last executing test programs: 6m35.607570982s ago: executing program 0 (id=1308): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = fsopen(&(0x7f0000000100)='ramfs\x00', 0x1) r1 = fsmount(r0, 0x0, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$netlink(0x10, 0x3, 0xa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r2 = syz_io_uring_setup(0x10cf, &(0x7f00000000c0)={0x0, 0xd69d, 0x8, 0x8, 0x34c, 0x0, r1}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r5 = syz_open_dev$video4linux(&(0x7f0000000080), 0x86, 0x62500) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r5, 0x4020565b, &(0x7f00000002c0)={0x0, 0x7}) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x1cd83f7c25e05491, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100, 0x1, {0x3}}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000007, 0x31, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r1) sendmsg$IPVS_CMD_SET_DEST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[], 0x74}, 0x1, 0x0, 0x0, 0x80}, 0x881) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$TIOCSERGETLSR(0xffffffffffffffff, 0x5459, &(0x7f0000000240)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0x3fd, 0xffffffffffffffff, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) mq_timedsend(r1, &(0x7f0000000340)="d3d68b95f3894ca7ef520960c6128829a8b97d19fd032f2df22857d7c60d0b84c06d6a93f346ceb22edc2a0648204b7c4eced0ce7fe3c3a007e8f257061c4bce17d15842ade406e7ec6f86a04032309d239f3e1a123ff371316aa75d09d5aeb3eb0b8c48980edb06", 0x68, 0x6, &(0x7f0000000280)) 6m30.505778421s ago: executing program 0 (id=1319): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r2 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x4000000, 0x0, 0x1, 0x10d}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r5 = socket$l2tp(0x2, 0x2, 0x73) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x62, 0x4000, @fd=r5, 0x1, 0x0, 0x0, 0x1, 0x0, {0x1, r6}}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) 6m26.995663205s ago: executing program 0 (id=1325): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x4044004) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac000000000000000000000000000000001300", "f4bd000000801900", [0x0, 0x2000000000001]}}) 6m26.607530537s ago: executing program 0 (id=1326): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x101301) ioctl$USBDEVFS_CONNECTINFO(r0, 0x8108551b, 0x0) dup(r0) 6m26.2835037s ago: executing program 0 (id=1328): syz_open_procfs$pagemap(0x0, &(0x7f0000000140)) symlinkat(&(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000180)={0x18, 0x0, {0x4, @remote, 'batadv_slave_1\x00'}}, 0x1e) ioctl$PPPOEIOCSFWD(r0, 0x40047452, &(0x7f0000000040)={0x18, 0x0, {0x5, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 'veth1_to_hsr\x00'}}) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000980)=ANY=[@ANYBLOB="40000000100003052abd70000400000000000000ef548ebb33193da15b2de69fe10909b8ad42c4d9620c4e8c27002bf09ab84ac582ff91c971668804a002db00000000000000000000000000000000e35a26cc", @ANYRES32=0x0, @ANYBLOB="00000000a0010200140012800b0001006d61637365630000040002800a003f00aaaaaaaaaabb"], 0x40}}, 0x800) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000100)}) r4 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r4, 0xc008561c, &(0x7f0000000400)={0xf0f001, 0x1}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b0000000000000000"], 0x48) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x0, 0x24, &(0x7f0000004200)=ANY=[@ANYBLOB="12010000e2793f10d10501200002000000010902120001000000000904"], 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000040)='\x19\xf7\x00\x00\x00\x00\xe1s\n\xa7\x9b\xab\xa2\xd0\xcau:R\to\x97\x0e\x15G\x8a\xa4\xa5\x84\x05\xa4\x0fl@\x92w\x84\xc3\xc93q\n[\xb9\xbc\x98;\x11\xd5\xd1.\x87\xb7R\x85\bh=a\xc4\xbd', 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r6, @ANYRES16=r3], 0x0) 6m24.548944033s ago: executing program 0 (id=1333): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x7, 0x6, 0x101, 0x0, 0xfffffff0, {0x7, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040001}, 0x20000000) (async) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x7, 0x6, 0x101, 0x0, 0xfffffff0, {0x7, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040001}, 0x20000000) mmap(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x4, 0x13, r1, 0xdb281000) (async) mmap(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x4, 0x13, r1, 0xdb281000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x202) ioctl$SCSI_IOCTL_PROBE_HOST(r5, 0x5385, &(0x7f0000000180)={0x8d, ""/141}) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYRES32=r2, @ANYRESOCT=r3, @ANYRES64=r5, @ANYRESOCT=r3, @ANYRES32=r0, @ANYRESHEX=0x0, @ANYRES8=r0, @ANYRES32=r1, @ANYRESHEX=r3]) (async) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYRES32=r2, @ANYRESOCT=r3, @ANYRES64=r5, @ANYRESOCT=r3, @ANYRES32=r0, @ANYRESHEX=0x0, @ANYRES8=r0, @ANYRES32=r1, @ANYRESHEX=r3]) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='wchan\x00') read$eventfd(r6, &(0x7f0000000340), 0x8) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) 6m9.30028118s ago: executing program 32 (id=1333): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x7, 0x6, 0x101, 0x0, 0xfffffff0, {0x7, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040001}, 0x20000000) (async) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, 0x7, 0x6, 0x101, 0x0, 0xfffffff0, {0x7, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20040001}, 0x20000000) mmap(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x4, 0x13, r1, 0xdb281000) (async) mmap(&(0x7f0000ff6000/0x4000)=nil, 0x4000, 0x4, 0x13, r1, 0xdb281000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x1, 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x202) ioctl$SCSI_IOCTL_PROBE_HOST(r5, 0x5385, &(0x7f0000000180)={0x8d, ""/141}) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYRES32=r2, @ANYRESOCT=r3, @ANYRES64=r5, @ANYRESOCT=r3, @ANYRES32=r0, @ANYRESHEX=0x0, @ANYRES8=r0, @ANYRES32=r1, @ANYRESHEX=r3]) (async) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)=ANY=[@ANYRES32=r2, @ANYRESOCT=r3, @ANYRES64=r5, @ANYRESOCT=r3, @ANYRES32=r0, @ANYRESHEX=0x0, @ANYRES8=r0, @ANYRES32=r1, @ANYRESHEX=r3]) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='wchan\x00') read$eventfd(r6, &(0x7f0000000340), 0x8) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) (async) close_range(r0, 0xffffffffffffffff, 0x0) 13.685365281s ago: executing program 1 (id=2560): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_emit_ethernet(0x42, &(0x7f0000000000)=ANY=[@ANYBLOB="ffefffffffff0180c2000751f2c1876b3e9ae71000060080"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) unshare(0x20000400) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x250140, 0x0) fcntl$getflags(r2, 0x3) socket$packet(0x11, 0x2, 0x300) socket$rxrpc(0x21, 0x2, 0x2) r3 = socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCGETNODEID(r3, 0x89e1, 0x0) ioctl$EVIOCGABS2F(0xffffffffffffffff, 0x8018456f, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = dup(r4) socket(0xb, 0x3, 0xfffffffe) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x10000, @empty, 0x2}, 0x1c) ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r6, 0x0) ioctl$SNDCTL_TMR_TEMPO(r5, 0xc0045405, &(0x7f00000000c0)=0xe4) bpf$MAP_CREATE(0x0, 0x0, 0x48) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) 11.807680271s ago: executing program 2 (id=2568): unshare(0x22020400) openat$vcsu(0xffffffffffffff9c, &(0x7f0000000080), 0x183822, 0x0) syz_open_dev$usbmon(&(0x7f0000000140), 0x3, 0x40100) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_usb_connect(0x6, 0x24, &(0x7f0000001080)={{0x12, 0x1, 0x0, 0x94, 0x9b, 0x4, 0x40, 0xc52, 0x2222, 0x205e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xb4, 0x0, 0x0, 0xb6, 0xd0, 0xfe}}]}}]}}, 0x0) syz_usb_control_io$uac1(r2, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0xffffffffffffffd4, 0x3, 0x200a}}}, 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000500)={0x14, 0x0, &(0x7f00000004c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000f00)={0x24, 0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB="0003b90000000d03012c"], 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0xc0686611, &(0x7f0000000080)={0x197, 0x0, 0x4000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x0, 0x81, 0xffffffff}) renameat2(0xffffffffffffffff, &(0x7f0000000380)='./cgroup\x00', 0xffffffffffffffff, &(0x7f00000003c0)='./mnt\x00', 0x0) r4 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r4, 0x1, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000200000019"]) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000070961c40dbfb69010203010902180001000000000904f400008fa66bfd6874c89a91bd6cd39f59d1e0d4cb5c00"], 0x0) r5 = syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) r8 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) readv(r8, &(0x7f0000000280)=[{&(0x7f0000000040)=""/151, 0x97}, {0x0}], 0x2) syz_io_uring_submit(r6, r7, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r5, 0x7a98, 0x0, 0x8, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x8, 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="18300000040000000002000003000000950000000000000087f3a144d3a308d37c3e0ba2d8f66d9a73f33ed5d3e36d6e71c04c495ad17607ef69cae547f41b7acea86eeebcb13de8c989976608dd0000000000000000009c33fd20b7dea1edc0ad5cc8c6be9253e9b79a6d7a0ba5f9fcc02edfc55397f15a89368ec176141381bafc379eb0cb81a4ceead5f639e78f6238dd3e143a582c214137d49f677e884271be806f9dcd717553183fe59ef3b573c9c8d9c68dfc75adaef20aa5cc3eb25c4a44efe4a253361577d7fd3d4d9d31f56c49a71619e2911b7921da52cb1c205694bcf9b4ef007e865274d0b36b7e810fc88496a85e7ff51a1faadae1ec4ec7aa14dea7792dbacc14075083f9256c5a55cb10eb9ebded6104470445dea24bbb4235edef41ced3adcf74e31d81d57d83b157edf5e9aaa074a36b6eaa754b04b2f067936244e2e48fdd4372817f830ad2b7486397d4b701ac88e246aa0cab1203613eabc9144467"], &(0x7f0000000200)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_xfrm(0x10, 0x3, 0x6) 11.131681159s ago: executing program 1 (id=2574): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x270856, &(0x7f0000008380)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYRES16=r0, @ANYRESOCT=r0], 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000006340)={0x2020, 0x0, 0x0}, 0x2058) write$FUSE_LSEEK(r0, &(0x7f00000021c0)={0x18, 0xfffffffffffffff5, r2, {0x4}}, 0x18) read$FUSE(r0, &(0x7f0000000100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_IOCTL(r0, &(0x7f0000002140)={0x20, 0x0, r3, {0x0, 0x0, 0x80003ff}}, 0x20) lstat(&(0x7f0000008800)='./file0\x00', 0x0) getdents(r1, 0x0, 0x0) read$FUSE(r0, &(0x7f0000008d00)={0x2020}, 0x2020) syz_fuse_handle_req(r0, &(0x7f0000004340)="4dfcda61763dff617b1f46968be03364c1a5ec05a16d333afaa5aca8cf08ff05a8173fe045dec66e41cec09164fbb0c7af9bc9cc05405b27631c130aadcefdec09d8a74cffb008a66428467570a1ef35f547b0cba721820a50c1925fb4725aebb7c20f79cffe830a3580282b70ef9e7ebf2bb49d5df2f619cb426c715b0d43ecab560d49ef462341279bc66d8ace0f4ebd553d770752ddb410a997bce7a0272051a323a351c82c61834a7e1c2b3c35b8034feed988af4add368bec1088f509f0d73de4eb3e6ad53c44f90dc645a0fbf5221c1d8d0ccf837c923531451032a26260ce7305cf685ad6ea3b3c4c964d7ab4a7bd31dfacb2eb655e997da4d8cb4d58244a7e971003d0e060cb21c8207e34a862e97478eb677ebbbc58e75bcc2408cd6444b5e8977714fdcf28f02ef79061211e4aea477da56c45ec813eca35a0d51b5404e210bc8c311c546922a4d099370ef4cc438f2c428708166931f339d91b92d334221e7cef3255026ab85c2abf9597b3d0616e6040238585a260fb4ffa388fb89f96727d501dd391cd2b9500fbe4749723059c4af6ddcc7b4d3eee4fbdbce89e8ed0d6fd7d7751c48a5f867a12a9edf431e9565700ee4998cea1cc31bef0ea7e0c95342ad46c74ed824341dfe9a79b19a4af2b95c2eacf49ff2cdc14e4dbe48a51d60bf09a4d96a1cc7a34a9405c4d2985333fa02e4272bf467d5cb20031a3a013d65dd077af5249c5242b7a404bbe6ac01df468365d27b8c695468204cb42585e83c97345fc456e5f7d6ab84325a8ce170a4630d3dd6d0c683f6a7506afa655de3c25d39407f9055685a637c02af3b424731ffe1d268217ff22ed277917840ace2ebacc2ba402275c00bdd36d3edc38c039c38cb0292dfbae12876429c53eaff3b1a64c26ae65544633c4f600c1e82a826b9cb2d87781efa5d8d964fde7ee4d3f6f044c529c42f5c2c3af903ef2b1304e5a77f78088c81357e914f9d5fe60af04aab855db0b23c9c0f911bcd03caf1633aaf32620ee38b75af49e4f23d652f126ee9f72b804116a106cb7ab2432983ac7c8dd5dcd4f5e40388962d5d161aef04c288508cd8fc6bd3e62a898e7b835f38eed5e0d1a55e6dd35d6ad20843023fb4fac5c5e3e72a221c68cdae67dfaed5e76ec9098f6c18f7aa0a58e9d5aa58676421cd9af8baac8a948b5d5b7f0bb566386bde8d8bffa669383fb5d7185194f3e32bb8422cefe874d38c8426b5b21796e7e4619224be6605a0fb8cce1dc3ba321eda8d13aa0adf856ecdd0918c64ae388993a2e4cb96c9be793116965cb1c16ed0d932729e4f5ccea1149a8729c0bdcbb90ce9c46d35ab3ab26b5fd88abd1c6e5526dd7672ad58a32cbb314d48f6cb13010720bf9796191c62abb490cf55ff54fada5274343f47f06e2f0f49a33976e76f6c338954f857f5fa8febc75670dd0270b9dc65bd51f14e9a0bf03747fbe56dfdaa38085f71627945e0a946789d2374188c21733798f43692077b697c71f49c7ab7b411e490dbba14ea3a1bec162843f3481dd2ae68d635cf4d44ecef9a8ce0baa82bc07f2fe690e26a467d5e9935b6a39e48e608811442cb7ae769dbd44830f5c2623ba80f6b74de37f4a47369e79d8f148ba5f1f9055c0d879700f07840aba2b34d8a5180eb9619556530fc76ca0c1c5bf0ec354b372f16c3949298fbfd03a602c91454f660ccc0cff70218a2016aae94b9bc8ead58110abe4896bc7880a861f16f9879058d1394452183d9acd1ba4e1b7bf31a8dfb5d8f9eeb149cedd8a78ba4a5800bac4e425debb54f28222e4ade6fa108b32927a4223588ffa67183d1f81829547e39d326cd2b4b9d873df6e5a8a93f95b911be0e88e70c664a439e96aec7ce93821b1469e5dbfc6d96d1a1070b64aedfa225b78cb0e054ec6f15a9c4c0812deaa7a45cd9ce557aa2030a8991b342f8b8997b9bba771cf3d4e8e1e87ea5798f1a9b66eef7a0265cefacee040d2bbb885622d22177ddabe66c84124fcf0c581e1b120af0bf5656616cbb48efb4cd605e4644fe0b701166b0e43ca1ed0267fae98cdbdba46f5edcaaace42dffe02f5e44e5f43d7b445944f6acc42048f94f1026de6af4b3091c878c665a66aaaf72ef0519a3489aebd174e6bde887d56b5df1004789e43c648e962547d65e5ca970be1733cf686aff66f862ef0fe5edd757c8240e4e5e53ea1f720e03bcc2efe908c59e9c01d6ed0fd1fe789494524107ecc958c72bc22e10aa3d77dbbc49988961014bf2c2da1b7298e525afa70dc900733eedf3d7fa2bb21caca7ab6d3c181a7eacf6eb4ca8e2e6e5ce9cc29de868773beb4b583a0bf4e19b20637c621c6600fad6fcc6a38f9d710f1b9fc961a18a8eb4efdd7ce70e9c365217c7c272ac6633171a2acc83e840b00cab4351074829aa5cf930dd762b9efdea67d41f7d72588090a0d0f20df02e6fea364686812c6ee5a28199fce56fa2597c5df96a16abcdc80ddab618c77040b090a3987cdeab024d62c079669a8edea44146a5e334b283f1b75eed3582c11353381338ce43d361f2bc39c27c3a20352bbf5e0a7b9111408c7c0174b2bba67f6e985808ba7c3d6b41da685e07a18eea715503825231761c9f2368cc7345172fbdbf954214c994e1242e068157af111c696e5e245dc1d558a7702447912cff9e4de795ac5e2cf11e0032a80165252fcfa012316c13f094ce01206b710479e81a7dc8a796adbff0a304c8b96a7ed1c7e9735d0b8926ab12a885e353bf7fa2ae9b5d16b70426e82c6126b44504d260d0c21f05774d465b80d9eced55a1da5901d6061aee3cccf165e0fe0a2fcb6c58ece7ce863725f36485299aa13ad7cccf06d7800552ba7d7c567aca102be5c823c83fa717021053c5be5fdfbdb106be54a60ef01af22ae29511b4fbec90dbc9112720623fe2c01cfc33b38150f11fc6a9a5649e70a5faceabda0a9fac92dfefa76eaf8bf624be632126dcee30ef71f1403c7abbf63bb17ada06e17a9023a05667818bbe43d4ed2873164e51d2454a50b00a007351c14d3433afaca06fa43285ff80d9bdcff5a959110cda16d5c144033c022fa1ae8ac6007631acbada7932acd69808c4bb407352e7588a141604bc2d48fd4a826872ab303464232bc4d1578779de50b7f9ce626152f046efc3bb20417b43c7a7ed9239eb3ec40815d838bddbd65de371367e5a9ee95766ebc4f6e66efbf66de6da16009794ff13ee7a7ea7cecb5b3d2997cd253d19d29991e44ae869b074783c525a63179bff68bcc8fe9e8cd9f3a3e957ef01a864eda255accd82e9b93f870aa8766941495b196612faee05265c0ee0ec6a10017a79a2187a62bba75ff82f403f8e919d0e23743faeba561c802ee0bc02ac1ee63d6e0898c97d6923177ad4c3c18ca320fbd518fa9b94b17470e535cfc15c4cde45843c18a1e456ee2c7eef7205d8b025967c5eb47f33d8e592168374a520ecf77682d0c02396fc77c40645b85a0d553ce7d87ca82aa76c5b4e5566a8d08cc06d058d0b93401c728487181c384da61c8f6261008987d51045714af3d9d949b62a7ffcc52871494d27c3e0dbbc18cd2c0a9f8c6c3fa53f75c836e569bae2634cabba4d84f73229fe5a6d56a853e0abe40d598af95dd6e91d594a72938da3afa0cea875dc46127ac8e78eb009bec784bc031e45ebac856839ebc690fe1d41de79ddd672e5ba90fab7bd0bfddc044396d78c67e543b234602aef6f8f9f36524fe2575b6df331f0b578aac28f2efbbe3d9ea407e269e539a5367a5a37dd04a691a99f54af6669fbbb5b6b19e573a665cc2ae8a84023e8bb81c3fe4cdc0ad596b43bd15c735a9fa3f13529220cd279b056abb70e57fd70f3c3ed53f94fb4999d4725c853363a4efd64f81c654ed8c86a1db1041cb23d7b377292720560c5ec3df70f2d9c4c87d64adbd84c5790ec9264af4a3c6c1cb7afa1a3f623cfdca586fc9c10036329a08244515ccec57167c22d9da3810fdd6949d899a16828ce0ea212431d470da06acd08f73a98ad022a712fed8adf82a08ba48ec0569f357221303d1223956a8531b0a37bd725d23487d83342760eccea51503948c98308492773c168d3f15ef187280d2cc9eb63e7cbe190b5678e56b42acc208f32529e766876eacfd5f391aa4806b2cc8effb9e142858b1fe2e2ea7e058964e9b081b718d6501075cda5624a689e4b773923e67c1c3a64384149f4c0b30959fa0db54802c8e525df3cd92506f0c6fe6cf704cede138626306811ad6c30c5e3aed978f1ab0e9a24a6fc069858daef5f8e50bee0e4d2cbb4ee2c95a9faf0f70a23b17a62db1581c34196c0bf4cecdb469e2bba2a15950f8441d907ebdfd1cb29a0bcab242c1a485efe0ab91e1b60b9564b1e387044f65c483ed27fb81e29e292194cabd390dc03bae6180adc57c90cfdcbf81a80112e49fd592cc321d6b4d6f019340e0b4bef7a4b8fee204c41e1937a279336e9a0ad082fb5763d7c585f5e111a86145df7657f8131740ff422fa3d36e976c1029825300b96c2f4398d56cd7eecb85580a80e9463f4fdb955c038a6742c96cc8f932d19f6f802359ab60cad0e7666a8b385a27e8a569f9cb7f7f2a3bec2a4c03466fe8712b48334cb8efc3a7c24e7514cabe2ca17cfdfccb103d63c814f19f36e654174564f9f9456bc319671138cad9aebca798ff0bf7909049aa4e83f4cd3874554d5d86f08a528bcbde0af33f22509debf2246aa1a2c3e162ecf2011bd11e9fce474661ff2176b4b86a82bf8bd139936212453476c7ebc3ff474be7a65944cb03340a30512742794077ab0e3efb7e735981ad61d6c8fecd25909384cd7f97f