last executing test programs: 9m43.118707267s ago: executing program 2 (id=3): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', 0xffffffffffffffff, 0x0, 0xfffffffffffffffe}, 0x18) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000015c0)=@base={0x1, 0xb, 0xbe, 0x1, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r2, &(0x7f00000000c0), 0x0}, 0x20) unshare(0x26020480) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000000280), 0x20000, 0x2) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r5, 0xc0045540, &(0x7f0000000000)=0xfffffffd) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) syz_usb_connect(0x0, 0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000094ba78084e080110aeed010203010902220001000000000904000001437b6a00090501", @ANYRES32], 0x0) 9m40.018200156s ago: executing program 2 (id=14): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, 0x0, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r5 = fanotify_init(0x200, 0x101000) readv(r5, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/136, 0x88}], 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) 9m39.70135052s ago: executing program 2 (id=17): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000200)={0x40, r5, 0x1, 0x70bd2c, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x2, 0x25}}}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x99e}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}]]}, 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x2, 0x3}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1c, 0x3a, 0xb, 0x0, 0x0, {0x4}, [@nested={0x4}, @nested={0x4, 0x9}]}, 0x1c}}, 0x0) r7 = io_uring_setup(0x2cef, &(0x7f0000000200)={0x0, 0x4ff6, 0x3, 0x2, 0x315}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_CLOCK(r7, 0x1d, &(0x7f0000000000)={0x1}, 0x0) set_mempolicy_home_node(&(0x7f0000fed000/0x1000)=nil, 0x1000, 0x2, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) mincore(&(0x7f00008d6000/0x1000)=nil, 0x1000, &(0x7f0000000140)=""/39) syz_emit_ethernet(0x3e, &(0x7f0000000280)={@broadcast, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x2b, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x73, 0x0, @empty=0xac1414aa, @dev}}}}}}, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x13, r8, 0x3000) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ZERO(r9, 0x0, 0x48f, &(0x7f00000000c0)={0x2, @rand_addr=0x64010100, 0x4e22, 0x3, 'wrr\x00', 0x10, 0xfffffff2, 0x38}, 0x2c) 9m39.106618159s ago: executing program 32 (id=17): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000200)={0x40, r5, 0x1, 0x70bd2c, 0x0, {{0x2}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x2, 0x25}}}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x99e}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}]]}, 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0x4040000) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x14) prlimit64(0x0, 0x7, &(0x7f0000000180)={0x2, 0x3}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1c, 0x3a, 0xb, 0x0, 0x0, {0x4}, [@nested={0x4}, @nested={0x4, 0x9}]}, 0x1c}}, 0x0) r7 = io_uring_setup(0x2cef, &(0x7f0000000200)={0x0, 0x4ff6, 0x3, 0x2, 0x315}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_CLOCK(r7, 0x1d, &(0x7f0000000000)={0x1}, 0x0) set_mempolicy_home_node(&(0x7f0000fed000/0x1000)=nil, 0x1000, 0x2, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) mincore(&(0x7f00008d6000/0x1000)=nil, 0x1000, &(0x7f0000000140)=""/39) syz_emit_ethernet(0x3e, &(0x7f0000000280)={@broadcast, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x2b, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x73, 0x0, @empty=0xac1414aa, @dev}}}}}}, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x13, r8, 0x3000) r9 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ZERO(r9, 0x0, 0x48f, &(0x7f00000000c0)={0x2, @rand_addr=0x64010100, 0x4e22, 0x3, 'wrr\x00', 0x10, 0xfffffff2, 0x38}, 0x2c) 7m59.984373434s ago: executing program 4 (id=382): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x6}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000100), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000000c0)={0x2, 0xfa}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000008c0)={0x2, 0x7}, 0x2) syz_usb_connect(0x0, 0x2d, &(0x7f0000000940)={{0x12, 0x1, 0x0, 0xa6, 0xff, 0x5, 0x40, 0xabcd, 0xcdee, 0x5b9, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x1b, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9c, 0x0, 0x0, 0x1, 0x3, 0x51}}, {{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) (async) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x6}, 0x2) (async) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000100), 0x2) (async) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000000c0)={0x2, 0xfa}, 0x2) (async) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000008c0)={0x2, 0x7}, 0x2) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000000940)={{0x12, 0x1, 0x0, 0xa6, 0xff, 0x5, 0x40, 0xabcd, 0xcdee, 0x5b9, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x1b, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9c, 0x0, 0x0, 0x1, 0x3, 0x51}}, {{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0xff, 0xff}}]}}]}}, 0x0) (async) 7m59.217979325s ago: executing program 4 (id=385): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) (async) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) preadv2(r0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/84, 0x54}, {&(0x7f0000000380)=""/184, 0xb8}, {&(0x7f00000000c0)=""/25, 0x19}, {&(0x7f0000000440)=""/225, 0xe1}, {&(0x7f0000000540)=""/205, 0xcd}], 0x5, 0x50, 0x6, 0x2) (async) preadv2(r0, &(0x7f0000000280)=[{&(0x7f00000001c0)=""/84, 0x54}, {&(0x7f0000000380)=""/184, 0xb8}, {&(0x7f00000000c0)=""/25, 0x19}, {&(0x7f0000000440)=""/225, 0xe1}, {&(0x7f0000000540)=""/205, 0xcd}], 0x5, 0x50, 0x6, 0x2) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r2, &(0x7f0000847fff)='X', 0xffe4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$video4linux(&(0x7f0000000080), 0x100000008, 0x0) socket$tipc(0x1e, 0x2, 0x0) (async) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='fd=', @ANYBLOB="7ce67cd2b9698d5c20f6ae408974634d9c11951f153014d3568944c8e566d76287d29c2f9faa74063a7c99b84e9d8b91503f927c6b3548bbd1bcd795413e67ff6bc6d7d8e50968b1e11581d3007924d70d6a99a3b64660d6793fdf351a665870099ed6554c666e9c9490c636cea2f573cff05fd8bc1072c4d750f3ab4776a8caef2712761055b0a88eb65a11746aba468f", @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000180)={0x50, 0x0, r5, {0x7, 0x29, 0x0, 0xffffffff85000014, 0x5, 0x7, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x50) unshare(0x6a040000) (async) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x94173000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x94173000) sendmsg$DEVLINK_CMD_RATE_DEL(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$DEVLINK_CMD_RATE_DEL(0xffffffffffffffff, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) (async) socket$inet_smc(0x2b, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) (async) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x0, 0x4}]}) syz_open_dev$loop(0x0, 0x6, 0x20000) close_range(r6, 0xffffffffffffffff, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) (async) openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x4b) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000880)=ANY=[], 0x10}}, 0x0) syz_fuse_handle_req(r4, &(0x7f00000042c0), 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_fuse_handle_req(r4, &(0x7f00000042c0), 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x8}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r4, &(0x7f00000067c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b00", 0x2000, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="780000000000000002000000000000040000000000000000000000000000000004"], 0x0, 0x0, 0x0, 0x0}) 7m56.994277881s ago: executing program 4 (id=395): syz_usb_connect(0x2, 0xe4, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000017ffd340b1134200bbdf000000010902d2f6010000400009046a00067af4190009050f080000050801060c8b631b7507250102020700090501"], 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="40000000000201040000000002000000240002801400018008000100ac1414aa08000200e00000010c0002800500010000000000040003"], 0x40}}, 0x40) syz_usb_connect(0x2, 0xe4, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000017ffd340b1134200bbdf000000010902d2f6010000400009046a00067af4190009050f080000050801060c8b631b7507250102020700090501"], 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="40000000000201040000000002000000240002801400018008000100ac1414aa08000200e00000010c0002800500010000000000040003"], 0x40}}, 0x40) (async) 7m55.19055679s ago: executing program 4 (id=402): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x40000000}, 0x6e) syz_open_dev$vbi(0x0, 0x0, 0x2) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000400)={0x48, 0x2, r4}) (async) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000400)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r4, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r4, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) ioctl$IOMMU_HWPT_ALLOC$NONE(r3, 0x3b89, &(0x7f0000000000)={0x28, 0x2, r5, r4, 0x0, 0x0, 0x0, 0x0, 0x0}) close_range(r2, 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x1, 0x0) read$nci(0xffffffffffffffff, &(0x7f0000002780)=""/3, 0x3) (async) read$nci(0xffffffffffffffff, &(0x7f0000002780)=""/3, 0x3) request_key(0x0, &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0) 7m52.730089139s ago: executing program 4 (id=407): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000010010000000ffdbdf2500000000", @ANYRES32=r3, @ANYBLOB="20000000280e0400280012800b0001006d61637365630000180002800500030008"], 0x48}, 0x1, 0x0, 0x0, 0x24008001}, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched_retired(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000040)={&(0x7f0000000300)=@newtclass={0x8d4, 0x28, 0x810, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0xfff1, 0x7}, {0xe}, {0x1e, 0x8}}, [@c_dsmark={{0xb}, {0xc, 0x2, @TCA_DSMARK_VALUE={0x5}}}, @c_cbq={{0x8}, {0x418, 0x2, [@TCA_CBQ_WRROPT={0x10, 0x2, {0x0, 0x3, 0x10, 0x4, 0xed7e, 0x101}}, @TCA_CBQ_RTAB={0x404, 0x6, [0xffffffff, 0x2, 0xbc0, 0x2e6, 0x3, 0x18, 0x2a01000, 0x3, 0x6, 0x7, 0x6, 0x1, 0x5, 0x2, 0x2, 0x2, 0xff, 0x1, 0x5, 0x1, 0x5, 0x2, 0xa, 0xfff, 0x0, 0x9, 0x4, 0x7fff, 0x7, 0x7, 0xf63, 0x0, 0x1, 0xeba, 0x1, 0xff, 0x4, 0x9, 0x5, 0xcf3, 0x6, 0x35, 0x7, 0x10000, 0x9, 0xf72, 0x4, 0xfffffff9, 0xbf, 0x100, 0x6, 0x3, 0x6, 0x0, 0x8, 0x9e, 0x10, 0xb2, 0x4, 0x5, 0xffff3a46, 0x2, 0xc6, 0x3, 0x6, 0x4b2, 0x9, 0x7, 0x0, 0x11a8, 0x1, 0x5, 0x7f, 0x8001, 0x4, 0x6, 0x6, 0x8, 0x7, 0x188e, 0x7, 0x7c9, 0xffff3b59, 0xe, 0x10, 0x3, 0xe, 0x8, 0x6, 0x6, 0x6, 0x7, 0x8001, 0x3, 0x9, 0x7ff, 0x1, 0x4, 0x5, 0x6, 0x5, 0x8928, 0x3, 0x6, 0x3, 0x941, 0xe675, 0x34, 0x2, 0x0, 0x8, 0xe1, 0x101, 0x1, 0x7, 0x0, 0x7, 0x62, 0x7f, 0x2f42768, 0x0, 0x400, 0x8, 0x0, 0x3cff, 0x7fff, 0x1, 0xf602, 0xffffffff, 0xc, 0x1ff, 0x40, 0x1, 0x8, 0x6, 0x7, 0x40, 0x2, 0x0, 0xbd, 0x20, 0x4, 0x9, 0x0, 0x5, 0xcf, 0xfffffffb, 0x4c38b99a, 0xffff, 0x4, 0xfffffffd, 0x800, 0xce3, 0xa, 0x1, 0x1, 0x2, 0x612, 0x2, 0xe, 0x9, 0xf4, 0x9, 0x5, 0x4a4e, 0x9, 0x81, 0x101, 0x8, 0x2, 0x1, 0x0, 0x7fffffff, 0x5, 0x7f, 0xc7, 0x1, 0x0, 0x106a, 0x3, 0x19, 0xfffffffc, 0x8, 0x800, 0x4, 0x74, 0x572b, 0x9b4, 0x80000000, 0xd, 0x800, 0x0, 0x3, 0x6, 0x2, 0x10000, 0x7ff, 0x4, 0xfffffffe, 0x1000, 0x3, 0x7f, 0x4, 0x7, 0x48, 0x0, 0xffffff30, 0x5, 0xe60, 0x7ff, 0x9, 0x3, 0x0, 0x0, 0x1, 0x7, 0x4, 0x10, 0x7, 0x401, 0x6, 0x10001, 0x9, 0x9, 0xc074, 0x0, 0x2, 0x80d1, 0x6, 0xf, 0xe32, 0x6, 0x7fff, 0x5, 0x6, 0xff, 0x1ff, 0xf, 0xdf, 0x7, 0x101, 0x8000, 0x8, 0x5, 0x5, 0x4, 0x8, 0xf, 0x8, 0x7, 0x9, 0x1, 0x0, 0x7fffffff, 0x100, 0x6]}]}}, @c_cbq={{0x8}, {0x418, 0x2, [@TCA_CBQ_RATE={0x10, 0x5, {0x7, 0x0, 0x0, 0x1, 0x3ff, 0x3}}, @TCA_CBQ_RTAB={0x404, 0x6, [0x1, 0xd, 0x6630, 0x68, 0x7, 0x1ff, 0x5592, 0x9, 0x0, 0x0, 0x7e82406a, 0x4, 0xa319, 0x8000, 0x60000000, 0x5, 0x140, 0xa853, 0x7, 0x3, 0x6, 0x5, 0x5, 0x3e, 0xc, 0x3, 0x6, 0x4, 0xe, 0x5, 0x0, 0x0, 0x7, 0x3, 0x7, 0x9, 0xff, 0x0, 0x1000, 0x81, 0x5, 0xb57, 0x3, 0x80, 0x9, 0x3, 0x4, 0x5, 0xffff, 0x5, 0x6, 0x1000, 0x4, 0x10000, 0xb0, 0xa, 0x200, 0x75f9, 0x7, 0x6, 0x3, 0x7, 0x5, 0x8, 0x8, 0x7215, 0xfffffe0a, 0x7, 0x0, 0x2, 0x12, 0xed4, 0x80, 0x81, 0x4, 0x3, 0x0, 0x5, 0x6, 0x8, 0x401, 0x4, 0xffff, 0x3, 0xd, 0x401, 0x6, 0x8, 0x1200, 0x2, 0xe03, 0x9, 0x2, 0x0, 0x9, 0x8, 0x4, 0x9, 0x10, 0x7, 0xfffffffa, 0x1b1, 0x1, 0x2, 0x2, 0xf76, 0x80, 0x6, 0xe56, 0xfff, 0x80000000, 0x40, 0x3, 0x6, 0x74, 0x1c0000, 0x3ff, 0xffffa1aa, 0x2, 0x0, 0xff, 0x3, 0x4, 0xb, 0x7, 0x10000, 0x4, 0x0, 0x6, 0xddb5, 0x3, 0x9, 0x7, 0x3, 0x9, 0x1, 0x3d, 0x9, 0x7, 0x9, 0x2, 0x3, 0x2, 0xfce, 0x8, 0x3, 0x3, 0x6, 0x7, 0x82c, 0x7, 0x1, 0x8, 0x7, 0x9, 0xffff0fde, 0x2, 0x9d, 0x2, 0x1, 0x0, 0x9, 0x6, 0x66df, 0x5, 0x7, 0x7, 0x9, 0xd, 0xa515, 0x80000000, 0x3, 0xfff, 0x9, 0x3, 0x1, 0x4, 0x6, 0x5, 0x7, 0xff, 0xff, 0x3, 0x1, 0x2, 0x4, 0x7, 0x0, 0x4, 0x5, 0x800, 0xffff4414, 0x7, 0x1, 0x40, 0x1103, 0xa1, 0xf, 0x1, 0x2, 0xf, 0x4, 0x9, 0x3ff, 0xbb1, 0x5, 0x0, 0x8, 0xe8, 0x10001, 0x7d, 0x3, 0x100, 0x3, 0x4, 0xfffffff8, 0x9, 0x8, 0x3, 0x4, 0x6, 0x6, 0x8001, 0x2, 0x5, 0xfffffc00, 0x9, 0x27a, 0x3, 0x8001, 0x7, 0x0, 0x6, 0x3, 0x9, 0x6, 0x7, 0x1, 0x40, 0xb9, 0x8, 0x454c, 0x7, 0x290, 0x0, 0x4, 0x0, 0x800, 0x0, 0x80000000, 0x100, 0x400, 0x3, 0xffff, 0xc96, 0x7]}]}}, @c_atm={{0x8}, {0x38, 0x2, [@TCA_ATM_FD={0x8, 0x1, r4}, @TCA_ATM_EXCESS={0x8, 0x4, {0xb, 0x7}}, @TCA_ATM_EXCESS={0x8, 0x4, {0xffe0, 0xffe0}}, @TCA_ATM_FD={0x8, 0x1, r5}, @TCA_ATM_HDR={0x13, 0x3, "8783c954bc1d293c85ad87174a94ce"}]}}, @c_dsmark={{0xb}, {0xc, 0x2, @TCA_DSMARK_VALUE={0x5, 0x5, 0x45}}}]}, 0x8d4}, 0x1, 0x0, 0x0, 0x85}, 0x4080) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = socket$inet_smc(0x2b, 0x1, 0x0) r9 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0xd4bb, 0x0, 0xfffffffd}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x0, r8, 0x0, 0x0, 0x0, 0x80800}) io_uring_enter(r9, 0x3517, 0xc2de, 0x9, 0x0, 0x0) 7m51.469929295s ago: executing program 4 (id=415): syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = io_uring_setup(0x4c0d, &(0x7f00000003c0)={0x0, 0x8d60, 0x1000, 0xffffffff, 0x221}) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, 0x0}, 0x94) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0xfffffffd, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{}, {}]}, [{}, {}, {}, {}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x20000000, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x10}, {}, {0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x9}, {}, {}, {}, {}, {0x5}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, {0x0, 0x0, 0x3}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000400)=@filter={'filter\x00', 0x42, 0x4, 0x350, 0xffffffff, 0xf8, 0x1b0, 0xf8, 0xffffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x2, 0x2, 0x0, 0xc}}, @common=@unspec=@connmark={{0x30}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x90, 0xb8, 0x0, {}, [@common=@socket0={{0x20}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @multicast2, 0xffffff00, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xe0, 0x108, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x9, 0x2}}, @common=@socket0={{0x20}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0xb}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3b0) (async) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f0000000100)=ANY=[], 0x8) (async) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) (async) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22, 0x0, @rand_addr, 0x99f}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000340)={0x2, 0x4e23, 0x0, @private2}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000080)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac7108bfaffffffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) (async) socket$packet(0x11, 0x2, 0x300) (async) socket(0x2, 0x80805, 0x0) (async) socket$inet(0x2b, 0x801, 0x0) syz_open_dev$usbmon(&(0x7f0000000200), 0x34, 0x880) (async) socket$key(0xf, 0x3, 0x2) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, 0x0, 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x27) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 7m36.251161556s ago: executing program 33 (id=415): syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r0, 0x0, 0x0) r1 = io_uring_setup(0x4c0d, &(0x7f00000003c0)={0x0, 0x8d60, 0x1000, 0xffffffff, 0x221}) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, 0x0}, 0x94) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0xfffffffd, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{}, {}]}, [{}, {}, {}, {}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x20000000, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x10}, {}, {0x0, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x9}, {}, {}, {}, {}, {0x5}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, {0x0, 0x0, 0x3}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x7}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x5) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000400)=@filter={'filter\x00', 0x42, 0x4, 0x350, 0xffffffff, 0xf8, 0x1b0, 0xf8, 0xffffffff, 0xffffffff, 0x2b8, 0x2b8, 0x2b8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x100000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x2, 0x2, 0x0, 0xc}}, @common=@unspec=@connmark={{0x30}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x90, 0xb8, 0x0, {}, [@common=@socket0={{0x20}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @multicast2, 0xffffff00, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0xe0, 0x108, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x9, 0x2}}, @common=@socket0={{0x20}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0xb}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3b0) (async) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f0000000100)=ANY=[], 0x8) (async) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) (async) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0xe22, 0x0, @rand_addr, 0x99f}, 0x1c) (async) connect$inet6(r3, &(0x7f0000000340)={0x2, 0x4e23, 0x0, @private2}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000080)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac7108bfaffffffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) (async) socket$packet(0x11, 0x2, 0x300) (async) socket(0x2, 0x80805, 0x0) (async) socket$inet(0x2b, 0x801, 0x0) syz_open_dev$usbmon(&(0x7f0000000200), 0x34, 0x880) (async) socket$key(0xf, 0x3, 0x2) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, 0x0, 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x27) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 7m24.17976645s ago: executing program 3 (id=490): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x2e, &(0x7f00000000c0)=ANY=[@ANYRES64, @ANYRESDEC=0x0, @ANYBLOB="0000000000000000b702000014000000b703"], 0x0}, 0x94) r0 = socket$kcm(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0xa1) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803001d000b0ad25a80648c2594f90124fc60100c050000040009053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1, 0x0, 0x0, 0x4000}, 0x3500000000000000) 7m23.802314753s ago: executing program 3 (id=491): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x2, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) recvfrom$l2tp6(r2, 0x0, 0x0, 0x10100, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x24, &(0x7f0000000e00)={{0x12, 0x1, 0x310, 0x1b, 0xf9, 0x17, 0x10, 0xd46, 0x2011, 0xe88a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0x4, 0xd0, 0x3, [{{0x9, 0x4, 0x6a, 0xa, 0x0, 0x4d, 0x78, 0x27, 0x62}}]}}]}}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0}) preadv(r3, &(0x7f0000000480)=[{&(0x7f0000000080)=""/251, 0xfb}, {&(0x7f0000000200)=""/249, 0xf7}], 0x2, 0x800, 0x0) shutdown(r2, 0x0) 7m21.870259491s ago: executing program 3 (id=498): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x1e42) syz_clone(0x1100080, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0xc000001) syz_clone(0xc0080, 0x0, 0x0, 0x0, 0x0, 0x0) 7m21.506984805s ago: executing program 3 (id=501): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TCSETSF(r1, 0x560b, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d30303030303030da7d6e32303830303030303030303034303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, 0x0, 0x0) syz_open_dev$sg(0x0, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r7, 0x1, 0x0, 0x0, {{}, {}, {0x14, 0x19, {0x8, 0x1, 0x1}}}}, 0x30}}, 0x20000000) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000300)='.\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file0\x00', 0x252) 7m20.446534455s ago: executing program 3 (id=506): socket$netlink(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000080000000000000010000009400000007ad4160850000000f00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80002, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000140)={'batadv0\x00', 0x2}) r2 = syz_open_dev$vcsn(&(0x7f00000001c0), 0x3, 0x402881) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f00000002c0)=0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='netlink_extack\x00', r0}, 0x10) r3 = socket(0x10, 0x3, 0x0) sendto$inet6(r3, &(0x7f00000022c0)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f0000000a0000000d0085a168d0bf46d32345653600648d040005000209000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000402160005000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0xa8202, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c6f563c4af1000000120a01020000000000000000020000000900020073797a3100000000080004400000000009000100737900"/87], 0x64}, 0x1, 0x0, 0x0, 0x24004081}, 0x0) sendmsg$NFT_MSG_GETOBJ(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000000000000000000002000000"], 0x14}}, 0x4040040) close_range(r4, 0xffffffffffffffff, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'tunl0\x00'}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000002ec0)='./binderfs/binder-control\x00', 0x2, 0x0) ioctl$BINDER_CTL_ADD(r8, 0xc1086201, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000000a05000000000000000000010000000900010073797a30000000000c000440000000000000000340000000160a01000000000000000000010000000900010073797a30000000000900020073797a300000000014000380080001400000000008000240000000003c010000160a0101000b000000000000010000060900020073797a30000000000900010073797a3000000000040003800c010380080002"], 0x1d0}}, 0x663fc53a6c6d1cee) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=@gettfilter={0x5c, 0x2e, 0x105, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x7, 0xe}, {0x6, 0x10}, {0xffe0, 0x2}}, [{0x8, 0xb, 0x8000}, {0x8, 0xb, 0x8}, {0x8, 0xb, 0x4}, {0x8, 0xb, 0x2}, {0xffffffffffffff43, 0xb, 0x6}, {0x8, 0xb, 0x3}, {0x8, 0xb, 0x5}]}, 0x5c}}, 0x4000010) r9 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r10 = fsopen(&(0x7f0000000000)='sockfs\x00', 0x0) fcntl$lock(r10, 0x5, &(0x7f0000000040)={0x1, 0x1, 0x6, 0xffffffffffffffff}) r11 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r11, &(0x7f0000000040)="aa", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r11, 0x84, 0x7c, &(0x7f0000000380), 0x8) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) socket(0x10, 0x803, 0x0) 7m19.427259171s ago: executing program 3 (id=510): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x301402, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000040)=0x10000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x48e80, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB='\x000\f'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000d00)={0x44, &(0x7f0000002680)=ANY=[@ANYBLOB="201628000000cc5914df6188838c2d1b706ac260e9476090883a8437c96696a485c49d9cc6685c4d16655c1eea7a649ab0810d29bd93fc943661a6521956b25e47a0ce8d6a6d51ac365d351838c8d655973c986b2e63ab9eaaea3e5fe4ffc66d65717ac744782d5fba05a69baa1f37c812b8a6a4647626b3d33b2f3ac7c3cef743a59fe6fe4e4b914067f58af01c1fdf2872e288f8d387b722e57fd5145dc353a1616c5e32d1df703af4ca573fc7cd6586ccb5b6cebbc88262bccbbcabdc6b07388d780b8881329eea358a7e4dbb5c5b92520f7ad4e1f0ed6b9855b77fb5cf8387d148ff4377c31eaceef91a8d2adac979359f4844956e684a3fbda2f599c14d33510adfa39e5114"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'/10], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x200) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f0000000000)=0x3) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000000c0)={0x1d, r6}, 0x18) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, r6}, 0x18) sendmmsg$inet(r5, &(0x7f0000004980)=[{{0x0, 0x0, &(0x7f0000002940)=[{&(0x7f0000002640)="ef0ba606342672dabc", 0x9}], 0x1}}], 0x1, 0x20000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4804) recvmmsg(r5, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)=""/189}, {&(0x7f00000002c0)=""/182}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/198}, {&(0x7f0000001480)=""/169}, {&(0x7f0000001540)=""/4096}], 0x10, &(0x7f0000002540)=""/216}}], 0x2, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f00000003c0)={0x0, 0x0, @ioapic={0x0, 0x258c7e36, 0x3, 0x1, 0x0, [{0xc, 0x5, 0xac, '\x00', 0x81}, {0x93, 0x80, 0x9, '\x00', 0x9}, {0x4, 0x6, 0x95, '\x00', 0xe}, {0x80, 0x2, 0xe0, '\x00', 0xc}, {0xa, 0x3, 0xb, '\x00', 0x93}, {0x0, 0x4, 0x9, '\x00', 0x4}, {0x5, 0x5, 0x7e, '\x00', 0x9}, {0xa, 0x0, 0x5, '\x00', 0xde}, {0x0, 0x81, 0x4, '\x00', 0x7}, {0x60, 0x3, 0x5, '\x00', 0xd1}, {0x7, 0x54, 0x3, '\x00', 0x7}, {0x2, 0x8e, 0x7, '\x00', 0x5}, {0x4, 0x8, 0x1, '\x00', 0xb}, {0xe, 0x4, 0x26, '\x00', 0xf}, {0x4a, 0x4, 0x18, '\x00', 0x5}, {0xa, 0xff, 0x6, '\x00', 0x2}, {0x6, 0x6, 0x8, '\x00', 0x9}, {0x3, 0x1, 0x3, '\x00', 0x19}, {0x0, 0x5, 0x10, '\x00', 0x7}, {0x6, 0x0, 0xf9, '\x00', 0x9}, {0x5, 0x9, 0x79, '\x00', 0x2}, {0x8, 0x7f, 0x7, '\x00', 0x6}, {0xff, 0x1f, 0xde, '\x00', 0x89}, {0x1, 0x7, 0x0, '\x00', 0xc}]}}) r7 = dup2(r0, r0) read$FUSE(r7, &(0x7f0000000640)={0x2020}, 0x2020) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r8, &(0x7f0000000080)='syz1\x00', 0x1ff) ioctl$SNDCTL_DSP_GETOSPACE(r7, 0x8010500c, &(0x7f0000000080)) unshare(0x22020400) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) 7m18.749453484s ago: executing program 34 (id=510): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x301402, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000040)=0x10000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x48e80, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0xf2, 0xc5, 0x96, 0x20, 0x16d0, 0x10b8, 0xde8e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x0, 0x83, 0xec, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB='\x000\f'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r3, 0x0, &(0x7f0000000d00)={0x44, &(0x7f0000002680)=ANY=[@ANYBLOB="201628000000cc5914df6188838c2d1b706ac260e9476090883a8437c96696a485c49d9cc6685c4d16655c1eea7a649ab0810d29bd93fc943661a6521956b25e47a0ce8d6a6d51ac365d351838c8d655973c986b2e63ab9eaaea3e5fe4ffc66d65717ac744782d5fba05a69baa1f37c812b8a6a4647626b3d33b2f3ac7c3cef743a59fe6fe4e4b914067f58af01c1fdf2872e288f8d387b722e57fd5145dc353a1616c5e32d1df703af4ca573fc7cd6586ccb5b6cebbc88262bccbbcabdc6b07388d780b8881329eea358a7e4dbb5c5b92520f7ad4e1f0ed6b9855b77fb5cf8387d148ff4377c31eaceef91a8d2adac979359f4844956e684a3fbda2f599c14d33510adfa39e5114"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'/10], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x200) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f0000000000)=0x3) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r5 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000000c0)={0x1d, r6}, 0x18) connect$can_j1939(r5, &(0x7f0000000140)={0x1d, r6}, 0x18) sendmmsg$inet(r5, &(0x7f0000004980)=[{{0x0, 0x0, &(0x7f0000002940)=[{&(0x7f0000002640)="ef0ba606342672dabc", 0x9}], 0x1}}], 0x1, 0x20000010) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4804) recvmmsg(r5, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000200)=""/189}, {&(0x7f00000002c0)=""/182}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/198}, {&(0x7f0000001480)=""/169}, {&(0x7f0000001540)=""/4096}], 0x10, &(0x7f0000002540)=""/216}}], 0x2, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f00000003c0)={0x0, 0x0, @ioapic={0x0, 0x258c7e36, 0x3, 0x1, 0x0, [{0xc, 0x5, 0xac, '\x00', 0x81}, {0x93, 0x80, 0x9, '\x00', 0x9}, {0x4, 0x6, 0x95, '\x00', 0xe}, {0x80, 0x2, 0xe0, '\x00', 0xc}, {0xa, 0x3, 0xb, '\x00', 0x93}, {0x0, 0x4, 0x9, '\x00', 0x4}, {0x5, 0x5, 0x7e, '\x00', 0x9}, {0xa, 0x0, 0x5, '\x00', 0xde}, {0x0, 0x81, 0x4, '\x00', 0x7}, {0x60, 0x3, 0x5, '\x00', 0xd1}, {0x7, 0x54, 0x3, '\x00', 0x7}, {0x2, 0x8e, 0x7, '\x00', 0x5}, {0x4, 0x8, 0x1, '\x00', 0xb}, {0xe, 0x4, 0x26, '\x00', 0xf}, {0x4a, 0x4, 0x18, '\x00', 0x5}, {0xa, 0xff, 0x6, '\x00', 0x2}, {0x6, 0x6, 0x8, '\x00', 0x9}, {0x3, 0x1, 0x3, '\x00', 0x19}, {0x0, 0x5, 0x10, '\x00', 0x7}, {0x6, 0x0, 0xf9, '\x00', 0x9}, {0x5, 0x9, 0x79, '\x00', 0x2}, {0x8, 0x7f, 0x7, '\x00', 0x6}, {0xff, 0x1f, 0xde, '\x00', 0x89}, {0x1, 0x7, 0x0, '\x00', 0xc}]}}) r7 = dup2(r0, r0) read$FUSE(r7, &(0x7f0000000640)={0x2020}, 0x2020) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r8, &(0x7f0000000080)='syz1\x00', 0x1ff) ioctl$SNDCTL_DSP_GETOSPACE(r7, 0x8010500c, &(0x7f0000000080)) unshare(0x22020400) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) 11.776278731s ago: executing program 5 (id=2062): syz_usb_connect(0x6, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904"], 0x0) r0 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) r1 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) execveat$binfmt(0xffffffffffffff9c, r1, 0x0, &(0x7f00000003c0)={[], 0xf000}, 0x1000) openat$binfmt(0xffffffffffffff9c, r1, 0x41, 0x1ff) write$binfmt_script(r0, &(0x7f0000000000)={'#! ', './file0', [{0x20, '\b&\xe7%{'}, {0x20, ']\'.'