: 002b:00007f4955fa1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 299.978344][ T8784] RAX: ffffffffffffffda RBX: 00007f4955415fa0 RCX: 00007f495519c819 [ 299.978358][ T8784] RDX: 0000000040004010 RSI: 0000200000000000 RDI: 0000000000000003 [ 299.978371][ T8784] RBP: 00007f4955fa1090 R08: 0000000000000000 R09: 0000000000000000 [ 299.978383][ T8784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 299.978395][ T8784] R13: 00007f4955416038 R14: 00007f4955415fa0 R15: 00007f495553fa48 [ 299.978426][ T8784] [ 299.981580][ T29] audit: type=1326 audit(1774932941.082:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 300.211540][ T24] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 300.212453][ T9] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 300.434139][ T29] audit: type=1326 audit(1774932941.082:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 300.458649][ T29] audit: type=1326 audit(1774932941.082:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 300.499919][ T29] audit: type=1326 audit(1774932941.092:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 300.537550][ T24] usb 2-1: Using ep0 maxpacket: 8 [ 300.550364][ T29] audit: type=1326 audit(1774932941.092:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f495515d04e code=0x7ffc0000 [ 300.580411][ T29] audit: type=1326 audit(1774932941.092:531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 300.604957][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 300.612354][ T29] audit: type=1326 audit(1774932941.092:532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8777 comm="syz.3.864" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f495519c819 code=0x7ffc0000 [ 300.639180][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 300.650265][ T9] usb 1-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 300.659712][ T9] usb 1-1: Product: syz [ 300.664396][ T9] usb 1-1: Manufacturer: syz [ 300.671173][ T9] usb 1-1: SerialNumber: syz [ 300.677334][ T24] usb 2-1: config index 0 descriptor too short (expected 51726, got 36) [ 300.695343][ T24] usb 2-1: config 81 has too many interfaces: 239, using maximum allowed: 32 [ 300.695961][ T9] usb 1-1: config 0 descriptor?? [ 300.711593][ T5251] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 300.724730][ T9] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 300.736624][ T24] usb 2-1: config 81 has an invalid descriptor of length 0, skipping remainder of the config [ 300.779308][ T24] usb 2-1: config 81 has 0 interfaces, different from the descriptor's value: 239 [ 300.800746][ T24] usb 2-1: New USB device found, idVendor=b3f0, idProduct=845d, bcdDevice=94.f8 [ 300.818257][ T24] usb 2-1: New USB device strings: Mfr=68, Product=65, SerialNumber=247 [ 300.836519][ T24] usb 2-1: Product: syz [ 300.844805][ T24] usb 2-1: Manufacturer: syz [ 300.855137][ T24] usb 2-1: SerialNumber: syz [ 300.893060][ T5251] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 300.907736][ T5251] usb 4-1: config 0 has no interfaces? [ 300.917909][ T5251] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 300.938439][ T5251] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 300.965063][ T5251] usb 4-1: config 0 descriptor?? [ 301.011799][ T5919] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 301.130799][ T9] gspca_zc3xx: reg_r err -71 [ 301.135635][ T9] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 301.183057][ T5919] usb 3-1: Using ep0 maxpacket: 8 [ 301.206744][ T5919] usb 3-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 301.237897][ T5919] usb 3-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 301.246558][ T5891] usb 4-1: USB disconnect, device number 47 [ 301.258207][ T9] usb 1-1: USB disconnect, device number 46 [ 301.283169][ T5919] usb 3-1: Product: syz [ 301.295775][ T5919] usb 3-1: Manufacturer: syz [ 301.310664][ T5919] usb 3-1: SerialNumber: syz [ 301.327686][ T5919] usb 3-1: config 0 descriptor?? [ 301.347672][ T5919] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 301.948588][ T5919] gspca_zc3xx: reg_w_i err -71 [ 301.955991][ T5919] gspca_zc3xx 3-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 301.976542][ T5919] usb 3-1: USB disconnect, device number 51 [ 302.101515][ T9] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 302.252147][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 302.264504][ T9] usb 4-1: config 162 has an invalid interface number: 79 but max is 1 [ 302.276142][ T9] usb 4-1: config 162 has an invalid interface number: 183 but max is 1 [ 302.285344][ T9] usb 4-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 302.297669][ T9] usb 4-1: config 162 has no interface number 0 [ 302.304370][ T9] usb 4-1: config 162 has no interface number 1 [ 302.311019][ T9] usb 4-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 302.324492][ T9] usb 4-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 302.352910][ T9] usb 4-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 302.377853][ T9] usb 4-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 302.393554][ T9] usb 4-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 302.415332][ T9] usb 4-1: config 162 interface 79 has no altsetting 0 [ 302.422495][ T9] usb 4-1: config 162 interface 183 has no altsetting 0 [ 302.432287][ T9] usb 4-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 302.441990][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 302.450442][ T9] usb 4-1: Product: syz [ 302.455135][ T9] usb 4-1: Manufacturer: syz [ 302.459891][ T9] usb 4-1: SerialNumber: syz [ 302.725862][ T8803] loop5: detected capacity change from 0 to 16384 [ 302.862413][ T5919] usb 2-1: USB disconnect, device number 49 [ 302.914799][ C0] I/O error, dev loop5, sector 3072 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 302.925687][ C0] I/O error, dev loop5, sector 3328 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 302.937043][ T8814] loop5: detected capacity change from 16384 to 0 [ 302.940147][ T8819] FAULT_INJECTION: forcing a failure. [ 302.940147][ T8819] name failslab, interval 1, probability 0, space 0, times 0 [ 303.029136][ T8819] CPU: 1 UID: 0 PID: 8819 Comm: syz.2.880 Not tainted syzkaller #0 PREEMPT(full) [ 303.029167][ T8819] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 303.029178][ T8819] Call Trace: [ 303.029186][ T8819] [ 303.029194][ T8819] dump_stack_lvl+0xe8/0x150 [ 303.029229][ T8819] should_fail_ex+0x412/0x560 [ 303.029264][ T8819] should_failslab+0xa8/0x100 [ 303.029291][ T8819] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 303.029313][ T8819] ? __alloc_skb+0x186/0x7d0 [ 303.029335][ T8819] ? __alloc_skb+0x1d0/0x7d0 [ 303.029353][ T8819] ? __local_bh_enable_ip+0xd0/0x130 [ 303.029382][ T8819] __alloc_skb+0x1d0/0x7d0 [ 303.029401][ T8819] ? __raw_spin_lock_init+0x45/0x100 [ 303.029424][ T8819] audit_log_start+0x416/0xa20 [ 303.029454][ T8819] ? __pfx_audit_log_start+0x10/0x10 [ 303.029480][ T8819] ? get_pid_task+0x20/0x1f0 [ 303.029499][ T8819] ? get_pid_task+0x20/0x1f0 [ 303.029516][ T8819] ? get_pid_task+0x20/0x1f0 [ 303.029543][ T8819] audit_seccomp+0x63/0x190 [ 303.029564][ T8819] ? clear_bhb_loop+0x40/0x90 [ 303.029584][ T8819] ? clear_bhb_loop+0xe/0x90 [ 303.029608][ T8819] __seccomp_filter+0xd48/0x1ef0 [ 303.029642][ T8819] ? __pfx___seccomp_filter+0x10/0x10 [ 303.029667][ T8819] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 303.029698][ T8819] ? __fget_files+0x3a0/0x420 [ 303.029724][ T8819] ? fput+0xa0/0xd0 [ 303.029766][ T8819] ? __secure_computing+0xe1/0x2a0 [ 303.029792][ T8819] do_syscall_64+0xf4/0xf80 [ 303.029816][ T8819] ? trace_irq_disable+0x3b/0x150 [ 303.029833][ T8819] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.029852][ T8819] ? clear_bhb_loop+0x40/0x90 [ 303.029875][ T8819] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 303.029895][ T8819] RIP: 0033:0x7f5fb4b9c819 [ 303.029910][ T9] pl2303 4-1:162.79: required endpoints missing [ 303.029915][ T8819] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 303.029933][ T8819] RSP: 002b:00007f5fb5ab9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000062 [ 303.029955][ T8819] RAX: ffffffffffffffda RBX: 00007f5fb4e15fa0 RCX: 00007f5fb4b9c819 [ 303.029968][ T8819] RDX: 0000000000000000 RSI: 0000200000000dc0 RDI: 0000000000000001 [ 303.029979][ T8819] RBP: 00007f5fb5ab9090 R08: 0000000000000000 R09: 0000000000000000 [ 303.029990][ T8819] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 303.030001][ T8819] R13: 00007f5fb4e16038 R14: 00007f5fb4e15fa0 R15: 00007f5fb4f3fa48 [ 303.030029][ T8819] [ 303.491297][ T9] pl2303 4-1:162.183: required interrupt-in endpoint missing [ 303.508119][ T9] usb 4-1: USB disconnect, device number 48 [ 303.876304][ T5919] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 303.994381][ T5251] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 304.039059][ T5919] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 304.049552][ T5919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 304.057834][ T5919] usb 3-1: Product: syz [ 304.082993][ T5919] usb 3-1: Manufacturer: syz [ 304.088846][ T5919] usb 3-1: SerialNumber: syz [ 304.122645][ T5919] usb 3-1: config 0 descriptor?? [ 304.306873][ T8837] tipc: Enabled bearer , priority 0 [ 304.345418][ T5251] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 304.356034][ T5251] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 304.369641][ T5251] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 304.370082][ T8836] tipc: Disabling bearer [ 304.381054][ T5251] usb 6-1: config 0 descriptor?? [ 304.560938][ T8828] bond0: (slave bond_slave_1): Releasing backup interface [ 304.678607][ T5251] ath6kl: Failed to submit usb control message: -71 [ 304.696019][ T5251] ath6kl: unable to send the bmi data to the device: -71 [ 304.711647][ T5251] ath6kl: Unable to send get target info: -71 [ 304.735443][ T5251] ath6kl: Failed to init ath6kl core: -71 [ 304.765068][ T5251] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 304.808692][ T5251] usb 6-1: USB disconnect, device number 19 [ 304.991647][ T9] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 