731e1d07ef00fdfdb59bba2d2b8fcbf4e842bf5b3cfc83ddd72558555ba323168868955d1c1106b08fc7790d8d88bc3333d862523f3c3d796b4dfa3946028a9a188041e6d9f3ca93b72061ef3dafaf05a716ee82dae9613711ee19d9c851ca807f773323f1d4e650d2b41332f1154336acedd946f8a824ef0395bf070b1491328f316dd9faa2ba3ac69d3b1631c0d11c34c561fa23e501eebf5a8d1daa377329b7163eb1d14aa439cc0de4aef5f484d6402a7ab515482dbc1983ac4d9638b1032d54d562bebbc7886eec027e098abebcf887092b52168a70463ae6368cb7ae087c01e6027fed0679bd36fe987ff4d87f6241f68249d5d1b1046f4e08dcae09dd7c452c6caf15486fbe9d72a9e4f7fc2599bb6d1b02981f196e6ef2054b63f000fb449afe2dbcb491f7c9c77191f786c3f28c237b6516ed5e898cc544f5a818cd517dd5bb7ef25e042e423e037d541dc67982cbc1c50a401c854a9a998264894fa2bf46a4090855c9866fff245fdcbfc1f5ef0874a7f1d9194b0ffb0cb9b227eb6bece97019ece1b235d1049bbf50a54931239552d7b4088a636d0157bcfe4074395ecc59fc597fb7fb5c58f37442eaf8cc25a085417df2ac3c7fcca743c638fbd4d74d2f385a03bcb853ffd124e7755ce5e77c95327b7cdb5e9b6d5187fce9240e6ced58caf66d46b1dcac09c33a4289d2f581d6c1e8e61b04622f3dd5537c2dd4382a659aeefe8e7ef50e71fb01b7e88cae9bc676cb535e9e8dcd846706d1e90a0e117d1d2a036aa0169afac25efd36221fa7d25a9c78e4866c8841e7364446f7332f389de93e7165f43db924bd9f5e656c43e3180eef305d377a8aeb76c390d4969abad2c30805b83f77c6194e697192620a73a08cd63ceeeeb55ad782f3383a9b4c1485aeb258e0c41d788565e55bb3de3f28ac47564cf0201a5aae39eabdc9730a7f569247bfaad55c4ef76c03f79b27d197336d9081a6053621454ed36a700f59926a27cec5605fa2cdcc970cd5e9be1e35d75d390742675afaf5c62a049e43c17747eca6336889b19f1269092de97067014ddce51ca13eea46313653f9a001a753117622b218e90115226a39cc485eed3fadc8ab08022b32a4aabc04d54d62114a824e43c23aa0fbd71f25c3da701339739397aa4995865d27a260677938182217bf6106262b84f4f836bfb5a688fdc5690e6faa42e0a40d1a573e8b1b9381c8f308607eadcdcfe16f72d79c5d5c41b1ad42e1dc6664aa44b32a195f54c63d503830552eddf6b66047426e46e5b45e16b12b730d3be5a6090310ae3346c99999be1b0a4b849f3e3387aecc0064409544df79a6aecd0a456edeb380bba6b6d1cbeaaf992716f1a539860e0500c9597883f194334109d55b5c6c7fe47278c2d32e3822b91f7ee856f30a5bab0f5b2823a6992b5077199079e17e9d62dd427cb5ca636abd84d078fa326e992c3f202f5086e8c114125f21e59054eb6b660e93958e2599a175536c01fc679c1018fabcba0743c5ff19a25d97f283c3f849c2376d6c0469f0ee5c2631801051e4ea3a6eb9eef400a57c1a984ac2da5ba2ed99dea3535057fcee1937ff16082c0f2717ba3f484fbe6bbf0d2b9b54487654c0a66b7dcecec7565c8c8d0f950702275f81646e0faad4a949b53a8f08478d86a53e28e396a49a69f47320235f3dc0affc98a31d8ca1cd0a3aa8bc19c91f0e725ce50aeb40179271ac570c720b882d1cf24e18b1556c7775c61605a6f01108f13d3b54958d09a0469c21dde2c3e1c265303646f1fbca7f79060f9ef2b1a1444668d8de32a30d2b630011feecb8e8da915a686a5e4d0dc0fb4f3ae5af2b87ad6c96af2f78e2e1109fe972aed4a35cebe8414fbca1cb5582d2b8c7bab70ce23dc614a73e7e215f306c22723c1f3714ecdd163342ae6ea9d14f1d8f9b1087c156b5ee9a3c061d006a235784f3995ff534856f25e8cbe30118f304f0347aa3c0b420d46479cb89ca8e022df9ae2772637e3a2f40b9a4e1526661afe212da274777799087999685cf0beadf654a3f773f07333d2e2bee5ca50434ace5173d3da67c4bbb901a7c0085023ba808689d794be69adfa926bc8893097ee81101412535a17c61c88b68f985c19643cccc65fe327f4fe6f1996b46b88cbd8271c7e6f5e48005bbf9cfd0b016d4cb0d954dd28a506d44baa97e13021ca3da301a576dcb7c698648013a3638eca6e81230d01f35298cbe25e017b37a872451a9ceddfb3123416e510412ead9fe0e9241a12ebdb1689d4d214cdae5074cafa785c2ec1d9dd477ba2f92e90d01d967662f9689cd7f10fd85d60deac2feee248c72897a93ee3b509a93f2cb66e17cb29e56610230d24fe0dd1b911e811f4fc997b48b81a0ab366bb80c66ae25a95b5344cdc62392fa892c61a3ff41889a867487f567a00d09d2e1e4cd0bd18f4eb491f25dd4d43d3559b5936375cf62bbcee0c138d3a3bce5ff90b7313b16f58b5ff9560b7520a658375d010dd6268b13ce3f0b5b8e4bd4ad7bc9148e0fe5201fe1128120a2951714b6947cae5f174c827d111f63c9af06e188c2ba29c584be3aa49e50314c8c62f5f8896bd450c29fa2a0627cfe17e7c0204e2ac9e98a75a4bd1addb07377a1a1dd03987194a8060eb5597704a1e093d05ef5aef615ff7f7df232bfbfc984bfa4f66865d22289e1361ac2d4b6910545a5452c7d84350586ddb40f7e0dff215e1df0da2391ea40a486bc744f7b6601280f23100605745a0f4fd05fbbfc19e09ac8b5881381eb4f051cdf7a9a70c458e6ab64413f1afbe0056e88f4a9dc0cf9010ff24e58511ab5d7c48067b7a6f2924f77fdf98a99f7ed41493d49d11ebae6fb16205429cff7faeff857e1c199481e4f47edcfa0ed88977cac5a2fa91e7095bdc313b4bef642b9fe41c51425bf6647efd2cd8102500cc8db17d194a8c917dc572852d813a26350821d5134138671329da198a764fb245fc9bc256446b639ca7dd6029f9e11bb82f5cc5d49d850324b5ea7865d09447b6488b6258a2474a9efb31e20cc4a699f8412718aa60cffca20e27b116ffeadd35cc02a22b1aae6f761147aded1daa3645cb8f154d86117ccdd1c8f41323884a5fd3b8e84cb06911c84cee967b05d27425f4f169c700731bf060e289d2d423314d45c16e646e0ca075e1665bc61d70528d6a2f44cbd712c55878cff4b52e8ec53d61cc93133060e17f4c321c7eec6a62b166e6088f6e1859a4c87a65c8c0c2636a6208943ab268f6f7bb149c10a3144ecda100722dea79e762092c795f5998c0224394cf6671683843a75153c831465d5cc2b96d6c265e1accb993d17e38f54ed7a560d6d4a9a2efb91d8e5d8f5a872d15aeadd8a547f923485af2b51dbb41c1190b305bd6fcb0902d752735e2ad9a7a382b11b233699883e58f69496f386742f24424d1628f63e3c4683d863aadbd2fea5fc62da953ea90edf3144b9099bc42de9f1761c3298e49f7e7ef982d9a3dd2cac0be0d7fbcfa871a0551def16a66326c1cd31494c2fc0c66eab049102ff64cd060a66d9bafd71cf4cf36b8239f61c1aafb456f3cabb704da3a57dc97ef4c33d086cd93d80ae6c0f4003f631cde44af03a563eb044e2fb7635154d3e600df7654bb2f003ee1bfad84617158af0252d24e248a90bdcaab49787309505fe56b431e9e8c9b4ae1e1915d3b2730eb71d1c43171568d0b7d110d897d1b99141b3875fcd72adef2ed3d23d4ad9b6b579d3210a4df7450d3362f027f258b2d000c206c61fd27829e31f2140e2ba2ff4508ad6607e9a92afdc0fb1649581496cba95e9d4a141a38139af7770c9f82c7fd8a60032b86211d7114b68738ca533e4471b474723b65ebfe492db2fee1605569c2e2f41b552216afc60699824ce85da297045f7494357d7564bf9e1a8e9cc649fa0d2c19d202d2884a1f4e2e3c7d23d6cdd6a68c391192f64e2884d6a22e6a001f39ab06886e1a44411cae0de297ba69ef5369a4f40f2beb776a1f1745da26a70a312cbb1529936e4b82348febbd38762054e03d7d685567cf9003c14768bf7eedaaa8a5ea32a0cbaac361de9057a51d55d3822b1779e6fc24d6b6d604e2e45ad67ea2d7056c64915ae435dee84aac0f6cec00b2a552a23b4c1e920cab9fea8799cd42b0f5cd8ef3066a36bb607e6a318c650a29c05715515bdac7d0dd2a93cfc0f73642aaeaeee1b589b0959bfc112184b775b2d95fc7656a37ffe12a7f70f98632ce7fa2973be8afda5b2726164302043c1a202c085680484aec29ec9557950adaf7a49865970dd94783075815d774062af88be0ffac2573da0c4142880dbc9310b446a49bd4bc84971f6cc63b5c053df2036cc596edd73ec936b35ec08825d021bf857709a3eee884d10ac78fea569d57028d6282c54346677604c5a3e1d7d7e2ffdb82eda5011ed46a3e1924ffaeca217a2f737e0aaab16bb7611ef474836105d6288e027d352bdb39072ad7c9e4394dd25d0706ab46500868975041faaf613f3b243c350f6ce696970516fbfecff3ddebe03c911770d598c871e2906adb0351977b7f4e639362686444eb763eaf0736f40d6d89dddc1fd95d5e300754ae54955c55262a32fe956db7246c58807d19f294cca724356ddbc3e886ca265c4bb06a4404c95705167b5f93443e826001f4a7240bbed179310450542289201361d409567fadfe70c0dcfa12d79580cd7e710882f0ab909a1ee9369601cc1ca41ee7320d598edb46b4ded84b829cbc62202a2f9653baf57e07ad879e5fa68ed8e564ca70d490340b0f639496b381e97aaead7e6f38ec15e4f32aa3ab0d6c84241ee77628039d8ec24cc7607899f9d85d63d6caa9cb37b9eef59f4bf27fe2507fd4166509e8879b75f6c88597535489b71b03427db98d929cdffdea57df6dd57aeb7a9b83d613dc5cc233367758c988aebfaf857caef5664a876a193f6827d0d0152da90df97ad11a37c054b845a8dd16c09b554701a7c8657e1c277a62c357e01a4b5ca38a9a36183bd8117e49043458e9b0ba94055cdfa860f0432f706ed15121f92aeacff5adb22fbbb4e5f01f9a4198184abb30de7463dbf8dbdc3d57067a53b140872487e77849f8445ebc180f1ea85b02523961e45c8ffeca013718f3526cfa21d42fb95202584f318ef6757d02de105c5651d43c597ee970d5d93b8fa60dbe62c413d4c1d2688b490f7149c8896210ebe2ed9a8b650115fd14d75982fe2d85965020d4dba7d6797156b90ecca71d2c18f36b6a4cdfbb5e3f8a5df735608ffd021effa63294bbb4682871036d84450df5cbf6541d870e2eeb98954c3d0b0fc486ae0bb1739b7662a4206940f1b40962000714ff25186b4029eb0887a38c7800d6798437b7354b15b42c905ec227d3f7363ddf1bb2a6edd4a18361da6e105b3a47361453bf720ac954881be7ac815957ed385758d389d109181216f87349962d759fe25a1072f849af004895d8839446450c2f49bd55530ce1ca28e3745bcf139f071c9066fbd8ee920e3fba79f546141f2c9300338406a8a454171688dfd7e866db034f45fc3678fb476b5a090d1815405370a36edfbb9f224bdc8dede771951e4471c9e13f43d96180b094bca2285d1be90b1553e3555e18d1fc47e7b20be79cec83a0765c424ff4f30b4772e40d0d6c3b0b158b26be5f5f7695f5288b6cbc35f9688517694e6ea784916ea9a1e2da6e51e5c5a0693bc2542302babfc5ca6f6be88fb0751ce1f0d87c40913ebe90bb7d8f0716d49632366c939a66d8ada16f7a0c50bb7774da244bf94cea882ebfe0b6f62b7a9e46dc2408bdafebb7c1af0365e7b229730b4926c15ebbf40f34e4eb747747aabf8f8f1fc312c49f76f2cff0e9d0a66661f92e648b2acf5d3b5e0b8aa8a463fb38c7eb1b1e037c110c9aef71feee2240b2633fbb8e9473b25820f821a396b977b221f41254389f71d45cbf589d65db581bb7d700fdde63ecac964273e757a55625703e0ddb9999a4e6299d49314aa25d18ab3286ec0f467a4ac5c2683deec1bffaf445b225ce2e9bed80a270d27f10cce8f3b2086fd0bf5e7e8b9c579f2293f3ea187f4c837ede136dd626782a8f26c06c77e3ac180e32cf61ddf1e262d753dc8f307a217a367476f2cdbc93d97d363aab8f4b9b5fdd9707ea1eba973a71616e4286a3c5bce14689f597f3468fc2a79e1615a9814472fda19fc123af0a7ae7d841de4b7311cae55e808835bb65f8aefee00ba4434c547086c74ae9052ec8eb590c4fcdcfe7ed043e6d969853c0bcf8236e439040a33aea289265f2dca95647f5c9846c58cea58de7fbef4e6dc186f1c9eaab6aa4129dce77f569a30465cdae98ad6fc3b9cb25c2d8477caae17b04e80c51fd5fd01b1a5312992d3ebc76c44ad6e21e54d6da0426cf5921ae2943403d06bb306d41fa912837a80596e3c342237eaca492d4534b5ead45f020bb9b10eb74332df1e0cc34139bb59533416236a579a4c2d5fb7d155619826dc48ecfe578ca38d1806f14867de65a00db28cee493c16169efaa11f4d3c09356daf090a3f678d890f54a4a4d50f02ad87261987487480851d8fea4472cbd666a318f98992a5cf423cf23ef515c241d1143b24a6d0f8295134210d7e7ba493468ba64127f8463cde77319c834d78c6d2d774f49ec37976a4b6799fd5325a2ea426858c45b7fba0013aa2db789999c1ce0dbc2e40931b0587acb2eb6d73d456ac4", 0x2000, &(0x7f0000008c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000008700)=ANY=[@ANYBLOB="3000000000000000000000000000000000000000643b1475000000000000000006"], 0x0, 0x0, 0x0, 0x0}) getdents64(r1, 0x0, 0x0) read$FUSE(r0, &(0x7f0000002300)={0x2020, 0x0, 0x0}, 0x2020) getdents64(r1, 0x0, 0x300) write$FUSE_INTERRUPT(r0, &(0x7f0000000080)={0x10, 0x0, r4}, 0x10) r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001000000000904"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000000)={0x2c, &(0x7f0000002180)=ANY=[@ANYRESDEC=0x0], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) r6 = memfd_create(&(0x7f00000005c0)='\x103q}2[\xe0\x9a\xee\xaf\x03\x97\x9et\v\"|Ma\x86\xe7\xc0\x14\x9f\xb9h\xb1\x96\xe7=I\x860S6\xb5\xa8\xc2\x95Je%\xfeG\'\b\x00\x00\x00\x00\x00\x00\x00\x1c\xa6\xab\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94k\xcd\t\x00\x90k\xd6\x05\xb6&\xd0\x9daA\xc5\x9c_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2Oc\xc0c\x03gB!\xb0\xb8n\x01\x9bT\x95\x10\x86\xe8$\x7f\r[\xf9\x0e1v\xb1\n\x88\v\x95uy\xb5:`\x8b\nC\x18A;\xaa%\xaf\xc7\xa3\xac\xa2D\xb5\xe2\xe1\xdc(\xfd\x05\x9fB\x84O\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\xa0\x17\xe3\xac\xe9\xc9\xa7\x8a\x1b\x03\"&\xac\xcap>\xccZ\x01\xbc\x18\xc1\xb9\xe9\v\x8b\x9c\xb4Q\xd4\x96EV<>\x99\xca\xb3\xe0\xc4tL\xed\xf5W\xbd#\xcf\x8a\x84\xed\x9f/\xd4\xbb\xea;-Dp\xf8\xd0F\x90\xf8\x92Ip6\xf4\x16\xe8\x14\xe0\x92!\x92-F\xe2\x14D\x91\xa8b\x04\xdd\x1d\a\xdc\xe0\x18\x85{\x80Q\xf6k\x96\xfaQ\x9fW\vO\xf0\xe4O\\\xceS\xe2\x05\x049d\x06#\x88\xc3\xdf\x85O\x1c\xc3\xad?r\xd7\x0e\x00\xd7\x83\xb0\x88\x9c\xf6Y-F\x98\xdd\x9c~\xfd\x95\xc3\xb6lC\xaa\"Y\xa2K\xecz\x84:*\xf5Y\xd1\x9b1\xbd\x9b\x15\xd4\xec\x02o\x01&\xaa\x90w\xc4\xc7\x8en\xb5\x1ag\xab&?\xbe\xcb\xe8v\xa8\xe0\xa4\x81sW\xacf\x149\xd2}\xef\x03Ga\x9a$4\x8c\xa5!p\x83\x05\x96%\x02%\xabj\n\b\xc8NC\x91}&y\xd3\xe1\xeep\'\xc5\xab\x19GsX5\x8c\n\x9fh\xee;4\xb1%V\xe0\xa9\x8e\xf30:\xd8\x18N~G\x139\xcaf2\x02F1\xc6\x82\x00E\xae\x9d\x17\x871N:\xb4\xea \x8e\xdelP\x83\x1f\'\xe2\xd6\xc0\xc3\xfc\xc9677u\xf3RUP@o>\xee\xb8\xa3\t\x02\xb7\\,\xebK\xed\x1b\xc9e\xb3\x16\xce\x9bI\xdb\xfa\x82\x85\t\x9bg\xd0s\xe2\f{\x8cp~;\xf8\x96\xf2\x91\x06\x89\xa6D\xce\xac\x03\xc1\x83\xd1\xe6 |\xa75\xd7\x80t\xfc\xf8\xd2\x12N\x1cB7^\xfd4\xae\xb0VFw\b!\xae\x1baTv\xc0z\x19\xc5\xc8w\xba\x97N\x9a`\x8f\xfc\x9ee\xf9\x00\x1cQA\x14]\r\xd4\"\xc2\x12GD\xdb{\x88\xaa\x81\xc8\xa2\xdeI\xa2\xbel\x0e\xec\x17fNI\x05\xff\x8d\xf4_\x1a\vqA\xb7\x0ed<\x98\xee\xb8\x19\xec\x9f\xee\xe1_\xacG\x8b\xa3\xc3\x13\x80\x0f\xf4I\xdeAwG\xbdkno\xa2\b\x126\x97\x9b\xf9|P\xd94\v\x15\xcb\xc0\x9d\x11\xf3\x18\xae!2\x1b\x12\xa9\xc8~\xb7S\x94\xb5\xc7;\xa90D>s\xe9\xa4N\xf8\xdb\xab\xa0\x94~\xa1]b\xa4\xe5\xe2e\x1c\x8b\xd2\xc7Md\x93\x02\xd8\xb0,\xeb\x03\xaa\v\xed\x9bR\x8a\x80\xc2\x1f\x17ej\x973wv\x83a\xe06\x96\xde\xbc%Uh;H\xf8S\xf1\xa1g\x02\xc4\xc3\xa4\xa8\x96\t\xfex\xa2?\xcb\\Y\x1e\xfe\xca\xa0i\x80O\x11\xac\xb7$\xdb\xbc\xb0\xcb\xacqU\xb5*\x00\x00\x00\x00\x00\x00\x00\f\xda\xf8oV\x89\xd3\x1f\x99+\xe5T\x8eM4\x1c\xc6\x7f\xd4\xf2\xcc\xd3\x94\xca\xd4\x00\x00\x00\x00\x00\x00\x00\x00\x00~A9\xf6IBu2L\x9e\xa2\xd0\x92\xd1\xbc\xb8\tJ\xa1\aN\x87\x95\xbb\xa9s\xab\x90\x06\xc6!p\x9e?~\xf9\xe6\xae*\v\xa3\xd9gxKN\'z]*\x93\xf7\b\x91\xd0\xff\xd9\xc6a\xb5q\x9c\xa1Go\xd58\x93\xe0,\x9f\xe4\xa9\xd9A\x9e\x95e\x98\xd0V\x9d\xed\x97\xf1\xc5\xce\xf5\x90!d\x9a\xd8\x10\xbbx\r8\xff\x8bNUK\xebA\xe5\x92f\xc4\xd1\xa8\x15\xbf\xb5iW\xdb.kbf*\x89\xf0\xecq m-~\xbbf?\xec=\xd2\xe2\x1e\x8d/o\xcd\xc8x\xdb\xe6\xd0W\xca\xc5kz\x8e9\xfa\x86\x0f\x96p', 0x3) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r9, 0x84, 0x77, &(0x7f0000002200)=ANY=[@ANYRES32=r8, @ANYBLOB="0c1d0500a9040200020004000300"], 0x12) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={r10, 0x8001}, 0x8) getsockopt$bt_hci(r7, 0x84, 0x7f, &(0x7f0000000080)=""/4050, &(0x7f0000000000)=0xfd2) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000000}) fcntl$addseals(r6, 0x409, 0xb) syz_usb_control_io(r5, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r5, 0x0, 0x0) 8.594736829s ago: executing program 2 (id=2583): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="a4010000190a05000000000000000000000000000c0003400000000000000001770007402117a3a0ca6bead4b2affca81cb36d623843a09caac7c60cc10db68f9bd1302e297a212d278947f6c5f84380ea54538713c854eca55bc10a4cbb5c3dc9bdf70600000000000076ed821b47bfbf5ce8d41300b68af5acb031c11fbbadd121be33fad0718050f676454bed7aee1101e5e42c19450008000b4000000002e400048024000180090001006d617371000000001400028008000340000000000800034000000001100001800a000100717565756500000024000180090001006d65746100000000140002800800034000000004080001400000001564000180090001006861736800000000540002800800044000000000080002400000000208000740000000010800054000000800080005400000000508db1ee791a13d7e9f0001400000000b080007400000000008000440000000020800054000000400100001800a00010072616e6765000000140001800e000100627974656f726465720000000900010073797a310000000008000b40000000040c0006400000000000000004559bc89adfba9e4f15c15d4b599c297740ccaab2dab53238ffdc26bacc671a09ea305d60e8a104f68f77eb05aa26b9d9d6b583921b55ee4248d12ed011b7528f3218d815e4fe4174f4a9feef47709c019ac68770a82ec107c2688390f00692ce5f42471f822f"], 0x1a4}}, 0x0) unshare(0x62040200) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffc, 0xff, 0x80000000}, 0x1c) socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @rand_addr=0x64010100}}, 0x0, 0x0, 0x400, 0xd, 0x30}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x3, 0x4}, 0x4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f00000003c0)={0x48}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r5, 0x4008ae9c, &(0x7f00000000c0)={0x17, 0x6, 0xd}) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x5618a84ff582e169) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x100}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1, 0x7fff0000}]}) getrusage(0x1, &(0x7f0000000480)) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c00000010003b1500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008001c"], 0x3c}}, 0x0) socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000240)={'team0\x00', @link_local}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[], 0x54}}, 0x0) 8.394265871s ago: executing program 1 (id=2584): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x4000001, 0x13, r0, 0x48075000) syz_usb_connect(0x6, 0x7a, &(0x7f00000000c0)=ANY=[], 0x0) syz_open_dev$sndpcmc(0x0, 0x2, 0x200080) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$rxrpc(0xffffffffffffffff, &(0x7f0000000040)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x7ffe, @dev={0xfe, 0x80, '\x00', 0x25}}}, 0x24) fcntl$getflags(0xffffffffffffffff, 0x3) r2 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x141121) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) syz_io_uring_setup(0x38fd, &(0x7f0000000280)={0x0, 0x1fffff, 0x14509, 0x2000003, 0x2af}, &(0x7f0000000340)=0x0, 0x0) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/resume', 0x149282, 0x10) write$cgroup_int(r5, &(0x7f0000000040)=0x902, 0x12) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_int(r7, 0x29, 0x1a, 0x0, &(0x7f0000000040)) syz_io_uring_submit(r4, 0x0, &(0x7f0000000140)=@IORING_OP_NOP={0x0, 0x46}) r8 = openat$audio(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFMT(r8, 0xc0045005, &(0x7f0000000080)=0x2) ioctl$SNDCTL_DSP_SETFRAGMENT(r8, 0xc004500a, &(0x7f00000000c0)=0x2) r9 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x7732, 0x20000, 0x0, 0x3}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r10, r11, &(0x7f00000001c0)=@IORING_OP_READ_FIXED={0x4, 0x20, 0xede124a209009ae2, @fd=r9, 0x5, 0x7, 0x80000000, 0x9, 0x0, {0x3, r6}}) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r8, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 6.975848572s ago: executing program 2 (id=2588): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc222, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x1000, 0x6, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xd, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141901) r1 = syz_io_uring_setup(0x22f, &(0x7f0000000080)={0x0, 0x5325, 0x10000, 0x0, 0x100002cf}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r1, 0x7a98, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r6 = bpf$ITER_CREATE(0x21, &(0x7f0000000180)={r5}, 0x8) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000200)={'wg1\x00', 0x0}) r8 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r8, 0x0, 0xf, 0x0, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@gettclass={0x24, 0x2a, 0x200, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0xffe0, 0x9532fb06ea5433d}, {0x7, 0x9}, {0x8, 0xa}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x20000001) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r6, 0x3b72, &(0x7f0000000100)={0xc1, 0x2, 0x5, 0x4, "0a6c2f7bd93611b188e25119347639cb585fa6ac3fd4dad7523d653aca9d62c9840ede0f7e83d4cc54274d589342fd26b30c4837657ece87fe2a6ac0e7939d553a9418ebca3184140ecd2b9c90120b1b68124596a9654f2bae0f8beed9ae000ffbc601e01b40f46e459f153ae6a1c0831704e4ec51e354704c71078a94def31076f05362d62da00e1bd7041b277ca066ec8d1f745be45f6dc358319b7b8192df03a803a25625af5c11"}) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x7, {[@local=@item_012={0x1, 0x2, 0x2, 'l'}, @main=@item_012={0x2, 0x0, 0xb, "75c7"}, @local=@item_012={0x1, 0x2, 0x9, 'P'}]}}, 0x0}, 0x0) r9 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) write$uinput_user_dev(r9, &(0x7f0000000300)={'syz1\x00', {0x0, 0x0, 0x2}, 0x4, [0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x87, 0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x514, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xfffffff7, 0x0, 0x2, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x2, 0x871], [0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x7, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x40002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x10000, 0x0, 0xfffffffc, 0x0, 0x9, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x45c) syz_usb_connect$uac1(0x3, 0x94, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902820003010000000904000000010100000a24010000000201020c24020000000000000000000904010000010200000904010101010200000724010000000009050109000000000007250101000000090402000001020000090402010101ff"], 0x0) 5.707782877s ago: executing program 1 (id=2597): r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001a77aa4094225b4210a20102030109022400010000000009040000029233500009050602ff030000000905"], 0x0) mlockall(0x2) r1 = shmget$private(0x0, 0x400000, 0x800, &(0x7f000000e000/0x400000)=nil) shmctl$SHM_LOCK(r1, 0xb) shmat(r1, &(0x7f0000ffd000/0x1000)=nil, 0x7000) shmctl$SHM_UNLOCK(r1, 0xc) unshare(0x20000400) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000002600), 0x101800, 0x0) ioctl$RTC_AIE_ON(r2, 0x7001) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7f, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000040)={0x1, @raw_data="dfab4d85d47fab3f5852323481422e0f382a7fff4f2f6544e6018dbd8ab7448ced0cb6d971aa93e8b234fd2ceb6c160545bc47d95cb6f68a98ee9ea4686093a60d1e90430c08857fd0c428cdd40ea133631f9993733758d144b78ac24b59a54138ada8c18089c1250c7de9ef6ad3b2f7f28322211b5313b263f34c07a174f7d1d0f000f2bd2a60f9e4f18a82318f990d85778a2b77c73764d2d187c87800f0905ca84dbdd9002b572b0928a92da591fbaa566464e5cb6dbaf6a6945d91b66259944c62c5090ca50c"}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000003080)={&(0x7f0000000340)=ANY=[@ANYBLOB="2c0000000104010200000000000000000a00000206000640000400000800054000000008050001000100000098e4e51de42723975a11cb859ba30790d2a5d3b87fa1dfb0652336942ff68c1ef7c19fe1df78eb4e9a133d490d94b3206dedbf41a3558c22f9724d608944159db8140433d711"], 0x2c}, 0x1, 0x0, 0x0, 0x40084}, 0x0) r5 = socket(0x28, 0x1, 0x0) getsockopt$inet_pktinfo(r5, 0x0, 0x8, &(0x7f0000000400)={0x0, @empty}, &(0x7f0000000200)=0xc) connect$packet(r5, &(0x7f0000000100)={0x28, 0x1a, r6, 0x1, 0x47, 0x6, @link_local}, 0x14) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f00000000c0)={0x33, 0x1a, 0xe, 0x1, 0x3, 0x2, 0x2, 0x70}) r7 = openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f0000000040)=0x90000) r8 = syz_usb_connect$uac1(0x2, 0xa5, &(0x7f0000000000)=ANY=[@ANYRES8=r6], 0x0) syz_usb_control_io(r8, &(0x7f0000000280)={0x2c, 0x0, &(0x7f0000000300)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x403}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0003090000001a036be1b7c3ed3ff5018e866c9a938c2f7b"], 0x0, 0x0, 0x0}, 0x0) unshare(0x40000000) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x48e01) r9 = syz_io_uring_setup(0x70ca, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x3, 0x179}, &(0x7f0000000100)=0x0, &(0x7f00000007c0)=0x0) syz_io_uring_submit(r10, r11, &(0x7f0000000000)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x3, 0xb, &(0x7f0000000440)=[{&(0x7f0000000580)="1a1b", 0x2}, {0x0}], 0x2}) io_uring_enter(r9, 0x4d10, 0x2, 0x2, 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000240)={@local}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r7, 0x7a8, &(0x7f0000000540)={{@any, 0xc25}, @my=0x1, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffd}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x12, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0x2a, '\x00', 0x0, @cgroup_sock_addr=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 3.995910515s ago: executing program 4 (id=2602): r0 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x4) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000000, 0x50, r0, 0x70332000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r1, 0xc0487c04, &(0x7f0000000400)={0x0, 0x3, 0x0, &(0x7f0000000080)=[{}, {}, {}], 0x2, 0x0, &(0x7f00000001c0)=[{}, {}], 0x1, 0x0, &(0x7f00000002c0)=[{}], 0x5, 0x0, &(0x7f0000000300)=[{}, {}, {}, {}, {}]}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000480)={0x0, 0x1}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000500)={r3, @in={{0x2, 0x4e21, @local}}, 0x8, 0xc}, &(0x7f00000005c0)=0x90) bind$inet6(r1, &(0x7f0000000600)={0xa, 0x4e21, 0x3, @remote, 0x3}, 0x1c) r4 = syz_open_dev$loop(&(0x7f0000000640), 0xffffffffffffffff, 0x200) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000006c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000680)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000700)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x5, @loopback, 0x5}, {0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, '\x00', 0x1e}, 0xffffffff}, r5, 0x7}}, 0x48) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000780)={'wg0\x00', 0x3}) get_mempolicy(&(0x7f00000007c0), &(0x7f0000000800), 0xd, &(0x7f0000ffe000/0x2000)=nil, 0x1) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000880)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000940)={&(0x7f0000000840)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000900)={&(0x7f00000008c0)=@mpls_getnetconf={0x24, 0x52, 0x720, 0x70bd2d, 0x25dfdbfb, {}, [@IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x80000001}, @NETCONFA_IFINDEX={0x8, 0x1, r7}]}, 0x24}, 0x1, 0x0, 0x0, 0x4002840}, 0x4000000) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000980)={0x0, 0x6, 0x1, [0xa, 0x0, 0x8, 0x9, 0x9], [0xc, 0x4, 0x9b, 0x7fff, 0x1, 0x7, 0x3, 0x502, 0x1, 0x100000000, 0xad, 0xf, 0x400, 0x2, 0x3, 0x3, 0x68d1, 0x3, 0x10, 0x5, 0x0, 0x5, 0x2, 0x4f72, 0x8000000000000001, 0x4, 0x7fffffffffffffff, 0x10001, 0x10001, 0x100000001, 0x5, 0xf394, 0x1, 0x7fffffffffffffff, 0x2c0e, 0x7, 0x401, 0x8, 0x100000001, 0x9, 0x2, 0x5, 0x2, 0xc56, 0xe77, 0xfffffffffffffffb, 0x7fff, 0xa, 0x200, 0x100000000, 0x4, 0x1ff, 0x9af, 0x6, 0x1, 0x7fffffffffffffff, 0x8, 0x2, 0x20000000, 0x2, 0x6, 0x5, 0x4, 0x0, 0x6, 0x6, 0x0, 0x2, 0x68, 0x8000000000000001, 0x3, 0x40c, 0xd63, 0xb95, 0x1, 0x1ff, 0x361d, 0x0, 0x7, 0x81, 0x73d5, 0x2, 0x4, 0x0, 0x2, 0x4, 0x9, 0x1, 0xfffffffffffffff7, 0x6, 0x80000001, 0x9, 0x80, 0x99, 0xdb, 0x4, 0x4, 0xfffffffffffff67d, 0x7, 0x9f8, 0x3, 0x9, 0x3, 0x9, 0x8, 0x91d, 0x0, 0x7, 0xff, 0xbb7, 0xfffffffffffffffe, 0x0, 0xef, 0x7, 0xf4b, 0x3, 0x9, 0xec, 0x100000000, 0x80000001, 0x5]}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f0000000dc0)={0x0, 0x5, 0x30e1, 0x1}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r6, 0xc400941d, &(0x7f00000011c0)={0x0, 0x8000000000000001, 0xf8, 0x1}) ioctl$BTRFS_IOC_BALANCE_V2(r6, 0xc4009420, &(0x7f00000015c0)={0x11, 0x1, {0xc, @struct={0x4, 0xc}, r8, 0xa, 0x1, 0x6, 0x400, 0xd, 0x20, @usage=0x9, 0xfffffff8, 0x14b, [0x9, 0x100000001, 0x19e6, 0x8, 0x5, 0x643]}, {0x7f, @usage=0x69, r9, 0x5, 0x100, 0x0, 0x1, 0x3, 0x1, @struct={0x7, 0x6}, 0x10, 0x1, [0x1, 0x5, 0x1, 0x8, 0x4]}, {0x0, @usage=0x2, r10, 0x6, 0x100000000, 0x6, 0x81, 0x7fffffff, 0x4a0, @usage=0x7, 0x2, 0x8, [0x100000000, 0x6, 0x7, 0x3, 0x6, 0x10000]}, {0x1, 0x1, 0x4}}) ioctl$FITRIM(r0, 0xc0185879, &(0x7f00000019c0)={0x5, 0xfffffffffffffffd, 0x3d7f6420}) r11 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002c40)={0x6, 0x22, &(0x7f0000001a00)=@raw=[@printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}, @alu={0x7, 0x1, 0x6, 0x0, 0xa, 0x1, 0xffffffffffffffff}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @map_val={0x18, 0x9, 0x2, 0x0, r1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @map_val={0x18, 0x5, 0x2, 0x0, r1}, @map_idx={0x18, 0x1, 0x5, 0x0, 0xf}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0xd}], &(0x7f0000001b40)='GPL\x00', 0x3, 0x1000, &(0x7f0000001b80)=""/4096, 0x40f00, 0x4, '\x00', r7, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000002b80)={0x7, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000002bc0)=[r1, r1, r1, r1, r1, r1], &(0x7f0000002c00)=[{0x2, 0x5, 0xf, 0x6}, {0x0, 0x4, 0xb, 0x5}, {0x3, 0x3, 0xb, 0x7}, {0x5, 0x1, 0xa, 0x7}], 0x10, 0x4, @void, @value}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000002e00)={@fallback=r2, 0x37, 0x0, 0x9, &(0x7f0000002d00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f0000002d40)=[0x0, 0x0, 0x0], &(0x7f0000002d80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000002dc0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000002e40)={@cgroup=r1, r11, 0x30, 0x4, r1, @void, @value=r1, @void, @void, r12}, 0x20) r13 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r13, &(0x7f0000002e80)={0xa, 0x4e21, 0x6, @private0, 0x5}, 0x1c) ioctl$FITHAW(r4, 0xc0045878) get_mempolicy(&(0x7f0000002ec0), &(0x7f0000002f00), 0x200, &(0x7f0000ffc000/0x1000)=nil, 0x2) r14 = syz_genetlink_get_family_id$team(&(0x7f0000002f80), r1) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000003640)={&(0x7f0000002f40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000003600)={&(0x7f0000003040)={0x598, r14, 0x200, 0x70bd26, 0x25dfdbfe, {}, [{{0x8}, {0x258, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1000}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4f}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x101}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r7}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x7ff}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r7}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x180000}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1a6}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffb}}, {0x8, 0x6, r7}}}]}}, {{0x8, 0x1, r7}, {0x50, 0x2, 0x0, 0x1, [{0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8}, {0xb4, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0xe, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}]}}, {{0x8, 0x1, r7}, {0xb8, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1acf}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r7}, {0x84, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r7}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r7}}}]}}]}, 0x598}, 0x1, 0x0, 0x0, 0x800}, 0xc040) 3.859898323s ago: executing program 4 (id=2603): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1300000010000000"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000c80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7020000000000008501030005000000bf0900000000000055090100000000005e90000000000000bf91000000000000b70200000000000085000000a0000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 3.81333924s ago: executing program 4 (id=2604): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x1280, 0x3}, 0x18, 0x0) r2 = landlock_create_ruleset(&(0x7f0000000080)={0x100, 0x0, 0x1}, 0x18, 0x0) landlock_restrict_self(r2, 0x0) landlock_restrict_self(r1, 0x0) landlock_restrict_self(r1, 0x2) r3 = fsopen(&(0x7f0000000540)='vxfs\x00', 0x0) readv(r3, &(0x7f0000000680)=[{&(0x7f0000000200)=""/117, 0x75}, {0x0}], 0x2) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) socket$inet(0x2, 0x0, 0x9) bind$unix(r5, &(0x7f0000003000)=@file={0x1}, 0x6e) r6 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x4404c0, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000280)={'veth1_virt_wifi\x00', @random="bca9635b5f8c"}) r7 = landlock_create_ruleset(&(0x7f0000000000)={0x1, 0x2, 0x1}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) connect$unix(r4, &(0x7f0000000640)=@file={0x1}, 0x6e) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f00000086c0)=[{{0x0, 0x0, 0x0}, 0x8101}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/188, 0xbc}, {&(0x7f0000000000)=""/258, 0x102}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000000440)=""/89, 0x59}, {&(0x7f00000006c0)=""/243, 0xf3}], 0x5}, 0x80000000}], 0x4, 0x20, 0x0) 3.561865893s ago: executing program 2 (id=2605): socket(0x10, 0x80002, 0x0) socket(0x80000000000000a, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) accept$alg(r0, 0x0, 0x0) socket$kcm(0x2, 0xa, 0x2) (async) creat(&(0x7f0000000040)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x50, r2, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback=0xac1414aa}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @remote}]}, 0x50}}, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) syz_open_dev$video4linux(&(0x7f0000000000), 0xf, 0x101800) (async) syz_usb_connect(0x6, 0x24, &(0x7f00000001c0)=ANY=[], 0x0) (async) socket$igmp(0x2, 0x3, 0x2) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) (async) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) unshare(0x6a040000) (async) mmap(&(0x7f00002ad000/0xc00000)=nil, 0xc00000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) r4 = socket$netlink(0x10, 0x3, 0x0) (async) r5 = gettid() sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000005f00)=ANY=[@ANYBLOB="2800000010000100"/20, @ANYRES32=r3, @ANYBLOB="6d3082610000000008001300", @ANYRES32=r5], 0x28}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) 3.447839956s ago: executing program 4 (id=2606): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="840200001b000100000000000000000000000000000000000000000000000000ff020000000000000000000000000001000000e91000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000008100000000000000000000000000008402000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000a00100001"], 0x284}}, 0x0) 3.355762648s ago: executing program 2 (id=2607): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$EVIOCGPHYS(0xffffffffffffffff, 0x80404507, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket(0x10, 0x4, 0x7fffffff) sendmsg$nl_route_sched(r3, 0x0, 0x0) bind$alg(r3, &(0x7f0000000340)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm_base(ctr-cast5-avx,ghash-clmulni))\x00'}, 0x58) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f00000000c0)=[{&(0x7f0000000180)='\'', 0x1}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) splice(r5, 0x0, r4, 0x0, 0x10000008ebc, 0x0) sendmmsg$alg(r4, &(0x7f0000000b80)=[{0x0, 0x0, &(0x7f00000000c0)=[{0x0}], 0x1, 0x0, 0x0, 0x20000000}], 0x11, 0x8004) readv(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000480)=""/67, 0x43}], 0x1) readv(r0, &(0x7f0000003e40)=[{&(0x7f0000002b40)=""/25, 0x19}], 0x1) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, &(0x7f0000000240)={0x2, 0x8, 0xf}) r6 = memfd_create(&(0x7f0000000100)='\xd1\xbd\x01\x9b\x04\x00\xa6\xb7\xa9kE\x10Bx\xd0\x05\xe9\xd57\xc9\xc3\tC8\xa0F\x91\x9e\x98\x17\xa9\xb7\xc5\xac\xafv\xff\x81/\x00\x98\x89\xeb\xb1Ot\xc5h\xc4f\xdf\x832\xc3\x9bW\x89<7\xf9\xfc\xf8\x89\x1eU\xa1^/b.\xf9\xea\xe5\xf6.