last executing test programs: 27.595462391s ago: executing program 2 (id=3): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x8871b000) (async) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x17, &(0x7f0000000080)=0x1, 0x4) (async) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='map_files\x00') fchdir(r1) creat(&(0x7f00000010c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1e4) 27.151209791s ago: executing program 2 (id=11): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000000), 0x7, 0x400000) ioctl$HIDIOCGDEVINFO(r1, 0x801c4803, &(0x7f0000000040)=""/4) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000000000)=0x1) sendmmsg$inet6(r2, &(0x7f0000007240)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x6, @mcast2, 0x7}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001380)=[{&(0x7f00000012c0)="1ce02c7a", 0xfe60}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000), 0x1}}], 0x400000000000220, 0x1c000) ppoll(&(0x7f0000000080)=[{r2, 0x10}], 0x1, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000440)={0x0, 0x0, 0x0, &(0x7f0000000200)=""/148, 0x0}) r4 = dup(r3) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f00000001c0)={0x0, r4}) 25.9560645s ago: executing program 2 (id=16): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000840)={@val={0x8, 0x800}, @val={0x6, 0x0, 0x6, 0x0, 0x14, 0xfffe}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x16, 0x14, 0x68, 0x0, 0xb, 0x32, 0x0, @private=0xa010100, @broadcast}}}, 0x22) r3 = accept$alg(r0, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCOUTQ(r4, 0x5411, &(0x7f00000000c0)) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000580)="b19ccccf84f531d9ec4cda81a3ef2ca8", 0x10) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000580)="b19ccccf84f531d9ec4cda81a3ef2ca8", 0x10) sendmmsg$alg(r3, &(0x7f00000061c0)=[{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f00000005c0)="ed662cff3672974e4d737d008dddd10dc59443b6c659f29573aca4d8d90c7b891cfd3bc0fea2b99c36cd4048c01be84d61e79264ddeeecbcbfa17e2884f0bcc221f5357317115cfda2e1a2db1e46a73f97534e68806943333f58ac3ad9e36bca32b6070791721062388ecded928121b83c028c8d1a32a863c69bcf224382ef8dd445211a09f1ec2b2ea5ab2f41613ac27a79dfdd7829343a74d350430b084f1b30c55b287a082cc5b38e6edc6fa4c270d64815f8c5fcdb793e327bf2d78ef9111047503f89014da9581e7124c2c04f8be5fdc19f446286abc3460f7ca6", 0xdd}, {&(0x7f0000000080)="b4bc5d84e96cb99d72fdb00fe697976aa4bbdba4f93a8fa38eebb04ed64e64f5f35fde0cc3d938f3a35d4af0bb60fc36ea6a87631c9ab3", 0x37}, {&(0x7f00000029c0)="79039a73c40db0f21b4964c7ff46f66ee06648c40195bf3e9f66c49a6281c5ceb505a66ed4d22001f4c28dba305c3b091bfb6f6794827c83ea62f642c2cc1141fad6fb767875a61d727a6f06d43ae1f410fc00e21bcaeab03754309ec2848004b3a5b9e2b4e81ba169010756a73af927fc282ebb1408dd5756b07b0155bb901fb4282ad84f56e25cbed8f78910279a9cd97f21ae3eb2adba9977034fba74c9b7771ddd6aba0e58262948a5a8bd7023e09a62ce7c05c961c897ac7e836321f589471b7433611f1cf2fc50d982bccd7c91ff88868e8933bdc142b58be0e7bf407852ce98e59de967c8736e92c5c3d10a3e6a698faa96cd6cf0262691a59f4fbe3efafcf6ea620a96611825141864bbba2d165b938fb44abe7a7aa4129538536149f59ff5cc2b5b385a2af9944f4a5e16b14a0312981eedbf13e97622d2d88d6089ae2ada5dcec081b3f581b043b53fcd9e1fcce4c10bbc2b6c766510e3b37913bb008c861ce0568be853f0f0666b02cc411f9cf31ac9464cf89056bec7f825637e18b8eb4fb1497bf468b3ae1de3f796ae655b68c12c9dbe63c5020b37e2bd62747f454a536445ba3e2ca9da3bdd87615c3998d51a6d469c7258d1ab6c448c9366638af0a3c127e36bb983d8ac280f5136ea82deeeac40fc941b308b4d550d1088994ea3b753e45b38ca6e7b3f6e569caf1d143f6e2eb3e22cc54fe7d0f83ec4e1cd647ba0f1e70cf6f173cfe9c4117381fe4987dbe724a9dac39ed0d75e7438602cc0facc4470a84264e75eb0073604712f8d366070e637dc54658937de350e65879868078c7eccccd6c2af157635d850450f2611473848e5cf8f35a738eba546a2ba3fa8cebcaf47b5db2c1029aae7f321485088b1a0952a4e188a53e830d08147c60ac7edea4740bb1d10ee24342e7f7988207fd12dcc65565ff570eaf439918561d2e136d2ba31dd3508e071c3b152707f27651e4ff6f1935c479cbf5e8b1501f27a8a0289e80674602853a63db38f8f914604ab9f7e3a1c34852d67b82e055f155b2e448f9cbb6c13ba9b75efa9e908bafce169019ef4afcdbd35b3380e13cdfb7ff97d86d90b746bf8a5411c1f5f449be0816a53afa4a36ff6330bb99aba9c727ce8fb0416a52b9d208ca5db0537e9b34f84ff0231eaf8efc7457047af5640c873d449d7afab4ae62b4c09e87478cf1742ffd5f96ef2f267684f653473d34c3bf9891bdd99600ae4a89a63f218bca23549f4f28c3729ebc87065648bf3dd9317147ce3e9fbc023e368d5b1fee21b85595f29b5adfd31b7ddf0e97c84bedda954e5ee4053e0c1e607a3abb0b793585d6922de9d623e3196ed18bb59847fb1fff79c08bca93749e284c3b39f8ca0abb1f50d44d04e82785c322720780abccc487ae1f74d2693e6edcb526824fe679461c8d687cb03f262bd774a9c59d763282e520e61262340cb9e8a099bbd159447aca215ed401af931dd20d73c31d48382e9343fa2a84dbf69277b1c1f425cf0853d7b612929f89832d6b6ea759ab5639e858c6aa3685b3afb59732f369c0cf7cc6b7f37a1872b0475fa32b6238aceca41dc4ab734e7e2ef6065c2512c60d8b6721cd417e1adc4b85dffdabb060e9b53447d9c028e649bcf9b114978789c68fc236aca7785621ac64f25ac1b460bbf646ab3ed61eba78279d3f467f3661e54d503edcf652d278839b0511caedb9655fe35129d12f19a4da9f40dc3fe42654078a1fa507f4da852d486626dd7abe46f0de872bbbcfa2f188f3d956d204c55a789365468fab3251a8bea46e33c3d5d5d8fedf634aa0d598635d097c658bc600a4ad4a856b72db01d15d327e626c9fa482a9639272c177628216e9206737e7ae56412143039ea412787dc9eada884d77162509a98a9a6b9c6b3054690515f65", 0x54d}], 0x3, &(0x7f0000000540)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40010000) seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000000)=0x7fc00000) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0xffffffff, 0x6, 0x0, 0xc5a4, 0x200000000000, 0x2, 0x10003, 0x877, 0x8000000000000, 0x80000001, 0x0, 0x9, 0x1, 0x5, 0x10000100000008ca, 0x400008005], 0x80a0000, 0x100c02}) (async) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0xffffffff, 0x6, 0x0, 0xc5a4, 0x200000000000, 0x2, 0x10003, 0x877, 0x8000000000000, 0x80000001, 0x0, 0x9, 0x1, 0x5, 0x10000100000008ca, 0x400008005], 0x80a0000, 0x100c02}) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) (async) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5393, &(0x7f0000000000)) (async) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5393, &(0x7f0000000000)) recvmsg(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000019c0)=""/4078, 0xfee}], 0x1}, 0x12162) 24.972525663s ago: executing program 2 (id=21): r0 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x10) r1 = epoll_create1(0x0) fcntl$dupfd(r1, 0x0, r1) epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0x2) mount$9p_unix(&(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000240), 0x2000000, &(0x7f00000004c0)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x7) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000001040)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac2(r5, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000600)={0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="a8dd00000000aadcc9d25c2a35f3f283e2fc967462efd578ad859ea0403cbaf6478121a8b8cf6e47"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r5, 0x0, &(0x7f0000000d80)={0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="000f000000bed8e4a236136795d515dfe49da48d00"], 0x0, 0x0}) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r7 = socket$kcm(0x10, 0x2, 0x4) close(r7) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000780)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea6f464160af36514001a240800020004000200060006000364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000800)=ANY=[], 0x114}], 0x1, 0x0, 0x0, 0x40001}, 0x0) 9.917813179s ago: executing program 32 (id=21): r0 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x10) r1 = epoll_create1(0x0) fcntl$dupfd(r1, 0x0, r1) epoll_create1(0x0) r2 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0x2) mount$9p_unix(&(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000200)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000240), 0x2000000, &(0x7f00000004c0)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETLINK(r3, 0x400454cd, 0x7) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000001040)=ANY=[@ANYBLOB="1201000040154220a9055015bbe4010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$uac2(r5, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000600)={0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="a8dd00000000aadcc9d25c2a35f3f283e2fc967462efd578ad859ea0403cbaf6478121a8b8cf6e47"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r5, 0x0, &(0x7f0000000d80)={0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="000f000000bed8e4a236136795d515dfe49da48d00"], 0x0, 0x0}) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r7 = socket$kcm(0x10, 0x2, 0x4) close(r7) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000780)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea6f464160af36514001a240800020004000200060006000364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000800)=ANY=[], 0x114}], 0x1, 0x0, 0x0, 0x40001}, 0x0) 5.837903512s ago: executing program 0 (id=73): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x106, 0x2}}, 0xfe5e) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x2000000000001005, 0x19dff, 0x4}}}, 0x90) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000080)={[0x2]}, 0x8, 0x80000) readv(r3, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/128, 0x80}], 0x1) landlock_restrict_self(r2, 0xe) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x106, 0x2}}, 0xfe5e) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r5, 0x30, 0x0, @in6={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8}}}, 0x90) r6 = socket(0x10, 0x3, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="000100feffffff00010000fe88000000000000000000000000000100000000000000000000000000000001000107144e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c0000007f000001000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff8000000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd700003350000020001002000000000000000480003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800180000100000"], 0x140}, 0x1, 0x0, 0x0, 0x8801}, 0x0) socket$caif_stream(0x25, 0x1, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) r9 = accept4(r8, 0x0, 0x0, 0x80800) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x4040000) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000340)}, {&(0x7f00000003c0)=""/116, 0x74}], 0x3}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="10009641b67525bef7391000000008000300000000000800130001"], 0x24}, 0x1, 0x0, 0x0, 0x40855}, 0x24004140) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="d8000000210081044e81f7d28344b90402", 0x11}], 0x1}, 0x0) r10 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000000)=ANY=[], 0x33fe0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000000401"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x20048800) write(r6, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) socket(0x2, 0x80805, 0x0) 5.176207179s ago: executing program 3 (id=75): mkdir(&(0x7f0000000000)='./file0\x00', 0xe95b787bbbb12e9) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000a80)='./file0\x00', &(0x7f0000000080)='romfs\x00', 0x4000, &(0x7f0000000140)='grpquota') r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x2) execveat(r0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={[&(0x7f0000000180)='\\\x00', &(0x7f00000001c0)='+\\\x00']}, &(0x7f00000002c0)={[&(0x7f0000000240)='grpquota', &(0x7f0000000280)=':.+-)-,,/{#%}.\x00']}, 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0xe95b787bbbb12e9) (async) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000a80)='./file0\x00', &(0x7f0000000080)='romfs\x00', 0x4000, &(0x7f0000000140)='grpquota') (async) open$dir(&(0x7f00000000c0)='./file0\x00', 0x0, 0x2) (async) execveat(r0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)={[&(0x7f0000000180)='\\\x00', &(0x7f00000001c0)='+\\\x00']}, &(0x7f00000002c0)={[&(0x7f0000000240)='grpquota', &(0x7f0000000280)=':.+-)-,,/{#%}.