305.021483][ T24] usb 4-1: new full-speed USB device number 49 using dummy_hcd [ 305.141477][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 305.150334][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 305.161564][ T9] usb 1-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 305.169822][ T9] usb 1-1: Product: syz [ 305.174428][ T9] usb 1-1: Manufacturer: syz [ 305.179080][ T9] usb 1-1: SerialNumber: syz [ 305.186985][ T9] usb 1-1: config 0 descriptor?? [ 305.193636][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 305.198334][ T9] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 305.212673][ T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFC, changing to 0x8C [ 305.229890][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 305.241323][ T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 305.262044][ T24] usb 4-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 305.279672][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 305.288140][ T24] usb 4-1: Product: syz [ 305.293026][ T24] usb 4-1: Manufacturer: syz [ 305.297822][ T24] usb 4-1: SerialNumber: syz [ 305.306296][ T24] usb 4-1: config 0 descriptor?? [ 305.311259][ T8850] FAULT_INJECTION: forcing a failure. [ 305.311259][ T8850] name failslab, interval 1, probability 0, space 0, times 0 [ 305.311299][ T8850] CPU: 0 UID: 0 PID: 8850 Comm: syz.5.890 Not tainted syzkaller #0 PREEMPT(full) [ 305.311321][ T8850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 305.311333][ T8850] Call Trace: [ 305.311341][ T8850] [ 305.311348][ T8850] dump_stack_lvl+0xe8/0x150 [ 305.311379][ T8850] should_fail_ex+0x412/0x560 [ 305.311411][ T8850] should_failslab+0xa8/0x100 [ 305.311437][ T8850] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 305.311457][ T8850] ? __alloc_skb+0x186/0x7d0 [ 305.311477][ T8850] ? __alloc_skb+0x1d0/0x7d0 [ 305.311494][ T8850] ? __local_bh_enable_ip+0xd0/0x130 [ 305.311521][ T8850] __alloc_skb+0x1d0/0x7d0 [ 305.311540][ T8850] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 305.311566][ T8850] netlink_sendmsg+0x5d4/0xb40 [ 305.311594][ T8850] ? __pfx_netlink_sendmsg+0x10/0x10 [ 305.311616][ T8850] ? aa_sock_msg_perm+0xf1/0x1b0 [ 305.311645][ T8850] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 305.311668][ T8850] ____sys_sendmsg+0x972/0x9f0 [ 305.311699][ T8850] ? __pfx_____sys_sendmsg+0x10/0x10 [ 305.311730][ T8850] ? import_iovec+0x73/0xa0 [ 305.311754][ T8850] ___sys_sendmsg+0x2a5/0x360 [ 305.311782][ T8850] ? __pfx____sys_sendmsg+0x10/0x10 [ 305.311836][ T8850] ? __fget_files+0x2a/0x420 [ 305.311851][ T8850] ? __fget_files+0x3a0/0x420 [ 305.311876][ T8850] __x64_sys_sendmsg+0x1bd/0x2a0 [ 305.311901][ T8850] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 305.311933][ T8850] ? __pfx_ksys_write+0x10/0x10 [ 305.311964][ T8850] do_syscall_64+0x14d/0xf80 [ 305.311986][ T8850] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.312004][ T8850] ? clear_bhb_loop+0x40/0x90 [ 305.312027][ T8850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 305.312045][ T8850] RIP: 0033:0x7fcf4199c819 [ 305.312071][ T8850] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 305.312087][ T8850] RSP: 002b:00007fcf42868028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 305.312107][ T8850] RAX: ffffffffffffffda RBX: 00007fcf41c15fa0 RCX: 00007fcf4199c819 [ 305.312121][ T8850] RDX: 0000000004000800 RSI: 0000200000000000 RDI: 0000000000000003 [ 305.312133][ T8850] RBP: 00007fcf42868090 R08: 0000000000000000 R09: 0000000000000000 [ 305.312144][ T8850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 305.312155][ T8850] R13: 00007fcf41c16038 R14: 00007fcf41c15fa0 R15: 00007fcf41d3fa48 [ 305.312183][ T8850] [ 305.432139][ T5919] usb 3-1: ATUSB: AT86RF230 version 224 [ 305.437662][ T24] xbox_remote_probe: Unexpected endpoint_in [ 305.644231][ T5919] usb 3-1: Firmware version (0.0) predates our first public release. [ 305.644673][ T24] usb 4-1: USB disconnect, device number 49 [ 305.658683][ T5919] usb 3-1: Please update to version 0.2 or newer [ 305.746818][ T5919] usb 3-1: USB disconnect, device number 52 [ 305.798879][ T9] gspca_zc3xx: reg_w_i err -71 [ 305.804555][ T9] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 305.818325][ T9] usb 1-1: USB disconnect, device number 47 [ 305.833977][ T5251] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 305.942694][ T8858] netlink: 8 bytes leftover after parsing attributes in process `syz.1.893'. [ 305.952241][ T8858] netlink: 24 bytes leftover after parsing attributes in process `syz.1.893'. [ 305.995233][ T5251] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 306.010467][ T5251] usb 6-1: string descriptor 0 read error: -22 [ 306.018874][ T5251] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 306.033158][ T5251] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.053997][ T5251] cdc_ether 6-1:1.0: invalid descriptor buffer length [ 306.077825][ T5251] usb 6-1: bad CDC descriptors [ 306.255970][ T5905] usb 6-1: USB disconnect, device number 20 [ 306.257937][ T8865] tipc: Started in network mode [ 306.272898][ T8865] tipc: Node identity fa5793b5d9ac, cluster identity 4711 [ 306.284083][ T8865] tipc: Enabled bearer , priority 0 [ 306.306004][ T8863] tipc: Disabling bearer [ 306.331678][ T5251] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 306.501695][ T5251] usb 2-1: Using ep0 maxpacket: 8 [ 306.509836][ T5251] usb 2-1: config 162 has an invalid interface number: 79 but max is 1 [ 306.518717][ T5251] usb 2-1: config 162 has an invalid interface number: 183 but max is 1 [ 306.537416][ T5251] usb 2-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 306.558274][ T5251] usb 2-1: config 162 has no interface number 0 [ 306.572266][ T5251] usb 2-1: config 162 has no interface number 1 [ 306.578634][ T5251] usb 2-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 306.592966][ T5251] usb 2-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 306.606897][ T5251] usb 2-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 306.619422][ T5251] usb 2-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 306.630083][ T5251] usb 2-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 306.640493][ T5251] usb 2-1: config 162 interface 79 has no altsetting 0 [ 306.647582][ T5251] usb 2-1: config 162 interface 183 has no altsetting 0 [ 306.657628][ T5251] usb 2-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 306.667584][ T5251] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 306.676444][ T5251] usb 2-1: Product: syz [ 306.685220][ T5251] usb 2-1: Manufacturer: syz [ 306.690383][ T5251] usb 2-1: SerialNumber: syz [ 306.741483][ T5919] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 306.903158][ T5919] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 306.917451][ T8862] loop5: detected capacity change from 0 to 16384 [ 306.927473][ T5919] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 306.947535][ T5919] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 306.978483][ T5919] usb 3-1: config 0 descriptor?? [ 307.090614][ T8884] loop5: detected capacity change from 16384 to 0 [ 307.090768][ C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 307.118489][ C1] I/O error, dev loop5, sector 2816 op 0x0:(READ) flags 0x80700 phys_seg 8 prio class 2 [ 307.144144][ T5251] pl2303 2-1:162.79: required endpoints missing [ 307.181198][ T5251] pl2303 2-1:162.183: required interrupt-in endpoint missing [ 307.233194][ T5919] ath6kl: Failed to submit usb control message: -71 [ 307.234037][ T5251] usb 2-1: USB disconnect, device number 50 [ 307.257522][ T5919] ath6kl: unable to send the bmi data to the device: -71 [ 307.278985][ T5919] ath6kl: Unable to send get target info: -71 [ 307.294529][ T5919] ath6kl: Failed to init ath6kl core: -71 [ 307.330180][ T5919] ath6kl_usb 3-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 307.366227][ T5919] usb 3-1: USB disconnect, device number 53 [ 307.517220][ T8892] FAULT_INJECTION: forcing a failure. [ 307.517220][ T8892] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 307.545134][ T8892] CPU: 0 UID: 0 PID: 8892 Comm: syz.3.904 Not tainted syzkaller #0 PREEMPT(full) [ 307.545165][ T8892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 307.545178][ T8892] Call Trace: [ 307.545187][ T8892] [ 307.545196][ T8892] dump_stack_lvl+0xe8/0x150 [ 307.545230][ T8892] should_fail_ex+0x412/0x560 [ 307.545266][ T8892] _copy_to_user+0x31/0xb0 [ 307.545292][ T8892] simple_read_from_buffer+0xe1/0x170 [ 307.545328][ T8892] proc_fail_nth_read+0x1bb/0x230 [ 307.545361][ T8892] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 307.545394][ T8892] ? rw_verify_area+0x2a6/0x4d0 [ 307.545417][ T8892] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 307.545448][ T8892] vfs_read+0x20c/0xa70 [ 307.545469][ T8892] ? fdget_pos+0x246/0x320 [ 307.545493][ T8892] ? __pfx___mutex_lock+0x10/0x10 [ 307.545521][ T8892] ? __pfx_vfs_read+0x10/0x10 [ 307.545546][ T8892] ? __fget_files+0x2a/0x420 [ 307.545568][ T8892] ? __fget_files+0x3a0/0x420 [ 307.545585][ T8892] ? __fget_files+0x2a/0x420 [ 307.545613][ T8892] ksys_read+0x150/0x270 [ 307.545638][ T8892] ? __pfx_ksys_read+0x10/0x10 [ 307.545673][ T8892] do_syscall_64+0x14d/0xf80 [ 307.545698][ T8892] ? trace_irq_disable+0x3b/0x150 [ 307.545716][ T8892] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.545736][ T8892] ? clear_bhb_loop+0x40/0x90 [ 307.545762][ T8892] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 307.545782][ T8892] RIP: 0033:0x7f495515d04e [ 307.545802][ T8892] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 307.545819][ T8892] RSP: 002b:00007f4955f7ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 307.545842][ T8892] RAX: ffffffffffffffda RBX: 00007f4955f806c0 RCX: 00007f495515d04e [ 307.545857][ T8892] RDX: 000000000000000f RSI: 00007f4955f800a0 RDI: 0000000000000006 [ 307.545870][ T8892] RBP: 00007f4955f80090 R08: 0000000000000000 R09: 0000000000000000 [ 307.545883][ T8892] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 307.545895][ T8892] R13: 00007f4955416128 R14: 00007f4955416090 R15: 