\xa0\xfc\xc7\xf3\x01,\x17\xd4\xec3\x17\xe8x\xca?H\x813\xc0o57d\x82 \x89K\x14DgP6jB\x9e\xa33u\x9ao\xf8H\xa6\xbf\xea\x11T\xcf*\x10\x9d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa3\xe1T\xbb\xb6\x8c%\xc8\xda\x90\xce\x02\xcbh\xbb\xd8', 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x5c2, &(0x7f0000000280)={0x0, 0x0, 0x4000, 0x1, 0xfffffffe}, &(0x7f0000000000)=0x0, &(0x7f0000000580)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) io_uring_enter(r4, 0x29e, 0x10a, 0x3f, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) fstatfs(r6, &(0x7f00000003c0)=""/146) r8 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) ioctl$SCSI_IOCTL_SEND_COMMAND(r8, 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="000000000300000054"]) r9 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x7ffffffffd, r9, 0x0, 0x0) 3.302696059s ago: executing program 4 (id=2608): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x64c842, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x5e, &(0x7f00000003c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb867b46c6a0da49210add60122d9200283aff200100000000000000"], 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000001c0)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000000) sched_setattr(r2, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x8940, 0x0, 0x0) ioctl$FIONCLEX(r1, 0x5450) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) pwritev2(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000140)="e7", 0x1}], 0x10000000000002a9, 0x6, 0x1000, 0xff01) close(r3) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x4, 0x0) shutdown(r4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmmsg(r4, &(0x7f0000005000)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/19, 0x13}, 0x3}], 0x4000169, 0x60, 0x0) listen(r3, 0x40000000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0xc048) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x300000f, 0x10, 0xffffffffffffffff, 0x853c4000) sendmmsg$inet(r6, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) 2.572190434s ago: executing program 5 (id=2610): socket$kcm(0x2, 0xa, 0x2) r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') bind$packet(r0, &(0x7f00000002c0)={0x11, 0xf5, 0x0, 0x1, 0x1, 0x6, @multicast}, 0x14) r2 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) preadv(r1, &(0x7f0000000100)=[{&(0x7f0000000140)=""/197, 0xc5}], 0x1, 0x36, 0x0) r3 = socket$key(0xf, 0x3, 0x2) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x301001) sendmsg$key(r3, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="021800001c000000000000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000000000020012000000000000000004fcffffff0600ff0000000000000000000000000000000000000000000000000001000000fe8000000000002100000000000000bb050005002b0000000a000000000000000000000000000000000008001900000000000a00000000000000fe8000000000000000000000000000bb000000000a", @ANYBLOB="da96851a78b79d7867b57777c85ba3023394f620a4f75e93966d13f1d5aeb09ed46c5a57947c7507ed9b0a5367b2a241b3484cea6e3c59120290"], 0xfffffffffffffeaf}}, 0x0) socket$kcm(0x2, 0xa, 0x2) (async) socket$packet(0x11, 0x3, 0x300) (async) syz_open_procfs(0x0, &(0x7f00000000c0)='net/ptype\x00') (async) bind$packet(r0, &(0x7f00000002c0)={0x11, 0xf5, 0x0, 0x1, 0x1, 0x6, @multicast}, 0x14) (async) socket(0x200000000000011, 0x2, 0x0) (async) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) (async) preadv(r1, &(0x7f0000000100)=[{&(0x7f0000000140)=""/197, 0xc5}], 0x1, 0x36, 0x0) (async) socket$key(0xf, 0x3, 0x2) (async) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x301001) (async) sendmsg$key(r3, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="021800001c000000000000000000000005000600000000000a00000000000000000000000000000000000000000000000000000000000000020012000000000000000004fcffffff0600ff0000000000000000000000000000000000000000000000000001000000fe8000000000002100000000000000bb050005002b0000000a000000000000000000000000000000000008001900000000000a00000000000000fe8000000000000000000000000000bb000000000a", @ANYBLOB="da96851a78b79d7867b57777c85ba3023394f620a4f75e93966d13f1d5aeb09ed46c5a57947c7507ed9b0a5367b2a241b3484cea6e3c59120290"], 0xfffffffffffffeaf}}, 0x0) (async) 2.531172833s ago: executing program 1 (id=2611): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1300000010000000"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000c80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000005000000bf0900000000000055090100000000005e00000000000000bf91000000000000b70200000000000085000000a0000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 2.207776091s ago: executing program 1 (id=2612): socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x8}, @IPSET_ATTR_HASHSIZE={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x0) request_key(&(0x7f0000000180)='big_key\x00', &(0x7f00000002c0)={'syz', 0x3}, &(0x7f0000000280)='/dev/snd/\xfcotrolC#\x00\x00', 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x28, 0x0) r4 = dup(r3) ioctl$UFFDIO_API(r4, 0xc018aa3f, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x0, 0x0, 0x400, 0x0, 0x30}, 0x9c) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000000040)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) mlockall(0x7) close(r5) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) close(0xffffffffffffffff) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="1201010200000010f3b100000000010203010902240001010330050904000801030101000921ff00010122b00b09058103100002ba07424ae89cf7d629f944a4bedd8607e44fa2444b"], 0x0) mlock2(&(0x7f0000007000/0x1000)=nil, 0x1000, 0x0) r6 = socket$netlink(0x10, 0x3, 0xb) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0xc389c8727692dceb}, 0x1080) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="14060006000000000000000900040000c5b543623900000000"], 0x14}}, 0x4) r8 = syz_open_dev$sndctrl(&(0x7f0000000140), 0x1, 0x2400) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r8, 0xc0045540, &(0x7f0000000100)=0x2) 2.080457872s ago: executing program 5 (id=2613): r0 = syz_open_dev$video(&(0x7f0000000000), 0x3, 0x680) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000040)={0xa, @pix={0x4, 0x3, 0x38416761, 0x9, 0x1, 0x0, 0xc, 0x114c, 0x0, 0x3, 0x2, 0x5}}) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {0x4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x2, 0x100b, &(0x7f000000a380)=""/4107, 0x41100, 0x51, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {}, {0x8}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r4}]}}]}, 0x3c}}, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000140)={'ipvlan1\x00', &(0x7f0000000a40)=@ethtool_per_queue_op={0x4b, 0xf, [0x9, 0x8, 0x3, 0x7, 0x0, 0x7ff, 0x1, 0x4, 0x3, 0x8, 0x10000, 0x8, 0x3, 0x1000, 0xcb7, 0xf, 0x74, 0x4, 0x80000001, 0x8, 0x101, 0x5, 0x1e00000, 0x5, 0xfffffff5, 0x1fe, 0x7, 0x65, 0xd, 0xa, 0x6, 0x80, 0x8, 0x9, 0x200, 0x80000001, 0x3, 0x8, 0x3, 0x7, 0x400, 0x6, 0x7, 0x5, 0x688, 0x9, 0x40, 0x3, 0x80000000, 0x80000001, 0x9, 0xf0, 0x1a0, 0xffff, 0x6, 0xc, 0xc, 0x80, 0x4, 0x1, 0x5, 0x9, 0x7, 0x80000000, 0x7, 0x8001, 0x7, 0x300, 0x7, 0x2, 0x0, 0x101, 0x7, 0xdd, 0xfffffffc, 0x4, 0x7788, 0x4, 0xffff48cf, 0x4, 0x7, 0x7f, 0x6, 0x0, 0x5017, 0xe, 0x80000001, 0x0, 0x8001, 0x6, 0x2, 0x8, 0x23, 0x374, 0x3, 0x98f, 0x3, 0x8000, 0x5008, 0x4fb2, 0x3, 0x2, 0x10000, 0x80000001, 0x100, 0x2, 0x2, 0x400, 0x6, 0x2, 0x1000000, 0x9, 0x2, 0x7, 0x8, 0x4, 0x5, 0x80000001, 0x8, 0x1, 0xe920, 0x7, 0x0, 0x7f, 0x4, 0x200, 0x1, 0x101], "9b5e2a72cc6bf08f0dd22a51aa58fa9c9305f2fc0ac233aea67ccf25b703410efd1244ae2ccfd191ad8072e0a0c244ee47e708fad03bbbd36b7afe161b3fc7eaf40a08c8bbedbee72e9c167a2ed4824075c30d06f0f91c62d067a072f77485f4c36e5db201e54bade4d8441b08ebff8419ab5923508e3008865aae81ee67"}}) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x8, 0xf, &(0x7f00000009c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000030000008500000005000000bf090000000000004509010000000000ac00000000000000cd9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000190081054e81f782db4cb9040220080000000000000000070a000a000900142603600e1208001e0000050401d559e0e0df7fc07963acc3038ebba8000400027c035c0461c1d67f6f94007134cf6efb8001a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c3f5aeb4edbb57a5025ccca9e008026f6e6ddba61f5fad95667e006dcdf639500bfeb789d00000000000000d5e1cace81ed6c117ab5d6d69bda4039e81f86f60f0bffece0b42a9ecbee5de6ccd40dd6e4ed", 0xd8}], 0x1}, 0x14) syz_open_dev$video(&(0x7f0000000000), 0x3, 0x680) (async) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000040)={0xa, @pix={0x4, 0x3, 0x38416761, 0x9, 0x1, 0x0, 0xc, 0x114c, 0x0, 0x3, 0x2, 0x5}}) (async) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x600, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {0x4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x2, 0x100b, &(0x7f000000a380)=""/4107, 0x41100, 0x51, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x5, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {}, {0x8}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r4}]}}]}, 0x3c}}, 0x0) (async) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000140)={'ipvlan1\x00', &(0x7f0000000a40)=@ethtool_per_queue_op={0x4b, 0xf, [0x9, 0x8, 0x3, 0x7, 0x0, 0x7ff, 0x1, 0x4, 0x3, 0x8, 0x10000, 0x8, 0x3, 0x1000, 0xcb7, 0xf, 0x74, 0x4, 0x80000001, 0x8, 0x101, 0x5, 0x1e00000, 0x5, 0xfffffff5, 0x1fe, 0x7, 0x65, 0xd, 0xa, 0x6, 0x80, 0x8, 0x9, 0x200, 0x80000001, 0x3, 0x8, 0x3, 0x7, 0x400, 0x6, 0x7, 0x5, 0x688, 0x9, 0x40, 0x3, 0x80000000, 0x80000001, 0x9, 0xf0, 0x1a0, 0xffff, 0x6, 0xc, 0xc, 0x80, 0x4, 0x1, 0x5, 0x9, 0x7, 0x80000000, 0x7, 0x8001, 0x7, 0x300, 0x7, 0x2, 0x0, 0x101, 0x7, 0xdd, 0xfffffffc, 0x4, 0x7788, 0x4, 0xffff48cf, 0x4, 0x7, 0x7f, 0x6, 0x0, 0x5017, 0xe, 0x80000001, 0x0, 0x8001, 0x6, 0x2, 0x8, 0x23, 0x374, 0x3, 0x98f, 0x3, 0x8000, 0x5008, 0x4fb2, 0x3, 0x2, 0x10000, 0x80000001, 0x100, 0x2, 0x2, 0x400, 0x6, 0x2, 0x1000000, 0x9, 0x2, 0x7, 0x8, 0x4, 0x5, 0x80000001, 0x8, 0x1, 0xe920, 0x7, 0x0, 0x7f, 0x4, 0x200, 0x1, 0x101], "9b5e2a72cc6bf08f0dd22a51aa58fa9c9305f2fc0ac233aea67ccf25b703410efd1244ae2ccfd191ad8072e0a0c244ee47e708fad03bbbd36b7afe161b3fc7eaf40a08c8bbedbee72e9c167a2ed4824075c30d06f0f91c62d067a072f77485f4c36e5db201e54bade4d8441b08ebff8419ab5923508e3008865aae81ee67"}}) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x8, 0xf, &(0x7f00000009c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000030000008500000005000000bf090000000000004509010000000000ac00000000000000cd9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000190081054e81f782db4cb9040220080000000000000000070a000a000900142603600e1208001e0000050401d559e0e0df7fc07963acc3038ebba8000400027c035c0461c1d67f6f94007134cf6efb8001a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c3f5aeb4edbb57a5025ccca9e008026f6e6ddba61f5fad95667e006dcdf639500bfeb789d00000000000000d5e1cace81ed6c117ab5d6d69bda4039e81f86f60f0bffece0b42a9ecbee5de6ccd40dd6e4ed", 0xd8}], 0x1}, 0x14) (async) 1.970181824s ago: executing program 3 (id=2614): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1300000010000000"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000c80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7020000000000008580040005000000bf0900000000000055090100000000005e90000000000000bf91000000000000b70200000000000085000000a0000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 1.767798483s ago: executing program 3 (id=2615): r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="000125bd7000ffdbdf2514000000f800068008000600080000000400050004000200e4000300993abeffbf1d9a9e3fa7bf05974afc891bb5d1772c288f97adadc804ecb6a08cb9c1faf5c3db51432e1c644c17315ba92570dd8104ceed869d1e6d02aff96908bec4f9afb95ead33db8413951465a7a6681efb30e7d8a947e19af7bff82ce6d70ecc8dfa21544ce98f59dca95c2a6bba31ce1b45110b4a61674c38fa448d94ddba1f0ad635b64062f0eb570c876552d7fd16f059a7adacea90ec45942bbc53c812780923b560eccd332aa4d376387a0d0f1a17bbc0199fe8d19c46ad06309e968304628f3768b7abd1d74ea57dad12414580a1486aeaaf4ff50be6fa7027ad644800018044000400200001000a004e2400000005fe8000000000000000000000000000bb900a0000200002000a004e2100000ec000000000000000000000ffffac1414aa06000000ac00058007000100696200000c00028008000200001000001c00028008000300f7ffffff08000300f9ffffff08000300070000002400028008000200ac060000080003008000000008000300a2000000080003004240000014000280080002000800000008000300090000000700010069620000140002800800040004000000080003000f0000002400028008000400feffffff0800020004000000080002000800000008000100040000000c00068008000100ff0100000c00098008000100060000001c0002800400040004000400080001000b00000008000100008000001c000980080002000008000008000100ffffffff0800010000000000300007800c00040000000000000000000c0004004db00000000000000c0004000c00000000000000080001009900000098000580140002800800020001000000080004000008000008000100756470000800010075647000340002800800040001000000080004000100010008000400000000800800020000000000080003000400000008000200feffffff080001006574680008000100657468002c000280080004000000000008000300030000000800030007000000080003000302000008000400c2000000"], 0x318}, 0x1, 0x0, 0x0, 0x20000800}, 0x20000004) r1 = syz_open_dev$vim2m(&(0x7f0000000580), 0x0, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x8, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xe, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_DQ_RATE_ESTIMATOR={0x8}, @TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x3}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) prctl$PR_SET_MM_MAP(0x49, 0xe, &(0x7f0000000200)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000004000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000000/0xb000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0}, 0x68) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000002c0)={0x2, @raw_data="bdd60f58adcce0f352474234285574c86f54d269e1314060492caed3474b4b004521616a007805fd7dcfcaf483359ce731519a6fff33c3dea21eaec9c8dff60cca5e9bd370744323aa997b533f672817888b450b2945ba6ea55a77ce07ad61d2c0ef66a1575f25edea0e123f7aae2ddae1d7af0cd9ddce21d085e771c00c6d958b7d38d9f0aa6319a65273bd52763d850a7e23b87b37f0ab70e8fd394cc8bc66a8cca09fcb853ba08438ff777ab8c198b88fef35961469f0788e0ca891bff385991804f02ade369b"}) 1.737261974s ago: executing program 5 (id=2616): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001", @ANYRES16=r0, @ANYRESDEC, @ANYRES16, @ANYRESHEX=r0], 0x7c}, 0x1, 0x0, 0x0, 0x80}, 0x200408c1) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c00000003644385cddf0a01080000000000000000020008000900010073797a30000000000900030073797a3100000000140000001100010000000000000000000000000a"], 0x54}, 0x1, 0x0, 0x0, 0x58fe7ab67a988db6}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x1c) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, 0x0) bind$inet6(r1, &(0x7f0000000400)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000700)=ANY=[@ANYBLOB="aaaaaad0ffffffffff080045000028001414aa00004e2200"/38, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5010000090780000"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000380)=0x3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x400, 0xffffffff, 0x1000000}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$rxrpc(0x21, 0x2, 0x2) syz_io_uring_submit(r6, r7, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x42, 0x0) r8 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_SELECT(r8, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r9, 0xc08c5332, &(0x7f00000003c0)={0xc, 0x0, 0x0, 'queue1\x00', 0x200000}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r9, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) 1.436292621s ago: executing program 3 (id=2617): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=@ipv4_newrule={0x1c, 0x20, 0x301, 0x40, 0x0, {0x2, 0x10, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x1001c}}, 0x1c}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=@ipv4_newrule={0x1c, 0x20, 0x301, 0x40, 0x0, {0x2, 0x10, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x1001c}}, 0x1c}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) (async) 1.291822793s ago: executing program 3 (id=2618): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="840200001b000100000000000000000000000000000000000000000000000000ff020000000000000000000000000001000000e91000"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000008100000000000000000000000000009802000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000a00100001"], 0x284}}, 0x0) 1.021608237s ago: executing program 3 (id=2619): r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='fdinfo\x00') getdents64(r0, &(0x7f0000002440)=""/181, 0xb5) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002100)='/proc/bus/input/devices\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f0000000100)="66660f38825000baf80c66b82df75a8866efbafc0cb057ee66b9800000c00f326635000100000f30baf80c66b888674e8e66efbafc0c66b8a18624a466ef0f572a67660f38020cfa660f381df4660f2c400a660fc733660f3882930000", 0x5d}], 0x1, 0x1b, &(0x7f00000001c0)=[@cr0={0x0, 0x80000000}], 0x1) r2 = signalfd(0xffffffffffffffff, 0x0, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r3) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0) ioctl$HIDIOCGREPORT(r2, 0x400c4807, &(0x7f00000000c0)={0x1, 0x1, 0x1}) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_ep_write(r3, 0x81, 0xfffffffffffffdca, &(0x7f0000000080)="c0") readv(r4, &(0x7f0000000340)=[{&(0x7f0000000040)=""/5, 0x5}, {&(0x7f0000001180)=""/4096, 0x1000}], 0x2) 750.293722ms ago: executing program 5 (id=2620): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x2, 0x6, 0x750, 0x0, 0x290, 0x0, 0x0, 0x290, 0x680, 0x680, 0x680, 0x680, 0x680, 0x6, 0x0, {[{{@ipv6={@mcast1, @private1, [], [], 'pimreg0\x00', 'wg1\x00', {}, {}, 0x21}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @local, @mcast2, @mcast1, [0x0, 0x0, 0xff000000]}}, @common=@inet=@multiport={{0x50}, {0x40, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e20]}}]}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0x0, 0xff}}}}, {{@ipv6={@remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xffffffff], [0x0, 0x0, 0xffffff00], '\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffc}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv4=@loopback}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @mcast2, @mcast2, @private1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @broadcast}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7b0) (async, rerun: 32) r2 = socket$inet6(0xa, 0x2, 0x0) (async, rerun: 32) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="fc0000001900674c0000000000040000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a0000000000000052e67428bd0d5618ecd81d4c419bdb3bd3d313ba0fbd2d47ad3de4ae8a87b708a625a23502883a02cab87ee6e9340791954df87e63378856fa4426641d9c0d0243220376b883b1011f0bf0529188db56184c3dd735e35851d0eed936c06728a4", @ANYRESDEC=r2, @ANYRESOCT, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033", @ANYRES16=r2], 0xfc}}, 0x0) (async) sendto$inet6(r2, 0x0, 0x0, 0x8810, &(0x7f0000000080)={0xa, 0x4ea0, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}, 