\x00']}, 0x100) (async) 5.033548749s ago: executing program 3 (id=76): r0 = add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00"}, 0x48, 0xfffffffffffffffe) keyctl$unlink(0x9, r0, r0) (async) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x8, 0x4, 0x8b, 0xfffa}, 0x1d, [0x7ffe, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x8, 0x4, 0x3c5b, 0x1, 0x3, 0x9, 0x1, 0x1f461e2c, 0x0, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x1, 0x80000000, 0x242, 0x3, 0xe, 0xfffffffe, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0xd, 0x80003e, 0x8f, 0x6, 0x10000006, 0x0, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x3, 0x40], [0x1, 0xffff, 0x134, 0x7ffe, 0x9, 0xfffffff3, 0x129432e6, 0xcb, 0x6, 0xd, 0x2bf, 0x6c9, 0x9, 0x6, 0x3, 0x0, 0x7, 0x5, 0x0, 0x11, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x3, 0x400, 0x5, 0x6, 0x7, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x0, 0xdd83, 0x100002, 0xa, 0x4, 0x9, 0x8, 0x800, 0x6, 0x7, 0x8002, 0x1, 0xfe000000, 0xff7f, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0x7, 0x80000003, 0x9, 0x48c93690, 0x42, 0x9], [0x400, 0x4, 0x0, 0x5, 0xfffffffe, 0xfffff76b, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x83, 0x80000003, 0x200009, 0x100003e7, 0x9, 0x5, 0x3, 0x2, 0xf38, 0x8, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0xf, 0xd, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0xfffffffc, 0x1, 0x1, 0xffff, 0x0, 0x1a, 0x1c, 0x120000, 0x3, 0x6, 0xaaed, 0x5, 0x65], [0x9, 0xbb31, 0x3, 0xb, 0x1, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x2, 0xf58, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7ffe, 0x80000000, 0x200a620, 0x2, 0xc, 0x1, 0x4, 0x14c, 0x60a7, 0xe, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7f, 0x100, 0x9606, 0x7, 0x2, 0x4, 0x6, 0x1, 0x10080, 0x4, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0xb0b2748, 0x1, 0x1, 0x200, 0xffbf2441, 0xfff]}, 0x45c) (async) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f0000000140), 0x10) sendmsg$can_bcm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="0500000003000000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00'], 0x48}}, 0x0) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201100153a42908f00a71729188010203010902240001060000000904000002ff"], 0x0) 4.76390242s ago: executing program 0 (id=77): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x20, &(0x7f0000000280)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400400142603600e122f00160006000400a8000600200003400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b31d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025cc40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de603000000e4edef3d93452a92954b43370e9703920723f9a94100"/216, 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) connect$rxrpc(r1, &(0x7f0000000040)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0x5, @mcast2, 0x5}}, 0x24) 4.577257189s ago: executing program 0 (id=79): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000018000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c0001c006000100d9030000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) mount$9p_tcp(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x800, &(0x7f0000000300)={'trans=tcp,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@noxattr}]}}) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000e"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 4.018495993s ago: executing program 1 (id=80): syz_usb_connect$hid(0x5, 0x36, &(0x7f0000001600)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x263, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xd, 0x80, 0x9, "", [{{0x9, 0x4, 0x0, 0x10, 0x1, 0x3, 0x1, 0x2, 0x9, {0x9, 0x21, 0x0, 0x9, 0x1, {0x22, 0x997}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x5, 0x2, 0x1}}}}}]}}]}}, &(0x7f0000001c00)={0x0, 0x0, 0x0, 0x0}) (async) r0 = syz_usb_connect(0x6, 0x3d7, &(0x7f00000007c0)=ANY=[@ANYBLOB="120100004cefc008e10593085bfd010203010902c50301000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x18, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4008af60, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x0, 0x0}) (async) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x80045505, &(0x7f0000000040)=0xfffffffa) 3.913985264s ago: executing program 0 (id=81): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x4a, 0x201, 0x0, 0x0, {0xa, 0x0, 0x300}}, 0x14}}, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x20, 0x3, 0x6, 0x301, 0x0, 0x0, {0x3, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)="d80000001c0081030081f782db44b904021d080201000000040000a118000c006505000062600e1208000f0100810401a8001600200001", 0x37}, {&(0x7f0000000180)="7a5fec1af17cbfd4b9a3b433644732028dfa578ba44a2a812577cc1d17f7b696d53837c2c394e77680a468cd57fb31a8f543f4929e0da50599e1beaa04be46d09c1c0f0589f3858256d0dbfb1ab9ab125e3eb3291f4c60713576d446c152ba1f64f802163850c625a24928edc7d9b77382417f0dee7e27c3496ba19e5fc489a89faa045a3f3db0bab4218dfb9eeb7d4db0064404bf9bfeda7cb396976ebbe78bb6ffe6c0f846484fe2fc0cb374f3f352d07e32f306bb51211fcca3873a922a08a478bd2fd162bd3eabf0bdf53417c1e1cb7e2114f8b2900558102f9889b9bf629f74fa2cd8bfee118f9e67f27a", 0xed}], 0x2, 0x0, 0x0, 0x7400}, 0x4001) r1 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0xfe33) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_generic(0x10, 0x3, 0x10) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000000080)={[{@quota}, {@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x37]}}]}) chdir(&(0x7f0000000240)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) ioctl$VT_SETMODE(r2, 0x5602, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001fe969b406c050081c94a0102030109021b00024508601b046e0999ade98ff409046e03009d3b4e811950c4eae02ebb8c3d4cd334a789650ba1f1f5581df4aedd22e4cc0a107afb1e1f85fc49d458731c82147f726b1fc987c5a4fb81c4ea34ae5c5d22dfcc49876653ecc9272431344a2ccab641fe058e6db9369ebd6878a6d03c0f497859840c8a4a6ace22cfcdcd8d4a3a71e3424259b685d8cecfe889895dfcacca5fd86999644bd1ff31b9dbd5dc64ef22b47b75d3654585349fd2016e0d4207e61ac7d9f933728c19df00eaca5f"], 0x0) socket(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x4a, 0x201, 0x0, 0x0, {0xa, 0x0, 0x300}}, 0x14}}, 0x0) (async) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x20, 0x3, 0x6, 0x301, 0x0, 0x0, {0x3, 0x0, 0x8}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040}, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)="d80000001c0081030081f782db44b904021d080201000000040000a118000c006505000062600e1208000f0100810401a8001600200001", 0x37}, {&(0x7f0000000180)="7a5fec1af17cbfd4b9a3b433644732028dfa578ba44a2a812577cc1d17f7b696d53837c2c394e77680a468cd57fb31a8f543f4929e0da50599e1beaa04be46d09c1c0f0589f3858256d0dbfb1ab9ab125e3eb3291f4c60713576d446c152ba1f64f802163850c625a24928edc7d9b77382417f0dee7e27c3496ba19e5fc489a89faa045a3f3db0bab4218dfb9eeb7d4db0064404bf9bfeda7cb396976ebbe78bb6ffe6c0f846484fe2fc0cb374f3f352d07e32f306bb51211fcca3873a922a08a478bd2fd162bd3eabf0bdf53417c1e1cb7e2114f8b2900558102f9889b9bf629f74fa2cd8bfee118f9e67f27a", 0xed}], 0x2, 0x0, 0x0, 0x7400}, 0x4001) (async) socket$kcm(0x10, 0x400000002, 0x0) (async) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[], 0xfe33) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) capset(&(0x7f0000000040)={0x20071026}, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x81, 0xfffffff9}) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, &(0x7f0000000000)) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) (async) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000000080)={[{@quota}, {@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x37]}}]}) (async) chdir(&(0x7f0000000240)='./file0\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) (async) ioctl$VT_SETMODE(r2, 0x5602, 0x0) (async) syz_usb_connect(0x3, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001fe969b406c050081c94a0102030109021b00024508601b046e0999ade98ff409046e03009d3b4e811950c4eae02ebb8c3d4cd334a789650ba1f1f5581df4aedd22e4cc0a107afb1e1f85fc49d458731c82147f726b1fc987c5a4fb81c4ea34ae5c5d22dfcc49876653ecc9272431344a2ccab641fe058e6db9369ebd6878a6d03c0f497859840c8a4a6ace22cfcdcd8d4a3a71e3424259b685d8cecfe889895dfcacca5fd86999644bd1ff31b9dbd5dc64ef22b47b75d3654585349fd2016e0d4207e61ac7d9f933728c19df00eaca5f"], 0x0) (async) 3.357362172s ago: executing program 3 (id=82): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000001840)={'sit0\x00', &(0x7f00000017c0)={'sit0\x00', 0x0, 0x7800, 0x786, 0x40, 0x8000, {{0x15, 0x4, 0x1, 0x4, 0x54, 0x66, 0x0, 0xa, 0x29, 0x0, @empty, @empty, {[@lsrr={0x83, 0x2b, 0xf4, [@loopback, @loopback, @broadcast, @multicast2, @multicast2, @broadcast, @local, @loopback, @multicast1, @dev={0xac, 0x14, 0x14, 0x44}]}, @generic={0x44, 0x12, "d70867214d15683392734e3527dcdbab"}]}}}}}) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) sendmmsg$inet6(r1, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000005c0)="91a523765e8b45435756aa569bee12a6379d076ff43c8e49cca58d1fc5d071bc79aab2f57848e1f1c9f357c59a334ab2c6a2c7dbbe7aab8f5d7c8417d0087351364e2eb95d97e8049a6ceb4d09c11fd25a1b0b5ea9bb68250674dd973d3bd52951bfbf9da2e7015417f632448fd3441f732ade9f726f265b2783169f6056ad79c409b3d30a42e7", 0x87}, {&(0x7f0000000680)="32bd833f48d728aaee17e55bf944835f29ee7025e587c355521ccc2fdf9c7b9ac187d61a24a494935f20ca92a49f2ee5fe6fbe6ccadbe407ab5c90842371a8eb4a9a8eb9908b9e40f966e5dfcabe647ab54bb3ad3dfc416d2c4b87bcd05177452deb44be95fe91c63cd32c098e9b2a2ca98143586de24f80cfd2d18ea440cf6a7d0e270e0233a88359834e587d8c895af1a02c6599e04e6b8839dc341c56f9a42e7dbd012ab6beb72f5f9eb2a11614f9e54e32b77ec668729ad8a3406640135903da71d26b498b0b7b9dfbfed2", 0xcd}, {&(0x7f0000001600)="297a2d30c8767c7dcf836e082dace91df26728f0af2f38bfcdd3568b0e25a529d61aef8d4c7a90bb5b0e8914a86f39fefd09c7cb64bad6cc076ab81021444ae35c3cc0aa62b086f5cd0293aa8901e01ae0dc984c7d59397161001a384abecc03da7c3ee7537c109ffd1a48faafd4e435fd03e15aed0a248957350c06c85fd46f694461e3d0076dc676cfa14b661330c21150a61ab349bffeb0367903a83485206d77c65b11c2948331533dfa894e5381ac635f12e6b5ed67c8161cabe2a998129264c64bcbd049ae6b92d2f3c98a87232f8edf30759679c8e34c347a3b261d57299d6f14140d1a54931dd9eaec13e49f894564b62e652abf3c642ec81d9df473ca1b70d759fdeeaf81da28414229797a1bc4683fd7001384edc3c0fc51fa52763cb73899ad29d9eab5451b387dd819fcef714e393f121c5897198934a305ebbd15cd123a1c9b0905866402a014bbb1353165fde07cbdcc915477bdfccf8f76beb21e176e76ce18f90e04e81b8c61b4ff476a508307c6a6ef3f6f8a6f56d757fbd55d598fd3b214d85c6278f3f72a2d062cec84aabbf9b15cdd5c2b9a90ea735ab081758ba2769f121a7c66599f24cf46a84392eb00a556f4a3fbe5e199b73352f06bcf29edcabc98c4589a3f1d8a95e2ad211e56d76a10421450719db22d053d6ee33c1d2cb604a5146b0805cbb26b4b426d5c0412a5d35627bf276885163f8e20cc9dd1987de5f9920df2d309ed077282f129730b01814732cf32a6cdcc846b1a472a011f266b9bbdc9f8dc524a9f80f3f9b963506be0094a53f7bd4f92d1ff4b2128cd00a885b7313a59f075b75fef9886a07d83a7a684a28263d4c3e480daaf5e96c557f83a9c14c280eba8b8ad6925da0ec79eaf8ee5cc6590f641328b8b1936f79cfd988201fdc88333df8fd555059c28be4aaa7e1c4214729938410e8942ed97e75b41ee7f5f7106b49c7104543649cef2e4dce8011334b5b1176c27a9c2e72be5671045530fecf595b67eed3155d2c5bc34125314ced05f629ef1fafe260e04ee5d45308712b69cd7b1e3f0168d14feef66ecb4b4dc8d6eb13950d3d8c209c96dc7a72904a964bab1b6d998ecf17fde848685e5ad0faeb9d47ca10099d7483df54354b0ecd905c3fc3055efb4f9f978a09898ee4fe8f244330370a2c81d630ecd706abf7426233de4d034315a44afd756322a67c11b5f03778d692a290a095ef97a7156285ecbc3a6fe3c5f9b9f189d6dc66a7d2860d5bfd1e6", 0x37d}], 0x3}}], 0x1, 0x40094) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000340), 0x8) creat(0x0, 0xdafbe5d6891b6e4) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) connect$pppl2tp(r3, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendmmsg(r3, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) 2.511081882s ago: executing program 0 (id=83): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='smaps\x00') r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, &(0x7f0000000080)={0x40014, 0x2}) (async, rerun: 64) r2 = syz_open_dev$video4linux(&(0x7f0000000040), 0x0, 0x0) (rerun: 64) ioctl$VIDIOC_SUBDEV_S_FMT(r2, 