last executing test programs: 8m20.500534418s ago: executing program 0 (id=157): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x2, 0x80805, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) getsockopt$bt_hci(r0, 0x84, 0x85, &(0x7f0000002380)=""/4107, &(0x7f00000000c0)=0x1012) 8m20.273783536s ago: executing program 0 (id=162): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x19, 0x0, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x36a06e38, 0x6, 0xa, 0x3, 0xc, 0x2, 0x1041, 0x800000000000, 0x20, 0x3, 0xffffffffffffffff, 0xffffffff, 0x4, 0x1, 0x800006, 0x68], 0xeeef0000, 0x1c0057}) mprotect(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x1) ioctl$KVM_RUN(r2, 0xae80, 0x0) 8m19.882742294s ago: executing program 0 (id=165): mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x200800, 0x118) r1 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r1, 0x1, &(0x7f0000000000)={0x2108, r0}, 0x0) landlock_restrict_self(r1, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 8m19.763952104s ago: executing program 0 (id=166): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='.\x00', &(0x7f0000000000), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) 8m18.751701043s ago: executing program 0 (id=176): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)={{0x12, 0x1, 0x0, 0x3a, 0x98, 0x2a, 0x8, 0xccd, 0x10a3, 0x23a2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x57, 0x33, 0x19}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x10, &(0x7f0000000040)={0x0, 0x2, 0x6, "92afc102df3e"}, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4a, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 8m18.327426323s ago: executing program 0 (id=181): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, &(0x7f00000000c0)="0f21b034000f21c9440f20c03507000000440f22c066bad00466b8af0066ef66b85b0066b83d018e9bf0f0b887008ee867360f062e0f09", 0x37}], 0x1, 0x8, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 8m17.923129988s ago: executing program 32 (id=181): syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, &(0x7f00000000c0)="0f21b034000f21c9440f20c03507000000440f22c066bad00466b8af0066ef66b85b0066b83d018e9bf0f0b887008ee867360f062e0f09", 0x37}], 0x1, 0x8, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7m28.670140462s ago: executing program 2 (id=462): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r2, 0x0, {0x1, 0xff, 0x4}, 0xfe}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r1, 0x6b, 0x4, &(0x7f0000000080)=0x1, 0x4) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xffe0, 0x6}, {0xfff1, 0x9}, {0x2, 0xfff3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x48040}, 0x20000050) 7m28.135482917s ago: executing program 2 (id=466): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000000f000/0x18000)=nil, &(0x7f0000000380)=[@text32={0x20, &(0x7f0000000300)="b8050000000f01c10f46a78900000066ba2100b067ee66ba2000b8000000000f23c00f21f835010003000f23f8ee6d6c2f800000c00f3266bac0000f3066b808008ed0660f38806f008ee0", 0x4b}], 0x1, 0x3b, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x33, 0x40000000788, 0x80000000002, 0x183, 0x400000004, 0x0, 0xee, 0x0, 0x100000000, 0x4, 0x6, 0x3b9, 0xf, 0xfffffffffffffffd, 0x0, 0x8], 0x8000000, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 7m27.633271087s ago: executing program 2 (id=471): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) ppoll(&(0x7f0000000100)=[{r1, 0x4080}], 0x1, 0x0, 0x0, 0x0) recvmmsg$unix(r0, &(0x7f0000003c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 7m26.707551092s ago: executing program 2 (id=477): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) unshare(0x2c020400) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, 0x0, 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x226) 7m25.727202572s ago: executing program 2 (id=485): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x6f, 0x48014) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x400000000a882, 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x28011, r3, 0x3a535000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 7m25.476037235s ago: executing program 2 (id=487): socket(0x200000000000011, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) r0 = open(&(0x7f0000000380)='./bus\x00', 0xeb40, 0x0) r1 = creat(&(0x7f0000000200)='./bus\x00', 0x84) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000240)=ANY=[@ANYBLOB='+\x00\x00\x00', @ANYRES32=r0], 0x2b) sendfile(r2, r0, 0x0, 0x4000000053d2) 7m25.127356614s ago: executing program 33 (id=487): socket(0x200000000000011, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x0, 0x80) r0 = open(&(0x7f0000000380)='./bus\x00', 0xeb40, 0x0) r1 = creat(&(0x7f0000000200)='./bus\x00', 0x84) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000240)=ANY=[@ANYBLOB='+\x00\x00\x00', @ANYRES32=r0], 0x2b) sendfile(r2, r0, 0x0, 0x4000000053d2) 1m37.196940982s ago: executing program 4 (id=2577): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xa, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0xf, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0xec6, &(0x7f00000008c0)={0x0, 0x0, 0x3000}, 0x0, 0x0) ioctl$IOMMU_IOAS_MAP(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x9, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c881, 0x8, 0xd1}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x10, 0x1, 0xbfdffffc}, &(0x7f00000000c0)=0x0, &(0x7f00000003c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) 1m36.339164007s ago: executing program 4 (id=2579): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r3 = dup(r2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000040)=@arm64={0x6, 0x4, 0x9, '\x00', 0x1}) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f0000000000)=0xd000) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1m35.363400426s ago: executing program 4 (id=2581): socket$inet6(0xa, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x7cc5, 0x4000, 0x0, 0x0, 0x0) 1m33.449931195s ago: executing program 4 (id=2587): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x2080) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) ioctl$LOOP_SET_FD(r3, 0x4c05, r3) dup2(r2, r0) 1m32.975018857s ago: executing program 4 (id=2588): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000200), 0xffffffffffffffff) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7c, 0xe) bind$inet(r0, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) sendto(r0, &(0x7f0000000740)="50fbdf12a30d7a48b2c5c84948f3426077a9f0ca1475183db3bf52a6b2cdb77ef9af2a603a3e78adff59fbb22bae1b2443011fd801251bcef8f165533aac58c7556dd51edc5a6865d4e29f0bbd0ed602050000000000002944de604d849a1e3b32905b0d26e9ff34b83f38a2ae8b1c6748ef8b87ef2a359249c3e294931489ba57f83f96048684434854ab3b6ad59f45e832972639508fe4dcb371c013bc129572e996a7db94fae8d71a076ec5", 0xad, 0x0, 0x0, 0x0) write$binfmt_misc(r0, &(0x7f0000000380)="c7", 0x1) sendto$inet(r0, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x52, 0x0, 0x0) 1m32.795310678s ago: executing program 4 (id=2591): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x23a, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x1, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r6 = dup(r5) read$FUSE(r6, &(0x7f0000002b80)={0x2020}, 0x2020) 1m31.746484013s ago: executing program 34 (id=2591): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x23a, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x1, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) r6 = dup(r5) read$FUSE(r6, &(0x7f0000002b80)={0x2020}, 0x2020) 33.918883824s ago: executing program 5 (id=2849): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) pipe(&(0x7f0000000040)) socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000400)) socket$alg(0x26, 0x5, 0x0) fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f00000002c0)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7fffffff], 0x0, 0x1}) 33.638680721s ago: executing program 5 (id=2851): openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xffffffffffffff2c}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) 31.097356885s ago: executing program 5 (id=2859): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0xef92, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) getpgrp(0xffffffffffffffff) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r6, 0x0, r5, 0x0, 0x2, 0x0) 29.635528841s ago: executing program 5 (id=2864): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) 28.324235105s ago: executing program 5 (id=2883): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x49c, 0x0, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x80000) sendmsg$kcm(r3, &(0x7f0000001880)={0x0, 0xf5, &(0x7f0000001600)=[{&(0x7f0000001a00)="e8a472", 0x3}, {&(0x7f00000000c0)="bcc9b1557de1fad1f955144629ed4dcf3c33679ea22502e3cff8923bf5d43921bc111a262f295a8eb540", 0x7fffeffd}, {&(0x7f0000001680)="094fb143daa9baa36aaa2cca06886c533118e056", 0x14}], 0x3}, 0x0) 26.827290412s ago: executing program 5 (id=2880): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001780)=@newtfilter={0x3c, 0x2c, 0xd27, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xd, 0xffff}, {}, {0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x6, 0xa}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x2008c014) 26.01977433s ago: executing program 35 (id=2880): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001780)=@newtfilter={0x3c, 0x2c, 0xd27, 0x30bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xd, 0xffff}, {}, {0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0x6, 0xa}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x2008c014) 13.384071116s ago: executing program 1 (id=2922): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) creat(&(0x7f00000000c0)='./file0\x00', 0x48) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10, 0x8, &(0x7f0000000000)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) 10.191203565s ago: executing program 1 (id=2934): r0 = syz_usb_connect(0x0, 0x3e, &(0x7f0000001100)=ANY=[@ANYBLOB="1201000020dafb2099041010f50a0102030109022c00010000000009040000016f2bae000824020100000000092402020000000000090585da20"], 0x0) syz_open_dev$sndctrl(&(0x7f0000000080), 0x2, 0xc8080) syz_usb_disconnect(r0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3ff, 0x8, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xffffffff, 0x10000000, 0x99, 0x20000002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9e, 0xa0000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4771], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x3, 0xfffffff9, 0x4, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xe0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) r2 = epoll_create(0x6) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000040)={0xa0000002}) ioctl$UI_DEV_CREATE(r1, 0x5501) write$uinput_user_dev(r1, &(0x7f0000000500)={'syz0\x00', {0x8000, 0x7f, 0x3, 0x3}, 0x3a, [0x5, 0x1, 0x7, 0x83e, 0x5, 0xd, 0x6, 0x0, 0x7, 0x9, 0x4, 0x7, 0x1, 0x3ff, 0x3, 0xfffffff9, 0x27e8, 0xf93, 0x6, 0x3, 0x2, 0x1, 0x47dc, 0x10000, 0x4, 0x3, 0xfffffffc, 0x1, 0x0, 0x18, 0x8, 0x9, 0x190a, 0x1000, 0x23, 0x0, 0x4, 0x1, 0x1, 0x5, 0x2, 0xfd84, 0x200, 0x3, 0x6, 0x9, 0xffffffc0, 0x8, 0xe0000000, 0x5, 0x77, 0xb, 0x7, 0x5, 0x7, 0x22, 0x1, 0x7fffffff, 0x4, 0x80000000, 0xdc6, 0xfffffffc, 0xffffffff, 0x7], [0x9, 0x1, 0xb069, 0xffffc5b3, 0x2, 0x5, 0x2, 0xdc0, 0x0, 0x3, 0x2, 0x8, 0x6, 0x661b, 0x9, 0x5f, 0x7d, 0x10001, 0x2, 0x2, 0x8, 0x7, 0xbda, 0x80000000, 0x20, 0x4, 0x8, 0xfffffffc, 0x2, 0x9, 0x7fff, 0x4, 0x8, 0x6, 0x60, 0x6, 0x5, 0xfff, 0xfffffff9, 0x8, 0x6, 0xfffffffc, 0x7fffffff, 0x8, 0x8, 0x3, 0x2, 0xe14, 0x200, 0x7, 0x63, 0x8, 0x9, 0x7f, 0x3, 0xcbf, 0x200, 0x2, 0x2, 0x8, 0x3, 0x0, 0x400, 0x7], [0x9, 0x4, 0x0, 0x0, 0x6, 0x8, 0xffffff81, 0x4, 0x401, 0xb, 0x200, 0x9, 0xfe0, 0x5, 0x4, 0x40, 0xfffffff9, 0x956, 0x63, 0xb72, 0xf816, 0x57d, 0x0, 0x7, 0x1, 0x6, 0x1, 0xe9, 0x0, 0x3, 0x1, 0xfffffffb, 0x3, 0x3, 0x81, 0xf, 0x9, 0x3, 0x3cc, 0x9, 0xc, 0x800, 0x9e86, 0x31, 0x2, 0x0, 0x3, 0x7, 0x3, 0x6, 0x9, 0xe0, 0x7, 0x7f, 0x1ff, 0x6d, 0x7, 0xfffffffb, 0x1175, 0x8000, 0x11d, 0x8f9b, 0x3, 0x6], [0x9, 0x5, 0xfffffbff, 0x5, 0x6, 0x400005, 0x80000001, 0x7fff, 0xff, 0x0, 0x1, 0x1, 0x6, 0xffffd529, 0x408, 0x0, 0x2f5, 0x1ff, 0x8000, 0x3, 0x7f, 0x7fffffff, 0x40000000, 0x4b1, 0x6, 0xc, 0x5, 0x5, 0x508f, 0xc6, 0x81, 0x9, 0x7ea692d0, 0x2, 0x8, 0x1d59, 0xfff, 0xe10d, 0xc, 0x40, 0x4, 0x3, 0xfff, 0xfe, 0x1, 0x3, 0x366e, 0x7, 0xfffffffc, 0x8001, 0x3, 0x3, 0x4, 0x0, 0x8, 0x0, 0x3ff, 0x6, 0x0, 0x1, 0x9, 0xffffffff, 0x7, 0x5]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 8.327221558s ago: executing program 6 (id=2940): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x2, 0x0, &(0x7f00000000c0)='GPL\x00', 0x5}, 0x94) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='fd/3\x00') r1 = epoll_create1(0x0) execveat(0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r2 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r2, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000808, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @loopback}, 0x1c) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000200)=0x3d10, 0x4) sendto$inet6(r2, &(0x7f0000000000)="8d", 0x1, 0x40440c1, 0x0, 0x0) dup2(r2, r0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000240)={0x80000011}) 8.194283109s ago: executing program 6 (id=2942): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x185) prctl$PR_MCE_KILL(0x41555856, 0x0, 0x2) r3 = inotify_init() inotify_add_watch(r3, &(0x7f00000000c0)='.\x00', 0x5000009) fallocate(r2, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r2, 0x0) 8.192891445s ago: executing program 1 (id=2943): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000680)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000080)={0x34, &(0x7f00000000c0)={0x40, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b80)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 6.591193559s ago: executing program 6 (id=2949): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000001100)='fdinfo/4\x00') r0 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_FLAGS={0x8, 0x8, 0x702}]}, 0x34}}, 0x0) r3 = socket(0x10, 0x803, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295a5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r5}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 6.495661506s ago: executing program 6 (id=2951): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1000000}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000200), 0x800) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) 6.242097729s ago: executing program 3 (id=2955): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e"], 0x7c}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2180, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x24008040) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000180)=@arm64={0x10, 0x10, 0x4, '\x00', 0xfff}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x0, 0x9, 0x0, 0xfffffffe, 0x0, [{0x2, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x8, 0x2, '\x00', 0xb}, {0xff, 0x7f, 0xd3, '\x00', 0x67}, {0x0, 0x5, 0xf5, '\x00', 0xf}, {0x7, 0x9, 0x8, '\x00', 0x2}, {0x0, 0x4, 0x54, '\x00', 0xff}, {0x74, 0xd4, 0xf1, '\x00', 0x7f}, {0x3, 0x5, 0xc}, {0x7f, 0x5, 0xb, '\x00', 0x8}, {0xd7, 0xe, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfc, 0x7, 0x26}, {0xcf, 0x5, 0x8, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x3a, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x2, '\x00', 0x1}, {0x4, 0x4c, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x2}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x12, '\x00', 0x10}, {0x1, 0x3, 0xf5, '\x00', 0x4}, {0x7, 0x6, 0x4}]}}) 5.81658741s ago: executing program 7 (id=2956): bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000090000000500000007"], 0x48) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) unshare(0x22020600) r0 = timerfd_create(0x0, 0x800) timerfd_settime(r0, 0x3, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r2 = syz_open_dev$radio(&(0x7f0000000200), 0x1, 0x2) ioctl$VIDIOC_G_MODULATOR(r2, 0xc0445636, &(0x7f0000000100)={0x0, "a3a1b56a4c84226a928a751f1cb50b3e6421ca43d00c7441b04e9026e3dbaf07"}) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec21, 0x1000, 0x400001, 0x40000333, 0x0, r1}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) 5.750112265s ago: executing program 3 (id=2957): socket$nl_netfilter(0x10, 0x3, 0xc) openat$ubi_ctrl(0xffffff9c, &(0x7f0000000000), 0x610100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) futex(&(0x7f00000001c0)=0x1, 0x8, 0x0, 0x0, &(0x7f0000000240)=0x1, 0x2) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3ff, 0x8, &(0x7f0000006680)) r2 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f00000000c0)={r2, r2, r2}, &(0x7f0000000080)=""/34, 0x22, &(0x7f0000000000)={&(0x7f0000000280)={'wp512-generic\x00'}}) 5.260368867s ago: executing program 8 (id=2958): r0 = socket(0x10, 0x803, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000ec0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xd, 0xfff2}, {}, {0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0xe42ef}, @TCA_MPLS_PARMS={0x1c, 0x2, {{0x9, 0x5c, 0x3, 0xfffffffc}, 0x2}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x4) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000ec0)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xb, 0xfff2}, {}, {0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x54, 0x2, [@TCA_BASIC_ACT={0x50, 0x3, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x4, 0xffff, 0x6, 0x2, 0x6}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x4) 4.870939599s ago: executing program 8 (id=2959): r0 = socket$rxrpc(0x21, 0x2, 0xa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x11) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$rxrpc(r0, &(0x7f0000000000)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x100, @mcast1, 0xffffffff}}, 0x24) r3 = syz_io_uring_setup(0x10a, &(0x7f0000000140)={0x0, 0x5883, 0x0, 0x0, 0xfffffdfc}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) 4.726622853s ago: executing program 6 (id=2960): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="1201410130f56920ac05190272f00102030109021b000100001000090455070103490200090582030004"], 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) syz_usb_control_io(r0, 0x0, &(0x7f0000000580)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB='\x00N\b'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 4.419399601s ago: executing program 1 (id=2961): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000940)=ANY=[@ANYBLOB="400f01"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000240)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000800)={0x0, 0x15}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f0000000280)=ANY=[], 0x0, 0x0}) 4.001782392s ago: executing program 7 (id=2962): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r3, r1, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000200)={0x28, 0x0, r3, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) ioctl$IOMMU_HWPT_INVALIDATE$TEST(r0, 0x3b8d, &(0x7f0000000280)={0x20, r5, &(0x7f00000002c0)=[{}], 0xdeadbeef, 0x8, 0x1}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000300)={0x8, r5}) ioctl$IOMMU_DESTROY$hwpt(r0, 0x3b80, &(0x7f0000000340)={0x8, r4}) ioctl$IOMMU_GET_HW_INFO(r0, 0x3b8a, &(0x7f0000000380)={0x24, 0x0, r3, 0x1c, &(0x7f00000003c0)=""/28}) ioctl$IOMMU_DESTROY$stdev(r0, 0x3b80, &(0x7f0000000400)={0x8, r2}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000440)={0x8, r1}) close(r0) 3.702579035s ago: executing program 7 (id=2963): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x46) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0xc, 0x4, 0xffffbe0000000001, 0x8, 0xffffffff}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(r2, 0x0, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f0000000000)=0x1) ioctl$VIDIOC_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000000900)={0x0, @bt={0xcde, 0x190, 0x1, 0x2, 0xdd9f83, 0x2, 0x9, 0x1, 0x7, 0x5, 0x4, 0x13, 0x7, 0x7f, 0x0, 0xb763599953cb092e, {0x0, 0x6fd8e84b}, 0x3, 0xed}}) 3.39122811s ago: executing program 8 (id=2964): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x4, 0xfa0d, 0xfffffffb}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r2 = socket(0x28, 0x1, 0x0) r3 = syz_io_uring_setup(0x512, &(0x7f0000000280)={0x0, 0xc65d, 0x100, 0x8, 0x40}, &(0x7f0000000240)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000000c0)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r2, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0, 0x2121, 0x0, {0x3}}) io_uring_enter(r3, 0x47f6, 0xb277, 0x0, 0x0, 0x0) 2.601350674s ago: executing program 3 (id=2965): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0}, 0x94) r1 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000006c0)={0x2, 0x0, [{0x0, 0xe, &(0x7f00000001c0)=""/14}, {0x2, 0xe0, &(0x7f0000000580)=""/224}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 2.122378909s ago: executing program 3 (id=2966): socket$inet6_udp(0xa, 0x2, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d0000"], 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x409, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c881, 0x8, 0xe2}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8b37, &(0x7f0000000080)={'wlan1\x00', @random="d203343500"}) ioctl$PTP_EXTTS_REQUEST(0xffffffffffffffff, 0x40103d02, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000300)=ANY=[@ANYRES8], 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) syz_emit_ethernet(0x0, 0x0, 0x0) 1.920032693s ago: executing program 7 (id=2967): r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0xffffffff) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x4000045) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x49b, &(0x7f0000000380)={0x0, 0x2c0c, 0x400, 0x7, 0x2000284}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4007, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(r3, 0x40f6, 0x4f7c, 0x0, 0x0, 0x0) 1.789820854s ago: executing program 8 (id=2968): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r3, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, 0x0) 1.514002036s ago: executing program 6 (id=2969): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000700)={0x40, 0x0, 0xf, "012720dcfe14c639a500ba17162716"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) close(0x3) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000100)={0x20, 0x46e2ce1dfc86f44b, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r2, 0x5b15, 0x0) 711.460574ms ago: executing program 8 (id=2970): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x55) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xffffffff) fsetxattr$system_posix_acl(0xffffffffffffffff, 0x0, &(0x7f00000001c0)={{}, {0x1, 0x1}, [{0x2, 0x4}], {0x4, 0x4}, [], {0x10, 0x2}}, 0x2c, 0x1) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0, 0x4}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x39383ddd, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe}, 0x94) 589.469525ms ago: executing program 7 (id=2971): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x122}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x4000000) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4088, 0xff8}, 0x0) 565.891284ms ago: executing program 8 (id=2972): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000000)) r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x6) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$int_in(r2, 0x5452, &(0x7f0000001080)=0x3) write(r2, &(0x7f0000000080)='g', 0x1) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000140)={0x6, 0x3, 0x6, 0x7fff, 0x1a, "ee1dd756f560f25a63b2f119c3439425ea59d8"}) 443.387295ms ago: executing program 1 (id=2973): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_CAP_X86_USER_SPACE_MSR(r1, 0x4068aea3, &(0x7f0000000180)={0xbc, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000080)={r3, 0x1, 0x8, 0x1}) 417.527828ms ago: executing program 3 (id=2974): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x190) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000002140)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000001dc0)={0x50, 