00007f495553fa48 [ 307.545928][ T8892] [ 308.059245][ T8899] netlink: 24 bytes leftover after parsing attributes in process `syz.3.906'. [ 308.097853][ T8899] netlink: 'syz.3.906': attribute type 1 has an invalid length. [ 308.125275][ T8903] binder: 8896:8903 ioctl c0306201 0 returned -14 [ 308.283630][ T9] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 308.371545][ T5919] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 308.421501][ T5905] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 308.448971][ T9] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 308.458714][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 308.467037][ T9] usb 6-1: Product: syz [ 308.471520][ T9] usb 6-1: Manufacturer: syz [ 308.476146][ T9] usb 6-1: SerialNumber: syz [ 308.483328][ T9] usb 6-1: config 0 descriptor?? [ 308.521493][ T5919] usb 4-1: Using ep0 maxpacket: 16 [ 308.528576][ T5919] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 308.543438][ T5919] usb 4-1: config 0 interface 0 has no altsetting 0 [ 308.550120][ T5919] usb 4-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 308.559500][ T5919] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 308.570487][ T5919] usb 4-1: config 0 descriptor?? [ 308.601492][ T5905] usb 1-1: Using ep0 maxpacket: 8 [ 308.611037][ T5905] usb 1-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 308.626810][ T5905] usb 1-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 308.635942][ T5905] usb 1-1: Product: syz [ 308.640283][ T5905] usb 1-1: Manufacturer: syz [ 308.645314][ T5905] usb 1-1: SerialNumber: syz [ 308.653262][ T5905] usb 1-1: config 0 descriptor?? [ 308.668508][ T5905] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 308.705336][ T8901] bond0: (slave bond_slave_1): Releasing backup interface [ 308.760869][ T8908] tipc: Started in network mode [ 308.766992][ T8908] tipc: Node identity be83bacb89be, cluster identity 4711 [ 308.781324][ T8908] tipc: Enabled bearer , priority 0 [ 308.796509][ T8907] tipc: Disabling bearer [ 309.007094][ T5919] nzxt-smart2 0003:1E71:2009.000A: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.3-1/input0 [ 309.269960][ T5905] gspca_zc3xx: reg_w_i err -71 [ 309.273998][ T8899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 309.278005][ T5905] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 309.292265][ T8899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 309.326842][ T5905] usb 1-1: USB disconnect, device number 48 [ 309.344365][ T8923] mmap: syz.2.915 (8923) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 309.537129][ T9] usb 6-1: ATUSB: AT86RF230 version 224 [ 309.586721][ T5251] usb 4-1: USB disconnect, device number 50 [ 309.643371][ T5919] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 309.743846][ T9] usb 6-1: Firmware version (0.0) predates our first public release. [ 309.754844][ T9] usb 6-1: Please update to version 0.2 or newer [ 309.796458][ T9] usb 6-1: USB disconnect, device number 21 [ 309.806079][ T5919] usb 2-1: Using ep0 maxpacket: 8 [ 309.827954][ T5919] usb 2-1: config 162 has an invalid interface number: 79 but max is 1 [ 309.846749][ T5919] usb 2-1: config 162 has an invalid interface number: 183 but max is 1 [ 309.857494][ T5919] usb 2-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 309.870715][ T5919] usb 2-1: config 162 has no interface number 0 [ 309.877520][ T5919] usb 2-1: config 162 has no interface number 1 [ 309.885306][ T5919] usb 2-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 309.898881][ T5919] usb 2-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 309.929023][ T5919] usb 2-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 309.953982][ T5919] usb 2-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 309.969736][ T5919] usb 2-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 309.981894][ T5919] usb 2-1: config 162 interface 79 has no altsetting 0 [ 309.988828][ T5919] usb 2-1: config 162 interface 183 has no altsetting 0 [ 309.998225][ T5919] usb 2-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 310.007924][ T5919] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 310.016254][ T5919] usb 2-1: Product: syz [ 310.020697][ T5919] usb 2-1: Manufacturer: syz [ 310.025394][ T5919] usb 2-1: SerialNumber: syz [ 310.191501][ T5251] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 310.259121][ T8926] loop5: detected capacity change from 0 to 16384 [ 310.442108][ T5251] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 310.455942][ T5251] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 310.471746][ T8939] loop5: detected capacity change from 16384 to 0 [ 310.475582][ C1] I/O error, dev loop5, sector 3328 op 0x0:(READ) flags 0x80700 phys_seg 29 prio class 2 [ 310.489707][ C0] I/O error, dev loop5, sector 15648 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 310.490812][ T5251] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 310.517223][ T5919] pl2303 2-1:162.79: required endpoints missing [ 310.618113][ T5251] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 310.626530][ T5251] usb 1-1: SerialNumber: syz [ 310.651196][ T5919] pl2303 2-1:162.183: required interrupt-in endpoint missing [ 310.667056][ T5919] usb 2-1: USB disconnect, device number 51 [ 310.742270][ T5905] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 310.858835][ T5251] usb 1-1: 0:2 : does not exist [ 310.862471][ T9] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 310.891629][ T5905] usb 6-1: Using ep0 maxpacket: 32 [ 310.957387][ T5251] usb 1-1: USB disconnect, device number 49 [ 310.993686][ T6036] udevd[6036]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 311.038716][ T5905] usb 6-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 311.066939][ T5905] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 311.101469][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 311.113075][ T5905] usb 6-1: Product: syz [ 311.127599][ T5905] usb 6-1: Manufacturer: syz [ 311.182956][ T9] usb 3-1: config 0 has no interfaces? [ 311.193059][ T9] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 311.205013][ T9] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 311.211502][ T5905] usb 6-1: SerialNumber: syz [ 311.221017][ T9] usb 3-1: Manufacturer: syz [ 311.260442][ T9] usb 3-1: config 0 descriptor?? [ 311.281939][ T5905] usb 6-1: config 0 descriptor?? [ 311.306749][ T5905] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 311.318722][ T8951] tipc: Started in network mode [ 311.323716][ T8951] tipc: Node identity 36a817d445de, cluster identity 4711 [ 311.331222][ T8951] tipc: Enabled bearer , priority 0 [ 311.341019][ T8950] tipc: Disabling bearer [ 311.508351][ T8944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 311.544243][ T8944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 311.555724][ T8945] netlink: 'syz.2.919': attribute type 1 has an invalid length. [ 311.570702][ T8944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 311.624612][ T8945] 8021q: adding VLAN 0 to HW filter on device bond0 [ 311.654949][ T8946] bond0: (slave gretap1): making interface the new active one [ 311.671570][ T8946] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 311.715378][ T8945] vlan0: entered allmulticast mode [ 311.724312][ T8945] bond0: entered allmulticast mode [ 311.729923][ T8945] gretap1: entered allmulticast mode [ 311.735699][ T9] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 311.755782][ T8945] bond0: (slave vlan0): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 311.782031][ T8944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 311.857824][ T5905] gspca_topro: reg_w err -110 [ 311.892710][ T5905] gspca_topro: Sensor soi763a [ 312.062191][ T9] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 312.071272][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 312.188789][ T9] usb 4-1: Product: syz [ 312.206522][ T9] usb 4-1: Manufacturer: syz [ 312.232396][ T9] usb 4-1: SerialNumber: syz [ 312.247594][ T9] usb 4-1: config 0 descriptor?? [ 312.412726][ T42] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 312.501202][ T8954] bond0: (slave bond_slave_1): Releasing backup interface [ 312.571680][ T42] usb 2-1: Using ep0 maxpacket: 16 [ 312.601389][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 312.849247][ T42] usb 2-1: config 0 has no interfaces? [ 312.859135][ T42] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 312.869734][ T42] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 312.878189][ T42] usb 2-1: Manufacturer: syz [ 312.889055][ T42] usb 2-1: config 0 descriptor?? [ 312.897380][ T8970] ptrace attach of "./syz-executor exec"[7608] was attempted by ""[8970] [ 313.217848][ T8958] netlink: 'syz.1.921': attribute type 1 has an invalid length. [ 313.310306][ T8958] 8021q: adding VLAN 0 to HW filter on device bond0 [ 313.363544][ T8959] bond0: (slave gretap1): making interface the new active one [ 313.377810][ T8959] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 313.629767][ T9] usb 4-1: ATUSB: AT86RF230 version 226 [ 313.793231][ T5892] usb 3-1: USB disconnect, device number 54 [ 313.830765][ T9] usb 4-1: Firmware version (0.0) predates our first public release. [ 313.844547][ T9] usb 4-1: Please update to version 0.2 or newer [ 313.988689][ T86] bond0 (unregistering): (slave gretap1): Releasing active interface [ 314.005519][ T86] gretap1 (unregistering): left allmulticast mode [ 314.025213][ T5892] usb 6-1: USB disconnect, device number 22 [ 314.065978][ T86] bond0 (unregistering): Released all slaves [ 314.247965][ T9] usb 4-1: USB disconnect, device number 51 [ 314.648319][ T8985] tmpfs: Unknown parameter 'i1t!' [ 314.695069][ T8985] delete_channel: no stack [ 314.715882][ T5905] usb 2-1: USB disconnect, device number 52 [ 314.854896][ T9] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 314.947536][ T13] bond0 (unregistering): (slave gretap1): Releasing active interface [ 315.027781][ T13] bond0 (unregistering): Released all slaves [ 315.051526][ T9] usb 4-1: Using ep0 maxpacket: 8 [ 315.061073][ T9] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 