0x80085665, &(0x7f0000000080)) (async) exit(0x2) (async) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000100)={0x3, &(0x7f0000000000)=[{}, {0x0}, {}]}) ioctl$DRM_IOCTL_LOCK(r0, 0x4008642a, &(0x7f0000000140)={r3, 0x28}) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') 2.359350696s ago: executing program 3 (id=84): r0 = socket(0x10, 0x80002, 0x0) sendmsg(r0, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000340)="24000000180003041dfffd946f610500020100000005fe060c10882108000f00fef3c00e", 0x24}], 0x1}, 0x4) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6d9820fae9d6dcd32f9d3d5c200", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x81800) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000005000)=ANY=[], 0x1198}, 0x1, 0x0, 0x0, 0x40}, 0x880) recvfrom$inet(r2, &(0x7f0000000000)=""/4084, 0xff4, 0x12023, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000180)="290000002000190f00003fffffffda0602000000ffe80001dd0000040d001800ea11c21d0005000000", 0x29}], 0x1) 2.279788264s ago: executing program 1 (id=85): r0 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) (async) ioctl$XFS_IOC_FSCOUNTS(r0, 0x80205871, &(0x7f0000000040)) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000000)) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) (async) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4000000004, &(0x7f0000000340)=[{0x10, 0x6, 0xffffffffffffffff}, {0xfffffffffffffffe, 0xfffffffffffffffd, 0xffffffff}, {0x4, 0xffffffff, 0x4}], 0x3, 0xbff, 0x1e, 0x0, 0x2c, 0x5f}) (async) r3 = dup(r1) write$UHID_INPUT(r3, &(0x7f0000002080)={0x200f, {"20e30a30ed0d09f91b5e070987f70e06d038e7ff7fc6e5539b0d3e0e8b089b3f363063030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c526db51b1b5b31070d0773090acd3b78130daa61d8e8040001000000b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19300305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f6709000000a141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a027d5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf050000008000000000f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b3f3f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7af1d0e54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c01008e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2f5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d21488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e1a63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e09d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a603336c00000077cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046ca5b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe6531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e6586df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59555e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0d8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb601203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000930dedf800", 0x1000}}, 0x1006) ioctl$KDMKTONE(r0, 0x4b30, 0xffffffffffffffff) (async) write(r0, &(0x7f0000000000)="1c0000001a", 0x5) 2.144574816s ago: executing program 3 (id=86): madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) r0 = syz_open_procfs(0x0, 0x0) pwritev(r0, 0x0, 0x0, 0x7, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0xffffffff, 0x6, 0x0, 0x1, 0x200000000000, 0x2, 0x10000, 0x87a, 0x8000000000000, 0x80040000000000, 0x0, 0x9, 0x1, 0x5, 0x10000100000008ca, 0x400008005], 0x80a0000, 0x100c02}) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5393, &(0x7f0000000000)) r2 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1e7d, 0x319c, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xe0, 0x0, "", [{{0x9, 0x4, 0x0, 0x4, 0xfd, 0x3, 0x0, 0x4, 0x0, {0x9, 0x21, 0x20, 0x4, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x7, 0x8, 0xc3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.872811053s ago: executing program 1 (id=87): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a", 0x35}], 0x1, 0x0, 0x0, 0x7400}, 0x10) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0xc0686611, &(0x7f0000000180)={0x1fe, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000000)=@newsa={0xf0, 0x10, 0x1, 0x70bdab, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@empty, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast2, 0x4, 0x6c}, @in6=@remote, {0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, {0x5, 0x4, 0xd, 0xa}, {0x0, 0x400}, 0xfffffffc, 0x0, 0xa, 0x1, 0x6}}, 0xf0}}, 0x20000000) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1800000076"], 0x1c}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_TOL(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x68, r2, 0x800, 0x70bd2a, 0x25dfdbfd, {{}, {}, {0x4c, 0x18, {0x2, @media='eth\x00'}}}, ["", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x90}, 0x4000040) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x58}, 0x1, 0x0, 0x0, 0x40000104}, 0x4000841) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000003680)=""/4103, 0x1007}, {&(0x7f0000000400)=""/104, 0x68}], 0x2}, 0x100) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), r0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x30, r5, 0x0, 0x70bd25, 0x25dfdbfc, {{}, {}, {0x14, 0x19, {0x8, 0x5, 0x101, 0xb7}}}, ["", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x60008010}, 0x40) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) 1.739889035s ago: executing program 1 (id=88): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000018000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c0001c006000100d9030000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) mount$9p_tcp(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x800, &(0x7f0000000300)={'trans=tcp,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@noxattr}]}}) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000e"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1.423605712s ago: executing program 1 (id=89): r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7ffffffbffffffff, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000240)={0x1, 0x0, {0x0, 0x0, 0x3012, 0x0, 0x0, 0x0, 0x2}}) 1.413205368s ago: executing program 0 (id=90): socket$inet6_tcp(0xa, 0x1, 0x0) (async) r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x5543, 0x81, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x6, "", [{{0x9, 0x4, 0x0, 0x0, 0x8, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x8, 0x4, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x420, 0x82, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) 1.222754022s ago: executing program 1 (id=91): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455cb, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100006325a640402000207265970000010902240001000000000904000002214c6a0009050702000000da000905894a2a55773bc81a775e6c56f14a6875695c4a2375018353a2c8224936d67b"], 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_tos={0x0, r2, 0x0, 0x3}}, 0x20) syz_usb_connect$uac3(0x3, 0x12c, &(0x7f0000000200)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x70, 0x499, 0x1057, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x11a, 0x3, 0x1, 0x5, 0x30, 0x7, {0x8, 0xb, 0x0, 0x2, 0x1, 0x0, 0x30, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x9, 0x30}, [@feature_unit={0xd, 0x24, 0x7, 0x4, 0x5, [0xf8, 0xa]}, @mixer_unit={0x6, 0x24, 0x5, 0x5, 0x2, "9c"}, @source_unit={0xc, 0x24, 0xb, 0x3, 0x1, 0x3ff, 0x35, 0x3}, @selector_unit={0x7, 0x24, 0xc, 0x30, 0x2, '\nx'}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x5, 0xfa, 0x2c, 0x9, 0x7}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0xe, 0x3, 0x19, 0x6, "72b5"}, @format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x8, 0x3, 0x6, '4'}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x80, 0x4, 0x0, 0x2, "fc", "ea401b"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xb2, 0x5, 0xa, 0x0, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x40, 0x8, 0x3, 0xee, {0xa, 0x25, 0x25, 0x5, 0x5, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x3, 0x2, 0x5a, 0x4, "87"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x3, 0x401, 0x2, "ae2517189fed9815b6"}, @format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0xc, 0x2, 0x0, 0x4, "2ee2c56f"}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xb339, 0x6, 0x2, "a7ddb68c"}, @as_header={0x17, 0x24, 0x1, 0x8, 0x0, 0x7, 0x5, 0x3, 0x5, 0xf, 0x77}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xe, 0x40, 0x9, 0x2, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x40, 0x0, 0x4, {0xa, 0x25, 0x25, 0x5, 0x0, 0x6}}}}}}}}]}}, &(0x7f0000000600)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x211, 0x4, 0x6c, 0xcf, 0x40, 0x2}, 0x19, &(0x7f0000000380)={0x5, 0xf, 0x19, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0x0, 0x9, 0xb}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x6, 0x4, 0x3}]}, 0x6, [{0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x1809}}, {0x4, &(0x7f0000000400)=@lang_id={0x4}}, {0x60, &(0x7f0000000440)=@string={0x60, 0x3, "654cc5b9a510db41bb128960576a15f44b4d8d6217210cb12997363d6110e24bbbfcd3517ae5d83caad06637dc4a5649a839c3db939a0f0d1414ab0a83c25aa6983585093a1d84f99ed25690854a90d0696d448c7c48b82361f30516116d"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x3801}}, {0x9, &(0x7f0000000500)=@string={0x9, 0x3, "c3bb11a3aa5925"}}, {0x8c, &(0x7f0000000540)=@string={0x8c, 0x3, "5003b0ca9a5eef268515f6d58a516921fc0aaa952acf2ec1c36830f7df4f4439ba5da810fe6f5a4b062e043aed6a6f5af743e19b9356f42ddaf64a3acb75dca2fba47ca02cc9603a91b75758cc2652baf55089f607e00e588e0eb1f9e9ccc96d63dd7d86ed1010cd104e59059e14fb765a58c8c6cbb8b202d428d3c24007f274b382cdcd00ed16a3c133"}}]}) 0s ago: executing program 3 (id=92): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080), 0x0) acct(0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r0, 0xc0f85403, 0x0) quotactl_fd$Q_SYNC(0xffffffffffffffff, 0xffffffff80000100, 0x0, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000180)='G', 0x1}], 0x1, 0x0, 0x0, 0x11000000}, 0x81) (async) sendmsg(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000180)='G', 0x1}], 0x1, 0x0, 0x0, 0x11000000}, 0x81) r1 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000540)) ptrace$cont(0x20, r1, 0x0, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) (async) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r2, &(0x7f0000000040)={'#! ', '', [{0x20, '\xd9m\xf4\f00\xf4\xfa\t\t'}]}, 0xf) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x5, 0x4, 0x26000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x5, 0x4, 0x26000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) close(r2) (async) close(r2) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.91' (ED25519) to the list of known hosts. [ 92.131938][ T9] cfg80211: failed to load regulatory.db [ 96.001215][ T5810] cgroup: Unknown subsys name 'net' [ 96.241443][ T5810] cgroup: Unknown subsys name 'cpuset' [ 96.296760][ T5810] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 98.399177][ T5810] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 100.985007][ T60] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 101.003985][ T60] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 101.008554][ T60] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 101.047968][ T5830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 101.049760][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 101.056147][ T5830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 101.057196][ T5830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 101.067734][ T5830] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 101.129422][ T5141] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 101.130256][ T5141] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 101.235728][ T5141] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 101.271540][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 101.274611][ T5836] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 101.277136][ T5141] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 