}, {0x20, '\''}, {0x20, '.\xad_/'}, {}, {0x20, '@'}, {}, {0x20, '&'}], 0xa, "6a18f51209ffec7f719ab707abfa42ec01cbdec54bd3cfcfb5ada18085ab1afcf4754587d4e0b19a4890fb028d80acbb94c624c3eca42ec7b6f89dc1bbe18ae4ee7d1a7c16b5e596fd603b88d6c59c80c2c6c8c98fdea3b3fbed6ec30f7ae63acce6ed4321c99404beceadda3715ab5621c11f0fca60f9fc"}, 0x9a) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r5, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff2417d079bb892435a1e107fa5c0ecd207d9e6f2a209bf148e6bc56955cb53347d1499097488fcad724a1"}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="0401000016000100000000000000000000000000000000000000000000000000ff01000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8800000000000000000000000000010000000033000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0015005b"], 0x104}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=ANY=[@ANYBLOB="f8000000160001000000000000000000fe880000000000000000000000000101ff01000000000000000000000000000100000400000000000000000033000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ac1414aa0000000000000000000000000000000033"], 0xf8}}, 0x0) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r7, 0x80047453, 0x0) r9 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SPEED(r9, 0xc0045002, &(0x7f0000000080)=0x4) write$dsp(r9, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) ioctl$BINDER_THREAD_EXIT(r5, 0x40046208, 0x0) 8.653061097s ago: executing program 5 (id=2077): r0 = syz_usb_connect(0x7, 0x24, &(0x7f0000001140)={{0x12, 0x1, 0x0, 0xbd, 0xf7, 0x13, 0x8, 0x2770, 0x930c, 0x8d6a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2a, 0xc5, 0x98}}]}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 8.00001124s ago: executing program 5 (id=2083): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0xa0380, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000180)={0x2, 0x0, @dev}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x20}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) r3 = socket(0x10, 0x803, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000200)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[], 0x20}}, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000080)=ANY=[], 0x1df) write$binfmt_misc(r2, &(0x7f00000005c0)="4410020f558a0be87bb7b7463dff61036ecc55e8f64334ead57ef95e616820ca0f6202", 0x23) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x406, 0x2, 0x0, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea84324037e2fe98ab480b8785d9600010000000d00000000400000000000000000004f3900", "28ce30ec8d08598948224ad54af2c11d875397bdb22d0000b420a1a93c5291ecc6f19e01177d3d458dd49928610000002000", "90be8b1c551265406c7f306003d8a0f4bd00"}}) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) 7.765228347s ago: executing program 0 (id=2087): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x46, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000080), 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x1b) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, 0xffffffffffffffff, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x600000000000000, 0x0, 0x0, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'bridge_slave_0\x00', 0x401}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x28, 0x2, 0x6, 0x401, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x880}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x74, 0x0, 0x0) eventfd2(0x9, 0x80001) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x24, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x5, @loopback}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}]}}}]}, 0x58}}, 0x0) r8 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000044082, 0x0) fallocate(r8, 0x11, 0x0, 0x7c000) getpeername$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'syztnl1\x00', 0x0, 0x781f, 0x7800, 0x7f, 0x4, {{0x14, 0x4, 0x1, 0x7, 0x50, 0x66, 0x0, 0x1, 0x2d, 0x0, @loopback, @rand_addr=0x64010100, {[@noop, @noop, @noop, @ssrr={0x89, 0xf, 0x24, [@private=0xa010100, @remote, @loopback]}, @end, @ssrr={0x89, 0x27, 0x76, [@dev={0xac, 0x14, 0x14, 0x17}, @remote, @loopback, @multicast1, @loopback, @dev={0xac, 0x14, 0x14, 0x23}, @dev={0xac, 0x14, 0x14, 0x15}, @multicast2, @private=0xa010100]}]}}}}}) sendmsg$inet6(r0, &(0x7f0000000440)={&(0x7f0000000000)={0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, '\x00', 0x23}, 0xff}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)="505ebb66fa951bce7b75ff15d0eebfbb0245", 0x12}], 0x1, &(0x7f0000000240)=[@hopopts={{0x60, 0x29, 0x36, {0x3a, 0x8, '\x00', [@calipso={0x7, 0x40, {0x0, 0xe, 0x1, 0xd, [0x8, 0xfffffffffffffffe, 0x4, 0x3, 0xfffffffffffffffa, 0x305b, 0x1]}}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, r9}}}, @hopopts_2292={{0x20, 0x29, 0x36, {0x16, 0x0, '\x00', [@pad1, @enc_lim={0x4, 0x1, 0x1}]}}}, @rthdr_2292={{0x48, 0x29, 0x39, {0x3c, 0x6, 0x1, 0x3, 0x0, [@private1={0xfc, 0x1, '\x00', 0x1}, @loopback, @dev={0xfe, 0x80, '\x00', 0x3f}]}}}, @rthdr_2292={{0x28, 0x29, 0x39, {0xf0, 0x2, 0x2, 0x7, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}]}}}, @dstopts_2292={{0x30, 0x29, 0x4, {0x1, 0x2, '\x00', [@hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}}}, @tclass={{0x14, 0x29, 0x43, 0x7}}, @pktinfo={{0x24, 0x29, 0x32, {@private0={0xfc, 0x0, '\x00', 0x1}, r10}}}, @hoplimit={{0x14, 0x29, 0x34, 0x6}}, @hopopts={{0x30, 0x29, 0x36, {0x73, 0x2, '\x00', [@pad1, @padn, @calipso={0x7, 0x10, {0x3, 0x2, 0x0, 0x1, [0xf]}}]}}}], 0x1d0}, 0x0) 7.372392764s ago: executing program 1 (id=2089): mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) (async) mremap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x20, 0x13, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000044}, 0x90) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) r3 = socket(0x10, 0x3, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000003c0)=@IORING_OP_SEND={0x1a, 0x20, 0x0, r3, 0x0, 0x0, 0xfffffd49, 0x20044080, 0x1}) io_uring_enter(0xffffffffffffffff, 0x27e2, 0x0, 0x0, 0x0, 0x0) openat$udambuf(0xffffff9c, &(0x7f0000000000), 0x2) (async) openat$udambuf(0xffffff9c, &(0x7f0000000000), 0x2) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x3, 0x0, 0xb49, 0x40000007, 0x8, 0xfffffffa, 0x3}, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) (async) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r4, 0xc0a85320, &(0x7f0000000180)={{0x80, 0x80}, 'port0\x00', 0x20, 0x161041, 0x40, 0x6, 0x0, 0x0, 0x5, 0x0, 0x0, 0x9}) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r4, 0xc0a85320, &(0x7f0000000180)={{0x80, 0x80}, 'port0\x00', 0x20, 0x161041, 0x40, 0x6, 0x0, 0x0, 0x5, 0x0, 0x0, 0x9}) r5 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r5, 0xc0a85352, &(0x7f0000000200)={{0x80}, 'port1\x00', 0x89, 0x0, 0x4, 0xfffffeff, 0x0, 0x0, 0x200000, 0x0, 0x4875c99660ff2b28}) (async) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r5, 0xc0a85352, &(0x7f0000000200)={{0x80}, 'port1\x00', 0x89, 0x0, 0x4, 0xfffffeff, 0x0, 0x0, 0x200000, 0x0, 0x4875c99660ff2b28}) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) (async) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x3fe3aa0262d8c583, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xf}, {0xffff, 0xffff}, {0x6, 0xa}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0x0, 0x0, 0x6}, 0x2000408d) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETPLANE(r6, 0xc03064b7, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') (async) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/arp\x00') preadv(r10, &(0x7f0000000080)=[{&(0x7f0000000b40)=""/119, 0x50}, {&(0x7f0000000bc0)=""/95, 0x5f}], 0x2, 0x4000ffe, 0x0) 7.006301365s ago: executing program 5 (id=2090): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3000000076000d0b00000008000000000300000000000000080001000100000008"], 0x30}}, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x1, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$mixer(0xffffff9c, &(0x7f00000001c0), 0x80002, 0x0) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$SOUND_MIXER_WRITE_VOLUME(r3, 0xc0044d03, &(0x7f0000000180)=0x3f) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={0x0, 0x184}, 0x1, 0x0, 0x0, 0x40043}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r5, 0x5393, &(0x7f0000000000)) 5.554768704s ago: executing program 5 (id=2092): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000980)={0x16, 0x98, 0xfa00, {0x0, 0x2, 0xffffffffffffffff, 0x30, 0x0, @in={0x2, 0x4e20, @loopback}}}, 0xa3) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x1c, &(0x7f00000004c0)=ANY=[@ANYBLOB="180c000000000000000000000000000018110000c66435ca5f3ef7b1c46c7b3114da683d398b0132679d816c9bd82bf2964b2559ac56a296f4098e1db52ec472f35e5ec7758336adf1f60b1d07a46ed1cf878f467d", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007b9a00fe00000000b6090800000000007b9af0ff00000000bf8610000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32, @ANYBLOB="0000000000000000b7050000080000001500000076000000bf9800000000000056080000000000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2c, '\x00', 0x0, @cgroup_skb=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r2 = openat$sysfs(0xffffff9c, &(0x7f0000000080)='/sys/power/pm_test', 0x0, 0x0) syz_clone3(&(0x7f00000000c0)={0x385200080, 0x0, 0x0, 0x0, {0x33}, 0x0, 0x20, 0x0, 0x0, 0x0, {r2}}, 0x58) r3 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100000ede84205a63bb08090047a30102f50802770001e9c086050000000904eb00007916ec00"], 0x0) syz_usb_control_io$printer(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="f94f1c000000"], 0x0, 0x0, 0x0, 0x0}) connect$inet(r1, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$inet_buf(r1, 0x0, 0x4, &(0x7f0000000000)="9b5211dc97917db13281a2ec297031dde3a099609719a10836b97f47d7d5823284f760e767f9faa3f5", 0x29) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x8, 0x8031, 0xffffffffffffffff, 0xee04c000) syz_usb_control_io$cdc_ecm(r3, &(0x7f0000000200)={0x14, &(0x7f0000000180)=ANY=[@ANYBLOB="4020140000001423f7cbdf51932c3892f56d7ca2d0c210fffee3"], &(0x7f00000001c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000380)={0x1c, &(0x7f0000000240)={0x20, 0x1, 0xe, "5daa923fb52e9d8c77db72511c88"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x81}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x2}}) syz_usb_connect(0x5, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="120110019bde521023398a71d7d80102030109022400010509401909047b07022d51d5980905eb0220000202050905e6"], 0x0) 5.242278907s ago: executing program 1 (id=2093): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x50, 0x10, 0x401, 0x70bd2d, 0x3, {0x0, 0x0, 0x0, 0x0, 0x38b2b, 0x8100}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x16}]}, 0x50}, 0x1, 0x0, 0x0, 0x24004000}, 0x0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000340)='/sys/kernel/config', 0x0, 0x0) lseek(r1, 0x7fb, 0x1) r2 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000180)={0x802, 0x8, 0x12}, 0x18) move_mount(r1, &(0x7f00000000c0)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x22a) 5.094161277s ago: executing program 1 (id=2094): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@hyper}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r1, 0x1, 0x4d, 0xffffffffffffffff, &(0x7f0000000540)) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) (async) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) (async) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@hyper}) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a00)) (async) getsockopt$sock_buf(r1, 0x1, 0x4d, 0xffffffffffffffff, &(0x7f0000000540)) (async) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, 0x0) (async) 4.986961555s ago: executing program 6 (id=2096): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', &(0x7f0000000880)={'syztnl2\x00', 0x0, 0x0, 0x7c, 0x8, 0x80000401, 0x7b, @ipv4={'\x00', '\xff\xff', @loopback}, @loopback={0xfec0ffff00000000, 0xffff8881114a4aa8}, 0x7, 0x0, 0x300, 0x8}}) 4.694071118s ago: executing program 6 (id=2097): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_to_team\x00'}) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c}}]}, 0x78}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000012c0)=@newtfilter={0x6c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {}, {0xd}}, [@filter_kind_options=@f_bpf={{0x8}, {0x40, 0x2, [@TCA_BPF_ACT={0x34, 0x1, [@m_police={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}, @TCA_BPF_FD={0x8, 0x6, r3}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x400c040}, 0x0) (async) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0x9, @private0, 0x8}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x7a, &(0x7f0000000340)={r8, @in6={{0xa, 0x3, 0xfffffffd, @dev={0xfe, 0x80, '\x00', 0x38}}}}, &(0x7f0000000040)=0x84) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) (async) getpid() sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a5fdad8800000000140012800b00010067656e65766500000400028008000400e1ff00009bbd1f239dcd391f44ff5bf4b9bf1f4e462be91f7e5367bf5cfd36690c971475a305aa88f0690f8fca4a62bcafdce7882250695a5eada1af72cf65fb525bf29c6aa8e70f349e469be482b73a71191b24504ebb9893be3479b1e6369db624b9302555467265b0ecffa5b9cefbc11b8b9db547f33d5f68e9e25c6680"], 0x3c}}, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4019b93f5fe108c8bee1f903000000000034140029ca6f389eed3c5f0520d20000a3ba77b36f857269ba6e712d1fe216", @ANYRES16=r1, @ANYBLOB="200029bd7000fbdbdf254200000008000300", @ANYRES32=r9, @ANYBLOB="0a0006008f1602bdcae900000a00060008021100000000000a000600d1b1c6906e990000"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x8080) (async, rerun: 64) sendmsg$nl_route_sched(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000001a40)=@newqdisc={0x50, 0x24, 0xd0f, 0x3, 0x3, {0x60, 0x0, 0x0, 0x0, {0x0, 0x2}, {0xffff, 0xffff}, {0x4}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xf0, 0xa, 0x0, 0x5, 0x0, 0x9, 0x10000}}, {0x4}}]}, @qdisc_kind_options=@q_drr={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x40001d4}, 0x8840) (rerun: 64) 4.675370077s ago: executing program 1 (id=2098): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x24004044}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x5, 0xffff}}}, 0x24}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="3c00000011000100000000000000000007000000", @ANYRES32=r2], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (fail_nth: 17) 4.592289136s ago: executing program 0 (id=2099): syz_usb_connect(0x2, 0x41, &(0x7f0000000200)=ANY=[@ANYBLOB="ce010000d1253c40d11256eddd460102030109022f0001000000000904cf0000ff013700052482730105240057c90d240f010e00000007"], 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7020000020000008500000086"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000002c80)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="300000001c000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="40003a000a000200ffffffffffff000008000f"], 0x30}}, 0x0) (async) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f0000000000)={0x3, 0x9, 0x81, 0x880}) 4.087297785s ago: executing program 6 (id=2100): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0xa0380, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000f00)={&(0x7f0000000180)={0x2, 0x0, @dev}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x20}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) r3 = socket(0x10, 0x803, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000200)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[], 0x20}}, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000080)=ANY=[], 0x1df) write$binfmt_misc(r2, &(0x7f00000005c0)="4410020f558a0be87bb7b7463dff61036ecc55e8f64334ead57ef95e616820ca0f6202", 0x23) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x604, 0x2, 0x0, 0x0, 0x0, 0x2, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea84324037e2fe98ab480b8785d9600010000000d00000000400000000000000000004f3900", "28ce30ec8d08598948224ad54af2c11d875397bdb22d0000b420a1a93c5291ecc6f19e01177d3d458dd49928610000002000", "90be8b1c551265406c7f306003d8a0f4bd00"}}) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) 4.021836463s ago: executing program 1 (id=2102): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200), 0x197302, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x80000000000b49, 0x8, 0x1000000000008, 0x0, 0x80000003}, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='freezer.self_freezing\x00', 0x0, 0x0) fcntl$getown(r1, 0x9) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r2, 0xc0189379, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$PPPIOCSPASS(r5, 0x40107447, &(0x7f0000000340)={0x6, &(0x7f0000000300)=[{0x97f, 0x4, 0x0, 0xf72}, {0x81, 0x2, 0x62}, {0x29, 0x7, 0x2, 0x4}, {0x9, 0x39, 0x4f, 0xfffffffc}, {0x1f7, 0x4, 0xf9, 0x1000000}, {0x2, 0xf3, 0x42, 0x2}]}) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, @log={{0x8}, @void}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x40010}, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x20, 0x0, 0x88, {0x0, 0x201cb605ce81a557}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f00000004c0)='V', 0x1}, {&(0x7f0000000180)="fc", 0x1}], 0x20) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x8910, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x6) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x290, 0x0, 0xb, 0xd0e0011, 0x120, 0xc6, 0x1f8, 0x1d8, 0x190, 0x1f8, 0x1d8, 0x3, 0x0, {[{{@ip={@rand_addr, @broadcast, 0x0, 0x0, 'nr0\x00', '\x00', {}, {}, 0x1}, 0x0, 0xd8, 0x120, 0x2000000, {}, [@common=@icmp={{0x28}, {0x0, "0010"}}, @common=@unspec=@connlimit={{0x40}}]}, @unspec=@CT0={0x48}}, {{@ip={@remote, @multicast1, 0x0, 0x0, 'bridge_slave_1\x00', 'virt_wifi0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x20000, 'syz1\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f0) 3.531801734s ago: executing program 6 (id=2103): pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff}, 0x80) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) sendfile(r1, r0, 0x0, 0x4) pipe2$9p(&(0x7f0000000200), 0x80) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) (async) sendfile(r1, r0, 0x0, 0x4) (async) 3.316700832s ago: executing program 6 (id=2104): socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ftruncate(0xffffffffffffffff, 0x8000000000000000) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000d00)={{0x12, 0x1, 0x110, 0x4c, 0x68, 0x59, 0x8, 0xbda, 0x129, 0xbe93, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa, 0x91, 0x80, 0xc2, [{{0x9, 0x4, 0xc1, 0x0, 0x0, 0x55, 0x39, 0x49, 0xa}}]}}]}}, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = syz_io_uring_setup(0x3e33, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x7, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r1, 0x4, 0x0}) io_uring_enter(r2, 0x3516, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = dup(r5) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000080)=0x7fff) recvmmsg(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x40030002, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x8801) ioctl$TCSETSF(r6, 0x5404, &(0x7f0000000000)={0x0, 0xfffffffb, 0x0, 0x515f3157, 0x4, "78e1141009f593233bce41f20613341f43d01f"}) write$UHID_INPUT(r6, &(0x7f0000001040)={0xd, {"a2e3ad21ed6b0af99cfbf4c007f70eb4d04fe7ff7fc6e5539b0872fc8b546a1b4d09940f08900c878f0e1ac6e7049b4cb4956c409b3c2a0867f3988f7ef319520100ffe8d178708c523c921b1b0f5a0a169b50d336cd3b78130daa61d8f809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae193973735b36d5b1b63e91c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca5b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b4124351601611c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1388dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44060bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca4051c2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb77ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e05130935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463181f4b87c10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fad6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b3110b932a4d02da711b757fe43c06d21e35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc238a081ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed714887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee658e4cb5e930ed624806c43a006dc9336d07c2b8081c128ad2706f48261f7897084c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264d2700c838fa2c7b34252600c9654e502dcea39cb6bc3eb69992e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa70826ad01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1010}}, 0x1b7) read$FUSE(r6, &(0x7f0000002080)={0x2020}, 0x2020) syz_usb_ep_write(r0, 0x8, 0x0, &(0x7f00000000c0)) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) preadv(0xffffffffffffffff, &(0x7f00000002c0), 0x0, 0x0, 0x0) 2.665994414s ago: executing program 7 (id=2105): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$yama_ptrace_scope(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)={0x20, r3, 0x301, 0x70bd28, 0x25dfdb7e, {0x1c}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x10) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000240)={0x0, 0x4, 0x0, 0x0, 0x0, 0x5001}) r5 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x1, 0x40000333}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, &(0x7f0000000000)=0x3) r9 = syz_io_uring_setup(0x1e1e, &(0x7f0000000280)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r10, r11, &(0x7f0000000180)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r9, 0x48e9, 0x0, 0x2, 0x0, 0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000040)=[{0x0}], 0x1}) io_uring_enter(r5, 0x847ba, 0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r1, &(0x7f0000003a40)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r12, &(0x7f000000c280)="897c6500ff3035465c7acb4e06980b05687c1480c7aafe631c0543db2bf0d6f539506e8782da06c1ca018774d72e9e5a3418ab66ee78dad68457b17ec9d47bf7d8272d607c1c0a4bd906f0cee7f8451828d2458596bdd6a459ba18ebaf61b38f5d66c27fa8a024ad7832a85e58689a4c254c94cbcf7208fce6e61d9566459789d15a6f91dd7db7c54cc3a94da956fb290a8a15f849270bc459d9d9f47801be86dd5c9d18382081a993b7bfde5c28adca4c71329afd6be743b076033b5859891703eb65fa256d6f47450b6edacbd05a9bd8b372e90cfc30f32826566dac6c48e6ef001881cbc30482f9ec469e476a101da496b8c0785eaf875d3608b0c49e9d39baaa1041f903a805f0f24aa63722fa2d87b98595fa5cfaf8b79c458de43ee39904e7cac7540a934b4108957785d58807abff186949f1b94cd21b724aff34ac45c7066dcdbd68ea7b766af9d045cd7fafeafc5c5a0c3400ef4e0c71a6fdd5b8d68a6f317644cda9d2fd2c839a82b97b3d909b54c672227bef573c9de1991d65a63017f724d1f7f1575e69db53318a7fd7065b303e751518c8eef04f642dbd4dfa349040a7b5401050ffc2b4ef62803a7c8eaba99e011dfac24d81b2b61e0b0581e53bf520f623eca17f0545c5e59ff15b527475f970f589894ae589145fa4283f7225088ccfeba1d72e9128f8c223ae1840f2edae3dbcdf7e560d5cdf4f71c9ada1931c0f8312c000101b264aaddb9fab166ba8d8903d6098eca20935ca607ea79e936798b3dfb22a7e159abb234cf21f3733dbf263a8ff116092f251659108892b2e21e1b428fd225096a5040270b2d70347013eaa1fd8e452942200283aab092c4ffc5b8b427b5d691a5a773e09da20539ff0f8214331c5d84107ae8a59aeb58efe22d7a079e446f1dfb07510377799bfdc7ee59cabcd76af0fe8a427ac8258ff33bbad5a8061f1cfdfbf375d73d676cc7916d6658ce46a0b17ad6350150f98e3512b513e25ca73f5f5df0a1fb9582ace7906c493fe1fd2889d9aac0b7c29c2b6c205537627bad64df433336a5ace32ca871e51b4dab0fbb00886a1fa81a98b74de0a26cebf65723515ebb807fc3c161ed42d1a7b6b55717613577ea437f3a2967c66ce45ff85a6a35b7cd40625fc575b107d7394e3d2db51d58347276c33e21f50b5a6b5672bf9fda63139bb75aead1fe4ee9a4064af5a5958466aa39faa6d821489fa415224c8d69d3b5922236832c2b1e4f6b8863b32f9aea83fb522a2de081d674502b48f73ce6db98d84136059b4a6676bc85ac6b7626329afa9bc7d3f9f2caa3c4d872744e0a8e02d72a75c6c545b8ec8e15b6fb0fe4185bd0d154960e6fef05ba40e5fe2968eb1301dcc52a03337179e74ba1522af93d77827845f8941c69ed8bb84567e3c63f1cc378a542f1de7007b688ff0a9c69d5861f0b85402c30a2fd391c52bafbe65f8e82135fd38361d7c0b43c982b2f3e7cb09c40c7e215114f4243d670cd576bcd93c1e959345170c75d6c3cf89cf8c2c70dc792e646e7c649d4c5f36bb016c7acd466ad58473d40dfef36394e581065a8581ab852250403cf372ac0065bf757fa3f445424ac0d82aec1938a2ea116bdfd306baa1cb06c62a4a97d66ab1b9489469cb8ba842da12e310caed02c5ef05c0be1e1e8c9c8b87d6871c94c57d164d08672b205c948086a06a545b266b7ad902a908681eb188bc51b6190b5cb9d8ca59b8c4c6e7369c00d6f6119fd5d437239e3d3c89cb81e09e560fb817590106015f08e7b09f1e1e65bfab3b8489fa058e24081978b9e25463d9945bfbca81c08885d4b6d4c62e217bd9e19460762f36c66bc948fe31cde089626fbb310e3c78a8d3f2eac21d374d9b58d887235d3a95721168e4b9475849071d60ecfe7ea5d6c4bf60da3747612ef59bb651270f326c0af31bc8c71361f851de34ccb3c8071b96f1128d7ee79b41246e566edd0272dbd3ccfe472b38e5e03d3ef83218bd498e6de8b4d92cb6f82716449ede7ba845028eccdb9137be8a622ac88ac53118fbc39637fa7a93cd3abc6f7671c7804420d66e94720acbcac916950f9baca77fef4217155ccc2cd0507339a0486f9f468eb28772986ee768c63eba671bf8c52e48a2a5dc2cc24fe925368706c2d712dd1064692b0fb2a32ddfbd4a0ffcf9c2abcedaae6e527bc1d42637aff2a275b76a7a7f010e42e1cc1d27141f6c3585a2bf58c6c5789ce61551d10118a000e3764631ec0b7f4b1a6f22a678133a30940b79dc76f863dd9f6e0d7776300898c97cef286c731c2050928c492439256e481652bff0d202db3cfdc54c9816ceea7895357bfa0362fad79afd09ed55189294d6ead7e898ac091cddbe7efcedb314bc02a18dd5bbddc42e089124758bb491fd1536aab27c5c124567bc325e7028bced5a179a011d1cb9a5ffb61d7af863e91ec8e60495561188b74d158ba1418228d44e92915a22eb1c166ef7d6179e84381ed950ffd747f13e24172942d922ca3109fb8b1e4e6264fa4a4eec75ad0d0e22579d90f45d6cd157300e38ae665eb56457202e25a8dd5877ba99725de288660badd2704345d9bad208c903ba27ea167dd45a77f77b6502b525b2973270582858183c784c324c1366fbba8d410c38bf75b41e067f6a9a017c56595161db4fc5639393fdafb1f148d3f416c1adc5fe1ab9cebe4689855c9b4bda6dcba5d5fa858a1b87d2ad23cdf54dbdf4d14aa4462da0b6f1107f4afa0091c2643508861a4d9f133ba77751941bb8fb756abf1a104205b80d47a3b4a59724d959c8b5833da4f56fb6613231f230a9378c9af741e94fd2c7213ac1d7625559b3f032f6c8df3ab441929720fe43d7c548cc661eed5b3c62b3c61f538ea3228376e2a18c6da2ad906322f64fb4865cde8e1889a8e5237fd6a39bbd6662f1dedc22fbd74e4376fa610cd710703dbd3924a38beae69783d1d5abf36122cbb87129ba719042748f060f4303a3199c5891c5040fd8cdb9761b006bf64cdcb65e5cc50a29994b8c1c34b83760ece12ed9ed7c3d2a7f8911cdf23a1afe0d7db1bf342aa0123dd5cd31339f5c8e160c4efef882602b3eccbe76fb690162b8bfb8a31910bcdf9a4a5dde76c2ac2fcd8678add7a000cfdcab398eb2171c026313eb6eb56b4b87bf8ef93f7f8a1c0bcc3775b681d4229ea561cb52281d8ba4315c3694ed08433596884d5a7ce3a8b1f82359846b7136726e2fe37bf4f7b7e2206cdcdb0705ced9f0dcaaa2ed3a78ea70d2cfeab668eb321400fc955e9aeb7bbcf86cd03f02dd443503a1480d9d9f899f53bd747a95293786798fc59fceb09e686a9328da4f929b6201841bbbefaffcf3386abdf69540e3b46a643ec10f0acf21f27c0053dc13f18485dbc898729dfbeaaa4887b58cd442d7ffa941808cd9658595be8650a815b088621278d89f0d8a4252566b923df3a3cd65c0e4af08fad385927251b31d35f75eaf25e6cf13a579aeeb0bcc0a14ca4a20a6831d532be0b2af3821792a2df95131b7fafef245aa19b214053342aa820c35858d13f84e496294529411015c41ed447b5b51dc44a45d52552a2be1abfc157f3ace7bfa32d5b931421d5a152dd66b7bf549311b08325e5a7201f793037b38990bedeca8a647c08d2478670f8fc2b4e8983ea18bcd514daeeeeb9d7a778f783c76edf01bd4beda4b77b612cd2e865c2e4f58ca7ae06147bf66ae6aee221cf9b9505dc07e6fb6cf4f82dc8c406c78e270210c11cf2531011ed678d9dfe1f49c9a69a95a9f3b0e5b624d9c2664d787ab911b75a4a38d63e9d6c353f8aaf433ff961fe5e34d84936ead0d0bc7954caf84e541f5c6f3f20c9eed21eb0316b82c0dc5182540e63a0af25565496792153d6395adc2b8d68b8bcd93dd110ff5685879db4384ec390d44b89663d43a5de3bdc0e103b7c1b355dc5f6fe3518c93628780ba03f156badea65d1d0af8433c9e8a975fdd19453da662a33fa9f0f5fa15fdb216b483fb48370a967246e0b763df8b3bc7924a6c76c4b114f803dbfa3b312e6815b4eb67be167283a9e482d9a5beac250089d069d4c386b7fda5fc228404a0f58b12ca4dc131c381b49b42b570bcfc0dd663f24afaf65a26a21f6d92f52c9f8de36cb76bacbaa0eef98ba6b7dbbc2629a03bb2b6f83fc5adaf20c217bc8d0f0d2421e01472532bcb546aeb2d483c8f95011a3ba1d2fd8086a717cb015dd53064ef4a80b6d6fdc12d9069223fdf2aa9b192a0e0bdb38436f49d9eedfef3665815633fee4344aff11162526362b70b18e1dbedbb5d8c4698860beccf667851878