315.069787][ T9] usb 4-1: config 0 has an invalid interface number: 28 but max is 0 [ 315.082942][ T9] usb 4-1: config 0 has no interface number 0 [ 315.095579][ T9] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 315.099796][ T5905] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 315.118077][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.136544][ T8994] syzkaller0: entered promiscuous mode [ 315.143536][ T8994] syzkaller0: entered allmulticast mode [ 315.162891][ T9] usb 4-1: Product: syz [ 315.167533][ T9] usb 4-1: Manufacturer: syz [ 315.181914][ T9] usb 4-1: SerialNumber: syz [ 315.205329][ T9] usb 4-1: config 0 descriptor?? [ 315.227352][ T9] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 315.246481][ T9] usb 4-1: setting power ON [ 315.253844][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 315.264439][ T9] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 315.279656][ T9] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 315.282550][ T5905] usb 2-1: Using ep0 maxpacket: 8 [ 315.295993][ T5905] usb 2-1: config 162 has an invalid interface number: 79 but max is 1 [ 315.308550][ T5905] usb 2-1: config 162 has an invalid interface number: 183 but max is 1 [ 315.317521][ T5905] usb 2-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 315.320811][ T9] usb 4-1: media controller created [ 315.333769][ T5905] usb 2-1: config 162 has no interface number 0 [ 315.340932][ T5905] usb 2-1: config 162 has no interface number 1 [ 315.348881][ T5905] usb 2-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 315.368100][ T29] kauditd_printk_skb: 77 callbacks suppressed [ 315.368120][ T29] audit: type=1326 audit(1774932956.842:608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8983 comm="syz.5.929" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fcf4199c819 code=0x0 [ 315.399580][ T5905] usb 2-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 315.412212][ T5905] usb 2-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 315.417369][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 315.430928][ T5905] usb 2-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 315.454751][ T5905] usb 2-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 315.459481][ T9] usb 4-1: digital interface selection failed (-22) [ 315.477659][ T9] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 315.479050][ T5905] usb 2-1: config 162 interface 79 has no altsetting 0 [ 315.489311][ T9] usb 4-1: setting power OFF [ 315.504888][ T9002] syz_tun: entered allmulticast mode [ 315.505950][ T9] dvb-usb: bulk message failed: -22 (2/0) [ 315.511918][ T9002] syz_tun: left allmulticast mode [ 315.516755][ T9] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 315.533951][ T9] (NULL device *): no alternate interface [ 315.611462][ T5905] usb 2-1: config 162 interface 183 has no altsetting 0 [ 315.618058][ T9] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 315.767351][ T5905] usb 2-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 315.783575][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 315.798600][ T9] usb 4-1: USB disconnect, device number 52 [ 315.836363][ T5905] usb 2-1: Product: syz [ 315.857681][ T5905] usb 2-1: Manufacturer: syz [ 315.873030][ T5905] usb 2-1: SerialNumber: syz [ 316.171022][ T8989] loop5: detected capacity change from 0 to 16384 [ 316.431406][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 316.632594][ T9013] loop5: detected capacity change from 16384 to 0 [ 316.639372][ C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 316.679819][ C1] I/O error, dev loop5, sector 6912 op 0x0:(READ) flags 0x80700 phys_seg 2 prio class 2 [ 316.755029][ T5905] pl2303 2-1:162.79: required endpoints missing [ 316.789139][ T5905] pl2303 2-1:162.183: required interrupt-in endpoint missing [ 316.869732][ T5905] usb 2-1: USB disconnect, device number 53 [ 317.211562][ T9] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 317.371309][ T9] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 317.387616][ T9] usb 4-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 317.404780][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 317.421865][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.466801][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.540213][ T9] usb 4-1: Product: syz [ 317.559943][ T9] usb 4-1: Manufacturer: syz [ 317.635465][ T9] usb 4-1: SerialNumber: syz [ 317.668193][ T9] usb 4-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 317.786037][ T9035] tmpfs: Unknown parameter 'i1t!' [ 317.933787][ T9035] delete_channel: no stack [ 318.069210][ T9038] syzkaller0: entered promiscuous mode [ 318.075330][ T9038] syzkaller0: entered allmulticast mode [ 318.088300][ T9] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 318.113027][ T9] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 318.177943][ T9] usb 4-1: media controller created [ 318.218944][ T9] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 319.087859][ T9] usb 4-1: USB disconnect, device number 53 [ 319.581466][ T5251] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 319.751474][ T5251] usb 1-1: Using ep0 maxpacket: 8 [ 319.759614][ T5251] usb 1-1: config 162 has an invalid interface number: 79 but max is 1 [ 319.975029][ T5251] usb 1-1: config 162 has an invalid interface number: 183 but max is 1 [ 319.986690][ T5251] usb 1-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 319.997249][ T5251] usb 1-1: config 162 has no interface number 0 [ 320.003912][ T5251] usb 1-1: config 162 has no interface number 1 [ 320.010337][ T5251] usb 1-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 320.024779][ T5251] usb 1-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 320.042376][ T5919] usb 4-1: new full-speed USB device number 54 using dummy_hcd [ 320.082402][ T5251] usb 1-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 320.227048][ T5251] usb 1-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 320.307055][ T5251] usb 1-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 320.386865][ T5251] usb 1-1: config 162 interface 79 has no altsetting 0 [ 320.425659][ T5251] usb 1-1: config 162 interface 183 has no altsetting 0 [ 320.454920][ T5251] usb 1-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 320.508331][ T5251] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 320.540483][ T5251] usb 1-1: Product: syz [ 320.623558][ T5251] usb 1-1: Manufacturer: syz [ 320.641311][ T5251] usb 1-1: SerialNumber: syz [ 320.759668][ T5919] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 320.771413][ T5919] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 320.782900][ T5919] usb 4-1: config 0 interface 0 has no altsetting 0 [ 320.801479][ T5919] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 320.810593][ T5919] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 320.818855][ T5919] usb 4-1: Product: syz [ 320.858911][ T9078] tmpfs: Unknown parameter 'i1t!' [ 320.867274][ T5919] usb 4-1: Manufacturer: syz [ 320.872019][ T5919] usb 4-1: SerialNumber: syz [ 320.891875][ T5919] usb 4-1: config 0 descriptor?? [ 320.913584][ T5919] usb 4-1: selecting invalid altsetting 0 [ 320.966099][ T9065] loop5: detected capacity change from 0 to 16384 [ 321.139023][ T9078] delete_channel: no stack [ 321.165212][ T9080] loop5: detected capacity change from 16384 to 0 [ 321.170490][ T9069] snd-usb-audio 4-1:0.0: Runtime PM usage count underflow! [ 321.190708][ C0] I/O error, dev loop5, sector 2304 op 0x0:(READ) flags 0x80700 phys_seg 31 prio class 2 [ 321.228174][ T5919] usb 4-1: USB disconnect, device number 54 [ 321.306335][ T5251] pl2303 1-1:162.79: required endpoints missing [ 321.308197][ T6150] udevd[6150]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 321.318062][ T5251] pl2303 1-1:162.183: required interrupt-in endpoint missing [ 321.448763][ T5251] usb 1-1: USB disconnect, device number 50 [ 321.668608][ T9089] FAULT_INJECTION: forcing a failure. [ 321.668608][ T9089] name failslab, interval 1, probability 0, space 0, times 0 [ 321.704254][ T9089] CPU: 1 UID: 0 PID: 9089 Comm: syz.1.958 Not tainted syzkaller #0 PREEMPT(full) [ 321.704283][ T9089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 321.704296][ T9089] Call Trace: [ 321.704306][ T9089] [ 321.704314][ T9089] dump_stack_lvl+0xe8/0x150 [ 321.704349][ T9089] should_fail_ex+0x412/0x560 [ 321.704384][ T9089] should_failslab+0xa8/0x100 [ 321.704413][ T9089] __kmalloc_cache_noprof+0x88/0x660 [ 321.704438][ T9089] ? tcp_sendmsg_fastopen+0x1de/0x5e0 [ 321.704472][ T9089] tcp_sendmsg_fastopen+0x1de/0x5e0 [ 321.704507][ T9089] tcp_sendmsg_locked+0x4bb2/0x5490 [ 321.704536][ T9089] ? aa_file_perm+0x192/0x15e0 [ 321.704556][ T9089] ? tcp_sendmsg_locked+0x291/0x5490 [ 321.704582][ T9089] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 321.704612][ T9089] ? __lock_acquire+0x6b5/0x2cf0 [ 321.704634][ T9089] ? __lock_acquire+0x6b5/0x2cf0 [ 321.704664][ T9089] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 321.704684][ T9089] ? tcp_sendmsg+0x21/0x50 [ 321.704701][ T9089] ? __local_bh_enable_ip+0xd0/0x130 [ 321.704717][ T9089] ? __pfx_inet6_sendmsg+0x10/0x10 [ 321.704735][ T9089] tcp_sendmsg+0x2f/0x50 [ 321.704751][ T9089] __sys_sendto+0x4a3/0x710 [ 321.704766][ T9089] ? __pfx___sys_sendto+0x10/0x10 [ 321.704778][ T9089] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 321.704802][ T9089] ? __fget_files+0x3a0/0x420 [ 321.704819][ T9089] ? ksys_write+0x242/0x270 [ 321.704833][ T9089] ? __pfx_ksys_write+0x10/0x10 [ 321.704850][ T9089] __x64_sys_sendto+0xde/0x100 [ 321.704865][ T9089] do_syscall_64+0x14d/0xf80 [ 321.704879][ T9089] ? trace_irq_disable+0x3b/0x150 [ 321.704889][ T9089] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.704901][ T9089] ? clear_bhb_loop+0x40/0x90 [ 321.704919][ T9089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.704932][ T9089] RIP: 0033:0x7f1c4c99c819 [ 321.704946][ T9089] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 321.704957][ T9089] RSP: 002b:00007f1c4d87e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 321.704972][ T9089] RAX: ffffffffffffffda RBX: 00007f1c4cc15fa0 RCX: 00007f1c4c99c819 [ 321.704981][ T9089] RDX: 0000000000000001 RSI: 0000200000000040 RDI: 0000000000000003 [ 321.704989][ T9089] RBP: 00007f1c4d87e090 R08: 0000200000000140 R09: 000000000000001c [ 321.704996][ T9089] R10: 0000000020040045 R11: 0000000000000246 R12: 0000000000000001 [ 321.705004][ T9089] R13: 00007f1c4cc16038 R14: 00007f1c4cc15fa0 R15: 00007f1c4cd3fa48 [ 321.705022][ T9089] [ 322.681752][ T9] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 322.834523][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 322.850961][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 322.886426][ T9] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 322.920352][ T9] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 322.944691][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 322.961779][ T9] usb 3-1: config 0 descriptor?? [ 323.437024][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.450543][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.461485][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.480721][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.503315][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.519030][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.538824][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.552188][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.567661][ T9] plantronics 0003:047F:FFFF.000B: unknown main item tag 0x0 [ 323.623010][ T9] plantronics 0003:047F:FFFF.000B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 323.882832][ T9] usb 3-1: USB disconnect, device number 55 [ 324.101244][ T9118] fido_id[9118]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/3-1/report_descriptor': No such file or directory [ 324.166521][ T9124] tmpfs: Unknown parameter 'i1t!' [ 324.176595][ T9124] delete_channel: no stack [ 324.185302][ T5919] usb 6-1: new full-speed USB device number 23 using dummy_hcd [ 324.593374][ T5919] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 324.604798][ T5919] usb 6-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 324.695829][ T5919] usb 6-1: config 0 interface 0 has no altsetting 0 [ 324.735919][ T5919] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 324.751527][ T5919] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 324.759929][ T5919] usb 6-1: Product: syz [ 324.792935][ T5905] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 324.795869][ T5919] usb 6-1: Manufacturer: syz [ 324.808613][ T5919] usb 6-1: SerialNumber: syz [ 324.862068][ T5919] usb 6-1: config 0 descriptor?? [ 324.899474][ T5919] usb 6-1: selecting invalid altsetting 0 [ 325.081541][ T5905] usb 2-1: Using ep0 maxpacket: 8 [ 325.133422][ T5905] usb 2-1: config 162 has an invalid interface number: 79 but max is 1 [ 325.141995][ T5905] usb 2-1: config 162 has an invalid interface number: 183 but max is 1 [ 325.150387][ T5905] usb 2-1: config 162 has an invalid descriptor of length 0, skipping remainder of the config [ 325.184730][ T5905] usb 2-1: config 162 has no interface number 0 [ 325.191228][ T5905] usb 2-1: config 162 has no interface number 1 [ 325.197681][ T5251] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 325.229456][ T42] usb 6-1: USB disconnect, device number 23 [ 325.269948][ T5905] usb 2-1: config 162 interface 79 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 325.331614][ T5905] usb 2-1: config 162 interface 183 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 325.362982][ T5251] usb 3-1: device descriptor read/64, error -71 [ 325.382515][ T5905] usb 2-1: config 162 interface 183 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 325.417541][ T5905] usb 2-1: config 162 interface 183 altsetting 1 endpoint 0x86 has invalid wMaxPacketSize 0 [ 325.453031][ T5905] usb 2-1: config 162 interface 183 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 0 [ 325.497988][ T5905] usb 2-1: config 162 interface 79 has no altsetting 0 [ 325.524716][ T5905] usb 2-1: config 162 interface 183 has no altsetting 0 [ 325.546648][ T5905] usb 2-1: New USB device found, idVendor=056e, idProduct=5004, bcdDevice=db.d1 [ 325.565635][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 325.581994][ T5905] usb 2-1: Product: syz [ 325.586306][ T5905] usb 2-1: Manufacturer: syz [ 325.590931][ T5905] usb 2-1: SerialNumber: syz [ 325.631681][ T5251] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 325.773364][ T5251] usb 3-1: device descriptor read/64, error -71 [ 325.882742][ T5251] usb usb3-port1: attempt power cycle [ 325.896676][ T9126] loop5: detected capacity change from 0 to 16384 [ 326.321489][ T5251] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 326.342066][ T5251] usb 3-1: device descriptor read/8, error -71 [ 326.352582][ T9145] loop5: detected capacity change from 16384 to 0 [ 326.352903][ C1] I/O error, dev loop5, sector 56 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 326.371746][ C1] I/O error, dev loop5, sector 5888 op 0x0:(READ) flags 0x80700 phys_seg 31 prio class 2 [ 326.401596][ T5905] pl2303 2-1:162.79: required endpoints missing [ 326.430692][ T5905] pl2303 2-1:162.183: required interrupt-in endpoint missing [ 326.614234][ T5905] usb 2-1: USB disconnect, device number 54 [ 326.701848][ T5251] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 326.732273][ T5251] usb 3-1: device descriptor read/8, error -71 [ 326.842251][ T5251] usb usb3-port1: unable to enumerate USB device [ 327.952109][ T5905] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 328.113445][ T5905] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 328.132027][ T5905] usb 6-1: config 2 interface 0 has no altsetting 0 [ 328.141821][ T5905] usb 6-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 328.151189][ T5905] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 328.190039][ T5905] usb 6-1: Product: syz [ 328.206318][ T5905] usb 6-1: Manufacturer: syz [ 328.210959][ T5905] usb 6-1: SerialNumber: syz [ 328.250491][ T5905] usb 6-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 328.261881][ T5905] usb 6-1: selecting invalid altsetting 0 [ 328.280681][ T5905] usb 6-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter) [ 328.296998][ T9174] tmpfs: Unknown parameter 'i1t!' [ 328.306543][ T9174] delete_channel: no stack [ 328.459800][ T42] usb 6-1: USB disconnect, device number 24 [ 329.322176][ T5905] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 329.475142][ T5905] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 329.497460][ T5905] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 329.518220][ T5905] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 329.534681][ T5905] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 329.551730][ T5905] usb 2-1: SerialNumber: syz [ 329.682897][ T9197] FAULT_INJECTION: forcing a failure. [ 329.682897][ T9197] name failslab, interval 1, probability 0, space 0, times 0 [ 329.703602][ T9197] CPU: 0 UID: 0 PID: 9197 Comm: syz.0.993 Not tainted syzkaller #0 PREEMPT(full) [ 329.703631][ T9197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 329.703642][ T9197] Call Trace: [ 329.703649][ T9197] [ 329.703657][ T9197] dump_stack_lvl+0xe8/0x150 [ 329.703692][ T9197] should_fail_ex+0x412/0x560 [ 329.703737][ T9197] should_failslab+0xa8/0x100 [ 329.703764][ T9197] __kmalloc_noprof+0xe8/0x760 [ 329.703788][ T9197] ? tomoyo_encode+0x28b/0x550 [ 329.703813][ T9197] tomoyo_encode+0x28b/0x550 [ 329.703846][ T9197] tomoyo_realpath_from_path+0x58d/0x5d0 [ 329.703888][ T9197] ? tomoyo_path_number_perm+0x219/0x630 [ 329.703915][ T9197] tomoyo_path_number_perm+0x246/0x630 [ 329.703944][ T9197] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 329.703987][ T9197] ? __lock_acquire+0x6b5/0x2cf0 [ 329.704039][ T9197] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 329.704084][ T9197] ? __fget_files+0x2a/0x420 [ 329.704113][ T9197] ? __fget_files+0x2a/0x420 [ 329.704129][ T9197] ? __fget_files+0x3a0/0x420 [ 329.704145][ T9197] ? __fget_files+0x2a/0x420 [ 329.704167][ T9197] security_file_ioctl+0xc3/0x2a0 [ 329.704195][ T9197] __se_sys_ioctl+0x47/0x170 [ 329.704220][ T9197] do_syscall_64+0x14d/0xf80 [ 329.704243][ T9197] ? trace_irq_disable+0x3b/0x150 [ 329.704261][ T9197] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.704288][ T9197] ? clear_bhb_loop+0x40/0x90 [ 329.704313][ T9197] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 329.704332][ T9197] RIP: 0033:0x7f5744f9c819 [ 329.704350][ T9197] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.704366][ T9197] RSP: 002b:00007f5745f43028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 329.704387][ T9197] RAX: ffffffffffffffda RBX: 00007f5745215fa0 RCX: 00007f5744f9c819 [ 329.704401][ T9197] RDX: 0000200000000180 RSI: 00000000c040ff0b RDI: 0000000000000003 [ 329.704414][ T9197] RBP: 00007f5745f43090 R08: 0000000000000000 R09: 0000000000000000 [ 329.704427][ T9197] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 329.704439][ T9197] R13: 00007f5745216038 R14: 00007f5745215fa0 R15: 00007f574533fa48 [ 329.704468][ T9197] [ 329.704495][ T9197] ERROR: Out of memory at tomoyo_realpath_from_path. [ 329.778421][ T5905] usb 2-1: 0:2 : does not exist [ 330.320584][ T5905] usb 2-1: USB disconnect, device number 55 [ 331.210030][ T9232] tmpfs: Unknown parameter 'i1t!' [ 331.333362][ T42] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 331.355619][ T9232] delete_channel: no stack [ 331.558800][ T42] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 331.591412][ T42] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 331.604222][ T42] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 331.697041][ T42] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 331.802033][ T42] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 331.869818][ T42] usb 4-1: config 0 descriptor?? [ 332.376432][ T42] plantronics 0003:047F:FFFF.000C: unknown main item tag 0x4 [ 332.444385][ T42] plantronics 0003:047F:FFFF.000C: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 332.794517][ T9247] FAULT_INJECTION: forcing a