101.311619][ T5836] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 101.312284][ T5141] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 101.313980][ T5141] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 101.332805][ T5141] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 101.367289][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 101.368013][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 102.414660][ T5832] chnl_net:caif_netlink_parms(): no params data found [ 102.435177][ T5828] chnl_net:caif_netlink_parms(): no params data found [ 102.507033][ T5831] chnl_net:caif_netlink_parms(): no params data found [ 102.592823][ T5833] chnl_net:caif_netlink_parms(): no params data found [ 102.879440][ T5832] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.880342][ T5832] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.880811][ T5832] bridge_slave_0: entered allmulticast mode [ 102.883654][ T5832] bridge_slave_0: entered promiscuous mode [ 102.933774][ T5828] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.934013][ T5828] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.934252][ T5828] bridge_slave_0: entered allmulticast mode [ 102.943249][ T5828] bridge_slave_0: entered promiscuous mode [ 102.982700][ T5832] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.982937][ T5832] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.983184][ T5832] bridge_slave_1: entered allmulticast mode [ 102.985851][ T5832] bridge_slave_1: entered promiscuous mode [ 103.035639][ T5828] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.035969][ T5828] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.037966][ T5828] bridge_slave_1: entered allmulticast mode [ 103.059228][ T5828] bridge_slave_1: entered promiscuous mode [ 103.107652][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.108042][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.108558][ T5831] bridge_slave_0: entered allmulticast mode [ 103.111401][ T5831] bridge_slave_0: entered promiscuous mode [ 103.132782][ T5141] Bluetooth: hci0: command tx timeout [ 103.203953][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.204284][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.206282][ T5141] Bluetooth: hci1: command tx timeout [ 103.228468][ T5831] bridge_slave_1: entered allmulticast mode [ 103.231018][ T5831] bridge_slave_1: entered promiscuous mode [ 103.260157][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.260487][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.260767][ T5833] bridge_slave_0: entered allmulticast mode [ 103.263306][ T5833] bridge_slave_0: entered promiscuous mode [ 103.297431][ T5832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.329756][ T5828] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.330225][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.330571][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.330853][ T5833] bridge_slave_1: entered allmulticast mode [ 103.333540][ T5833] bridge_slave_1: entered promiscuous mode [ 103.392996][ T5832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.425494][ T5828] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.447216][ T5141] Bluetooth: hci3: command tx timeout [ 103.447226][ T60] Bluetooth: hci2: command tx timeout [ 103.489922][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.566697][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.598232][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 103.603824][ T5832] team0: Port device team_slave_0 added [ 103.640456][ T5828] team0: Port device team_slave_0 added [ 103.645563][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 103.662716][ T5832] team0: Port device team_slave_1 added [ 103.689824][ T5828] team0: Port device team_slave_1 added [ 103.745543][ T5831] team0: Port device team_slave_0 added [ 103.807445][ T5831] team0: Port device team_slave_1 added [ 103.837388][ T5833] team0: Port device team_slave_0 added [ 103.839757][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.839770][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.839791][ T5832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.908556][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.908570][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.908591][ T5828] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.912612][ T5833] team0: Port device team_slave_1 added [ 103.914399][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.914410][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.914431][ T5832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.015525][ T5828] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.015541][ T5828] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.015563][ T5828] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.085878][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.085903][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.085923][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.172073][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.172086][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.172107][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.183234][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 104.183252][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.183289][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.279385][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.279404][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.279434][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.424205][ T5832] hsr_slave_0: entered promiscuous mode [ 104.432814][ T5832] hsr_slave_1: entered promiscuous mode [ 104.707042][ T5828] hsr_slave_0: entered promiscuous mode [ 104.709136][ T5828] hsr_slave_1: entered promiscuous mode [ 104.711516][ T5828] debugfs: 'hsr0' already exists in 'hsr' [ 104.711613][ T5828] Cannot create hsr debugfs directory [ 104.803211][ T5831] hsr_slave_0: entered promiscuous mode [ 104.804860][ T5831] hsr_slave_1: entered promiscuous mode [ 104.813262][ T5831] debugfs: 'hsr0' already exists in 'hsr' [ 104.813291][ T5831] Cannot create hsr debugfs directory [ 104.923406][ T5833] hsr_slave_0: entered promiscuous mode [ 104.935610][ T5833] hsr_slave_1: entered promiscuous mode [ 104.943542][ T5833] debugfs: 'hsr0' already exists in 'hsr' [ 104.943575][ T5833] Cannot create hsr debugfs directory [ 105.207591][ T5141] Bluetooth: hci0: command tx timeout [ 105.286269][ T5141] Bluetooth: hci1: command tx timeout [ 105.526239][ T5141] Bluetooth: hci3: command tx timeout [ 105.528005][ T5141] Bluetooth: hci2: command tx timeout [ 105.849502][ T5832] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 105.901155][ T5832] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.916820][ T5832] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 105.940293][ T5832] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.951885][ T5832] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 106.033103][ T5832] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.061008][ T5832] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 106.095218][ T5832] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.260859][ T5831] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 106.301612][ T5831] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.309288][ T5831] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 106.361386][ T5831] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.365146][ T5831] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 106.391526][ T5831] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.434025][ T5831] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 106.462784][ T5831] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.645884][ T5833] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 106.703376][ T5833] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.727719][ T5833] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 106.769562][ T5833] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.775294][ T5833] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 106.815248][ T5833] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.845186][ T5833] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 106.882986][ T5833] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.079539][ T5828] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 107.123674][ T5828] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.161317][ T5828] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 107.200930][ T5828] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.214743][ T5828] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 107.251182][ T5828] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.274331][ T5828] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 107.286944][ T5141] Bluetooth: hci0: command tx timeout [ 107.311254][ T5828] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.366308][ T5141] Bluetooth: hci1: command tx timeout [ 107.416262][ T5832] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.562516][ T5832] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.606651][ T60] Bluetooth: hci2: command tx timeout [ 107.606757][ T5141] Bluetooth: hci3: command tx timeout [ 107.683727][ T2226] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.684189][ T2226] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.735290][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.764323][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.764462][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.881678][ T5831] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.934006][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.957302][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.957589][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.063428][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.063544][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.162463][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.228734][ T5828] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.234305][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.234551][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.344704][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.344888][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.485392][ T5828] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.568428][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.568559][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.640418][ T1428] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.640683][ T1428] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.849794][ T5832] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.110367][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.243807][ T5832] veth0_vlan: entered promiscuous mode [ 109.366259][ T5141] Bluetooth: hci0: command tx timeout [ 109.404016][ T5832] veth1_vlan: entered promiscuous mode [ 109.447121][ T5141] Bluetooth: hci1: command tx timeout [ 109.497510][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.555839][ T5831] veth0_vlan: entered promiscuous mode [ 109.588929][ T5828] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.643516][ T5831] veth1_vlan: entered promiscuous mode [ 109.659077][ T5832] veth0_macvtap: entered promiscuous mode [ 109.686849][ T60] Bluetooth: hci2: command tx timeout [ 109.686896][ T5141] Bluetooth: hci3: command tx timeout [ 109.743663][ T5832] veth1_macvtap: entered promiscuous mode [ 109.861541][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.891528][ T5833] veth0_vlan: entered promiscuous mode [ 109.931370][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.994871][ T5831] veth0_macvtap: entered promiscuous mode [ 110.014240][ T68] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.020773][ T5833] veth1_vlan: entered promiscuous mode [ 110.032954][ T5828] veth0_vlan: entered promiscuous