a25a1e766caae2861f2e23404aac859e62fdfeac06a6057554828d7035806e8ab3ee2fa6d711e5811db61231a22f4672f6a11b27641f350bcab78792362e6ebc1c054a643bbbf2746678c14dc567d1f73e37005c8ab6374c4d8d3106384a2d32c5fcf05cb9ba97cb7fa1aff11505a701bead543e555f3901ef3b693d5b9ebf49518c3509af042b7e84b1b867c22b7e08725220e4338fd074edce428212e6a3563a08e2ccd8ab71910256532904542e93d5c7deb5bf5d49beb3202d4da4f643649e55edbb91188cdcf0883a40c6ed6b8a086fb5c50dc08fee00308420121d4c7431b3cfb80f9c1e099423ac451d67b12e930d9e391d0a799c7d4b54a0d56ea0aae00c1d009e21fb5459416b464b227d66ccc1a68da59d64c1583dee54bbcd7d61ffe541fd0fb7452adba91906918966a7d58019ad1f8fdebeceeed7018837b6e4272eefeec8385abe7207fb2d7061fa6cdc478165a98971f9729b818a73edefed976d5c7c0a651c091cfd1174c020e39330a79144271fe4cbc61ea0ffa274d0d87d06dd08c1d5f8a0364d46ef7b54426bc286330c75fa257afeb2715c2ae511ff53b1189cc59ab80b1325fbdcedfdb8f36ed71f70091116e16b52188b794e637755027caac8db8554f8674b844964c710cacd7a9d6b06baf6fef76159a380e639b0d3e66080a7cf7f86baac01dbe47fe687fcef2f3bfbf6f8fba045181dee688360a11ee56e5fc73ed31c0e2924ae57f0cc93c63a30662a65c5d5f17123ae28cc5b74dd13ed81b03dc7fa61dc575668868c0df12d3553269f04ba79084d070abcdbd4745de80e90e4e3e524f27249b5c4a2f2d4c8b331b0cb6d4efe62a298daacc6eacdfe008c1f912795dbdc37098c42db860953120fda709baa6d46f52eaba781505e68561ca0f281e850532ef8e7c779883e312806e1c357bdef8d0dda005e710cfa6eb8686e8bf3bff036b3fcdc4036541d93530ce6f598442c24170b307ef05f23c93aa0ec96831b532d8120402214a940d1fa01ed649061a4a71308be189cffd729a196754fb8a75f23851189589be1b819f0612cad3dc94ccee88f4ab9ef6ac9c7daad8cf94f5ed9496c4c824e5b4f66ce32a80e7a6ef069a32f6812e656aa5f5742bd432afdf026c86e8f28212c1139dad47d7fc07e5c1a83e993daaa4a4bb5f0c9435ccab2a10f867ffe259dba7a1d9168619b1e3048860a5122e4a5d0b00372eaae861a0cc88549852fffa76e6d78739b654d67df15ea97a9a46b7c382d83191a673aa619b4a10ec05bc681379b0d6df824cb6fe158e9d89ae5dd1ef66976f67972b553db52eb6feef836dca6026293f83a61e117754a7424a3da63bd82d017f87f0603e2a9b8fc550aae611681935ae91f7ca2b5341b05a25208bd28f1a202a7f2a213b1d7411ffb557470aec00c4d13c70163f22a038a189710dd19a47e8db4a87c3fd329a63abca172a9810edad2d8e19ef85b57ea4287cfb3d740d7ea3fa9c80d06e1aa84b317f678ddb3c147ba5e0db432125f59ca4944c8e9050281ca82a3ecf67b2a5df678697a52a7297af1ecb03c586af7b91d74e881964ed95f7be12fa07e2a4e71aab8b913a13996fa33e915144bf00e49b8e7adec5b2c4b8165f54ba3155230e241ee023af77a295ab87c40f63f6092ccee05cb08a265abe8f57c9919bf45064b6c2240ba8011db223a283a4e2292d9b59df8c9a4fdc763f0631007db9976f351717db0e6b5f9c6e5f227c2efa1ae5fe0be1af0b22fc164f9f9678a01fe8b059749fe8a2972455732da1989c609d191544ef9fbb3e58da93ec4a582430523f260b776e4d747312747d18a9bae14740f5dcd35fd1072f8a4d81573b5882203be856b62d7e1d87081a9e431872c9d68864197bbc61f15dd8aeae950d34d6ce97182deebd2ad64cabd1c723baf512acfc7e94675b31369bd60e155af79b97bb734312569f736dcd5b5a78223ffaa0f7e93e1a112cb9f6a5b88fe3cf12c30024c16c6b8380fdf086c662665d3751c11617cc4dbd5b8bc7543301a23fbc90ba8d060193cdc2b68c31c734d516707b759f7db009c8f06e69b40154e1cd8ae444afb28134acdf871136b4fd78bd86d7faaaf618afb25e92d1ee37cdff0595278f9565f5eb109e181e9cacec2f22e32e9f34774ee223fdb992febcc5dbc5cceeda16cbcf1434730d859e7e03d36ff17636a7a7e66956b515894da114f3040909f90ce3cfbb2d7d46e37049c0fb124e0683d662eb427cd7b851ada229451e6e3aaee64b9964ced3036bde5d9d80eb062474f96ecfb9b65fcafc719494ac12ab7df245475f2a5e7f85ca4789833ca373e6214d39176c8f51dde87a4cfe5414a20f68bb9f34709979b99533ba3435c4aa56e525195e10ffd00f8e41aee30a909c07b973bbf733d45500b539ebe2206d438216690998d9e256db1b7ac6bef3e810785e1986985c945a2b820323a592721fcfa444934d0faf8aa439d5efca5dcd77b72d1eb91b3790d50d0a7483e354c415f81d99c133d648c1293e795b3c43f9b47e23ef982e10072ea5baafb0df675e69af1807b225afa0cec3eafbde8535d3ecaa0ea6ddbffe4465207425bb003670320324df0aeeb16b38a043f9c0e85673b36def332fd68b2b1e6edda621d0cadebbced8c7fc8f890489115b457249e8d8103676b3207a472804d33e0fe511ac56cd8dc5333b2333892f87b455940ada78fcf5075c358fce990e6f65f095eb416d876ce6f120b8b02cfa6b176ee269c942f881247c3e464cce2aa65c39137607c585aeb4b5f24f5f8e058c9c8b48003c1809da3e8aad1bee7955c3a976d43fe132e2b16f4758a0a9884e51d13b930675a4361ff366b0fed190ad7b2a00385528951e39cd44ea06d8921b9d613d7626221154cf86249a550198fe4e5b05ad3052b474291da0a0a2f701759859bc0392adf243ad5eca89e6d18e28dff99ef95743bcabe75504be8c715cd6360facf3bb06cb97c29989d4f6ff5083573cefe6ef0b39a252a2678112fa88e5b06c9a6bfc9597cc96e5a49710c4fc120fb0da4945b9d94e46de1e9989d0fc3d8d20df23d815b660c799a903f651b0d013f7fe158f1d297f7fcb6a48780ca5525f1d081ada0aafa83552318b848783306549750b6254cf676c7b934cf7fdab99273af0cdc089b34278f3fb151cadde14d0d3250e85a4b0ff2a2778a219aa40563d3ef575285484424b6d0e7cc8392342e4848c6fc8cb20fa1b450cc4c1fea19f3bbdd9e342e6c49cd7ac893b1eda2e93d1d74d20969465946b398fbc733757741ac822c4a118632cd242a439fc37512cf79b7c629504ccc1e7f2f11798955c3262b5e9695625ba74d8050e20f51d4769e1ab938f487f1bc4b55b5abcaa3ec079c2d0972b2ae9bfb7c5423b959119292ea05f1d79d35afe47e49d97c946b193bffc0a8f607f18a6845cecbbdd98cd351db2b2dce05a4848ba84a6a497b4618950130cb7e76c03d0976eb2fb41d3a42a1430063ed8e5b8c67e80fd4fc1148911958babbcbff33a6505de209b0d9320017fd736fd027a16564008ab2e1f48a6dd66c9256730e9fda0a606875d0871b2b9b0bc2ed4e1b696dbf0283c8dc72cf4338e595266f5390bc3a21f988353118f2948fc75d050ea076b73508d9ed89bade0ba305c1f4e5daf9d40d2f5e7ababed8d1b1d919c61a6d3fb149c1a9b44e38585a2fe322f83d73a3aecb44da3f0e82942d75d62ed3f91eb44f3411df014f88839e4cb1e21b9b259d4eb4adaf6b0be433d0ed4c87ec77dde5ee9d566e3dd8d928fc1875c63af26c59daba5ae267d9bd5da72b99a03e6a33cc48ed961ab484ff4a46c2d5fa597e626e00b530d7b9a9705e4e08d03f3a7f2a5a5233ad6340e3b5c89db81ca713b6d7d855c6324955f85109b204566f50178cd88abe3fcba25de905e8ea0b75ad51831761ed9b1af2470f976f05ec73bf74d137c207270cfd614170518cdc449aeeb663e114359c8124eaf2499d8cf5dc84a0872301db2e57b50bd285060ec4390d99d4ae3674ca3bb8679c1b08e566ba4f30daec8684a980055eb43cb5a1306c4b52a154682aa96637e06c869278aa2f74ef7345632c11265ef8ac97e953745302556881ba0cb590fef271c0abb193fb84d18ee3f24d9976ae816b857d6f68d1fdfe10b312c799fe014debf875d04bff8b4f387859e97c6bf13f7083c28a2045a0b5eb09c94e781a165965e8617c0efed1701ea9667aeca26d9577ea7b1242e1d91b25d6a66756cc627648a293b9f4345966bc469fafaeddc1118d0972bd5c7751a1f51e5989fd952f314ae10417c97b41e60ebfbc47e496486fa4a89fd16aea7fa1eabebd26eb2a37a3e2b351e0c9d2f67b2e5be0f921adc9b6045b045948e5103af0e5050b9c0799b513c00865deebda730de538f956ceb6164e08bd6f58655a294b4b44fc65309b30f9c00f92ef5bd5b911a3d830f72c258b19521bb8e80db02129954efb61423f518d2c5f36587303890cad9a93fa4f4bcd0e24c67db679c67ea59c1350b8442577632d5e8735833f3daf5a74bc7bd82659a81beba8c889632efe03cd24187aee856cf659e16e195464f52f2b984fc7a299e7b2aa53979a147ebed35705d5e89691666536f2febacfcef9b32d14952f958b72512869e4f6a0a34176918217888b1eb8b89322ebb6bb1dead2b4744e728479880db70e6147edaff6c3f083f18e0696bdbd78cf0bda14d9f42e5c1077ced00041aadff90470aacec0e48e2a5f2a0ed37818a173b96061e8c5bf24c0bde9e09f9e0ddb8e13306ef1d4eb8043ebadde5d7553e5212ecd4691eb426251f9d6720b8276ac543dde02399a35d974b22c1727d4b6df01957cae47443b706d43165e01d6932b136f561ce837431254cfb2a6e7d8070a2d3805aaa15b3c10ccd0cda2e9b418ce9ef380e5d08217752e12b3b892d03a9495c83d78d674612fde5a67738b2d4649ce44606ecce6bf3bd1293eca246a83643e4f1c7ba362b110e07c8479f216e3d4afc4fcb8d0820c8ab702a66d8183e83174597035e92b9b500dee08c80b927b42c3689c7c9617b4112c9e54cbfa51e989b5fd42b80c595d3edd265f138e8128cfbbb0e4f53aa0aa95a2ecda4518b2e564c42d5de7671560843d08103b9bdceac5fdeb0b1266f72f491265dd2b2b80a225a50955167da1812364ea340d82f61535401bae6f3140a8795d7c318a64cee4676627244930957b2f0b227be21b72d90027e6a5a7af3c59470c74dcdb71d1ef090a0f49c91acd604c792385c8f4e085765292822ee5eca03885fd6bfeaca9b3bbbdeac939f7846a487c5a483ed1e4fbf37c93886ea27bb35c812089b900b77c7c924147e97b6a71533610750bc84921012aa8158b213f7601d934a20bdd1f757b0a33042a683af6b9069f3900059d7f80f9fdcc9f33ece8cf7888dc9e24f1fc6ca0ecccf161c5334c60f440feb3acfc3d115011c176dfa05314c5bcf089e3c82bbe7680a3eefdcdbf3ac27265b779db4f49bade0128eda6e29bc5933ef454601db1b49628fd39ab938794fa46a33937a086ece7050d31a21524e2f0cacb307ed4412a2078636f9cc8e11c5c31cc0f9edd7be6d1e31a1513a58e25215f5a24245cb988589e6d5e5119f4f6557c697fad7d1c3a7e3bae064db4382701e33e48c5b6a52fe9141a385ef2325c6f7781134607e98bfd02c43d6deefaa861700388b40d98e941cfb2ddec209f977e8b9f93d29fdbf85e3010ce7cd622e8c75ce3df535e392052b6d65d5042d2a6e78bbfe5ee146e8b18d4bc7fb024dbba57cbe0402205593766a313950cb719d00c67bb6b3bcaa1015b89e820f11475afce655947113a7c3dcbb52427f090df994fbf076db867e0ab3f6125fb8884c1d13ff3e99fab5fa8b9f0b72cb44db4d0a48d9ec17f9733764e213c40a15ad821ec60e4a88cb2fd9dd9a4f35e6a708f4b74067f4be3f03a95261f6b191df53fa5bb5164e4a164630ad9ce39087aa950ad9e60cd2c44fa2237c49abf858c97737fd21180fd0b9542767150fbed3f39a29e6c3484d9437e15d2439f2a54b2a1ac7e63e6c436658abc3f1dd52d984f6c6901768a8cf2ec98ebf44e90e0fc0c24f8957c62e05d8eacecaf25b178fd710af609a8a1bc4d7955b5f0cb4f48a37685e6304ea5843573a1abff37b5106916c83c8f23f939a0dc43aea8d196191ed6e18dd793990d1f37d7de0bf8fac6f469843724eaab86be8a483be281b8ecf4aa29d9c571951cde8cd8c2aaf4d597ac2cb48f23fad145916920a55d655924940573b64dbd42a280cddc4810434f930183fdbbdc72db1491a4c9d44daf9b1bc2fecd855508648063040faeb125da0e68e6cd2002181118eecff0be1dd8eae726af5d451630cd65119c52abd6dded97f931202f186a18c4ba34bc2c3f6d765e2d8f445e959f26ffb55827cf3ff2cc0289f17b82c8caa5a2d3d54306a300f0ef42bbe4ea9e32c5d4b1173942745cdcfe4f5d1619eefaf8dc600afbc9171d516f7f4b35331d0b9be005132ffad5e9df59710278b842afb626a78b8b8b37fc3a894dc705b2d4e0940cb264e9dc87eaa148e6faf78125462f28a0f1d7b3c65a291b85713fa71ffc478f6601e8716c35489f4a54ed0c70bcfd5502cc91374dc3c982075c5180398bc6b195b36e79dcc4087cb990cc9d964a150e0dcc887d496bdd27c3f298736b9ad8345ba2df46021964cf43c38f9d2e94b77bee2b7bf059e0870ff9f17b9ef1320c0aa88a2fa9781e9017ab64643de9a3df9ed4b8cfd8fa080a2e494409520b795eb1517d224a05e450c4c8ae0e9fd29c0e72d3a592cce55f6dd5107f21214e1a3f9a5448384de06149f959ec0c92790f0ff229ab4971171f1c528ae6d095ec007bf5e7f55d623a68194e9ea8edc3af418075338328f24e7504341c22bef72c2963fc9c3237ba990d29c2c8aa3007395f6d96e95b40ee1b18dbad550bf39d0d98268cb74dde76d987c3169c9067495fb1b88508bbb7e94cbb7dfc15c03b1d5b163132c8a468906f02d422a8cf98d0b432b5779dd962074b72dd27439b2e94312f573435e5aa84664432c1914839cd6e172186ce93eeb1d7cb0659696d9d550eb3b185f8c6ee16e53f78233cbe709f99d2879d63d93f7d0ed133241d2f1ab1eb2c56605ca0f0e01c39ab0ba2370fe5c4e68de0561b517ff9a10023c386236398372c7176e35443e2cf5dd6cbed9f23395f231e6a54f65626cb5860a8b72122c34664119e7c47204ef4a70583a", 0x2000, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x90, 0x0, 0x400000, {0x3, 0x0, 0xc550, 0x0, 0x1, 0x0, {0x8001, 0x0, 0x0, 0x803, 0x0, 0x0, 0x80, 0x0, 0x200, 0x1000, 0x0, r13, r14, 0x0, 0x7}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r12, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0afeff0000000073019c00000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x300}, 0x48) migrate_pages(0x0, 0x8, &(0x7f0000000040)=0x1, &(0x7f0000000100)=0x2) 2.382239861s ago: executing program 5 (id=2106): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000070000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021340011800a0001006c696d6974000000240002800c00024000000000000000030c000140000000000000010108000440000000013c0000000c0a01010000000000000000070000000900020073797a31000000000900010073797a3000000000100003800c00008008000340000000edec"], 0xf4}}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x90, 0x42, 0x88, 0x10, 0x403, 0xf850, 0xa3c, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1d, 0x0, 0x0, 0xd3, 0x50, 0x3e}}]}}]}}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x3000008, 0x20010, r2, 0x3a53d000) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) syz_emit_ethernet(0x6a, 0x0, 0x0) r3 = syz_open_procfs(0x0, 0x0) readv(r3, &(0x7f0000001440)=[{0x0}], 0x1) connect$qrtr(r3, &(0x7f0000000140)={0x2a, 0x0, 0x7fff}, 0xc) r4 = fsopen(&(0x7f0000000040)='binder\x00', 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) close(r4) syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f00000001c0), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) sendto$inet(0xffffffffffffffff, 0x0, 0xffe5, 0x0, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000ad1e00084112155000000000000109022c0001000000000904000001030000000921ffff00012205000905810300000cfd00"], 0x0) syz_open_dev$tty1(0xc, 0x4, 0x2) socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs, 0x6e) 2.242539896s ago: executing program 1 (id=2107): syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d031, 0xffffffffffffffff, 0x0) pread64(0xffffffffffffffff, 0x0, 0x0, 0xc2a) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$kcm(0x2d, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f62726964676500140001007767320000"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x48, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bridge\x00'}]}]}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x24040089}, 0x20008000) socket$packet(0x11, 0x3, 0x300) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) get_mempolicy(0x0, 0x0, 0x1ff, &(0x7f00001a6000/0x3000)=nil, 0x2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)={0x44, r6, 0x1, 0x0, 0x25dfdffc, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x0, 0x42}}}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x4, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x18, 0x4829, 0xb5d1, 0x6, 0x9, 0xf062, 0x6, 0x1388]}}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x200440c0}, 0x0) 2.165978056s ago: executing program 7 (id=2108): r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000040), 0x4fd0, 0x18402) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000000500)={{r1}, "c3d70674f71a8d73cc5cda25e07fbc8f7cc8997126af621f6a03984b5c4f952bad482e5e3688dfcef58d6e08bc4ab0a92c58c445ca79e8dcd3f82a4b40ccd240bddb8b9674a9d17b89839960e04b90ed4fd6b74d0743553074ddf4377a915b3e91121222955c85ad54ff2b7778cc9558c27c00c42c0b672b2b771810bdaa8532f7d4439aafc86238ccbbc3c5f3390632b746e247a059d983fc4f3e73561ad4ad6f124a12f32880c810cfe7f595ce0287aa388361edf8609de2cff5cf0a47503af9f88db478cc3a0298193abbbf1ea2d45f14d51f46f1096e15cbd953d2440d0732b99aafee2b581cb4ca7897e4dd8892da682ab32f8f8cf20e5c53af55f44b650200a5c8222183f678b0cf40b6dc9ac2a3a973f653b80ba5f9515915dbcd7600b29d597ed5992fa768194d131f4eebaa61908410fc5c134d71469c2dfec12ffbdba3254ec0e6b03cb769b6a7cf0d608235209a3d14c599521b58df098e1f1875b4864cea262d08188a11e44dd15dde3a511b3fcb41b20e01f50ac525b43987861424ba2ad7ddb870efd584b0453f0dca0613f450c80a20cc240a5c4e8852b52b9fe2a0cf3ee5dba2c0e4058c66345f1872e7a9e7aaec794859709a613612ce597fb64bac67479629110b35009b8ad97db54688b3110da9c739d61e74fcda601d2aa8401a4d8e50c3f7d36762bc89759ea44a08555924f0b3a9cb6b1cfc386634f395ab6db1f1ba2bc5e243ca2ca39bef3e04e69e1b1e58ef15d63ffe7999ce57d4fca8feafcc7ecd5776cb442c97167b3773d1a70ea3ef6146f6b8253475fe7126f42746cedd39e8983715654d855af53934fcf3fe233fdd40ef532aee81d0245a3b949158a23965aef67dbf894aae943d4ef77399884c731b225c409d66888c837f7a76542080038e6313827064e2b4dfd96984a4c0b98c691921c57d1880cba692aa68f99a85aa4fbe6a3d9a193f05025630a8139315507fb41c801ec272f12b85093f433099cd4885e7132dcc6a90d6807b77b7cf73c2a02a1bf2aa21bdd152f9e0387c74467582fd9b12ad030d18630df0e17326114c123647bd7d9037e5b1ee5cfb7ed9ed008290c000ebfec0106c76f79866118e9cfbbab24e117dde95e8ccb95e6a5620f1095092fe1d1c6d2e6ca91cefefb83b949830c99d88399f4934d122bfd266c0a42cbf8d9d03bc08d9d951a757d55bcf4845ebe76a5a98eb5df5defc1e148119b78e0f2f0a07884373cdcd32e849644732b6080b598cff4a613296cccd0cc92fb58c69367b8f8911ea1c079076d2686ef2492b911143a060be5804282a6b54fc70f520c1f0d2dd9ab5eb40d0be2e92eca1022fc7f85db28ef48b4e4156d51bab9f626302edddfdfcc40c6a504bf151318fd80eab9c4cb5527fb490ab5255703f629725da6132b8ebc3e44649a9429c406a7fdf4b2464632facfa03dd2ec64fc9d13118c3aef2dca9a9cc5ad507e7f72247701df2f713b95840c7b7225ee0fd3aa0a730ba4dd9ebfb93db7180ca6c141d59c727c48fd97d3998d6adc3697d407c3268ff928627fed843933d277ce4c219696f97db8ad569f0fb6e85bf59489087952b89b6130ef6882962db7d183d6d712f8ecd0ea9a4d5e0177076cbe2b4c8329ea8824d38f1a37b82d4033dda70fc2b76ab458e6af18efa38de444e5f530c50072a5e91de979e9599f254f7264daa323d60494ab072a201f4f180d2296067f79b9780ee51430c46cc4283c2dade218ec7c2bea49f5366897f4486e1a56c7255c0f3eb901b002f6a31591e154f130ffca97cb8ea5779b28392568eaf4244c8469028e91ce63ea46931022aacf0c1db9f48864d99e17065cdd42fd59a193781c56bcd583120c47d4a2ec0422fda2d53bfdbcac323656e96bc4d8cbcaafc3eb289a05663397292e6959ca6c68e37908f8c8f68b0bd10175ee48a32f038a556d2c29cf93098c78895795d72661d256ad72c824fddd7c791ec8b71f61b39e86e5e5e7a7f21cc2bc512034cc18c65bb9bef5ccbcf721fd67290edb053f7c2104030a1573539e29126f968d48a869b24ba235596f211c8eb7782fb8b78ef730ca76662c04c8f545138b516cfc224681c8ea899aea4a3d97b508e6d78630f50cfa30ed71b30f83a34296550a687d4fdb30ddb659eec84fdd3bc60edc235814880a41080f2c93ea9bd3514686ed3264dddd5316949bff0e27a98cc99f5804381810c6d7b01ac883a76df6d29da3f80218b6b69119d7978f47dd617fdffbf6c95844a6db65601a525551d5a5aa193d566ec987f1d097fa2889ed5c19390a083f454865961bda82b5eafecc008b0e408f8209c791933baec28ab80e0d5401595c4fd22a577d4b20a2ab1b38c7f67e276e6a6fc8cb826a144b0a6a9ffaadaf985f5e3fb1721c5ca61f947d54ad380ed7a74a7d35a9a10ef11c3b8fa17f5d75949dfe3b441b8801fa925d6e1ffac5d66f508b17a1896f18e5b39f82719cd86458e061de4c0464230f2dbca1fcc11427ca1e9c1cbcf848260be632cc2239d2eead63351c05ee28ffc7d62947152fae0172da7952bd64de03b13ee1b6037095aeea54fad44cdcc00c9ad412686df99db78421e5fa39a343dc051288edc69ec6d6120258dfec02a04890994f5ad4049561ed4bca8934616330fecfd9f08a0ecb1304318aab5df0f45f39c89c6433ff396bb4c74b62f26a2e70a410dcf14ba9438867e212fa261e4e68beb0cec29cb0f96824470f251e1814298d56f994770d90c248c722558852c0f8adbb6438d3e9b51a187bc857288a78a75887110a6b9d406712620cb7996f7944187d84b4d7374673d776e4abbe1c3085df771b6c36c70a279a0dd770fd89216135b86fe0a2a658f13ab49a10c418b15b550c84d5b0c7c64393eb12af26c26babc43508a262bf828b586faed7515f4d5a0c568d9166ddd72d08b3a4ffc8e979a70906527d17606cb7e57c1dd55de7c71a3a32992b5f358fceac911c26d7ab56536fb8551f32c1074415ed43368635f168886dd51559a037fd8665560b81438e071b8aa32b3710fbfd77d20eedb1e29ce36d6162293dc3473da3cce8024ab284e6f45b8ec3c3d94d3b8a70a8d99b3ff5d5f8069e20326cace0317c9ba5f073883e8bd2b8df4a2126de28a790ba4758facb212798c0520cf3cd595dc42dfd34550b5d4375ed0af69b90e6947bc4492c9b2806933592c23b489fd017491f033b5761288a8244343d453186046d903c7ff345ac3012ffdb5055f14088e45b92e065677af979d972e8c6adfaee584858c7d16cb7ffb4aa11b025271956aaf2f2d95147ec69c49d9c3cb4368d83cb468927f26f5a9888c409ffd4c5a8574a69e9c21ac637e6e485ec635d49dd48add91f2fd16239a274874915bfa4a75af94924af25c93eb1b4fa3507b1bac80fc803606f474f460d40a69bdcbfe65272b65bba81ff27c77fd9d012cb8acb6f89c721b59e8e8a097d3945529aaf6f3de35094ec3b88867f37516234c7de9a3bfc05d01763b4870e55c342ee15342b0fb342feab3bb82483bd8bdcbf8b68a89494c0c6881ba5091c2a44c1865e7f0382f99ea1e2979559d8d555c243bba36ce6df4c67372764e4c8221f0941c4ff8e08b859f5f30d7891011078e6e9906a6e7d08e01cd61b87cdee9c03d576c34fe91ff795f1b7c20be9ea4cb49be16833fc9e0df2590f236f30bef7c5fb64a6545e4454f4c8dfba892817ca792b7a62e10f7a32781e729b2d7fd2ccbc954db2b6f134eff7d49b8acb95a74244d736db91181456324aa871f9321fcc532bd80c34ca6e7cff90ecea064045988a58170894955270581433719c396a509b3905a28a275c8ba0aedd1be1fe425e9c7c1659eec54c8119d6cadda410f4444cbb126cb5550f81f78713a56ac001a1810a53da12bc0d1e9104d1382f1595f5d6b99ff6c90c757ca70b790d02a9549afe18aad399f9843bd329d1d86d8d6066f5982ef0abd4e972853cdacf65e0b770f1692a68a32825a962914eedc899b8a9d0cae3dd5db3cc3136ed513b16e51164891ecc1264267d8bbbef1e52ea128d1fef86c729f80413e71d0584668487bb313c0a28b9d7ea52a1f53148c2f035683aca547bc06421986e9e1b0ee80298694ca63f8e1460a1ef9d38409c7ce783955bfc66975bf2ba6ebf59252409b9d59be459ef588c42b25e39b378c8ef4960e8de6c9447ebce3cfc9cda41d65e47d4104ed6879c62ec67700a54cfceae7e2b90c6d5d591d60e962035da4e85e096d2c2a94e71b2d4178d54c79567e66af4a0dd42581cd703b0653ec36a5b86d06fe6956fc5f9851ac238863cae5caa07970c269de040b35a32d7dcd4c0bf656a6eecc4b1d92a600d8ae7c0ef529ca09f4664468ab3df7e6e93b2db78980ddd07125c47447680565c85e2588d07cef90644330f56361f6d4b15f7201c2dae76b3acc2e7e2d233427a96eee3504e542cf94b5ca9da3a8dcf2837e0a2ac97e84eb153f145e121a3e4e62ee12a888b742686b5e1346d221d02cdfd7099858ef012a856c1c059e7ddcedb5880b861085858833a68dd61dfce95bcea8707530283335217612b61f9d6f728fb487f64bb5cdcf3ce1aa0dcd4144a5364215777def04a8a44156de5ae0cb132ee12fc528072b08f22b69f25c5168de79e85fa54688241fcab4a4957aa6f256ba912d586d7addd2309ca473098db9c1f421eb436eb7b688bf5e95ab31a06aa922f8f58f6bb9b9d097b6331017ceb9715628a79c87666420b6f5815c79517b9811a90c16c7d7945fc1cb8522e0e06872f590b6eff9870dbfbafa8ddfd6ed0e2f7349a3303460f86e4310d39dd7b0123fe5f8061689d291382da02cdab3364e672406d8a054de6d6074b1cab16ac15814299eb226165dcbf4d7bc755bd8bfe2f76f46afc5564ad430cbad3d1afd0bf07c6df7c67d5669cceed1af5aa096c08786d973d38fc844b5623878fabe5b675a76b5a83b70d7fba44ef9c3767471c6228aaf543be9fb87b6d220dd9715a4c3568a3fd5cd24587a48c7a64be9af9152da2c0a9eccfbddd21719b5d9418a5fbf25ae3a895bfbfc8adfc14f72a191dc8354e7876c22918f6aa29e6a796a03098bbdcb9284fc52345318c33ec4e1c7f833fbfbea2b7520f206cd136bc3caa6dd47c1b79f649642bb7f449a5e2b218181783214957ef380d5c32786307d636be4e222b25df117ef3b2ab69f5d105cf0307db1ebed6207fb4053db859f7109d818ab1c38a251bd612132aede863825111a702621724f2782a205ed2f3707b2d8bcce949456e24872a03eb50efdf92c6b3e31339aea5c2dca62993861a39b4dfd4873b30a05e39e9c0e4d2fcaa24dd60cd99ab5bd64c850c3281a640fac0c0a499642f20261b9ec94d8fdb23c3f3de2369380b00b124a5bdeaadd037c6d332107ab7aada8d47a14fc2310083890c78f6028cf31b463c180a6b0ca5a1ca3f9806fd320298a2a9ce39f80931346e0c157c4e3d49eecadc24a245a5f5c0aefa8b63e19611275e449d1bca9172598c70f59444dcf9e7b48ccbd03bc98517537029e2b0f3a39273681c162378b4ce6e5c628950b4f8b45aa528182a8f5fb4e55902173beeaef071494fe8e62a474917a20cd832993432de2ae688539b59170a90b5b05f282e21bb1293f2109afc5a829c4e789c6cbfe08def9127cd298adf91fd097031c51701893f072b69df3d26602d076003397dad711dd84f27b7baea47c6cff41ce31aedf5c16ee6621f30e3bcc2268e209793a6248117f43deac2e7dea7d"}) (async) ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000000500)={{r1}, "c3d70674f71a8d73cc5cda25e07fbc8f7cc8997126af621f6a03984b5c4f952bad482e5e3688dfcef58d6e08bc4ab0a92c58c445ca79e8dcd3f82a4b40ccd240bddb8b9674a9d17b89839960e04b90ed4fd6b74d0743553074ddf4377a915b3e91121222955c85ad54ff2b7778cc9558c27c00c42c0b672b2b771810bdaa8532f7d4439aafc86238ccbbc3c5f3390632b746e247a059d983fc4f3e73561ad4ad6f124a12f32880c810cfe7f595ce0287aa388361edf8609de2cff5cf0a47503af9f88db478cc3a0298193abbbf1ea2d45f14d51f46f1096e15cbd953d2440d0732b99aafee2b581cb4ca7897e4dd8892da682ab32f8f8cf20e5c53af55f44b650200a5c8222183f678b0cf40b6dc9ac2a3a973f653b80ba5f9515915dbcd7600b29d597ed5992fa768194d131f4eebaa61908410fc5c134d71469c2dfec12ffbdba3254ec0e6b03cb769b6a7cf0d608235209a3d14c599521b58df098e1f1875b4864cea262d08188a11e44dd15dde3a511b3fcb41b20e01f50ac525b43987861424ba2ad7ddb870efd584b0453f0dca0613f450c80a20cc240a5c4e8852b52b9fe2a0cf3ee5dba2c0e4058c66345f1872e7a9e7aaec794859709a613612ce597fb64bac67479629110b35009b8ad97db54688b3110da9c739d61e74fcda601d2aa8401a4d8e50c3f7d36762bc89759ea44a08555924f0b3a9cb6b1cfc386634f395ab6db1f1ba2bc5e243ca2ca39bef3e04e69e1b1e58ef15d63ffe7999ce57d4fca8feafcc7ecd5776cb442c97167b3773d1a70ea3ef6146f6b8253475fe7126f42746cedd39e8983715654d855af53934fcf3fe233fdd40ef532aee81d0245a3b949158a23965aef67dbf894aae943d4ef77399884c731b225c409d66888c837f7a76542080038e6313827064e2b4dfd96984a4c0b98c691921c57d1880cba692aa68f99a85aa4fbe6a3d9a193f05025630a8139315507fb41c801ec272f12b85093f433099cd4885e7132dcc6a90d6807b77b7cf73c2a02a1bf2aa21bdd152f9e0387c74467582fd9b12ad030d18630df0e17326114c123647bd7d9037e5b1ee5cfb7ed9ed008290c000ebfec0106c76f79866118e9cfbbab24e117dde95e8ccb95e6a5620f1095092fe1d1c6d2e6ca91cefefb83b949830c99d88399f4934d122bfd266c0a42cbf8d9d03bc08d9d951a757d55bcf4845ebe76a5a98eb5df5defc1e148119b78e0f2f0a07884373cdcd32e849644732b6080b598cff4a613296cccd0cc92fb58c69367b8f8911ea1c079076d2686ef2492b911143a060be5804282a6b54fc70f520c1f0d2dd9ab5eb40d0be2e92eca1022fc7f85db28ef48b4e4156d51bab9f626302edddfdfcc40c6a504bf151318fd80eab9c4cb5527fb490ab5255703f629725da6132b8ebc3e44649a9429c406a7fdf4b2464632facfa03dd2ec64fc9d13118c3aef2dca9a9cc5ad507e7f72247701df2f713b95840c7b7225ee0fd3aa0a730ba4dd9ebfb93db7180ca6c141d59c727c48fd97d3998d6adc3697d407c3268ff928627fed843933d277ce4c219696f97db8ad569f0fb6e85bf59489087952b89b6130ef6882962db7d183d6d712f8ecd0ea9a4d5e0177076cbe2b4c8329ea8824d38f1a37b82d4033dda70fc2b76ab458e6af18efa38de444e5f530c50072a5e91de979e9599f254f7264daa323d60494ab072a201f4f180d2296067f79b9780ee51430c46cc4283c2dade218ec7c2bea49f5366897f4486e1a56c7255c0f3eb901b002f6a31591e154f130ffca97cb8ea5779b28392568eaf4244c8469028e91ce63ea46931022aacf0c1db9f48864d99e17065cdd42fd59a193781c56bcd583120c47d4a2ec0422fda2d53bfdbcac323656e96bc4d8cbcaafc3eb289a05663397292e6959ca6c68e37908f8c8f68b0bd10175ee48a32f038a556d2c29cf93098c78895795d72661d256ad72c824fddd7c791ec8b71f61b39e86e5e5e7a7f21cc2bc512034cc18c65bb9bef5ccbcf721fd67290edb053f7c2104030a1573539e29126f968d48a869b24ba235596f211c8eb7782fb8b78ef730ca76662c04c8f545138b516cfc224681c8ea899aea4a3d97b508e6d78630f50cfa30ed71b30f83a34296550a687d4fdb30ddb659eec84fdd3bc60edc235814880a41080f2c93ea9bd3514686ed3264dddd5316949bff0e27a98cc99f5804381810c6d7b01ac883a76df6d29da3f80218b6b69119d7978f47dd617fdffbf6c95844a6db65601a525551d5a5aa193d566ec987f1d097fa2889ed5c19390a083f454865961bda82b5eafecc008b0e408f8209c791933baec28ab80e0d5401595c4fd22a577d4b20a2ab1b38c7f67e276e6a6fc8cb826a144b0a6a9ffaadaf985f5e3fb1721c5ca61f947d54ad380ed7a74a7d35a9a10ef11c3b8fa17f5d75949dfe3b441b8801fa925d6e1ffac5d66f508b17a1896f18e5b39f82719cd86458e061de4c0464230f2dbca1fcc11427ca1e9c1cbcf848260be632cc2239d2eead63351c05ee28ffc7d62947152fae0172da7952bd64de03b13ee1b6037095aeea54fad44cdcc00c9ad412686df99db78421e5fa39a343dc051288edc69ec6d6120258dfec02a04890994f5ad4049561ed4bca8934616330fecfd9f08a0ecb1304318aab5df0f45f39c89c6433ff396bb4c74b62f26a2e70a410dcf14ba9438867e212fa261e4e68beb0cec29cb0f96824470f251e1814298d56f994770d90c248c722558852c0f8adbb6438d3e9b51a187bc857288a78a75887110a6b9d406712620cb7996f7944187d84b4d7374673d776e4abbe1c3085df771b6c36c70a279a0dd770fd89216135b86fe0a2a658f13ab49a10c418b15b550c84d5b0c7c64393eb12af26c26babc43508a262bf828b586faed7515f4d5a0c568d9166ddd72d08b3a4ffc8e979a70906527d17606cb7e57c1dd55de7c71a3a32992b5f358fceac911c26d7ab56536fb8551f32c1074415ed43368635f168886dd51559a037fd8665560b81438e071b8aa32b3710fbfd77d20eedb1e29ce36d6162293dc3473da3cce8024ab284e6f45b8ec3c3d94d3b8a70a8d99b3ff5d5f8069e20326cace0317c9ba5f073883e8bd2b8df4a2126de28a790ba4758facb212798c0520cf3cd595dc42dfd34550b5d4375ed0af69b90e6947bc4492c9b2806933592c23b489fd017491f033b5761288a8244343d453186046d903c7ff345ac3012ffdb5055f14088e45b92e065677af979d972e8c6adfaee584858c7d16cb7ffb4aa11b025271956aaf2f2d95147ec69c49d9c3cb4368d83cb468927f26f5a9888c409ffd4c5a8574a69e9c21ac637e6e485ec635d49dd48add91f2fd16239a274874915bfa4a75af94924af25c93eb1b4fa3507b1bac80fc803606f474f460d40a69bdcbfe65272b65bba81ff27c77fd9d012cb8acb6f89c721b59e8e8a097d3945529aaf6f3de35094ec3b88867f37516234c7de9a3bfc05d01763b4870e55c342ee15342b0fb342feab3bb82483bd8bdcbf8b68a89494c0c6881ba5091c2a44c1865e7f0382f99ea1e2979559d8d555c243bba36ce6df4c67372764e4c8221f0941c4ff8e08b859f5f30d7891011078e6e9906a6e7d08e01cd61b87cdee9c03d576c34fe91ff795f1b7c20be9ea4cb49be16833fc9e0df2590f236f30bef7c5fb64a6545e4454f4c8dfba892817ca792b7a62e10f7a32781e729b2d7fd2ccbc954db2b6f134eff7d49b8acb95a74244d736db91181456324aa871f9321fcc532bd80c34ca6e7cff90ecea064045988a58170894955270581433719c396a509b3905a28a275c8ba0aedd1be1fe425e9c7c1659eec54c8119d6cadda410f4444cbb126cb5550f81f78713a56ac001a1810a53da12bc0d1e9104d1382f1595f5d6b99ff6c90c757ca70b790d02a9549afe18aad399f9843bd329d1d86d8d6066f5982ef0abd4e972853cdacf65e0b770f1692a68a32825a962914eedc899b8a9d0cae3dd5db3cc3136ed513b16e51164891ecc1264267d8bbbef1e52ea128d1fef86c729f80413e71d0584668487bb313c0a28b9d7ea52a1f53148c2f035683aca547bc06421986e9e1b0ee80298694ca63f8e1460a1ef9d38409c7ce783955bfc66975bf2ba6ebf59252409b9d59be459ef588c42b25e39b378c8ef4960e8de6c9447ebce3cfc9cda41d65e47d4104ed6879c62ec67700a54cfceae7e2b90c6d5d591d60e962035da4e85e096d2c2a94e71b2d4178d54c79567e66af4a0dd42581cd703b0653ec36a5b86d06fe6956fc5f9851ac238863cae5caa07970c269de040b35a32d7dcd4c0bf656a6eecc4b1d92a600d8ae7c0ef529ca09f4664468ab3df7e6e93b2db78980ddd07125c47447680565c85e2588d07cef90644330f56361f6d4b15f7201c2dae76b3acc2e7e2d233427a96eee3504e542cf94b5ca9da3a8dcf2837e0a2ac97e84eb153f145e121a3e4e62ee12a888b742686b5e1346d221d02cdfd7099858ef012a856c1c059e7ddcedb5880b861085858833a68dd61dfce95bcea8707530283335217612b61f9d6f728fb487f64bb5cdcf3ce1aa0dcd4144a5364215777def04a8a44156de5ae0cb132ee12fc528072b08f22b69f25c5168de79e85fa54688241fcab4a4957aa6f256ba912d586d7addd2309ca473098db9c1f421eb436eb7b688bf5e95ab31a06aa922f8f58f6bb9b9d097b6331017ceb9715628a79c87666420b6f5815c79517b9811a90c16c7d7945fc1cb8522e0e06872f590b6eff9870dbfbafa8ddfd6ed0e2f7349a3303460f86e4310d39dd7b0123fe5f8061689d291382da02cdab3364e672406d8a054de6d6074b1cab16ac15814299eb226165dcbf4d7bc755bd8bfe2f76f46afc5564ad430cbad3d1afd0bf07c6df7c67d5669cceed1af5aa096c08786d973d38fc844b5623878fabe5b675a76b5a83b70d7fba44ef9c3767471c6228aaf543be9fb87b6d220dd9715a4c3568a3fd5cd24587a48c7a64be9af9152da2c0a9eccfbddd21719b5d9418a5fbf25ae3a895bfbfc8adfc14f72a191dc8354e7876c22918f6aa29e6a796a03098bbdcb9284fc52345318c33ec4e1c7f833fbfbea2b7520f206cd136bc3caa6dd47c1b79f649642bb7f449a5e2b218181783214957ef380d5c32786307d636be4e222b25df117ef3b2ab69f5d105cf0307db1ebed6207fb4053db859f7109d818ab1c38a251bd612132aede863825111a702621724f2782a205ed2f3707b2d8bcce949456e24872a03eb50efdf92c6b3e31339aea5c2dca62993861a39b4dfd4873b30a05e39e9c0e4d2fcaa24dd60cd99ab5bd64c850c3281a640fac0c0a499642f20261b9ec94d8fdb23c3f3de2369380b00b124a5bdeaadd037c6d332107ab7aada8d47a14fc2310083890c78f6028cf31b463c180a6b0ca5a1ca3f9806fd320298a2a9ce39f80931346e0c157c4e3d49eecadc24a245a5f5c0aefa8b63e19611275e449d1bca9172598c70f59444dcf9e7b48ccbd03bc98517537029e2b0f3a39273681c162378b4ce6e5c628950b4f8b45aa528182a8f5fb4e55902173beeaef071494fe8e62a474917a20cd832993432de2ae688539b59170a90b5b05f282e21bb1293f2109afc5a829c4e789c6cbfe08def9127cd298adf91fd097031c51701893f072b69df3d26602d076003397dad711dd84f27b7baea47c6cff41ce31aedf5c16ee6621f30e3bcc2268e209793a6248117f43deac2e7dea7d"}) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @local, 