0x2ab8f1b6}, 0x1c) 623.698218ms ago: executing program 4 (id=2621): r0 = creat(0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f00000002c0), 0x1f, 0x40) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r5, 0x6, 0x4, &(0x7f00000000c0), &(0x7f0000000400)=0x4) sendmmsg$unix(r3, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r6 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x22402, 0x0) ioctl$TCSETAF(r6, 0x5408, &(0x7f0000000080)={0x800, 0x4001, 0x5, 0xfffa, 0xa, '\t\x00'}) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000180)='\r', 0x1}], 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x10000012, 0x0, 0x0, 0xb49, 0x5, 0x8, 0xfffffffd, 0x3}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYRESHEX=r3, @ANYRESDEC=r4, @ANYRES32], 0x328}, 0x1, 0x0, 0x0, 0x800}, 0x40044084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0xffffffffffffff5e, 0x0, 0x1, 0x0, 0x0, 0x803}, 0x4040085) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) r9 = syz_open_dev$radio(&(0x7f0000000100), 0x2, 0x2) ioctl$VIDIOC_SUBSCRIBE_EVENT(r9, 0x4020565a, &(0x7f0000000140)={0x3, 0x98f907, 0x5}) ioctl$VIDIOC_DQEVENT(r0, 0x80885659, &(0x7f0000000180)={0x0, @data}) sendmsg$inet(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) read$FUSE(r7, 0x0, 0x0) preadv2(0xffffffffffffffff, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 524.277784ms ago: executing program 5 (id=2622): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000440), 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000140)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005001d00000000000500010004"], 0x4c}}, 0x0) 306.745617ms ago: executing program 5 (id=2623): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) (async, rerun: 64) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async, rerun: 64) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0xb8, &(0x7f0000000140), &(0x7f00000000c0)=0x4) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='gid_map\x00') (async) r5 = socket$nl_route(0x10, 0x3, 0x0) (async) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) (async) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r7, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@getchain={0x2c, 0x11, 0x1, 0x2000000, 0xffffffff, {0x0, 0x0, 0x0, r7, {}, {}, {0xfff3}}, [{0x8, 0xb, 0x200}]}, 0x2c}}, 0x0) (async) bind$packet(r4, &(0x7f0000000040)={0x11, 0x6, r7, 0x1, 0x62, 0x6, @multicast}, 0x14) unshare(0x2c020400) (async) syz_io_uring_setup(0x5080, &(0x7f0000000180)={0x0, 0xdb0d, 0x800, 0xfffffffd, 0x3b5}, 0x0, 0x0) (async, rerun: 64) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) (async, rerun: 64) renameat2(0xffffffffffffff9c, &(0x7f0000002200)='./file0\x00', 0xffffffffffffff9c, 0x0, 0x2) (async) syz_io_uring_setup(0xe42, &(0x7f0000000140)={0x0, 0x2119, 0x400}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000040)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f00000004c0)={0x0, 0x0, 0x32}, &(0x7f0000000500)='./file0\x00', 0x18}) 201.296799ms ago: executing program 2 (id=2624): r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) r1 = syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000180)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a"], 0x7c}, 0x1, 0x0, 0x0, 0x20048800}, 0x0) socket$inet6(0xa, 0x2, 0x0) close_range(r3, r1, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="fa125914787f42345364ffcb90a420793bd8aafc9a7d1ae1231c201ff2c26b000e314af098fdc6aafd4bc46f3999973d9fd39577ac68248b4cbdd6b21bd4a2cf7d7ee19fc636024a012d71f90854b8f2a8300c3fb3d555c183dd7f9fdc", @ANYBLOB="eb1d279c6c7f749a1a9762616128f19ad0501ec711c5e1f3761416c3aaa3bea29bc0fbb4753c4ed400d3b61036bb7df5676c51a3348c5337c482da8ca6a3a6792436de52c8b5a195dd5f31dbaf1a8564ce4d15c8e32c999679c4a798c71d2539ae7ab2d92711240c55ad67203e9ab81a762918519d462355127d1434fc9769e163d76bae4a6091c955aecca7917e1846cd", @ANYBLOB="28683ee4300aff2da0207e8548cbf10a230a33ea1bb290602481925689bf1e9da8e0a7d6a97a9f2e05c55cabf023407e2b2d72ff17a2c12a08f2aab8737d6d55769976c894842ad97a99a218f0ce02917e909cbe5aa8ae5c5644a0ea07c61e305f40ba2840230abbd3661d2ea2f685a67de4ad0027496e94892411274bda9f079a976a050a787674c1d97af0a3af10ca08a8a3d1b29ef86901db8a43d30a146439cc1697bb5945cdd9c03a85f8af06cb0e67bb63e799a1f4588f53e1dd9f174ba191af24bb24ff56440f7b9ed4c08c23a585b0c30bdc1df22d00868deba36148b46205168d853320afb7edcc2a2b0c9bd6e9fb3d3ccafd4fe5864167", @ANYRESOCT=r0, @ANYRES8=r3], 0x0, 0x0, 0x0, 0x0, 0x1e00, 0xe, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FD_FRAMES(r4, 0x65, 0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0286405, &(0x7f0000000080)={0x719d, 0x9, {0x0}, {0xffffffffffffffff}, 0x5, 0x6}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000020605000000000000000000000000000900020073797a3200000000050004000000000005000500020000000c000300686173683a6970000c000780080006000000000005000100070000ec"], 0x50}}, 0x20000000) ioprio_get$pid(0x0, r6) ioctl$KDFONTOP_GET(r5, 0x4b72, &(0x7f0000000600)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r8, 0x107, 0x18, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'adiantum(xchacha20-simd,anubis-generic,nhpoly1305-sse2)\x00'}, 0x58) gettid() r10 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x0) read(r10, &(0x7f0000000200)=""/202, 0xca) 0s ago: executing program 3 (id=2625): syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040303dfe5000000010902b901010000003f0904"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f00000008c0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000e868495fb58d00b6ad1f50ad32d6ad25dfd73a015e0ca6a0f68a7d007dc6751dfb265a0e3ccae669e173a64bc1cfd514600650a58f145ff1205fc9ddaa275e687d452d64e7cc957d77578f4c25235138d5521f9453559c35da860e8efbc64e57cbb7aee976f2b54421eed73d5661cfeecf9c66c54c3b3ffe1b4ce25d7c983cd44c05bd0a48dfe3e26e7a23129d6606ed28a69989d552af6d9a9df2c3af36e0360070011bbecc2f4a3799af2551ce935b0f327cb3f011a7d06602e2fd5234712596b696418f163d1a1a83109753f54b21cd027edd68149ee99eebc6f7d6dd4aed4af7588c8e1b44ccb19e810879b81a7000000e7ffffff00000000d7900a820b63278f4e9a217b98ef7042ad2a928903000000cbe43a1ed25268816b00000000000009d27d753a30a147b24a48435bd8a568669596e9e0867958e1dd7a0defb6670c06054002238260000000000040587c1ed797aa21a38e1e389f640a0b8b0000000000a835ad0f61ba739cd0c31b05c00fba8a4aee676d7caa2e53b91a68ff2e60da7b01a2e5785a238afa4aba70c08b0d71b6f72d6a8d87fb08533d97ad96d3943c4cc8306dac433a5cdf78b04963d679d5a5d07e618a1ef9057fec00f9e93021f5a8d30e716de8cde9c6000000000c3b64d10f0939b42b33ab2a8717096c58bb3bb1d457d8bb96870f5a7e2ba31fd69bb80235d957eaa9a40b764e5381ffa604aaafb76a980e72b408f686b1"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) semtimedop(0x0, &(0x7f0000000300)=[{0x3, 0x100, 0x1000}], 0x1, &(0x7f0000000b00)) socket$inet6_mptcp(0xa, 0x1, 0x106) kernel console output (not intermixed with test programs): evice number 50 [ 871.069075][T13511] usb 3-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 871.093360][T13512] usb 6-1: config 0 has an invalid interface number: 32 but max is 0 [ 871.124950][T13512] usb 6-1: config 0 has no interface number 0 [ 871.134833][T14717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 871.149757][T13511] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.152420][T14717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 871.167616][T13512] usb 6-1: config 0 interface 32 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 871.182020][T13511] usb 3-1: config 0 descriptor?? [ 871.194957][T13512] usb 6-1: config 0 interface 32 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 871.210355][ T5877] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 871.244080][T13512] usb 6-1: New USB device found, idVendor=046d, idProduct=c71b, bcdDevice= 0.00 [ 871.257397][T13512] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.272972][T13512] usb 6-1: config 0 descriptor?? [ 871.380216][ T5877] usb 5-1: Using ep0 maxpacket: 16 [ 871.391453][ T5877] usb 5-1: config 95 has too many interfaces: 118, using maximum allowed: 32 [ 871.408953][ T5877] usb 5-1: config 95 has an invalid descriptor of length 99, skipping remainder of the config [ 871.421976][ T5877] usb 5-1: config 95 has 0 interfaces, different from the descriptor's value: 118 [ 871.437869][ T5877] usb 5-1: New USB device found, idVendor=046d, idProduct=c623, bcdDevice= 0.00 [ 871.447659][ T5877] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.689585][T13512] logitech-djreceiver 0003:046D:C71B.001E: unknown main item tag 0x2 [ 871.823899][T13512] logitech-djreceiver 0003:046D:C71B.001E: unknown main item tag 0x0 [ 871.840387][T13511] usb 3-1: Cannot set autoneg [ 871.848303][T13511] MOSCHIP usb-ethernet driver 3-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 871.870069][T13512] logitech-djreceiver 0003:046D:C71B.001E: unknown main item tag 0x0 [ 871.891420][T13512] logitech-djreceiver 0003:046D:C71B.001E: unknown main item tag 0x0 [ 871.910538][T13511] usb 3-1: USB disconnect, device number 36 [ 871.960583][T13512] logitech-djreceiver 0003:046D:C71B.001E: unknown main item tag 0x0 [ 871.984894][T14715] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 871.996172][T14715] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 872.048330][T13512] logitech-djreceiver 0003:046D:C71B.001E: unknown main item tag 0x0 [ 872.078524][T13512] logitech-djreceiver 0003:046D:C71B.001E: unknown main item tag 0x0 [ 872.125629][T14725] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2185'. [ 872.153192][T13512] logitech-djreceiver 0003:046D:C71B.001E: hidraw0: USB HID v0.00 Device [HID 046d:c71b] on usb-dummy_hcd.5-1/input32 [ 872.211283][T13512] usb 6-1: USB disconnect, device number 77 [ 872.349369][T14730] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2187'. [ 872.419823][T14726] fido_id[14726]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 872.874064][T14736] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2188'. [ 873.002100][T14746] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 873.043363][T14746] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 874.080402][T14764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 874.125449][T14764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 874.278205][T14764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 874.298310][T14764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 874.471151][T14766] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2197'. [ 874.515027][ T5877] usb 5-1: string descriptor 0 read error: -71 [ 874.522677][ T5877] usb 5-1: USB disconnect, device number 79 [ 874.649152][T14768] loop2: detected capacity change from 0 to 7 [ 874.669559][T11469] loop2: p1 [ 874.673516][T11469] loop2: partition table partially beyond EOD, truncated [ 874.685172][T11469] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 874.706327][T14768] loop2: p1 [ 874.736602][T14768] loop2: partition table partially beyond EOD, truncated [ 874.774706][T14768] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 874.902744][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 874.929469][T14772] : renamed from bond0 (while UP) [ 875.000848][ T30] kauditd_printk_skb: 39 callbacks suppressed [ 875.000867][ T30] audit: type=1326 audit(1747739866.736:876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.035738][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 875.081374][ T30] audit: type=1326 audit(1747739866.736:877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.133021][ T30] audit: type=1326 audit(1747739866.736:878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.162312][ T30] audit: type=1326 audit(1747739866.736:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.184700][ C1] vkms_vblank_simulate: vblank timer overrun [ 875.204128][ T30] audit: type=1326 audit(1747739866.736:880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.254427][ T30] audit: type=1326 audit(1747739866.736:881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=332 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.279213][ T30] audit: type=1326 audit(1747739866.736:882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.301568][ C1] vkms_vblank_simulate: vblank timer overrun [ 875.310146][ T30] audit: type=1326 audit(1747739866.736:883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.332495][ C1] vkms_vblank_simulate: vblank timer overrun [ 875.348224][ T30] audit: type=1326 audit(1747739866.736:884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.377158][ T30] audit: type=1326 audit(1747739866.736:885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14771 comm="syz.5.2200" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f69d6d8e969 code=0x7ffc0000 [ 875.399567][ C1] vkms_vblank_simulate: vblank timer overrun [ 875.783190][T14794] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2209'. [ 875.963172][T14797] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 875.976624][T14797] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 876.033849][T14802] loop2: detected capacity change from 0 to 7 [ 876.043438][T14802] loop2: p1 [ 876.046773][T14802] loop2: partition table partially beyond EOD, truncated [ 876.060889][T14802] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 876.070173][T13512] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 876.144247][ T5199] loop2: p1 [ 876.147536][ T5199] loop2: partition table partially beyond EOD, truncated [ 876.155627][ T5199] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 876.238484][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 876.250405][T13512] usb 5-1: Using ep0 maxpacket: 16 [ 876.258547][T13512] usb 5-1: config 95 has too many interfaces: 118, using maximum allowed: 32 [ 876.270007][T13512] usb 5-1: config 95 has an invalid descriptor of length 99, skipping remainder of the config [ 876.294473][T13512] usb 5-1: config 95 has 0 interfaces, different from the descriptor's value: 118 [ 876.327663][T13512] usb 5-1: New USB device found, idVendor=046d, idProduct=c623, bcdDevice= 0.00 [ 876.364472][T13512] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 876.409380][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 876.487039][T14813] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2216'. [ 876.498195][T14813] netlink: 'syz.5.2216': attribute type 10 has an invalid length. [ 876.539768][T14813] 8021q: adding VLAN 0 to HW filter on device  [ 876.557293][T14813] team0: Port device  added [ 876.566350][T14813] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2216'. [ 876.953079][T14795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 877.015882][T14795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 877.098222][T14813] team0 (unregistering): Port device team_slave_0 removed [ 877.289425][T14813] team0 (unregistering): Port device team_slave_1 removed [ 877.471429][T14813] team0 (unregistering): Port device  removed [ 877.728286][T14832] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2221'. [ 878.376981][T14840] xt_CT: You must specify a L4 protocol and not use inversions on it [ 878.832991][T13512] usb 5-1: string descriptor 0 read error: -71 [ 878.944739][T13512] usb 5-1: USB disconnect, device number 80 [ 879.025870][T14842] Cannot find del_set index 3 as target [ 879.444329][T13512] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 879.599671][T13512] usb 5-1: device descriptor read/64, error -71 [ 879.662303][T14848] loop2: detected capacity change from 0 to 7 [ 879.669508][T14848] loop2: p1 [ 879.675465][T14848] loop2: partition table partially beyond EOD, truncated [ 879.700656][T14848] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 879.839408][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 879.883234][T13512] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 879.952414][T14860] Cannot find del_set index 2 as target [ 880.009329][T14862] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2230'. [ 880.042003][T13512] usb 5-1: device descriptor read/64, error -71 [ 880.090079][T12263] usb 2-1: new full-speed USB device number 51 using dummy_hcd [ 880.160614][T13512] usb usb5-port1: attempt power cycle [ 880.200895][ T5877] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 880.242447][T12263] usb 2-1: not running at top speed; connect to a high speed hub [ 880.251645][T12263] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 880.261527][ T52] usb 6-1: new full-speed USB device number 78 using dummy_hcd [ 880.269241][T12263] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1023, setting to 64 [ 880.281969][T12263] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid wMaxPacketSize 0 [ 880.294441][T12263] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 880.303666][T12263] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.312110][T12263] usb 2-1: Product: syz [ 880.316359][T12263] usb 2-1: Manufacturer: syz [ 880.321068][T12263] usb 2-1: SerialNumber: syz [ 880.351034][ T5877] usb 3-1: device descriptor read/64, error -71 [ 880.453713][ T52] usb 6-1: config 2 has an invalid interface number: 1 but max is 0 [ 880.462784][ T52] usb 6-1: config 2 has no interface number 0 [ 880.468978][ T52] usb 6-1: config 2 interface 1 has no altsetting 0 [ 880.478792][ T52] usb 6-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice=47.78 [ 880.488610][ T52] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.496737][ T52] usb 6-1: Product: syz [ 880.501426][T13512] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 880.501429][ T52] usb 6-1: Manufacturer: syz [ 880.514503][ T52] usb 6-1: SerialNumber: syz [ 880.520807][T13512] usb 5-1: device descriptor read/8, error -71 [ 880.541293][T12263] cdc_ncm 2-1:1.0: bind() failure [ 880.551195][T12263] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 880.558327][T12263] cdc_ncm 2-1:1.1: bind() failure [ 880.571924][T12263] usb 2-1: USB disconnect, device number 51 [ 880.600428][ T5877] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 880.750205][ T5877] usb 3-1: device descriptor read/64, error -71 [ 880.760326][T13512] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 880.810914][T13512] usb 5-1: device descriptor read/8, error -71 [ 880.832972][ T52] snd-usb-audio 6-1:2.1: probe with driver snd-usb-audio failed with error -22 [ 880.865788][ T52] snd-usb-us122l 6-1:2.1: usb_set_interface error [ 880.876878][ T52] snd-usb-us122l 6-1:2.1: probe with driver snd-usb-us122l failed with error -22 [ 880.887228][ T5877] usb usb3-port1: attempt power cycle [ 880.903788][ T52] usb 6-1: USB disconnect, device number 78 [ 880.942673][T13512] usb usb5-port1: unable to enumerate USB device [ 880.994721][T11469] udevd[11469]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:2.1/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 881.010384][T14866] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2232'. [ 881.224264][T14873] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 881.234776][T14873] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 881.250405][ T5877] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 881.292635][ T5877] usb 3-1: device descriptor read/8, error -71 [ 881.316824][T14875] xt_CT: You must specify a L4 protocol and not use inversions on it [ 881.530310][ T5877] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 881.561886][ T5877] usb 3-1: device descriptor read/8, error -71 [ 881.670712][ T5877] usb usb3-port1: unable to enumerate USB device [ 881.936195][T14886] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 881.986371][T14886] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 882.050383][T13512] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 882.132006][T14888] xt_NFQUEUE: number of total queues is 0 [ 882.202350][T13512] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 882.205515][T14889] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 882.226331][T13512] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 882.258467][T14889] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 882.275657][T13512] usb 6-1: config 0 descriptor?? [ 882.537002][T14894] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2243'. [ 882.726182][T13512] [drm:udl_init] *ERROR* Selecting channel failed [ 882.746317][T13512] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 2 [ 882.770203][T13512] [drm] Initialized udl on minor 2 [ 882.778988][T13512] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 882.799920][T13512] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 882.811361][T13511] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 882.832705][T13512] usb 6-1: USB disconnect, device number 79 [ 882.841238][T13511] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed [ 882.858287][T13511] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 883.067617][T14901] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 883.079502][T14901] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 883.396610][T14910] loop2: detected capacity change from 0 to 7 [ 883.409266][T11469] Dev loop2: unable to read RDB block 7 [ 883.415126][T11469] loop2: unable to read partition table [ 883.422247][T11469] loop2: partition table beyond EOD, truncated [ 883.429423][T14910] Dev loop2: unable to read RDB block 7 [ 883.446393][T14910] loop2: unable to read partition table [ 883.458173][T14910] loop2: partition table beyond EOD, truncated [ 883.465358][T14910] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 883.650217][T13512] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 883.782035][T14929] netlink: 80 bytes leftover after parsing attributes in process `syz.4.2255'. [ 883.810060][T13512] usb 3-1: Using ep0 maxpacket: 16 [ 883.816694][T13512] usb 3-1: too many configurations: 123, using maximum allowed: 8 [ 883.835475][T13512] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 883.909712][T13512] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 883.921734][T13512] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 883.933947][T13512] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 883.985424][T13512] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 883.997432][T13512] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 884.011717][T13512] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 884.036132][T13512] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 884.051820][T13512] usb 3-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 884.061324][T13512] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45 [ 884.069407][T13512] usb 3-1: SerialNumber: syz [ 884.100596][T13512] usb 3-1: config 0 descriptor?? [ 884.142166][T13512] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input79 [ 884.275472][T13511] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 884.334324][T14934] xt_CT: You must specify a L4 protocol and not use inversions on it [ 884.514634][ T5184] bcm5974 3-1:0.0: could not read from device [ 884.585969][T13511] usb 5-1: Using ep0 maxpacket: 16 [ 884.631378][ T5184] bcm5974 3-1:0.0: could not read from device [ 884.639564][T13511] usb 5-1: unable to get BOS descriptor or descriptor too short [ 884.660427][T13511] usb 5-1: config 1 interface 0 has no altsetting 0 [ 884.670298][T13511] usb 5-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 884.679490][T13511] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 884.687711][T13511] usb 5-1: Product: syz [ 884.695275][T13511] usb 5-1: Manufacturer: syz [ 884.705804][T13511] usb 5-1: SerialNumber: syz [ 884.735352][T14943] loop2: detected capacity change from 0 to 7 [ 884.746293][ T5184] bcm5974 3-1:0.0: could not read from device [ 884.800809][T14943] loop2: p1 [ 884.805392][T14943] loop2: partition table partially beyond EOD, truncated [ 884.813959][T14943] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 884.841256][ T5184] bcm5974 3-1:0.0: could not read from device [ 884.887251][T13512] usb 3-1: USB disconnect, device number 41 [ 885.147398][T14945] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2259'. [ 885.156770][T14945] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2259'. [ 885.458303][ T52] IPVS: starting estimator thread 0... [ 885.550178][T14949] IPVS: using max 24 ests per chain, 57600 per kthread [ 885.713376][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 885.770118][T13512] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 885.988687][T13512] usb 3-1: config 36 interface 0 altsetting 0 endpoint 0x6 has an invalid bInterval 192, changing to 11 [ 886.008066][T13512] usb 3-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 886.020951][T13512] usb 3-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 886.034489][T13512] usb 3-1: Manufacturer: syz [ 886.039516][T13512] usb 3-1: SerialNumber: syz [ 886.566772][T14966] loop2: detected capacity change from 0 to 7 [ 886.602457][T12245] Dev loop2: unable to read RDB block 7 [ 886.618564][T12245] loop2: unable to read partition table [ 886.634689][T12245] loop2: partition table beyond EOD, truncated [ 886.691942][T14966] Dev loop2: unable to read RDB block 7 [ 886.748161][T14966] loop2: unable to read partition table [ 886.790559][T14966] loop2: partition table beyond EOD, truncated [ 886.797966][T14966] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 887.278958][T13512] usbhid 3-1:36.0: couldn't find an input interrupt endpoint [ 887.325696][T13512] usb 3-1: USB disconnect, device number 42 [ 887.796637][T13511] usbhid 5-1:1.0: can't add hid device: -71 [ 887.810770][T13511] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 887.822244][T13511] usb 5-1: USB disconnect, device number 85 [ 887.910127][ T52] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 887.928351][T14992] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 888.070097][ T52] usb 6-1: Using ep0 maxpacket: 8 [ 888.087799][ T52] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 888.099271][ T52] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 888.117496][ T52] usb 6-1: Product: syz [ 888.122355][ T52] usb 6-1: Manufacturer: syz [ 888.128555][ T52] usb 6-1: SerialNumber: syz [ 888.173879][ T52] usb 6-1: config 0 descriptor?? [ 888.394444][T15004] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2274'. [ 888.500450][ T52] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 888.590893][T15008] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 888.645387][T15008] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 888.688626][T15015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 888.697809][T15015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 888.761282][T13511] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 888.791339][T13512] usb 3-1: new full-speed USB device number 43 using dummy_hcd [ 888.967904][T13512] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 889.025167][T13512] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x94, changing to 0x84 [ 889.158291][T13512] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10 [ 889.301353][T13512] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 889.340834][T13511] usb 5-1: config 0 has no interfaces? [ 889.349760][T13512] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 889.375396][T13512] usb 3-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=ed.ae [ 889.385432][T13512] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.394066][T13512] usb 3-1: Product: syz [ 889.398492][T13512] usb 3-1: Manufacturer: syz [ 889.403524][T13512] usb 3-1: SerialNumber: syz [ 889.414083][T13512] usb 3-1: config 0 descriptor?? [ 889.431624][T13512] input: KB Gear Tablet as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input80 [ 889.445749][T13511] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 889.455488][T13511] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.463988][T13511] usb 5-1: Product: syz [ 889.468335][T13511] usb 5-1: Manufacturer: syz [ 889.473483][T13511] usb 5-1: SerialNumber: syz [ 889.539419][T15025] xt_CT: You must specify a L4 protocol and not use inversions on it [ 889.593451][T13511] usb 5-1: config 0 descriptor?? [ 889.647458][T13509] usb 3-1: USB disconnect, device number 43 [ 889.730768][ T52] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 890.270229][T15035] fuse: Bad value for 'fd' [ 890.530214][T13509] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 890.690427][ T52] usb 6-1: USB disconnect, device number 80 [ 890.733456][T13509] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 196, using maximum allowed: 30 [ 890.764879][T13509] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 890.914137][T13509] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 196 [ 891.009745][T13509] usb 3-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.00 [ 891.047981][T13509] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 891.153931][T13509] usb 3-1: config 0 descriptor?? [ 891.358899][T15057] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 891.368060][T15057] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 891.428196][T15057] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2287'. [ 891.593022][T13509] holtek_kbd 0003:04D9:A055.001F: bogus close delimiter [ 891.609408][T13509] holtek_kbd 0003:04D9:A055.001F: item 0 4 2 10 parsing failed [ 891.627552][T13509] holtek_kbd 0003:04D9:A055.001F: probe with driver holtek_kbd failed with error -22 [ 891.718068][T15067] futex_wake_op: syz.5.2288 tries to shift op by 32; fix this program [ 891.757826][T15067] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 891.837435][ T52] usb 3-1: USB disconnect, device number 44 [ 891.966836][T12263] usb 5-1: USB disconnect, device number 86 [ 892.038345][T15071] netlink: 'syz.5.2290': attribute type 8 has an invalid length. [ 892.346796][ T52] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 892.400435][T12263] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 892.470125][ T5877] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 892.520548][ T52] usb 6-1: Using ep0 maxpacket: 8 [ 892.536879][ T52] usb 6-1: config 0 has no interfaces? [ 892.549202][ T52] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 892.577936][ T52] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 892.597217][T12263] usb 5-1: unable to get BOS descriptor or descriptor too short [ 892.606719][T12263] usb 5-1: too many configurations: 22, using maximum allowed: 8 [ 892.619000][ T52] usb 6-1: config 0 descriptor?? [ 892.640801][ T5877] usb 2-1: Using ep0 maxpacket: 32 [ 892.661694][T12263] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 892.680523][ T5877] usb 2-1: unable to get BOS descriptor or descriptor too short [ 892.696392][T12263] usb 5-1: can't read configurations, error -71 [ 892.708284][ T5877] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 256, setting to 64 [ 892.723482][ T5877] usb 2-1: New USB device found, idVendor=0123, idProduct=0001, bcdDevice=4a.fe [ 892.733183][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 892.741521][ T5877] usb 2-1: Product: syz [ 892.745815][ T5877] usb 2-1: Manufacturer: syz [ 892.750570][ T5877] usb 2-1: SerialNumber: syz [ 892.769917][ T5877] usb 2-1: config 0 descriptor?? [ 892.911460][T15071] SET target dimension over the limit! [ 892.928286][T13509] usb 6-1: USB disconnect, device number 81 [ 893.002814][ T5877] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input81 [ 893.228489][T13509] usb 2-1: USB disconnect, device number 52 [ 893.279347][T15096] xt_CT: You must specify a L4 protocol and not use inversions on it [ 894.300206][T12263] usb 6-1: new full-speed USB device number 82 using dummy_hcd [ 894.450327][T12263] usb 6-1: device descriptor read/64, error -71 [ 894.700153][T12263] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 894.870094][T12263] usb 6-1: device descriptor read/64, error -71 [ 895.000475][T12263] usb usb6-port1: attempt power cycle [ 895.399185][T15127] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2302'. [ 895.470653][T15129] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2302'. [ 895.490811][T12263] usb 6-1: new full-speed USB device number 84 using dummy_hcd [ 895.547004][T12263] usb 6-1: device descriptor read/8, error -71 [ 895.618918][T15133] xt_CT: You must specify a L4 protocol and not use inversions on it [ 895.850240][T12263] usb 6-1: new full-speed USB device number 85 using dummy_hcd [ 895.887107][T12263] usb 6-1: device descriptor read/8, error -71 [ 896.017960][T12263] usb usb6-port1: unable to enumerate USB device [ 897.430159][T12263] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 897.594187][T12263] usb 2-1: Using ep0 maxpacket: 16 [ 897.603731][T12263] usb 2-1: config 0 has an invalid interface number: 214 but max is 0 [ 897.612988][T12263] usb 2-1: config 0 has no interface number 0 [ 897.619217][T12263] usb 2-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 897.640401][T12263] usb 2-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 897.653222][T12263] usb 2-1: New USB device strings: Mfr=1, Product=0, SerialNumber=3 [ 897.678989][T12263] usb 2-1: Manufacturer: syz [ 897.694437][T12263] usb 2-1: SerialNumber: syz [ 897.723721][T12263] usb 2-1: config 0 descriptor?? [ 897.790070][ T5877] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 897.820210][T15139] FAULT_INJECTION: forcing a failure. [ 897.820210][T15139] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 897.858097][T15139] CPU: 0 UID: 0 PID: 15139 Comm: syz.4.2304 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 897.858126][T15139] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 897.858136][T15139] Call Trace: [ 897.858143][T15139] [ 897.858151][T15139] dump_stack_lvl+0x189/0x250 [ 897.858186][T15139] ? __lock_acquire+0xaac/0xd20 [ 897.858218][T15139] ? __pfx_dump_stack_lvl+0x10/0x10 [ 897.858245][T15139] ? __pfx__printk+0x10/0x10 [ 897.858264][T15139] ? __might_fault+0xb0/0x130 [ 897.858291][T15139] should_fail_ex+0x414/0x560 [ 897.858312][T15139] _copy_from_iter+0x1db/0x15a0 [ 897.858348][T15139] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 897.858372][T15139] ? kmem_cache_alloc_node_noprof+0x217/0x3c0 [ 897.858398][T15139] ? __pfx__copy_from_iter+0x10/0x10 [ 897.858424][T15139] ? __build_skb_around+0x257/0x3e0 [ 897.858446][T15139] ? netlink_sendmsg+0x642/0xb30 [ 897.858462][T15139] ? skb_put+0x11b/0x210 [ 897.858491][T15139] netlink_sendmsg+0x6b2/0xb30 [ 897.858532][T15139] ? __pfx_netlink_sendmsg+0x10/0x10 [ 897.858558][T15139] ? aa_sock_msg_perm+0x94/0x160 [ 897.858580][T15139] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 897.858597][T15139] ? __pfx_netlink_sendmsg+0x10/0x10 [ 897.858615][T15139] __sock_sendmsg+0x219/0x270 [ 897.858639][T15139] ____sys_sendmsg+0x505/0x830 [ 897.858674][T15139] ? __pfx_____sys_sendmsg+0x10/0x10 [ 897.858710][T15139] ? import_iovec+0x74/0xa0 [ 897.858738][T15139] ___sys_sendmsg+0x21f/0x2a0 [ 897.858760][T15139] ? __pfx____sys_sendmsg+0x10/0x10 [ 897.858841][T15139] ? __fget_files+0x2a/0x420 [ 897.858867][T15139] ? __fget_files+0x3a0/0x420 [ 897.858903][T15139] __x64_sys_sendmsg+0x19b/0x260 [ 897.858926][T15139] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 