0x0, r2, {0x7, 0x2b, 0x0, 0x2b418842, 0x6}}, 0x50) statx(0xffffffffffffff9c, &(0x7f0000000640)='./file0/file1\x00', 0x1000, 0x100, 0x0) syz_fuse_handle_req(r1, &(0x7f0000004200)="aa8e9df36226466e888b39901e75023156b5530e75c1e203314842ea78a6048cdec3383c60dcd8fa24f6928f6e02ab1090989c59ae38dceda05af132af4546a298837c63ea70975feb0919d7f7766791d530b90d522b23c58776ac7a4035383c5a0dd90d8b766c96816631f1742a0da0ce6ddd053a05966f6b6ec22dd28a0a2636d07696a307496b0b0d8bb370227dca3c96838e556681409be388f1dfbf500f1aee82b374f4473aecbdb77cf567fece7f8ec733fa91aa92a186f9768d16d0257ef826959fb3a73e4976a019bde8a82e9bb0a0443cbb1ab2c6e8f8748489948710294efb79d70edec2271491bc1cddc9c9d2713cc3063761f2bea07f5577bbe5224302ef23adcc96cb5ecee406c7977c97d7000000006e28198954bba79006fd58b2a2b43047e7f3ead143ccb6b27043d7a7512e9d3bad0138554f4b465ab6d1cec9b40cb301ac6491ee7fcdc0588e53eb2510471de91e3e73c98f0a3cc9929eac63f477a1208a80f8c75d0a1d9edb895d675d036a1863dddea98b18c846ac253b2470324b21eaaa6e69389b91bcd470995cd6835c6fac80d5ca41b66562c910f893124cf0f20dc65d90aa0f9cd1a7c88f755aaf33875d7639ae1b7413834636de57f44302b723646257ee7456bdfee10f2eaf0c05f2cf01a115ed8ac2908827af3d85da2f1bcf53d87ee830dc5e98fcfc1a22e547ce57508f606945a7599d8e1cc0268987cb7b3d00a6bfacea7bd05430255bc8b473a071b83695783944ef856fc89906e0b44a13166309bc8cc1dbae68399e1e8e4a2ea265c1a104dd862563cdaeee2b37e72fbda323cc72360b6d4fad2fd2409397f90422bbe6e9068aaf38e18918736e6357a6caac59ae803ffbe853ff716a388423bbc93bb2d6b1222bb94c96a3bddf421288d47039fa1b73573dbed87e1f6b280f8b045f9be8e0d85f6cf416bfc0f3f4ce988aefa2382cccf39e40b2a1657814b7953d0a0aea45d50d02d66982e5269f1ededd6a9f8f9e212314a4bb5c2f4898278fd3a585c1ff60e435b186c552134e5ddb0f2cc95dac405bc4bd32ccda41b05c6a376070c8ef2d6eb3ea7fce97da8f09440d47dc5faca6271d1ce4f4201b315d1cc3fa1d4cc2baa14e4c57bafb7b5bb2e9e859505360e1738a36100dd6c2fb6610fc0ed88e452148ecd8b73517f69c28f0c979525d21ba4fef353eebb2326f48217c44a322e9f1f08f92af1ff5ee5f2dc563f1a0edb09d0646105be0c46ddc8b71301e68013e863d539af5b3a2b11f770d8c0c086988216602619ec440f98d434add23bc7f54d145260773e53121188ca179832d5c406f2b4a91045edca91232416219fade02bf6ba002352943850294b05d9a142889205e6b69336cecfe8a7cfc88688368d54b475f3915eea851334395f80b41177ed4d17d91880a22c1c0cf33a550e32fbf76505458d07ebccc4e77bafae1700c9997f6fe28452f011e370642f228bbf0e2f3dc05741127f6d73e96c073b26e730ac19cb17dfc63c0ed4b5d53ffd6e312e3e80822c8bbea3cf2914f3f8ee53fb4edde1d4507fa9d7de54eecb75132befab6bf486cb05bc8727dadac49c83bf08d9eb94621b42241f9eb8fd1e6fbf969d932a023760faa62c178b7f0a1d43adbf5c21a35a58d381442ecdfc2dcce2d11e5efae8433b14fc9fc28294ae76eaa95f38ac121f255d9b478c81a1caf5c606c34e6efa80dd3aa77cc4001b9fceebcc77a1efea7bf9f749f62c7a8bd5deb0f70c54ab5daab010cf14b2f1012516dc1639edb2d890638b73559d060be47f594f322efdd40c5945148fe1690585923488910fcb3159006f935f7d184e4b4c404ccb6e2a799cc67aa2b56a13c16e3ad92b85a12060881c1d140708ffece6965f9746ed4eef74d37424e760f4b266c80c93390523eadc65494962bed4efc86a0fead2fe25c9108c5d591770cee92f9ff2d916ba0dedc6551a47ce3a4dbc97043e588b3483f0793786fe9f32f1b79ba3f4c4ccabba52a59861c8024bcdfc8ecb0acc821160b060d5dc24f0ade14d08b56218a32a03f9eba729c02fc6b714bc72b11cc7fe47b51b3a174cfa2d8f5df80a0fd4d1dd2ed36b868b46ee5a8cc72e91b57bd05005b5142b5531650813fb5496af379f9e7b1b73c49c64dead9725af0742a41b770205390791de856715c0138ca22f134911a28d2caf22ef21049d1ba721d278bcf675317c5303cbaf96535414fd92c55d741120200d49729e01e399e4c30fa8da659654196af7991a3d294c775a610f242a56c88d542641036de7eccbd64f9f306a3920596d350637a6409f667110b46c6d85ab94df4d7b0af12318522ba1e745e7de45176789a53213b9b3d23b2599275e4f1858fdb2fd63f8c6f7990235e2fb3c4c8f215715973b60b1e56d1f061b6ff33510d08fa403559cbcc21bd141b41f1e9ab4e163a0f80a918ba13031c483931a9dcdb790ad77fbdf5634662cb75e79d986e4724f64c80203600df7ac9950330431b83777bd968a86be5698b13c37513235ac89a0a1dcb799112a86a2d96b1708e0c5e983756d8243927fc7d42be6ff4c946c0763a9745897726f38b65920363b7c32051bf9e770ab1ec140ff11fc639f36fa760afcfd6ba2f609df8cb0949f26119895b69c8ffd0836a01da1e407ba08f37a1144674f5a71b3499ffcccb21e75f19cdfb33c7eded5fa5c264784a78edc5f6de17da15317a66fea522b6e92a52efa5013797212d816c3229c7dd523e2165f9f042c3b3b16e608a1d87ab9c46c2b291bf547e1f4312913b16e39a714c24ebc5cb4f4f80bb20ce4efdf2921db45b7389fef98bd0e8aa40be16758b0d7755ab631b27c5d49225e84fea63e3f031c665851ef4ed18628b26445da2cad4741800cf72a401ad79a7462657068e0f2ee65eeb86da66890247cb45b31d3ad06ea7500eac5be65528c55bf190b0ec27673b67b36117344097a0dbb9db47a2b5144218002d14cbb98629c2ed35db5cdcf93994e3e3d1a1673ff60ec0d9bae1217ba6f39ae4ac4c9e5a19f85634f3091150c4724aaabe3bd1445cfa33fac93b86c5871ca168a728899e2e0062a596fba22b962764420f1268bb8ae0a894559c488cfce6b71aa8478964d2eef5086b2cee891ca031b6543bb7ba55006621f1d80e17abcba9f9d05fc5e61c6c4a890aba4b205f5570e7866ec4de380420c4758de63ff0f7b1acb0521e45cd9bc54df1a4614c04c524f43e86f58757eddb645bbc56a63de5bb560f56a31796dc344d58e2ff2d3fe5228d87c0439e6353943c92160fb847a172eea37ad0c22de5d1e7cd66730218832c87b73366131e29a1545b26d4c500a9afd75864b460cea1ba33a5dca6e5585e9c78a8ee3361f20e2b79489ed2ef1c935d7deeef6de0d009b72a0751929209b351331c0225c29341f5d476b278061a0a33c1e455815bbb83eebf5f5c3fe97c4b3df32846a094501a157196b6c1db1e05cec4f2dee823ebea7da05f5ee63aee1670128471465ae83defcf26aba78f18544146fcc9305ed5899965edbcf9f677c499a52d984db346c12faf02553338e6553488c29c9f3f4537a9437b5eb7382f95f9e844d27fa0b1ffc48d2b44e383b1fdb567b7f23863e8e10b6210f8031859cea410d52f99b5a8d2f218e7c92e231904b171dc077c636db15087cfb0ca6a2cd09f6b7973627a03ebfb4772daddc8ad7c9e534d8bc58cfc6d1305374b589a2a85c8a3c471c7408712ff5cfd7a50bee627d0417a5667dba71866320857cdb84e071a37e477f1b5ac16bdd464d8bf3ae31860ad19722bea1d85d1a5c09e1ab36dcd6c4bf524ed2137745e3562147081027d7852bee1ccc9563e4ff0ce72affa7002e9a066591ddf31abc4388281d98d2d88fa1c5f22cb60523e72e3d838fc6b0163fe0082ce0d8d59098363a174818113182d40cdb6367cb4a867c5aaa480c95f4a98439a2b58291fedcbfedfc3ebb41fe6b0a12fce36518ea6082fb919cdff23e3b40aa26eac8d634e03fc3a1e0fafe402c875709b15b622f35bfdd233ea8d7989ec38dfa1e5b5688d76c615b5efba62dd7d50be97b92f16c838edecd426e18dd270ddda42121d7ad8d26ec28df29580e6dcd7f968885d1cbc5f573efda890a408b45701bdf5cb2e3c54f8481710145ac1f5bdb1b53a1e9a7efd8a3ad7dad7bd0fa017e080854913beda2ccc95631a5c1da5c5afaa84bcc3f1a7041208fac9e09ef52140f142bed882b8988ea062cc8ecd7fd78fd33aeee8e8d5cc891514e3407fbb171e84e45fa14713e995513e16763424e356032ac81047c8e2bfe05dfecc510b55866d4a8696c91afd7b6b809fcf2e0f8a21834f43149d8e2b5dc5fddacb8ff9341376281e8f7d762fdb61a8e6536529b0d4d3cd8217fdb4f0b8341587737da7f50dbe4e5b7851a25d52066bd0e3ad11aed47ee02bec11d0f125cdee1f505cc5c1223d386b2fda556331cf57d8df433927cf12a5fbff853be266c5a64b6424f7b106931d312f0fd447206d21c1945579915e7e21627c7fc423a813823ce5fa2c6f3114303d0995c5706418a088535c62eda2a60c82b727c31177252f8ea025c16a3676ea0ccec24ea57e68c7e0f1b0e06f78a8ccead63eb4c0ef5c59b1d3a805644f8089e604a5bd3aa4494ff7fca02dd5894a6f02e572edd487af04ace3e37f19074325613d6f7d2af73062607b45a3c9365337a1c5e6bae9702a65f0a1b9ce75e43f6381efd9d610ad37532b62c6ab5957ded77a5d01604f67d7ccaa495266ab7fe161268b9a6156643ab6289fa0be75ac433a0204df164c02d3d0cb1b7bf0acd92ca8ff19b710b0b511820d0500fdf58f598fc611380a0f7dffce7bbc934edc967ba0094a0281750176748a4e2c99684c1c4a40258b0da77a0bfb9a4b808d5932443389f0f346dad998cee519624aeb07ea4446064282b1448bfa2e5ac3393d30b5c3865a8995869f69bab0747cfcbbd2bfd407c82e198da326f36be9a508e12d6d73fb262b37fcd7ff70b372c966b7198a9f2364012ff8127f200c079cb70d550f9483c1bf9fba69ebc961c989a82fc38cffe853e4738f33f1fa42fe7167e4bb79110f237d7e4989d2f6f4bd21905e491e2d4b6ac5a66025c11a93ab1eddcade3c3e78c270eaf6a0a6ed43df6e35bcaea9aa716d547d2136c2388379abf645e3f7cad1cc1fdc92b882729ff92b0612302970bd9ca7e36d76b2eb4d9dfe35116bb7771e448867e57026e622e1e54422b064fdb707fef339aa16fde808f622a7269b77c292c7e85fade6dcde475c2f61d71370209bc0e46ba7c7b71e41df246d283f5574205ca6b4819c63d97193eb084fd6b0c20b956cfc4b45b51fd46b2e034ff0f003179c7539fbc4e888c0633767604ed0f07beb4fe00f5a3b56ad9f3997cb49c7a8b92a719411b20874686a8a5ab462914baa85d016df99796a868af3dfa6ad98ceaaa18af2f2fad2ebf3dee1df8c8863e84ed83d6da5e283ca9cc385e0ded20531f127ff4aa974b91634d8f367154d3e23ebb04571a5a453d1265e873d00d40be7e1eb7e74529822b4c81d742c981a988fb786084cbd1e721358c7a1ea5293aa609773b890a5c9de4d1349588def4232d41fa5d7cfbc3dd130754891c304118a895268555874613e9c89c66bceea609e7ca1a914ea327db1f85a3809098e801289d8ab71997c2ad5bd1f3fd4b3c6b80667ac2b6b23b35018206dbf708284f0e0fac58d0b6d72c0d0034b6ed37b1f9931158f2443f045f65e33084ebc6aac93d8c0e3c1c52878dd3f54b9f88a40821090cdeb3bdbb61f0be16338a2a7ba0f77e9ecd5400b6f809a49eee78346c69e7ab560fcc32f2d19e665bb91fbc00e4c00838a1385d5156d1696f694027a9e6a7ef66933202012caca81c1b3ebe64976a9d000e28a6aae5d6f061c5acf8e4bca00bc5ecc547ab1664cdb2125300130a5a92abc0d36cf911fb3123034e925ea097fde14253dd3de52bf5c8a6bf01436c92dbbf5450a9b7775a981b09eab05406dae83f8ddcf898b1bace4b8487f0b4ec5b5316a9b7e3bcd6da41caa23604b3932ff3daf31bb19e74c687773bb54503f6b3ed74aef1410dc4a9a72fa05b1e120e682a7e7f9b8c7b6836fa9d8f96d16fa17975bc3dd7784f0d621d5a69038b0947d1cb47381c82c6df030fc8033dd66b380d884b12991ef5d5283e552f723aaf791bf3af581423c57b536b91e5a158695b68f7eccfd72fd2af1016e261ec863215d1df0fe756366e56fa86c4495cd9a45e83227af93a5b431c5d33fea2b3d469aab08f57b85b3a14a47d7da8ca74dae34f963cf660057466dac3937ce00060f8db8099178944aa37474a37eaef3b9ca04bd0eb1d03c25887d530cd690625f5829830851a6a58a7b411bc87aa70f26e80514799664e35c44db243d61add5bcaba3695e45e9f1a3cbf8ebdfb87571c44b9dcddc5fd422e94cbeb02bb58abd14e140829e12f7f0c7e3cc1a1bcae8429775e531710bfa504e103b17c20c329f653c015ab514fd6cf162b96d871930de99413e148fa58c1ff262a997c6ed1bc008912c6b864031dc95b5a3ad6aa3521167a62fe771baff828cafaf178539048d2e91a62ee7a50df04062422150347774db320fb535ddd4c03a8cdfc3affd253c200e1d5678ff12eb6f5bd43da636778cd2f8551295f4cbbc902322e491c5c10fee144daeaec4cc2a2f855f5312f4c8cac1155c8d3b93a5fe6a60118a0a9912b16d583582b478e4f05c375247d4cd897c49a8cfd2540833311039d9b121e5d5779d71b206d0d862b95e0eab28005f86ddd6ec514d931a521fc035eaacfd10ec5f97af541cabf08512f6c79e7e0db5217bd14aab6d3e9458018c3e59769bcb689347d7e394b469e9c9d9da2be8fc7a54b1aab301b68c1faf7ba7bfd05b8a313c902ad3733e523fd64739d9af110e39a96f1048fd6a43d13045ec71ff3d1f64a904f3878cb18f58b3b84942331ec05d3372a328a83e8aab828574313964f6f6c5af246faf2c69a95e9ceca77c0fbf303103a2d38ef6da2929a3dbccae5823f82d9a37c989154c8a760df8e7d8589daf1fd69683cadd2c7ac13e285a7661c23913912ee272797e3a0808654fd0b9f74f2fe04cb34167aa630b8aa58efc2586bef8c7c2e354d7c8d08de7d25a80b08bae8d2326d16a15d537d8baffcbbae460ce608ded63a45bdf0caf9dc335aa8d2aac03a62a9c6c62ce7c2caa9a731baa549d1880d3facdb4bee43ae27ccd5a22f143da8e7b4deb5c2a194d450eb5ff6949a950115d4e1d60fc75115346a0aaaf1400a301dcc8a04f9d2762c093f88adac799f6bd5150ca9c7d3ac1f728b88b1b0807a7407ad9b8febd89a801c9845af62bf2fc98aea4835d52871774e72b9fc07d26d55ef163833fd2f5c951ff963f43fcdaf03995cf3f14360b05be587e7a19fb760a944166b1fbd04c0d02bda8ff5d92a23c4e683db1b2823a6b02a16a7bc7963aaeeec43d97a85752fa439544127fb71d8b4fee6a09b966bc4e7be67acca35bfe4acabf18f6e9cc938c1e0af43e11754cbe7b37738019d9a162083f5f1fcdd9299921a349f1e0ee840b19fed4c0b5273d5e71ff5f1f20dbb36c89e1edbbef78de1a6229a2cd22bcf2164a1b567f7c08c6ba78ff2e53bc348dd2ab53b9deffc9cf8726feaf9cb07b4f94d189314da8c0005f3bb031e44c402339588832779790e814c707fdbe0830d53b4d35812f27e7709bee185d6d6d67a65382dcf56d567180a4a74cb05b0f7d0202bf33b88729f2bab7003264a2d67ea93d022baea74d7ca54a0081923a82e56750f22f58bc997ea57afe1bce18405383055745f0c6bfbbc514df76107b3c5d04bfe033dace72bd5bead25e736a0052b6efe7eb1153d1afe9202e227d60e4e38f5f294894d2ef9b89998194492e427442a18506e24ddcc1952354fe0250ad949be08a63b6c0e206ecbac70415c36f1bf78d7068ce8eb804561eab2540c6c984e63d1217de1242ae70a5dd457d7a96f24ad9e8a59c060a2a95e9e04a6a4429f40d47d2770e9d3ece295d748aa30a7bbd2aec570733be7855c3a789d71d94b3c86ccdd3cca3ddcb35a969e8c2d5b17ded6ab8b81b90a4206ac2ff163c04ba9886b5ec6138db5eb6ffc19201f66a1057858e564960de679b2996bb93c8d2b440fde169d1fbb5886fe673639c514c2eb8bca75f79abbb73c4a125e5f4d7d4ccd5c9fc85cedc9fe6f2b2b75ec384fa6ecec37579a70bd29b4c9893badb36e1b33cf61b07ee7d2a5550ac9f23b5fe629297efe94eb8a8c2adce65a61ddae84544fe8f81455e2d053fdf7efde38b92b0b4d3e7ff9d81f5de7d571cb4db7e059cbe1ac2153b22b57b4d45d58fa50d152efa2d85d262238ce4816e40f93b65f53b6646297f69e3dde4ae7c57e9112054cb831eca5716863196db7667674b00be7c83f900c944ea2bc8e8e6b6b335a6e9f63e6f6635f6afc0889355aa4f0b928b90f76e6f03b5d40e9a0cace6243aff4590c0ef255860401b16da288687e890b1921b8ba63860df7aad86279c89d16cc4ad1ef4633639f203724c1958fb3b6a990f555e8df8f494fbdae25b353c14fe524541347c1d7f61c349f55773575fab73df09ebd1c635ad5f93fc8e075093ec3fd8b832e5331e329c2578d1f6f7a0a44838e578fe40db7d11645c2c73e0a438a80085988294d98a4ef4c5faa593dd5a9b0dec12d8a6dfd15cc4503bb2078739f26f9c10d0b1fc2634094cfd2ff6bec88a7513debde5fcabb85fd31df8d97bcfaf247edb89cb056fc52bc06f117a3e1022a57817b9abe1793cf279e163212f501681eb9ef08e39adb9ba80ec3cd45f5ae7afc0c256a3470e8ed3ca41c5502c510f0526eab848ec5a7115a53741cf05846989b9b5fc6d2ad74fb855a852e3fc7234bb0ed8b6937167133925dbeb4313a9895860e761300a0695e03e81c2c1e3fe3f4b8c42c946b010259ffa4c1d345350020cddc8e9697fb83c22fff5190558551584368e7a270f958bc72e2624c3e45bbef318b5134f0419e725945e445993f2f176f0a21f5dba86398529fe5159d57c0d75d64f950763b52935e778b20356615409dcb088514eeba3f811e9ce6ce2bd1ba6ac932bd79f7a518959f99d52acbc2a1d0c02c70b9ea46d662d39c315b36315f4220e5dce293275050a3e6df506d0c1d7786017572cd758ba4995963fa034ecd49cadb42bb1ee280600557ce2e17488e1dd4595b8c7d4f20f420a3a01b6228d764c5069222cc93e2091fd2053f05a50eda7840c13f45c6e2a2fbc0f9de4baefb7b40ea1fb7e9d30fb1fdb8f20eafca0c7c8c61c57dfcb8e2836e8d0ce546e8e37b9fc467e1bbeab314be171573398e0c2fb032049a99acf174a857c019609e83010dda8da078a4311efcaaff62fa908dde87cec4d41078c343eec5a80c42d0146d57e9a14f2b5611be05e3b665728c14ea9536d146926fe1e8d5acf12afca415ef5ad77bdfead7ea087183962592296d3d892c64a0a3b9fc95b50f03df7f4f50f950b43a289af09ca92a01a684e5c649b8da4a3365878273a00afd14b4fa2ddaeea5007f728899ba9f5fc9d1d7893a489e56c5fb152e5f775042f4b3bab6cea9cbf9a2b91647fe3c62d3ae4b5d065460b51d51b6e91f2f4fe90a3775e6312ffc805612fee8c314ee70c92de3feefb3cda56a59ddba83757b0e85cb0ee7ad1ac608a1e6a64656d9f586afc38fd1f6474b521724532d88cd351688db077dc9d229a78f8704b21f85324bf9c697874cac5f709c6701a421ac368edda0ec3a0b90268c449acf753d7e8cab501ae3d7e04788e899ec54a2517545b68fd928fb659349e1692bdeccca648fd13a7602868c44e77ed6fd587538a74adc6acdb1ebd1816af88ece2ca64f2603428a0aa842fe86be6b2b568fd29c23433c9e3f9f0e45bd13beb22ac06eb82ae0eb2b3b328aca4abba5e72a155e2cc82ac92c4697fdb9439511c1144fe2ba36f516fa181f7f8d58af69f87a6c936d1e561fff0509819e65a681aaea445a106f8ff3dfd987e2e24e977281cb85cc5e5eb987da2d17e73dacfd9880bd14ecad13d5705643f926303b389a61fd63139577de263a5fdef1facdac0068a9471fc17ac654e88e0a0d12c8aca1e850b64a88f2382e0cf3a4e3363827a06abc1eeb87216e3447dfbf8c04080ca2fe1a08cc2e2001eb386cf02ac0d3b328bcf1de009d048a03cd955c628971c30a137dc66879cbe938390a8f63251f55e559549dd11969b637876a20bc7c6f5fe2b753923d2f0269f2082206eb2312f40654cc95bb38add159104495018a5aa7b8f5836162de9a03b6981c662f2ee02a168d530a002616c09c4cc26c2a2726711e3e25b4e3acb6dcba25fde78ecede51f01e22a2f79409c77011a599ff57d81e70dbde5fcbdc841f9af0e49e8200cd2d3c73013e0e5608ee1951ac04a111864b545e7bc2434c2474286519feaff4da07324d1b13bb16d1daa1d485bcd5466b82c9622f92664f1153d08c6e644b3d0f5902b4d749895f7763015bf0e2849703ed920a3866a260f22fe40f46c76ca6ca10ae8994505fa613a6b1aec84ee6620c25ca4d002f56ddd21b12eed5132634a3194281283fe5fdac07d2fec091dc0f748fe25c6b08cf8d4ff893e863a43c4c92fba47d86c8dfbbabbdca0cec09f732bc0b8df2a97ee7208e64512249300aa4c44c10d4c4503bd76e7b4e2c9aa2e274166ef103d5c832a760f33b5a0eae4dab922f0fec5adbf409bff956b4ce40e6157d498d46ae053f1ad73655bfb0a3dfac6b96c09bac4d07e6bd7f3ac6337f58cccc631466985f6ad680d21a5fe9a9bde4b6980c689e6e8c7a413b6e3084997c089443ffaca9be80c96ce1d9b6de074b4aecfd2db3b679a2d5cf0523aa14414699d481eace4aa397d818ff4d3e73d82031849c7e4f1f1503b636728637f87cf7a7df5472abfcb7e5d77439e1018dba49a41e1c8e63942fe0d1a426f390e8e225fee14501a34762b8d835ca14d6a3a3d8042724ea9e6b568fe0eb84306397ffa8345935e9be8642e6ffbd96e636fd16cacae5d4b88fd0aa0bfbba8221f68eabc98c67de6f9eab2cca07b096b458bbfdc7f1da0bb845a1a6e19c6da87a958acb1aad0b74d6537e97fb0673a20178cbb963f909839e49ec593ddcfc3046aa54c22e3a54148c440d1f2ba1fa7417572c629e48e6d2e07760a87581971d1edccc03c0e465d4d6321d820b3346fb516c1813585a6a8462124f91428a90ed037f40cd6f23596dc90c03825636e55a061838964213c70104ec0c5909a0c62240e93314f9b67ce8fafa115251282a6ee7a036a861d1af11919dbfa7ceb7b2260e66be6300a536e78ebdf60a6f022574b35205341f3557e409d8ecc0c2304b372605c9284aebe1b92f13051db78210df83873b0496625507cf8e1ee5e90aa66f45be75e388d6e0a021b8af3787ee06cd710719b4d06ca5ba5f87de812a660f939584ea880d3c71bc58135e612431850180ee39b707bd98aff26d2c5e4396b43daefd82b2ec1004978637b8d389cc415d628fea6f66f28664f9409448e68a2d48a0a00", 0x2000, &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x90, 0x0, 0x7ff, {0x5, 0x3, 0xdc, 0x5, 0x2, 0x6, {0x4, 0x638, 0xfffffffffffffff8, 0x8, 0x3, 0x79, 0xfffffffe, 0x7, 0x1, 0x8000, 0x4, r3, r4, 0x7, 0x5}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r1, &(0x7f0000008e80)="0e24ac7705237246fc1db898fda0c7f95d375ea7f4bc7a07517a51095880f2219d9e4329f6c4e734f2bb34564a1c2e298d7eb8844d8af7b30e1a71750a2511e44b368fc6e9ae65e40e64e4b5fd3d0f87009b5727519df1ddbcbb38ef00871f00ed2543b7f2990a44482bf3d7478c3c2799dd8120fc3258cfeccf648fe15128c54d1d4272bfd44950915afd3aa0abb5b04d4dbec287df0816c3e43c2503cac6e95041aa205c5958f51a9c4c8214ae2108401b08ae7ff8440988c93424422f06c628077d767432521fefa0f8d0f387e685e4af54bdd7f931c3eace52ca7a6ba2d0fd701e5d77393e6268f52e68d97087f87edd2ae49180028bf08ab7e02c3ef12aec2f286d1bf40fd3a5f337b0f0b63d701c60bae36a5e1644bc90f34165049ac5c4fc8a0ada90e345df1420a58c92cfcc6973d3fa532b8b4088592e0f2c36f7e756139b272fc99104a93c5cf2599c683b60910af98a55b17bf646ddddb13e73d0bfdcfb3e3d261d84f83270832708f6e5b3fd2bb98e135b914e21681b409d717afa8f65dc9d3ab6a78b9b026b6aa1f1ee5872426b4bd4fd652072f86dfb96ef79649396a0f19239b0ce6ba9a8ff49f8f4820579a3169fe54b6f060a69236d57a1a13f033054fb22dbfb3f72861acc7ed51ebed60a8a03c3e16030e7a114d0690c268713d8206b34a005fb89d5123103d36ab57594fc731e8a6353ab3be3af22faa6f85b54ba78b90aba30e17dad90c31a20cc5f39c8ff50097bb310535efd6ecbc49dfc2d547bee78d5c5ebfe0d4bd3c093413e12cfefbfdb5f38c437ce831b209f3337979f6e0c46d8bf272a3ac6076c7940f905536167d2285d2a7d0e75f1765f0c080f1dfd9bae98afdfda7e7837d1081d83effab72e6eff493cc9031a299383f726227d75474e4c8378b2376fc7fef8b213b26794edc4c2fc110d917b863d25e7382b19b1b90cc90428f6aa0b1df015bcbbe83de36ff56c065ba92f1f49e61ac6bc6b3c20e42e7763dd52f66095f07e235f0062accb0eab60ce54d84391cbf2613096ded353543b5d6a884cc981b759e4499ab72881f88542208c9fd81b541514d6d2ed54683926b0d6bfe904b76215aea6db4cff8242d3ee5524acb456ec219e42d46c1b1e3fa9748404db4583537b195ad326853ed9472790656ab01bd031b19fb64b0e5227d18ea09ea7557c9afdc918c918a1fafdd18f9f54682bf0f49ba2ae14f963340dc6600e1b344ce50ed61af0726e3441583f8cf045df193dfbce93285d7fddfc0d831fefc85cd3e7920757f27a4e09b5cfa77b93a5e82f571d1293d9437cf89997011eee6ba9f9b7e6ce2fe1c381cb2db053a6e2d9351edbddcc10faf80f5b686727dd8982b12604fde3467f4a7e98b13250df7e1eef67da8f7fe3fffd3a185457aaaecb38f5ca31ea3e35cc7c6adc3873c734cb661e3c43e64bf0843b2cf1d950642eeb20d698cc9e598eb7ec71d3a0d83f311afa2d40a659a219defad76fdb7e8146756ff02a8a74abf8a8ccd72ffd7f70911698d54552aada8ef27b3f5b2644d4d0fda2976d838686a7469b296a98b67b7cc9834dc94f2292581dd242d1abb42db30d4de42c4611c0fbdc77134a6cb0c0d7b36d18a217aaabd34744ed5cac171e2a8bfe90b2dad03d0ca5f74d3eb95c454757be4c77f386c63fee91e95a508d8fcea5cd6bef9bd05e0b992da4e4cbc2f52c9cfde09b6f17f3d73fffc01d7ac55f328061516cf0e4fa50fff5b03dca67b163a68d9ddbb988f50a68fdbfc6e6feb6c892b58eb766d3429396669228dd1653bcbb5cb47c0857d27660e62d23e90178ef2b75713c2c58a207d8c21e9ce64556bfd71b40207ee76416f9f40c5601173b1d84105ac331247c021941a6a27e86de4f9a4db382f67dd6dc8e86a02a8438ddda1a636256fcac8e2328aaa3c054ab86f55c9d7bb2c2999a5c7933f092a3bf66523cb388052c65d138346ad1c5137fa383d7b9023b1868af02cf48923289162544db8fb29cf592c306a76ec92b35f33fae90f5aeac830b82dcc3f0069f668aebe6e5fe13c811f150de080632e357221d2f220ef95ce436730d1f9390d9f192220347d04ac5a94631e349ad330276b9524f775f7a8f68be7823ad7ed3ac4b4d87a12c0261846ec1dfe785b60675968e79496d7ae4e5d478661bd7125f2cc0de35422764556b63d687b339e2b25ad43ca85bc861944d19f9689dffe71d87030d23e0428942441d622de361778cbe8952f7b93c74783552b0087bff535afaf92935aa889018e46d34b2a258f863d89e4b6da841389fa63d489d135e559b7d11b8d97215323548501c275248eb07916ae3f0814c6af32f5ece7eb0330bdaac4394c518f3c8e48cafc36057cfa7788fb2f9a73bddb1d40546cf21b681e6c9ef6f0ac43c512762323209b2c878ed5a9f55e207b56a33c863eaa34a6eb14ad8de9885d52a7c073a406ea4324f8433ddfd89b269d6716072627054197928370ae01a94e3dd4d07125560a5cb1d1bfbbd8c099194de5f787a550a3400ce796e115702255d1f17d96a7fb63384ff497cf72beeb50bd24008ffc58256aec6b2faff2c20336e29bc1acd853214496893af25e8efb571c96edf64fbcd136c95e1213e73bc3f1a896fca2bde0894449ee2927c38114de5f1063d0c203c3fab1389861c4cda173a991eb275ccffe04f75d67df181c26777b18e5552b42fb4332046554109a9a6007592a62d2553dbd098f1daae593322e45f66a64bdb09869feede70d1fcc88fd4c19f4008d1b1d5f34a6025a71d9bf6ff20daccda25cbcc662cfc687ffe5ebc344468f338f4c9bbdc7ed9820feb5e3b09ace47f4253a81da7029816656613aef7456524fc68f4345bc0e7f26240d4594374d2fcb39560e2828e0e219b2417f5787add73418b465b1308d5ac5169791f55802d11354eb62940a492d955e8bd11b952a28acea90cb43af774e6fc75e57383e68937aa3643aa37f7e7665c703576579dcccf63d2bdadfbf14be796d4023689880453b0ff576fb01bb141be3c17478f0d555ca96ff7c3f3e4f53be1f088827203fab2008ec6687e4f5df305f58fe647b93ad09a70165c989498d313ca5ba05f3ce90adc80d55b56d0ec4cd5a78268cc6def7e8bb810bc29f8e742487048363815fa3fe645194ee8529ffba2b8d6756915530f142b42f31eae1703faeae14f3d81ae5c2297c3476b0f89b32f53802453fc74c80bf217097577a910a51860bbead4f73a29423816eadca7b1e2d24a9895949b352fe59f13abfa7b69c0f0061eaae2ada6d72b2f90c9c553ad8be9ee4e4ad2876851a3f3e979c4d770d7df9a27e72ab215ec3efd252d622e7ec6160ac951d1ee9b8c0adc0fc853f2a4f36602c955b61646246e07bd7b745f5d3e99f95f55a1616ed36633db6efa97a96dacf12219cf1555222cc6a589a6def5680124f7ac2f1ec83832a30fd011ff02dbf4ab01afb5989fcc678383f179b5d647cf0a762acf0714e9e4151afa39626884e6f56859d3aafc9fc7f7bbcfb27e038e238783cf56c86f0be52568c4bed0917d651f4d26f76ba6c343e075146504590da391e1c4d028dc81767294df5de9370d62756584baa3bfa31578b6f754e77b0d6ea7357d8915ff0bda182b604b014ecf7dc94ab97061765bfab2053fa863fb671fad3b6312d6e59ba0e70b0ea2476399e925f8fa2e51c9bbfac19aeb11db3dd6ea8d916c4d4eae7de17259e6155591be9b704d3e24cda131eded5e9dd6758dc90a5c7a43332957d26ac91bc65120b1c6b7b94fdf83b397bd8990747f01d3ed912abeab74bb5ae3ff2ee0009cfe8cdb6b4e75a7de3566c8ff7bdddb06b7775cf3116b029e7c85fb7189147e753d614caa490594ff2e22b7144153c635ac7b20a49c2d8575af2f546b968bea9fc4ee5ff417a6fa86ca09c8fed14ea4b721b2d5870d4b670761c70516daa07809ac3817246844f01eadda045c57d1c864cbaabedf90cb42d374392e77b3d1a1afdf962feb55a4e04a77c8fb452429007e0046a406a5f2325f0c7f75a19deed1b456ac5de6486eebbc126ff97c5ee8531a975676b61a0d79f56ff75cbcd20337119422815537a57766648777f1b5f75d358dc63764083406e2d95afd87d00099581940367ed029065df0d9008301fb92e019feac9bb406032167eb053ab07309385771aacc2c52a5d526d14721fd530e63cb7c53f27518c679ccd0f3d2db8aa52ef95c6ac3f5dac0b9b5c3a96a794690f3d49aa0e5a4a95b36609cf61d471cc2c0cd55e8cd96be47558b055280313b15907eba5761180f5229a59341faa1e11eb5b6a48ec9320efb1d9f00936d9a5d91f2bf837fe72edf6ec025c1c4e87171cc02c7342fa5d4f825157d70d8f66f6fa0542de2255373d8743612e7d4e16b8ceebf4e92c40926f21929cab343b981120236b8b0b900772a33bbe4eef06feff3c7b104cf63d92c7f9233982f9b713489fb8bf80f2feffd6c22007b63925209e158a837dc95b42d52ed764350b5f83ad54041bc15a7552c0b8c1933d674a16b0c0934277d9895c1ad01327231a7fffc4b5e1a1495489559bebff324d54f2894563a23b85d3bef62c356eb476e01e0c039287ca38626751f701ef4e20d951433940ce1138660589ff389dee9f85a7faebb9cc494bbe7138b413303af6e05806032d8131d5a25a5d7c0ed87906d92bdd87ce7d62c13989f3435ad77a29b721d8219d2cf530c2ec9edc3de9ce2dcd5053c38a6797de8d8cbd3596ed545d2dc6f825a0e65428dd73df96d5f3e40dbe5a62f0f440f712419d1558ef97bf1d0ca1d59fa1caf6ed0d422456848e196e94b4741b757935bc3aef3a46f53066dc7a74f42d539da2228fb8593ddb79ac977a8b67c0a6058efdbe23ba75fb2faf5b9f152e60b8a96ee19fbf0c417c89f882c53d389bf27a18b9e34b2a33aa27029cfed7a03335cf33d95ea803ad125237a9cc70520f18bc7e9f0c1432368a5304544f5d1e1599242bcd905f69f25cd0fcde391960fc57426e0bf22155ea315f0caee330bf3b7f4f4363f87146531175ad4f69002