'geneve0\x00'}}, 0x1e) socket$pppoe(0x18, 0x1, 0x0) (async) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @local, 'geneve0\x00'}}, 0x1e) (async) connect$pppoe(r3, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @local, 'geneve0\x00'}}, 0x1e) close(r2) connect$pppoe(r3, &(0x7f00000004c0)={0x18, 0x0, {0x3, @remote, 'rose0\x00'}}, 0x1e) 1.993871976s ago: executing program 7 (id=2109): connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x1, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xf}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac95ab194f93f8e795a9b29420fa62d", 0x11}], 0x1}}], 0x1, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 1.527099207s ago: executing program 7 (id=2110): syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x500) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='veno\x00', 0x5) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x0, 0x4008000) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x6, 0x6, 0x0, 0x3}, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a100efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb72b4b996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) ioctl$USBDEVFS_CLEAR_HALT(r3, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_usb_connect$uac1(0x3, 0xa4, 0x0, 0x0) r5 = openat$vimc1(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r5, 0x4020565a, &(0x7f0000000000)={0x5, 0x802, 0x2}) r6 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r6, 0x5) r7 = socket$unix(0x1, 0x2, 0x0) r8 = socket$unix(0x1, 0x2, 0x0) bind$unix(r8, &(0x7f0000003000)=@file={0x1}, 0x6e) connect$unix(r7, &(0x7f0000000640)=@file={0x1}, 0x6e) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r9, 0x6, 0x21, &(0x7f0000000040)="5766b1b827f600333b09d3748ee7d700", 0x10) shutdown(r4, 0x0) write$binfmt_script(r4, &(0x7f0000000140)={'#! ', './file0'}, 0xb) 1.370045325s ago: executing program 0 (id=2111): r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x2080, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0000000000000004000008017a36604f2506f3a7", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0000000000000004000008017a36604f2506f3a7", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) r3 = socket$packet(0x11, 0xa, 0x300) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) socket$packet(0x11, 0x2, 0x300) (async) r5 = socket$packet(0x11, 0x2, 0x300) socket$inet6(0xa, 0x800000000000002, 0x0) (async) r6 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r6, 0x11, 0x67, &(0x7f0000000940)=0x28, 0x4) sendto$inet6(r6, 0x0, 0x0, 0x400ad80, &(0x7f0000000080)={0xa, 0x4621, 0x0, @local}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000006780)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)="b3ab706204ee39c9dae21a1718ee351ebc92d2f0d482a863ae5c0b4d768ffe745af2c53a083d9b761b", 0xfff7}], 0x1}}], 0x1, 0x0) (async) sendmmsg$inet6(r6, &(0x7f0000006780)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000001c0)="b3ab706204ee39c9dae21a1718ee351ebc92d2f0d482a863ae5c0b4d768ffe745af2c53a083d9b761b", 0xfff7}], 0x1}}], 0x1, 0x0) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa004}, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000180)="10030600e0ff020004004788aa96a13bb100001100007fca1a00", 0x10608, 0x0, &(0x7f0000000140)={0x11, 0x0, r7}, 0x14) unshare(0x26020480) (async) unshare(0x26020480) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket(0x40000000015, 0x5, 0x0) (async) r8 = socket(0x40000000015, 0x5, 0x0) bind$inet(r8, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x57) preadv(r0, &(0x7f0000001840)=[{&(0x7f0000001780)=""/138, 0x8a}], 0x1, 0x7ff, 0x8001) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) socket$kcm(0x10, 0x2, 0x4) (async) r9 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f00000000c0)="48000000140081fb7059ae08060c040002ff0f03f1cd823010a7ce9000000000000ec000006fabca3b4e7d06a6bd7c00000000030000068a562ad6e74703c48f93bc2a0200000046", 0x48}], 0x1}, 0x4000000) (async) sendmsg$kcm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001540)=[{&(0x7f00000000c0)="48000000140081fb7059ae08060c040002ff0f03f1cd823010a7ce9000000000000ec000006fabca3b4e7d06a6bd7c00000000030000068a562ad6e74703c48f93bc2a0200000046", 0x48}], 0x1}, 0x4000000) r10 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r10, 0x7a7, &(0x7f00000002c0)=0xa0000) (async) ioctl$IOCTL_VMCI_VERSION2(r10, 0x7a7, &(0x7f00000002c0)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r10, 0x7a0, &(0x7f0000000100)={@my=0x1}) io_setup(0x1, &(0x7f0000000b80)=0x0) io_submit(r11, 0x1, &(0x7f00000003c0)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x0, r10, 0x0}]) 1.089750725s ago: executing program 0 (id=2112): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x24004044}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x5, 0xffff}}}, 0x24}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="3c00000011000100000000000000000007000000", @ANYRES32=r2], 0x3c}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (fail_nth: 18) 863.200616ms ago: executing program 0 (id=2113): r0 = epoll_create1(0x80000) ppoll(&(0x7f0000000180)=[{r0, 0x15}, {r0, 0x6009}], 0x2, 0x0, 0x0, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000005c0)={0x2004}) (fail_nth: 6) 309.975356ms ago: executing program 0 (id=2114): membarrier(0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x2abf, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x1b0}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r6, &(0x7f0000000300)={'syz1\x00', {0x0, 0x0, 0x2}, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x87, 0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x514], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xfffffff7, 0x0, 0x2, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x2, 0x871], [0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x7, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x40002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x10000, 0x0, 0xfffffffc, 0x0, 0x9, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r6, 0x5501) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a030000000d0000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40006000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff00080003400000000c2c0000000b0a01010000000000000000070000000900020073797a31000000000900010073797a30"], 0xc0}}, 0x0) r8 = syz_io_uring_setup(0x4169, 0x0, &(0x7f0000000480), &(0x7f0000000040)=0x0) syz_io_uring_setup(0xa94, &(0x7f0000000280)={0x0, 0x44c2, 0x0, 0x2, 0xfffffffd}, &(0x7f0000000000)=0x0, &(0x7f00000005c0)) syz_io_uring_submit(r10, r9, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffe54}) io_uring_enter(r8, 0x48e9, 0x3, 0x0, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0xc0, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r2, 0x1, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) 309.564566ms ago: executing program 6 (id=2115): syz_open_dev$sndmidi(&(0x7f0000000000), 0x8f, 0x11dc41) (async) r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000009e602206d0414c340000000000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r2 = socket(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000180)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e5fa424ac4d31c4f7a1", 0x90, 0x0, 0x0, 0xf) (async) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) (async) r3 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r3) (async) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r3}) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000080)={0x0, r3}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) (async) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) (async) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000e40)) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) (async) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, &(0x7f0000000080)={0x20, 0xa, 0x9, {0x9, 0x9, "0dd5caa8776609"}}, 0x0, &(0x7f0000000100), 0x0}, 0x0) r4 = io_uring_setup(0x48da, &(0x7f00000002c0)={0x0, 0x8815, 0x2000, 0x2, 0x192}) r5 = io_uring_setup(0x600f, &(0x7f0000000180)={0x0, 0xe879, 0x2, 0x40000000, 0x5, 0x0, r4}) (async) r6 = syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x0, 0x13580}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000000)=@IORING_OP_ASYNC_CANCEL={0xe, 0x18, 0x0, 0x0, 0x0, 0x12345}) (async) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, r9) 84.894516ms ago: executing program 7 (id=2116): r0 = syz_open_dev$audion(&(0x7f0000000000), 0x7fffffff, 0x1000) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000040)={0x101, 0xc92, 0x3, 0x8, 0x6, 0x0, [{0x6, 0x3, 0x40, '\x00', 0x2483}, {0x5, 0x9, 0xe4, '\x00', 0xa08}, {0x10, 0x2, 0xefd, '\x00', 0x8}, {0x5, 0x9, 0x9, '\x00', 0x400}, {0xd1a4, 0x9, 0x7, '\x00', 0x400}, {0x81, 0x7fffffff, 0x0, '\x00', 0x400}]}) write$FUSE_NOTIFY_DELETE(r0, &(0x7f00000001c0)={0x2a, 0x6, 0x0, {0x1, 0x4, 0x1, 0x0, ':'}}, 0x2a) r1 = syz_open_dev$mouse(&(0x7f0000000200), 0x9, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000240)) (async) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000240)=0x0) prlimit64(r2, 0x4, &(0x7f0000000280)={0xe, 0x8}, &(0x7f00000002c0)) timer_create(0x1, &(0x7f0000000440)={0x0, 0x41, 0x1, @thr={&(0x7f0000000300)="73a8806602194c8f44c46e7fb3a02259a71711c463685744b4cb30692273b1cd6d5e964dfb872ff7230afb2523de723b3a4efb0048d242860148a36bf0993ba580f02187cbe86a3bc0d11123691bf8ad", &(0x7f0000000380)="9ff4298b2444f5b3617bca4bf849bb0ba0931183f8ae0a74b9cef7a1b896af97fd89c53fd783d95e33091111e18f7225a14ece63078757746797f892a72362dd85967fa98b105dde6ae8fdedfe4899b2a5743d0788ee4a3fd538a78572bf3949f8b635ce5982cb90dbd6a34ea6d4e2329ee92b87f62a546226493707750340f4e2ba86b531227acc00eac19bd1b2233d8b01c83bff4ad044c27d0cb85e938673d1"}}, &(0x7f0000000480)=0x0) timer_gettime(r3, &(0x7f00000004c0)) (async) timer_gettime(r3, &(0x7f00000004c0)) prlimit64(r2, 0xb, &(0x7f0000000500)={0x8f0, 0x4}, &(0x7f0000000540)) (async) prlimit64(r2, 0xb, &(0x7f0000000500)={0x8f0, 0x4}, &(0x7f0000000540)) getsockopt(r1, 0x2, 0xff, &(0x7f0000000580)=""/140, &(0x7f0000000640)=0x8c) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000680)={0x2, "5ed1c8619f5566648ccfc6ae2ffd2e8db17032f477b751da5f270a936909a3cb"}) getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f00000006c0), &(0x7f0000000700)=0x30) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000007c0)={0xa30000, 0x0, 0x7, r1, 0x0, &(0x7f0000000780)={0x9a091f, 0x2, '\x00', @p_u16=&(0x7f0000000740)=0x7}}) (async) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f00000007c0)={0xa30000, 0x0, 0x7, r1, 0x0, &(0x7f0000000780)={0x9a091f, 0x2, '\x00', @p_u16=&(0x7f0000000740)=0x7}}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000800), 0x2200, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000840), 0x2, 0x0) timerfd_create(0x3, 0x80000) (async) timerfd_create(0x3, 0x80000) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000880)={0x0, 0x3ff}, 0x8) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000940)={'syztnl1\x00', &(0x7f00000008c0)={'erspan0\x00', 0x0, 0x10, 0x40, 0x5, 0x1, {{0xf, 0x4, 0x2, 0x5, 0x3c, 0x67, 0x0, 0x81, 0x29, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x1a}, {[@timestamp_prespec={0x44, 0x14, 0xd5, 0x3, 0x4, [{@rand_addr=0x64010100}, {@private=0xa010102, 0x100}]}, @end, @timestamp_addr={0x44, 0xc, 0xe9, 0x1, 0x9, [{@private=0xa010101, 0x2}]}, @noop, @ra={0x94, 0x4, 0x1}]}}}}}) statx(r1, &(0x7f0000000980)='./file0\x00', 0x0, 0x4, &(0x7f00000009c0)) (async) statx(r1, &(0x7f0000000980)='./file0\x00', 0x0, 0x4, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000ac0)={{{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@multicast1, 0x4e21, 0x0, 0x4e21, 0x5, 0xa, 0xa0, 0xa0, 0x3c, r4, r5}, {0xfff, 0x0, 0x0, 0xe, 0x0, 0x1, 0x3, 0x3ff}, {0xfffffffffffffffb, 0x2, 0x3, 0x9}, 0x7, 0x6e6bb6, 0x1, 0x0, 0x2, 0x1}, {{@in=@rand_addr=0x64010100, 0x4d3, 0xff}, 0x2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3500, 0x0, 0x0, 0x6, 0x8, 0x5}}, 0xe8) ioctl$VIDIOC_S_CROP(r1, 0x4014563c, &(0x7f0000000bc0)={0x8, {0x8, 0x8, 0x7, 0x1}}) (async) ioctl$VIDIOC_S_CROP(r1, 0x4014563c, &(0x7f0000000bc0)={0x8, {0x8, 0x8, 0x7, 0x1}}) syz_open_dev$vbi(&(0x7f0000000c00), 0x3, 0x2) (async) syz_open_dev$vbi(&(0x7f0000000c00), 0x3, 0x2) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000c40)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f0000000c80)={0xc, r6}) socket$nl_route(0x10, 0x3, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) (async) r7 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000cc0)={'\x00', 0x43d, 0x7, 0x8, 0x668, 0x80000001, r7}) timer_getoverrun(r3) (async) timer_getoverrun(r3) 0s ago: executing program 7 (id=2117): socket$can_bcm(0x1d, 0x2, 0x2) migrate_pages(0x0, 0x3, &(0x7f00000002c0)=0x2d, &(0x7f0000000280)=0xa) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) recvmmsg(r1, &(0x7f0000000c80)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001e00)=""/4106, 0x100a}], 0x1}, 0x5}], 0x2, 0x10040, 0x0) r2 = dup(r0) syz_io_uring_setup(0x44bd, &(0x7f0000000740)={0x0, 0x1c2a, 0x1, 0x3, 0x0, 0x0, r2}, 0x0, 0x0) r3 = socket(0x1e, 0x1, 0x0) connect$tipc(r3, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x2f00, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @remote}}}}) socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002030040000904000001020d00000524c3176f26240080a9b2f51a0100000000000001000006241a0100140905810340020000fc090401000002"], 0x0) readv(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x8000000000000001, 0x3, 0x8, 0xe0, 0x0, 0x0, 0x400000000000000}, 0x0, 0x0, 0x0, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r5, &(0x7f00000000c0)={0x1d, r6}, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), r7) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000400)) sendmsg$BATADV_CMD_SET_HARDIF(r7, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x4800}, 0x20004804) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) sendmsg$can_bcm(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)={0x1, 0x0, 0x0, {0x0, 0x2710}, {r8, r9/1000+10000}, {}, 0x1, @can={{0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, "a597d1543d011fd8"}}, 0x48}}, 0x480c1) sendmsg$can_bcm(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1, 0x8, 0x2, {}, {}, {0x2, 0x1, 0x1, 0x1}, 0x1, @can={{0x2, 0x1, 0x1, 0x1}, 0x1, 0x1, 0x0, 0x0, "68c76dee16687b11"}}, 0x48}, 0x1, 0x0, 0x0, 0x24000000}, 0x4000) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r10, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): strings: Mfr=4, Product=0, SerialNumber=0 [ 593.735497][ T48] usb 1-1: Manufacturer: syz [ 593.751149][ T48] usb 1-1: config 0 descriptor?? [ 593.992882][ T48] usb 1-1: USB disconnect, device number 113 [ 594.645445][ T5889] usb 8-1: new high-speed USB device number 60 using dummy_hcd [ 594.808188][ T5889] usb 8-1: Using ep0 maxpacket: 16 [ 594.833802][ T5889] usb 8-1: config 0 has an invalid interface number: 195 but max is 0 [ 594.897186][ T5889] usb 8-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 594.949095][ T5889] usb 8-1: config 0 has no interface number 0 [ 594.988999][ T5889] usb 8-1: New USB device found, idVendor=0421, idProduct=0418, bcdDevice=95.ff [ 595.033400][ T5889] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 595.075780][T13813] input: syz1 as /devices/virtual/input/input57 [ 595.109278][ T5889] usb 8-1: Product: syz [ 595.115392][ T5889] usb 8-1: Manufacturer: syz [ 595.131352][ T5889] usb 8-1: SerialNumber: syz [ 595.145726][ T5918] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 595.196294][ T5889] usb 8-1: config 0 descriptor?? [ 595.237610][ T5889] usb 8-1: bad CDC descriptors [ 595.319975][ T5918] usb 2-1: config 27 has an invalid descriptor of length 129, skipping remainder of the config [ 595.348432][ T5918] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 595.370936][ T5918] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 595.685057][ T5918] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 595.724275][ T5918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=131 [ 595.777021][ T5918] usb 2-1: SerialNumber: syz [ 595.849519][ T5918] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 595.869853][T13824] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1808'. [ 595.886274][ T5918] usb 2-1: invalid MIDI out EP 0 [ 596.074446][T13827] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1808'. [ 596.231313][ T5918] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 596.370573][ T5936] usb 7-1: new full-speed USB device number 68 using dummy_hcd [ 596.402874][ T5849] udevd[5849]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 596.549942][ T5889] usb 8-1: USB disconnect, device number 60 [ 596.645144][ T5936] usb 7-1: unable to get BOS descriptor or descriptor too short [ 596.655181][ T5936] usb 7-1: not running at top speed; connect to a high speed hub [ 596.681359][ T5936] usb 7-1: config 3 has an invalid interface number: 106 but max is 0 [ 596.713286][ T5936] usb 7-1: config 3 has no interface number 0 [ 596.756937][ T5936] usb 7-1: config 3 interface 106 has no altsetting 0 [ 596.795211][ T5936] usb 7-1: New USB device found, idVendor=0d46, idProduct=2011, bcdDevice=e8.8a [ 596.829401][T13835] netlink: 'syz.0.1810': attribute type 4 has an invalid length. [ 596.899433][ T5936] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.919560][ T5936] usb 7-1: Product: syz [ 596.958109][ T5936] usb 7-1: Manufacturer: syz [ 597.005041][ T5936] usb 7-1: SerialNumber: syz [ 597.015429][ T923] usb 8-1: new high-speed USB device number 61 using dummy_hcd [ 597.277017][ T923] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 597.288533][ T923] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 597.325232][ T923] usb 8-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 597.354896][ T923] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 597.389945][ T923] usb 8-1: SerialNumber: syz [ 597.463067][ T5936] kobil_sct 7-1:3.106: required endpoints missing [ 597.520523][ T5936] usb 7-1: USB disconnect, device number 68 [ 597.632949][ T923] usb 8-1: 0:2 : does not exist [ 597.732945][ T923] usb 8-1: USB disconnect, device number 61 [ 597.916925][ T6135] udevd[6135]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 598.084747][ T5889] usb 2-1: USB disconnect, device number 101 [ 598.534024][T13857] xt_addrtype: ipv6 does not support BROADCAST matching [ 598.695619][ T923] usb 7-1: new high-speed USB device number 69 using dummy_hcd [ 598.855490][ T923] usb 7-1: Using ep0 maxpacket: 16 [ 598.876654][ T923] usb 7-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 598.917053][ T923] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 598.939721][ T923] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 598.968862][ T923] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 598.989100][ T923] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.011346][ T923] usb 7-1: Product: syz [ 599.022112][ T923] usb 7-1: Manufacturer: syz [ 599.033628][ T923] usb 7-1: SerialNumber: syz [ 599.035388][ T5889] usb 1-1: new high-speed USB device number 114 using dummy_hcd [ 599.167441][T13869] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 599.364053][T13870] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1820'. [ 599.455387][ T5889] usb 1-1: Using ep0 maxpacket: 32 [ 599.463788][ T5889] usb 1-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 599.481695][ T5889] usb 1-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 599.536996][ T5889] usb 1-1: config 0 interface 0 has no altsetting 0 [ 599.553023][ T923] usb 7-1: 0:2 : does not exist [ 599.568758][ T5889] usb 1-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 599.607062][ T5889] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.643560][ T5889] usb 1-1: config 0 descriptor?? [ 599.824390][T13850] tipc: Started in network mode [ 599.842407][T13850] tipc: Node identity 6e112c785f13, cluster identity 4711 [ 599.853470][T13850] tipc: Enabled bearer , priority 0 [ 599.906008][T13876] syzkaller0: entered promiscuous mode [ 599.923245][T13876] syzkaller0: entered allmulticast mode [ 599.979342][T13850] tipc: Resetting bearer [ 600.278101][ T5889] usbhid 1-1:0.0: can't add hid device: -71 [ 600.284236][ T5889] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 600.313421][ T5889] usb 1-1: USB disconnect, device number 114 [ 600.345525][ T5918] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 600.483643][T13849] tipc: Resetting bearer [ 600.524510][ T5918] usb 6-1: config 0 has no interfaces? [ 600.536027][ T5918] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 600.548632][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 600.557816][ T5918] usb 6-1: Product: syz [ 600.562133][ T5918] usb 6-1: Manufacturer: syz [ 600.570941][ T5918] usb 6-1: SerialNumber: syz [ 600.764813][T13849] tipc: Disabling bearer [ 600.779299][ T5918] usb 6-1: config 0 descriptor?? [ 601.023271][ T923] usb 7-1: 1:0: failed to get current value for ch 0 (-22) [ 601.079385][T13880] xt_nat: multiple ranges no longer supported [ 601.196941][ T923] usb 7-1: USB disconnect, device number 69 [ 601.221140][T13880] ip6t_srh: unknown srh match flags 5040 [ 601.629362][T13891] xt_hashlimit: overflow, rate too high: 0 [ 601.835528][ T48] usb 1-1: new full-speed USB device number 115 using dummy_hcd [ 601.876127][ T5936] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 602.105372][ T5936] usb 2-1: Using ep0 maxpacket: 8 [ 602.201278][ T5936] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 602.271533][ T5936] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 602.298871][ T5936] usb 2-1: config 1 has no interface number 1 [ 602.314396][ T5936] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 602.348534][ T5936] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 602.362326][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.388073][ T5936] usb 2-1: Manufacturer: ೵侻ਙȯﺨ╹沛ꁋ [ 602.629373][T13891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 602.682074][T13891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 602.779419][ T5936] usb 2-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 602.959272][ T5936] usb 2-1: USB disconnect, device number 102 [ 603.916952][T13901] binder: 13896:13901 ioctl c0306201 2000000003c0 returned -22 [ 604.602968][ T48] usb 1-1: unable to get BOS descriptor or descriptor too short [ 604.612531][ T48] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 604.625057][ T48] usb 1-1: can't read configurations, error -71 [ 604.794607][T13912] fuse: Unknown parameter '0x0000000000000005' [ 605.496145][ T5918] usb 6-1: USB disconnect, device number 91 [ 605.692587][T13931] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1835'. [ 605.874225][T13932] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1835'. [ 606.291504][T13946] loop2: detected capacity change from 0 to 7 [ 606.380466][ T5967] loop2: [ 606.387656][ T5967] loop2: partition table partially beyond EOD, truncated [ 606.418869][T13946] loop2: [ 606.422092][T13946] loop2: partition table partially beyond EOD, truncated [ 606.805582][ T5918] usb 1-1: new high-speed USB device number 117 using dummy_hcd [ 606.977240][ T5918] usb 1-1: New USB device found, idVendor=041e, idProduct=4053, bcdDevice=e6.56 [ 607.015898][ T5918] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.039019][ T5918] usb 1-1: config 0 descriptor?? [ 607.113014][ T5918] gspca_main: gspca_zc3xx-2.14.0 probing 041e:4053 [ 607.645920][ T5918] gspca_zc3xx: reg_w_i err -110 [ 607.672562][ T5918] gspca_zc3xx 1-1:0.0: probe with driver gspca_zc3xx failed with error -110 [ 607.850147][ T5918] usb 1-1: USB disconnect, device number 117 [ 607.885402][ T5889] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 607.957028][ T5917] usb 8-1: new high-speed USB device number 62 using dummy_hcd [ 608.236267][ T5889] usb 7-1: Using ep0 maxpacket: 8 [ 608.241589][ T5917] usb 8-1: Using ep0 maxpacket: 8 [ 608.258912][ T5889] usb 7-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 608.281490][ T5917] usb 8-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 608.293718][ T5917] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 608.304997][ T5889] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.323629][T13980] loop2: detected capacity change from 0 to 7 [ 608.337868][T13980] loop2: [ 608.341186][ T5917] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 608.355474][T13980] loop2: partition table partially beyond EOD, truncated [ 608.367567][ T5889] usb 7-1: config 0 descriptor?? [ 608.385516][ T5917] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 608.403939][T13982] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1853'. [ 608.413282][T13982] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1853'. [ 608.429877][ T5917] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.454415][ T5917] usb 8-1: Product: 줓ꁢ郰耄∬펮㊜ሞ❾㻉滞丈鵦螉ῐ㖕薺쀮癵ꇉ꽽ᢸ쳭 [ 608.545044][ T5917] usb 8-1: Manufacturer: 蚻函淌ﲡ䦇匿涀눩脝煼蜃썊빐⯀驍쾳鍞뛼靇㰨ᐍ빀纬ᯘᘝ䓧듙ᝊ墑睔ཽ佰틺ۚ河ｉ⩖᝴즇쐺翍뽝蜒咂짃梯ٻ⋑엪苃앚鷁᡾鎝அ쪪ទꚻ榒셒샞蕗簌淍﻾춡ㅌ⏬垫䩴夰챪⟹䭥㼊ዠ珨 [ 608.725716][ T5917] usb 8-1: SerialNumber: 旘뿸墢㽔⦑⅔緞썍ᥬ㣐쥝因햎圵૎늇콯⊶ﻇ㼻屑ଖ핯枃⥯춱櫊脅䰀￑狙埇ᗞĖผ仐鸀㋷阙䘎ᣌ騋 [ 609.247858][T14002] netlink: 'syz.5.1858': attribute type 10 has an invalid length. [ 609.354794][T14003] netlink: 'syz.5.1858': attribute type 10 has an invalid length. [ 609.403943][T14002] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1858'. [ 609.448813][T14003] netlink: 156 bytes leftover after parsing attributes in process `syz.5.1858'. [ 609.664191][ T5889] asix 7-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 609.718317][ T5889] asix 7-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 609.736597][ T5889] asix 7-1:0.0: probe with driver asix failed with error -71 [ 609.776092][ T5889] usb 7-1: USB disconnect, device number 70 [ 610.460348][T14014] Falling back ldisc for ttyS3. [ 610.599980][T14022] FAULT_INJECTION: forcing a failure. [ 610.599980][T14022] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 610.630827][T14022] CPU: 0 UID: 0 PID: 14022 Comm: syz.6.1864 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 610.630856][T14022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 610.630869][T14022] Call Trace: [ 610.630877][T14022] [ 610.630886][T14022] dump_stack_lvl+0x189/0x250 [ 610.630919][T14022] ? __pfx____ratelimit+0x10/0x10 [ 610.630946][T14022] ? __pfx_dump_stack_lvl+0x10/0x10 [ 610.630975][T14022] ? __pfx__printk+0x10/0x10 [ 610.630995][T14022] ? __might_fault+0xb0/0x130 [ 610.631024][T14022] should_fail_ex+0x414/0x560 [ 610.631051][T14022] _copy_from_iter+0x1db/0x16f0 [ 610.631090][T14022] ? irqentry_exit+0x74/0x90 [ 610.631117][T14022] ? __pfx__copy_from_iter+0x10/0x10 [ 610.631158][T14022] netlink_sendmsg+0x6b2/0xb30 [ 610.631188][T14022] ? __pfx_netlink_sendmsg+0x10/0x10 [ 610.631211][T14022] ? aa_sock_msg_perm+0x94/0x160 [ 610.631236][T14022] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 610.631259][T14022] ? __pfx_netlink_sendmsg+0x10/0x10 [ 610.631281][T14022] __sock_sendmsg+0x219/0x270 [ 610.631311][T14022] ____sys_sendmsg+0x505/0x830 [ 610.631338][T14022] ? __pfx_____sys_sendmsg+0x10/0x10 [ 610.631369][T14022] ? import_iovec+0x74/0xa0 [ 610.631389][T14022] ___sys_sendmsg+0x21f/0x2a0 [ 610.631414][T14022] ? __pfx____sys_sendmsg+0x10/0x10 [ 610.631469][T14022] ? __fget_files+0x2a/0x420 [ 610.631489][T14022] ? __fget_files+0x3a0/0x420 [ 610.631519][T14022] __x64_sys_sendmsg+0x19b/0x260 [ 610.631544][T14022] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 610.631575][T14022] ? __pfx_ksys_write+0x10/0x10 [ 610.631590][T14022] ? rcu_is_watching+0x15/0xb0 [ 610.631622][T14022] ? do_syscall_64+0xbe/0x3b0 [ 610.631654][T14022] do_syscall_64+0xfa/0x3b0 [ 