mode [ 110.041896][ T68] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.077843][ T68] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.081949][ T5831] veth1_macvtap: entered promiscuous mode [ 110.150844][ T68] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.245903][ T5828] veth1_vlan: entered promiscuous mode [ 110.422087][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.584132][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.667407][ T5833] veth0_macvtap: entered promiscuous mode [ 110.678708][ T50] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.685255][ T50] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.714704][ T50] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.732444][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.732460][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.767477][ T50] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.768975][ T5833] veth1_macvtap: entered promiscuous mode [ 110.819942][ T5828] veth0_macvtap: entered promiscuous mode [ 110.907897][ T5828] veth1_macvtap: entered promiscuous mode [ 111.159727][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.192483][ T1428] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.192506][ T1428] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.410611][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.444969][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.566460][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.570965][ T5828] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.573860][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.573961][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.573977][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.638823][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.670982][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.737821][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.785090][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.831865][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.920015][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.023741][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.023764][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.260423][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.260446][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.482605][ T1428] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.482625][ T1428] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.509628][ T5925] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6'. [ 113.622514][ T1428] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.622534][ T1428] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.748667][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.748688][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.813289][ T5928] gfs2: not a GFS2 filesystem [ 114.810969][ T5951] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 115.194652][ T5951] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1'. [ 115.212681][ T5951] nbd: must specify at least one socket [ 115.875948][ T5961] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13'. [ 116.472666][ T5977] syzkaller1: entered promiscuous mode [ 116.472701][ T5977] syzkaller1: entered allmulticast mode [ 117.169881][ T5885] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 117.209792][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 117.416197][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 117.452928][ T5885] usb 1-1: Using ep0 maxpacket: 32 [ 117.504301][ T10] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 117.504330][ T10] usb 4-1: config 0 has no interface number 0 [ 117.504374][ T10] usb 4-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 117.504401][ T10] usb 4-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 117.504428][ T10] usb 4-1: config 0 interface 41 has no altsetting 0 [ 117.552950][ T10] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 117.552983][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.553005][ T10] usb 4-1: Product: syz [ 117.553021][ T10] usb 4-1: Manufacturer: syz [ 117.553036][ T10] usb 4-1: SerialNumber: syz [ 117.587631][ T5885] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 117.587662][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.587682][ T5885] usb 1-1: Product: syz [ 117.587696][ T5885] usb 1-1: Manufacturer: syz [ 117.587711][ T5885] usb 1-1: SerialNumber: syz [ 117.890082][ T10] usb 4-1: config 0 descriptor?? [ 117.924733][ T5994] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 117.928343][ T5994] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 118.021431][ T5885] usb 1-1: config 0 descriptor?? [ 118.080190][ T5894] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 118.141631][ T6004] netlink: 28 bytes leftover after parsing attributes in process `syz.1.23'. [ 118.306865][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 118.340004][ T5894] usb 3-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 118.340037][ T5894] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.340058][ T5894] usb 3-1: Product: syz [ 118.340073][ T5894] usb 3-1: Manufacturer: syz [ 118.340088][ T5894] usb 3-1: SerialNumber: syz [ 118.410915][ T5994] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 118.411093][ T5994] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 118.480924][ T5894] usb 3-1: config 0 descriptor?? [ 118.592947][ T5991] kAFS: unparsable volume name [ 118.798992][ T5894] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 119.319740][ T5885] airspy 1-1:0.0: usb_control_msg() failed -110 request 09 [ 119.319771][ T5885] airspy 1-1:0.0: Could not detect board [ 119.319890][ T5885] airspy 1-1:0.0: probe with driver airspy failed with error -110 [ 120.346971][ T37] usb 1-1: USB disconnect, device number 2 [ 120.501053][ T10] sr9700 4-1:0.41 eth1: register 'sr9700' at usb-dummy_hcd.3-1, CoreChip SR9700 USB Ethernet, fa:63:3c:de:99:22 [ 121.018543][ T10] usb 4-1: USB disconnect, device number 2 [ 121.053165][ T5894] gspca_ov534_9: reg_r err -110 [ 121.128196][ T10] sr9700 4-1:0.41 eth1: unregister 'sr9700' usb-dummy_hcd.3-1, CoreChip SR9700 USB Ethernet [ 121.186377][ T5878] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 121.328670][ T5894] gspca_ov534_9: Unknown sensor 0000 [ 121.328773][ T5894] ov534_9 3-1:0.0: probe with driver ov534_9 failed with error -22 [ 121.353444][ T5878] usb 2-1: Using ep0 maxpacket: 16 [ 121.361796][ T5878] usb 2-1: config 0 has an invalid interface number: 34 but max is 0 [ 121.361823][ T5878] usb 2-1: config 0 has no interface number 0 [ 121.361865][ T5878] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 121.361892][ T5878] usb 2-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 121.382231][ T37] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 121.413006][ T5878] usb 2-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 121.413039][ T5878] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.413061][ T5878] usb 2-1: Product: syz [ 121.413077][ T5878] usb 2-1: Manufacturer: syz [ 121.413092][ T5878] usb 2-1: SerialNumber: syz [ 121.507550][ T5878] usb 2-1: config 0 descriptor?? [ 121.508984][ T6020] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 121.509111][ T6020] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 121.626163][ T37] usb 1-1: Using ep0 maxpacket: 16 [ 121.632494][ T37] usb 1-1: unable to get BOS descriptor or descriptor too short [ 121.634894][ T37] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7 [ 121.669139][ T37] usb 1-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice= 0.40 [ 121.669171][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.669251][ T37] usb 1-1: Product: syz [ 121.669268][ T37] usb 1-1: Manufacturer: syz [ 121.669284][ T37] usb 1-1: SerialNumber: syz [ 121.715792][ T6020] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 121.715925][ T6020] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 121.796828][ T10] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 121.928257][ T5878] asix 2-1:0.34 (unnamed net_device) (uninitialized): invalid hw address, using random [ 121.985658][ T10] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 121.985687][ T10] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 122.031047][ T10] usb 4-1: New USB device found, idVendor=dc50, idProduct=35eb, bcdDevice=f1.06 [ 122.031078][ T10] usb 4-1: New USB device strings: Mfr=101, Product=125, SerialNumber=3 [ 122.031104][ T10] usb 4-1: Product: syz [ 122.031115][ T10] usb 4-1: Manufacturer: syz [ 122.031125][ T10] usb 4-1: SerialNumber: syz [ 122.525199][ T10] usb 4-1: Can't get UAC3 power state for id 10 [ 122.610077][ T10] usb 4-1: BAAD HEADSET c_chmask mismatch [ 122.830772][ T6024] overlayfs: failed to resolve './file0/file0::': -2 [ 122.917855][ T6025] batadv_slave_1: entered promiscuous mode [ 123.179542][ T6027] netlink: 'syz.0.29': attribute type 21 has an invalid length. [ 123.179578][ T6027] IPv6: NLM_F_CREATE should be specified when creating new route [ 123.189754][ T6027] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 123.189800][ T6027] IPv6: NLM_F_CREATE should be set when creating new route [ 123.190134][ T6027] IPv6: NLM_F_CREATE should be set when creating new route [ 123.190167][ T6027] IPv6: NLM_F_CREATE should be set when creating new route [ 123.231376][ T6030] Zero length message leads to an empty skb [ 123.430804][ T6032] fuse: Bad value for 'user_id' [ 123.430894][ T6032] fuse: Bad value for 'user_id' [ 124.349964][ T6037] netlink: 28 bytes leftover after parsing attributes in process `syz.0.32'. [ 124.773240][ T10] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 124.795947][ T37] usb 1-1: Audio class v2/v3 interfaces need an interface association [ 124.806864][ T37] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 124.881587][ T10] usb 4-1: USB disconnect, device number 3 [ 124.963707][ T6020] batadv_slave_1: left promiscuous mode [ 124.997397][ T6045] overlayfs: missing 'lowerdir' [ 125.182648][ T6047] udevd[6047]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 125.235063][ T5878] asix 2-1:0.34 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 125.235603][ T5878] asix 2-1:0.34: probe with driver asix failed with error -71 [ 125.324169][ T5878] usb 2-1: USB disconnect, device number 3 [ 125.422324][ T37] usb 1-1: USB disconnect, device number 3 [ 125.437275][ T10] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 125.518307][ T6050] /dev/nullb0: Can't open blockdev [ 125.611778][ T10] usb 4-1: config 1 interface 0 altsetting 10 endpoint 0x81 has invalid maxpacket 32, setting to 8 [ 125.611817][ T10] usb 4-1: config 1 interface 0 altsetting 10 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 125.611850][ T10] usb 4-1: config 1 interface 0 has no altsetting 0 [ 125.661998][ T6048] udevd[6048]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 125.751644][ T6052] EXT4-fs (nullb0): VFS: Can't find ext4 filesystem [ 125.843567][ T6054] syz.0.37 uses obsolete (PF_INET,SOCK_PACKET) [ 126.456259][ T5878] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 126.606301][ T5878] usb 2-1: Using ep0 maxpacket: 16 [ 126.612563][ T5878] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 126.615798][ T5878] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice=27.0a [ 126.615833][ T5878] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.615856][ T5878] usb 2-1: Product: syz [ 126.615872][ T5878] usb 2-1: Manufacturer: syz [ 126.615888][ T5878] usb 2-1: SerialNumber: syz [ 126.681301][ T5878] usb 2-1: config 0 descriptor?? [ 126.736257][ T37] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 126.783801][ T10] usb 4-1: New USB device found, idVendor=04d8, idProduct=f372, bcdDevice= 0.40 [ 126.783832][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.783850][ T10] usb 4-1: Product: Ñ… [ 126.783863][ T10] usb 4-1: Manufacturer: Ñž [ 126.838019][ T10] usb 4-1: can't set