d46e95a48f714c9bbd9e39b95783406d477dabe03397d68e7af5ee623b4c05eb64120ca76af4f1d37348f93f39d8fa1d22fef874ce65b66f8a1aaff9db97520dab97eb8d1f99efef4d4c9704d181d687874ec4fbb400ed4ce050ac997c843e647bebeddc33eeb70201b3286ea25ad1bdb80dba1fc78a6883ecca84d17645be16bee32967bd487c6f5e0714ca819d5913436ac9aeeab4e5092ec1897dad39737365e8414246a81a731bf7d3ad8d789b42c651702b70ee786032356e3b9fc4402104ffbe55026c84e8ec5dd2a1860cefd0e7789ac2a47fa5ee9610dee980fa3c2fa7219b4e57642f31012b3e00e64285fda219fa9ca37955e3c25fd5872172ed2f5651d208897ed4e1d224243b2f241f24580e924e02cb60af5e14898028596400a770f94e67590df5fe99e9d170d061397f71f4202eca4c91c7fc27e2379358a8d9bfc28c2fb67842b0bd1e5e68e017b34084aa08e7453fc6b03bd42772643eae036f25f10e4da022818dc84f35eea2c07e4dbb41e861b8a4c6df4f0b4b785f0df55f863707a0563cdd5b9fcaa352b54071cd486cf4948575ddbe4654a566438922887a3bd304853a98283c7a4d7757cc6e8298b0121aca5fdb64d86996d8c0ddfa1ee4ccef1ee21dcf853bdb02471383f73ddae17dfef217c6a3f79b182fc36bdb47d1899e87bb4c4e490ad4a2724d223b31b889685355f349ca8bc62d39150ebccaba863bd72bf91d65cffe560eecf162b2440f9d74fe0fb3f8479fd8f6293f16e4d67b3ec30e83180444cec51d2b455a3ab2b6286d4fac1acba8b7b5026671fef497d5e050e0aa34dcecf2d06a9e4b60cdb3f9cbb7cadd73c817f255f8e2eb22d6283a7934e0fd64eaf52caab2d1862baf505889e4db1a1870f0049b3ada06d38af52535da352bedbf1e88e34595820cedd4559cbe0fe0578c557a62f56060d75c5a6806e384d3c274c218d57beecbd8e7832f3cc050668b44c1b8ff8cdcd2b85b5ecb9eca1dcc1204d27bc3689578eab43dac5658a1cfe75456b221c15ed26720a49829f96d501fda6d7839724207d6a5f6bb3d8390e90dd7c6b80e15e6b20b7c74ff3282c770eb1c77583fc97bdb5f2df62a74b3385e2e8ba06fc39730f1f02107477c215deb6c8599cdacc7c710b7b1a77afbe3b2a593f6eec5c8014dd366f5890a1a579e51d858cc8ef93aff098af9903b4e3633a3090a630e64be99f49d32d63d779f989d0198044717741d3bfab4242a05dae33f11ed6b1d850fb379f725fdb7b296d9d9b3024160d4fd735a77c8ab23f0816bfc2715a2561c3cee6e41cf79030c1500c09e75ebbd5a7aa8a0e4826542ad46a9350e969b357c142af13afdd8927cdce3d1f35493f6a7a14c5a20739d462d566fe3ab620f1ef323768bd871eb454dad947f2a871efa05d601cf9fb08d992caf6f4b0f652e13df7dfc658f50e0c9bfc3bf28114a51142f65e25435a32c8719fde2a3d5c4850e31ffa675fa44f9e54957d108e46a67a3b7d71b272ecb0385466e39238f6421b2fd6f33a258883a4501b63001ee9ecb9137162488051f7ff15e6f4be81ca31ffac70f48bcd3457fcb137a2f5108d908ba1d51b0fca7e14273b176af4b954837dc3d40b4341fd03063ee145dfc4456bb303bb0540db3aadb26240242f4a55cb9f6623b6e724e0f9d8b73d02c9fd9140873c0bb884e3cf4c844bad6f27388b56840b63d65ca760dbddf778e430e1f03c246e74e9b56a08a56617658f7fc42e3582f3181a720e51598d22062815ca3caebf36389a58278acc788035d8deb0b800180ef6537d92bfa18947cb18232bfd27e048fcd49d44c137f1d8a10294a6dd20251a00c379bb0936fcb5137c9f5a7a7404976c778912a37f1503deb27b85d3b1d886415a98348d3632c7eb4bf58fdfddd5b24407709474e4478c991a03ed8b456d9a71ec82f05791eb17425e0360493fb5ec343eba7e9c970f47f4cd85edda849cc524d42a11eaf29be950e621cd12e16e3a304516ce5c74a2b47a1baf1f3321b84318883bb023cb5f67dc3541a4d72ebb3316244f96cde4aebc1a77336a93d226c315ab02581123140e45373f40c8cfc7fb5d478607f9b38c2b95bcd55fb8a2047569ac7927b9e4208f75032abfe83442d2ca5db1ee8903888548b5fa9724520083052f8e652f1b0d39d031d2c61f63e5cfb98061b5b913dc6da26e690c85b07fa19b9bf83d124a5fcf96de21d9f00c9aaf2ec66580e4dd99c21c01b7557b7c6336cec525003157d3efdd16a52407b35225f65e44933d56c90dbeeffcfbe2b10bdd921a507592817043c88bab1882ac8863f8a73fed3310138ae56c9b5fb8aa22d5d6ab9e5ece2afb94c5054bdc8444b00a46d74716c21346f2dce31f180f3e01453d7a7aaf4200c4be278a2a88fbec4529a551189da822d1365c8ac70bd6c6cb3c3791e183eeba95e65f1f87c10b2f740bee2575807c486e3b7939f093d44693ac069089830afff26d7165712abb7ba5bf8aaa87a3d57c5670b3a45d707b87aa7689b18292d851cac59802b38bd7ab8e1c3b8a134db1a366aaa8f77a6e2c937f49961637d291970b4541e3405948ba2ef49b40f600e28861c54f06a2400f82ffb2b9a0d4c6da720f9fea31dbe3f42aa29bd126fcbfccb9d809c8bbd76d241fc2588963f10434b69e9415d20bea13c30a08b22f5f21bd945a11466d228848b7b68927725239142fc536f784b705d3bd318f5d5fce31ddd32eca57309b1f9e5cdb0164df0bc45d04db323ed272fef5e4e0554cbe0eef83999d6dd82b67a5de6986b7063851602f833a23946ffb004b9cb30f6af2108e2aee029aa3e4fd525597f4a8d0184750731821bf21aaf703753270d3f12d5ed5f7bdb47c891074a44c63bebe47c66aab7f24e422b5f549249f26cab0aac9484087871de53cdb6d575e0e7ea3c73de23460c5b1bbe1e838433de48ecc812c1e21861dc290f22733090b5d3f88910478bff51307e6d869b68a745255ca007b9f5dda63074845d4d8f03604ada7cb5f8c1bcad9f3a84bab71e6c109ef7bd8eb29ba18011430f28eee91aa83749594aa5c717c0d53e0ff68372284e356e55f9cf33716ade1e148beda327236f4005472600f99a1c2fbe10c5492d2e082d15fa962492b16029a222bce55a001b2726fad239160f3ed55e98343fa5266cd7f5e36158480430e2f802fbfa3aa6e7299ab0940eea91682c79fffb171a705a23b70173f0973ca0b0ea230b306418677be4e6bcca0e6cc7bdbf6a3a96090819d541f505402ce505b40bd7d012ffb6a62f2528c5d370b2d6d6cf4b49c6886d20a5cc94cbe5e7cdf012af5d27c0c89c190956d1aaf1911888b33f67341fe74a10cba3328b84e3c4b83bb8b25da32122ed8df7b831e77bf9528af4b0960a0abb420e931eead4dcf31849cafc6099e8a3053758200bdbb411346662442e8274bc9780fd69abb4ef9ddd292f791b846a5849610862453cdb9263ddc232492de5d24c2c52751223cb961bb9ba7c86988b2a5490c3540ada6ffb9ba287c3e15d228aa0a6491ceced135cb1533b31c0b8ca218ffe4e1a07f29b4557a05b447358350ebfdcff9793b2eb1d7e0ea082b1f4fde8207071a8beb8c1e5efc49e1153fb8fb21ebc46c4d5b404a743a54076e4987da1748a39c70c083960873ffa0b88d4cccae69cdf4630a78250db81141e216e2007b7aea7500ad3176ae8e22c5fce5f14f0aa581bbe520a6d6c5f504547b178e62236f54809dd43763107e49b0d44a7968dcdf73a8c3c395fecd8a557ab850bebf1a67e82714131e0380fd6684e8094783190ce491a03243d903b4488d574be3847b4219145f5aa05201b4bafcbe2c2c98fb4e968c15822e20c06e83b0fc24d8d30acc9e24b36cfd06ad1a073719bf3a92922111e76efac5a813faaca76acfb065ad4faf1efe403aee89bc149bfa4e907008fe5f81d4e795c7a646c2b48e79b7ba54ec42425978c4d084c3c1f66ccdf230515366b08cd506a210e92e75bf7adfbaada44b619feecc4427ca23e74b68abfe9796a6e9a1f540d6a438042f506c27bb4f4814c73541b38eb7d548010363cdf7b2b6faf1a41a10fb71bd206388f32777c6b8e3fd7f6cd76342a1fba80deba8100f878eb4e4a09287ce513bb6b1f445e3cbdf220ff5faceb36c3a7f1a1710e780b9772124e5728fed14bbe348f0f4831913ae69ff40c953cc6447babbcf55b08491357531dc9d86fbe5cd4fd0d6e03e5b71daca299a8d31c3596fb98d21acc09d03e3fe7cc1f13c3e8b49b9dd40b8397ae617b322951a4bd8fe8a1eff9f920b79ddad1639da4d4a18c12ca3b65430e41506198483d5a2a0bc058269e7575cd6dc8d1a0393748622369c107b8a5fe570a7795d98b75e23d4c05c39655c8b81a389b512461a20711487695b8d4ff2d81ab4fe8c884768cbb99640a9ec5b54d3cd13a90f318e0264038b7f91dd73205342400eb9d186ed30286ff7cb9e459341ee59638b253148cfa74bada6b959f185b5cf68a313ff757836aafbbdf1f4440ec0f44d99c3950a6e2fdc6b7d8c6120f921630b93ec31c216e93e6b3781d02ef2339dbea56125ffe79019b1689c25d35db7d3f3e5c613060400977a2f7e142b50591b2ae5738dfd208c0f4daeda71edd05beaf4fc0b128fd004bd2bf1cea1d6883b4287cab96354e8f34f9d3707763b731686cbe6c175848a9f4bdd7c2961d270d9ef63ac95aa0603d3612a8933660c303fd1a91b3eb700718cdf40a34795399a7812c89b44f7b223dbe8bb08e0c01c4bf740c95431445a6b6fae337df7778e834813b34e0e6d3f0e935fdd136e6ac50c8e11fffb518b06c734985f31884a411293a3a3757a6e5be3d2495916314dc072fc9c0dbefcb5100513df15c18e04b2ad744d660f9cb5f4c64eead30fdd52507bba003c625108e6cdfcd7a1b38e8fd4fef0d419f695904be3026aeb9bab1ad3566a0a46a2a2d092c75ae2cbad109a117b7db76b729aaab3a89bcef8a5e63008613414fa5ce56988bbe3e839ccb8e192c56115522620e0851fbd19790f3acf9669915ef0f1ca0a2ca8a5578747f2d6cbec07a7bc4128ae131b7685191d5cf05210cc4bca2dc6303747c72cc0e4165512cccd43c5a79800b84ca018190a70984d73056e2a8bbdea91fdfcda72d9f8705227c5c4fdef9e0b81948420cae7344ba872a85e2d47c1e40fefcaa8d246fac5c7abe90b2bf39ec601390dd0a8cacbe82fc1ba0cf13c3cd89220a42e82ce62ccdf63fcb1be53c91d36349c7d3aa30170dccd5262d9ee570581ae5c9f84cf5b32261d8f531f6df0636cea496c698f36aee3274f0f9dfb7d72c074530a2679d13e5cc1bfcd957be3eba04a12f8897507122fc74ad66a7f621012ea43878cfa9a2a3ed95581aebdf1ffd7a8985f65c63de9eab4286cb94e57e3076e4e2850faef69b1d9f75ff45227b9e1bcc256c0236dc63483cffb8d72543eb213b2e0a487217850ab3bf7213dabb360c35714dbab5604357ea7b23fc0ba27d0bd09dc09e7ac471088c58d28e3ef12c3054d8a017a5023f378ae81bbbf55228620e061ace44906cc82520bfac2e1d7f7e340f53215bcf6f6078d82266abaaf479e084e73f0600572a7d482a84633eefc6e196f27638e8f08c6a4c615ef98238895d2cffb221a800424e115b0e84b960424fe39a2f33a203eb42f7f5e70e8f73aa172a8adf1d977b176cae2750859c96692bdac1067b7a1b1496dbd7c8220f3f0b42938ba0779c9bfa414a0e6073556d651d526875a4cfa95e8e981f40fc6d8bdd4704a12f44612e8eb8842535edea3d609d929b3fc05c2b02bd44e02a732ba814caf9e03e0bd7f41a24b3b6e282d07d74de2ab968ac739e994c0265416a7347f44bb80d1948cf8c9a69409e850b13f379dd672eb34a732b0b1d7b67ef2ee1bcb686cc4d1f4512c1ffb105ad2e46d783e0ca5f97ef9e4ab2798ce1c29b0f3292fbf1001d9487adfc3b34b4329be6b72ebf7a62158e488bd7888060f1e562045ecf9388c492fe3e0a6ce9b92b5a3eb29c80cc69da72f7dc2f2ac730e5d82cc5b75cecdd0809db8f1cc17bf5b72ed46fa3038722b6369d9f9497b83cc2ea1d0ebea0ac1306a83249705ae0b1c0145af67388d2153dbcb8856971216ee8f3d0cc6f532f159e5e28c6308154bf8efe46333b30740e9d94993393a27eb263dc0d19f182913ffa3953a52847fe979b9e682d304944529131b02ed468c88b5aac0483ff22ad56f9630b4f6134f266ee446068edd079411571f7e77acf2035d483043b8ad85b6277dca9e590ca801dc1896acdfc88dcf3cf83fca85afefe6addd27131f8be0fd5a80a0723556639fff59d56453ec76d3ebad3f5cb04e7b758b13e3d64c2ff5c3b018f52ba9363e053ee2fd78e35b2a834a069953e759455047521ad6615ab87e6381f0363a4554b86dd14f5ab43eb6b3fff64d94af0949a9e5c63d8c8e883886e61bd36f5ca11dfe2c025290cd49f369f8a3f9023d5daa7410fba96927fd0b5d2c75e", 0x2000, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x90, 0x0, 0x4, {0x5, 0x3, 0x0, 0x4000000000008, 0xfffffffd, 0x6, {0x2, 0x6, 0x8, 0x100000000000, 0x7, 0x81, 0x8, 0x6, 0x2008, 0x8000, 0xe44, r3, r4, 0x5, 0x81}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000003080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000380)={0x10, 0x2c, 0x15, 0x70bd2b, 0x25dfdbff}, 0x10}], 0x1, 0x0, 0x0, 0x810}, 0x44800) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x880cc2, 0x20) close_range(r0, 0xffffffffffffffff, 0x0) 384.32201ms ago: executing program 7 (id=2975): recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1a, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r2, 0xae80, 0x0) migrate_pages(0x0, 0x9, &(0x7f0000000040)=0x9, &(0x7f0000000380)=0x102) openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000000)={0x0, 0x2710}, 0x10) 39.408218ms ago: executing program 1 (id=2976): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, 0x0, 0x650) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="08030000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="9c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00120000009404006c0012800b00010062726964676500005c0002800c001e00000000000000000005002a00ff0000000500260001000000050019000000000008001a00d80300000c001f0000000000000000000500240000000000050024000100000008001a0007000000050007000700000008000a00", @ANYRES32=r2], 0x9c}}, 0x40) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r5, @ANYBLOB="010000"], 0x3c}}, 0x0) 0s ago: executing program 3 (id=2977): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x28100, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/partitions\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000440)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x2, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x5, 0xfffffffffffffffa, 0x4004, 0x2, 0x200, 0xefffffffffffffff, 0x0, 0x0, 0x2000000, 0x0, 0x1c, 0x0, 0xffffffffffffffff, 0x6, 0xc], 0x0, 0x41901}) ioctl$KVM_RUN(r3, 0xae80, 0x0) kernel console output (not intermixed with test programs): d to sync IRQ enable register: -EPIPE [ 411.032499][T12556] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 411.988169][ T5838] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000400. ret = -EPROTO [ 412.023559][ T5838] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 412.064981][ T5838] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 412.086070][ T5838] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 412.152297][T12570] cgroup: fork rejected by pids controller in /syz4 [ 412.273147][ T5838] usb 6-1: USB disconnect, device number 22 [ 415.696126][T12662] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 415.706624][T12662] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 416.077331][ T5838] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 416.247932][ T5838] usb 5-1: Using ep0 maxpacket: 16 [ 416.254771][ T5838] usb 5-1: config 0 has no interfaces? [ 416.264624][ T5838] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 416.277367][ T5838] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 416.296488][ T5838] usb 5-1: Manufacturer: syz [ 416.305047][ T5838] usb 5-1: config 0 descriptor?? [ 416.617949][ T8733] usb 5-1: USB disconnect, device number 38 [ 417.703397][T12711] syzkaller0: entered promiscuous mode [ 417.709269][T12711] syzkaller0: entered allmulticast mode [ 419.485578][ T8722] usb 4-1: new high-speed USB device number 30 using dummy_hcd [ 419.640878][ T8722] usb 4-1: Using ep0 maxpacket: 16 [ 419.661481][ T8722] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 419.675664][ T8722] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 419.745146][ T8722] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 419.897453][ T8722] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 419.906664][ T8722] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.918373][ T8722] usb 4-1: config 0 descriptor?? [ 420.412825][ T8722] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.001A/input/input27 [ 420.468124][ T8722] microsoft 0003:045E:07DA.001A: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 420.569322][T12763] No buffer was provided with the request [ 420.584010][ T8722] usb 4-1: USB disconnect, device number 30 [ 420.721969][T12765] fido_id[12765]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 421.463636][T12778] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2136'. [ 421.517437][T12778] netlink: 76 bytes leftover after parsing attributes in process `syz.6.2136'. [ 421.587519][T12778] bridge0: entered promiscuous mode [ 421.597455][T12778] bridge0: entered allmulticast mode [ 421.613678][T12778] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2136'. [ 422.267382][ T5848] Bluetooth: hci0: command 0x0406 tx timeout [ 422.275229][T12752] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 423.131638][T12752] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 423.140389][T12752] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 423.277650][T12799] binder: 12798:12799 ioctl c0306201 200000000080 returned -14 [ 423.538051][T12809] fuse: Bad value for 'fd' [ 424.426985][ T5848] Bluetooth: hci2: command 0x0406 tx timeout [ 425.147379][ T5848] Bluetooth: hci4: command 0x0c1a tx timeout [ 425.597323][ T8733] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 425.747884][ T8733] usb 7-1: Using ep0 maxpacket: 8 [ 425.771727][ T8733] usb 7-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 425.792052][ T8733] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.955077][ T8733] usb 7-1: Product: syz [ 425.964182][ T8733] usb 7-1: Manufacturer: syz [ 425.972749][ T8733] usb 7-1: SerialNumber: syz [ 426.070421][ T8733] usb 7-1: config 0 descriptor?? [ 426.096793][ T8733] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 426.103903][T12838] syzkaller1: entered promiscuous mode [ 426.127298][T12838] syzkaller1: entered allmulticast mode [ 426.917537][T12861] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6erspan0 [ 426.967286][ T8722] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 427.147517][ T8722] usb 6-1: Using ep0 maxpacket: 8 [ 427.159171][ T8722] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 427.177264][ T8722] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 427.186247][ T8722] usb 6-1: Product: syz [ 427.190514][ T8722] usb 6-1: Manufacturer: syz [ 427.195120][ T8722] usb 6-1: SerialNumber: syz [ 427.209580][ T8722] usb 6-1: config 0 descriptor?? [ 427.420273][ T8722] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 427.893581][ T8733] gspca_sonixj: reg_r err -71 [ 427.937540][ T8733] sonixj 7-1:0.0: probe with driver sonixj failed with error -71 [ 427.950251][ T8733] usb 7-1: USB disconnect, device number 24 [ 427.998179][ T5838] usb 4-1: new full-speed USB device number 31 using dummy_hcd [ 428.159045][ T5838] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 428.170322][ T5838] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 127, setting to 64 [ 428.181599][ T5838] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 428.190809][ T5838] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 428.201966][T12877] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 428.210583][T12877] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 428.220926][ T5838] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 428.428779][ T8733] usb 4-1: USB disconnect, device number 31 [ 428.443445][ T8722] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 428.484752][ T8722] usb 6-1: USB disconnect, device number 23 [ 429.062576][T12898] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 429.627766][ T8722] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 429.778983][ T5838] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 429.797260][ T8722] usb 2-1: Using ep0 maxpacket: 8 [ 429.813974][ T8722] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 429.967520][ T8722] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 429.976614][ T8722] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.996008][ T8722] usb 2-1: config 0 descriptor?? [ 430.027644][ T5838] usb 4-1: Using ep0 maxpacket: 16 [ 430.043216][ T5838] usb 4-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 430.067024][ T5838] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.077597][ T5838] usb 4-1: Product: syz [ 430.081817][ T5838] usb 4-1: Manufacturer: syz [ 430.086451][ T5838] usb 4-1: SerialNumber: syz [ 430.107490][ T5838] usb 4-1: config 0 descriptor?? [ 430.209017][T12923] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2188'. [ 430.209554][ T8722] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 430.219327][T12923] bridge_slave_1: left allmulticast mode [ 430.236426][T12923] bridge_slave_1: left promiscuous mode [ 430.242877][T12923] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.253982][T12923] bridge_slave_0: left allmulticast mode [ 430.260150][T12923] bridge_slave_0: left promiscuous mode [ 430.266522][T12923] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.433084][ T8722] usb 2-1: USB disconnect, device number 21 [ 430.433155][ C1] iowarrior 2-1:0.0: iowarrior_callback - usb_submit_urb failed with result -19 [ 430.447250][ T783] usb 6-1: new full-speed USB device number 24 using dummy_hcd [ 430.524571][ T5838] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 430.539421][ T5838] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 430.559421][ T5838] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 430.570345][ T5838] usb 4-1: media controller created [ 430.575748][ T30] audit: type=1326 audit(1764688419.345:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.617730][ T30] audit: type=1326 audit(1764688419.345:205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.621379][ T783] usb 6-1: config 0 has no interfaces? [ 430.654251][ T783] usb 6-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 430.664059][ T783] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 430.666955][ T5838] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 430.673791][ T783] usb 6-1: Product: syz [ 430.685225][ T783] usb 6-1: Manufacturer: syz [ 430.690152][ T783] usb 6-1: SerialNumber: syz [ 430.709617][ T30] audit: type=1326 audit(1764688419.345:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.712768][ T783] usb 6-1: config 0 descriptor?? [ 430.767677][ T30] audit: type=1326 audit(1764688419.345:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.808874][ T30] audit: type=1326 audit(1764688419.345:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.840494][ T30] audit: type=1326 audit(1764688419.345:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.864887][ T30] audit: type=1326 audit(1764688419.345:210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.891123][ T30] audit: type=1326 audit(1764688419.345:211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.915303][ T30] audit: type=1326 audit(1764688419.345:212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 430.973330][ T30] audit: type=1326 audit(1764688419.355:213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12927 comm="syz.4.2190" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe320d8f749 code=0x7ffc0000 [ 431.035410][ T5838] zl10353_read_register: readreg error (reg=127, ret==0) [ 431.042591][ T5838] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 431.080878][ T5838] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 431.123803][ T5838] usb 4-1: USB disconnect, device number 32 [ 431.167714][ T8733] usb 6-1: USB disconnect, device number 24 [ 431.201204][ T5838] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 433.927854][ T783] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 433.965459][T12976] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2107136741 (134856751424 ns) > initial count (31747348608 ns). Using initial count to start timer. [ 434.047300][ T5838] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 434.088666][ T783] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 434.116774][ T783] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 434.145399][ T783] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 434.167321][ T783] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 434.186685][ T783] usb 2-1: SerialNumber: syz [ 434.421443][ T5838] usb 6-1: Using ep0 maxpacket: 16 [ 434.430291][ T5838] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 434.450157][ T5838] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 434.543317][ T5838] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 434.553922][ T5838] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.679592][ T5838] usb 6-1: Product: syz [ 434.683797][ T5838] usb 6-1: Manufacturer: syz [ 434.687124][ T783] usb 2-1: 0:2 : does not exist [ 434.858892][ T5838] usb 6-1: SerialNumber: syz [ 435.175593][ T783] usb 2-1: USB disconnect, device number 22 [ 435.185271][ T5838] usb 6-1: 0:2 : does not exist [ 435.204525][ T5838] usb 6-1: 5:0: failed to get current value for ch 0 (-22) [ 435.285413][ T5838] usb 6-1: USB disconnect, device number 25 [ 435.397091][ T7325] udevd[7325]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 436.037763][ T5838] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 436.196107][T12998] pimreg: entered allmulticast mode [ 436.213871][T12998] pimreg: left allmulticast mode [ 436.227715][ T5838] usb 5-1: Using ep0 maxpacket: 32 [ 436.241252][ T5838] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 436.277388][ T5838] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 436.475548][T13006] kvm: apic: phys broadcast and lowest prio [ 436.559927][T13006] kvm: apic: phys broadcast and lowest prio [ 436.595192][ T5838] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 436.606440][ T5838] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 436.658822][ T5838] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 436.677506][ T5838] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.697733][ T5838] usb 5-1: Product: syz [ 436.706919][ T5838] usb 5-1: Manufacturer: syz [ 436.743218][ T5838] usb 5-1: SerialNumber: syz [ 436.789900][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 436.802187][ T5838] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input28 [ 437.013412][ T5838] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 437.024272][ T5838] (id 0x00) [ 437.198400][ T5838] rc_core: IR keymap rc-imon-pad not found [ 437.204259][ T5838] Registered IR keymap rc-empty [ 437.231071][ T5838] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 437.247899][ T5838] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 437.293124][ T5838] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 437.319117][ T5838] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input29 [ 437.343176][ T5838] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:39> initialized [ 438.017660][ T8733] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 438.643547][ T8733] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 438.729391][ T8733] usb 4-1: config 1 has no interface number 0 [ 438.735610][ T8733] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1024 [ 438.753949][ T8733] usb 4-1: config 1 interface 7 altsetting 0 has a duplicate endpoint with address 0x6, skipping [ 438.775045][ T8733] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 438.826215][ T8733] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 438.886215][ T8733] usb 4-1: Product: syz [ 438.907887][ T8733] usb 4-1: Manufacturer: syz [ 438.912527][ T8733] usb 4-1: SerialNumber: syz [ 438.940460][T13045] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 438.957646][T13045] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 439.089673][ T783] usb 5-1: USB disconnect, device number 39 [ 439.098910][T13058] imon:send_packet: packet tx failed (-71) [ 439.120279][ T8733] usb 4-1: Expected 3 endpoints, found: 2 [ 439.137407][T13058] imon:vfd_write: send packet #4 failed [ 439.319238][ T5838] usb 4-1: USB disconnect, device number 33 [ 440.034634][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.041192][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.605762][T13107] syzkaller0: entered promiscuous mode [ 441.633970][T13107] syzkaller0: entered allmulticast mode [ 441.647789][ T8733] usb 2-1: new low-speed USB device number 23 using dummy_hcd [ 441.810860][ T8733] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 441.822241][ T8733] usb 2-1: config 0 has no interface number 0 [ 441.830579][ T8733] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 441.873247][ T8733] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 441.898206][ T8733] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 441.907722][ T8733] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 441.917836][ T8733] usb 2-1: config 0 descriptor?? [ 441.969391][T13103] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 442.000379][ T8733] iowarrior 2-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 442.818265][ T8733] usb 2-1: USB disconnect, device number 23 [ 443.090264][T13141] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 444.137287][ T5927] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 444.307429][ T5927] usb 5-1: Using ep0 maxpacket: 32 [ 444.314335][ T5927] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 444.334178][ T5927] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 444.361136][ T5927] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 444.382351][ T5927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 444.406172][ T5927] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 444.445892][ T5927] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 444.475093][ T5927] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 444.485039][ T5927] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.515689][ T5927] usb 5-1: config 0 descriptor?? [ 444.759109][ T5927] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 40 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 444.815097][ T5927] usb 5-1: USB disconnect, device number 40 [ 444.861811][ T5927] usblp0: removed [ 444.889205][T13175] netlink: 'syz.6.2265': attribute type 1 has an invalid length. [ 444.913345][T13175] netlink: 1156 bytes leftover after parsing attributes in process `syz.6.2265'. [ 445.302619][ T5927] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 445.647788][T13171] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 445.657595][ T5927] usb 5-1: Using ep0 maxpacket: 32 [ 445.674371][ T5927] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 445.705450][ T5927] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 445.757360][ T5927] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 445.781934][ T5927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 445.797516][ T5927] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 445.823147][ T5927] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 445.836577][ T5927] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 445.845781][ T5927] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 445.868340][ T5927] usb 5-1: config 0 descriptor?? [ 446.089071][ T5927] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 41 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 446.199073][T13195] 8021q: adding VLAN 0 to HW filter on device bond2 [ 446.223085][T13197] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 446.299097][T13197] bond2: (slave macvlan0): making interface the new active one [ 446.321667][T13197] bond2: (slave macvlan0): Enslaving as an active interface with an up link [ 446.360382][ C1] usblp0: nonzero read bulk status received: -71 [ 446.362417][ T8733] usb 5-1: USB disconnect, device number 41 [ 446.372710][T13159] usblp0: error -71 reading from printer [ 446.420587][ T8733] usblp0: removed [ 446.616064][T13210] sch_tbf: burst 274 is lower than device lo mtu (65550) ! [ 447.167940][ T8733] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 447.347323][ T8733] usb 6-1: Using ep0 maxpacket: 16 [ 447.408877][ T8733] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 447.427327][ T8733] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 447.461516][ T8733] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 447.480803][ T8733] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 447.488994][ T8733] usb 6-1: Manufacturer: syz [ 447.528792][ T8733] usb 6-1: config 0 descriptor?? [ 448.365003][ T5927] usb 6-1: USB disconnect, device number 26 [ 448.757352][ T8733] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 448.967549][ T8733] usb 7-1: Using ep0 maxpacket: 32 [ 449.000230][ T8733] usb 7-1: unable to get BOS descriptor or descriptor too short [ 449.009530][ T8733] usb 7-1: config 128 has an invalid interface number: 127 but max is 3 [ 449.018224][ T8733] usb 7-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 449.039917][ T8733] usb 7-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 449.053205][ T8733] usb 7-1: config 128 has no interface number 0 [ 449.113188][T13256] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2291'. [ 449.123232][ T8733] usb 7-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid maxpacket 1828, setting to 1024 [ 449.164231][ T8733] usb 7-1: config 128 interface 127 has no altsetting 0 [ 449.232790][ T8733] usb 7-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 449.245833][ T8733] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.262032][ T8733] usb 7-1: Product: syz [ 449.272418][ T8733] usb 7-1: Manufacturer: syz [ 449.325979][ T8733] usb 7-1: SerialNumber: syz [ 449.355660][T13236] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 449.454984][T13256] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2291'. [ 449.716404][ T8733] usb 7-1: USB disconnect, device number 25 [ 449.822689][ T5982] udevd[5982]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 450.550653][T13286] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2301'. [ 450.623873][T13286] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2301'. [ 450.637567][T13286] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2301'. [ 452.157292][ T5927] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 452.312198][ T5927] usb 6-1: Using ep0 maxpacket: 8 [ 452.324065][ T5927] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 452.351729][ T5927] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 452.423058][ T5927] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 452.532401][ T5927] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 452.611755][ T5927] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 452.638913][ T5927] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 452.864166][ T5927] usb 6-1: GET_CAPABILITIES returned 0 [ 452.870427][ T5927] usbtmc 6-1:16.0: can't read capabilities [ 453.098985][ T5927] usb 6-1: USB disconnect, device number 27 [ 454.577395][ T5927] usb 7-1: new full-speed USB device number 26 using dummy_hcd [ 454.609243][T13371] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2326'. [ 454.693187][T13371] 8021q: adding VLAN 0 to HW filter on device bond2 [ 454.716131][T13375] netlink: 'syz.3.2326': attribute type 10 has an invalid length. [ 454.737771][ T5927] usb 7-1: config 0 has an invalid interface number: 52 but max is 0 [ 454.745969][ T5927] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 454.766598][ T5927] usb 7-1: config 0 has no interface number 0 [ 454.777064][ T5927] usb 7-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 454.784051][T13375] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2326'. [ 454.788700][ T5927] usb 7-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid wMaxPacketSize 0 [ 454.809036][ T5927] usb 7-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 454.863391][ T5927] usb 7-1: config 0 interface 52 has no altsetting 0 [ 454.979361][ T5927] usb 7-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 454.986089][T13375] ipvlan0: entered promiscuous mode [ 455.018035][T13375] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 455.051074][ T5927] usb 7-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 455.079417][ T5927] usb 7-1: Manufacturer: syz [ 455.096208][ T5927] usb 7-1: config 0 descriptor?? [ 455.319090][T13364] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.349663][T13364] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.398846][ T5927] synaptics_usb 7-1:0.52: synusb_open - usb_submit_urb failed, error: -90 [ 455.439812][ T5927] synaptics_usb 7-1:0.52: probe with driver synaptics_usb failed with error -5 [ 455.633670][ T5927] usb 7-1: USB disconnect, device number 26 [ 455.847743][T13406] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2337'. [ 457.302278][T13431] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 457.313228][T13432] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2346'. [ 457.397660][T13435] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2346'. [ 457.559365][T13432] 8021q: adding VLAN 0 to HW filter on device bond4 [ 458.160287][ T5927] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 458.347380][ T5927] usb 6-1: Using ep0 maxpacket: 16 [ 458.355007][ T5927] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 458.372823][ T5927] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 458.388944][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.416555][ T5927] usb 6-1: Product: syz [ 458.427341][ T5927] usb 6-1: Manufacturer: syz [ 458.437284][ T8733] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 458.448984][ T5927] usb 6-1: SerialNumber: syz [ 458.463618][ T5927] usb 6-1: config 0 descriptor?? [ 458.482508][ T5927] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 458.522631][ T5927] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 458.599783][ T8733] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 458.613224][ T8733] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 458.635661][ T8733] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 458.657552][ T8733] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.696039][ T8733] usb 2-1: config 0 descriptor?? [ 459.080475][ T5927] em28xx 6-1:0.0: chip ID is em2765 [ 459.145740][ T8733] usbhid 2-1:0.0: can't add hid device: -71 [ 459.164613][ T8733] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 459.197544][ T8722] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 459.223184][ T8733] usb 2-1: USB disconnect, device number 24 [ 459.367969][ T8722] usb 7-1: Using ep0 maxpacket: 16 [ 459.380068][ T8722] usb 7-1: config 0 has an invalid interface number: 41 but max is 0 [ 459.392019][ T8722] usb 7-1: config 0 has no interface number 0 [ 459.402806][ T8722] usb 7-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 459.420636][ T8722] usb 7-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 459.441687][ T8722] usb 7-1: config 0 interface 41 has no altsetting 0 [ 459.453094][ T8722] usb 7-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 459.462539][ T8722] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.478973][ T8722] usb 7-1: Product: syz [ 459.490493][ T8722] usb 7-1: Manufacturer: syz [ 459.498944][ T8722] usb 7-1: SerialNumber: syz [ 459.514918][ T8722] usb 7-1: config 0 descriptor?? [ 459.524354][T13457] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 459.532171][T13457] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 459.755015][T13457] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 459.777393][T13457] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 459.791410][ T5927] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 459.804786][ T5927] em28xx 6-1:0.0: board has no eeprom [ 460.421971][ T8722] CoreChips 7-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 460.907130][T13481] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 460.910118][T13442] em28xx 6-1:0.0: writing to i2c device at 0xfffe failed (error=-5) [ 460.968061][ T5927] em28xx 6-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 460.975925][ T5927] em28xx 6-1:0.0: dvb set to bulk mode. [ 460.985155][ T5838] em28xx 6-1:0.0: Binding DVB extension [ 461.027524][ T5927] usb 6-1: USB disconnect, device number 28 [ 461.054659][ T5927] em28xx 6-1:0.0: Disconnecting em28xx [ 461.069680][ T5838] em28xx 6-1:0.0: Registering input extension [ 461.107479][ T5927] em28xx 6-1:0.0: Closing input extension [ 461.139330][ T5927] em28xx 6-1:0.0: Freeing device [ 461.768781][ T8722] CoreChips 7-1:0.41 (unnamed net_device) (uninitialized): Error reading RX_CTL register:ffffffb9 [ 461.779930][ T8722] CoreChips 7-1:0.41 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0000:ffffffb9 [ 461.818183][ T8722] CoreChips 7-1:0.41: probe with driver CoreChips failed with error -71 [ 461.852725][ T8722] usb 7-1: USB disconnect, device number 27 [ 463.917715][T13525] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2372'. [ 464.668346][ T8734] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 464.831024][ T8734] usb 2-1: Using ep0 maxpacket: 32 [ 464.838965][ T8734] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 464.849689][ T8734] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 464.861679][ T8734] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 464.874949][ T8734] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 464.913649][ T8734] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 464.923865][ T8734] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.940726][ T8734] usb 2-1: Product: syz [ 464.945227][ T8734] usb 2-1: Manufacturer: syz [ 464.949972][ T8734] usb 2-1: SerialNumber: syz [ 464.960785][ C0] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 464.970746][ T8734] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input32 [ 465.187356][ T8734] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 465.200875][ T8734] (id 0x00) [ 465.338311][ T8734] rc_core: IR keymap rc-imon-pad not found [ 465.351425][ T8734] Registered IR keymap rc-empty [ 465.356596][ T8734] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 465.367613][ T8734] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 465.398359][ T8734] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0 [ 465.418308][ T8734] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0/input33 [ 465.474649][ T8734] imon 2-1:155.0: iMON device (15c2:ffdc, intf0) on usb<2:25> initialized [ 466.020696][T13524] veth1_to_bond: entered promiscuous mode [ 466.026743][T13524] veth1_to_bond: left promiscuous mode [ 468.028146][T13573] imon:send_packet: task interrupted [ 468.038194][T13573] imon:send_packet: packet tx failed (-512) [ 468.047561][ T8722] usb 2-1: USB disconnect, device number 25 [ 468.113931][T13573] imon:vfd_write: send packet #1 failed [ 468.545430][T13592] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2391'. [ 468.597844][ T5848] Bluetooth: hci0: ACL packet for unknown connection handle 201 [ 468.989686][T13599] xt_CT: No such helper "pptp" [ 470.138403][ T5927] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 470.307320][ T5927] usb 4-1: Using ep0 maxpacket: 8 [ 470.320831][T13636] batadv_slave_1: entered promiscuous mode [ 470.330483][ T5927] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 470.349984][T13636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2402'. [ 470.359561][ T5927] usb 4-1: config 0 has no interface number 0 [ 470.366151][ T5927] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 470.381596][ T5927] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 470.394440][ T5927] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 470.418891][ T5927] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 470.440763][ T5927] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 470.452775][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 470.463402][T13636] batadv_slave_1 (unregistering): left promiscuous mode [ 470.478992][ T5927] usb 4-1: config 0 descriptor?? [ 470.487767][T13636] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 470.507011][ T5927] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 470.831933][ T5927] usb 4-1: USB disconnect, device number 34 [ 470.868148][ T5927] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 471.456133][ T5848] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 471.520148][T13658] netlink: 'syz.3.2408': attribute type 4 has an invalid length. [ 471.668452][T13661] netlink: 'syz.3.2408': attribute type 4 has an invalid length. [ 473.848316][T13683] binder: 13682:13683 ioctl c0306201 200000000680 returned -14 [ 476.195360][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 476.195377][ T30] audit: type=1326 audit(1764688464.965:247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.296201][ T30] audit: type=1326 audit(1764688464.965:248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.359031][ T30] audit: type=1326 audit(1764688464.965:249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.471202][ T30] audit: type=1326 audit(1764688464.965:250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.535378][ T30] audit: type=1326 audit(1764688464.965:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.559077][ T30] audit: type=1326 audit(1764688464.965:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.664740][ T30] audit: type=1326 audit(1764688464.965:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.664931][T13734] netlink: 'syz.4.2431': attribute type 10 has an invalid length. [ 476.708439][T13734] veth1_macvtap: left promiscuous mode [ 476.749322][T13734] team0: Device veth1_macvtap failed to register rx_handler [ 476.765141][ T30] audit: type=1326 audit(1764688464.965:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.822033][ T30] audit: type=1326 audit(1764688464.965:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.879204][ T30] audit: type=1326 audit(1764688464.965:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13719 comm="syz.3.2426" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7a2578f749 code=0x7ffc0000 [ 476.959397][T13742] kvm: pic: non byte write [ 479.372768][T13766] netlink: 'syz.6.2440': attribute type 1 has an invalid length. [ 479.492868][T13768] bond3: (slave vcan1): The slave device specified does not support setting the MAC address [ 479.577709][T13768] bond3: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 479.640479][T13768] bond3: (slave vcan1): making interface the new active one [ 479.690090][T13768] bond3: (slave vcan1): Enslaving as an active interface with an up link [ 479.733890][T13771] bond3: entered allmulticast mode [ 479.759535][T13771] vcan1: entered allmulticast mode [ 480.647376][ T8733] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 480.801445][ T8733] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 480.824059][ T8733] usb 2-1: config 0 interface 0 altsetting 8 endpoint 0x81 has invalid wMaxPacketSize 0 [ 480.911194][ T8733] usb 2-1: config 0 interface 0 has no altsetting 0 [ 480.977990][ T8733] usb 2-1: New USB device found, idVendor=044f, idProduct=b651, bcdDevice= 0.00 [ 480.993781][ T8733] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.008885][ T8733] usb 2-1: config 0 descriptor?? [ 481.556069][ T8733] thrustmaster 0003:044F:B651.001B: unknown main item tag 0x0 [ 481.607441][ T8733] thrustmaster 0003:044F:B651.001B: unknown main item tag 0x0 [ 481.615023][ T8733] thrustmaster 0003:044F:B651.001B: item fetching failed at offset 2/7 [ 481.635995][ T8733] thrustmaster 0003:044F:B651.001B: parse failed [ 481.644116][ T8733] thrustmaster 0003:044F:B651.001B: probe with driver thrustmaster failed with error -22 [ 481.807647][ T8722] usb 2-1: USB disconnect, device number 26 [ 481.964251][T13802] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2448'. [ 482.907492][ T8722] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 482.977311][ T5927] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 483.119738][ T8722] usb 7-1: unable to get BOS descriptor or descriptor too short [ 483.134679][ T8722] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 483.142560][ T5927] usb 6-1: Using ep0 maxpacket: 8 [ 483.152882][ T5927] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 483.162302][ T8722] usb 7-1: can't read configurations, error -71 [ 483.170982][ T5927] usb 6-1: config 0 has no interface number 0 [ 483.184670][ T5927] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 483.201796][ T5927] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 483.214804][ T5927] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 483.227565][ T5927] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 483.248055][ T5927] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 483.261218][ T5927] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 483.283178][ T5927] usb 6-1: config 0 descriptor?? [ 483.319830][ T5927] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 483.631504][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 483.631522][ T30] audit: type=1804 audit(1764688472.405:266): pid=13823 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2457" name="/newroot/526/file0" dev="fuse" ino=1 res=1 errno=0 [ 483.681099][ T8733] usb 6-1: USB disconnect, device number 29 [ 483.704898][ T8733] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 483.878274][ T5838] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 484.199800][ T5838] usb 4-1: Using ep0 maxpacket: 32 [ 484.306169][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0 [ 484.315868][ T5838] usb 4-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 484.325046][ T5838] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.358404][ T5838] usb 4-1: Product: syz [ 484.372556][ T5838] usb 4-1: Manufacturer: syz [ 484.392918][ T5838] usb 4-1: SerialNumber: syz [ 484.414174][ T5838] usb 4-1: config 0 descriptor?? [ 484.896374][ T5838] gs_usb 4-1:0.0: Configuring for 89 interfaces [ 485.092197][ T5838] gs_usb 4-1:0.0: Couldn't get bit timing const for channel 0 (-EPROTO) [ 485.108838][ T5838] gs_usb 4-1:0.0: probe with driver gs_usb failed with error -71 [ 485.163902][ T5838] usb 4-1: USB disconnect, device number 35 [ 486.080725][ T8733] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 486.107475][ T8734] usb 5-1: new full-speed USB device number 42 using dummy_hcd [ 486.237414][ T8733] usb 4-1: Using ep0 maxpacket: 8 [ 486.253727][ T8733] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 486.263764][ T8733] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 486.275065][ T8734] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 486.286142][ T8734] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 486.307287][ T8733] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 486.320914][ T8734] usb 5-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 486.330453][ T8733] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 486.348998][ T8734] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.359299][ T8733] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 486.369552][ T8734] usb 5-1: config 0 descriptor?? [ 486.375457][ T8733] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.700600][ T8733] usb 4-1: GET_CAPABILITIES returned 0 [ 486.706137][ T8733] usbtmc 4-1:16.0: can't read capabilities [ 486.795432][ T8734] uclogic 0003:5543:0064.001C: item fetching failed at offset 0/1 [ 486.819344][ T8734] uclogic 0003:5543:0064.001C: parse failed [ 486.825388][ T8734] uclogic 0003:5543:0064.001C: probe with driver uclogic failed with error -22 [ 486.847861][ T5838] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 486.967323][ T783] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 487.007462][ T5838] usb 6-1: Using ep0 maxpacket: 32 [ 487.015642][ T5838] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 487.029873][ T5838] usb 6-1: config 0 has no interface number 0 [ 487.030100][ T8734] usb 5-1: USB disconnect, device number 42 [ 487.040790][ T5838] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 487.115571][ T5838] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.126172][ T5838] usb 6-1: Product: syz [ 487.132955][ T5838] usb 6-1: Manufacturer: syz [ 487.140191][ T5838] usb 6-1: SerialNumber: syz [ 487.171285][ T5838] usb 6-1: config 0 descriptor?? [ 487.185544][ T5838] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 487.200972][ T783] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 487.212770][ T783] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 487.223593][ T783] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 487.232801][ T783] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.256313][ T783] usb 7-1: config 0 descriptor?? [ 487.416931][ T5838] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 487.457628][ T5838] usb 6-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 487.843400][ C1] usb 6-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 487.854143][ T5838] usb 6-1: USB disconnect, device number 30 [ 487.868723][ T5838] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 487.908982][ T5838] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 488.016361][ T5838] quatech2 6-1:0.51: device disconnected [ 488.108747][ T783] usbhid 7-1:0.0: can't add hid device: -71 [ 488.121452][ T783] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 488.140786][ T783] usb 7-1: USB disconnect, device number 30 [ 488.303413][T13879] syzkaller0: entered promiscuous mode [ 488.312313][T13879] syzkaller0: entered allmulticast mode [ 488.735369][ T5927] usb 4-1: USB disconnect, device number 36 [ 491.039935][T13918] netlink: 'syz.3.2486': attribute type 1 has an invalid length. [ 491.181777][T13920] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2486'. [ 492.002336][T13918] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 492.004156][T13919] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 492.120755][T13929] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2489'. [ 492.262606][T13933] syzkaller0: entered promiscuous mode [ 492.275340][T13938] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2489'. [ 492.277466][T13933] syzkaller0: entered allmulticast mode [ 492.417413][ T783] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 492.597399][ T783] usb 5-1: Using ep0 maxpacket: 16 [ 492.605058][ T783] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 492.630749][ T783] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 492.650498][ T783] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 492.660666][ T783] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.669014][ T783] usb 5-1: Product: syz [ 492.673428][ T783] usb 5-1: Manufacturer: syz [ 492.678284][ T783] usb 5-1: SerialNumber: syz [ 492.911829][ T783] usb 5-1: 0:2 : does not exist [ 492.929510][ T783] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 492.969315][ T783] usb 5-1: USB disconnect, device number 43 [ 493.045315][T13787] udevd[13787]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 493.947687][ T5927] usb 4-1: new high-speed USB device number 37 using dummy_hcd [ 494.102200][ T5927] usb 4-1: Using ep0 maxpacket: 16 [ 494.109688][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 494.123162][ T5927] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 494.132943][ T5927] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.141435][ T5927] usb 4-1: Product: syz [ 494.145788][ T5927] usb 4-1: Manufacturer: syz [ 494.151216][ T5927] usb 4-1: SerialNumber: syz [ 494.164902][ T5927] usb 4-1: config 0 descriptor?? [ 494.174343][ T5927] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 494.184478][ T5927] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 494.784100][ T5927] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 494.947483][ T5838] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 495.109797][ T5838] usb 6-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 495.137304][ T5838] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.166603][ T5838] usb 6-1: config 0 descriptor?? [ 495.203493][ T5838] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 495.214658][ T5927] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 495.229142][ T5927] em28xx 4-1:0.0: board has no eeprom [ 496.280098][T13959] em28xx 4-1:0.0: writing to i2c device at 0x0 failed (error=-5) [ 496.337656][ T5927] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 496.362461][ T5927] em28xx 4-1:0.0: dvb set to bulk mode. [ 496.411324][ T8722] em28xx 4-1:0.0: Binding DVB extension [ 496.420129][ T5927] usb 4-1: USB disconnect, device number 37 [ 496.428736][ T5927] em28xx 4-1:0.0: Disconnecting em28xx [ 496.598307][ T8722] em28xx 4-1:0.0: Registering input extension [ 496.612462][ T5927] em28xx 4-1:0.0: Closing input extension [ 496.661263][ T5927] em28xx 4-1:0.0: Freeing device [ 496.917674][ T5838] gspca_stv06xx: I2C: Read error writing address: -71 [ 496.929031][ T5838] usb 6-1: USB disconnect, device number 31 [ 497.551412][T14000] xt_CT: No such helper "pptp" [ 498.078253][ T5927] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 498.257257][ T5927] usb 6-1: Using ep0 maxpacket: 32 [ 498.280191][ T5927] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 498.307296][ T5927] usb 6-1: config 0 has no interface number 0 [ 498.317262][ T5927] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 498.350616][ T5927] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 498.377380][ T5927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 498.395653][ T5927] usb 6-1: Product: syz [ 498.433161][ T5927] usb 6-1: Manufacturer: syz [ 498.446977][ T5927] usb 6-1: SerialNumber: syz [ 498.494843][ T5927] usb 6-1: config 0 descriptor?? [ 498.508397][T14008] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 498.732648][T14008] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 500.087273][ T8734] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 500.267338][ T8734] usb 2-1: Using ep0 maxpacket: 16 [ 500.275376][ T8734] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 500.460674][ T8734] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 500.477863][ T8734] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.502454][ T8734] usb 2-1: Product: syz [ 500.507075][ T8734] usb 2-1: Manufacturer: syz [ 500.546979][ T8734] usb 2-1: SerialNumber: syz [ 500.560342][ T8734] usb 2-1: config 0 descriptor?? [ 500.589972][ T8734] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 500.614130][ T8734] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 501.029154][ T5927] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 501.041162][ T5927] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 501.130661][ T5927] asix 6-1:0.188: probe with driver asix failed with error -71 [ 501.158304][ T5927] usb 6-1: USB disconnect, device number 32 [ 501.342837][ T8734] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 501.392711][T14058] netlink: 'syz.4.2525': attribute type 1 has an invalid length. [ 501.478910][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.527623][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.591817][T14058] 8021q: adding VLAN 0 to HW filter on device bond3 [ 501.700337][T14058] bond3: (slave ip6gretap1): making interface the new active one [ 501.725937][T14058] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link [ 502.011578][ T8734] em28xx 2-1:0.0: board has no eeprom [ 502.057351][ T783] usb 6-1: new full-speed USB device number 33 using dummy_hcd [ 502.417676][ T8734] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 502.426500][ T8734] em28xx 2-1:0.0: dvb set to bulk mode. [ 502.435751][ T8733] em28xx 2-1:0.0: Binding DVB extension [ 502.454648][ T8734] usb 2-1: USB disconnect, device number 27 [ 502.488580][ T8734] em28xx 2-1:0.0: Disconnecting em28xx [ 502.513198][ T783] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 502.523938][ T783] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 502.535729][ T783] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 502.549250][ T783] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 502.560253][ T783] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 502.591762][ T783] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 502.603573][ T783] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 502.612139][ T783] usb 6-1: Product: syz [ 502.616494][ T783] usb 6-1: Manufacturer: syz [ 502.622295][ T783] usb 6-1: SerialNumber: syz [ 502.630029][ T8733] em28xx 2-1:0.0: Registering input extension [ 502.639016][ T8734] em28xx 2-1:0.0: Closing input extension [ 502.661589][ T783] usb 6-1: config 0 descriptor?? [ 502.680693][ T8734] em28xx 2-1:0.0: Freeing device [ 502.894497][ T783] radio-si470x 6-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 502.902424][ T783] radio-si470x 6-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 503.102991][ T783] radio-si470x 6-1:0.0: software version 0, hardware version 0 [ 503.110838][ T783] radio-si470x 6-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 503.124234][ T783] radio-si470x 6-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 503.317518][ T783] radio-si470x 6-1:0.0: submitting int urb failed (-90) [ 503.556854][ T8734] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 503.707488][ T8734] usb 7-1: Using ep0 maxpacket: 16 [ 503.719245][ T8734] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 503.731322][ T8734] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 503.747015][ T8734] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 503.756838][ T8734] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 503.765227][ T8734] usb 7-1: Product: syz [ 503.771135][ T8734] usb 7-1: Manufacturer: syz [ 503.775826][ T8734] usb 7-1: SerialNumber: syz [ 503.789461][ T8734] usb 7-1: config 0 descriptor?? [ 503.806005][ T8734] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 503.816523][ T8734] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 504.409219][ T8734] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 504.417052][ T8734] em28xx 7-1:0.0: Config register raw data: 0xfffffffb [ 504.937006][ T783] usb 6-1: USB disconnect, device number 33 [ 505.034416][ T8734] em28xx 7-1:0.0: Unknown AC97 audio processor detected! [ 505.042403][ T8734] em28xx 7-1:0.0: couldn't setup AC97 register 2 [ 505.259179][ T8734] em28xx 7-1:0.0: couldn't setup AC97 register 4 [ 505.277042][ T8734] em28xx 7-1:0.0: couldn't setup AC97 register 6 [ 505.300980][ T8734] em28xx 7-1:0.0: couldn't setup AC97 register 54 [ 505.317606][ T8734] em28xx 7-1:0.0: couldn't setup AC97 register 56 [ 505.338968][ T8734] usb 7-1: USB disconnect, device number 31 [ 506.357685][ T8734] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 506.563039][ T8734] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 506.604949][ T8734] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 506.646670][ T8734] usb 7-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 506.678516][ T8734] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 506.686527][ T8734] usb 7-1: Manufacturer: syz [ 506.734914][ T8734] usb 7-1: config 0 descriptor?? [ 507.271594][ T8734] pyra 0003:1E7D:2CF6.001D: unknown main item tag 0x0 [ 507.278805][ T8734] pyra 0003:1E7D:2CF6.001D: unknown main item tag 0x0 [ 507.307936][ T8734] pyra 0003:1E7D:2CF6.001D: unknown main item tag 0x0 [ 507.333934][ T8734] pyra 0003:1E7D:2CF6.001D: unknown main item tag 0x0 [ 507.356424][ T8734] pyra 0003:1E7D:2CF6.001D: unknown main item tag 0x0 [ 507.405726][ T8734] pyra 0003:1E7D:2CF6.001D: unknown main item tag 0x0 [ 507.430632][ T8734] pyra 0003:1E7D:2CF6.001D: unknown main item tag 0x0 [ 507.475380][ T8734] pyra 0003:1E7D:2CF6.001D: hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.6-1/input0 [ 509.395207][ T8734] pyra 0003:1E7D:2CF6.001D: couldn't init struct pyra_device [ 509.408925][ T8734] pyra 0003:1E7D:2CF6.001D: couldn't install mouse [ 509.476794][ T8734] pyra 0003:1E7D:2CF6.001D: probe with driver pyra failed with error -71 [ 509.515242][ T8734] usb 7-1: USB disconnect, device number 32 [ 509.932320][T14201] delete_channel: no stack [ 510.096307][T14200] fido_id[14200]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 510.613982][T14216] binder: 14212:14216 ioctl c0306201 2000000001c0 returned -14 [ 510.660885][T14215] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2575'. [ 511.887878][ T5838] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 512.110279][ T5838] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 512.208854][ T5838] usb 7-1: config 0 has no interface number 0 [ 512.286148][ T5838] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 512.321546][ T5838] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 512.363853][ T5838] usb 7-1: Product: syz [ 512.383444][ T5838] usb 7-1: Manufacturer: syz [ 512.429757][ T5838] usb 7-1: SerialNumber: syz [ 512.479931][ T5838] usb 7-1: config 0 descriptor?? [ 512.825752][ T5838] usb 7-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 512.897575][ T5838] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 513.061470][ T5838] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 513.102052][T14226] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2578'. [ 513.136756][ T5838] usb 7-1: media controller created [ 513.333477][ T5838] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 513.447732][ T5927] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 513.489097][ T5838] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 513.684946][ T5927] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 513.709047][ T5838] usb 7-1: USB disconnect, device number 33 [ 513.716208][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 513.757267][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 514.026869][ T5927] usb 4-1: New USB device found, idVendor=05f3, idProduct=0240, bcdDevice=1b.24 [ 514.038131][ T5927] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.046173][ T5927] usb 4-1: Product: syz [ 514.067005][ T5927] usb 4-1: Manufacturer: syz [ 514.097383][ T5927] usb 4-1: SerialNumber: syz [ 514.131466][ T5927] usb 4-1: config 0 descriptor?? [ 514.165647][T14243] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 514.382131][ T5927] powermate: unknown product id 0240 [ 514.418625][ T5927] powermate: Expected payload of 3--6 bytes, found 1024 bytes! [ 514.462950][ T5927] input: Griffin SoundKnob as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input36 [ 514.894804][ C1] powermate: config urb returned -71 [ 514.901843][ C1] powermate: config urb returned -71 [ 514.907890][ C1] powermate: config urb returned -71 [ 514.914931][ T5927] usb 4-1: USB disconnect, device number 38 [ 514.921208][ C1] powermate 4-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 516.875006][T14280] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 516.933478][ T36] bridge_slave_1: left allmulticast mode [ 516.971937][ T36] bridge_slave_1: left promiscuous mode [ 517.009016][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.058870][ T36] bridge_slave_0: left allmulticast mode [ 517.079260][ T36] bridge_slave_0: left promiscuous mode [ 517.085093][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.418988][ T36] bond3 (unregistering): (slave ip6gretap1): Releasing active interface [ 517.546718][ T5837] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 517.560297][ T5837] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 517.642032][ T5837] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 517.650020][ T5837] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 517.661598][ T5837] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 519.055080][ T36] bond1 (unregistering): Released all slaves [ 519.380338][ T36] bond2 (unregistering): (slave batadv1): Releasing active interface [ 519.396929][ T36] bond2 (unregistering): Released all slaves [ 519.647862][ T36] bond0 (unregistering): Released all slaves [ 519.714304][ T5837] Bluetooth: hci3: command tx timeout [ 519.791218][ T783] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 519.855347][ T36] bond3 (unregistering): Released all slaves [ 519.947291][ T783] usb 2-1: Using ep0 maxpacket: 16 [ 519.955218][ T783] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 520.042593][ T783] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 520.069690][ T783] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 520.096655][ T783] usb 2-1: Product: syz [ 520.144012][ T783] usb 2-1: Manufacturer: syz [ 520.149163][ T783] usb 2-1: SerialNumber: syz [ 520.182620][ T783] usb 2-1: config 0 descriptor?? [ 520.262627][ T783] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 520.339124][ T783] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 520.571958][ T36] hsr_slave_0: left promiscuous mode [ 520.583723][ T36] hsr_slave_1: left promiscuous mode [ 520.648229][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 520.923234][ T783] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 520.940204][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 521.369745][ T783] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 521.500877][ T783] em28xx 2-1:0.0: board has no eeprom [ 521.788970][ T5837] Bluetooth: hci3: command tx timeout [ 522.757251][ T783] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 522.808289][ T783] em28xx 2-1:0.0: dvb set to bulk mode. [ 522.813936][ T8734] em28xx 2-1:0.0: Binding DVB extension [ 522.980272][ T783] usb 2-1: USB disconnect, device number 28 [ 522.986947][ T783] em28xx 2-1:0.0: Disconnecting em28xx [ 523.280105][ T8734] em28xx 2-1:0.0: Registering input extension [ 523.298533][ T783] em28xx 2-1:0.0: Closing input extension [ 523.338873][ T783] em28xx 2-1:0.0: Freeing device [ 523.868528][ T5837] Bluetooth: hci3: command tx timeout [ 523.899202][ T36] team0 (unregistering): Port device team_slave_1 removed [ 524.090224][ T36] team0 (unregistering): Port device team_slave_0 removed [ 524.745372][ T783] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 524.931948][ T783] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 524.941767][ T783] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.956553][ T783] usb 7-1: Product: syz [ 524.965356][ T783] usb 7-1: Manufacturer: syz [ 524.978270][ T783] usb 7-1: SerialNumber: syz [ 525.387764][ T8734] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 525.423107][ T783] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 525.435723][ T783] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 525.439385][T14310] chnl_net:caif_netlink_parms(): no params data found [ 525.492430][T14416] picdev_read: 7 callbacks suppressed [ 525.492442][T14416] kvm: pic: non byte read [ 525.503953][T14416] kvm: pic: level sensitive irq not supported [ 525.504037][T14416] kvm: pic: non byte read [ 525.516403][T14416] kvm: pic: level sensitive irq not supported [ 525.516480][T14416] kvm: pic: non byte read [ 525.528468][T14416] kvm: pic: level sensitive irq not supported [ 525.528554][T14416] kvm: pic: non byte read [ 525.573618][ T8734] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 525.584027][ T8734] usb 2-1: New USB device found, idVendor=03da, idProduct=2820, bcdDevice=52.3c [ 525.593867][ T8734] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.626221][T14416] kvm: pic: non byte read [ 525.640960][T14416] kvm: pic: non byte read [ 525.650871][ T8734] usb 2-1: config 0 descriptor?? [ 525.656417][T14416] kvm: pic: non byte read [ 525.669519][T14416] kvm: pic: non byte read [ 525.675514][T14416] kvm: pic: non byte read [ 525.687043][T14416] kvm: pic: non byte read [ 525.693777][T14416] kvm: pic: level sensitive irq not supported [ 525.765269][ T36] IPVS: stop unused estimator thread 0... [ 525.924419][T14411] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 525.957365][ T5837] Bluetooth: hci3: command tx timeout [ 525.996032][T14310] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.009720][ T8722] usb 2-1: USB disconnect, device number 29 [ 526.060973][T14310] bridge0: port 1(bridge_slave_0) entered disabled state [ 526.083166][T14310] bridge_slave_0: entered allmulticast mode [ 526.133812][T14310] bridge_slave_0: entered promiscuous mode [ 526.166056][T14310] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.184264][T14310] bridge0: port 2(bridge_slave_1) entered disabled state [ 526.198798][T14310] bridge_slave_1: entered allmulticast mode [ 526.213191][T14310] bridge_slave_1: entered promiscuous mode [ 526.355696][T14310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 526.378093][T14310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 526.455203][T14310] team0: Port device team_slave_0 added [ 526.481333][T14310] team0: Port device team_slave_1 added [ 526.536443][T14310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 526.545918][T14310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 526.576233][T14310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 526.590756][T14310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 526.598759][T14310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 526.625848][T14310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 526.691887][ T783] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 526.956633][ T783] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001000. ret = -EPROTO [ 526.964500][T14310] hsr_slave_0: entered promiscuous mode [ 526.981833][ T783] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 527.004026][ T783] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 527.010414][T14310] hsr_slave_1: entered promiscuous mode [ 527.061356][ T783] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 527.102666][T14310] debugfs: 'hsr0' already exists in 'hsr' [ 527.134253][ T783] lan78xx 7-1:1.0: probe with driver lan78xx failed with error -71 [ 527.149530][T14310] Cannot create hsr debugfs directory [ 527.260918][ T783] usb 7-1: USB disconnect, device number 34 [ 528.219617][T14310] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 528.307881][T14310] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 528.374998][T14310] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 528.392128][T14310] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 528.436745][T14460] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2636'. [ 528.727801][ T783] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 528.754647][T14310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 528.796373][T14310] 8021q: adding VLAN 0 to HW filter on device team0 [ 528.826367][ T152] bridge0: port 1(bridge_slave_0) entered blocking state [ 528.833607][ T152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 528.883139][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 528.889393][ T783] usb 4-1: Using ep0 maxpacket: 32 [ 528.890362][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 528.944717][ T783] usb 4-1: config 0 has no interfaces? [ 529.182772][ T783] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 529.216812][ T783] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.332345][ T783] usb 4-1: Product: syz [ 529.347352][ T783] usb 4-1: Manufacturer: syz [ 529.361582][ T783] usb 4-1: SerialNumber: syz [ 529.393038][ T783] usb 4-1: config 0 descriptor?? [ 529.437894][ T8722] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 529.473750][T14310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 529.597689][ T8722] usb 6-1: Using ep0 maxpacket: 32 [ 529.603429][T14310] veth0_vlan: entered promiscuous mode [ 529.604985][ T8722] usb 6-1: config 0 has an invalid interface number: 184 but max is 0 [ 529.622959][ T8722] usb 6-1: config 0 has no interface number 0 [ 529.645652][ T8722] usb 6-1: config 0 interface 184 has no altsetting 0 [ 529.676124][ T8722] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 529.680669][T14310] veth1_vlan: entered promiscuous mode [ 529.728086][ T8722] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 529.736124][ T8722] usb 6-1: Product: syz [ 529.753300][ T8722] usb 6-1: Manufacturer: syz [ 529.769760][ T8722] usb 6-1: SerialNumber: syz [ 529.785714][ T8722] usb 6-1: config 0 descriptor?? [ 529.815476][ T8722] smsc75xx v1.0.0 [ 529.914285][ T5927] usb 4-1: USB disconnect, device number 39 [ 529.919156][T14310] veth0_macvtap: entered promiscuous mode [ 530.001066][T14310] veth1_macvtap: entered promiscuous mode [ 530.082549][T14310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 530.131128][T14310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 530.208041][ T3877] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.233895][ T3877] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.259601][ T3877] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.289128][ T3877] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 530.445090][ T8722] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 530.491563][ T8722] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 530.612809][ T3877] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 530.645343][ T3877] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.750537][T14506] kvm: requested 72914 ns i8254 timer period limited to 200000 ns [ 530.778672][T14506] kvm: requested 130742 ns i8254 timer period limited to 200000 ns [ 530.800618][T14506] kvm: requested 32685 ns i8254 timer period limited to 200000 ns [ 530.819234][T14506] kvm: requested 129066 ns i8254 timer period limited to 200000 ns [ 530.852194][T14506] kvm: requested 62019 ns i8254 timer period limited to 200000 ns [ 530.892267][ T1327] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 530.935539][T14506] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 530.944364][ T1327] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 530.981767][T14506] kvm: requested 130742 ns i8254 timer period limited to 200000 ns [ 531.025930][T14506] kvm: requested 172647 ns i8254 timer period limited to 200000 ns [ 531.040068][T14506] kvm: requested 81295 ns i8254 timer period limited to 200000 ns [ 531.058423][T14506] kvm: requested 167619 ns i8254 timer period limited to 200000 ns [ 531.989165][ T8722] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 532.001375][ T8722] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 532.067549][ T8722] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 532.098250][ T8722] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71 [ 532.391145][ T8722] usb 6-1: USB disconnect, device number 34 [ 532.687662][ T8734] usb 7-1: new high-speed USB device number 35 using dummy_hcd [ 532.860888][ T8734] usb 7-1: Using ep0 maxpacket: 16 [ 532.933964][ T8734] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 532.953420][ T8734] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 532.962837][ T8734] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 532.971175][ T8734] usb 7-1: Product: syz [ 532.975566][ T8734] usb 7-1: Manufacturer: syz [ 532.980806][ T8734] usb 7-1: SerialNumber: syz [ 533.111927][ T8734] usb 7-1: config 0 descriptor?? [ 533.164484][ T8734] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 533.224221][ T8734] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 533.764015][ T8734] em28xx 7-1:0.0: chip ID is em2765 [ 534.092399][T14579] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2663'. [ 534.518189][ T8734] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 534.528170][ T8734] em28xx 7-1:0.0: board has no eeprom [ 535.528781][T14607] binder: 14606:14607 ioctl c0306201 2000000001c0 returned -14 [ 535.628488][T14548] em28xx 7-1:0.0: reading from i2c device at 0x1a4 failed (error=-5) [ 535.693199][ T8734] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 535.698345][T14611] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2674'. [ 535.714710][ T8734] em28xx 7-1:0.0: dvb set to bulk mode. [ 535.728905][ T783] em28xx 7-1:0.0: Binding DVB extension [ 535.751265][ T8734] usb 7-1: USB disconnect, device number 35 [ 535.782541][ T8734] em28xx 7-1:0.0: Disconnecting em28xx [ 535.884667][ T783] em28xx 7-1:0.0: Registering input extension [ 535.892613][ T8734] em28xx 7-1:0.0: Closing input extension [ 535.911719][T14615] kvm: vcpu 2044: requested lapic timer restore with starting count register 0x390=3343437945 (53495007120 ns) > initial count (52285443328 ns). Using initial count to start timer. [ 535.940257][ T8734] em28xx 7-1:0.0: Freeing device [ 537.723280][ T30] audit: type=1800 audit(1764688526.495:267): pid=14627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2678" name="bus" dev="ramfs" ino=74465 res=0 errno=0 [ 538.519137][ T5941] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 538.707329][ T5941] usb 4-1: Using ep0 maxpacket: 32 [ 538.715300][ T5941] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 538.735155][ T5941] usb 4-1: config 0 has no interface number 0 [ 538.777862][ T5941] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 538.802254][ T5941] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 538.833063][ T5941] usb 4-1: Product: syz [ 538.850802][ T5941] usb 4-1: Manufacturer: syz [ 538.899819][ T5941] usb 4-1: SerialNumber: syz [ 538.925767][ T5941] usb 4-1: config 0 descriptor?? [ 538.945160][ T5941] smsc95xx v2.0.0 [ 539.157870][T14683] binder: BINDER_SET_CONTEXT_MGR already set [ 539.170947][T14683] binder: 14682:14683 ioctl 4018620d 200000000040 returned -16 [ 539.200127][T14683] binder: 14682:14683 ioctl c018620c 200000000100 returned -1 [ 539.365991][ T5941] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 539.408111][ T5941] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 540.087351][ T8722] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 540.277365][ T8722] usb 8-1: Using ep0 maxpacket: 8 [ 540.526439][ T8722] usb 8-1: config 135 has an invalid interface number: 230 but max is 0 [ 540.550584][ T8722] usb 8-1: config 135 has an invalid descriptor of length 0, skipping remainder of the config [ 540.565167][ T8722] usb 8-1: config 135 has no interface number 0 [ 540.571702][ T8722] usb 8-1: config 135 interface 230 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 540.669324][ T8722] usb 8-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=3f.3a [ 540.683969][ T8722] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 540.710208][ T8722] usb 8-1: Product: syz [ 540.718925][ T8722] usb 8-1: Manufacturer: syz [ 540.744178][ T8722] usb 8-1: SerialNumber: syz [ 540.770752][ T8722] uvcvideo 8-1:135.230: Found Unit with invalid ID 0 [ 540.776667][T14715] syzkaller0: entered promiscuous mode [ 540.785285][T14715] syzkaller0: entered allmulticast mode [ 540.798438][ T8722] uvcvideo 8-1:135.230: Found UVC 0.00 device syz (18ec:3288) [ 540.818815][ T8722] uvcvideo 8-1:135.230: No valid video chain found. [ 541.093812][ T5941] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000038: -71 [ 541.117733][ T5941] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -71 [ 541.180568][ T5941] usb 4-1: USB disconnect, device number 40 [ 541.220028][ T8722] usb 8-1: USB disconnect, device number 2 [ 541.821313][T14732] create_pit_timer: 4 callbacks suppressed [ 541.821330][T14732] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 541.947642][ T8734] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 542.137327][ T8734] usb 2-1: Using ep0 maxpacket: 8 [ 542.156037][ T8734] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 542.178318][ T8734] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 542.197341][ T8734] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 542.217281][ T8734] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 542.269420][ T8734] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 542.297263][ T8734] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 542.528184][ T8734] usb 2-1: GET_CAPABILITIES returned 0 [ 542.546217][ T8734] usbtmc 2-1:16.0: can't read capabilities [ 542.784460][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 542.797595][T14730] usbtmc 2-1:16.0: Unable to send data, error -71 [ 542.808189][ T8734] usb 2-1: USB disconnect, device number 30 [ 543.074377][T14757] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2719'. [ 543.110436][T14757] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2719'. [ 543.141498][T14757] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2719'. [ 543.207940][T14757] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2719'. [ 543.408056][T14763] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2722'. [ 543.747977][ T5927] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 543.931018][ T5927] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 543.982097][ T5927] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 544.017434][ T5927] usb 8-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 544.046933][ T5927] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 544.098984][ T5927] usb 8-1: config 0 descriptor?? [ 544.534343][ T5927] cp2112 0003:10C4:EA90.001E: item fetching failed at offset 5/7 [ 544.596712][ T5927] cp2112 0003:10C4:EA90.001E: parse failed [ 544.637649][ T5927] cp2112 0003:10C4:EA90.001E: probe with driver cp2112 failed with error -22 [ 545.220427][ T783] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 545.443468][ T783] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 545.463023][ T783] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 545.509661][ T783] usb 2-1: Product: syz [ 545.517303][ T783] usb 2-1: Manufacturer: syz [ 545.521903][ T783] usb 2-1: SerialNumber: syz [ 545.555040][T14822] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(6) [ 545.561879][T14822] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 545.618786][T14822] vhci_hcd vhci_hcd.0: Device attached [ 545.871113][T14823] vhci_hcd: connection closed [ 545.883276][T13150] vhci_hcd: stop threads [ 546.008543][ T783] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 546.027480][ T783] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 546.045712][T13150] vhci_hcd: release socket [ 546.055847][T13150] vhci_hcd: disconnect device [ 546.078690][ T8729] usb 44-1: enqueue for inactive port 0 [ 546.484886][ T8731] usb 8-1: USB disconnect, device number 3 [ 546.693409][ T8729] usb usb44-port1: attempt power cycle [ 547.431628][ T8729] usb usb44-port1: unable to enumerate USB device [ 547.736109][ T783] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000040. ret = -EPROTO [ 547.797868][ T783] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 547.858087][ T783] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 547.893715][ T783] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 547.939226][ T783] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 548.009459][ T783] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 548.094590][ T783] usb 2-1: USB disconnect, device number 31 [ 548.715628][T14863] futex_wake_op: syz.6.2738 tries to shift op by 32; fix this program [ 549.641921][T14894] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 549.648489][T14894] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 549.702923][T14894] vhci_hcd vhci_hcd.0: Device attached [ 549.889740][ T8731] vhci_hcd: vhci_device speed not set [ 549.957325][ T8731] usb 45-1: new full-speed USB device number 2 using vhci_hcd [ 550.095147][T14895] vhci_hcd: connection reset by peer [ 550.113853][T13150] vhci_hcd: stop threads [ 550.119728][T13150] vhci_hcd: release socket [ 550.134471][T13150] vhci_hcd: disconnect device [ 553.141272][T14930] syz.3.2754 (14930): drop_caches: 2 [ 553.666689][T14953] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2761'. [ 554.441765][T14959] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2765'. [ 554.609597][T14961] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 555.137755][ T8731] vhci_hcd: vhci_device speed not set [ 555.994960][T14992] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2773'. [ 556.030007][T14992] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2773'. [ 556.553884][T14999] pim6reg: entered allmulticast mode [ 556.570028][T14999] netlink: 'syz.1.2776': attribute type 10 has an invalid length. [ 556.582703][T14999] team0: Failed to send port change of device netdevsim0 via netlink (err -105) [ 556.594099][T14999] team0: Failed to send options change via netlink (err -105) [ 556.602455][ T5927] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 556.615655][T14999] team0: Port device netdevsim0 added [ 556.767648][ T5927] usb 4-1: Using ep0 maxpacket: 32 [ 556.774290][ T5927] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 556.786137][ T5927] usb 4-1: config 0 has no interface number 0 [ 556.797758][ T5927] usb 4-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 556.851901][ T5927] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 556.863631][ T5927] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 556.892340][ T5927] usb 4-1: Product: syz [ 556.899856][ T5927] usb 4-1: Manufacturer: syz [ 556.930987][ T5927] usb 4-1: SerialNumber: syz [ 557.055052][ T5927] usb 4-1: config 0 descriptor?? [ 557.068458][T14997] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 557.297513][T14498] usb 7-1: new full-speed USB device number 36 using dummy_hcd [ 557.314085][T14997] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 557.509119][T14498] usb 7-1: not running at top speed; connect to a high speed hub [ 557.519909][T14498] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 557.545404][T14498] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 557.557625][T14498] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 557.573207][T14498] usb 7-1: Product: 䒔伺⬼巺翝憕惴쳯垒ꦇƗ⹹ꨟ嘈씆뢚誹Ᲊ熛蹬첩㬶ꦦâｃ嵝醙䃜ࣿ⑆㘗툒㼏樷桇꟔ḅ괶⫅蒃њ㖖༞慺鵔㜎ᯑ첷藐艗䷴趣玙踰㨑㞛⎼죪ʗぃ禛⯢㲝얘㝵찦ὠݸ퇗틻Ȭ粓ꨏӷ뻃嗭༅ގ [ 557.775972][T14498] usb 7-1: Manufacturer: А [ 557.784762][T14498] usb 7-1: SerialNumber: ᐁ [ 558.065623][T14498] usb 7-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 558.073633][T14498] usb 7-1: unit 91 not found! [ 558.089884][T14498] usb 7-1: 5:0: cannot get min/max values for control 2 (id 5) [ 558.102785][T14498] usb 7-1: 5:0: cannot get min/max values for control 3 (id 5) [ 558.146602][T14498] usb 7-1: 5:0: cannot get min/max values for control 3 (id 5) [ 558.192684][T14498] usb 7-1: USB disconnect, device number 36 [ 558.260944][T13787] udevd[13787]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such device [ 559.197337][ T5927] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 559.224793][ T5927] asix 4-1:0.188 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 559.249928][ T5927] asix 4-1:0.188: probe with driver asix failed with error -71 [ 559.305453][ T5927] usb 4-1: USB disconnect, device number 41 [ 559.332730][T15030] netlink: 'syz.5.2796': attribute type 4 has an invalid length. [ 559.708438][ T8731] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 559.869507][ T8731] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 559.890976][ T8731] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 559.907662][ T8731] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 559.917106][ T8731] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 559.995570][ T8731] usb 2-1: config 0 descriptor?? [ 560.468581][ T8731] cp2112 0003:10C4:EA90.001F: unknown main item tag 0x0 [ 560.492748][ T8731] cp2112 0003:10C4:EA90.001F: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 560.678095][ T8731] cp2112 0003:10C4:EA90.001F: Part Number: 0x82 Device Version: 0xFE [ 561.187891][ T8731] cp2112 0003:10C4:EA90.001F: error setting SMBus config [ 561.211503][ T8731] cp2112 0003:10C4:EA90.001F: probe with driver cp2112 failed with error -71 [ 561.271556][ T8731] usb 2-1: USB disconnect, device number 32 [ 562.011840][T15068] kvm: requested 80457 ns i8254 timer period limited to 200000 ns [ 562.046011][T15068] kvm: requested 130742 ns i8254 timer period limited to 200000 ns [ 562.064461][T15068] kvm: requested 46933 ns i8254 timer period limited to 200000 ns [ 562.097863][T15068] kvm: requested 181866 ns i8254 timer period limited to 200000 ns [ 562.247509][T15068] kvm: requested 62857 ns i8254 timer period limited to 200000 ns [ 562.299067][T15077] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2794'. [ 562.318130][T15068] kvm: requested 80457 ns i8254 timer period limited to 200000 ns [ 562.334425][T15068] kvm: requested 41066 ns i8254 timer period limited to 200000 ns [ 562.444538][T15068] kvm: requested 112304 ns i8254 timer period limited to 200000 ns [ 562.453270][T15068] kvm: requested 129066 ns i8254 timer period limited to 200000 ns [ 562.462632][T15068] kvm: requested 80457 ns i8254 timer period limited to 200000 ns [ 562.911004][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.917412][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.117302][ T5927] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 563.299587][ T5927] usb 6-1: Using ep0 maxpacket: 8 [ 563.309707][ T5927] usb 6-1: config 0 has no interfaces? [ 563.319736][ T5927] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 563.329412][ T5927] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 563.487643][ T5927] usb 6-1: config 0 descriptor?? [ 563.764508][ T5927] usb 6-1: USB disconnect, device number 35 [ 566.447266][ T5941] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 566.627310][ T5941] usb 7-1: Using ep0 maxpacket: 32 [ 566.631803][T15142] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 566.640314][ T5941] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 566.662517][ T5941] usb 7-1: config 0 has no interfaces? [ 566.672821][ T5941] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 566.682432][ T5941] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.729892][ T5941] usb 7-1: config 0 descriptor?? [ 567.086889][ T8722] usb 7-1: USB disconnect, device number 37 [ 567.667317][ T5941] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 567.817362][ T5941] usb 8-1: Using ep0 maxpacket: 32 [ 567.824044][ T5941] usb 8-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 567.833389][ T5941] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.901604][ T5941] usb 8-1: config 0 descriptor?? [ 568.020318][T15166] random: crng reseeded on system resumption [ 568.232655][ T5941] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 568.262268][ T5941] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 568.273275][ T5941] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 568.281627][ T5941] usb 8-1: media controller created [ 568.331892][ T5941] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 568.433752][T15159] az6027: more than 2 i2c messages at a time is not handled yet. TODO. [ 568.443111][ T5941] az6027: usb out operation failed. (-71) [ 568.455445][ T5941] az6027: usb out operation failed. (-71) [ 568.477095][ T5941] stb0899_attach: Driver disabled by Kconfig [ 568.508653][ T5941] az6027: no front-end attached [ 568.508653][ T5941] [ 568.537855][ T5941] az6027: usb out operation failed. (-71) [ 568.543699][ T5941] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 568.582269][ T5941] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.7/usb8/8-1/input/input39 [ 568.665999][ T5941] dvb-usb: schedule remote query interval to 400 msecs. [ 568.682700][ T5941] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 568.732844][ T5941] usb 8-1: USB disconnect, device number 4 [ 568.911088][ T5941] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 571.139554][T15201] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2836'. [ 571.142268][T15199] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 571.286143][T15201] 8021q: adding VLAN 0 to HW filter on device bond5 [ 571.309978][T15206] bond5: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 571.415603][T15206] 8021q: adding VLAN 0 to HW filter on device bond5 [ 571.581146][T15206] bond5: (slave lo): Enslaving as an active interface with an up link [ 572.174790][ T8731] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 572.474476][ T8731] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 572.515396][ T8731] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 572.549109][ T8731] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 572.587857][ T8731] usb 6-1: config 0 descriptor?? [ 572.637324][ T8731] pwc: Askey VC010 type 2 USB webcam detected. [ 573.025692][ T8731] pwc: recv_control_msg error -32 req 02 val 2b00 [ 573.049127][ T8731] pwc: recv_control_msg error -32 req 02 val 2700 [ 573.076043][ T8731] pwc: recv_control_msg error -32 req 02 val 2c00 [ 573.085687][ T8731] pwc: recv_control_msg error -32 req 04 val 1000 [ 573.093846][ T8731] pwc: recv_control_msg error -32 req 04 val 1300 [ 573.158400][ T8731] pwc: recv_control_msg error -32 req 04 val 1400 [ 573.177809][ T8731] pwc: recv_control_msg error -32 req 02 val 2000 [ 573.220446][ T8731] pwc: recv_control_msg error -32 req 02 val 2100 [ 573.436229][ T8731] pwc: recv_control_msg error -71 req 02 val 2500 [ 573.448111][T15236] GUP no longer grows the stack in syz.3.2846 (15236): 200000011000-200000018000 (20000000e000) [ 573.459303][T15236] CPU: 1 UID: 0 PID: 15236 Comm: syz.3.2846 Not tainted syzkaller #0 PREEMPT(full) [ 573.459325][T15236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 573.459341][T15236] Call Trace: [ 573.459352][T15236] [ 573.459360][T15236] dump_stack_lvl+0x189/0x250 [ 573.459390][T15236] ? __pfx_dump_stack_lvl+0x10/0x10 [ 573.459408][T15236] ? __pfx__printk+0x10/0x10 [ 573.459428][T15236] ? find_vma+0xe7/0x160 [ 573.459465][T15236] __get_user_pages+0x2470/0x2a00 [ 573.459518][T15236] get_user_pages_remote+0x2f1/0xac0 [ 573.459541][T15236] ? __pfx_mtree_load+0x10/0x10 [ 573.459573][T15236] ? __pfx_get_user_pages_remote+0x10/0x10 [ 573.459607][T15236] ? __access_remote_vm+0x367/0x7d0 [ 573.459637][T15236] __access_remote_vm+0x211/0x7d0 [ 573.459668][T15236] ? __pfx___access_remote_vm+0x10/0x10 [ 573.459695][T15236] ? alloc_pages_noprof+0xbe/0x190 [ 573.459718][T15236] proc_pid_cmdline_read+0x430/0x810 [ 573.459743][ T8731] pwc: recv_control_msg error -71 req 02 val 2400 [ 573.459751][T15236] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 573.459777][T15236] ? rw_verify_area+0x2a6/0x4d0 [ 573.459800][T15236] vfs_readv+0x5aa/0x850 [ 573.459819][T15236] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 573.459845][T15236] ? __pfx_vfs_readv+0x10/0x10 [ 573.459878][T15236] ? __fget_files+0x2a/0x420 [ 573.459901][T15236] ? __fget_files+0x3a0/0x420 [ 573.459919][T15236] ? __fget_files+0x2a/0x420 [ 573.459947][T15236] __x64_sys_preadv+0x197/0x2a0 [ 573.459967][T15236] ? __pfx___x64_sys_preadv+0x10/0x10 [ 573.459989][T15236] ? do_syscall_64+0xbe/0xf80 [ 573.460010][T15236] do_syscall_64+0xfa/0xf80 [ 573.460025][T15236] ? lockdep_hardirqs_on+0x98/0x140 [ 573.460049][T15236] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.460066][T15236] ? clear_bhb_loop+0x60/0xb0 [ 573.460087][T15236] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.460103][T15236] RIP: 0033:0x7f7a2578f749 [ 573.460120][T15236] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 573.460135][T15236] RSP: 002b:00007f7a2663d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 573.460155][T15236] RAX: ffffffffffffffda RBX: 00007f7a259e5fa0 RCX: 00007f7a2578f749 [ 573.460168][T15236] RDX: 0000000000000001 RSI: 0000200000001200 RDI: 0000000000000003 [ 