failure. [ 332.794517][ T9247] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 332.856690][ T9247] CPU: 1 UID: 0 PID: 9247 Comm: syz.3.1004 Not tainted syzkaller #0 PREEMPT(full) [ 332.856721][ T9247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 332.856733][ T9247] Call Trace: [ 332.856742][ T9247] [ 332.856750][ T9247] dump_stack_lvl+0xe8/0x150 [ 332.856786][ T9247] should_fail_ex+0x412/0x560 [ 332.856833][ T9247] _copy_to_user+0x31/0xb0 [ 332.856859][ T9247] simple_read_from_buffer+0xe1/0x170 [ 332.856905][ T9247] proc_fail_nth_read+0x1bb/0x230 [ 332.856939][ T9247] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 332.856971][ T9247] ? rw_verify_area+0x2a6/0x4d0 [ 332.856993][ T9247] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 332.857023][ T9247] vfs_read+0x20c/0xa70 [ 332.857043][ T9247] ? fdget_pos+0x246/0x320 [ 332.857067][ T9247] ? __pfx___mutex_lock+0x10/0x10 [ 332.857095][ T9247] ? __pfx_vfs_read+0x10/0x10 [ 332.857119][ T9247] ? __fget_files+0x2a/0x420 [ 332.857142][ T9247] ? __fget_files+0x3a0/0x420 [ 332.857160][ T9247] ? __fget_files+0x2a/0x420 [ 332.857187][ T9247] ksys_read+0x150/0x270 [ 332.857212][ T9247] ? __pfx_ksys_read+0x10/0x10 [ 332.857245][ T9247] do_syscall_64+0x14d/0xf80 [ 332.857267][ T9247] ? trace_irq_disable+0x3b/0x150 [ 332.857284][ T9247] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.857305][ T9247] ? clear_bhb_loop+0x40/0x90 [ 332.857330][ T9247] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.857349][ T9247] RIP: 0033:0x7f495515d04e [ 332.857369][ T9247] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 332.857386][ T9247] RSP: 002b:00007f4955f7ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 332.857408][ T9247] RAX: ffffffffffffffda RBX: 00007f4955f806c0 RCX: 00007f495515d04e [ 332.857423][ T9247] RDX: 000000000000000f RSI: 00007f4955f800a0 RDI: 0000000000000005 [ 332.857435][ T9247] RBP: 00007f4955f80090 R08: 0000000000000000 R09: 0000000000000000 [ 332.857447][ T9247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 332.857459][ T9247] R13: 00007f4955416128 R14: 00007f4955416090 R15: 00007f495553fa48 [ 332.857492][ T9247] [ 333.120774][ T9250] binder: BINDER_SET_CONTEXT_MGR already set [ 333.128299][ T9250] binder: 9249:9250 ioctl 4018620d 200000004a80 returned -16 [ 333.219714][ T5251] usb 4-1: USB disconnect, device number 55 [ 333.911144][ T9264] FAULT_INJECTION: forcing a failure. [ 333.911144][ T9264] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 333.925839][ T9264] CPU: 0 UID: 0 PID: 9264 Comm: syz.0.1013 Not tainted syzkaller #0 PREEMPT(full) [ 333.925869][ T9264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 333.925882][ T9264] Call Trace: [ 333.925893][ T9264] [ 333.925902][ T9264] dump_stack_lvl+0xe8/0x150 [ 333.925936][ T9264] should_fail_ex+0x412/0x560 [ 333.925972][ T9264] _copy_from_user+0x2d/0xb0 [ 333.925995][ T9264] ___sys_sendmsg+0x1c6/0x360 [ 333.926026][ T9264] ? __pfx____sys_sendmsg+0x10/0x10 [ 333.926095][ T9264] ? __fget_files+0x2a/0x420 [ 333.926113][ T9264] ? __fget_files+0x3a0/0x420 [ 333.926142][ T9264] __x64_sys_sendmsg+0x1bd/0x2a0 [ 333.926170][ T9264] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 333.926205][ T9264] ? __pfx_ksys_write+0x10/0x10 [ 333.926239][ T9264] do_syscall_64+0x14d/0xf80 [ 333.926263][ T9264] ? trace_irq_disable+0x3b/0x150 [ 333.926282][ T9264] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.926303][ T9264] ? clear_bhb_loop+0x40/0x90 [ 333.926327][ T9264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 333.926347][ T9264] RIP: 0033:0x7f5744f9c819 [ 333.926368][ T9264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 333.926386][ T9264] RSP: 002b:00007f5745f43028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 333.926409][ T9264] RAX: ffffffffffffffda RBX: 00007f5745215fa0 RCX: 00007f5744f9c819 [ 333.926424][ T9264] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 333.926437][ T9264] RBP: 00007f5745f43090 R08: 0000000000000000 R09: 0000000000000000 [ 333.926449][ T9264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 333.926462][ T9264] R13: 00007f5745216038 R14: 00007f5745215fa0 R15: 00007f574533fa48 [ 333.926494][ T9264] [ 334.921725][ T5830] Bluetooth: hci5: command 0x0406 tx timeout [ 335.121791][ T5892] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 335.281655][ T5892] usb 1-1: Using ep0 maxpacket: 16 [ 335.289883][ T5892] usb 1-1: config 0 has no interfaces? [ 335.304142][ T5892] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 335.313557][ T5892] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 335.333435][ T5892] usb 1-1: Manufacturer: syz [ 335.349087][ T5892] usb 1-1: config 0 descriptor?? [ 335.570420][ T9272] netlink: 'syz.0.1016': attribute type 1 has an invalid length. [ 335.770290][ T9272] 8021q: adding VLAN 0 to HW filter on device bond0 [ 335.866244][ T9284] bond0: (slave gretap1): making interface the new active one [ 335.955304][ T9284] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 336.000508][ T9] usb 1-1: USB disconnect, device number 51 [ 336.158097][ T9305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1025'. [ 336.169995][ T9305] veth0_macvtap: left promiscuous mode [ 336.178726][ T5892] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 336.268446][ T9307] FAULT_INJECTION: forcing a failure. [ 336.268446][ T9307] name failslab, interval 1, probability 0, space 0, times 0 [ 336.286571][ T9307] CPU: 0 UID: 0 PID: 9307 Comm: syz.3.1026 Not tainted syzkaller #0 PREEMPT(full) [ 336.286602][ T9307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 336.286614][ T9307] Call Trace: [ 336.286622][ T9307] [ 336.286631][ T9307] dump_stack_lvl+0xe8/0x150 [ 336.286664][ T9307] should_fail_ex+0x412/0x560 [ 336.286699][ T9307] should_failslab+0xa8/0x100 [ 336.286728][ T9307] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 336.286751][ T9307] ? __alloc_skb+0x1d0/0x7d0 [ 336.286773][ T9307] ? process_measurement+0x7ce/0x1c80 [ 336.286811][ T9307] __alloc_skb+0x1d0/0x7d0 [ 336.286845][ T9307] tcp_stream_alloc_skb+0x3f/0x580 [ 336.286877][ T9307] tcp_sendmsg_locked+0x1375/0x5490 [ 336.286915][ T9307] ? tomoyo_check_open_permission+0x38e/0x470 [ 336.286957][ T9307] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 336.286977][ T9307] ? tcp_sendmsg+0x21/0x50 [ 336.286993][ T9307] ? __local_bh_enable_ip+0xd0/0x130 [ 336.287011][ T9307] tcp_sendmsg+0x2f/0x50 [ 336.287027][ T9307] ____sys_sendmsg+0x80a/0x9f0 [ 336.287044][ T9307] ? __lock_acquire+0x6b5/0x2cf0 [ 336.287064][ T9307] ? __pfx_____sys_sendmsg+0x10/0x10 [ 336.287084][ T9307] ? import_iovec+0x73/0xa0 [ 336.287100][ T9307] ___sys_sendmsg+0x2a5/0x360 [ 336.287118][ T9307] ? __pfx____sys_sendmsg+0x10/0x10 [ 336.287135][ T9307] ? kstrtouint+0x6e/0xe0 [ 336.287167][ T9307] ? __fget_files+0x2a/0x420 [ 336.287178][ T9307] ? __fget_files+0x3a0/0x420 [ 336.287194][ T9307] __sys_sendmmsg+0x27c/0x4e0 [ 336.287212][ T9307] ? __pfx___sys_sendmmsg+0x10/0x10 [ 336.287226][ T9307] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 336.287256][ T9307] ? ksys_write+0x242/0x270 [ 336.287271][ T9307] ? __pfx_ksys_write+0x10/0x10 [ 336.287288][ T9307] __x64_sys_sendmmsg+0xa0/0xc0 [ 336.287304][ T9307] do_syscall_64+0x14d/0xf80 [ 336.287318][ T9307] ? trace_irq_disable+0x3b/0x150 [ 336.287328][ T9307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.287340][ T9307] ? clear_bhb_loop+0x40/0x90 [ 336.287355][ T9307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 336.287373][ T9307] RIP: 0033:0x7f495519c819 [ 336.287387][ T9307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 336.287397][ T9307] RSP: 002b:00007f4955fa1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 336.287411][ T9307] RAX: ffffffffffffffda RBX: 00007f4955415fa0 RCX: 00007f495519c819 [ 336.287420][ T9307] RDX: 0000000000000002 RSI: 0000200000001640 RDI: 0000000000000003 [ 336.287428][ T9307] RBP: 00007f4955fa1090 R08: 0000000000000000 R09: 0000000000000000 [ 336.287435][ T9307] R10: 0000000000002090 R11: 0000000000000246 R12: 0000000000000001 [ 336.287442][ T9307] R13: 00007f4955416038 R14: 00007f4955415fa0 R15: 00007f495553fa48 [ 336.287460][ T9307] [ 336.581500][ T5892] usb 3-1: Using ep0 maxpacket: 8 [ 336.588361][ T5892] usb 3-1: config 0 has an invalid interface descriptor of length 8, skipping [ 336.599106][ T5892] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 336.609809][ T5892] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 336.626104][ T5892] usb 3-1: New USB device found, idVendor=15c2, idProduct=003b, bcdDevice=66.3e [ 336.635222][ T5892] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 336.643268][ T5892] usb 3-1: Product: syz [ 336.647459][ T5892] usb 3-1: Manufacturer: syz [ 336.652221][ T5892] usb 3-1: SerialNumber: syz [ 336.659009][ T5892] usb 3-1: rejected 1 configuration due to insufficient available bus power [ 336.667783][ T5892] usb 3-1: no configuration chosen from 1 choice [ 336.888858][ T1154] bond0 (unregistering): (slave gretap1): Releasing active interface [ 336.934047][ T1154] bond0 (unregistering): Released all slaves [ 337.011687][ T5905] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 337.141665][ T5905] usb 4-1: device descriptor read/64, error -71 [ 337.381461][ T5905] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 337.469503][ T9322] usb usb8: usbfs: process 9322 (syz.0.1030) did not claim interface 0 before use [ 337.551526][ T5905] usb 4-1: device descriptor read/64, error -71 [ 337.662608][ T5905] usb usb4-port1: attempt power cycle [ 338.058032][ T5251] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 338.066133][ T5905] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 338.092193][ T5905] usb 4-1: device descriptor read/8, error -71 [ 338.231234][ T5251] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 338.242699][ T5251] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 338.254625][ T5251] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 338.269822][ T5251] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 338.279585][ T42] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 