610.631679][T14022] ? lockdep_hardirqs_on+0x9c/0x150 [ 610.631705][T14022] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.631740][T14022] ? clear_bhb_loop+0x60/0xb0 [ 610.631764][T14022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.631802][T14022] RIP: 0033:0x7fc97d38e929 [ 610.631821][T14022] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 610.631841][T14022] RSP: 002b:00007fc97b1f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 610.631863][T14022] RAX: ffffffffffffffda RBX: 00007fc97d5b5fa0 RCX: 00007fc97d38e929 [ 610.631880][T14022] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000000e [ 610.631894][T14022] RBP: 00007fc97b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 610.631907][T14022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 610.631920][T14022] R13: 0000000000000000 R14: 00007fc97d5b5fa0 R15: 00007fc97d6dfa28 [ 610.631953][T14022] [ 610.898441][ C0] vkms_vblank_simulate: vblank timer overrun [ 611.045049][ T5917] usb 8-1: 0:2 : does not exist [ 611.066492][ T5917] usb 8-1: USB disconnect, device number 62 [ 611.344527][T14027] loop2: detected capacity change from 0 to 7 [ 611.353098][T14027] loop2: [ 611.358411][T14027] loop2: partition table partially beyond EOD, truncated [ 611.550287][ T6135] udevd[6135]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 611.632884][T14032] loop6: detected capacity change from 0 to 1 [ 611.677263][ T5972] loop6: [POWERTEC] p1 p2 [ 611.687383][ T5972] loop6: p1 size 20971520 extends beyond EOD, truncated [ 611.714951][ T5972] loop6: p2 start 536870912 is beyond EOD, truncated [ 611.760711][T14032] loop6: [POWERTEC] p1 p2 [ 611.788064][T14039] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 611.797444][T14032] loop6: p1 size 20971520 extends beyond EOD, truncated [ 611.859555][T14032] loop6: p2 start 536870912 is beyond EOD, truncated [ 612.040037][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 612.122572][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 612.168303][ T30] audit: type=1326 audit(1751225821.508:777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14050 comm="syz.6.1874" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc97d38e929 code=0x0 [ 612.326073][T14056] FAULT_INJECTION: forcing a failure. [ 612.326073][T14056] name failslab, interval 1, probability 0, space 0, times 0 [ 612.340900][T14056] CPU: 0 UID: 0 PID: 14056 Comm: syz.0.1877 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 612.340939][T14056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 612.340953][T14056] Call Trace: [ 612.340963][T14056] [ 612.340973][T14056] dump_stack_lvl+0x189/0x250 [ 612.341012][T14056] ? __pfx____ratelimit+0x10/0x10 [ 612.341043][T14056] ? __pfx_dump_stack_lvl+0x10/0x10 [ 612.341077][T14056] ? __pfx__printk+0x10/0x10 [ 612.341108][T14056] ? ref_tracker_alloc+0x318/0x460 [ 612.341140][T14056] should_fail_ex+0x414/0x560 [ 612.341172][T14056] should_failslab+0xa8/0x100 [ 612.341197][T14056] kmem_cache_alloc_noprof+0x73/0x3c0 [ 612.341230][T14056] ? skb_clone+0x212/0x3a0 [ 612.341263][T14056] skb_clone+0x212/0x3a0 [ 612.341294][T14056] __netlink_deliver_tap+0x404/0x850 [ 612.341332][T14056] ? netlink_deliver_tap+0x2e/0x1b0 [ 612.341358][T14056] netlink_deliver_tap+0x19c/0x1b0 [ 612.341384][T14056] netlink_unicast+0x72f/0x8d0 [ 612.341417][T14056] netlink_sendmsg+0x805/0xb30 [ 612.341453][T14056] ? __pfx_netlink_sendmsg+0x10/0x10 [ 612.341481][T14056] ? aa_sock_msg_perm+0x94/0x160 [ 612.341510][T14056] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 612.341537][T14056] ? __pfx_netlink_sendmsg+0x10/0x10 [ 612.341563][T14056] __sock_sendmsg+0x219/0x270 [ 612.341598][T14056] ____sys_sendmsg+0x505/0x830 [ 612.341631][T14056] ? __pfx_____sys_sendmsg+0x10/0x10 [ 612.341664][T14056] ? import_iovec+0x74/0xa0 [ 612.341688][T14056] ___sys_sendmsg+0x21f/0x2a0 [ 612.341717][T14056] ? __pfx____sys_sendmsg+0x10/0x10 [ 612.341783][T14056] ? __fget_files+0x2a/0x420 [ 612.341807][T14056] ? __fget_files+0x3a0/0x420 [ 612.341843][T14056] __x64_sys_sendmsg+0x19b/0x260 [ 612.341873][T14056] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 612.341917][T14056] ? __pfx_ksys_write+0x10/0x10 [ 612.341936][T14056] ? rcu_is_watching+0x15/0xb0 [ 612.341976][T14056] ? do_syscall_64+0xbe/0x3b0 [ 612.342013][T14056] do_syscall_64+0xfa/0x3b0 [ 612.342044][T14056] ? lockdep_hardirqs_on+0x9c/0x150 [ 612.342074][T14056] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.342096][T14056] ? clear_bhb_loop+0x60/0xb0 [ 612.342123][T14056] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 612.342145][T14056] RIP: 0033:0x7fe3e1d8e929 [ 612.342165][T14056] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 612.342185][T14056] RSP: 002b:00007fe3e2b9e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 612.342209][T14056] RAX: ffffffffffffffda RBX: 00007fe3e1fb5fa0 RCX: 00007fe3e1d8e929 [ 612.342225][T14056] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 000000000000000e [ 612.342239][T14056] RBP: 00007fe3e2b9e090 R08: 0000000000000000 R09: 0000000000000000 [ 612.342252][T14056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 612.342265][T14056] R13: 0000000000000000 R14: 00007fe3e1fb5fa0 R15: 00007fe3e20dfa28 [ 612.342298][T14056] [ 612.632155][ C0] vkms_vblank_simulate: vblank timer overrun [ 612.673667][T14056] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 612.722719][T14060] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1876'. [ 612.751724][T14060] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 612.772326][T14060] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 613.474394][T14075] sg_write: data in/out 252/19 bytes for SCSI command 0x0-- guessing data in; [ 613.474394][T14075] program syz.7.1880 not setting count and/or reply_len properly [ 613.668303][T14072] netlink: 'syz.1.1878': attribute type 5 has an invalid length. [ 614.224817][T14090] loop6: detected capacity change from 0 to 1 [ 614.252809][T14090] loop6: [POWERTEC] p1 p2 [ 614.262106][T14090] loop6: p1 size 20971520 extends beyond EOD, truncated [ 614.272567][T14090] loop6: p2 start 536870912 is beyond EOD, truncated [ 614.431535][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 615.325406][ T923] usb 8-1: new high-speed USB device number 63 using dummy_hcd [ 615.492842][T14109] xt_hashlimit: max too large, truncated to 1048576 [ 615.535560][ T923] usb 8-1: Using ep0 maxpacket: 8 [ 615.601261][ T923] usb 8-1: config 0 has an invalid interface number: 235 but max is 0 [ 615.639089][ T923] usb 8-1: config 0 has no interface number 0 [ 615.650651][ T923] usb 8-1: config 0 interface 235 has no altsetting 0 [ 615.672984][T14113] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1891'. [ 615.677427][ T923] usb 8-1: New USB device found, idVendor=0a12, idProduct=5d10, bcdDevice=92.0d [ 615.705229][ T923] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.720001][T14113] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1891'. [ 615.744443][ T923] usb 8-1: Product: syz [ 615.746377][T14113] unsupported nlmsg_type 40 [ 615.754622][ T923] usb 8-1: Manufacturer: syz [ 615.761669][ T923] usb 8-1: SerialNumber: syz [ 615.780457][ T923] usb 8-1: config 0 descriptor?? [ 615.991080][ T923] usb 8-1: USB disconnect, device number 63 [ 616.225370][ T5917] usb 1-1: new high-speed USB device number 118 using dummy_hcd [ 616.233125][ T5889] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 616.399265][ T5889] usb 2-1: Using ep0 maxpacket: 8 [ 616.404916][ T5917] usb 1-1: config 0 has no interfaces? [ 616.428336][ T5917] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 616.437626][ T5917] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 616.447094][ T5889] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 616.467965][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 616.483399][ T5917] usb 1-1: Product: syz [ 616.491387][ T5917] usb 1-1: Manufacturer: syz [ 616.496334][ T5889] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 616.508322][ T5917] usb 1-1: SerialNumber: syz [ 616.514338][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 616.526565][ T5917] usb 1-1: config 0 descriptor?? [ 616.548298][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 616.592487][ T5889] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 616.600097][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 616.612148][ T5889] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 616.633794][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 616.647284][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 616.668512][ T5889] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 616.676766][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 616.705477][ T5889] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 616.777771][ T5917] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 616.796931][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 616.933586][ T5889] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 616.984188][ T5889] usb 2-1: string descriptor 0 read error: -22 [ 616.990941][ T5889] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 617.001927][ T5889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.012768][ T5917] usb 6-1: Using ep0 maxpacket: 32 [ 617.032232][ T5917] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 617.057891][ T5917] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 617.068737][ T5917] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 617.080290][ T5917] usb 6-1: Product: syz [ 617.084917][ T5889] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 617.093870][ T5917] usb 6-1: Manufacturer: syz [ 617.100782][ T5917] usb 6-1: SerialNumber: syz [ 617.142233][ T5917] usb 6-1: config 0 descriptor?? [ 617.203859][T14124] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 617.333732][ T5917] hub 6-1:0.0: bad descriptor, ignoring hub [ 617.361956][ T5917] hub 6-1:0.0: probe with driver hub failed with error -5 [ 617.367988][T14136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 617.380043][T14136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 617.448571][ T5889] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 617.502650][T14137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 617.537940][T14137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 617.649552][ T5917] usb 6-1: USB disconnect, device number 92 [ 617.656407][T14124] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 617.729871][T14124] kvm: pic: level sensitive irq not supported [ 617.732542][T14124] kvm: pic: non byte read [ 617.758242][ T5889] usb 7-1: config 0 has no interfaces? [ 617.786718][ T5889] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 617.800663][ T5889] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.816197][ T5889] usb 7-1: Product: syz [ 617.828020][ T5889] usb 7-1: Manufacturer: syz [ 617.835735][T14124] kvm: pic: level sensitive irq not supported [ 617.835804][T14124] kvm: pic: non byte read [ 617.878608][ T5889] usb 7-1: SerialNumber: syz [ 617.934215][ T5889] usb 7-1: config 0 descriptor?? [ 618.267468][T14134] xt_nat: multiple ranges no longer supported [ 618.689531][T14142] FAULT_INJECTION: forcing a failure. [ 618.689531][T14142] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 618.712900][T14140] ip6t_srh: unknown srh match flags 5040 [ 618.734223][T14142] CPU: 0 UID: 0 PID: 14142 Comm: syz.5.1898 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 618.734254][T14142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 618.734268][T14142] Call Trace: [ 618.734278][T14142] [ 618.734288][T14142] dump_stack_lvl+0x189/0x250 [ 618.734327][T14142] ? __pfx____ratelimit+0x10/0x10 [ 618.734370][T14142] ? __pfx_dump_stack_lvl+0x10/0x10 [ 618.734401][T14142] ? __pfx__printk+0x10/0x10 [ 618.734423][T14142] ? __might_fault+0xb0/0x130 [ 618.734454][T14142] should_fail_ex+0x414/0x560 [ 618.734484][T14142] _copy_from_user+0x2d/0xb0 [ 618.734505][T14142] ___sys_sendmsg+0x158/0x2a0 [ 618.734532][T14142] ? __pfx____sys_sendmsg+0x10/0x10 [ 618.734590][T14142] ? __fget_files+0x2a/0x420 [ 618.734611][T14142] ? __fget_files+0x3a0/0x420 [ 618.734644][T14142] __sys_sendmmsg+0x227/0x430 [ 618.734674][T14142] ? __pfx___sys_sendmmsg+0x10/0x10 [ 618.734696][T14142] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 618.734759][T14142] ? ksys_write+0x22a/0x250 [ 618.734779][T14142] ? __pfx_ksys_write+0x10/0x10 [ 618.734796][T14142] ? rcu_is_watching+0x15/0xb0 [ 618.734833][T14142] __x64_sys_sendmmsg+0xa0/0xc0 [ 618.734860][T14142] do_syscall_64+0xfa/0x3b0 [ 618.734889][T14142] ? lockdep_hardirqs_on+0x9c/0x150 [ 618.734916][T14142] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.734937][T14142] ? clear_bhb_loop+0x60/0xb0 [ 618.734961][T14142] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 618.734981][T14142] RIP: 0033:0x7f36db78e929 [ 618.734999][T14142] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 618.735017][T14142] RSP: 002b:00007f36dc590038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 618.735039][T14142] RAX: ffffffffffffffda RBX: 00007f36db9b5fa0 RCX: 00007f36db78e929 [ 618.735055][T14142] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 618.735069][T14142] RBP: 00007f36dc590090 R08: 0000000000000000 R09: 0000000000000000 [ 618.735082][T14142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 618.735094][T14142] R13: 0000000000000000 R14: 00007f36db9b5fa0 R15: 00007f36dbadfa28 [ 618.735124][T14142] [ 619.115333][ T5917] usb 1-1: USB disconnect, device number 118 [ 619.467812][T14148] sg_write: data in/out 252/19 bytes for SCSI command 0x0-- guessing data in; [ 619.467812][T14148] program syz.5.1899 not setting count and/or reply_len properly [ 620.324255][T14154] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 620.389113][ T923] usb 2-1: USB disconnect, device number 103 [ 620.569996][ T5917] usb 7-1: USB disconnect, device number 71 [ 620.872743][T14164] bridge0: entered promiscuous mode [ 620.882617][T14164] bond0: entered promiscuous mode [ 620.887882][T14164] bond_slave_0: entered promiscuous mode [ 620.893711][ T5936] usb 1-1: new low-speed USB device number 119 using dummy_hcd [ 620.894260][T14164] bond_slave_1: entered promiscuous mode [ 620.926927][T14164] hsr1: entered allmulticast mode [ 620.936784][T14164] bridge0: entered allmulticast mode [ 620.947351][T14164] bond0: entered allmulticast mode [ 620.952516][T14164] bond_slave_0: entered allmulticast mode [ 620.960590][ T923] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 621.180512][T14169] sg_write: data in/out 252/19 bytes for SCSI command 0x0-- guessing data in; [ 621.180512][T14169] program syz.6.1905 not setting count and/or reply_len properly [ 621.215467][ T923] usb 2-1: Using ep0 maxpacket: 32 [ 621.215992][T14164] bond_slave_1: entered allmulticast mode [ 621.499115][ T923] usb 2-1: config 0 interface 0 has no altsetting 0 [ 621.543177][ T5936] usb 1-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 621.683275][ T5936] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.700106][ T923] usb 2-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 621.710736][ T923] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.826854][ T923] usb 2-1: Product: syz [ 621.834762][ T5936] usb 1-1: config 0 descriptor?? [ 621.855772][ T923] usb 2-1: Manufacturer: syz [ 621.880249][ T923] usb 2-1: SerialNumber: syz [ 621.909196][ T923] usb 2-1: config 0 descriptor?? [ 622.236193][ T923] gs_usb 2-1:0.0: Couldn't get device config: (err=-71) [ 622.313700][ T923] gs_usb 2-1:0.0: probe with driver gs_usb failed with error -71 [ 622.657115][ T923] usb 2-1: USB disconnect, device number 104 [ 622.820873][T14156] binder: 14155:14156 ioctl c0306201 200000000700 returned -14 [ 622.920431][T14184] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1908'. [ 622.943664][T14184] netlink: 184 bytes leftover after parsing attributes in process `syz.5.1908'. [ 623.364691][T14188] FAULT_INJECTION: forcing a failure. [ 623.364691][T14188] name failslab, interval 1, probability 0, space 0, times 0 [ 623.429053][T14188] CPU: 0 UID: 0 PID: 14188 Comm: syz.5.1909 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 623.429087][T14188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 623.429111][T14188] Call Trace: [ 623.429119][T14188] [ 623.429128][T14188] dump_stack_lvl+0x189/0x250 [ 623.429180][T14188] ? __pfx____ratelimit+0x10/0x10 [ 623.429200][T14188] ? __pfx_dump_stack_lvl+0x10/0x10 [ 623.429223][T14188] ? __pfx__printk+0x10/0x10 [ 623.429263][T14188] ? __pfx___might_resched+0x10/0x10 [ 623.429313][T14188] should_fail_ex+0x414/0x560 [ 623.429342][T14188] should_failslab+0xa8/0x100 [ 623.429358][T14188] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 623.429378][T14188] ? __alloc_skb+0x112/0x2d0 [ 623.429404][T14188] __alloc_skb+0x112/0x2d0 [ 623.429430][T14188] netlink_sendmsg+0x5c6/0xb30 [ 623.429460][T14188] ? __pfx_netlink_sendmsg+0x10/0x10 [ 623.429485][T14188] ? aa_sock_msg_perm+0x94/0x160 [ 623.429504][T14188] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 623.429522][T14188] ? __pfx_netlink_sendmsg+0x10/0x10 [ 623.429539][T14188] __sock_sendmsg+0x219/0x270 [ 623.429574][T14188] ____sys_sendmsg+0x52d/0x830 [ 623.429603][T14188] ? __pfx_____sys_sendmsg+0x10/0x10 [ 623.429634][T14188] ? import_iovec+0x74/0xa0 [ 623.429650][T14188] ___sys_sendmsg+0x21f/0x2a0 [ 623.429668][T14188] ? __pfx____sys_sendmsg+0x10/0x10 [ 623.429721][T14188] ? __fget_files+0x2a/0x420 [ 623.429742][T14188] ? __fget_files+0x3a0/0x420 [ 623.429772][T14188] __sys_sendmmsg+0x227/0x430 [ 623.429797][T14188] ? __pfx___sys_sendmmsg+0x10/0x10 [ 623.429811][T14188] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 623.429858][T14188] ? ksys_write+0x22a/0x250 [ 623.429880][T14188] ? __pfx_ksys_write+0x10/0x10 [ 623.429895][T14188] ? rcu_is_watching+0x15/0xb0 [ 623.429931][T14188] __x64_sys_sendmmsg+0xa0/0xc0 [ 623.429950][T14188] do_syscall_64+0xfa/0x3b0 [ 623.429970][T14188] ? lockdep_hardirqs_on+0x9c/0x150 [ 623.429990][T14188] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.430011][T14188] ? clear_bhb_loop+0x60/0xb0 [ 623.430036][T14188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.430054][T14188] RIP: 0033:0x7f36db78e929 [ 623.430071][T14188] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 623.430088][T14188] RSP: 002b:00007f36dc590038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 623.430103][T14188] RAX: ffffffffffffffda RBX: 00007f36db9b5fa0 RCX: 00007f36db78e929 [ 623.430114][T14188] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 623.430124][T14188] RBP: 00007f36dc590090 R08: 0000000000000000 R09: 0000000000000000 [ 623.430133][T14188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 623.430143][T14188] R13: 0000000000000000 R14: 00007f36db9b5fa0 R15: 00007f36dbadfa28 [ 623.430175][T14188] [ 624.144873][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.151328][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.406301][ T48] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 624.748768][ T5936] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 624.776062][ T5936] asix 1-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 624.844856][ T5936] asix 1-1:0.0: probe with driver asix failed with error -71 [ 624.870190][ T5936] usb 1-1: USB disconnect, device number 119 [ 625.005766][ T5918] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 625.060546][ T48] usb 7-1: config 0 has no interfaces? [ 625.076685][ T48] usb 7-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 625.100804][ T48] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.120135][ T48] usb 7-1: Product: syz [ 625.124452][ T48] usb 7-1: Manufacturer: syz [ 625.129717][ T48] usb 7-1: SerialNumber: syz [ 625.141635][ T48] usb 7-1: config 0 descriptor?? [ 625.185523][ T5918] usb 2-1: Using ep0 maxpacket: 32 [ 625.195533][T11205] usb 8-1: new high-speed USB device number 64 using dummy_hcd [ 625.210308][ T5918] usb 2-1: config 0 has an invalid interface number: 231 but max is 0 [ 625.222385][ T30] audit: type=1326 audit(1751225834.558:778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14194 comm="syz.5.1912" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f36db78e929 code=0x0 [ 625.244269][ T5918] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 625.268490][ T5918] usb 2-1: config 0 has no interface number 0 [ 625.281998][ T5918] usb 2-1: config 0 interface 231 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 625.301691][ T5918] usb 2-1: config 0 interface 231 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 625.336940][ T5918] usb 2-1: New USB device found, idVendor=d024, idProduct=5e5a, bcdDevice=16.a9 [ 625.361566][T11205] usb 8-1: config 0 has an invalid interface number: 101 but max is 0 [ 625.361923][ T5918] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.372296][T11205] usb 8-1: config 0 has no interface number 0 [ 625.426855][ T5918] usb 2-1: Product: syz [ 625.434581][T11205] usb 8-1: New USB device found, idVendor=093a, idProduct=2623, bcdDevice=b2.14 [ 625.448270][T11205] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.463047][T11205] usb 8-1: Product: syz [ 625.475485][ T5918] usb 2-1: Manufacturer: syz [ 625.480960][ T5918] usb 2-1: SerialNumber: syz [ 625.523822][ T5918] usb 2-1: config 0 descriptor?? [ 625.525399][T11205] usb 8-1: Manufacturer: syz [ 625.557900][T14205] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 625.601953][T11205] usb 8-1: SerialNumber: syz [ 625.610097][ T5918] usb-storage 2-1:0.231: USB Mass Storage device detected [ 625.638825][T11205] usb 8-1: config 0 descriptor?? [ 625.671847][T11205] gspca_main: gspca_pac7302-2.14.0 probing 093a:2623 [ 625.907314][T14205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 625.951915][T14205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.136155][T14218] sg_write: data in/out 252/19 bytes for SCSI command 0x0-- guessing data in; [ 626.136155][T14218] program syz.0.1916 not setting count and/or reply_len properly [ 626.305570][ T5917] usb 2-1: USB disconnect, device number 105 [ 626.595899][T14208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 626.604698][T14208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 626.691528][T11205] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 626.706201][T11205] gspca_pac7302 8-1:0.101: probe with driver gspca_pac7302 failed with error -110 [ 627.558535][T11205] usb 7-1: USB disconnect, device number 72 [ 627.904530][ T5917] usb 8-1: USB disconnect, device number 64 [ 628.555457][ T5917] usb 8-1: new high-speed USB device number 65 using dummy_hcd [ 628.735375][ T5917] usb 8-1: device descriptor read/64, error -71 [ 629.005731][ T5917] usb 8-1: new high-speed USB device number 66 using dummy_hcd [ 629.048195][T14258] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1925'. [ 629.110910][T14258] netlink: 60 bytes leftover after parsing attributes in process `syz.5.1925'. [ 629.175432][ T5917] usb 8-1: device descriptor read/64, error -71 [ 629.295871][ T5917] usb usb8-port1: attempt power cycle [ 629.665533][ T5917] usb 8-1: new high-speed USB device number 67 using dummy_hcd [ 629.685949][ T5917] usb 8-1: device descriptor read/8, error -71 [ 629.747420][T14275] ptrace attach of "./syz-executor exec"[7991] was attempted by "./syz-executor exec"[14275] [ 629.774248][T14275] netlink: 'syz.6.1931': attribute type 21 has an invalid length. [ 629.786249][T14275] netlink: 128 bytes leftover after parsing attributes in process `syz.6.1931'. [ 629.798539][T14275] netlink: 'syz.6.1931': attribute type 4 has an invalid length. [ 629.807578][T14275] netlink: 3 bytes leftover after parsing attributes in process `syz.6.1931'. [ 629.846346][ T48] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 629.935556][ T5917] usb 8-1: new high-speed USB device number 68 using dummy_hcd [ 629.966331][ T5917] usb 8-1: device descriptor read/8, error -71 [ 629.999518][ T48] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 245, setting to 64 [ 630.015569][ T48] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 630.025013][ T48] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 630.043853][ T48] usb 2-1: config 0 descriptor?? [ 630.089180][ T5917] usb usb8-port1: unable to enumerate USB device [ 630.344034][T14280] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1932'. [ 630.574582][T14280] 8021q: adding VLAN 0 to HW filter on device bond1 [ 630.793933][ T48] ath6kl: Failed to submit usb control message: -71 [ 630.814343][ T48] ath6kl: unable to send the bmi data to the device: -71 [ 630.857871][ T48] ath6kl: Unable to send get target info: -71 [ 630.868031][T11205] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 630.893963][ T48] ath6kl: Failed to init ath6kl core: -71 [ 630.926801][ T48] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 630.952403][ T48] usb 2-1: USB disconnect, device number 106 [ 631.037708][T11205] usb 6-1: unable to get BOS descriptor or descriptor too short [ 631.049706][T11205] usb 6-1: config index 0 descriptor too short (expected 65, got 45) [ 631.058838][T11205] usb 6-1: config 1 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 192, changing to 11 [ 631.072642][T11205] usb 6-1: config 1 interface 0 altsetting 9 endpoint 0x2 has an invalid bInterval 250, changing to 11 [ 631.119968][T11205] usb 6-1: config 1 interface 0 has no altsetting 0 [ 631.136676][T11205] usb 6-1: New USB device found, idVendor=1b96, idProduct=000b, bcdDevice= 0.40 [ 631.165457][T11205] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 631.173499][T11205] usb 6-1: Product: 㐊 [ 631.195965][T11205] usb 6-1: Manufacturer: 謒嫩뷓ꞝۅ袗昗킙醽弪Ὠ膨悢갛칀⸪팭≥⓫腈푗腢Ü멸쿲馻䨝堻盏ᛓઝ㑖紐쓾⥩葽昜弓诋ꦬ즖뻑Ꚃ䍹轙 [ 631.239265][T11205] usb 6-1: SerialNumber: 倊 [ 631.276173][ T48] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 631.415687][ T48] usb 2-1: device descriptor read/64, error -71 [ 631.469034][T11205] usbhid 6-1:1.0: can't add hid device: -71 [ 631.475080][T11205] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 631.514097][T11205] usb 6-1: USB disconnect, device number 93 [ 631.657630][ T48] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 631.685546][ T5918] usb 1-1: new high-speed USB device number 120 using dummy_hcd [ 631.795401][ T48] usb 2-1: device descriptor read/64, error -71 [ 631.835449][ T5896] usb 8-1: new full-speed USB device number 69 using dummy_hcd [ 631.855643][ T5918] usb 1-1: Using ep0 maxpacket: 32 [ 631.861879][ T5918] usb 1-1: too many configurations: 197, using maximum allowed: 8 [ 631.872811][ T5918] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 631.888589][ T5918] usb 1-1: can't read configurations, error -61 [ 631.906505][ T48] usb usb2-port1: attempt power cycle [ 631.999264][ T5896] usb 8-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 632.018774][ T5896] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 632.037224][ T5896] usb 8-1: Product: syz [ 632.044521][ T5918] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 632.045672][ T5896] usb 8-1: Manufacturer: syz [ 632.076883][ T5896] usb 8-1: SerialNumber: syz [ 632.100053][ T5896] usb 8-1: config 0 descriptor?? [ 632.205353][ T5918] usb 1-1: Using ep0 maxpacket: 32 [ 632.227209][ T5918] usb 1-1: too many configurations: 197, using maximum allowed: 8 [ 632.277530][ T48] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 632.288466][ T5918] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 632.448303][ T5918] usb 1-1: can't read configurations, error -61 [ 632.462417][ T48] usb 2-1: device descriptor read/8, error -71 [ 632.484768][ T5918] usb usb1-port1: attempt power cycle [ 632.706829][ T48] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 632.747036][T14317] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 632.766329][ T48] usb 2-1: device descriptor read/8, error -71 [ 632.804934][T14317] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 632.872350][ T5896] airspy 8-1:0.0: Board ID: 00 [ 632.879443][ T48] usb usb2-port1: unable to enumerate USB device [ 632.886768][ T5918] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 632.905227][ T5896] airspy 8-1:0.0: Firmware version: [ 632.922461][ T5918] usb 1-1: Using ep0 maxpacket: 32 [ 632.931912][ T5918] usb 1-1: too many configurations: 197, using maximum allowed: 8 [ 632.954882][ T5918] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 632.989457][ T5918] usb 1-1: can't read configurations, error -61 [ 633.135475][ T5918] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 633.176985][ T5918] usb 1-1: Using ep0 maxpacket: 32 [ 633.198895][ T5918] usb 1-1: too many configurations: 197, using maximum allowed: 8 [ 633.290560][ T5918] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 633.303608][ T5918] usb 1-1: can't read configurations, error -61 [ 633.320769][ T5918] usb usb1-port1: unable to enumerate USB device [ 633.784115][ T5896] airspy 