573.460180][T15236] RBP: 00007f7a25813f91 R08: 0000000000006a76 R09: 0000000000000000 [ 573.460191][T15236] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000000 [ 573.460201][T15236] R13: 00007f7a259e6038 R14: 00007f7a259e5fa0 R15: 00007f7a25b0fa28 [ 573.460233][T15236] [ 574.198655][ T8731] pwc: recv_control_msg error -71 req 02 val 2600 [ 574.236179][ T8731] pwc: recv_control_msg error -71 req 02 val 2900 [ 574.256409][ T8731] pwc: recv_control_msg error -71 req 02 val 2800 [ 574.291978][ T8731] pwc: recv_control_msg error -71 req 04 val 1100 [ 574.334945][ T8731] pwc: recv_control_msg error -71 req 04 val 1200 [ 574.940280][ T8731] pwc: Registered as video103. [ 574.955555][ T8731] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input40 [ 574.998743][ T8731] usb 6-1: USB disconnect, device number 36 [ 575.614521][T15268] binder: 15267:15268 ioctl c0306201 200000004a40 returned -14 [ 576.898181][T15276] syzkaller0: entered promiscuous mode [ 576.942838][T15276] syzkaller0: entered allmulticast mode [ 577.103252][ T30] audit: type=1326 audit(1764688565.865:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 577.138158][ T30] audit: type=1326 audit(1764688565.865:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=111 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 577.161715][ T30] audit: type=1326 audit(1764688565.865:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 577.184120][ C1] vkms_vblank_simulate: vblank timer overrun [ 577.267287][ T30] audit: type=1326 audit(1764688565.865:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 577.289639][ C1] vkms_vblank_simulate: vblank timer overrun [ 577.387301][ T30] audit: type=1326 audit(1764688565.865:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=22 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 578.066130][ T30] audit: type=1326 audit(1764688565.865:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 578.088510][ C1] vkms_vblank_simulate: vblank timer overrun [ 578.196445][ T30] audit: type=1326 audit(1764688565.865:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 578.219689][ T30] audit: type=1326 audit(1764688565.865:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 578.244705][ T30] audit: type=1326 audit(1764688565.865:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=275 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 578.275251][ T30] audit: type=1326 audit(1764688565.865:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15278 comm="syz.5.2859" exe="/root/syz-executor" sig=0 arch=c000003e syscall=275 compat=0 ip=0x7f7dbeb8f749 code=0x7ffc0000 [ 578.637441][T15305] input: syz1 as /devices/virtual/input/input41 [ 579.029192][ T8722] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 579.230850][ T8722] usb 7-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 579.251156][ T8722] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.267784][ T8722] usb 7-1: Product: syz [ 579.271988][ T8722] usb 7-1: Manufacturer: syz [ 579.276588][ T8722] usb 7-1: SerialNumber: syz [ 579.791095][ T8722] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 579.813777][ T8722] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 580.014139][T15332] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 580.857843][ T6143] bridge_slave_1: left allmulticast mode [ 580.866822][ T6143] bridge_slave_1: left promiscuous mode [ 580.892468][ T6143] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.931695][ T6143] bridge_slave_0: left allmulticast mode [ 580.943930][ T6143] bridge_slave_0: left promiscuous mode [ 580.956298][ T6143] bridge0: port 1(bridge_slave_0) entered disabled state [ 581.482765][ T8722] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000040. ret = -EPROTO [ 581.498252][ T8722] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 581.551500][ T8722] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 581.612320][ T8722] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 581.655940][ T8722] lan78xx 7-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 581.665036][ T5941] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 581.702307][ T8722] lan78xx 7-1:1.0: probe with driver lan78xx failed with error -71 [ 581.792189][ T8722] usb 7-1: USB disconnect, device number 38 [ 581.848701][ T5941] usb 2-1: Using ep0 maxpacket: 16 [ 581.878842][ T5941] usb 2-1: config 0 has no interfaces? [ 581.904091][ T5941] usb 2-1: New USB device found, idVendor=04d8, idProduct=00df, bcdDevice= 0.00 [ 581.918105][ T5941] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 581.966029][ T5941] usb 2-1: config 0 descriptor?? [ 582.264067][T14498] usb 2-1: USB disconnect, device number 33 [ 583.490057][ T5848] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 583.500086][ T5848] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 583.533197][ T5848] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 583.554635][ T5848] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 583.562402][ T5848] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 584.001547][ T6143] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 584.026750][ T6143] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 584.054097][ T6143] bond0 (unregistering): Released all slaves [ 584.877478][ T6143] bond1 (unregistering): Released all slaves [ 585.107420][ T8722] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 585.117337][ T5941] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 585.194746][ T6143] bond2 (unregistering): (slave dummy0): Releasing backup interface [ 585.208680][ T6143] bond2 (unregistering): Released all slaves [ 585.279958][ T5941] usb 8-1: Using ep0 maxpacket: 32 [ 585.289150][ T8722] usb 7-1: config index 0 descriptor too short (expected 28277, got 36) [ 585.300430][ T5941] usb 8-1: config 0 has an invalid interface number: 89 but max is 0 [ 585.314148][ T8722] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 585.333087][ T5941] usb 8-1: config 0 has no interface number 0 [ 585.350901][ T5941] usb 8-1: config 0 interface 89 has no altsetting 0 [ 585.358233][ T8722] usb 7-1: config 0 has no interfaces? [ 585.372160][ T8722] usb 7-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 585.399913][ T5941] usb 8-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 585.409809][ T8722] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 585.417975][ T5941] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.434813][ T5941] usb 8-1: Product: syz [ 585.439878][ T8722] usb 7-1: config 0 descriptor?? [ 585.622930][ T5941] usb 8-1: Manufacturer: syz [ 585.631304][ T5941] usb 8-1: SerialNumber: syz [ 585.637426][ T5837] Bluetooth: hci2: command tx timeout [ 585.672859][ T5941] usb 8-1: config 0 descriptor?? [ 585.701197][ T5941] em28xx 8-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 585.743383][ T5941] em28xx 8-1:0.89: Video interface 89 found: bulk [ 585.875032][ T6143] bond3 (unregistering): (slave veth0_to_bond): Releasing active interface [ 585.903931][ T6143] bond3 (unregistering): Released all slaves [ 586.281562][ T6143] bond4 (unregistering): Released all slaves [ 586.309637][ T5941] em28xx 8-1:0.89: unknown em28xx chip ID (0) [ 586.488869][ T6143] bond5 (unregistering): (slave lo): Releasing backup interface [ 586.506565][ T6143] bond5 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 586.525885][ T6143] bond5 (unregistering): Released all slaves [ 587.104392][T15416] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2898'. [ 587.687746][ T5941] em28xx 8-1:0.89: write to i2c device at 0xa0 failed with unknown error (status=1) [ 587.711622][ T5837] Bluetooth: hci2: command tx timeout [ 587.729340][ T5941] em28xx 8-1:0.89: failed to read eeprom (err=-5) [ 587.809427][ T5941] em28xx 8-1:0.89: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-5] [ 587.887404][ T5941] em28xx 8-1:0.89: Identified as Terratec Grabby (card=67) [ 587.894878][ T5941] em28xx 8-1:0.89: analog set to bulk mode. [ 587.905077][ T8722] em28xx 8-1:0.89: Registering V4L2 extension [ 587.971750][ T5941] usb 8-1: USB disconnect, device number 5 [ 587.998027][ T8722] em28xx 8-1:0.89: reading from i2c device at 0x4a failed (error=-19) [ 588.015516][ T5941] em28xx 8-1:0.89: Disconnecting em28xx [ 588.027315][ T8722] em28xx 8-1:0.89: Config register raw data: 0xffffffed [ 588.048228][ T783] usb 7-1: USB disconnect, device number 39 [ 588.057216][ T8722] em28xx 8-1:0.89: AC97 chip type couldn't be determined [ 588.087557][ T8722] em28xx 8-1:0.89: No AC97 audio processor [ 588.121430][ T8722] usb 8-1: Decoder not found [ 588.138688][ T8722] em28xx 8-1:0.89: failed to create media graph [ 588.153349][ T8722] em28xx 8-1:0.89: V4L2 device video103 deregistered [ 588.195773][ T8722] em28xx 8-1:0.89: Registering snapshot button... [ 588.233216][ T8722] input: em28xx snapshot button as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.89/input/input42 [ 588.276880][ T8722] em28xx 8-1:0.89: Remote control support is not available for this card. [ 588.307274][ T5941] em28xx 8-1:0.89: Closing input extension [ 588.334550][ T5941] em28xx 8-1:0.89: Deregistering snapshot button [ 588.490806][ T5941] em28xx 8-1:0.89: Freeing device [ 588.625622][ T6143] hsr_slave_0: left promiscuous mode [ 588.683248][T15440] kvm: pic: level sensitive irq not supported [ 588.683316][T15440] picdev_read: 3 callbacks suppressed [ 588.683330][T15440] kvm: pic: non byte read [ 588.696989][ T6143] hsr_slave_1: left promiscuous mode [ 588.699786][T15440] kvm: pic: single mode not supported [ 588.705013][T15440] kvm: pic: level sensitive irq not supported [ 588.712404][T15440] kvm: pic: non byte read [ 588.724884][T15440] kvm: pic: non byte read [ 588.733928][T15440] kvm: pic: single mode not supported [ 588.733991][T15440] kvm: pic: non byte read [ 588.745027][ T6143] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 588.777616][T15440] kvm: pic: single mode not supported [ 588.777679][T15440] kvm: pic: non byte read [ 588.793343][ T6143] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 588.803190][T15440] kvm: pic: non byte read [ 588.829452][T15440] kvm: pic: single mode not supported [ 588.829474][T15440] kvm: pic: level sensitive irq not supported [ 588.851473][T15440] kvm: pic: non byte read [ 588.881061][T15440] kvm: pic: non byte read [ 588.895959][T15440] kvm: pic: non byte read [ 588.906105][T15440] kvm: pic: non byte read [ 588.919256][T15440] kvm: pic: single mode not supported [ 588.919275][T15440] kvm: pic: level sensitive irq not supported [ 589.094859][T15444] binder_alloc: 15443: binder_alloc_buf, no vma [ 589.798085][ T5837] Bluetooth: hci2: command tx timeout [ 591.623144][ T6143] team0 (unregistering): Port device team_slave_1 removed [ 591.877260][ T5837] Bluetooth: hci2: command tx timeout [ 591.905880][T15475] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2911'. [ 591.918649][ T6143] team0 (unregistering): Port device team_slave_0 removed [ 593.754170][T15488] syzkaller0: entered promiscuous mode [ 593.765790][T15488] syzkaller0: entered allmulticast mode [ 594.541033][T15517] syzkaller0: entered promiscuous mode [ 594.546637][T15517] syzkaller0: entered allmulticast mode [ 594.573302][T15382] chnl_net:caif_netlink_parms(): no params data found [ 594.967495][ T8722] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 595.147535][ T8722] usb 4-1: Using ep0 maxpacket: 8 [ 595.154459][ T8722] usb 4-1: config 0 has an invalid interface number: 122 but max is 0 [ 595.192038][ T8722] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 595.220457][ T8722] usb 4-1: config 0 has no interface number 0 [ 595.226612][ T8722] usb 4-1: config 0 interface 122 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 595.257373][ T8722] usb 4-1: config 0 interface 122 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 8 [ 595.288183][ T8722] usb 4-1: config 0 interface 122 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 8 [ 595.344007][ T8722] usb 4-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 5.b7 [ 595.363820][ T8722] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.399133][ T8722] usb 4-1: Product: syz [ 595.403375][ T8722] usb 4-1: Manufacturer: syz [ 595.433764][T15382] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.437498][ T8722] usb 4-1: SerialNumber: syz [ 595.457412][T15382] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.464915][T15382] bridge_slave_0: entered allmulticast mode [ 595.465676][ T8722] usb 4-1: config 0 descriptor?? [ 595.515413][T15382] bridge_slave_0: entered promiscuous mode [ 595.518125][T15522] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 595.573122][T15382] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.610286][T15382] bridge0: port 2(bridge_slave_1) entered disabled state [ 595.627803][T15382] bridge_slave_1: entered allmulticast mode [ 595.639957][T15382] bridge_slave_1: entered promiscuous mode [ 595.746717][T15539] binder: 15538:15539 ioctl c0306201 200000000440 returned -14 [ 595.828147][T15382] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 595.886068][T15382] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 596.153518][ T8722] usb 4-1: NFC: intf ffff8880621d2000 id ffffffff8e9241e0 [ 596.198945][T15382] team0: Port device team_slave_0 added [ 596.231612][ T8722] usb 4-1: USB disconnect, device number 42 [ 596.240644][T15382] team0: Port device team_slave_1 added [ 596.476870][T15382] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 596.485112][T15382] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 596.654266][T15382] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 596.686396][T15382] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 596.707070][T15382] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 596.772337][T15382] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 596.826978][T15562] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 596.950710][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.024948][T15382] hsr_slave_0: entered promiscuous mode [ 597.042027][T15382] hsr_slave_1: entered promiscuous mode [ 597.098416][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.138985][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.182965][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.265281][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.374763][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.440734][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.479820][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.543750][T15563] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2929'. [ 597.797424][ T5941] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 597.911319][T15589] netlink: 'syz.7.2935': attribute type 4 has an invalid length. [ 597.922487][T15382] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 597.940951][T15382] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 597.954324][T15382] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 597.967272][ T5941] usb 7-1: Using ep0 maxpacket: 16 [ 597.979695][T15382] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 597.988482][ T5941] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 598.006535][ T5941] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 598.019427][ T5941] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 598.035466][T15595] binder_alloc: 15594: pid 15594 spamming oneway? 1 buffers allocated for a total size of 4096 [ 598.035937][ T5941] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 598.089003][ T5941] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 598.116095][ T5941] usb 7-1: config 0 descriptor?? [ 598.122627][T14428] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 598.194933][T15382] 8021q: adding VLAN 0 to HW filter on device bond0 [ 598.243398][T15382] 8021q: adding VLAN 0 to HW filter on device team0 [ 598.262284][T14390] bridge0: port 1(bridge_slave_0) entered blocking state [ 598.269607][T14390] bridge0: port 1(bridge_slave_0) entered forwarding state [ 598.287391][T14428] usb 2-1: Using ep0 maxpacket: 32 [ 598.294742][T14428] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 32 [ 598.302498][T15274] bridge0: port 2(bridge_slave_1) entered blocking state [ 598.311753][T15274] bridge0: port 2(bridge_slave_1) entered forwarding state [ 598.325032][T14428] usb 2-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= a.f5 [ 598.408293][T14428] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.416437][T14428] usb 2-1: Product: syz [ 598.423374][T14428] usb 2-1: Manufacturer: syz [ 598.428790][T14428] usb 2-1: SerialNumber: syz [ 598.438151][T14428] usb 2-1: config 0 descriptor?? [ 598.444431][T15586] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 598.505829][T14428] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 598.520403][T15382] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 598.648828][ T5941] input: HID 045e:07da as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/0003:045E:07DA.0020/input/input43 [ 598.763807][ T5941] microsoft 0003:045E:07DA.0020: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 598.794336][T14428] usb 2-1: USB disconnect, device number 34 [ 598.890812][T15382] veth0_vlan: entered promiscuous mode [ 598.952824][T15611] udevd[15611]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 598.987345][T15382] veth1_vlan: entered promiscuous mode [ 599.038453][T15586] input: syz0 as /devices/virtual/input/input44 [ 599.047299][ T8734] usb 7-1: USB disconnect, device number 40 [ 599.234527][T15382] veth0_macvtap: entered promiscuous mode [ 599.268173][T15382] veth1_macvtap: entered promiscuous mode [ 599.311903][T15615] fido_id[15615]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 599.332804][T15382] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 599.349023][T15382] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 599.386471][T15274] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.405816][T15274] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.416270][T15274] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.425938][T15274] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 599.534161][ T1327] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.555187][ T1327] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 599.598195][T14652] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 599.608563][T14652] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 600.117255][T14428] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 600.520168][T15639] binder: 15637:15639 ioctl c018620c 200000000240 returned -22 [ 600.661357][T14428] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 600.672028][T14428] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.696558][T14428] usb 2-1: Product: syz [ 600.708978][T14428] usb 2-1: Manufacturer: syz [ 600.721238][T14428] usb 2-1: SerialNumber: syz [ 601.189985][T14428] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 601.212936][T14428] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 602.545044][T14428] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 602.566344][T14428] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPIPE [ 602.876627][T14428] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00000118. ret = -EPROTO [ 602.932002][T14428] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 602.951850][T14428] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 602.968040][T14428] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 602.999621][T14428] usb 2-1: USB disconnect, device number 35 [ 603.847390][ T5927] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 604.015277][T15699] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 604.022383][ T5927] usb 7-1: Using ep0 maxpacket: 32 [ 604.032081][ T5927] usb 7-1: config 0 has an invalid interface number: 85 but max is 0 [ 604.055438][ T5927] usb 7-1: config 0 has no interface number 0 [ 604.221343][ T5927] usb 7-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 604.237955][ T8734] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 604.257449][ T5927] usb 7-1: config 0 interface 85 has no altsetting 0 [ 604.278145][ T5927] usb 7-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 604.288639][ T5927] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.296691][ T5927] usb 7-1: Product: syz [ 604.327135][ T5927] usb 7-1: Manufacturer: syz [ 604.342362][ T5927] usb 7-1: SerialNumber: syz [ 604.370720][ T5927] usb 7-1: config 0 descriptor?? [ 604.397565][ T8734] usb 2-1: Using ep0 maxpacket: 16 [ 604.410221][ T8734] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 604.545392][ T8734] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 604.617947][ T8734] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 604.627462][ T8734] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.671920][ T8734] usb 2-1: Product: syz [ 604.686553][ T8734] usb 2-1: Manufacturer: syz [ 604.703595][ T8734] usb 2-1: SerialNumber: syz [ 604.770846][ T8734] usb 2-1: config 0 descriptor?? [ 604.828656][ T8734] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 604.842662][ T8734] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 604.995464][ T5927] appletouch 7-1:0.85: Geyser mode initialized. [ 605.054772][ T5927] input: appletouch as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.85/input/input45 [ 605.546322][ T8734] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 605.553675][ T8734] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 605.815491][ T5927] usb 7-1: USB disconnect, device number 41 [ 605.864055][ T5927] appletouch 7-1:0.85: input: appletouch disconnected [ 606.177394][ T8729] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 606.367836][ T8729] usb 4-1: Using ep0 maxpacket: 8 [ 606.406886][ T8729] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 606.417906][ T8729] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 13 [ 606.450285][ T8729] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 606.461235][ T8729] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 606.475981][ T8729] usb 4-1: Product: syz [ 606.480287][ T8729] usb 4-1: Manufacturer: syz [ 606.499489][ T8729] usb 4-1: SerialNumber: syz [ 606.524618][ T8729] usb 4-1: config 0 descriptor?? [ 606.585157][ T8734] em28xx 2-1:0.0: Unknown AC97 audio processor detected! [ 606.793634][ T8734] em28xx 2-1:0.0: couldn't setup AC97 register 2 [ 606.822002][ T8729] usb 4-1: USB disconnect, device number 43 [ 606.841260][ T8734] em28xx 2-1:0.0: couldn't setup AC97 register 4 [ 606.859178][ T8734] em28xx 2-1:0.0: couldn't setup AC97 register 6 [ 606.892956][ T8734] em28xx 2-1:0.0: couldn't setup AC97 register 54 [ 607.030418][ T8734] em28xx 2-1:0.0: couldn't setup AC97 register 56 [ 607.057324][ T8734] usb 2-1: USB disconnect, device number 36 [ 607.457419][ T8729] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 607.637342][ T8729] usb 7-1: Using ep0 maxpacket: 8 [ 607.650286][ T8729] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 607.683958][ T8729] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 607.720102][ T8729] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 607.750396][ T8729] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 607.787226][ T8729] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 607.834145][ T8729] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 607.866032][ T8729] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.938645][T15750] [ 607.941005][T15750] ===================================================== [ 607.948119][T15750] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 607.955592][T15750] syzkaller #0 Not tainted [ 607.960013][T15750] ----------------------------------------------------- [ 607.966955][T15750] syz.8.2972/15750 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 607.974701][T15750] ffff8880271647f8 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 607.983466][T15750] [ 607.983466][T15750] and this task is already holding: [ 607.990844][T15750] ffff888032e8c468 (&tty->flow.lock){....