338.288492][ T5251] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 338.305102][ T5251] usb 2-1: config 0 descriptor?? [ 338.341742][ T5905] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 338.362846][ T5905] usb 4-1: device descriptor read/8, error -71 [ 338.441554][ T42] usb 6-1: Using ep0 maxpacket: 8 [ 338.483495][ T5905] usb usb4-port1: unable to enumerate USB device [ 338.494525][ T42] usb 6-1: New USB device found, idVendor=046d, idProduct=08dd, bcdDevice=ff.f4 [ 338.504947][ T42] usb 6-1: New USB device strings: Mfr=8, Product=2, SerialNumber=3 [ 338.513984][ T42] usb 6-1: Product: syz [ 338.518779][ T42] usb 6-1: Manufacturer: syz [ 338.531766][ T42] usb 6-1: SerialNumber: syz [ 338.694759][ T42] usb 6-1: config 0 descriptor?? [ 338.713614][ T42] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08dd [ 338.730848][ T5251] plantronics 0003:047F:FFFF.000D: reserved main item tag 0xe [ 338.748101][ T5251] plantronics 0003:047F:FFFF.000D: unknown main item tag 0x0 [ 338.788098][ T5251] plantronics 0003:047F:FFFF.000D: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 338.920344][ T42] gspca_zc3xx: reg_w_i err -71 [ 338.950017][ T5892] usb 3-1: USB disconnect, device number 60 [ 338.968179][ T42] gspca_zc3xx 6-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 338.984947][ T9324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 338.986585][ T42] usb 6-1: USB disconnect, device number 25 [ 339.057721][ T9324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 339.339665][ T5892] usb 2-1: USB disconnect, device number 56 [ 340.154900][ T29] audit: type=1804 audit(1774932981.632:609): pid=9344 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1038" name="/newroot/207/file1" dev="fuse" ino=1 res=1 errno=0 [ 340.611812][ T5892] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 340.777693][ T5892] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 340.834390][ T5892] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 340.853558][ T5892] usb 2-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 340.891525][ T42] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 340.919919][ T5892] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 340.962958][ T5892] usb 2-1: config 0 descriptor?? [ 341.171507][ T42] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 341.187174][ T42] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 341.198663][ T42] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 341.213285][ T42] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 341.231564][ T42] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.255798][ T42] usb 6-1: config 0 descriptor?? [ 341.321603][ T5892] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 341.461894][ T5892] usb 1-1: device descriptor read/64, error -71 [ 341.486442][ T42] ath6kl: Failed to submit usb control message: -71 [ 341.494030][ T42] ath6kl: unable to send the bmi data to the device: -71 [ 341.540439][ T42] ath6kl: Unable to send get target info: -71 [ 341.601765][ T42] ath6kl: Failed to init ath6kl core: -71 [ 341.624564][ T42] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 341.671133][ T42] usb 6-1: USB disconnect, device number 26 [ 341.721517][ T5892] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 341.862587][ T5892] usb 1-1: device descriptor read/64, error -71 [ 341.985521][ T5892] usb usb1-port1: attempt power cycle [ 342.391896][ T5892] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 342.437822][ T5892] usb 1-1: device descriptor read/8, error -71 [ 342.762802][ T5892] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 342.800010][ T5892] usb 1-1: device descriptor read/8, error -71 [ 342.922038][ T5892] usb usb1-port1: unable to enumerate USB device [ 343.399969][ T5892] usb 2-1: USB disconnect, device number 57 [ 343.442734][ T9397] syzkaller0: entered promiscuous mode [ 343.477191][ T9397] syzkaller0: entered allmulticast mode [ 343.661075][ T9404] netlink: 'syz.5.1059': attribute type 21 has an invalid length. [ 343.847932][ T9409] syzkaller0: entered promiscuous mode [ 343.854123][ T9409] syzkaller0: entered allmulticast mode [ 343.862282][ T5892] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 343.864022][ T9409] FAULT_INJECTION: forcing a failure. [ 343.864022][ T9409] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 343.886101][ T9409] CPU: 1 UID: 0 PID: 9409 Comm: syz.5.1061 Not tainted syzkaller #0 PREEMPT(full) [ 343.886130][ T9409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 343.886142][ T9409] Call Trace: [ 343.886149][ T9409] [ 343.886157][ T9409] dump_stack_lvl+0xe8/0x150 [ 343.886189][ T9409] should_fail_ex+0x412/0x560 [ 343.886225][ T9409] _copy_from_user+0x2d/0xb0 [ 343.886250][ T9409] __copy_msghdr+0x3c5/0x5b0 [ 343.886280][ T9409] ___sys_sendmsg+0x213/0x360 [ 343.886311][ T9409] ? __pfx____sys_sendmsg+0x10/0x10 [ 343.886366][ T9409] ? __fget_files+0x2a/0x420 [ 343.886385][ T9409] ? __fget_files+0x3a0/0x420 [ 343.886414][ T9409] __x64_sys_sendmsg+0x1bd/0x2a0 [ 343.886441][ T9409] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 343.886475][ T9409] ? __pfx_ksys_write+0x10/0x10 [ 343.886507][ T9409] do_syscall_64+0x14d/0xf80 [ 343.886531][ T9409] ? trace_irq_disable+0x3b/0x150 [ 343.886547][ T9409] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.886568][ T9409] ? clear_bhb_loop+0x40/0x90 [ 343.886598][ T9409] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 343.886618][ T9409] RIP: 0033:0x7fcf4199c819 [ 343.886639][ T9409] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 343.886656][ T9409] RSP: 002b:00007fcf42868028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 343.886677][ T9409] RAX: ffffffffffffffda RBX: 00007fcf41c15fa0 RCX: 00007fcf4199c819 [ 343.886693][ T9409] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 [ 343.886705][ T9409] RBP: 00007fcf42868090 R08: 0000000000000000 R09: 0000000000000000 [ 343.886717][ T9409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 343.886739][ T9409] R13: 00007fcf41c16038 R14: 00007fcf41c15fa0 R15: 00007fcf41d3fa48 [ 343.886769][ T9409] [ 344.128802][ T5892] usb 2-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 344.139508][ T5892] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 344.148172][ T5892] usb 2-1: Product: syz [ 344.155560][ T5892] usb 2-1: Manufacturer: syz [ 344.160288][ T5892] usb 2-1: SerialNumber: syz [ 344.173766][ T5892] usb 2-1: config 0 descriptor?? [ 344.212366][ T5251] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 344.348308][ T9420] FAULT_INJECTION: forcing a failure. [ 344.348308][ T9420] name failslab, interval 1, probability 0, space 0, times 0 [ 344.363761][ T9420] CPU: 1 UID: 0 PID: 9420 Comm: syz.2.1066 Not tainted syzkaller #0 PREEMPT(full) [ 344.363798][ T9420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 344.363812][ T9420] Call Trace: [ 344.363822][ T9420] [ 344.363830][ T9420] dump_stack_lvl+0xe8/0x150 [ 344.363867][ T9420] should_fail_ex+0x412/0x560 [ 344.363905][ T9420] should_failslab+0xa8/0x100 [ 344.363934][ T9420] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 344.363958][ T9420] ? __alloc_skb+0x186/0x7d0 [ 344.363980][ T9420] ? __alloc_skb+0x1d0/0x7d0 [ 344.364000][ T9420] ? __local_bh_enable_ip+0xd0/0x130 [ 344.364033][ T9420] __alloc_skb+0x1d0/0x7d0 [ 344.364056][ T9420] ? process_measurement+0x2e1/0x1c80 [ 344.364086][ T9420] alloc_skb_with_frags+0xca/0x890 [ 344.364120][ T9420] ? __pfx_process_measurement+0x10/0x10 [ 344.364150][ T9420] sock_alloc_send_pskb+0x878/0x990 [ 344.364185][ T9420] ? __lock_acquire+0x6b5/0x2cf0 [ 344.364224][ T9420] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 344.364252][ T9420] ? __lock_acquire+0x6b5/0x2cf0 [ 344.364288][ T9420] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 344.364318][ T9420] unix_dgram_sendmsg+0x460/0x18e0 [ 344.364346][ T9420] ? __lock_acquire+0x6b5/0x2cf0 [ 344.364391][ T9420] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 344.364412][ T9420] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 344.364446][ T9420] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 344.364474][ T9420] ____sys_sendmsg+0x972/0x9f0 [ 344.364511][ T9420] ? __pfx_____sys_sendmsg+0x10/0x10 [ 344.364547][ T9420] ? import_iovec+0x73/0xa0 [ 344.364577][ T9420] ___sys_sendmsg+0x2a5/0x360 [ 344.364609][ T9420] ? __pfx____sys_sendmsg+0x10/0x10 [ 344.364672][ T9420] ? __fget_files+0x2a/0x420 [ 344.364691][ T9420] ? __fget_files+0x3a0/0x420 [ 344.364727][ T9420] __x64_sys_sendmsg+0x1bd/0x2a0 [ 344.364757][ T9420] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 344.364793][ T9420] ? __pfx_ksys_write+0x10/0x10 [ 344.364829][ T9420] do_syscall_64+0x14d/0xf80 [ 344.364853][ T9420] ? trace_irq_disable+0x3b/0x150 [ 344.364870][ T9420] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.364891][ T9420] ? clear_bhb_loop+0x40/0x90 [ 344.364917][ T9420] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.364943][ T9420] RIP: 0033:0x7f5fb4b9c819 [ 344.364964][ T9420] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 344.364982][ T9420] RSP: 002b:00007f5fb5ab9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 344.365005][ T9420] RAX: ffffffffffffffda RBX: 00007f5fb4e15fa0 RCX: 00007f5fb4b9c819 [ 344.365021][ T9420] RDX: 0000000000004800 RSI: 0000200000000500 RDI: 0000000000000007 [ 344.365034][ T9420] RBP: 00007f5fb5ab9090 R08: 0000000000000000 R09: 0000000000000000 [ 344.365047][ T9420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 344.365060][ T9420] R13: 00007f5fb4e16038 R14: 00007f5fb4e15fa0 R15: 00007f5fb4f3fa48 [ 344.365092][ T9420] [ 344.370620][ T5251] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 344.736822][ T9402] bond0: (slave bond_slave_1): Releasing backup interface [ 344.751384][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 344.954067][ T30] INFO: task syz.4.456:7403 blocked for more than 143 seconds. [ 345.012591][ T30] Not tainted syzkaller #0 [ 345.321530][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 345.360676][ T30] task:syz.4.456 state:D stack:26408 pid:7403 tgid:7402 ppid:5849 task_flags:0x400740 