8-1:0.0: usb_control_msg() failed -71 request 0f [ 633.825806][ T5896] airspy 8-1:0.0: Registered as swradio24 [ 633.875344][ T5896] airspy 8-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 633.916042][ T5896] usb 8-1: USB disconnect, device number 69 [ 634.656187][T14357] binder: 14355:14357 ioctl c0306201 2000000003c0 returned -14 [ 634.671387][T14357] binder: 14355:14357 ioctl 4014563c 200000000140 returned -22 [ 634.796511][ T5917] usb 2-1: new full-speed USB device number 111 using dummy_hcd [ 634.875659][ T5896] usb 6-1: new full-speed USB device number 94 using dummy_hcd [ 635.050642][ T5917] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0047, bcdDevice=29.40 [ 635.062309][ T5917] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 635.078384][ T5896] usb 6-1: not running at top speed; connect to a high speed hub [ 635.099799][ T5917] usb 2-1: config 0 descriptor?? [ 635.141880][ T5896] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 635.145495][ T5918] usb 1-1: new full-speed USB device number 124 using dummy_hcd [ 635.155856][ T5896] usb 6-1: config 0 has no interface number 0 [ 635.177969][T14368] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1953'. [ 635.182246][ T5896] usb 6-1: config 0 interface 1 has no altsetting 0 [ 635.207176][ T5896] usb 6-1: New USB device found, idVendor=041e, idProduct=0005, bcdDevice=58.e0 [ 635.216887][ T5896] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 635.230495][ T5896] usb 6-1: Product: syz [ 635.240381][ T5896] usb 6-1: Manufacturer: syz [ 635.250585][ T5896] usb 6-1: SerialNumber: syz [ 635.271178][ T5896] usb 6-1: config 0 descriptor?? [ 635.317678][ T5918] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 635.340882][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 635.373835][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 635.401412][ T5918] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 635.450144][ T5918] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 635.471958][ T5918] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 635.493693][ T5918] usb 1-1: Manufacturer: syz [ 635.597612][ T5896] snd-usb-audio 6-1:0.1: probe with driver snd-usb-audio failed with error -22 [ 635.611904][ T5918] usb 1-1: config 0 descriptor?? [ 635.681952][ T5896] usb 6-1: USB disconnect, device number 94 [ 635.759051][ T6135] udevd[6135]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 635.880960][ T5889] usb 2-1: USB disconnect, device number 111 [ 635.895542][ T48] usb 7-1: new high-speed USB device number 73 using dummy_hcd [ 636.026919][ T5918] rc_core: IR keymap rc-hauppauge not found [ 636.032912][ T5918] Registered IR keymap rc-empty [ 636.074986][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 636.083546][ T48] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 636.105347][ T48] usb 7-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 636.136542][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 636.161078][ T48] usb 7-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 636.176592][ T5918] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 636.190889][ T5918] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input58 [ 636.217967][ T48] usb 7-1: config 220 has no interface number 2 [ 636.224368][ T48] usb 7-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 636.283874][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 636.529421][ T5889] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 636.588967][ T48] usb 7-1: config 220 interface 0 has no altsetting 0 [ 636.625720][ T48] usb 7-1: config 220 interface 76 has no altsetting 0 [ 636.642983][ T48] usb 7-1: config 220 interface 1 has no altsetting 0 [ 636.650574][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 636.679918][ T48] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 636.689954][ T48] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.715418][ T48] usb 7-1: Product: syz [ 636.719654][ T48] usb 7-1: Manufacturer: syz [ 636.746372][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 636.747813][ T48] usb 7-1: SerialNumber: syz [ 636.822240][ T5889] usb 2-1: Using ep0 maxpacket: 8 [ 636.840848][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 636.881799][ T5889] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 636.965434][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.024412][ T5889] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 637.050253][ T5889] usb 2-1: Product: syz [ 637.055459][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.064686][ T5889] usb 2-1: Manufacturer: syz [ 637.100133][ T5889] usb 2-1: SerialNumber: syz [ 637.119873][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.156916][ T5889] usb 2-1: config 0 descriptor?? [ 637.215461][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.265579][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.305405][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 637.417995][ T5889] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 637.434368][ T5918] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 637.444799][ T5918] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 637.929676][ T923] usb 1-1: USB disconnect, device number 124 [ 638.540611][T14405] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1961'. [ 638.866318][ T5889] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 638.993258][ T5889] dvbdev: DVB: registering new adapter (TerraTec NOXON DAB Stick) [ 639.065368][ T5889] usb 2-1: media controller created [ 639.173826][ T5889] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 639.297616][T14414] input: syz0 as /devices/virtual/input/input59 [ 639.489314][ T923] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 639.550074][ T5889] i2c i2c-2: Added multiplexed i2c bus 3 [ 639.556742][ T5889] rtl2832 2-0010: Realtek RTL2832 successfully attached [ 639.570591][ T5889] usb 2-1: DVB: registering adapter 2 frontend 0 (Realtek RTL2832 (DVB-T))... [ 639.580987][ T5889] dvbdev: dvb_create_media_entity: media entity 'Realtek RTL2832 (DVB-T)' registered. [ 639.686626][T14420] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1966'. [ 639.739627][ T48] usb 7-1: Found UVC 7.01 device syz (8086:0b07) [ 639.750635][ T923] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 639.783030][ T48] usb 7-1: No valid video chain found. [ 639.834212][ T5889] DVB: Unable to find symbol r820t_attach() [ 639.855480][ T923] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 639.865688][ T48] usb 7-1: selecting invalid altsetting 0 [ 639.886838][ T923] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 639.920368][ T48] usb 7-1: selecting invalid altsetting 0 [ 639.926515][ T923] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 639.940445][ T48] usbtest 7-1:220.1: probe with driver usbtest failed with error -22 [ 639.964085][T14412] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 640.001478][ T48] usb 7-1: USB disconnect, device number 73 [ 640.021720][ T923] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 640.116822][T14425] netlink: 'syz.0.1968': attribute type 5 has an invalid length. [ 640.211399][T14412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 640.225904][ T5889] usb 2-1: USB disconnect, device number 112 [ 640.268996][T14412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 640.321781][ T923] usb 6-1: USB disconnect, device number 95 [ 640.527369][ T5934] usb 1-1: new full-speed USB device number 125 using dummy_hcd [ 640.646013][ T5889] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 640.717186][ T5934] usb 1-1: config 0 has an invalid interface number: 207 but max is 0 [ 640.725661][ T5934] usb 1-1: config 0 has no interface number 0 [ 640.753142][ T5934] usb 1-1: New USB device found, idVendor=12d1, idProduct=ed56, bcdDevice=46.dd [ 640.767761][ T5934] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 640.778473][ T5934] usb 1-1: Product: syz [ 640.782715][ T5934] usb 1-1: Manufacturer: syz [ 640.789800][ T5934] usb 1-1: SerialNumber: syz [ 640.802336][ T5934] usb 1-1: config 0 descriptor?? [ 640.807429][ T5889] usb 2-1: device descriptor read/64, error -71 [ 640.824529][ T5934] qmi_wwan 1-1:0.207: probe with driver qmi_wwan failed with error -22 [ 641.055379][ T5889] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 641.185381][ T5889] usb 2-1: device descriptor read/64, error -71 [ 641.305835][ T5889] usb usb2-port1: attempt power cycle [ 641.396091][ T5918] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 641.535723][ T5934] usb 7-1: new high-speed USB device number 74 using dummy_hcd [ 641.559017][ T5918] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 641.567916][ T5918] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 641.581990][ T5918] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 641.596261][ T5918] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 641.611465][ T5918] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 641.647618][ T5918] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 641.657424][ T5889] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 641.670840][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 641.736004][T14455] netlink: 'syz.7.1977': attribute type 5 has an invalid length. [ 641.775374][ T5934] usb 7-1: Using ep0 maxpacket: 32 [ 641.783950][ T5889] usb 2-1: device descriptor read/8, error -71 [ 641.793756][ T5934] usb 7-1: config 0 has an invalid interface number: 106 but max is 0 [ 641.804304][ T5934] usb 7-1: config 0 has no interface number 0 [ 641.810451][ T5934] usb 7-1: config 0 interface 106 has no altsetting 0 [ 641.821358][ T5918] usb 6-1: Product: syz [ 641.826204][ T5918] usb 6-1: Manufacturer: syz [ 641.832275][ T5934] usb 7-1: New USB device found, idVendor=0421, idProduct=6901, bcdDevice=2d.1d [ 641.841763][ T5934] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.851304][ T5934] usb 7-1: Product: syz [ 641.856870][ T5934] usb 7-1: Manufacturer: syz [ 641.861585][ T5934] usb 7-1: SerialNumber: syz [ 641.865937][T14444] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 641.878745][ T5918] cdc_wdm 6-1:1.0: skipping garbage [ 641.885187][ T5934] usb 7-1: config 0 descriptor?? [ 641.890278][ T5918] cdc_wdm 6-1:1.0: skipping garbage [ 641.898275][ T5934] cdc_phonet 7-1:0.106: probe with driver cdc_phonet failed with error -22 [ 641.912846][ T5918] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 641.995354][ T5918] cdc_wdm 6-1:1.0: Unknown control protocol [ 642.045749][ T5889] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 642.066507][ T5889] usb 2-1: device descriptor read/8, error -71 [ 642.082705][ T5918] usb 6-1: USB disconnect, device number 96 [ 642.111360][ T5934] usb 7-1: USB disconnect, device number 74 [ 642.175713][ T5889] usb usb2-port1: unable to enumerate USB device [ 642.746958][T14457] binder: 14456:14457 ioctl c0306201 200000000700 returned -22 [ 643.100039][ T923] usb 1-1: USB disconnect, device number 125 [ 643.422529][T14469] loop2: detected capacity change from 0 to 1 [ 643.474350][T14469] Dev loop2: unable to read RDB block 1 [ 643.519241][T14469] loop2: unable to read partition table [ 643.529716][T14477] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 643.544748][T14469] loop2: partition table beyond EOD, truncated [ 643.545609][ T923] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 643.558712][T14469] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 643.610963][T14481] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 643.786010][ T923] usb 1-1: Using ep0 maxpacket: 8 [ 643.795640][ T923] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 643.807328][ T923] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 643.826159][T14489] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 643.833684][ T923] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 643.843512][ T923] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 643.853665][ T923] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 643.863514][ T923] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 643.876431][ T923] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.913331][ T923] usb 1-1: config 0 descriptor?? [ 643.925485][ T5889] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 643.934571][ T5835] Bluetooth: hci4: urb ffff88805d1b7900 submission failed (90) [ 644.038941][T14495] : renamed from team_slave_1 (while UP) [ 644.095565][ T5889] usb 2-1: Using ep0 maxpacket: 16 [ 644.108649][ T5889] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 644.122612][T14472] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1984'. [ 644.139123][ T5934] usb 1-1: USB disconnect, device number 126 [ 644.213632][ T5889] usb 2-1: New USB device found, idVendor=5543, idProduct=0005, bcdDevice= 0.00 [ 644.274323][ T5889] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.338524][ T5889] usb 2-1: config 0 descriptor?? [ 644.760521][ T5934] usb 8-1: new high-speed USB device number 70 using dummy_hcd [ 644.929466][ T5934] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 56, changing to 9 [ 644.945136][ T5934] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 8703, setting to 1024 [ 644.955371][ T5936] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 644.975391][ T923] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 644.983453][ T5934] usb 8-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 645.014985][ T5934] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.042546][ T5934] usb 8-1: config 0 descriptor?? [ 645.068201][ T5889] usbhid 2-1:0.0: can't add hid device: -71 [ 645.074565][ T5889] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 645.100054][ T5889] usb 2-1: USB disconnect, device number 117 [ 645.128728][ T923] usb 6-1: Using ep0 maxpacket: 32 [ 645.133983][ T5936] usb 1-1: Using ep0 maxpacket: 8 [ 645.141453][ T923] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 645.153205][ T923] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 645.163294][ T5936] usb 1-1: config 0 has an invalid interface number: 31 but max is 0 [ 645.171533][ T923] usb 6-1: New USB device found, idVendor=0079, idProduct=1801, bcdDevice= 0.00 [ 645.180948][ T5936] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 645.191252][ T923] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.199326][ T5936] usb 1-1: config 0 has no interface number 0 [ 645.209319][ T923] usb 6-1: config 0 descriptor?? [ 645.215048][ T5936] usb 1-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 645.228322][ T5936] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.236590][ T5936] usb 1-1: Product: syz [ 645.240831][ T5936] usb 1-1: Manufacturer: syz [ 645.245547][ T5936] usb 1-1: SerialNumber: syz [ 645.253244][ T5936] usb 1-1: config 0 descriptor?? [ 645.316088][T14516] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1994'. [ 645.327528][ T5934] ath6kl: Failed to submit usb control message: -71 [ 645.334388][ T5934] ath6kl: unable to send the bmi data to the device: -71 [ 645.349730][ T5934] ath6kl: Unable to send get target info: -71 [ 645.357065][ T5934] ath6kl: Failed to init ath6kl core: -71 [ 645.364039][ T5934] ath6kl_usb 8-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 645.391585][ T5934] usb 8-1: USB disconnect, device number 70 [ 645.512746][T14508] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1996'. [ 645.525172][ T5936] usb 1-1: Found UVC 0.04 device syz (046d:08c3) [ 645.533914][ T5936] usb 1-1: No valid video chain found. [ 645.692465][ T923] hid_mf 0003:0079:1801.0019: item fetching failed at offset 0/2 [ 645.719101][ T923] hid_mf 0003:0079:1801.0019: HID parse failed. [ 645.732069][ T923] hid_mf 0003:0079:1801.0019: probe with driver hid_mf failed with error -22 [ 645.780511][ T5934] usb 1-1: USB disconnect, device number 127 [ 645.812358][T14520] x_tables: duplicate underflow at hook 3 [ 645.888389][ T5889] usb 6-1: USB disconnect, device number 97 [ 646.475735][ T5934] usb 8-1: new high-speed USB device number 71 using dummy_hcd [ 646.555525][ T923] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 646.639320][ T5934] usb 8-1: Using ep0 maxpacket: 16 [ 646.650181][ T5934] usb 8-1: config 0 has an invalid interface number: 145 but max is 0 [ 646.658644][ T5934] usb 8-1: config 0 has no interface number 0 [ 646.666988][ T5934] usb 8-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 646.681640][ T5934] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.689898][ T5934] usb 8-1: Product: syz [ 646.694962][ T5934] usb 8-1: Manufacturer: syz [ 646.700102][ T5934] usb 8-1: SerialNumber: syz [ 646.708227][ T5934] usb 8-1: config 0 descriptor?? [ 646.709979][ T923] usb 1-1: config 0 has an invalid interface number: 219 but max is 0 [ 646.721388][ T5934] hub 8-1:0.145: bad descriptor, ignoring hub [ 646.721422][ T5934] hub 8-1:0.145: probe with driver hub failed with error -5 [ 646.726027][ T5934] input: bcm5974 as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.145/input/input60 [ 646.744806][ T923] usb 1-1: config 0 has an invalid interface number: 66 but max is 0 [ 646.754143][ T923] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 646.783120][ T923] usb 1-1: config 0 has no interface number 0 [ 646.789688][ T923] usb 1-1: config 0 has no interface number 1 [ 646.808617][ T923] usb 1-1: config 0 interface 219 altsetting 0 endpoint 0x4 has invalid maxpacket 1560, setting to 64 [ 646.834839][ T923] usb 1-1: config 0 interface 219 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 646.850604][ T923] usb 1-1: too many endpoints for config 0 interface 66 altsetting 153: 216, using maximum allowed: 30 [ 646.864333][ T923] usb 1-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0x12, changing to 0x2 [ 646.878054][ T923] usb 1-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 646.901129][ T923] usb 1-1: config 0 interface 66 altsetting 153 endpoint 0x86 has invalid maxpacket 34869, setting to 1024 [ 646.912773][T11205] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 646.925046][ T923] usb 1-1: config 0 interface 66 altsetting 153 bulk endpoint 0x86 has invalid maxpacket 1024 [ 646.937732][ T923] usb 1-1: config 0 interface 66 altsetting 153 has 3 endpoint descriptors, different from the interface descriptor's value: 216 [ 646.951380][ T923] usb 1-1: config 0 interface 66 has no altsetting 0 [ 646.960385][ T923] usb 1-1: New USB device found, idVendor=03eb, idProduct=2002, bcdDevice= 1.00 [ 646.970980][ T923] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.979381][ T923] usb 1-1: Product: syz [ 646.983765][ T923] usb 1-1: Manufacturer: syz [ 646.988673][ T923] usb 1-1: SerialNumber: syz [ 647.007955][ T923] usb 1-1: config 0 descriptor?? [ 647.014437][T14543] Context (ID=0x1) not attached to queue pair (handle=0x0:0x2) [ 647.029023][ T923] usb-storage 1-1:0.219: USB Mass Storage device detected [ 647.042810][ T923] usb-storage 1-1:0.219: Quirks match for vid 03eb pid 2002: 20 [ 647.065426][ T5936] usb 6-1: new low-speed USB device number 98 using dummy_hcd [ 647.092234][T11205] usb 2-1: Using ep0 maxpacket: 16 [ 647.099958][T11205] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 647.120725][T11205] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 647.140159][T11205] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 647.151309][T11205] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 647.161894][T11205] usb 2-1: Product: syz [ 647.168329][T11205] usb 2-1: Manufacturer: syz [ 647.172971][T11205] usb 2-1: SerialNumber: syz [ 647.182644][T11205] usb 2-1: config 0 descriptor?? [ 647.195098][T11205] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 647.207901][T11205] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 647.223725][ T923] usb-storage 1-1:0.66: USB Mass Storage device detected [ 647.236466][ T5936] usb 6-1: config 65 has an invalid interface number: 95 but max is 0 [ 647.244706][ T5936] usb 6-1: config 65 has no interface number 0 [ 647.252223][ T5936] usb 6-1: string descriptor 0 read error: -22 [ 647.258911][ T5936] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 647.274776][ T923] usb-storage 1-1:0.66: Quirks match for vid 03eb pid 2002: 20 [ 647.282494][ T5936] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 647.303973][ T5936] usbtest 6-1:65.95: Linux gadget zero [ 647.313721][ T5936] usbtest 6-1:65.95: low-speed {control in/out} tests (+alt) [ 647.343569][ T923] usb 1-1: USB disconnect, device number 2 [ 647.448706][T11205] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 647.464082][T11205] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 647.482955][T11205] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 647.499213][T11205] em28xx 2-1:0.0: No AC97 audio processor [ 647.521487][ T5936] usb 6-1: USB disconnect, device number 98 [ 647.542370][T11205] usb 2-1: USB disconnect, device number 118 [ 647.561211][T11205] em28xx 2-1:0.0: Disconnecting em28xx [ 647.584361][T11205] em28xx 2-1:0.0: Freeing device [ 647.705887][T14557] FAULT_INJECTION: forcing a failure. [ 647.705887][T14557] name failslab, interval 1, probability 0, space 0, times 0 [ 647.718907][T14557] CPU: 1 UID: 0 PID: 14557 Comm: syz.6.2006 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 647.718931][T14557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 647.718943][T14557] Call Trace: [ 647.718951][T14557] [ 647.718960][T14557] dump_stack_lvl+0x189/0x250 [ 647.718993][T14557] ? __pfx____ratelimit+0x10/0x10 [ 647.719020][T14557] ? __pfx_dump_stack_lvl+0x10/0x10 [ 647.719048][T14557] ? __pfx__printk+0x10/0x10 [ 647.719072][T14557] ? __lock_acquire+0xab9/0xd20 [ 647.719104][T14557] should_fail_ex+0x414/0x560 [ 647.719130][T14557] should_failslab+0xa8/0x100 [ 647.719151][T14557] kmem_cache_alloc_noprof+0x73/0x3c0 [ 647.719180][T14557] ? skb_clone+0x212/0x3a0 [ 647.719201][T14557] ? __pfx_skb_network_protocol+0x10/0x10 [ 647.719228][T14557] skb_clone+0x212/0x3a0 [ 647.719250][T14557] ? dev_queue_xmit_nit+0x25a/0xcc0 [ 647.719273][T14557] dev_queue_xmit_nit+0x416/0xcc0 [ 647.719293][T14557] ? dev_queue_xmit_nit+0x2d/0xcc0 [ 647.719324][T14557] dev_hard_start_xmit+0x1be/0x830 [ 647.719364][T14557] __dev_queue_xmit+0x1adf/0x3a70 [ 647.719392][T14557] ? __netlink_deliver_tap+0x404/0x850 [ 647.719415][T14557] ? __dev_queue_xmit+0x27e/0x3a70 [ 647.719440][T14557] ? do_syscall_64+0xfa/0x3b0 [ 647.719479][T14557] ? __pfx___dev_queue_xmit+0x10/0x10 [ 647.719518][T14557] ? __copy_skb_header+0xa7/0x550 [ 647.719541][T14557] ? __asan_memcpy+0x40/0x70 [ 647.719591][T14557] ? skb_clone+0x246/0x3a0 [ 647.719618][T14557] __netlink_deliver_tap+0x5ad/0x850 [ 647.719650][T14557] ? netlink_deliver_tap+0x2e/0x1b0 [ 647.719672][T14557] netlink_deliver_tap+0x19c/0x1b0 [ 647.719693][T14557] netlink_sendskb+0x68/0x140 [ 647.719724][T14557] netlink_rcv_skb+0x28c/0x470 [ 647.719745][T14557] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 647.719766][T14557] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 647.719800][T14557] ? netlink_deliver_tap+0x2e/0x1b0 [ 647.719820][T14557] ? netlink_deliver_tap+0x2e/0x1b0 [ 647.719846][T14557] netlink_unicast+0x75b/0x8d0 [ 647.719875][T14557] netlink_sendmsg+0x805/0xb30 [ 647.719905][T14557] ? __pfx_netlink_sendmsg+0x10/0x10 [ 647.719929][T14557] ? aa_sock_msg_perm+0x94/0x160 [ 647.719955][T14557] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 647.719978][T14557] ? __pfx_netlink_sendmsg+0x10/0x10 [ 647.720000][T14557] __sock_sendmsg+0x219/0x270 [ 647.720032][T14557] ____sys_sendmsg+0x52d/0x830 [ 647.720059][T14557] ? __pfx_____sys_sendmsg+0x10/0x10 [ 647.720091][T14557] ? import_iovec+0x74/0xa0 [ 647.720112][T14557] ___sys_sendmsg+0x21f/0x2a0 [ 647.720137][T14557] ? __pfx____sys_sendmsg+0x10/0x10 [ 647.720195][T14557] ? __fget_files+0x2a/0x420 [ 647.720215][T14557] ? __fget_files+0x3a0/0x420 [ 647.720246][T14557] __sys_sendmmsg+0x227/0x430 [ 647.720275][T14557] ? __pfx___sys_sendmmsg+0x10/0x10 [ 647.720295][T14557] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 647.720350][T14557] ? ksys_write+0x22a/0x250 [ 647.720370][T14557] ? __pfx_ksys_write+0x10/0x10 [ 647.720384][T14557] ? rcu_is_watching+0x15/0xb0 [ 647.720420][T14557] __x64_sys_sendmmsg+0xa0/0xc0 [ 647.720445][T14557] do_syscall_64+0xfa/0x3b0 [ 647.720471][T14557] ? lockdep_hardirqs_on+0x9c/0x150 [ 647.720497][T14557] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.720516][T14557] ? clear_bhb_loop+0x60/0xb0 [ 647.720538][T14557] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.720557][T14557] RIP: 0033:0x7fc97d38e929 [ 647.720574][T14557] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 647.720596][T14557] RSP: 002b:00007fc97b1f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 647.720616][T14557] RAX: ffffffffffffffda RBX: 00007fc97d5b5fa0 RCX: 00007fc97d38e929 [ 647.720629][T14557] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 647.720643][T14557] RBP: 00007fc97b1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 647.720654][T14557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 647.720666][T14557] R13: 0000000000000000 R14: 00007fc97d5b5fa0 R15: 00007fc97d6dfa28 [ 647.720695][T14557] [ 649.155420][T11205] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 649.223855][ T5934] usb 7-1: new high-speed USB device number 75 using dummy_hcd [ 649.307194][T11205] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 649.361302][T11205] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 649.469327][T11205] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 649.518639][ T5934] usb 7-1: New USB device found, idVendor=2c42, idProduct=1602, bcdDevice=da.64 [ 649.533789][ T5934] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 649.552266][ T5934] usb 7-1: Product: syz [ 649.555796][T11205] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.564893][ T5934] usb 7-1: Manufacturer: syz [ 649.618128][ T5934] usb 7-1: SerialNumber: syz [ 649.621769][T14575] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 649.644490][ T5934] usb 7-1: config 0 descriptor?? [ 649.674412][ T5934] hub 7-1:0.0: bad descriptor, ignoring hub [ 649.695076][T11205] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 649.707254][ T5934] hub 7-1:0.0: probe with driver hub failed with error -5 [ 649.730828][ T5934] f81232 7-1:0.0: f81534a converter detected [ 649.875184][T14572] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2011'. [ 649.938355][T14572] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2011'. [ 649.985802][T14572] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2011'. [ 650.075895][T14572] netlink: 84 bytes leftover after parsing attributes in process `syz.6.2011'. [ 650.148573][ T5934] f81534a ttyUSB0: f81232_set_register failed status: -71 [ 650.163982][ T5934] f81534a ttyUSB0: probe with driver f81534a failed with error -5 [ 650.247158][ T5934] usb 7-1: USB disconnect, device number 75 [ 650.260841][ T5934] f81232 7-1:0.0: device disconnected [ 650.353777][T14594] dvmrp8: entered allmulticast mode [ 650.437769][T14593] dvmrp8: left allmulticast mode [ 650.743298][T14603] netlink: 'syz.0.2019': attribute type 1 has an invalid length. [ 650.769536][T14603] netlink: 168864 bytes leftover after parsing attributes in process `syz.0.2019'. [ 650.802072][T14603] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 650.852453][T14608] libceph: resolve '4..' (ret=-3): failed [ 651.210480][ T5918] usb 8-1: USB disconnect, device number 71 [ 651.591931][ T5934] usb 6-1: USB disconnect, device number 99 [ 651.821836][T14619] FAULT_INJECTION: forcing a failure. [ 651.821836][T14619] name failslab, interval 1, probability 0, space 0, times 0 [ 651.834538][T14619] CPU: 1 UID: 0 PID: 14619 Comm: syz.5.2022 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 651.834556][T14619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 651.834564][T14619] Call Trace: [ 651.834571][T14619] [ 651.834576][T14619] dump_stack_lvl+0x189/0x250 [ 651.834601][T14619] ? __pfx____ratelimit+0x10/0x10 [ 651.834620][T14619] ? __pfx_dump_stack_lvl+0x10/0x10 [ 651.834640][T14619] ? __pfx__printk+0x10/0x10 [ 651.834657][T14619] ? __lock_acquire+0xab9/0xd20 [ 651.834681][T14619] should_fail_ex+0x414/0x560 [ 651.834700][T14619] should_failslab+0xa8/0x100 [ 651.834716][T14619] kmem_cache_alloc_noprof+0x73/0x3c0 [ 651.834736][T14619] ? skb_clone+0x212/0x3a0 [ 651.834751][T14619] ? __pfx_skb_network_protocol+0x10/0x10 [ 651.834788][T14619] skb_clone+0x212/0x3a0 [ 651.834805][T14619] ? dev_queue_xmit_nit+0x25a/0xcc0 [ 651.834822][T14619] dev_queue_xmit_nit+0x416/0xcc0 [ 651.834837][T14619] ? dev_queue_xmit_nit+0x2d/0xcc0 [ 651.834859][T14619] dev_hard_start_xmit+0x1be/0x830 [ 651.834889][T14619] __dev_queue_xmit+0x1adf/0x3a70 [ 651.834911][T14619] ? __netlink_deliver_tap+0x404/0x850 [ 651.834928][T14619] ? __dev_queue_xmit+0x27e/0x3a70 [ 651.834947][T14619] ? do_syscall_64+0xfa/0x3b0 [ 651.834976][T14619] ? __pfx___dev_queue_xmit+0x10/0x10 [ 651.835004][T14619] ? __copy_skb_header+0xa7/0x550 [ 651.835021][T14619] ? __asan_memcpy+0x40/0x70 [ 651.835064][T14619] ? skb_clone+0x246/0x3a0 [ 651.835083][T14619] __netlink_deliver_tap+0x5ad/0x850 [ 651.835105][T14619] ? netlink_deliver_tap+0x2e/0x1b0 [ 651.835120][T14619] netlink_deliver_tap+0x19c/0x1b0 [ 651.835135][T14619] netlink_sendskb+0x68/0x140 [ 651.835157][T14619] netlink_rcv_skb+0x28c/0x470 [ 651.835172][T14619] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 651.835186][T14619] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 651.835208][T14619] ? netlink_deliver_tap+0x2e/0x1b0 [ 651.835222][T14619] ? netlink_deliver_tap+0x2e/0x1b0 [ 651.835240][T14619] netlink_unicast+0x75b/0x8d0 [ 651.835261][T14619] netlink_sendmsg+0x805/0xb30 [ 651.835295][T14619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 651.835324][T14619] ? aa_sock_msg_perm+0x94/0x160 [ 651.835348][T14619] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 651.835371][T14619] ? __pfx_netlink_sendmsg+0x10/0x10 [ 651.835393][T14619] __sock_sendmsg+0x219/0x270 [ 651.835423][T14619] ____sys_sendmsg+0x52d/0x830 [ 651.835452][T14619] ? __pfx_____sys_sendmsg+0x10/0x10 [ 651.835484][T14619] ? import_iovec+0x74/0xa0 [ 651.835505][T14619] ___sys_sendmsg+0x21f/0x2a0 [ 651.835530][T14619] ? __pfx____sys_sendmsg+0x10/0x10 [ 651.835588][T14619] ? __fget_files+0x2a/0x420 [ 651.835608][T14619] ? __fget_files+0x3a0/0x420 [ 651.835637][T14619] __sys_sendmmsg+0x227/0x430 [ 651.835664][T14619] ? __pfx___sys_sendmmsg+0x10/0x10 [ 651.835685][T14619] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 651.835740][T14619] ? ksys_write+0x22a/0x250 [ 651.835759][T14619] ? __pfx_ksys_write+0x10/0x10 [ 651.835774][T14619] ? rcu_is_watching+0x15/0xb0 [ 651.835810][T14619] __x64_sys_sendmmsg+0xa0/0xc0 [ 651.835835][T14619] do_syscall_64+0xfa/0x3b0 [ 651.835862][T14619] ? lockdep_hardirqs_on+0x9c/0x150 [ 651.835888][T14619] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.835906][T14619] ? clear_bhb_loop+0x60/0xb0 [ 651.835929][T14619] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.835948][T14619] RIP: 0033:0x7f36db78e929 [ 651.835965][T14619] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 651.835981][T14619] RSP: 002b:00007f36dc590038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 651.836001][T14619] RAX: ffffffffffffffda RBX: 00007f36db9b5fa0 RCX: 00007f36db78e929 [ 651.836032][T14619] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 651.836045][T14619] RBP: 00007f36dc590090 R08: 0000000000000000 R09: 0000000000000000 [ 651.836076][T14619] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 651.836090][T14619] R13: 0000000000000000 R14: 00007f36db9b5fa0 R15: 00007f36dbadfa28 [ 651.836123][T14619] [ 652.655419][ T5936] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 652.815437][ T5936] usb 2-1: Using ep0 maxpacket: 32 [ 652.822552][ T5936] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 652.905611][T14630] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2025'. [ 652.934150][ T5936] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 652.946423][ T5936] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 652.975431][T11205] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 653.075727][ T5936] usb 2-1: Product: syz [ 653.095340][ T5936] usb 2-1: Manufacturer: syz [ 653.110250][ T5936] usb 2-1: SerialNumber: syz [ 653.319599][T11205] usb 6-1: Using ep0 maxpacket: 16 [ 653.357175][ T5936] usb 2-1: config 0 descriptor?? [ 653.504405][T14627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 653.513342][T14621] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 653.522927][T14627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 653.533785][ T5936] hub 2-1:0.0: bad descriptor, ignoring hub [ 653.552404][ T5936] hub 2-1:0.0: probe with driver hub failed with error -5 [ 654.074704][ T5936] usb 2-1: USB disconnect, device number 119 [ 654.583567][T14640] loop6: detected capacity change from 0 to 1 [ 654.585532][ T5936] usb 2-1: new high-speed USB device number 120 using dummy_hcd [ 654.600232][T14640] loop6: [POWERTEC] p1 p2 [ 654.665573][T14640] loop6: p1 size 20971520 extends beyond EOD, truncated [ 654.682371][T14640] loop6: p2 start 536870912 is beyond EOD, truncated [ 654.875551][ T5936] usb 2-1: Using ep0 maxpacket: 32 [ 654.913687][ T5936] usb 2-1: unable to get BOS descriptor or descriptor too short [ 654.979918][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 655.020936][ T5936] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 655.119613][ T5936] usb 2-1: can't read configurations, error -71 [ 656.135898][T14659] sg_write: data in/out 252/19 bytes for SCSI command 0x0-- guessing data in; [ 656.135898][T14659] program syz.1.2031 not setting count and/or reply_len properly [ 656.304889][T11205] usb 6-1: unable to get BOS descriptor or descriptor too short [ 656.381711][T11205] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 656.390892][T11205] usb 6-1: can't read configurations, error -71 [ 656.535408][ T5834] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 656.837341][ T5834] usb 1-1: Using ep0 maxpacket: 16 [ 656.881116][ T5834] usb 1-1: config 0 has an invalid interface number: 105 but max is 0 [ 656.905385][ T5834] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 656.936961][ T5834] usb 1-1: config 0 has no interface number 0 [ 656.959663][ T5834] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 656.974267][ T5834] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.989487][ T5834] usb 1-1: Product: syz [ 656.994407][ T5834] usb 1-1: Manufacturer: syz [ 657.003913][ T5834] usb 1-1: SerialNumber: syz [ 657.015149][ T5834] usb 1-1: config 0 descriptor?? [ 657.130782][T14676] loop6: detected capacity change from 0 to 7 [ 657.142153][ T5967] Dev loop6: unable to read RDB block 7 [ 657.148125][ T5967] loop6: unable to read partition table [ 657.160201][ T5967] loop6: partition table beyond EOD, truncated [ 657.166988][ T5936] usb 7-1: new high-speed USB device number 76 using dummy_hcd [ 657.182544][T14676] Dev loop6: unable to read RDB block 7 [ 657.188442][T14676] loop6: unable to read partition table [ 657.199863][T14676] loop6: partition table beyond EOD, truncated [ 657.208570][T14676] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 657.226166][T11205] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 657.237067][ T5834] usb 1-1: Found UVC 0.00 device syz (046d:08f3) [ 657.251826][ T5834] usb 1-1: No valid video chain found. [ 657.326196][ T5936] usb 7-1: Using ep0 maxpacket: 32 [ 657.336923][ T5936] usb 7-1: config 0 has an invalid interface number: 184 but max is 0 [ 657.345122][ T5936] usb 7-1: config 0 has no interface number 0 [ 657.360636][ T5936] usb 7-1: config 0 interface 184 has no altsetting 0 [ 657.376521][T11205] usb 6-1: Using ep0 maxpacket: 32 [ 657.384363][ T5936] usb 7-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 657.395352][ T5936] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.403371][ T5936] usb 7-1: Product: syz [ 657.416343][T11205] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 657.427657][ T5936] usb 7-1: Manufacturer: syz [ 657.433764][T11205] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8347, setting to 1024 [ 657.463833][ T5936] usb 7-1: SerialNumber: syz [ 657.471609][ T5936] usb 7-1: config 0 descriptor?? [ 657.477712][T11205] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 657.487049][T11205] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 657.504583][ T5936] smsc75xx v1.0.0 [ 657.508550][T11205] usb 6-1: config 0 descriptor?? [ 657.605404][ T5896] usb 8-1: new high-speed USB device number 72 using dummy_hcd [ 657.649771][ T5834] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 657.755393][ T5896] usb 8-1: Using ep0 maxpacket: 8 [ 657.765104][ T5896] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 657.774358][ T5896] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 657.782461][ T5896] usb 8-1: Product: syz [ 657.788355][ T5896] usb 8-1: Manufacturer: syz [ 657.793023][ T5896] usb 8-1: SerialNumber: syz [ 657.801132][ T5896] usb 8-1: config 0 descriptor?? [ 657.815772][ T5834] usb 2-1: Using ep0 maxpacket: 32 [ 657.823749][ T5834] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 657.841001][ T5834] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 657.851004][ T5834] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 657.859560][ T5834] usb 2-1: Product: syz [ 657.863899][ T5834] usb 2-1: Manufacturer: syz [ 657.868921][ T5834] usb 2-1: SerialNumber: syz [ 657.881786][ T5834] usb 2-1: config 0 descriptor?? [ 657.889699][T14682] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 657.899070][ T5834] hub 2-1:0.0: bad descriptor, ignoring hub [ 657.905743][ T5834] hub 2-1:0.0: probe with driver hub failed with error -5 [ 657.942508][T11205] savu 0003:1E7D:2D5A.001A: hiddev1,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.5-1/input0 [ 658.010801][ T5896] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 658.125085][T11205] usb 6-1: USB disconnect, device number 101 [ 658.156675][T14685] netlink: 'syz.1.2039': attribute type 63 has an invalid length. [ 658.213024][T14686] netlink: 'syz.1.2039': attribute type 63 has an invalid length. [ 658.586846][T14682] usb 2-1: reset high-speed USB device number 122 using dummy_hcd [ 658.709461][ T5936] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000044: -61 [ 658.720493][ T5936] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_DATA [ 658.768597][T14682] usb 2-1: device firmware changed [ 658.794475][ T48] usb 2-1: USB disconnect, device number 122 [ 658.909936][ T5936] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 658.924734][ T5936] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 658.935467][ T5936] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 658.947885][ T48] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 658.957022][ T5936] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 658.968524][ T5936] smsc75xx 7-1:0.184: probe with driver smsc75xx failed with error -32 [ 659.115493][ T48] usb 2-1: Using ep0 maxpacket: 32 [ 659.129033][ T48] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 659.148917][ T48] usb 2-1: string descriptor 0 read error: -22 [ 659.186025][ T48] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 659.201057][ T48] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 659.216292][ T48] usb 2-1: config 0 descriptor?? [ 659.244812][T14685] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 659.266277][ T5834] usb 1-1: USB disconnect, device number 3 [ 659.279875][ T48] hub 2-1:0.0: bad descriptor, ignoring hub [ 659.298459][ T48] hub 2-1:0.0: probe with driver hub failed with error -5 [ 659.449259][ T5896] dvb_usb_rtl28xxu 8-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 659.468387][T14693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 659.480096][ T5896] usb 8-1: USB disconnect, device number 72 [ 659.488311][T14693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 659.508051][ T48] usb 7-1: USB disconnect, device number 76 [ 659.662823][ T5936] usb 2-1: USB disconnect, device number 123 [ 659.768208][T14706] sg_write: data in/out 252/19 bytes for SCSI command 0x0-- guessing data in; [ 659.768208][T14706] program syz.5.2043 not setting count and/or reply_len properly [ 659.855858][ T5834] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 659.876984][T14709] loop2: detected capacity change from 0 to 7 [ 659.886865][T14709] loop2: [ 659.889904][T14709] loop2: partition table partially beyond EOD, truncated [ 660.315346][ T5834] usb 1-1: Using ep0 maxpacket: 16 [ 660.372272][ T5834] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 660.517839][T14712] loop2: detected capacity change from 0 to 7 [ 660.524877][ T5834] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 660.538866][T14712] loop2: [ 660.552731][T14712] loop2: partition table partially beyond EOD, truncated [ 660.572032][ T5834] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 660.660193][ T5834] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 660.713266][T14722] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2048'. [ 660.725938][ T5834] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.787089][ T5834] usb 1-1: config 0 descriptor?? [ 660.825411][ T5936] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 660.978685][ T5936] usb 2-1: Using ep0 maxpacket: 16 [ 660.996712][ T5936] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 661.028178][ T5936] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 661.040207][T14729] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2050'. [ 661.055325][ T5936] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 661.085676][ T5936] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 661.093038][ T5834] usbhid 1-1:0.0: can't add hid device: -71 [ 661.115358][ T5936] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 661.117046][ T5834] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 661.134173][ T5936] usb 2-1: config 0 descriptor?? [ 661.151567][T14734] fuse: Unknown parameter '&#ӆ5L ' [ 661.175813][ T5834] usb 1-1: USB disconnect, device number 4 [ 661.183626][T14732] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2051'. [ 661.206200][ T5934] usb 7-1: new high-speed USB device number 77 using dummy_hcd [ 661.349871][ T30] audit: type=1326 audit(1751225870.688:779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14744 comm="syz.5.2054" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f36db78e929 code=0x0 [ 661.373986][ T30] audit: type=1326 audit(1751225870.708:780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14744 comm="syz.5.2054" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f36db78e929 code=0x0 [ 661.381870][ T5934] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 661.409297][ T5934] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 661.430756][ T5934] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 661.441891][ T5934] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 661.465656][ T5934] usb 7-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 661.474791][ T5934] usb 7-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 661.486619][ T5934] usb 7-1: Manufacturer: syz [ 661.494161][ T5934] usb 7-1: config 0 descriptor?? [ 661.554938][ T5936] microsoft 0003:045E:07DA.001B: unknown main item tag 0x0 [ 661.572185][ T5936] microsoft 0003:045E:07DA.001B: unknown main item tag 0x0 [ 661.607018][ T5936] input: HID 045e:07da as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:045E:07DA.001B/input/input62 [ 661.705545][ T5834] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 661.715913][ T5936] microsoft 0003:045E:07DA.001B: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 661.727978][ T48] usb 8-1: new high-speed USB device number 73 using dummy_hcd [ 661.857859][ T5918] usb 2-1: USB disconnect, device number 124 [ 661.898360][ T5834] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 661.908582][ T48] usb 8-1: Using ep0 maxpacket: 8 [ 661.922775][ T48] usb 8-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 661.933511][ T5934] appleir 0003:05AC:8243.001C: unknown main item tag 0x0 [ 661.946648][ T5834] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 661.961672][ T48] usb 8-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 661.971855][ T5834] usb 1-1: config 1 interface 1 altsetting 17 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 661.999861][ T5934] appleir 0003:05AC:8243.001C: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.6-1/input0 [ 662.006359][T14763] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2059'. [ 662.015487][ T5834] usb 1-1: config 1 interface 1 has no altsetting 1 [ 662.038459][ T48] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 662.049699][ T5834] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 662.069542][ T5834] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.087985][ T5834] usb 1-1: Product: syz [ 662.096910][ T5834] usb 1-1: Manufacturer: syz [ 662.101494][ T48] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 662.101548][ T48] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.101570][ T48] usb 8-1: Product: syz [ 662.101588][ T48] usb 8-1: Manufacturer: syz [ 662.142371][ T5834] usb 1-1: SerialNumber: syz [ 662.143153][ T5936] usb 7-1: USB disconnect, device number 77 [ 662.189497][ T48] usb 8-1: SerialNumber: syz [ 662.208059][ T5834] usb 1-1: selecting invalid altsetting 1 [ 662.281741][T14767] VFS: Mount too revealing [ 662.300612][T14765] fido_id[14765]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 662.414756][ T5834] cdc_ncm 1-1:1.0: bind() failure [ 662.440349][ T48] usb 8-1: 0:2 : does not exist [ 662.451218][ T5834] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 662.468803][ T5834] cdc_ncm 1-1:1.1: bind() failure [ 662.491724][ T48] usb 8-1: USB disconnect, device number 73 [ 662.515789][ T5834] usb 1-1: USB disconnect, device number 5 [ 662.564981][T14772] binder: BINDER_SET_CONTEXT_MGR already set [ 662.574568][T14772] binder: 14771:14772 ioctl 4018620d 200000000040 returned -16 [ 662.597300][T14772] binder: 14771:14772 ioctl c0306201 200000000240 returned -11 [ 662.628133][ T6135] udevd[6135]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 663.082532][T14782] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2066'. [ 663.248080][T14790] netlink: 'syz.1.2067': attribute type 21 has an invalid length. [ 663.256353][T14790] netlink: 'syz.1.2067': attribute type 6 has an invalid length. [ 663.275439][T14790] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2067'. [ 663.295591][ T5918] usb 8-1: new full-speed USB device number 74 using dummy_hcd [ 663.455679][ T5834] usb 7-1: new high-speed USB device number 78 using dummy_hcd [ 663.478398][ T5918] usb 8-1: unable to get BOS descriptor or descriptor too short [ 663.492189][ T5918] usb 8-1: not running at top speed; connect to a high speed hub [ 663.502372][T14801] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2070'. [ 663.512838][ T5918] usb 8-1: config 253 has an invalid descriptor of length 0, skipping remainder of the config [ 663.523990][ T5918] usb 8-1: config 253 interface 0 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 663.537848][ T5918] usb 8-1: config 253 interface 0 has no altsetting 0 [ 663.547409][ T5918] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 663.557434][ T5918] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 663.566243][ T5918] usb 8-1: Product: syz [ 663.570434][ T5918] usb 8-1: Manufacturer: syz [ 663.575046][ T5918] usb 8-1: SerialNumber: syz [ 663.627873][ T5834] usb 7-1: config 1 interface 0 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 663.641862][ T5834] usb 7-1: config 1 interface 0 has no altsetting 0 [ 663.651196][ T5834] usb 7-1: New USB device found, idVendor=1c4f, idProduct=0059, bcdDevice= 0.40 [ 663.660541][ T5834] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 663.668657][ T5834] usb 7-1: Product: Л [ 663.672845][ T5834] usb 7-1: Manufacturer: 䐊 [ 663.677555][ T5834] usb 7-1: SerialNumber: Б [ 663.802347][T14779] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2065'. [ 663.873330][ T5918] cdc_ether 8-1:253.0: skipping garbage [ 663.881326][ T5918] cdc_ether 8-1:253.0: skipping garbage [ 663.888066][ T5918] usb 8-1: bad CDC descriptors [ 663.913705][ T5918] usb 8-1: USB disconnect, device number 74 [ 664.107008][ T5834] usbhid 7-1:1.0: can't add hid device: -71 [ 664.118472][ T5834] usbhid 7-1:1.0: probe with driver usbhid failed with error -71 [ 664.137054][ T5834] usb 7-1: USB disconnect, device number 78 [ 664.255385][ T5917] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 664.415363][ T5917] usb 1-1: Using ep0 maxpacket: 8 [ 664.440658][ T5917] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 664.461011][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 664.485519][ T5917] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 664.515413][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 664.534546][T14811] FAULT_INJECTION: forcing a failure. [ 664.534546][T14811] name failslab, interval 1, probability 0, space 0, times 0 [ 664.548606][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 664.558978][T14811] CPU: 0 UID: 0 PID: 14811 Comm: syz.7.2073 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 664.559006][T14811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 664.559019][T14811] Call Trace: [ 664.559032][T14811] [ 664.559041][T14811] dump_stack_lvl+0x189/0x250 [ 664.559075][T14811] ? __pfx____ratelimit+0x10/0x10 [ 664.559112][T14811] ? __pfx_dump_stack_lvl+0x10/0x10 [ 664.559142][T14811] ? __pfx__printk+0x10/0x10 [ 664.559168][T14811] ? __pfx___might_resched+0x10/0x10 [ 664.559197][T14811] ? fs_reclaim_acquire+0x7d/0x100 [ 664.559224][T14811] should_fail_ex+0x414/0x560 [ 664.559251][T14811] should_failslab+0xa8/0x100 [ 664.559273][T14811] kmem_cache_alloc_noprof+0x73/0x3c0 [ 664.559302][T14811] ? ep_insert+0x51a/0x1a00 [ 664.559336][T14811] ep_insert+0x51a/0x1a00 [ 664.559379][T14811] ? __pfx_ep_insert+0x10/0x10 [ 664.559408][T14811] ? __pfx___mutex_lock+0x10/0x10 [ 664.559438][T14811] ? __fget_files+0x2a/0x420 [ 664.559480][T14811] ? __fget_files+0x2a/0x420 [ 664.559517][T14811] ? __fget_files+0x3a0/0x420 [ 664.559538][T14811] ? __fget_files+0x2a/0x420 [ 664.559575][T14811] do_epoll_ctl+0x7f4/0xe90 [ 664.559617][T14811] __x64_sys_epoll_ctl+0x163/0x1a0 [ 664.559642][T14811] ? __pfx___x64_sys_epoll_ctl+0x10/0x10 [ 664.559660][T14811] ? rcu_is_watching+0x15/0xb0 [ 664.559698][T14811] ? do_syscall_64+0xbe/0x3b0 [ 664.559733][T14811] do_syscall_64+0xfa/0x3b0 [ 664.559762][T14811] ? lockdep_hardirqs_on+0x9c/0x150 [ 664.559791][T14811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.559813][T14811] ? clear_bhb_loop+0x60/0xb0 [ 664.559839][T14811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.559859][T14811] RIP: 0033:0x7fa5eeb8e929 [ 664.559879][T14811] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 664.559897][T14811] RSP: 002b:00007fa5ef9be038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 664.559919][T14811] RAX: ffffffffffffffda RBX: 00007fa5eedb6080 RCX: 00007fa5eeb8e929 [ 664.559934][T14811] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000003 [ 664.559946][T14811] RBP: 00007fa5ef9be090 R08: 0000000000000000 R09: 0000000000000000 [ 664.559960][T14811] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000001 [ 664.559973][T14811] R13: 0000000000000000 R14: 00007fa5eedb6080 R15: 00007fa5eeedfa28 [ 664.560006][T14811] [ 664.561344][ T5917] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 664.825793][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 664.869692][ T5917] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 664.885969][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 664.897231][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 664.910606][ T5917] usb 1-1: config 168 descriptor has 1 excess byte, ignoring [ 664.923552][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 664.937232][ T5917] usb 1-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 664.952932][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 664.970153][ T5917] usb 1-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 664.995866][ T5917] usb 1-1: string descriptor 0 read error: -22 [ 665.005467][ T5917] usb 1-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 665.015563][ T5917] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.046749][ T5917] adutux 1-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 665.264763][ T5917] usb 1-1: USB disconnect, device number 6 [ 665.370218][T14820] netlink: 'syz.7.2076': attribute type 11 has an invalid length. [ 665.467037][T14820] block device autoloading is deprecated and will be removed. [ 665.480355][T14820] syz.7.2076: attempt to access beyond end of device [ 665.480355][T14820] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 666.082885][T14831] vim2m vim2m.0: vidioc_s_fmt queue busy [ 666.333449][T14837] loop6: detected capacity change from 0 to 1 [ 666.341602][T14839] FAULT_INJECTION: forcing a failure. [ 666.341602][T14839] name failslab, interval 1, probability 0, space 0, times 0 [ 666.354270][T14839] CPU: 1 UID: 0 PID: 14839 Comm: syz.7.2084 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 666.354295][T14839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 666.354307][T14839] Call Trace: [ 666.354315][T14839] [ 666.354324][T14839] dump_stack_lvl+0x189/0x250 [ 666.354360][T14839] ? __pfx____ratelimit+0x10/0x10 [ 666.354394][T14839] ? __pfx_dump_stack_lvl+0x10/0x10 [ 666.354450][T14839] ? __pfx__printk+0x10/0x10 [ 666.354478][T14839] ? __lock_acquire+0xab9/0xd20 [ 666.354519][T14839] should_fail_ex+0x414/0x560 [ 666.354562][T14839] should_failslab+0xa8/0x100 [ 666.354587][T14839] kmem_cache_alloc_noprof+0x73/0x3c0 [ 666.354620][T14839] ? skb_clone+0x212/0x3a0 [ 666.354644][T14839] ? __pfx_skb_network_protocol+0x10/0x10 [ 666.354676][T14839] skb_clone+0x212/0x3a0 [ 666.354701][T14839] ? dev_queue_xmit_nit+0x25a/0xcc0 [ 666.354727][T14839] dev_queue_xmit_nit+0x416/0xcc0 [ 666.354750][T14839] ? dev_queue_xmit_nit+0x2d/0xcc0 [ 666.354785][T14839] dev_hard_start_xmit+0x1be/0x830 [ 666.354830][T14839] __dev_queue_xmit+0x1adf/0x3a70 [ 666.354862][T14839] ? kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 666.354899][T14839] ? __dev_queue_xmit+0x27e/0x3a70 [ 666.354926][T14839] ? do_syscall_64+0xfa/0x3b0 [ 666.355041][T14839] ? __pfx___dev_queue_xmit+0x10/0x10 [ 666.355094][T14839] ? __copy_skb_header+0xa7/0x550 [ 666.355125][T14839] ? __asan_memcpy+0x40/0x70 [ 666.355183][T14839] ? skb_clone+0x246/0x3a0 [ 666.355217][T14839] __netlink_deliver_tap+0x5ad/0x850 [ 666.355269][T14839] ? netlink_deliver_tap+0x2e/0x1b0 [ 666.355299][T14839] netlink_deliver_tap+0x19c/0x1b0 [ 666.355329][T14839] netlink_unicast+0x72f/0x8d0 [ 666.355366][T14839] netlink_sendmsg+0x805/0xb30 [ 666.355406][T14839] ? __pfx_netlink_sendmsg+0x10/0x10 [ 666.355439][T14839] ? aa_sock_msg_perm+0x94/0x160 [ 666.355473][T14839] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 666.355505][T14839] ? __pfx_netlink_sendmsg+0x10/0x10 [ 666.355534][T14839] __sock_sendmsg+0x219/0x270 [ 666.355576][T14839] ____sys_sendmsg+0x52d/0x830 [ 666.355613][T14839] ? __pfx_____sys_sendmsg+0x10/0x10 [ 666.355654][T14839] ? import_iovec+0x74/0xa0 [ 666.355682][T14839] ___sys_sendmsg+0x21f/0x2a0 [ 666.355715][T14839] ? __pfx____sys_sendmsg+0x10/0x10 [ 666.355801][T14839] ? __might_fault+0xb0/0x130 [ 666.355831][T14839] __sys_sendmmsg+0x227/0x430 [ 666.355870][T14839] ? __pfx___sys_sendmmsg+0x10/0x10 [ 666.355899][T14839] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 666.355978][T14839] ? ksys_write+0x22a/0x250 [ 666.356004][T14839] ? __pfx_ksys_write+0x10/0x10 [ 666.356024][T14839] ? rcu_is_watching+0x15/0xb0 [ 666.356081][T14839] __x64_sys_sendmmsg+0xa0/0xc0 [ 666.356113][T14839] do_syscall_64+0xfa/0x3b0 [ 666.356148][T14839] ? lockdep_hardirqs_on+0x9c/0x150 [ 666.356206][T14839] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.356226][T14839] ? clear_bhb_loop+0x60/0xb0 [ 666.356251][T14839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.356272][T14839] RIP: 0033:0x7fa5eeb8e929 [ 666.356291][T14839] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 666.356311][T14839] RSP: 002b:00007fa5ef9df038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 666.356332][T14839] RAX: ffffffffffffffda RBX: 00007fa5eedb5fa0 RCX: 00007fa5eeb8e929 [ 666.356348][T14839] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 666.356364][T14839] RBP: 00007fa5ef9df090 R08: 0000000000000000 R09: 0000000000000000 [ 666.356378][T14839] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 666.356391][T14839] R13: 0000000000000000 R14: 00007fa5eedb5fa0 R15: 00007fa5eeedfa28 [ 666.356424][T14839] [ 666.371716][ T7991] loop6: [POWERTEC] p1 p2 [ 666.371953][ T7991] loop6: p1 size 20971520 extends beyond EOD, truncated [ 666.376655][ T7991] loop6: p2 start 536870912 is beyond EOD, truncated [ 666.861506][T14837] loop6: [POWERTEC] p1 p2 [ 666.866314][T14837] loop6: p1 size 20971520 extends beyond EOD, truncated [ 666.906553][T14837] loop6: p2 start 536870912 is beyond EOD, truncated [ 667.149016][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 667.249168][T14861] FAULT_INJECTION: forcing a failure. [ 667.249168][T14861] name failslab, interval 1, probability 0, space 0, times 0 [ 667.267482][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 667.312240][T14861] CPU: 0 UID: 0 PID: 14861 Comm: syz.6.2086 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 667.312262][T14861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 