config #1, error -71 [ 126.867108][ T10] usb 4-1: USB disconnect, device number 4 [ 126.921407][ T37] usb 1-1: config 1 interface 0 has no altsetting 0 [ 126.924289][ T37] usb 1-1: New USB device found, idVendor=28bd, idProduct=0905, bcdDevice= 0.40 [ 126.924363][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 126.924379][ T37] usb 1-1: Product: syz [ 126.924389][ T37] usb 1-1: Manufacturer: syz [ 126.924400][ T37] usb 1-1: SerialNumber: syz [ 127.235124][ T6059] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.235752][ T6059] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.258705][ T5878] usb 2-1: USB disconnect, device number 4 [ 127.391044][ T5141] Bluetooth: hci3: Malformed LE Event: 0x0b [ 127.403036][ T6064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 127.424102][ T6064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 127.436205][ T9] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 127.586859][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 127.595593][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 127.595627][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 127.595650][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 127.595689][ T9] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 127.595713][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 127.666136][ T9] usb 4-1: config 0 descriptor?? [ 127.864727][ T37] usbhid 1-1:1.0: can't add hid device: -71 [ 127.864875][ T37] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 127.967220][ T37] usb 1-1: USB disconnect, device number 4 [ 128.041657][ T6067] netlink: 28 bytes leftover after parsing attributes in process `syz.1.41'. [ 128.109677][ T38] audit: type=1326 audit(1777263950.528:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6069 comm="syz.0.42" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4d3ddacdd9 code=0x0 [ 128.162810][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.162850][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.162876][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.162901][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.162924][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.162949][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.162975][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.163002][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.163028][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.163055][ T9] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 128.339395][ T6074] tmpfs: Unknown parameter 'tsrquotac‘å°#CWŠð' [ 128.402088][ T9] input: HID 045e:07da as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:045E:07DA.0001/input/input6 [ 128.414682][ T6074] netlink: 12 bytes leftover after parsing attributes in process `syz.1.43'. [ 128.547823][ T9] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.3-1/input0 [ 128.568913][ T9] usb 4-1: USB disconnect, device number 5 [ 128.630508][ T37] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 128.784450][ T6078] fido_id[6078]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 128.822152][ T37] usb 1-1: config 2 has an invalid interface number: 166 but max is 0 [ 128.822185][ T37] usb 1-1: config 2 has no interface number 0 [ 128.822218][ T37] usb 1-1: config 2 interface 166 has no altsetting 0 [ 128.839615][ T37] usb 1-1: New USB device found, idVendor=0b57, idProduct=50a6, bcdDevice=9a.24 [ 128.839647][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 128.839668][ T37] usb 1-1: Product: syz [ 128.839683][ T37] usb 1-1: Manufacturer: syz [ 128.839698][ T37] usb 1-1: SerialNumber: syz [ 129.386213][ T5885] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 129.429674][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.439626][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.440140][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.440151][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.466414][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.466429][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.499043][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.499053][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.499170][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.499177][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.499316][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.499323][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.499391][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.499474][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.499640][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.499647][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.499716][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.499722][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.499863][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.499870][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.499998][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.500005][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.500119][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.500125][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.500193][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.647700][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.647848][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.647856][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.647926][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.647932][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.648051][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.648058][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.648173][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.648180][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.648249][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.648255][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.648367][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.648374][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.648482][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.648489][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.648561][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.648568][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.648678][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.648684][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.648825][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.648835][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.656687][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.656861][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.658710][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.675672][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.867562][ T6085] binder: BINDER_SET_CONTEXT_MGR already set [ 129.867574][ T6085] binder: 6083:6085 ioctl 4018620d 200000000100 returned -16 [ 129.956346][ T5885] usb 4-1: Using ep0 maxpacket: 8 [ 129.958653][ T5885] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 129.958737][ T5885] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 129.958756][ T5885] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 129.958772][ T5885] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 129.958790][ T5885] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 129.958821][ T5885] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 129.958838][ T5885] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.108672][ T5885] usbtmc 4-1:16.0: probe with driver usbtmc failed with error -22 [ 130.329182][ T9] usb 4-1: USB disconnect, device number 6 [ 130.636131][ T5894] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 130.788603][ T5894] usb 2-1: config 5 has an invalid interface number: 134 but max is 1 [ 130.788634][ T5894] usb 2-1: config 5 has an invalid interface number: 2 but max is 1 [ 130.788656][ T5894] usb 2-1: config 5 has no interface number 0 [ 130.788674][ T5894] usb 2-1: config 5 has no interface number 1 [ 130.788719][ T5894] usb 2-1: config 5 interface 2 has no altsetting 0 [ 130.792036][ T5894] usb 2-1: New USB device found, idVendor=0572, idProduct=d811, bcdDevice=77.6d [ 130.792068][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.792090][ T5894] usb 2-1: Product: syz [ 130.792106][ T5894] usb 2-1: Manufacturer: syz [ 130.792122][ T5894] usb 2-1: SerialNumber: syz [ 131.238705][ T37] usbhid 1-1:2.166: couldn't find an input interrupt endpoint [ 131.268329][ T37] usb 1-1: USB disconnect, device number 5 [ 131.551125][ T5894] dvb-usb: found a 'Mygica D689 DMB-TH' in warm state. [ 131.551191][ T5894] usb 2-1: setting power ON [ 131.554063][ T5894] dvb-usb: bulk message failed: -22 (2/0) [ 131.688312][ T5894] dvb-usb: bulk message failed: -22 (1/0) [ 131.769341][ T6106] netlink: 28 bytes leftover after parsing attributes in process `syz.0.51'. [ 131.847234][ T5894] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 131.971885][ T5894] dvb-usb: Mygica D689 DMB-TH error while loading driver (-19) [ 131.971943][ T5894] dvb_usb_cxusb 2-1:5.134: probe with driver dvb_usb_cxusb failed with error -22 [ 132.011934][ T5894] dvb-usb: found a 'Mygica D689 DMB-TH' in warm state. [ 132.011989][ T5894] usb 2-1: setting power ON [ 132.012010][ T5894] dvb-usb: bulk message failed: -22 (2/0) [ 132.150361][ T5894] dvb-usb: bulk message failed: -22 (1/0) [ 132.305582][ T5894] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 132.339732][ T5894] dvb-usb: Mygica D689 DMB-TH error while loading driver (-19) [ 132.339791][ T5894] dvb_usb_cxusb 2-1:5.2: probe with driver dvb_usb_cxusb failed with error -22 [ 132.386165][ T37] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 132.440272][ T5894] usb 2-1: USB disconnect, device number 5 [ 132.566798][ T60] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 132.577442][ T37] usb 1-1: Using ep0 maxpacket: 32 [ 132.622578][ T60] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 132.647533][ T60] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 132.669851][ T37] usb 1-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 132.669882][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 132.669906][ T37] usb 1-1: Product: syz [ 132.669922][ T37] usb 1-1: Manufacturer: syz [ 132.669938][ T37] usb 1-1: SerialNumber: syz [ 132.686329][ T60] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 132.699127][ T60] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 132.787184][ T37] usb 1-1: config 0 descriptor?? [ 133.076634][ T1334] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.084297][ T1334] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.212015][ T37] airspy 1-1:0.0: Board ID: 00 [ 133.212040][ T37] airspy 1-1:0.0: Firmware version: [ 133.694743][ T6141] netlink: 65051 bytes leftover after parsing attributes in process `syz.3.59'. [ 133.979723][ T6122] chnl_net:caif_netlink_parms(): no params data found [ 134.076274][ T37] airspy 1-1:0.0: usb_control_msg() failed -71 request 0f [ 134.194219][ T6146] netlink: 12 bytes leftover after parsing attributes in process `syz.3.62'. [ 134.235681][ T6147] netlink: 12 bytes leftover after parsing attributes in process `syz.1.61'. [ 134.235715][ T6147] netlink: 'syz.1.61': attribute type 1 has an invalid length. [ 134.235725][ T6147] netlink: 'syz.1.61': attribute type 1 has an invalid length. [ 134.235734][ T6147] netlink: 4 bytes leftover after parsing attributes in process `syz.1.61'. [ 134.303675][ T37] airspy 1-1:0.0: Registered as swradio24 [ 134.303692][ T37] airspy 1-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 134.339017][ T6146] netlink: 28 bytes leftover after parsing attributes in process `syz.3.62'. [ 134.367235][ T37] usb 1-1: USB disconnect, device number 6 [ 134.561580][ T6122] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.578396][ T6122] bridge0: port 1(bridge_slave_0) entered disabled state [ 134.578762][ T6122] bridge_slave_0: entered allmulticast mode [ 