flags:0x00080002 [ 345.391090][ T30] Call Trace: [ 345.404864][ T30] [ 345.410630][ T30] __schedule+0x15dd/0x52d0 [ 345.411510][ T5251] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.438813][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.439989][ T5251] usb 4-1: Product: syz [ 345.454015][ T30] ? stack_trace_save+0xa9/0x100 [ 345.456432][ T5251] usb 4-1: Manufacturer: syz [ 345.469200][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 345.484224][ T30] ? save_trace+0x49/0x390 [ 345.493176][ T30] ? __pfx___schedule+0x10/0x10 [ 345.507147][ T30] ? schedule+0x90/0x360 [ 345.517809][ T30] schedule+0x164/0x360 [ 345.524542][ T5251] usb 4-1: SerialNumber: syz [ 345.524699][ T30] schedule_timeout+0xc3/0x2c0 [ 345.548740][ T30] ? irqentry_exit+0x59e/0x620 [ 345.568012][ T30] ? trace_irq_disable+0x3b/0x150 [ 345.570706][ T5251] usb 4-1: config 0 descriptor?? [ 345.592966][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 345.605853][ T30] __wait_for_common+0x3c0/0x690 [ 345.624283][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 345.650991][ T30] ? __pfx___wait_for_common+0x10/0x10 [ 345.665481][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 345.678561][ T30] wait_for_completion_state+0x1c/0x40 [ 345.698460][ T30] vfs_coredump+0x9c7/0x4280 [ 345.712731][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.726357][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.736852][ T30] ? __pfx_vfs_coredump+0x10/0x10 [ 345.750052][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.762269][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.771947][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.777007][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.782131][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.787404][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 345.792553][ T30] ? unwind_next_frame+0xa5/0x23c0 [ 345.797926][ T30] ? is_bpf_text_address+0x26/0x2b0 [ 345.803483][ T30] ? is_bpf_text_address+0x292/0x2b0 [ 345.810987][ T30] ? is_bpf_text_address+0x26/0x2b0 [ 345.822188][ T30] ? kernel_text_address+0xa5/0xe0 [ 345.828214][ T30] ? __kernel_text_address+0xd/0x30 [ 345.835182][ T30] ? unwind_get_return_address+0x4d/0x90 [ 345.841681][ T30] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 345.848406][ T30] ? arch_stack_walk+0xfb/0x150 [ 345.854016][ T30] ? stack_trace_save+0xa9/0x100 [ 345.860600][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 345.868237][ T30] ? stack_depot_save_flags+0x33/0x810 [ 345.874562][ T30] ? __lock_acquire+0x630/0x2cf0 [ 345.880525][ T30] ? kasan_save_track+0x4f/0x80 [ 345.888468][ T30] ? kasan_save_track+0x3e/0x80 [ 345.894146][ T30] ? kasan_save_free_info+0x46/0x50 [ 345.899807][ T30] ? __kasan_slab_free+0x5c/0x80 [ 345.905358][ T30] ? kmem_cache_free+0x187/0x630 [ 345.916937][ T30] ? get_signal+0xa4a/0x1330 [ 345.924659][ T30] ? arch_do_signal_or_restart+0xbc/0x830 [ 345.930540][ T30] ? exit_to_user_mode_loop+0x86/0x480 [ 345.936647][ T30] ? do_syscall_64+0x32d/0xf80 [ 345.941877][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 345.948198][ T5892] usb 2-1: unexpected transceiver, part 0xe2 version 0xe0 [ 345.956067][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 345.966465][ T30] get_signal+0x1107/0x1330 [ 345.971924][ T30] arch_do_signal_or_restart+0xbc/0x830 [ 345.977731][ T30] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 345.985285][ T30] exit_to_user_mode_loop+0x86/0x480 [ 345.990833][ T30] ? rcu_is_watching+0x15/0xb0 [ 345.996139][ T30] do_syscall_64+0x32d/0xf80 [ 346.000804][ T30] ? trace_irq_disable+0x3b/0x150 [ 346.007478][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.017610][ T30] ? clear_bhb_loop+0x40/0x90 [ 346.029737][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.038865][ T30] RIP: 0033:0x7f685279c819 [ 346.048585][ T30] RSP: 002b:00007f68509f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 346.058612][ T30] RAX: ffffffffffffffda RBX: 00007f6852a15fa8 RCX: 00007f685279c819 [ 346.067055][ T30] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f6852a15fac [ 346.075493][ T30] RBP: 00007f6852a15fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 346.083867][ T30] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 346.093733][ T30] R13: 00007f6852a16038 R14: 00007f6852b3f960 R15: 00007f6852b3fa48 [ 346.102417][ T30] [ 346.106268][ T30] [ 346.106268][ T30] Showing all locks held in the system: [ 346.117723][ T30] 1 lock held by khungtaskd/30: [ 346.125159][ T30] #0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 346.151105][ T30] 5 locks held by kworker/1:3/5251: [ 346.156667][ T5892] usb 2-1: Firmware version (0.0) predates our first public release. [ 346.165894][ T30] #0: ffff888022293548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 346.177512][ T5892] usb 2-1: Please update to version 0.2 or newer [ 346.185211][ T5892] usb 2-1: atusb_probe: initialization failed, error = -19 [ 346.192559][ T30] #1: ffffc900025f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 346.210190][ T5892] usb 2-1: USB disconnect, device number 58 [ 346.224412][ T30] #2: ffff888029f6b1e0 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 346.237868][ T30] #3: ffff888029e0f1e0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 346.247555][ T30] #4: ffff88802a0531a8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 346.257330][ T30] 2 locks held by getty/5585: [ 346.262429][ T30] #0: ffff8880379580a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 346.274189][ T30] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 346.284658][ T30] 3 locks held by kworker/0:4/5892: [ 346.289929][ T30] #0: ffff888022293548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 346.302126][ T30] #1: ffffc90003e47c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 346.314670][ T30] #2: ffff888029eff1e0 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 346.326961][ T30] [ 346.329421][ T30] ============================================= [ 346.329421][ T30] [ 346.339440][ T30] NMI backtrace for cpu 0 [ 346.339459][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 346.339482][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 346.339494][ T30] Call Trace: [ 346.339502][ T30] [ 346.339510][ T30] dump_stack_lvl+0xe8/0x150 [ 346.339544][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 346.339565][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 346.339594][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 346.339619][ T30] sys_info+0x135/0x170 [ 346.339647][ T30] watchdog+0xfd9/0x1030 [ 346.339689][ T30] ? watchdog+0x21a/0x1030 [ 346.339713][ T30] kthread+0x388/0x470 [ 346.339743][ T30] ? __pfx_watchdog+0x10/0x10 [ 346.339760][ T30] ? __pfx_kthread+0x10/0x10 [ 346.339782][ T30] ret_from_fork+0x51e/0xb90 [ 346.339812][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 346.339837][ T30] ? __switch_to+0xc7d/0x1450 [ 346.339863][ T30] ? __pfx_kthread+0x10/0x10 [ 346.339884][ T30] ret_from_fork_asm+0x1a/0x30 [ 346.339929][ T30] [ 346.339940][ T30] Sending NMI from CPU 0 to CPUs 1: [ 346.455383][ C1] NMI backtrace for cpu 1 [ 346.455404][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 346.455423][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 346.455434][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 346.455460][ C1] Code: 0e 6c 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d e3 32 1a 00 fb f4 fc e9 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 346.455474][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000242 [ 346.455491][ C1] RAX: 00000000004cfa07 RBX: ffffffff819a913a RCX: 0000000080000001 [ 346.455505][ C1] RDX: 0000000000000001 RSI: ffffffff8defa72c RDI: ffffffff8c27d100 [ 346.455517][ C1] RBP: ffffc90000197f10 R08: ffff8880b873399b R09: 1ffff110170e6733 [ 346.455529][ C1] R10: dffffc0000000000 R11: ffffed10170e6734 R12: 0000000000000001 [ 346.455541][ C1] R13: 1ffff11003bd9000 R14: 0000000000000001 R15: 1ffff11003bd9000 [ 346.455553][ C1] FS: 0000000000000000(0000) GS:ffff888125557000(0000) knlGS:0000000000000000 [ 346.455567][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 346.455579][ C1] CR2: 00007fcf41be92f8 CR3: 0000000067ed0000 CR4: 00000000003526f0 [ 346.455595][ C1] DR0: 0000000000000008 DR1: 0000000000000002 DR2: 0000000000000404 [ 346.455606][ C1] DR3: ffffffffefffff14 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 346.455617][ C1] Call Trace: [ 346.455626][ C1] [ 346.455633][ C1] default_idle+0x9/0x20 [ 346.455655][ C1] default_idle_call+0x72/0xb0 [ 346.455677][ C1] do_idle+0x36a/0x5f0 [ 346.455699][ C1] ? asm_sysvec_call_function_single+0x1a/0x20 [ 346.455719][ C1] ? __pfx_do_idle+0x10/0x10 [ 346.455743][ C1] cpu_startup_entry+0x43/0x60 [ 346.455764][ C1] start_secondary+0x101/0x110 [ 346.455784][ C1] common_startup_64+0x13e/0x147 [ 346.455806][ C1] [ 346.645640][ T5251] usb 4-1: non-Atmel transceiver xxxx021f [ 346.647878][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 346.647900][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 346.647923][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 346.647935][ T30] Call Trace: [ 346.647944][ T30] [ 346.647953][ T30] vpanic+0x56c/0xa60 [ 346.647985][ T30] ? __pfx___schedule+0x10/0x10 [ 346.648010][ T30] ? __pfx_vpanic+0x10/0x10 [ 346.648034][ T30] ? __pfx_console_unlock+0x10/0x10 [ 346.648069][ T30] panic+0xc5/0xd0 [ 346.648094][ T30] ? __pfx_panic+0x10/0x10 [ 346.648121][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 346.648147][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 346.648172][ T30] watchdog+0x1023/0x1030 [ 346.648196][ T30] ? watchdog+0x21a/0x1030 [ 346.648220][ T30] kthread+0x388/0x470 [ 346.648240][ T30] ? __pfx_watchdog+0x10/0x10 [ 346.648256][ T30] ? __pfx_kthread+0x10/0x10 [ 346.648276][ T30] ret_from_fork+0x51e/0xb90 [ 346.648304][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 346.648327][ T30] ? __switch_to+0xc7d/0x1450 [ 346.648352][ T30] ? __pfx_kthread+0x10/0x10 [ 346.648372][ T30] ret_from_fork_asm+0x1a/0x30 [ 346.648413][ T30] [ 346.653382][ T30] Kernel Offset: disabled