667.312272][T14861] Call Trace: [ 667.312278][T14861] [ 667.312285][T14861] dump_stack_lvl+0x189/0x250 [ 667.312313][T14861] ? __pfx____ratelimit+0x10/0x10 [ 667.312337][T14861] ? __pfx_dump_stack_lvl+0x10/0x10 [ 667.312361][T14861] ? __pfx__printk+0x10/0x10 [ 667.312382][T14861] ? __pfx___might_resched+0x10/0x10 [ 667.312405][T14861] ? fs_reclaim_acquire+0x7d/0x100 [ 667.312427][T14861] should_fail_ex+0x414/0x560 [ 667.312450][T14861] should_failslab+0xa8/0x100 [ 667.312468][T14861] kmem_cache_alloc_noprof+0x73/0x3c0 [ 667.312492][T14861] ? ep_ptable_queue_proc+0x5c/0x200 [ 667.312512][T14861] ep_ptable_queue_proc+0x5c/0x200 [ 667.312528][T14861] ? __pfx_ep_ptable_queue_proc+0x10/0x10 [ 667.312545][T14861] vb2_core_poll+0x84/0x840 [ 667.312565][T14861] vb2_fop_poll+0x168/0x380 [ 667.312592][T14861] ? __pfx_vb2_fop_poll+0x10/0x10 [ 667.312617][T14861] v4l2_poll+0x144/0x2c0 [ 667.312641][T14861] ? __pfx_v4l2_poll+0x10/0x10 [ 667.312664][T14861] ep_insert+0x115e/0x1a00 [ 667.312700][T14861] ? __pfx_ep_insert+0x10/0x10 [ 667.312723][T14861] ? __pfx___mutex_lock+0x10/0x10 [ 667.312748][T14861] ? __fget_files+0x2a/0x420 [ 667.312767][T14861] ? __pfx_ep_ptable_queue_proc+0x10/0x10 [ 667.312783][T14861] ? __fget_files+0x3a0/0x420 [ 667.312799][T14861] ? __fget_files+0x2a/0x420 [ 667.312823][T14861] do_epoll_ctl+0x7f4/0xe90 [ 667.312854][T14861] __x64_sys_epoll_ctl+0x163/0x1a0 [ 667.312871][T14861] ? __pfx___x64_sys_epoll_ctl+0x10/0x10 [ 667.312884][T14861] ? rcu_is_watching+0x15/0xb0 [ 667.312921][T14861] ? do_syscall_64+0xbe/0x3b0 [ 667.312947][T14861] do_syscall_64+0xfa/0x3b0 [ 667.312969][T14861] ? lockdep_hardirqs_on+0x9c/0x150 [ 667.313002][T14861] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.313016][T14861] ? clear_bhb_loop+0x60/0xb0 [ 667.313045][T14861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.313059][T14861] RIP: 0033:0x7fc97d38e929 [ 667.313071][T14861] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 667.313084][T14861] RSP: 002b:00007fc97b1d5038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 667.313099][T14861] RAX: ffffffffffffffda RBX: 00007fc97d5b6080 RCX: 00007fc97d38e929 [ 667.313109][T14861] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000003 [ 667.313117][T14861] RBP: 00007fc97b1d5090 R08: 0000000000000000 R09: 0000000000000000 [ 667.313126][T14861] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000001 [ 667.313135][T14861] R13: 0000000000000000 R14: 00007fc97d5b6080 R15: 00007fc97d6dfa28 [ 667.313158][T14861] [ 667.796820][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 667.903182][T14854] netlink: 'syz.7.2088': attribute type 5 has an invalid length. [ 668.171539][ T30] audit: type=1326 audit(1751225877.508:781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14865 comm="syz.6.2091" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fc97d38e929 code=0x0 [ 668.529444][T14848] netlink: 'syz.0.2087': attribute type 5 has an invalid length. [ 669.063334][T14872] geneve3: entered promiscuous mode [ 669.295519][ T48] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 669.495731][ T48] usb 6-1: Using ep0 maxpacket: 32 [ 669.528282][ T48] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 669.565393][ T48] usb 6-1: can't read configurations, error -61 [ 669.619635][T14883] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2097'. [ 669.668569][T14885] FAULT_INJECTION: forcing a failure. [ 669.668569][T14885] name failslab, interval 1, probability 0, space 0, times 0 [ 669.685508][T14885] CPU: 0 UID: 0 PID: 14885 Comm: syz.1.2098 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 669.685536][T14885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 669.685549][T14885] Call Trace: [ 669.685555][T14885] [ 669.685561][T14885] dump_stack_lvl+0x189/0x250 [ 669.685586][T14885] ? __pfx____ratelimit+0x10/0x10 [ 669.685606][T14885] ? __pfx_dump_stack_lvl+0x10/0x10 [ 669.685627][T14885] ? __pfx__printk+0x10/0x10 [ 669.685645][T14885] ? __pfx___might_resched+0x10/0x10 [ 669.685665][T14885] ? fs_reclaim_acquire+0x7d/0x100 [ 669.685688][T14885] should_fail_ex+0x414/0x560 [ 669.685709][T14885] should_failslab+0xa8/0x100 [ 669.685725][T14885] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 669.685745][T14885] ? __alloc_skb+0x112/0x2d0 [ 669.685763][T14885] __alloc_skb+0x112/0x2d0 [ 669.685796][T14885] netlink_ack+0x146/0xa50 [ 669.685808][T14885] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 669.685820][T14885] ? ref_tracker_free+0x63a/0x7d0 [ 669.685840][T14885] ? __copy_skb_header+0xa7/0x550 [ 669.685865][T14885] ? __pfx_ref_tracker_free+0x10/0x10 [ 669.685898][T14885] netlink_rcv_skb+0x28c/0x470 [ 669.685922][T14885] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 669.685936][T14885] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 669.685958][T14885] ? netlink_deliver_tap+0x2e/0x1b0 [ 669.685972][T14885] ? netlink_deliver_tap+0x2e/0x1b0 [ 669.685990][T14885] netlink_unicast+0x75b/0x8d0 [ 669.686010][T14885] netlink_sendmsg+0x805/0xb30 [ 669.686030][T14885] ? __pfx_netlink_sendmsg+0x10/0x10 [ 669.686046][T14885] ? aa_sock_msg_perm+0x94/0x160 [ 669.686064][T14885] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 669.686080][T14885] ? __pfx_netlink_sendmsg+0x10/0x10 [ 669.686095][T14885] __sock_sendmsg+0x219/0x270 [ 669.686116][T14885] ____sys_sendmsg+0x52d/0x830 [ 669.686135][T14885] ? __pfx_____sys_sendmsg+0x10/0x10 [ 669.686156][T14885] ? import_iovec+0x74/0xa0 [ 669.686170][T14885] ___sys_sendmsg+0x21f/0x2a0 [ 669.686187][T14885] ? __pfx____sys_sendmsg+0x10/0x10 [ 669.686230][T14885] ? __might_fault+0xb0/0x130 [ 669.686244][T14885] __sys_sendmmsg+0x227/0x430 [ 669.686263][T14885] ? __pfx___sys_sendmmsg+0x10/0x10 [ 669.686278][T14885] ? __mutex_unlock_slowpath+0x1cd/0x700 [ 669.686314][T14885] ? ksys_write+0x22a/0x250 [ 669.686327][T14885] ? __pfx_ksys_write+0x10/0x10 [ 669.686337][T14885] ? rcu_is_watching+0x15/0xb0 [ 669.686370][T14885] __x64_sys_sendmmsg+0xa0/0xc0 [ 669.686387][T14885] do_syscall_64+0xfa/0x3b0 [ 669.686406][T14885] ? lockdep_hardirqs_on+0x9c/0x150 [ 669.686424][T14885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 669.686437][T14885] ? clear_bhb_loop+0x60/0xb0 [ 669.686453][T14885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 669.686465][T14885] RIP: 0033:0x7f45e298e929 [ 669.686477][T14885] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 669.686489][T14885] RSP: 002b:00007f45e37d1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 669.686504][T14885] RAX: ffffffffffffffda RBX: 00007f45e2bb5fa0 RCX: 00007f45e298e929 [ 669.686514][T14885] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 669.686523][T14885] RBP: 00007f45e37d1090 R08: 0000000000000000 R09: 0000000000000000 [ 669.686531][T14885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 669.686539][T14885] R13: 0000000000000000 R14: 00007f45e2bb5fa0 R15: 00007f45e2cdfa28 [ 669.686557][T14885] [ 670.090901][ T48] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 670.205606][ T5918] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 670.263307][T14899] loop6: detected capacity change from 0 to 1 [ 670.273711][ T6135] loop6: [POWERTEC] p1 p2 [ 670.278680][ T48] usb 6-1: Using ep0 maxpacket: 32 [ 670.297126][ T6135] loop6: p1 size 20971520 extends beyond EOD, truncated [ 670.307450][ T48] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 670.328335][ T6135] loop6: p2 start 536870912 is beyond EOD, truncated [ 670.341063][ T48] usb 6-1: can't read configurations, error -61 [ 670.355607][ T5918] usb 1-1: device descriptor read/64, error -71 [ 670.369297][T14899] loop6: [POWERTEC] p1 p2 [ 670.402476][T14899] loop6: p1 size 20971520 extends beyond EOD, truncated [ 670.418919][ T48] usb usb6-port1: attempt power cycle [ 670.427300][T14899] loop6: p2 start 536870912 is beyond EOD, truncated [ 670.500255][T14905] xt_CT: You must specify a L4 protocol and not use inversions on it [ 670.605499][ T5918] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 670.618154][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 670.745710][ T5918] usb 1-1: device descriptor read/64, error -71 [ 670.787855][ T6135] udevd[6135]: inotify_add_watch(7, /dev/loop6p1, 10) failed: No such file or directory [ 670.885874][ T5918] usb usb1-port1: attempt power cycle [ 671.025610][ T48] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 671.065860][ T48] usb 6-1: Using ep0 maxpacket: 32 [ 671.077308][ T48] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 671.097020][ T48] usb 6-1: can't read configurations, error -61 [ 671.225713][ T48] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 671.266368][ T48] usb 6-1: Using ep0 maxpacket: 32 [ 671.291028][ T48] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 671.310711][ T48] usb 6-1: can't read configurations, error -61 [ 671.337721][ T48] usb usb6-port1: unable to enumerate USB device [ 671.395536][ T5918] usb 1-1: new full-speed USB device number 9 using dummy_hcd [ 671.403256][ T5917] usb 7-1: new high-speed USB device number 79 using dummy_hcd [ 671.426789][ T5918] usb 1-1: device descriptor read/8, error -71 [ 671.585555][ T5917] usb 7-1: Using ep0 maxpacket: 8 [ 671.615119][ T5917] usb 7-1: config 10 has an invalid interface number: 193 but max is 0 [ 671.647790][ T5917] usb 7-1: config 10 has no interface number 0 [ 671.677767][ T5917] usb 7-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice=be.93 [ 671.696743][ T5918] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 671.719960][ T5917] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.747429][ T5918] usb 1-1: device descriptor read/8, error -71 [ 671.765311][ T5917] usb 7-1: Product: syz [ 671.774998][ T5917] usb 7-1: Manufacturer: syz [ 671.794031][ T5917] usb 7-1: SerialNumber: syz [ 671.878379][ T5918] usb usb1-port1: unable to enumerate USB device [ 672.295784][ T5918] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 672.308104][ T5151] Bluetooth: hci1: command 0x0406 tx timeout [ 672.338412][T14932] loop2: detected capacity change from 0 to 7 [ 672.349990][ T5967] loop2: [ 672.353124][ T5967] loop2: partition table partially beyond EOD, truncated [ 672.378441][ T5834] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 672.447952][T14932] loop2: [ 672.454191][T14932] loop2: partition table partially beyond EOD, truncated [ 672.515788][ T5918] usb 6-1: Using ep0 maxpacket: 16 [ 672.523367][ T5918] usb 6-1: config 0 has an invalid interface number: 29 but max is 0 [ 672.536544][ T5918] usb 6-1: config 0 has no interface number 0 [ 672.564897][ T5834] usb 2-1: config 0 has no interfaces? [ 672.578595][ T5834] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 672.598141][ T5834] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.616227][ T5918] usb 6-1: New USB device found, idVendor=0403, idProduct=f850, bcdDevice= a.3c [ 672.659676][ T5834] usb 2-1: Product: syz [ 672.684496][ T5918] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.702921][ T5834] usb 2-1: Manufacturer: syz [ 672.740488][ T5834] usb 2-1: SerialNumber: syz [ 672.752414][ T5918] usb 6-1: Product: syz [ 672.767825][ T5918] usb 6-1: Manufacturer: syz [ 672.845444][ T5834] usb 2-1: config 0 descriptor?? [ 672.850612][ T5918] usb 6-1: SerialNumber: syz [ 672.939288][ T5918] usb 6-1: config 0 descriptor?? [ 672.982008][ T5918] ftdi_sio 6-1:0.29: FTDI USB Serial Device converter detected [ 672.992349][ T5918] ftdi_sio ttyUSB0: unknown device type: 0xa3c [ 673.010277][ T5917] rtsx_usb 7-1:10.193: probe with driver rtsx_usb failed with error -22 [ 673.027599][T14939] IPv4: Oversized IP packet from 127.202.26.0 [ 673.048465][ T5917] usb 7-1: USB disconnect, device number 79 [ 673.235042][T14923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.286648][T14923] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.382802][T14923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.437575][T14945] FAULT_INJECTION: forcing a failure. [ 673.437575][T14945] name failslab, interval 1, probability 0, space 0, times 0 [ 673.450782][T14945] CPU: 1 UID: 0 PID: 14945 Comm: syz.0.2113 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 673.450809][T14945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 673.450821][T14945] Call Trace: [ 673.450830][T14945] [ 673.450839][T14945] dump_stack_lvl+0x189/0x250 [ 673.450873][T14945] ? __pfx____ratelimit+0x10/0x10 [ 673.450902][T14945] ? __pfx_dump_stack_lvl+0x10/0x10 [ 673.450932][T14945] ? __pfx__printk+0x10/0x10 [ 673.450956][T14945] ? __pfx___might_resched+0x10/0x10 [ 673.450977][T14945] ? fs_reclaim_acquire+0x7d/0x100 [ 673.450996][T14945] should_fail_ex+0x414/0x560 [ 673.451015][T14945] should_failslab+0xa8/0x100 [ 673.451031][T14945] __kmalloc_noprof+0xcb/0x4f0 [ 673.451043][T14945] ? vb2_core_reqbufs+0x904/0x1420 [ 673.451066][T14945] vb2_core_reqbufs+0x904/0x1420 [ 673.451097][T14945] ? __pfx_vb2_core_reqbufs+0x10/0x10 [ 673.451123][T14945] ? __vb2_init_fileio+0x1e8/0xff0 [ 673.451139][T14945] __vb2_init_fileio+0x318/0xff0 [ 673.451151][T14945] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 673.451172][T14945] ? add_wait_queue+0xba/0x170 [ 673.451190][T14945] ? ep_ptable_queue_proc+0x13e/0x200 [ 673.451206][T14945] vb2_core_poll+0x4f5/0x840 [ 673.451222][T14945] vb2_fop_poll+0x168/0x380 [ 673.451244][T14945] ? __pfx_vb2_fop_poll+0x10/0x10 [ 673.451265][T14945] v4l2_poll+0x144/0x2c0 [ 673.451285][T14945] ? __pfx_v4l2_poll+0x10/0x10 [ 673.451305][T14945] ep_insert+0x115e/0x1a00 [ 673.451335][T14945] ? __pfx_ep_insert+0x10/0x10 [ 673.451355][T14945] ? __pfx___mutex_lock+0x10/0x10 [ 673.451375][T14945] ? __fget_files+0x2a/0x420 [ 673.451391][T14945] ? __pfx_ep_ptable_queue_proc+0x10/0x10 [ 673.451405][T14945] ? __fget_files+0x3a0/0x420 [ 673.451418][T14945] ? __fget_files+0x2a/0x420 [ 673.451445][T14945] do_epoll_ctl+0x7f4/0xe90 [ 673.451490][T14945] __x64_sys_epoll_ctl+0x163/0x1a0 [ 673.451512][T14945] ? __pfx___x64_sys_epoll_ctl+0x10/0x10 [ 673.451529][T14945] ? rcu_is_watching+0x15/0xb0 [ 673.451566][T14945] ? do_syscall_64+0xbe/0x3b0 [ 673.451589][T14945] do_syscall_64+0xfa/0x3b0 [ 673.451607][T14945] ? lockdep_hardirqs_on+0x9c/0x150 [ 673.451625][T14945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.451638][T14945] ? clear_bhb_loop+0x60/0xb0 [ 673.451654][T14945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 673.451667][T14945] RIP: 0033:0x7fe3e1d8e929 [ 673.451679][T14945] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 673.451691][T14945] RSP: 002b:00007fe3e2b7d038 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 673.451704][T14945] RAX: ffffffffffffffda RBX: 00007fe3e1fb6080 RCX: 00007fe3e1d8e929 [ 673.451714][T14945] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000003 [ 673.451722][T14945] RBP: 00007fe3e2b7d090 R08: 0000000000000000 R09: 0000000000000000 [ 673.451731][T14945] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000001 [ 673.451739][T14945] R13: 0000000000000000 R14: 00007fe3e1fb6080 R15: 00007fe3e20dfa28 [ 673.451759][T14945] [ 673.755567][T14923] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 674.039450][T14951] input: syz1 as /devices/virtual/input/input63 [ 674.217870][ T5917] usb 7-1: new full-speed USB device number 80 using dummy_hcd [ 674.419543][ T5917] usb 7-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 674.435920][ T5917] usb 7-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 674.463038][ T5917] usb 7-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 674.490558][ T5917] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 674.536350][ T5917] hub 7-1:4.0: USB hub found [ 674.695520][ T31] INFO: task kworker/1:0:24 blocked for more than 143 seconds. [ 674.703412][ T31] Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 [ 674.737508][T14947] netlink: 'syz.6.2115': attribute type 15 has an invalid length. [ 674.775654][T14947] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2115'. [ 674.784764][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 674.794906][ T31] task:kworker/1:0 state:D stack:22392 pid:24 tgid:24 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 674.816925][ T31] Workqueue: usb_hub_wq hub_event [ 674.830775][ T31] Call Trace: [ 674.838232][ T31] [ 674.845793][ T31] __schedule+0x16f5/0x4d00 [ 674.857121][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 674.869904][ T31] ? schedule+0x165/0x360 [ 674.880458][ T31] ? __pfx___schedule+0x10/0x10 [ 674.893626][ T31] ? schedule+0x91/0x360 [ 674.902987][ T31] schedule+0x165/0x360 [ 674.914607][ T31] schedule_preempt_disabled+0x13/0x30 [ 674.945432][ T31] __mutex_lock+0x724/0xe80 [ 674.959796][ T31] ? __mutex_lock+0x51b/0xe80 [ 674.974318][ T31] ? hub_event+0x21cb/0x4a00 [ 674.985560][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 674.998991][ T31] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 675.009754][ T31] hub_event+0x21cb/0x4a00 [ 675.029043][ T31] ? do_raw_spin_lock+0x121/0x290 [ 675.069640][ T31] ? __pfx_hub_event+0x10/0x10 [ 675.085320][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 675.127239][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 675.132990][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 675.140469][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 675.153330][ T31] process_scheduled_works+0xae1/0x17b0 [ 675.159429][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 675.166165][ T31] worker_thread+0x8a0/0xda0 [ 675.171249][ T31] kthread+0x70e/0x8a0 [ 675.175669][ T31] ? __pfx_worker_thread+0x10/0x10 [ 675.181174][ T31] ? __pfx_kthread+0x10/0x10 [ 675.186123][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 675.191984][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 675.198193][ T31] ? __pfx_kthread+0x10/0x10 [ 675.203193][ T31] ret_from_fork+0x3fc/0x770 [ 675.209603][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 675.215166][ T31] ? __switch_to_asm+0x39/0x70 [ 675.220621][ T31] ? __switch_to_asm+0x33/0x70 [ 675.229995][ T31] ? __pfx_kthread+0x10/0x10 [ 675.234841][ T31] ret_from_fork_asm+0x1a/0x30 [ 675.240502][ T31] [ 675.243996][ T31] [ 675.243996][ T31] Showing all locks held in the system: [ 675.258225][ T31] 4 locks held by kworker/u8:0/12: [ 675.263740][ T31] 5 locks held by kworker/1:0/24: [ 675.274266][ T31] #0: ffff8881432e1d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 675.288801][ T31] #1: ffffc900001e7bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 675.301133][ T31] #2: ffff888145b41198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 675.313092][ T31] #3: ffff888145b44510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 [ 675.324363][ T31] #4: ffff888029253868 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 [ 675.340926][ T31] 1 lock held by khungtaskd/31: [ 675.347790][ T31] #0: ffffffff8e13ee60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 675.361232][ T31] 2 locks held by getty/5592: [ 675.366882][ T31] #0: ffff8880310d30a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 675.386063][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 675.399052][ T31] 5 locks held by kworker/1:6/5910: [ 675.404371][ T31] #0: ffff8881432e1d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 675.420459][ T31] #1: ffffc90004b1fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 675.434154][ T31] #2: ffff88823be90198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 675.446714][ T31] #3: ffff888145b11510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 [ 675.459227][ T31] #4: ffff888029253868 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 [ 675.470970][ T31] 5 locks held by kworker/0:4/5917: [ 675.478509][ T31] #0: ffff8881432e1d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 675.496784][ T31] #1: ffffc90004b8fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 675.511576][ T31] #2: ffff888028404198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 675.520753][ T31] #3: ffff888055dc9198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 675.533978][ T31] #4: ffff888055c4a160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 675.544237][ T31] 1 lock held by syz.5.2106/14923: [ 675.552569][ T31] #0: ffff888055b85c08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 675.563161][ T31] 1 lock held by syz.1.2107/14929: [ 675.574783][ T31] #0: ffff88805869c408 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 675.615406][ T31] 2 locks held by syz.0.2114/14948: [ 675.621813][ T31] #0: ffffffff8ef92f48 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x2d8/0x5e0 [ 675.632438][ T31] #1: ffffffff8e144978 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 675.645238][ T31] 1 lock held by syz.0.2114/14950: [ 675.747630][ T5918] usb 2-1: USB disconnect, device number 125 [ 675.765075][ T5917] hub 7-1:4.0: config failed, can't read hub descriptor (err -22) [ 675.806993][ T31] [ 675.812880][ T31] ============================================= [ 675.812880][ T31] [ 675.836204][ T31] NMI backtrace for cpu 1 [ 675.836219][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 675.836238][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 675.836248][ T31] Call Trace: [ 675.836254][ T31] [ 675.836261][ T31] dump_stack_lvl+0x189/0x250 [ 675.836291][ T31] ? __wake_up_klogd+0xd9/0x110 [ 675.836311][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 675.836334][ T31] ? __pfx__printk+0x10/0x10 [ 675.836360][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 675.836381][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 675.836397][ T31] ? _printk+0xcf/0x120 [ 675.836416][ T31] ? __pfx__printk+0x10/0x10 [ 675.836433][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 675.836455][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 675.836475][ T31] watchdog+0xfee/0x1030 [ 675.836497][ T31] ? watchdog+0x1de/0x1030 [ 675.836529][ T31] kthread+0x70e/0x8a0 [ 675.836549][ T31] ? __pfx_watchdog+0x10/0x10 [ 675.836569][ T31] ? __pfx_kthread+0x10/0x10 [ 675.836587][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 675.836607][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 675.836628][ T31] ? __pfx_kthread+0x10/0x10 [ 675.836645][ T31] ret_from_fork+0x3fc/0x770 [ 675.836669][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 675.836695][ T31] ? __switch_to_asm+0x39/0x70 [ 675.836710][ T31] ? __switch_to_asm+0x33/0x70 [ 675.836725][ T31] ? __pfx_kthread+0x10/0x10 [ 675.836742][ T31] ret_from_fork_asm+0x1a/0x30 [ 675.836769][ T31] [ 675.836775][ T31] Sending NMI from CPU 1 to CPUs 0: [ 675.967731][ T5917] usb 7-1: USB disconnect, device number 80 [ 675.969714][ C0] NMI backtrace for cpu 0 [ 675.969727][ C0] CPU: 0 UID: 0 PID: 5917 Comm: kworker/0:4 Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 675.969746][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 675.969757][ C0] Workqueue: usb_hub_wq hub_event [ 675.969783][ C0] RIP: 0010:io_serial_in+0x77/0xc0 [ 675.969802][ C0] Code: e8 1e d1 78 fc 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 4f 54 dc fc 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f e9 1a 55 22 06 cc 44 89 f9 80 e1 07 [ 675.969817][ C0] RSP: 0018:ffffc90004b8ee50 EFLAGS: 00000002 [ 675.969830][ C0] RAX: 1ffffffff33b9260 RBX: 00000000000003fd RCX: 0000000000000000 [ 675.969842][ C0] RDX: 00000000000003fd RSI: 0000000000006f0f RDI: 0000000000006f10 [ 675.969852][ C0] RBP: ffffffff99dc99f0 R08: ffff888024cd8237 R09: 1ffff1100499b046 [ 675.969864][ C0] R10: dffffc0000000000 R11: ffffffff85477d00 R12: dffffc0000000000 [ 675.969877][ C0] R13: 0000000000000000 R14: ffffffff99dc9760 R15: 0000000000000000 [ 675.969887][ C0] FS: 0000000000000000(0000) GS:ffff888125c50000(0000) knlGS:0000000000000000 [ 675.969900][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 675.969911][ C0] CR2: 00002000002e0030 CR3: 0000000077232000 CR4: 00000000003526f0 [ 675.969925][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 675.969935][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 675.969945][ C0] Call Trace: [ 675.969951][ C0] [ 675.969960][ C0] wait_for_lsr+0xce/0x2f0 [ 675.969980][ C0] serial8250_console_write+0x134c/0x1ba0 [ 675.970002][ C0] ? __lock_acquire+0xab9/0xd20 [ 675.970025][ C0] ? __pfx_serial8250_console_write+0x10/0x10 [ 675.970042][ C0] ? console_flush_all+0x13a/0xc40 [ 675.970059][ C0] ? console_flush_all+0x13a/0xc40 [ 675.970078][ C0] ? do_raw_spin_unlock+0x122/0x240 [ 675.970095][ C0] ? console_flush_all+0x13a/0xc40 [ 675.970110][ C0] ? console_flush_all+0x13a/0xc40 [ 675.970128][ C0] console_flush_all+0x728/0xc40 [ 675.970145][ C0] ? console_flush_all+0x13a/0xc40 [ 675.970165][ C0] ? __pfx_console_flush_all+0x10/0x10 [ 675.970186][ C0] ? is_printk_cpu_sync_owner+0x32/0x40 [ 675.970208][ C0] console_unlock+0xc4/0x270 [ 675.970223][ C0] ? __pfx_console_unlock+0x10/0x10 [ 675.970237][ C0] ? vprintk_emit+0x3f0/0x7a0 [ 675.970251][ C0] ? vprintk_emit+0x587/0x7a0 [ 675.970271][ C0] ? vprintk_emit+0x444/0x7a0 [ 675.970284][ C0] ? vprintk_emit+0x444/0x7a0 [ 675.970299][ C0] vprintk_emit+0x5b7/0x7a0 [ 675.970312][ C0] ? vprintk_emit+0x444/0x7a0 [ 675.970327][ C0] ? __pfx_vprintk_emit+0x10/0x10 [ 675.970343][ C0] ? __pfx_snprintf+0x10/0x10 [ 675.970362][ C0] ? ret_from_fork_asm+0x1a/0x30 [ 675.970382][ C0] dev_vprintk_emit+0x337/0x3f0 [ 675.970398][ C0] ? __pfx_dev_vprintk_emit+0x10/0x10 [ 675.970416][ C0] ? kasan_save_track+0x4f/0x80 [ 675.970437][ C0] ? kasan_save_track+0x3e/0x80 [ 675.970458][ C0] ? kasan_save_free_info+0x46/0x50 [ 675.970480][ C0] dev_printk_emit+0xe0/0x130 [ 675.970499][ C0] ? __pfx_dev_printk_emit+0x10/0x10 [ 675.970516][ C0] ? do_raw_spin_lock+0x121/0x290 [ 675.970534][ C0] ? __dev_printk+0x131/0x190 [ 675.970552][ C0] _dev_info+0x10a/0x160 [ 675.970568][ C0] ? __pfx__dev_info+0x10/0x10 [ 675.970583][ C0] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 675.970606][ C0] ? kernfs_notify+0x60/0x370 [ 675.970628][ C0] ? kernfs_notify+0x284/0x370 [ 675.970650][ C0] usb_disconnect+0xdd/0x910 [ 675.970673][ C0] hub_event+0x1cdb/0x4a00 [ 675.970707][ C0] ? do_raw_spin_lock+0x121/0x290 [ 675.970725][ C0] ? register_lock_class+0x51/0x320 [ 675.970752][ C0] ? __pfx_hub_event+0x10/0x10 [ 675.970774][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 675.970800][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 675.970818][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 675.970840][ C0] ? process_scheduled_works+0x9ef/0x17b0 [ 675.970864][ C0] process_scheduled_works+0xae1/0x17b0 [ 675.970899][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 675.970929][ C0] worker_thread+0x8a0/0xda0 [ 675.970963][ C0] kthread+0x70e/0x8a0 [ 675.970981][ C0] ? __pfx_worker_thread+0x10/0x10 [ 675.971004][ C0] ? __pfx_kthread+0x10/0x10 [ 675.971021][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 675.971041][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 675.971062][ C0] ? __pfx_kthread+0x10/0x10 [ 675.971078][ C0] ret_from_fork+0x3fc/0x770 [ 675.971101][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 675.971125][ C0] ? __switch_to_asm+0x39/0x70 [ 675.971139][ C0] ? __switch_to_asm+0x33/0x70 [ 675.971154][ C0] ? __pfx_kthread+0x10/0x10 [ 675.971171][ C0] ret_from_fork_asm+0x1a/0x30 [ 675.971194][ C0] [ 676.593085][ T5834] usb 6-1: USB disconnect, device number 106 [ 676.606238][ T5834] ftdi_sio 6-1:0.29: device disconnected [ 676.654952][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 676.661872][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc3-syzkaller-00329-gdfba48a70cb6 #0 PREEMPT(full) [ 676.673698][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 676.683752][ T31] Call Trace: [ 676.687031][ T31] [ 676.689957][ T31] dump_stack_lvl+0x99/0x250 [ 676.694557][ T31] ? __asan_memcpy+0x40/0x70 [ 676.699165][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 676.704386][ T31] ? __pfx__printk+0x10/0x10 [ 676.708984][ T31] panic+0x2db/0x790 [ 676.712906][ T31] ? __pfx_panic+0x10/0x10 [ 676.717395][ T31] ? nmi_backtrace_stall_check+0x433/0x440 [ 676.723230][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 676.728601][ T31] ? nmi_trigger_cpumask_backtrace+0x2b6/0x300 [ 676.734763][ T31] watchdog+0x102d/0x1030 [ 676.739101][ T31] ? watchdog+0x1de/0x1030 [ 676.743526][ T31] kthread+0x70e/0x8a0 [ 676.747613][ T31] ? __pfx_watchdog+0x10/0x10 [ 676.752317][ T31] ? __pfx_kthread+0x10/0x10 [ 676.756916][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 676.762123][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 676.767330][ T31] ? __pfx_kthread+0x10/0x10 [ 676.771927][ T31] ret_from_fork+0x3fc/0x770 [ 676.776534][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 676.781667][ T31] ? __switch_to_asm+0x39/0x70 [ 676.786431][ T31] ? __switch_to_asm+0x33/0x70 [ 676.791189][ T31] ? __pfx_kthread+0x10/0x10 [ 676.795790][ T31] ret_from_fork_asm+0x1a/0x30 [ 676.800584][ T31] [ 676.803948][ T31] Kernel Offset: disabled [ 676.808285][ T31] Rebooting in 86400 seconds..