}-{3:3}, at: start_tty+0x20/0x70 [ 607.999468][T15750] which would create a new lock dependency: [ 608.005346][T15750] (&tty->flow.lock){....}-{3:3} -> (&new->fa_lock){....}-{3:3} [ 608.013021][T15750] [ 608.013021][T15750] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 608.022471][T15750] (kbd_event_lock){..-.}-{3:3} [ 608.022501][T15750] [ 608.022501][T15750] ... which became SOFTIRQ-irq-safe at: [ 608.035030][T15750] lock_acquire+0x117/0x340 [ 608.039627][T15750] _raw_spin_lock+0x2e/0x40 [ 608.044216][T15750] kbd_event+0xd2/0x3f70 [ 608.048539][T15750] input_handle_events_default+0xd4/0x1a0 [ 608.054334][T15750] input_pass_values+0x288/0x890 [ 608.059352][T15750] input_event_dispose+0x3e5/0x6b0 [ 608.064561][T15750] input_event+0x89/0xe0 [ 608.068876][T15750] hidinput_hid_event+0x1404/0x1dd0 [ 608.074151][T15750] hid_process_event+0x4be/0x620 [ 608.079247][T15750] hid_report_raw_event+0xe91/0x16d0 [ 608.084603][T15750] hid_input_report+0x43e/0x520 [ 608.089614][T15750] hid_irq_in+0x47e/0x6d0 [ 608.094198][T15750] __usb_hcd_giveback_urb+0x376/0x540 [ 608.099660][T15750] dummy_timer+0x85f/0x44c0 [ 608.104240][T15750] __hrtimer_run_queues+0x51c/0xc30 [ 608.109511][T15750] hrtimer_run_softirq+0x187/0x2b0 [ 608.114694][T15750] handle_softirqs+0x27d/0x850 [ 608.119540][T15750] __irq_exit_rcu+0xca/0x1f0 [ 608.124206][T15750] irq_exit_rcu+0x9/0x30 [ 608.128564][T15750] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 608.134273][T15750] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 608.140324][T15750] _raw_spin_unlock_irq+0x29/0x50 [ 608.145424][T15750] rcu_gp_init+0x115d/0x16b0 [ 608.150088][T15750] rcu_gp_kthread+0x16a/0x390 [ 608.154840][T15750] kthread+0x711/0x8a0 [ 608.158978][T15750] ret_from_fork+0x52d/0xa60 [ 608.163646][T15750] ret_from_fork_asm+0x1a/0x30 [ 608.168480][T15750] [ 608.168480][T15750] to a SOFTIRQ-irq-unsafe lock: [ 608.175482][T15750] (tasklist_lock){.+.+}-{3:3} [ 608.175506][T15750] [ 608.175506][T15750] ... which became SOFTIRQ-irq-unsafe at: [ 608.188103][T15750] ... [ 608.188111][T15750] lock_acquire+0x117/0x340 [ 608.195252][T15750] _raw_read_lock+0x36/0x50 [ 608.199829][T15750] __do_wait+0xde/0x740 [ 608.204065][T15750] do_wait+0x1e8/0x4f0 [ 608.208206][T15750] kernel_wait+0xab/0x170 [ 608.212608][T15750] call_usermodehelper_exec_work+0xbe/0x230 [ 608.218587][T15750] process_scheduled_works+0xad1/0x1770 [ 608.224215][T15750] worker_thread+0x8a0/0xda0 [ 608.228881][T15750] kthread+0x711/0x8a0 [ 608.233020][T15750] ret_from_fork+0x52d/0xa60 [ 608.237693][T15750] ret_from_fork_asm+0x1a/0x30 [ 608.242553][T15750] [ 608.242553][T15750] other info that might help us debug this: [ 608.242553][T15750] [ 608.252767][T15750] Chain exists of: [ 608.252767][T15750] kbd_event_lock --> &tty->flow.lock --> tasklist_lock [ 608.252767][T15750] [ 608.265527][T15750] Possible interrupt unsafe locking scenario: [ 608.265527][T15750] [ 608.273826][T15750] CPU0 CPU1 [ 608.279175][T15750] ---- ---- [ 608.284524][T15750] lock(tasklist_lock); [ 608.288844][T15750] local_irq_disable(); [ 608.295578][T15750] lock(kbd_event_lock); [ 608.302497][T15750] lock(&tty->flow.lock); [ 608.309417][T15750] [ 608.312881][T15750] lock(kbd_event_lock); [ 608.317396][T15750] [ 608.317396][T15750] *** DEADLOCK *** [ 608.317396][T15750] [ 608.325532][T15750] 6 locks held by syz.8.2972/15750: [ 608.330720][T15750] #0: ffff888032e8c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 608.340457][T15750] #1: ffff888032e8c2e8 (&tty->termios_rwsem/1){++++}-{4:4}, at: tty_set_termios+0x138/0x17e0 [ 608.350712][T15750] #2: ffff888032e8c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1c/0x90 [ 608.360010][T15750] #3: ffff888032e8c468 (&tty->flow.lock){....}-{3:3}, at: start_tty+0x20/0x70 [ 608.368955][T15750] #4: ffff888032e8c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1c/0x90 [ 608.378359][T15750] #5: ffffffff8df414c0 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 608.387495][T15750] [ 608.387495][T15750] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 608.398151][T15750] -> (kbd_event_lock){..-.}-{3:3} { [ 608.403533][T15750] IN-SOFTIRQ-W at: [ 608.407596][T15750] lock_acquire+0x117/0x340 [ 608.413920][T15750] _raw_spin_lock+0x2e/0x40 [ 608.420246][T15750] kbd_event+0xd2/0x3f70 [ 608.426366][T15750] input_handle_events_default+0xd4/0x1a0 [ 608.433894][T15750] input_pass_values+0x288/0x890 [ 608.440643][T15750] input_event_dispose+0x3e5/0x6b0 [ 608.447565][T15750] input_event+0x89/0xe0 [ 608.453620][T15750] hidinput_hid_event+0x1404/0x1dd0 [ 608.460625][T15750] hid_process_event+0x4be/0x620 [ 608.467371][T15750] hid_report_raw_event+0xe91/0x16d0 [ 608.474464][T15750] hid_input_report+0x43e/0x520 [ 608.481121][T15750] hid_irq_in+0x47e/0x6d0 [ 608.487260][T15750] __usb_hcd_giveback_urb+0x376/0x540 [ 608.494448][T15750] dummy_timer+0x85f/0x44c0 [ 608.500761][T15750] __hrtimer_run_queues+0x51c/0xc30 [ 608.507766][T15750] hrtimer_run_softirq+0x187/0x2b0 [ 608.514683][T15750] handle_softirqs+0x27d/0x850 [ 608.521259][T15750] __irq_exit_rcu+0xca/0x1f0 [ 608.527675][T15750] irq_exit_rcu+0x9/0x30 [ 608.533729][T15750] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 608.541177][T15750] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 608.548965][T15750] _raw_spin_unlock_irq+0x29/0x50 [ 608.555803][T15750] rcu_gp_init+0x115d/0x16b0 [ 608.562204][T15750] rcu_gp_kthread+0x16a/0x390 [ 608.568693][T15750] kthread+0x711/0x8a0 [ 608.574597][T15750] ret_from_fork+0x52d/0xa60 [ 608.581009][T15750] ret_from_fork_asm+0x1a/0x30 [ 608.587586][T15750] INITIAL USE at: [ 608.591558][T15750] lock_acquire+0x117/0x340 [ 608.597791][T15750] _raw_spin_lock_irqsave+0xa7/0xf0 [ 608.604719][T15750] vt_reset_unicode+0x2b/0x160 [ 608.611209][T15750] reset_vc+0x68/0x1b0 [ 608.617016][T15750] vc_init+0x70/0x4a0 [ 608.622718][T15750] con_init+0x385/0x9c0 [ 608.628599][T15750] console_init+0xfc/0x3f0 [ 608.634737][T15750] start_kernel+0x254/0x410 [ 608.640967][T15750] x86_64_start_reservations+0x24/0x30 [ 608.648145][T15750] x86_64_start_kernel+0x143/0x1c0 [ 608.654976][T15750] common_startup_64+0x13e/0x147 [ 608.661635][T15750] } [ 608.664205][T15750] ... key at: [] kbd_event_lock+0x18/0xa0 [ 608.672082][T15750] -> (&tty->flow.lock){....}-{3:3} { [ 608.677370][T15750] INITIAL USE at: [ 608.681250][T15750] lock_acquire+0x117/0x340 [ 608.687309][T15750] _raw_spin_lock_irqsave+0xa7/0xf0 [ 608.694059][T15750] start_tty+0x20/0x70 [ 608.699676][T15750] n_tty_set_termios+0xa7c/0x1090 [ 608.706254][T15750] tty_set_termios+0xda4/0x17e0 [ 608.712653][T15750] set_termios+0x516/0x6c0 [ 608.718614][T15750] tty_mode_ioctl+0x47e/0x740 [ 608.724841][T15750] tty_ioctl+0x9c6/0xde0 [ 608.730637][T15750] __se_sys_ioctl+0xfc/0x170 [ 608.736781][T15750] do_syscall_64+0xfa/0xf80 [ 608.742833][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.750274][T15750] } [ 608.752756][T15750] ... key at: [] alloc_tty_struct.__key.35+0x0/0x20 [ 608.761522][T15750] ... acquired at: [ 608.765316][T15750] _raw_spin_lock_irqsave+0xa7/0xf0 [ 608.770694][T15750] stop_tty+0x2f/0x150 [ 608.774934][T15750] kbd_event+0x2b72/0x3f70 [ 608.779516][T15750] input_handle_events_default+0xd4/0x1a0 [ 608.785404][T15750] input_pass_values+0x288/0x890 [ 608.790511][T15750] input_event_dispose+0x330/0x6b0 [ 608.795782][T15750] input_inject_event+0x1dd/0x340 [ 608.800965][T15750] evdev_write+0x2fc/0x480 [ 608.805536][T15750] vfs_write+0x27e/0xb30 [ 608.809946][T15750] ksys_write+0x145/0x250 [ 608.814613][T15750] do_syscall_64+0xfa/0xf80 [ 608.819274][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.825326][T15750] [ 608.827646][T15750] [ 608.827646][T15750] the dependencies between the lock to be acquired [ 608.827657][T15750] and SOFTIRQ-irq-unsafe lock: [ 608.841222][T15750] -> (tasklist_lock){.+.+}-{3:3} { [ 608.846518][T15750] HARDIRQ-ON-R at: [ 608.850657][T15750] lock_acquire+0x117/0x340 [ 608.857162][T15750] _raw_read_lock+0x36/0x50 [ 608.863653][T15750] __do_wait+0xde/0x740 [ 608.869793][T15750] do_wait+0x1e8/0x4f0 [ 608.875843][T15750] kernel_wait+0xab/0x170 [ 608.882155][T15750] call_usermodehelper_exec_work+0xbe/0x230 [ 608.890039][T15750] process_scheduled_works+0xad1/0x1770 [ 608.897577][T15750] worker_thread+0x8a0/0xda0 [ 608.904151][T15750] kthread+0x711/0x8a0 [ 608.910200][T15750] ret_from_fork+0x52d/0xa60 [ 608.916785][T15750] ret_from_fork_asm+0x1a/0x30 [ 608.923535][T15750] SOFTIRQ-ON-R at: [ 608.927677][T15750] lock_acquire+0x117/0x340 [ 608.934166][T15750] _raw_read_lock+0x36/0x50 [ 608.940655][T15750] __do_wait+0xde/0x740 [ 608.946802][T15750] do_wait+0x1e8/0x4f0 [ 608.952866][T15750] kernel_wait+0xab/0x170 [ 608.959270][T15750] call_usermodehelper_exec_work+0xbe/0x230 [ 608.967163][T15750] process_scheduled_works+0xad1/0x1770 [ 608.974724][T15750] worker_thread+0x8a0/0xda0 [ 608.981309][T15750] kthread+0x711/0x8a0 [ 608.987371][T15750] ret_from_fork+0x52d/0xa60 [ 608.993955][T15750] ret_from_fork_asm+0x1a/0x30 [ 609.000705][T15750] INITIAL USE at: [ 609.004758][T15750] lock_acquire+0x117/0x340 [ 609.011163][T15750] _raw_write_lock_irq+0xa2/0xf0 [ 609.018015][T15750] copy_process+0x225c/0x3c10 [ 609.024587][T15750] kernel_clone+0x21e/0x820 [ 609.030988][T15750] user_mode_thread+0xdd/0x140 [ 609.037650][T15750] rest_init+0x23/0x300 [ 609.043706][T15750] start_kernel+0x3ae/0x410 [ 609.050110][T15750] x86_64_start_reservations+0x24/0x30 [ 609.057466][T15750] x86_64_start_kernel+0x143/0x1c0 [ 609.064475][T15750] common_startup_64+0x13e/0x147 [ 609.071310][T15750] INITIAL READ USE at: [ 609.075797][T15750] lock_acquire+0x117/0x340 [ 609.082636][T15750] _raw_read_lock+0x36/0x50 [ 609.089473][T15750] __do_wait+0xde/0x740 [ 609.095961][T15750] do_wait+0x1e8/0x4f0 [ 609.102360][T15750] kernel_wait+0xab/0x170 [ 609.109023][T15750] call_usermodehelper_exec_work+0xbe/0x230 [ 609.117251][T15750] process_scheduled_works+0xad1/0x1770 [ 609.125129][T15750] worker_thread+0x8a0/0xda0 [ 609.132072][T15750] kthread+0x711/0x8a0 [ 609.138498][T15750] ret_from_fork+0x52d/0xa60 [ 609.145430][T15750] ret_from_fork_asm+0x1a/0x30 [ 609.152526][T15750] } [ 609.155187][T15750] ... key at: [] tasklist_lock+0x18/0x40 [ 609.163075][T15750] ... acquired at: [ 609.167035][T15750] _raw_read_lock+0x36/0x50 [ 609.171702][T15750] send_sigurg+0x12b/0x420 [ 609.176279][T15750] sk_send_sigurg+0x6c/0x2e0 [ 609.181027][T15750] queue_oob+0x420/0x4f0 [ 609.185429][T15750] unix_stream_sendmsg+0xc3f/0xdf0 [ 609.190698][T15750] __sock_sendmsg+0x21c/0x270 [ 609.195541][T15750] ____sys_sendmsg+0x52d/0x820 [ 609.200466][T15750] ___sys_sendmsg+0x21f/0x2a0 [ 609.205301][T15750] __sys_sendmmsg+0x227/0x430 [ 609.210137][T15750] __x64_sys_sendmmsg+0xa0/0xc0 [ 609.215244][T15750] do_syscall_64+0xfa/0xf80 [ 609.219921][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.225997][T15750] [ 609.228322][T15750] -> (&f_owner->lock){....}-{3:3} { [ 609.233617][T15750] INITIAL USE at: [ 609.237588][T15750] lock_acquire+0x117/0x340 [ 609.243828][T15750] _raw_write_lock_irq+0xa2/0xf0 [ 609.250506][T15750] __f_setown+0x67/0x370 [ 609.256517][T15750] generic_setlease+0xe1e/0x1280 [ 609.263178][T15750] do_fcntl_add_lease+0x34d/0x460 [ 609.269926][T15750] fcntl_setlease+0x123/0x180 [ 609.276494][T15750] do_fcntl+0x867/0x1a50 [ 609.282462][T15750] __se_sys_fcntl+0xc8/0x150 [ 609.288778][T15750] do_syscall_64+0xfa/0xf80 [ 609.295012][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.302628][T15750] INITIAL READ USE at: [ 609.307032][T15750] lock_acquire+0x117/0x340 [ 609.313696][T15750] _raw_read_lock_irqsave+0xaf/0x100 [ 609.321147][T15750] send_sigio+0x38/0x370 [ 609.327549][T15750] dnotify_handle_event+0x169/0x440 [ 609.334923][T15750] fsnotify+0x1814/0x1a80 [ 609.341502][T15750] fsnotify_move+0x1d7/0x5b0 [ 609.348265][T15750] vfs_rename+0x8a4/0xee0 [ 609.354761][T15750] do_renameat2+0x538/0x8e0 [ 609.361439][T15750] __x64_sys_renameat2+0xce/0xe0 [ 609.368533][T15750] do_syscall_64+0xfa/0xf80 [ 609.375197][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.383249][T15750] } [ 609.385817][T15750] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 609.394746][T15750] ... acquired at: [ 609.398617][T15750] _raw_read_lock_irqsave+0xaf/0x100 [ 609.404077][T15750] send_sigio+0x38/0x370 [ 609.408480][T15750] kill_fasync+0x24d/0x4d0 [ 609.413056][T15750] lease_break_callback+0x26/0x30 [ 609.418253][T15750] __break_lease+0x730/0x1620 [ 609.423086][T15750] do_dentry_open+0x73a/0x1420 [ 609.428005][T15750] vfs_open+0x3b/0x340 [ 609.432230][T15750] path_openat+0x340e/0x3dd0 [ 609.436978][T15750] do_filp_open+0x1fa/0x410 [ 609.441642][T15750] do_sys_openat2+0x121/0x200 [ 609.446479][T15750] __x64_sys_open+0x11e/0x150 [ 609.451313][T15750] do_syscall_64+0xfa/0xf80 [ 609.455987][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.462038][T15750] [ 609.464345][T15750] -> (&new->fa_lock){....}-{3:3} { [ 609.469461][T15750] INITIAL USE at: [ 609.473337][T15750] lock_acquire+0x117/0x340 [ 609.479392][T15750] _raw_write_lock_irq+0xa2/0xf0 [ 609.485885][T15750] fasync_remove_entry+0xf1/0x1c0 [ 609.492459][T15750] sock_fasync+0x85/0xf0 [ 609.498254][T15750] __fput+0x8a2/0xa70 [ 609.503783][T15750] task_work_run+0x1d4/0x260 [ 609.509921][T15750] exit_to_user_mode_loop+0xe9/0x130 [ 609.516756][T15750] do_syscall_64+0x2c7/0xf80 [ 609.522890][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.530336][T15750] INITIAL READ USE at: [ 609.534649][T15750] lock_acquire+0x117/0x340 [ 609.541137][T15750] _raw_read_lock_irqsave+0xaf/0x100 [ 609.548406][T15750] kill_fasync+0x199/0x4d0 [ 609.554837][T15750] sock_wake_async+0x137/0x160 [ 609.561595][T15750] sctp_data_ready+0x3c1/0x530 [ 609.568348][T15750] sctp_ulpq_tail_event+0x809/0xb70 [ 609.575532][T15750] do_ulpq_tail_event+0x109/0x160 [ 609.582543][T15750] sctp_datamsg_put+0x3ec/0x540 [ 609.589478][T15750] sctp_chunk_free+0x4a/0x60 [ 609.596054][T15750] __sctp_outq_teardown+0x7ab/0x9a0 [ 609.603232][T15750] sctp_association_free+0x240/0x7f0 [ 609.610494][T15750] sctp_do_sm+0x3eba/0x5a20 [ 609.616982][T15750] sctp_primitive_SHUTDOWN+0x98/0xc0 [ 609.624246][T15750] inet_shutdown+0x271/0x390 [ 609.630832][T15750] __x64_sys_shutdown+0x13f/0x1a0 [ 609.637929][T15750] do_syscall_64+0xfa/0xf80 [ 609.644413][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.652289][T15750] } [ 609.654772][T15750] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 609.663430][T15750] ... acquired at: [ 609.667217][T15750] _raw_read_lock_irqsave+0xaf/0x100 [ 609.672664][T15750] kill_fasync+0x199/0x4d0 [ 609.677239][T15750] __start_tty+0x18c/0x220 [ 609.681838][T15750] start_tty+0x2b/0x70 [ 609.686061][T15750] n_tty_set_termios+0xa7c/0x1090 [ 609.691248][T15750] tty_set_termios+0xda4/0x17e0 [ 609.696254][T15750] set_termios+0x516/0x6c0 [ 609.700826][T15750] tty_mode_ioctl+0x47e/0x740 [ 609.705657][T15750] tty_ioctl+0x9c6/0xde0 [ 609.710055][T15750] __se_sys_ioctl+0xfc/0x170 [ 609.714813][T15750] do_syscall_64+0xfa/0xf80 [ 609.719475][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.725527][T15750] [ 609.727840][T15750] [ 609.727840][T15750] stack backtrace: [ 609.733712][T15750] CPU: 0 UID: 0 PID: 15750 Comm: syz.8.2972 Not tainted syzkaller #0 PREEMPT(full) [ 609.733730][T15750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 609.733740][T15750] Call Trace: [ 609.733746][T15750] [ 609.733752][T15750] dump_stack_lvl+0x189/0x250 [ 609.733769][T15750] ? __pfx_dump_stack_lvl+0x10/0x10 [ 609.733790][T15750] ? __pfx__printk+0x10/0x10 [ 609.733816][T15750] __lock_acquire+0x2a95/0x2cf0 [ 609.733845][T15750] ? kill_fasync+0x199/0x4d0 [ 609.733863][T15750] lock_acquire+0x117/0x340 [ 609.733881][T15750] ? kill_fasync+0x199/0x4d0 [ 609.733903][T15750] _raw_read_lock_irqsave+0xaf/0x100 [ 609.733923][T15750] ? kill_fasync+0x199/0x4d0 [ 609.733940][T15750] ? __pfx__raw_read_lock_irqsave+0x10/0x10 [ 609.733961][T15750] kill_fasync+0x199/0x4d0 [ 609.733978][T15750] ? kill_fasync+0x53/0x4d0 [ 609.733995][T15750] ? __pfx_n_tty_write_wakeup+0x10/0x10 [ 609.734015][T15750] __start_tty+0x18c/0x220 [ 609.734029][T15750] start_tty+0x2b/0x70 [ 609.734043][T15750] n_tty_set_termios+0xa7c/0x1090 [ 609.734064][T15750] ? __pfx_n_tty_set_termios+0x10/0x10 [ 609.734082][T15750] tty_set_termios+0xda4/0x17e0 [ 609.734098][T15750] ? __pfx_tty_set_termios+0x10/0x10 [ 609.734116][T15750] set_termios+0x516/0x6c0 [ 609.734131][T15750] ? __pfx_set_termios+0x10/0x10 [ 609.734144][T15750] ? tty_ldisc_ref_wait+0x25/0x70 [ 609.734164][T15750] tty_mode_ioctl+0x47e/0x740 [ 609.734178][T15750] ? __pfx_tty_mode_ioctl+0x10/0x10 [ 609.734190][T15750] ? tty_ldisc_ref_wait+0x25/0x70 [ 609.734204][T15750] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 609.734228][T15750] ? n_tty_ioctl_helper+0x8e/0x340 [ 609.734242][T15750] ? __pfx_n_tty_ioctl+0x10/0x10 [ 609.734260][T15750] tty_ioctl+0x9c6/0xde0 [ 609.734277][T15750] ? __pfx_tty_ioctl+0x10/0x10 [ 609.734292][T15750] __se_sys_ioctl+0xfc/0x170 [ 609.734311][T15750] do_syscall_64+0xfa/0xf80 [ 609.734324][T15750] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.734337][T15750] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 609.734351][T15750] ? clear_bhb_loop+0x60/0xb0 [ 609.734365][T15750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 609.734379][T15750] RIP: 0033:0x7f9d6118f749 [ 609.734393][T15750] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 609.734405][T15750] RSP: 002b:00007f9d61fcf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 609.734421][T15750] RAX: ffffffffffffffda RBX: 00007f9d613e6090 RCX: 00007f9d6118f749 [ 609.734432][T15750] RDX: 0000200000000140 RSI: 0000000000005402 RDI: 0000000000000004 [ 609.734441][T15750] RBP: 00007f9d61213f91 R08: 0000000000000000 R09: 0000000000000000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 609.734450][T15750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 609.734459][T15750] R13: 00007f9d613e6128 R14: 00007f9d613e6090 R15: 00007f9d6150fa28 [ 609.734474][T15750] [ 610.110611][T15751] netlink: 'syz.1.2976': attribute type 1 has an invalid length. [ 610.124520][ T8729] usb 7-1: usb_control_msg returned -71 [ 610.147438][ T8729] usbtmc 7-1:16.0: can't read capabilities [ 610.160077][ T8729] usb 7-1: USB disconnect, device number 42 [ 610.241093][T15752] __nla_validate_parse: 26 callbacks suppressed [ 610.241115][T15752] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2976'. [ 610.368240][T15760] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2976'. [ 610.399736][T15751] bond3: entered promiscuous mode [ 610.404791][T15751] bond3: entered allmulticast mode [ 610.564874][T15752] bridge6: the hash_elasticity option has been deprecated and is always 16 [ 610.614330][T15752] bond3: (slave bridge6): making interface the new active one [ 610.657468][T15752] bridge6: entered promiscuous mode [ 610.662841][T15752] bridge6: entered allmulticast mode [ 610.688279][T15752] bond3: (slave bridge6): Enslaving as an active interface with an up link [ 610.718647][T15760] bond3: left promiscuous mode [ 610.723451][T15760] bridge6: left promiscuous mode [ 610.747402][T15760] bond3: left allmulticast mode [ 610.752302][T15760] bridge6: left allmulticast mode [ 610.774070][T15760] 8021q: adding VLAN 0 to HW filter on device bond3 [ 611.319940][ T5970] team0: Port device netdevsim0 removed [ 611.420236][ T5970] bridge_slave_1: left allmulticast mode [ 611.425911][ T5970] bridge_slave_1: left promiscuous mode [ 611.447641][ T5970] bridge0: port 2(bridge_slave_1) entered disabled state [ 611.455970][ T5970] bridge_slave_0: left allmulticast mode [ 611.467619][ T5970] bridge_slave_0: left promiscuous mode [ 611.473513][ T5970] bridge0: port 1(bridge_slave_0) entered disabled state [ 611.958815][ T5970] bond3 (unregistering): (slave bridge6): Releasing active interface [ 612.111260][ T5970] bond2 (unregistering): (slave macvlan0): Releasing backup interface [ 612.122008][ T5970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 612.131595][ T5970] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 612.140663][ T5970] bond0 (unregistering): Released all slaves [ 612.149985][ T5970] bond1 (unregistering): Released all slaves [ 612.162848][ T5970] bond2 (unregistering): Released all slaves [ 612.172704][ T5970] bond3 (unregistering): Released all slaves [ 612.236465][ T5970] : left promiscuous mode [ 612.453899][ T5970] hsr_slave_0: left promiscuous mode [ 612.459888][ T5970] hsr_slave_1: left promiscuous mode [ 612.465706][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 612.475143][ T5970] pim6reg (unregistering): left allmulticast mode [ 612.743208][ T5970] team0 (unregistering): Port device team_slave_1 removed [ 612.786754][ T5970] team0 (unregistering): Port device team_slave_0 removed [ 613.106652][ T5970] lo (unregistering): left allmulticast mode [ 613.300850][ T5970] IPVS: stop unused estimator thread 0... [ 613.411413][ T5970] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.461368][ T5970] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.522508][ T5970] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.552908][ T5970] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.654085][ T5970] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.704129][ T5970] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.744590][ T5970] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.800305][ T5970] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 613.912597][ T5970] bridge_slave_1: left allmulticast mode [ 613.919300][ T5970] bridge_slave_1: left promiscuous mode [ 613.925026][ T5970] bridge0: port 2(bridge_slave_1) entered disabled state [ 613.934944][ T5970] bridge_slave_0: left allmulticast mode [ 613.942444][ T5970] bridge_slave_0: left promiscuous mode [ 613.949330][ T5970] bridge0: port 1(bridge_slave_0) entered disabled state [ 613.959068][ T5970] bridge_slave_1: left allmulticast mode [ 613.964703][ T5970] bridge_slave_1: left promiscuous mode [ 613.971069][ T5970] bridge0: port 2(bridge_slave_1) entered disabled state [ 613.980456][ T5970] bridge_slave_0: left allmulticast mode [ 613.986081][ T5970] bridge_slave_0: left promiscuous mode [ 613.992062][ T5970] bridge0: port 1(bridge_slave_0) entered disabled state [ 614.132013][ T5970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 614.142772][ T5970] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 614.152617][ T5970] bond0 (unregistering): Released all slaves [ 614.209911][ T5970] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 614.219589][ T5970] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 614.229173][ T5970] bond0 (unregistering): Released all slaves [ 614.524856][ T5970] hsr_slave_0: left promiscuous mode [ 614.530811][ T5970] hsr_slave_1: left promiscuous mode [ 614.536452][ T5970] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 614.543937][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 614.551663][ T5970] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 614.559134][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 614.570995][ T5970] hsr_slave_0: left promiscuous mode [ 614.576634][ T5970] hsr_slave_1: left promiscuous mode [ 614.582577][ T5970] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 614.590111][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 614.598518][ T5970] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 614.605889][ T5970] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 614.617545][ T5970] veth1_macvtap: left promiscuous mode [ 614.623053][ T5970] veth0_macvtap: left promiscuous mode [ 614.628730][ T5970] veth1_vlan: left promiscuous mode [ 614.633974][ T5970] veth0_vlan: left promiscuous mode [ 614.639987][ T5970] veth1_macvtap: left promiscuous mode [ 614.645461][ T5970] veth0_macvtap: left promiscuous mode [ 614.651097][ T5970] veth1_vlan: left promiscuous mode [ 614.656344][ T5970] veth0_vlan: left promiscuous mode [ 614.823743][ T5970] team0 (unregistering): Port device team_slave_1 removed [ 614.835300][ T5970] team0 (unregistering): Port device team_slave_0 removed [ 615.012019][ T5970] team0 (unregistering): Port device team_slave_1 removed [ 615.039718][ T5970] team0 (unregistering): Port device team_slave_0 removed