134.717127][ T6122] bridge_slave_0: entered promiscuous mode [ 134.737512][ T6122] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.738147][ T6122] bridge0: port 2(bridge_slave_1) entered disabled state [ 134.738503][ T6122] bridge_slave_1: entered allmulticast mode [ 134.768617][ T6122] bridge_slave_1: entered promiscuous mode [ 134.778942][ T6157] netlink: 4 bytes leftover after parsing attributes in process `syz.3.63'. [ 134.806254][ T60] Bluetooth: hci4: command tx timeout [ 135.030892][ T6166] warning: `syz.3.66' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 135.188533][ T6122] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 135.215124][ T6122] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 135.274256][ T6170] faux_driver vkms: [drm] Unknown color mode 6; guessing buffer size. [ 135.295783][ T6122] team0: Port device team_slave_0 added [ 135.311259][ T6122] team0: Port device team_slave_1 added [ 135.384538][ T6122] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 135.384567][ T6122] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 135.384596][ T6122] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 135.434030][ T6122] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 135.434048][ T6122] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 135.434076][ T6122] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 135.640479][ T6122] hsr_slave_0: entered promiscuous mode [ 135.653302][ T6122] hsr_slave_1: entered promiscuous mode [ 135.673896][ T6122] debugfs: 'hsr0' already exists in 'hsr' [ 135.673926][ T6122] Cannot create hsr debugfs directory [ 135.785410][ T6181] netlink: 12 bytes leftover after parsing attributes in process `syz.3.70'. [ 135.868038][ T6181] netlink: 28 bytes leftover after parsing attributes in process `syz.3.70'. [ 135.973791][ T5894] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 135.981327][ T38] audit: type=1326 audit(1777263958.418:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 135.981429][ T38] audit: type=1326 audit(1777263958.418:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 135.981515][ T38] audit: type=1326 audit(1777263958.418:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 135.991483][ T38] audit: type=1326 audit(1777263958.418:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 135.991606][ T38] audit: type=1326 audit(1777263958.428:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 135.991662][ T38] audit: type=1326 audit(1777263958.428:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 135.993528][ T38] audit: type=1326 audit(1777263958.428:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 136.000471][ T38] audit: type=1326 audit(1777263958.428:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 136.000622][ T38] audit: type=1326 audit(1777263958.438:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 136.000928][ T38] audit: type=1326 audit(1777263958.438:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6168 comm="syz.0.68" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d3ddacdd9 code=0x7fc00000 [ 136.321710][ T5894] usb 2-1: New USB device found, idVendor=08fd, idProduct=0002, bcdDevice=ca.fd [ 136.321749][ T5894] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 136.321764][ T5894] usb 2-1: Product: syz [ 136.321775][ T5894] usb 2-1: Manufacturer: syz [ 136.321786][ T5894] usb 2-1: SerialNumber: syz [ 136.368215][ T5894] usb 2-1: config 0 descriptor?? [ 136.453841][ T6189] netlink: 'syz.0.73': attribute type 19 has an invalid length. [ 136.453866][ T6189] netlink: 180 bytes leftover after parsing attributes in process `syz.0.73'. [ 136.533734][ T60] Bluetooth: hci5: urb ffff8880361e6300 submission failed (2) [ 136.585134][ T6179] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.620276][ T6179] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 136.744416][ T5968] usb 2-1: USB disconnect, device number 6 [ 136.828999][ T6194] netlink: 'syz.3.74': attribute type 27 has an invalid length. [ 136.879534][ T6122] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 136.900580][ T60] Bluetooth: hci4: command tx timeout [ 136.923133][ T6122] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 136.924478][ T6122] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 136.991684][ T6196] romfs: Unknown parameter 'grpquota' [ 136.994603][ T6197] romfs: Unknown parameter 'grpquota' [ 137.009364][ T6122] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 137.014703][ T6122] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 137.203145][ T6122] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 137.217893][ T6122] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 137.270634][ T6122] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 137.372225][ T6205] netlink: 'syz.0.77': attribute type 21 has an invalid length. [ 137.372250][ T6205] __nla_validate_parse: 1 callbacks suppressed [ 137.372263][ T6205] netlink: 128 bytes leftover after parsing attributes in process `syz.0.77'. [ 137.375039][ T6205] netlink: 'syz.0.77': attribute type 4 has an invalid length. [ 137.375060][ T6205] netlink: 3 bytes leftover after parsing attributes in process `syz.0.77'. [ 137.487856][ T5885] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 137.636684][ T5885] usb 4-1: Using ep0 maxpacket: 8 [ 137.670038][ T5885] usb 4-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 137.670097][ T5885] usb 4-1: config 6 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 137.674102][ T5885] usb 4-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 137.674133][ T5885] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.674155][ T5885] usb 4-1: Product: syz [ 137.674170][ T5885] usb 4-1: Manufacturer: syz [ 137.674186][ T5885] usb 4-1: SerialNumber: syz [ 137.810279][ T6216] netlink: 12 bytes leftover after parsing attributes in process `syz.0.79'. [ 137.853501][ T6122] 8021q: adding VLAN 0 to HW filter on device bond0 [ 137.897060][ T5885] hso 4-1:6.0: Can't find BULK endpoints [ 137.917886][ T6122] 8021q: adding VLAN 0 to HW filter on device team0 [ 137.949001][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 137.972222][ T5894] usb 4-1: USB disconnect, device number 7 [ 137.987979][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 138.044049][ T6218] netlink: 28 bytes leftover after parsing attributes in process `syz.0.79'. [ 138.102288][ T1428] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.102468][ T1428] bridge0: port 2(bridge_slave_1) entered forwarding state [ 138.297269][ T6224] netlink: 'syz.0.81': attribute type 12 has an invalid length. [ 138.297292][ T6224] netlink: 120 bytes leftover after parsing attributes in process `syz.0.81'. [ 138.298650][ T6224] capability: warning: `syz.0.81' uses deprecated v2 capabilities in a way that may be insecure [ 138.426136][ T5891] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 138.576237][ T5891] usb 2-1: Using ep0 maxpacket: 8 [ 138.589804][ T5891] usb 2-1: unable to get BOS descriptor or descriptor too short [ 138.604435][ T5891] usb 2-1: config 1 interface 0 has no altsetting 0 [ 138.624942][ T5891] usb 2-1: New USB device found, idVendor=05ac, idProduct=0263, bcdDevice= 0.40 [ 138.624977][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.625000][ T5891] usb 2-1: Product: syz [ 138.625015][ T5891] usb 2-1: Manufacturer: syz [ 138.625031][ T5891] usb 2-1: SerialNumber: syz [ 138.697013][ T5885] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 138.907245][ T5885] usb 1-1: config 69 has an invalid descriptor of length 173, skipping remainder of the config [ 138.907277][ T5885] usb 1-1: config 69 has 0 interfaces, different from the descriptor's value: 2 [ 138.913548][ T5885] usb 1-1: New USB device found, idVendor=056c, idProduct=8100, bcdDevice=4a.c9 [ 138.913585][ T5885] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.913612][ T5885] usb 1-1: Product: syz [ 138.913631][ T5885] usb 1-1: Manufacturer: syz [ 138.913651][ T5885] usb 1-1: SerialNumber: syz [ 138.976202][ T60] Bluetooth: hci4: command tx timeout [ 139.158262][ T5891] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input7 [ 139.275739][ T5177] bcm5974 2-1:1.0: could not read from device [ 139.331554][ T6122] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 139.332264][ T6233] netlink: 'syz.0.81': attribute type 12 has an invalid length. [ 139.332283][ T6233] netlink: 120 bytes leftover after parsing attributes in process `syz.0.81'. [ 139.466742][ T5891] usb 2-1: USB disconnect, device number 7 [ 139.468191][ T5177] bcm5974 2-1:1.0: could not read from device [ 139.610493][ T5885] usb 1-1: USB disconnect, device number 7 [ 140.267626][ T6255] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.87'. [ 140.326682][ T5894] usb 4-1: new full-speed USB device number 8 using dummy_hcd [ 140.482337][ T6257] netlink: 28 bytes leftover after parsing attributes in process `syz.1.88'. [ 140.499298][ T5894] usb 4-1: too many endpoints for config 0 interface 0 altsetting 4: 253, using maximum allowed: 30 [ 140.499355][ T5894] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 140.499386][ T5894] usb 4-1: config 0 interface 0 altsetting 4 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 140.499415][ T5894] usb 4-1: config 0 interface 0 has no altsetting 0 [ 140.499449][ T5894] usb 4-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 140.499467][ T5894] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 140.604190][ T5894] usb 4-1: config 0 descriptor?? [ 140.612016][ T6251] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 140.628353][ T6122] veth0_vlan: entered promiscuous mode [ 140.940413][ T6122] veth1_vlan: entered promiscuous mode [ 141.037754][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.037797][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.037826][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.037853][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.037881][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.037908][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.037935][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.037963][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.038008][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.038036][ T5894] isku 0003:1E7D:319C.0002: unknown main item tag 0x0 [ 141.048894][ T60] Bluetooth: hci4: command tx timeout [ 141.160547][ T5894] isku 0003:1E7D:319C.0002: hidraw0: USB HID v0.20 Device [HID 1e7d:319c] on usb-dummy_hcd.3-1/input0 [ 141.206836][ T5885] usb 1-1: new low-speed USB device number 8 using dummy_hcd [ 141.252853][ T10] usb 4-1: USB disconnect, device number 8 [ 141.255601][ T6122] veth0_macvtap: entered promiscuous mode [ 141.359446][ T5885] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1056, setting to 8 [ 141.359502][ T5885] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8 [ 141.359548][ T5885] usb 1-1: New USB device found, idVendor=5543, idProduct=0081, bcdDevice= 0.00 [ 141.359573][ T5885] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.418451][ T9] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 141.443555][ T6122] veth1_macvtap: entered promiscuous mode [ 141.474591][ T6266] fido_id[6266]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 141.513596][ T5885] usb 1-1: config 0 descriptor?? [ 141.525021][ T6262] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 141.580362][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 141.580393][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 141.580419][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 21802, setting to 1024 [ 141.580445][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 1024 [ 141.585164][ T9] usb 2-1: New USB device found, idVendor=2040, idProduct=2000, bcdDevice=65.72 [ 141.585196][ T9] usb 2-1: New USB device strings: Mfr=151, Product=0, SerialNumber=0 [ 141.585412][ T9] usb 2-1: Manufacturer: syz [ 141.723399][ T9] usb 2-1: config 0 descriptor?? [ 141.724887][ T6264] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 141.774369][ T9] smsusb:smsusb_probe: board id=9, interface number 0 [ 141.813846][ T9] smsusb:siano_media_device_register: media controller created [ 141.861938][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.862019][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.862111][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.883017][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.885709][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.885875][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.895817][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.895896][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.896050][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.899814][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.899948][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.900394][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.900892][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.901052][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.901350][ T9] smsmdtv:smscore_sendrequest_and_wait: sendrequest returned error -22 [ 141.901408][ T9] smsmdtv:smscore_set_device_mode: mode detect failed -22 [ 141.901461][ T9] smsmdtv:smscore_start_device: set device mode failed , rc -22 [ 141.901503][ T9] smsusb:smsusb_init_device: smscore_start_device(...) failed [ 141.961873][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.962693][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.962850][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 141.963033][ C0] smsusb:smsusb_onresponse: error, urb status -71, 0 bytes [ 142.046469][ T5885] usbhid 1-1:0.0: can't add hid device: -71 [ 142.046606][ T5885] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 142.095860][ T9] ------------[ cut here ]------------ [ 142.095877][ T9] !PageLargeKmalloc(page) [ 142.095898][ T9] WARNING: mm/slub.c:6471 at free_large_kmalloc+0x9b/0x110, CPU#0: kworker/0:0/9 [ 142.095971][ T9] Modules linked in: [ 142.096077][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 142.096109][ T9] Tainted: [L]=SOFTLOCKUP [ 142.096119][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 142.096134][ T9] Workqueue: usb_hub_wq hub_event [ 142.096160][ T9] RIP: 0010:free_large_kmalloc+0x9b/0x110 [ 142.096207][ T9] Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 74 c7 43 30 ff ff ff ff 48 89 df 89 ee 5b 41 5e 5d e9 96 c8 fc ff 90 <0f> 0b 90 48 89 df 48 c7 c6 e4 6a 9b 8d 5b 41 5e 5d e9 0f 79 04 ff [ 142.096228][ T9] RSP: 0018:ffffc900000e6b80 EFLAGS: 00010206 [ 142.096247][ T9] RAX: 00000000ff000000 RBX: ffffea000190f880 RCX: 0000000000000001 [ 142.096263][ T9] RDX: ffffc90018ebf000 RSI: ffff8880643e2000 RDI: ffffea000190f880 [ 142.096281][ T9] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 142.096295][ T9] R10: dffffc0000000000 R11: ffffed10056cd981 R12: 1ffff110053de682 [ 142.096313][ T9] R13: ffff8880281c3080 R14: ffff88802b66cc60 R15: dffffc0000000000 [ 142.096332][ T9] FS: 0000000000000000(0000) GS:ffff888125a5b000(0000) knlGS:0000000000000000 [ 142.096351][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 142.096368][ T9] CR2: 00007f0073733fd0 CR3: 000000005e67c000 CR4: 00000000003526f0 [ 142.096393][ T9] Call Trace: [ 142.096403][ T9] [ 142.096416][ T9] usb_free_urb+0xd0/0x120 [ 142.096451][ T9] smsusb_term_device+0x1d7/0x3e0 [ 142.096494][ T9] smsusb_probe+0x1aba/0x2280 [ 142.096544][ T9] ? __pfx_smsusb_probe+0x10/0x10 [ 142.096574][ T9] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 142.096607][ T9] ? __pfx_smsusb_sendrequest+0x10/0x10 [ 142.096640][ T9] ? rt_spin_unlock+0x14f/0x200 [ 142.096670][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.096698][ T9] ? __pm_runtime_set_status+0x99c/0xc70 [ 142.096732][ T9] usb_probe_interface+0x659/0xc70 [ 142.096774][ T9] ? __pfx_usb_probe_interface+0x10/0x10 [ 142.096798][ T9] really_probe+0x267/0xaf0 [ 142.096834][ T9] __driver_probe_device+0x1ef/0x380 [ 142.096862][ T9] driver_probe_device+0x4f/0x240 [ 142.096906][ T9] __device_attach_driver+0x279/0x430 [ 142.096937][ T9] bus_for_each_drv+0x25b/0x2f0 [ 142.096973][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 142.097001][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 142.097061][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.097097][ T9] __device_attach+0x2c8/0x450 [ 142.097127][ T9] ? __pfx___device_attach+0x10/0x10 [ 142.097155][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.097190][ T9] device_initial_probe+0xa1/0xd0 [ 142.097220][ T9] bus_probe_device+0x12d/0x220 [ 142.097259][ T9] device_add+0x7e9/0xbb0 [ 142.097302][ T9] usb_set_configuration+0x1a87/0x2110 [ 142.097357][ T9] usb_generic_driver_probe+0x8d/0x150 [ 142.097401][ T9] usb_probe_device+0x1c4/0x3b0 [ 142.097437][ T9] ? __pfx_usb_probe_device+0x10/0x10 [ 142.097465][ T9] really_probe+0x267/0xaf0 [ 142.097498][ T9] __driver_probe_device+0x1ef/0x380 [ 142.097528][ T9] driver_probe_device+0x4f/0x240 [ 142.097557][ T9] __device_attach_driver+0x279/0x430 [ 142.097589][ T9] bus_for_each_drv+0x25b/0x2f0 [ 142.097624][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 142.097652][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 142.097686][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.097721][ T9] __device_attach+0x2c8/0x450 [ 142.097749][ T9] ? __pfx___device_attach+0x10/0x10 [ 142.097774][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.097808][ T9] device_initial_probe+0xa1/0xd0 [ 142.097835][ T9] bus_probe_device+0x12d/0x220 [ 142.097872][ T9] device_add+0x7e9/0xbb0 [ 142.097925][ T9] usb_new_device+0x9f8/0x16e0 [ 142.097970][ T9] ? __pfx_usb_new_device+0x10/0x10 [ 142.098014][ T9] hub_event+0x2a49/0x4f60 [ 142.098090][ T9] ? __pfx_hub_event+0x10/0x10 [ 142.098112][ T9] ? process_one_work+0x8b7/0x1710 [ 142.098152][ T9] ? process_one_work+0x8b7/0x1710 [ 142.098176][ T9] process_one_work+0x9a3/0x1710 [ 142.098226][ T9] ? __pfx_process_one_work+0x10/0x10 [ 142.098249][ T9] ? do_raw_spin_lock+0x12b/0x2f0 [ 142.098296][ T9] worker_thread+0xba8/0x11e0 [ 142.098353][ T9] kthread+0x388/0x470 [ 142.098386][ T9] ? __pfx_worker_thread+0x10/0x10 [ 142.098410][ T9] ? __pfx_kthread+0x10/0x10 [ 142.098444][ T9] ret_from_fork+0x514/0xb70 [ 142.098475][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 142.098501][ T9] ? __switch_to+0xc79/0x1410 [ 142.098543][ T9] ? __pfx_kthread+0x10/0x10 [ 142.098578][ T9] ret_from_fork_asm+0x1a/0x30 [ 142.098628][ T9] [ 142.098641][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 142.098663][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 142.098696][ T9] Tainted: [L]=SOFTLOCKUP [ 142.098705][ T9] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 142.098721][ T9] Workqueue: usb_hub_wq hub_event [ 142.098744][ T9] Call Trace: [ 142.098754][ T9] [ 142.098764][ T9] vpanic+0x56c/0xa60 [ 142.098796][ T9] ? __pfx__printk+0x10/0x10 [ 142.098832][ T9] ? __pfx_vpanic+0x10/0x10 [ 142.098860][ T9] ? is_bpf_text_address+0x292/0x2b0 [ 142.098901][ T9] ? is_bpf_text_address+0x26/0x2b0 [ 142.098943][ T9] panic+0xc5/0xd0 [ 142.098974][ T9] ? __pfx_panic+0x10/0x10 [ 142.099015][ T9] ? ret_from_fork_asm+0x1a/0x30 [ 142.099052][ T9] __warn+0x315/0x4c0 [ 142.099081][ T9] ? free_large_kmalloc+0x9b/0x110 [ 142.099121][ T9] ? free_large_kmalloc+0x9b/0x110 [ 142.099158][ T9] __report_bug+0x29a/0x540 [ 142.099189][ T9] ? device_initial_probe+0xa1/0xd0 [ 142.099213][ T9] ? bus_probe_device+0x12d/0x220 [ 142.099244][ T9] ? device_add+0x7e9/0xbb0 [ 142.099283][ T9] ? free_large_kmalloc+0x9b/0x110 [ 142.099320][ T9] ? __pfx___report_bug+0x10/0x10 [ 142.099349][ T9] ? usb_new_device+0x9f8/0x16e0 [ 142.099387][ T9] ? do_raw_spin_lock+0x12b/0x2f0 [ 142.099425][ T9] ? free_large_kmalloc+0x9b/0x110 [ 142.099461][ T9] report_bug+0x16a/0x220 [ 142.099494][ T9] ? free_large_kmalloc+0x9b/0x110 [ 142.099529][ T9] ? free_large_kmalloc+0x9d/0x110 [ 142.099564][ T9] handle_bug+0x9c/0x200 [ 142.099603][ T9] exc_invalid_op+0x1a/0x50 [ 142.099639][ T9] asm_exc_invalid_op+0x1a/0x20 [ 142.099663][ T9] RIP: 0010:free_large_kmalloc+0x9b/0x110 [ 142.099699][ T9] Code: 8b 43 30 83 f8 ff 74 13 25 00 00 00 ff 3d 00 00 00 f8 75 74 c7 43 30 ff ff ff ff 48 89 df 89 ee 5b 41 5e 5d e9 96 c8 fc ff 90 <0f> 0b 90 48 89 df 48 c7 c6 e4 6a 9b 8d 5b 41 5e 5d e9 0f 79 04 ff [ 142.099719][ T9] RSP: 0018:ffffc900000e6b80 EFLAGS: 00010206 [ 142.099739][ T9] RAX: 00000000ff000000 RBX: ffffea000190f880 RCX: 0000000000000001 [ 142.099755][ T9] RDX: ffffc90018ebf000 RSI: ffff8880643e2000 RDI: ffffea000190f880 [ 142.099772][ T9] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 142.099786][ T9] R10: dffffc0000000000 R11: ffffed10056cd981 R12: 1ffff110053de682 [ 142.099804][ T9] R13: ffff8880281c3080 R14: ffff88802b66cc60 R15: dffffc0000000000 [ 142.099842][ T9] usb_free_urb+0xd0/0x120 [ 142.099876][ T9] smsusb_term_device+0x1d7/0x3e0 [ 142.100090][ T9] smsusb_probe+0x1aba/0x2280 [ 142.100143][ T9] ? __pfx_smsusb_probe+0x10/0x10 [ 142.100175][ T9] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 142.100209][ T9] ? __pfx_smsusb_sendrequest+0x10/0x10 [ 142.100243][ T9] ? rt_spin_unlock+0x14f/0x200 [ 142.100274][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.100302][ T9] ? __pm_runtime_set_status+0x99c/0xc70 [ 142.100339][ T9] usb_probe_interface+0x659/0xc70 [ 142.100381][ T9] ? __pfx_usb_probe_interface+0x10/0x10 [ 142.100408][ T9] really_probe+0x267/0xaf0 [ 142.100444][ T9] __driver_probe_device+0x1ef/0x380 [ 142.100475][ T9] driver_probe_device+0x4f/0x240 [ 142.100503][ T9] __device_attach_driver+0x279/0x430 [ 142.100536][ T9] bus_for_each_drv+0x25b/0x2f0 [ 142.100572][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 142.100602][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 142.100637][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.100670][ T9] __device_attach+0x2c8/0x450 [ 142.100699][ T9] ? __pfx___device_attach+0x10/0x10 [ 142.100726][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.100759][ T9] device_initial_probe+0xa1/0xd0 [ 142.100788][ T9] bus_probe_device+0x12d/0x220 [ 142.100827][ T9] device_add+0x7e9/0xbb0 [ 142.100869][ T9] usb_set_configuration+0x1a87/0x2110 [ 142.100964][ T9] usb_generic_driver_probe+0x8d/0x150 [ 142.101007][ T9] usb_probe_device+0x1c4/0x3b0 [ 142.101036][ T9] ? __pfx_usb_probe_device+0x10/0x10 [ 142.101059][ T9] really_probe+0x267/0xaf0 [ 142.101095][ T9] __driver_probe_device+0x1ef/0x380 [ 142.101125][ T9] driver_probe_device+0x4f/0x240 [ 142.101156][ T9] __device_attach_driver+0x279/0x430 [ 142.101187][ T9] bus_for_each_drv+0x25b/0x2f0 [ 142.101222][ T9] ? __pfx___device_attach_driver+0x10/0x10 [ 142.101251][ T9] ? __pfx_bus_for_each_drv+0x10/0x10 [ 142.101285][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.101321][ T9] __device_attach+0x2c8/0x450 [ 142.101350][ T9] ? __pfx___device_attach+0x10/0x10 [ 142.101376][ T9] ? rt_spin_unlock+0x160/0x200 [ 142.101411][ T9] device_initial_probe+0xa1/0xd0 [ 142.101438][ T9] bus_probe_device+0x12d/0x220 [ 142.101477][ T9] device_add+0x7e9/0xbb0 [ 142.101522][ T9] usb_new_device+0x9f8/0x16e0 [ 142.101573][ T9] ? __pfx_usb_new_device+0x10/0x10 [ 142.101618][ T9] hub_event+0x2a49/0x4f60 [ 142.101699][ T9] ? __pfx_hub_event+0x10/0x10 [ 142.101723][ T9] ? process_one_work+0x8b7/0x1710 [ 142.101784][ T9] ? process_one_work+0x8b7/0x1710 [ 142.101808][ T9] process_one_work+0x9a3/0x1710 [ 142.101855][ T9] ? __pfx_process_one_work+0x10/0x10 [ 142.101878][ T9] ? do_raw_spin_lock+0x12b/0x2f0 [ 142.101934][ T9] worker_thread+0xba8/0x11e0 [ 142.101991][ T9] kthread+0x388/0x470 [ 142.102026][ T9] ? __pfx_worker_thread+0x10/0x10 [ 142.102052][ T9] ? __pfx_kthread+0x10/0x10 [ 142.102087][ T9] ret_from_fork+0x514/0xb70 [ 142.102117][ T9] ? __pfx_ret_from_fork+0x10/0x10 [ 142.102144][ T9] ? __switch_to+0xc79/0x1410 [ 142.102184][ T9] ? __pfx_kthread+0x10/0x10 [ 142.102217][ T9] ret_from_fork_asm+0x1a/0x30 [ 142.102266][ T9] [ 142.102618][ T9] Kernel Offset: disabled