897.858966][T15139] ? do_syscall_64+0xba/0x210 [ 897.859000][T15139] do_syscall_64+0xf6/0x210 [ 897.859028][T15139] ? clear_bhb_loop+0x60/0xb0 [ 897.859066][T15139] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 897.859085][T15139] RIP: 0033:0x7f016718e969 [ 897.859099][T15139] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 897.859118][T15139] RSP: 002b:00007f0168041038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 897.859141][T15139] RAX: ffffffffffffffda RBX: 00007f01673b5fa0 RCX: 00007f016718e969 [ 897.859157][T15139] RDX: 0000000000004800 RSI: 00002000000035c0 RDI: 0000000000000003 [ 897.859169][T15139] RBP: 00007f0168041090 R08: 0000000000000000 R09: 0000000000000000 [ 897.859181][T15139] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 897.859193][T15139] R13: 0000000000000000 R14: 00007f01673b5fa0 R15: 00007f01674dfa28 [ 897.859220][T15139] [ 897.940164][ T5877] usb 6-1: Using ep0 maxpacket: 32 [ 898.225375][ T5877] usb 6-1: config 0 has an invalid interface number: 219 but max is 0 [ 898.248768][ T5877] usb 6-1: config 0 has no interface number 0 [ 898.256861][ T5877] usb 6-1: config 0 interface 219 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 898.269764][ T5877] usb 6-1: config 0 interface 219 altsetting 0 endpoint 0x8B has invalid maxpacket 28739, setting to 1024 [ 898.284273][T15140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 898.293390][T15140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 898.302179][ T5877] usb 6-1: config 0 interface 219 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 898.330767][ T5877] usb 6-1: config 0 interface 219 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 898.342083][ T5877] usb 6-1: config 0 interface 219 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 898.356887][ T5877] usb 6-1: New USB device found, idVendor=108c, idProduct=0169, bcdDevice=75.b9 [ 898.381494][ T5877] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 898.390327][ T5877] usb 6-1: Product: syz [ 898.394725][ T5877] usb 6-1: Manufacturer: syz [ 898.400822][ T5877] usb 6-1: SerialNumber: syz [ 898.414020][ T5877] usb 6-1: config 0 descriptor?? [ 898.420953][T15137] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 898.637536][ T5877] etas_es58x 6-1:0.219: Starting syz syz (Serial Number syz) [ 898.836731][ T5877] etas_es58x 6-1:0.219: could not parse product info: 'Ђ' [ 898.971295][T15162] netlink: 'syz.2.2311': attribute type 11 has an invalid length. [ 898.988203][T15162] netlink: 140 bytes leftover after parsing attributes in process `syz.2.2311'. [ 899.148412][T13511] usb 6-1: USB disconnect, device number 86 [ 899.156940][T13511] etas_es58x 6-1:0.219: Disconnecting syz syz [ 900.028493][T15184] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 900.212207][T12263] usbtouchscreen 2-1:0.214: Failed to read FW rev: -71 [ 900.234667][T12263] usbtouchscreen 2-1:0.214: probe with driver usbtouchscreen failed with error -71 [ 900.301544][T12263] usb 2-1: USB disconnect, device number 53 [ 900.352540][T15197] FAULT_INJECTION: forcing a failure. [ 900.352540][T15197] name failslab, interval 1, probability 0, space 0, times 0 [ 900.390468][T15197] CPU: 1 UID: 0 PID: 15197 Comm: syz.1.2318 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 900.390500][T15197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 900.390513][T15197] Call Trace: [ 900.390523][T15197] [ 900.390532][T15197] dump_stack_lvl+0x189/0x250 [ 900.390572][T15197] ? __pfx_dump_stack_lvl+0x10/0x10 [ 900.390603][T15197] ? __pfx__printk+0x10/0x10 [ 900.390632][T15197] ? ref_tracker_alloc+0x318/0x460 [ 900.390660][T15197] should_fail_ex+0x414/0x560 [ 900.390689][T15197] should_failslab+0xa8/0x100 [ 900.390720][T15197] kmem_cache_alloc_noprof+0x73/0x3c0 [ 900.390746][T15197] ? skb_clone+0x212/0x3a0 [ 900.390782][T15197] skb_clone+0x212/0x3a0 [ 900.390817][T15197] __netlink_deliver_tap+0x404/0x850 [ 900.390856][T15197] ? netlink_deliver_tap+0x2e/0x1b0 [ 900.390884][T15197] netlink_deliver_tap+0x19c/0x1b0 [ 900.390911][T15197] netlink_unicast+0x72f/0x8d0 [ 900.390946][T15197] netlink_sendmsg+0x805/0xb30 [ 900.390982][T15197] ? __pfx_netlink_sendmsg+0x10/0x10 [ 900.391012][T15197] ? aa_sock_msg_perm+0x94/0x160 [ 900.391038][T15197] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 900.391062][T15197] ? __pfx_netlink_sendmsg+0x10/0x10 [ 900.391088][T15197] __sock_sendmsg+0x219/0x270 [ 900.391115][T15197] ____sys_sendmsg+0x505/0x830 [ 900.391152][T15197] ? __pfx_____sys_sendmsg+0x10/0x10 [ 900.391192][T15197] ? import_iovec+0x74/0xa0 [ 900.391227][T15197] ___sys_sendmsg+0x21f/0x2a0 [ 900.391261][T15197] ? __pfx____sys_sendmsg+0x10/0x10 [ 900.391337][T15197] ? __fget_files+0x2a/0x420 [ 900.391362][T15197] ? __fget_files+0x3a0/0x420 [ 900.391402][T15197] __x64_sys_sendmsg+0x19b/0x260 [ 900.391434][T15197] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 900.391483][T15197] ? do_syscall_64+0xba/0x210 [ 900.391521][T15197] do_syscall_64+0xf6/0x210 [ 900.391550][T15197] ? clear_bhb_loop+0x60/0xb0 [ 900.391576][T15197] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 900.391597][T15197] RIP: 0033:0x7f887ff8e969 [ 900.391616][T15197] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 900.391634][T15197] RSP: 002b:00007f8880eb3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 900.391656][T15197] RAX: ffffffffffffffda RBX: 00007f88801b5fa0 RCX: 00007f887ff8e969 [ 900.391672][T15197] RDX: 0000000000004800 RSI: 00002000000035c0 RDI: 0000000000000003 [ 900.391685][T15197] RBP: 00007f8880eb3090 R08: 0000000000000000 R09: 0000000000000000 [ 900.391698][T15197] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 900.391710][T15197] R13: 0000000000000000 R14: 00007f88801b5fa0 R15: 00007f88802dfa28 [ 900.391742][T15197] [ 900.658995][ C1] vkms_vblank_simulate: vblank timer overrun [ 900.765081][ C1] vkms_vblank_simulate: vblank timer overrun [ 901.732818][T13511] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 901.923882][T13524] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 901.956065][T13511] usb 5-1: config 0 has no interfaces? [ 902.080096][T13512] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 902.103442][T13511] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 902.113450][T13524] usb 2-1: config 0 has an invalid interface number: 64 but max is 0 [ 902.140161][T13524] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 902.148671][T15234] netlink: 'syz.2.2326': attribute type 7 has an invalid length. [ 902.171963][T13511] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.245469][T13524] usb 2-1: config 0 has no interface number 0 [ 902.252500][T13511] usb 5-1: Product: syz [ 902.260129][T13511] usb 5-1: Manufacturer: syz [ 902.264778][T13511] usb 5-1: SerialNumber: syz [ 902.278780][T13524] usb 2-1: New USB device found, idVendor=046d, idProduct=0823, bcdDevice=39.48 [ 902.288068][T13524] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 902.297190][T13511] usb 5-1: config 0 descriptor?? [ 902.307565][T13524] usb 2-1: Product: syz [ 902.311968][T13524] usb 2-1: Manufacturer: syz [ 902.335440][T13512] usb 6-1: device descriptor read/64, error -71 [ 902.347856][T13524] usb 2-1: SerialNumber: syz [ 902.368780][T13524] usb 2-1: config 0 descriptor?? [ 902.600394][T13512] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 902.623685][T15216] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 902.752421][T15240] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2321'. [ 902.996366][T13512] usb 6-1: device descriptor read/64, error -71 [ 903.135906][T13512] usb usb6-port1: attempt power cycle [ 903.580158][T13512] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 903.612519][T13512] usb 6-1: device descriptor read/8, error -71 [ 903.837677][T15248] vivid-000: disconnect [ 903.920513][T13512] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 904.197302][T15241] vivid-000: reconnect [ 904.248847][T13512] usb 6-1: device descriptor read/8, error -71 [ 904.370431][T13512] usb usb6-port1: unable to enumerate USB device [ 904.651262][T12263] usb 2-1: USB disconnect, device number 54 [ 904.846511][T12263] usb 5-1: USB disconnect, device number 89 [ 905.084761][T15261] 8021q: VLANs not supported on ip_vti0 [ 905.129137][T15269] loop2: detected capacity change from 0 to 7 [ 905.146244][ T6145] Dev loop2: unable to read RDB block 7 [ 905.153359][ T6145] loop2: unable to read partition table [ 905.159486][ T6145] loop2: partition table beyond EOD, truncated [ 905.223592][T15269] Dev loop2: unable to read RDB block 7 [ 905.246258][T15269] loop2: unable to read partition table [ 905.270829][T15269] loop2: partition table beyond EOD, truncated [ 905.287786][T15269] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 905.430084][T12263] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 905.434788][ T30] kauditd_printk_skb: 194 callbacks suppressed [ 905.434808][ T30] audit: type=1326 audit(1747739897.176:1080): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 905.560039][ T30] audit: type=1326 audit(1747739897.246:1081): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 905.874750][T12263] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 905.904639][T12263] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 905.974541][ T30] audit: type=1326 audit(1747739897.246:1082): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x7ffc0000 [ 906.012952][T12263] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 906.280894][T12263] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 906.312732][ T30] audit: type=1326 audit(1747739897.246:1083): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 906.343266][T12263] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 906.411483][T12263] usb 5-1: config 0 descriptor?? [ 906.449610][ T30] audit: type=1326 audit(1747739897.246:1084): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 906.564175][T15292] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 906.623614][ T30] audit: type=1326 audit(1747739897.246:1085): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 906.625387][T15292] netlink: 'syz.5.2341': attribute type 1 has an invalid length. [ 906.646001][ C1] vkms_vblank_simulate: vblank timer overrun [ 906.770368][ T30] audit: type=1326 audit(1747739897.246:1086): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 906.792410][T15293] bond0: entered promiscuous mode [ 906.799096][T15293] bond0: entered allmulticast mode [ 906.805504][T15293] 8021q: adding VLAN 0 to HW filter on device bond0 [ 906.818791][ T30] audit: type=1326 audit(1747739897.246:1087): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 906.852391][ T30] audit: type=1326 audit(1747739897.246:1088): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 906.875700][ T30] audit: type=1326 audit(1747739897.246:1089): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15273 comm="syz.1.2335" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f887ff2ab39 code=0x7ffc0000 [ 906.898075][ C1] vkms_vblank_simulate: vblank timer overrun [ 906.905642][T15292] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 906.909227][T12263] plantronics 0003:047F:FFFF.0020: unknown main item tag 0x4 [ 906.949095][T12263] plantronics 0003:047F:FFFF.0020: item fetching failed at offset 11/15 [ 906.988800][T12263] plantronics 0003:047F:FFFF.0020: parse failed [ 907.010811][T15292] batadv1: entered promiscuous mode [ 907.026997][T15292] batadv1: entered allmulticast mode [ 907.040318][ T4944] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 907.049229][T12263] plantronics 0003:047F:FFFF.0020: probe with driver plantronics failed with error -22 [ 907.071396][T15292] bond0: (slave batadv1): Enslaving as an active interface with an up link [ 907.106901][T15272] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 907.125196][T15272] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 907.203241][T13524] usb 5-1: USB disconnect, device number 90 [ 907.285140][T11557] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 907.640368][T13512] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 907.840162][T13512] usb 6-1: Using ep0 maxpacket: 16 [ 907.871988][T13512] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 907.904423][T13512] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 908.040065][T13512] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 16605, setting to 1024 [ 908.110019][T13512] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 908.162248][T13512] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 908.190088][T12263] usb 5-1: new low-speed USB device number 91 using dummy_hcd [ 908.208528][T13512] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 908.271652][T13512] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 908.323992][T13512] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 908.350022][T13512] usb 6-1: Manufacturer: syz [ 908.362442][T12263] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 908.365303][T13512] usb 6-1: config 0 descriptor?? [ 908.380082][T12263] usb 5-1: config 0 has no interface number 0 [ 908.420348][T12263] usb 5-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 908.455482][T12263] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 908.477231][T15312] binder: 15311:15312 ioctl 5423 200000000040 returned -22 [ 908.507283][T12263] usb 5-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 908.560102][T12263] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 908.597379][T12263] usb 5-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 908.629099][T12263] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 908.668275][T12263] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 908.732462][T15317] tipc: Enabling of bearer rejected, failed to enable media [ 908.740940][T13512] rc_core: IR keymap rc-hauppauge not found [ 908.746840][T13512] Registered IR keymap rc-empty [ 908.759587][T12263] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 908.779420][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 908.805658][T12263] usb 5-1: config 0 descriptor?? [ 908.824525][T15307] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 908.832398][T15307] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 908.844356][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 908.854684][T12263] ldusb 5-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 908.885398][T13512] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 908.924902][T13512] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input83 [ 908.943850][T15321] loop2: detected capacity change from 0 to 7 [ 908.951619][T15321] Dev loop2: unable to read RDB block 7 [ 908.960931][T15321] loop2: unable to read partition table [ 908.966847][T15321] loop2: partition table beyond EOD, truncated [ 908.973462][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 908.980721][ C0] mceusb 6-1:0.0: Error: urb status = -75 [ 908.987369][T15321] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 909.010511][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.030464][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.062216][T15307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 909.070213][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.095967][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.097952][T15307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 909.144571][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.199145][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.214161][T15307] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2345'. [ 909.230688][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.252441][T15307] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2345'. [ 909.274297][T15331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 909.283629][T15331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 909.340448][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.380325][T13512] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 909.393125][T15307] dummy0: entered promiscuous mode [ 909.423148][T15307] team0: entered promiscuous mode [ 909.424839][T13512] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 909.442574][T15307] hsr1: Slave A (dummy0) is not up; please bring it up to get a fully working HSR network [ 909.448814][T13512] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 909.472249][T15337] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2353'. [ 909.500632][T13512] usb 6-1: USB disconnect, device number 91 [ 909.528960][T15338] rdma_op ffff88807fe679f0 conn xmit_rdma 0000000000000000 [ 909.565596][T15307] hsr1: Slave B (team0) is not up; please bring it up to get a fully working HSR network [ 909.656601][T13524] usb 5-1: USB disconnect, device number 91 [ 909.685594][T13524] ldusb 5-1:0.55: LD USB Device #0 now disconnected [ 910.428938][T12263] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 910.640174][T12263] usb 6-1: Using ep0 maxpacket: 8 [ 910.655843][T12263] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 910.666602][T12263] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 910.736518][ T5877] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 910.764654][T12263] usb 6-1: Product: syz [ 910.774888][T12263] usb 6-1: Manufacturer: syz [ 910.782029][T12263] usb 6-1: SerialNumber: syz [ 910.835618][T12263] usb 6-1: config 0 descriptor?? [ 910.846616][T15350] netlink: 'syz.1.2356': attribute type 1 has an invalid length. [ 910.900181][ T5877] usb 5-1: Using ep0 maxpacket: 32 [ 910.909746][ T5877] usb 5-1: config 0 has an invalid interface number: 219 but max is 0 [ 910.918592][ T5877] usb 5-1: config 0 has no interface number 0 [ 910.925322][ T5877] usb 5-1: config 0 interface 219 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 910.937796][ T5877] usb 5-1: config 0 interface 219 altsetting 0 endpoint 0x8B has invalid maxpacket 28739, setting to 1024 [ 910.949607][ T5877] usb 5-1: config 0 interface 219 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 910.962326][ T5877] usb 5-1: config 0 interface 219 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 910.972363][ T5877] usb 5-1: config 0 interface 219 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0 [ 910.985414][ T5877] usb 5-1: New USB device found, idVendor=108c, idProduct=0169, bcdDevice=75.b9 [ 910.995002][ T5877] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 911.003097][ T5877] usb 5-1: Product: syz [ 911.008595][ T5877] usb 5-1: Manufacturer: syz [ 911.013567][ T5877] usb 5-1: SerialNumber: syz [ 911.023683][ T5877] usb 5-1: config 0 descriptor?? [ 911.024072][T15355] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2358'. [ 911.041264][T15344] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 911.050645][T15341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 911.082842][T15341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 911.262429][T12263] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 911.284996][T15356] bond5: (slave gretap1): making interface the new active one [ 911.298681][T12263] usb 6-1: setting power ON [ 911.321975][T12263] dvb-usb: bulk message failed: -22 (2/0) [ 911.355308][T15356] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 911.365550][T15362] sctp: [Deprecated]: syz.4.2355 (pid 15362) Use of struct sctp_assoc_value in delayed_ack socket option. [ 911.365550][T15362] Use struct sctp_sack_info instead [ 911.588640][ T5877] etas_es58x 5-1:0.219: Starting syz syz (Serial Number syz) [ 911.632229][T12263] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 911.673991][T12263] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 911.696117][T11417] Bluetooth: hci5: ACL packet for unknown connection handle 201 [ 911.710892][T12263] usb 6-1: media controller created [ 911.751666][T12263] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 911.769444][ T5877] etas_es58x 5-1:0.219: could not parse product info: 'Ђ' [ 911.802821][T12263] usb 6-1: selecting invalid altsetting 6 [ 911.810151][T12263] usb 6-1: digital interface selection failed (-22) [ 911.816985][T12263] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 911.828582][T12263] usb 6-1: setting power OFF [ 911.836450][T12263] dvb-usb: bulk message failed: -22 (2/0) [ 911.845005][T12263] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 911.864777][T12263] (NULL device *): no alternate interface [ 911.972829][T15344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 912.003595][T15344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 912.038884][T12263] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 912.064318][T12263] usb 6-1: USB disconnect, device number 92 [ 912.560427][T13512] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 912.720286][T13512] usb 6-1: Using ep0 maxpacket: 16 [ 912.733200][T13512] usb 6-1: unable to get BOS descriptor or descriptor too short [ 912.758324][T13512] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 912.792679][T13512] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 912.827617][T13512] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 912.843837][T13512] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.854957][T13512] usb 6-1: Product: syz [ 912.861372][T13512] usb 6-1: Manufacturer: syz [ 912.875463][T13512] usb 6-1: SerialNumber: syz [ 913.449538][T13524] usb 5-1: USB disconnect, device number 92 [ 913.499915][T13524] etas_es58x 5-1:0.219: Disconnecting syz syz [ 913.806452][ T30] kauditd_printk_skb: 60 callbacks suppressed [ 913.806473][ T30] audit: type=1326 audit(1747739905.546:1150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 913.875562][ T30] audit: type=1326 audit(1747739905.586:1151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 913.897757][ C1] vkms_vblank_simulate: vblank timer overrun [ 913.916277][ T30] audit: type=1326 audit(1747739905.586:1152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 913.962560][ T30] audit: type=1326 audit(1747739905.586:1153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 914.010332][T13524] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 914.031028][ T30] audit: type=1326 audit(1747739905.586:1154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 914.101995][ T30] audit: type=1326 audit(1747739905.586:1155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 914.129539][ T30] audit: type=1326 audit(1747739905.586:1156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 914.159402][ T30] audit: type=1326 audit(1747739905.596:1157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 914.181683][ C1] vkms_vblank_simulate: vblank timer overrun [ 914.225082][T13524] usb 5-1: Using ep0 maxpacket: 8 [ 914.236183][ T30] audit: type=1326 audit(1747739905.596:1158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 914.251963][T13524] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 914.264502][ T30] audit: type=1326 audit(1747739905.596:1159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15408 comm="syz.1.2370" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f887ff8e969 code=0x50000 [ 914.340259][T13524] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 914.348574][T13524] usb 5-1: Product: syz [ 914.415184][T13524] usb 5-1: Manufacturer: syz [ 914.430908][T13524] usb 5-1: SerialNumber: syz [ 914.458426][T13524] usb 5-1: config 0 descriptor?? [ 914.687114][T13524] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 914.947006][T15436] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 914.970638][T15436] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 915.057949][T15436] Set syz1 is full, maxelem 0 reached [ 915.094528][T15436] Set syz1 is full, maxelem 0 reached [ 915.286467][T15439] loop2: detected capacity change from 0 to 7 [ 915.337549][T13512] usb 6-1: USB disconnect, device number 93 [ 915.359029][T15439] loop2: p1 [ 915.394998][T15439] loop2: partition table partially beyond EOD, truncated [ 915.437369][T15439] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 915.523585][T15441] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 915.542655][T15441] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 915.686327][T12246] udevd[12246]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 916.245318][T13524] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 916.646799][T13524] usb 5-1: USB disconnect, device number 93 [ 917.045726][T15460] fuse: Bad value for 'fd' [ 917.160182][T13524] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 917.358572][T13524] usb 5-1: device descriptor read/64, error -71 [ 917.404012][T15455] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 917.610073][T13512] usb 3-1: new full-speed USB device number 45 using dummy_hcd [ 917.680224][T13511] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 917.687877][T13524] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 917.780105][T13509] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 917.792770][T13512] usb 3-1: config 16 has an invalid interface number: 140 but max is 0 [ 917.798575][T15478] loop2: detected capacity change from 0 to 7 [ 917.802525][T13512] usb 3-1: config 16 has no interface number 0 [ 917.808933][T15478] loop2: p1 [ 917.823616][T13512] usb 3-1: New USB device found, idVendor=04dd, idProduct=9032, bcdDevice=49.72 [ 917.824363][T15478] loop2: partition table partially beyond EOD, [ 917.833500][T13512] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 917.848271][T13511] usb 2-1: Using ep0 maxpacket: 32 [ 917.848283][T15478] truncated [ 917.851065][T15478] loop2: p1 size 1919251295 extends beyond EOD, [ 917.853587][T13524] usb 5-1: device descriptor read/64, error -71 [ 917.856739][T15478] truncated [ 918.635085][T13511] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 255 [ 918.667607][T13512] usb 3-1: Product: syz [ 918.671994][T13512] usb 3-1: Manufacturer: syz [ 918.685186][T13511] usb 2-1: New USB device found, idVendor=0499, idProduct=1010, bcdDevice= 5.f5 [ 918.694456][T13511] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 918.702553][T13509] usb 6-1: Using ep0 maxpacket: 16 [ 918.711762][T13512] usb 3-1: SerialNumber: syz [ 918.716446][T13511] usb 2-1: Product: syz [ 918.729151][T13511] usb 2-1: Manufacturer: syz [ 918.736713][T13524] usb usb5-port1: attempt power cycle [ 918.738389][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 918.764004][T13511] usb 2-1: SerialNumber: syz [ 918.787756][T13511] usb 2-1: config 0 descriptor?? [ 918.809757][T15473] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 918.843956][T13511] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 919.007710][T13512] usb 3-1: bad CDC descriptors [ 919.057638][T13512] usb 3-1: USB disconnect, device number 45 [ 919.068097][T12263] usb 2-1: USB disconnect, device number 55 [ 919.110868][T13524] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 919.263986][T13524] usb 5-1: device descriptor read/8, error -71 [ 919.530049][T13524] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 919.571125][T13524] usb 5-1: device descriptor read/8, error -71 [ 919.692274][T13524] usb usb5-port1: unable to enumerate USB device [ 920.120089][ T5877] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 920.427063][T12263] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 920.479025][ T5877] usb 2-1: Using ep0 maxpacket: 8 [ 920.650333][ T5877] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 920.660144][T12263] usb 5-1: Using ep0 maxpacket: 16 [ 920.700388][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 920.709050][ T5877] usb 2-1: Product: syz [ 920.713852][ T5877] usb 2-1: Manufacturer: syz [ 920.718554][ T5877] usb 2-1: SerialNumber: syz [ 920.723455][T12263] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 920.740235][T12263] usb 5-1: New USB device found, idVendor=0c70, idProduct=f014, bcdDevice= 0.00 [ 920.771827][ T5877] usb 2-1: config 0 descriptor?? [ 920.807467][T12263] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 920.846019][T12263] usb 5-1: config 0 descriptor?? [ 921.017466][ T5877] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 921.066873][T15500] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 921.108612][T15500] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 921.156660][T13509] usb 6-1: device descriptor read/all, error -71 [ 921.304603][T12263] aquacomputer_d5next 0003:0C70:F014.0021: hidraw0: USB HID v0.00 Device [HID 0c70:f014] on usb-dummy_hcd.4-1/input0 [ 921.306070][T15508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 921.423015][T15506] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 921.433558][T15508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 921.467087][T15506] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 921.520833][T15514] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2394'. [ 921.540338][T13512] usb 5-1: USB disconnect, device number 98 [ 921.618466][T15511] fido_id[15511]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 921.965163][T15522] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 921.992475][T15522] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 922.010095][T13512] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 922.160237][T13512] usb 5-1: Using ep0 maxpacket: 8 [ 922.178724][T13512] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 922.193528][T13512] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 922.223073][T13512] usb 5-1: Product: syz [ 922.240082][T13511] usb 3-1: new low-speed USB device number 46 using dummy_hcd [ 922.259111][T13512] usb 5-1: Manufacturer: syz [ 922.282104][T13512] usb 5-1: SerialNumber: syz [ 922.314298][T13512] usb 5-1: config 0 descriptor?? [ 922.380313][T13511] usb 3-1: device descriptor read/64, error -71 [ 922.543519][ T5877] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 922.543587][T13512] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 922.630779][T13511] usb 3-1: new low-speed USB device number 47 using dummy_hcd [ 922.770228][T13511] usb 3-1: device descriptor read/64, error -71 [ 922.882141][T13511] usb usb3-port1: attempt power cycle [ 922.924418][T13509] usb 2-1: USB disconnect, device number 56 [ 923.047481][T15536] syz_tun: entered allmulticast mode [ 923.055683][T15536] netlink: 40 bytes leftover after parsing attributes in process `syz.5.2400'. [ 923.077079][T15536] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2400'. [ 923.134431][T15534] syz_tun: left allmulticast mode [ 923.254209][T13511] usb 3-1: new low-speed USB device number 48 using dummy_hcd [ 923.285116][T13511] usb 3-1: device descriptor read/8, error -71 [ 923.340133][T13509] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 923.500180][T13509] usb 2-1: Using ep0 maxpacket: 16 [ 923.510152][T13509] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 923.524927][T13509] usb 2-1: New USB device found, idVendor=1294, idProduct=1320, bcdDevice= 0.00 [ 923.536851][T13511] usb 3-1: new low-speed USB device number 49 using dummy_hcd [ 923.542867][ T30] kauditd_printk_skb: 2429 callbacks suppressed [ 923.542888][ T30] audit: type=1326 audit(1747739915.286:3589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15543 comm="syz.5.2403" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f69d6d8e969 code=0x0 [ 923.544590][T13509] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 923.586191][T13509] usb 2-1: config 0 descriptor?? [ 923.606426][T13511] usb 3-1: device descriptor read/8, error -71 [ 923.720492][T13511] usb usb3-port1: unable to enumerate USB device [ 923.998459][T15519] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 924.015271][T15519] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 924.024308][T13509] hid-led 0003:1294:1320.0022: hidraw0: USB HID v0.03 Device [HID 1294:1320] on usb-dummy_hcd.1-1/input0 [ 924.077096][T13512] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 924.105075][T13509] hid-led 0003:1294:1320.0022: Riso Kagaku Webmail Notifier initialized [ 924.136352][T13512] usb 5-1: USB disconnect, device number 99 [ 924.222149][ T5877] usb 2-1: USB disconnect, device number 57 [ 924.251445][ T1154] leds riso_kagaku0:blue: Setting an LED's brightness failed (-38) [ 924.279456][ T13] leds riso_kagaku0:green: Setting an LED's brightness failed (-38) [ 924.326365][T15558] ptrace attach of "./syz-executor exec"[5846] was attempted by "./syz-executor exec"[15558] [ 924.348308][ T12] leds riso_kagaku0:red: Setting an LED's brightness failed (-38) [ 924.429593][T15564] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 924.459229][T15564] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 925.280161][ T52] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 925.430119][ T52] usb 2-1: Using ep0 maxpacket: 8 [ 925.464377][ T52] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 925.478205][ T52] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 925.509192][ T52] usb 2-1: Product: syz [ 925.530404][ T52] usb 2-1: Manufacturer: syz [ 925.538463][ T52] usb 2-1: SerialNumber: syz [ 925.562872][ T52] usb 2-1: config 0 descriptor?? [ 925.796800][ T52] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 926.095906][T15594] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 926.152383][T15594] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 926.430149][ T5877] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 926.623268][ T5877] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 926.634380][ T5877] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 926.645495][ T5877] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 926.663569][ T5877] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 926.675471][ T5877] usb 3-1: SerialNumber: syz [ 926.900886][ T5877] usb 3-1: 0:2 : does not exist [ 926.907272][ T5877] usb 3-1: unit 5: unexpected type 0x09 [ 926.931056][ T5877] usb 3-1: USB disconnect, device number 50 [ 926.976049][T11469] udevd[11469]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 927.251986][ T52] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 927.978298][ T52] usb 2-1: USB disconnect, device number 58 [ 928.150569][T13512] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 928.327951][T15630] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 928.350358][T13512] usb 6-1: Using ep0 maxpacket: 32 [ 928.373235][T13512] usb 6-1: config 0 has an invalid interface number: 9 but max is 0 [ 928.410160][T13512] usb 6-1: config 0 has no interface number 0 [ 928.440335][T13512] usb 6-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 928.454725][T13512] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 928.480089][T13509] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 928.509435][T13512] usb 6-1: Product: syz [ 928.524955][T13512] usb 6-1: Manufacturer: syz [ 928.540316][T13512] usb 6-1: SerialNumber: syz [ 928.573343][T13512] usb 6-1: config 0 descriptor?? [ 928.593469][T13512] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 928.901878][T13509] usb 3-1: Using ep0 maxpacket: 16 [ 929.636893][T15656] pimreg: entered allmulticast mode [ 929.649164][T15657] pimreg: left allmulticast mode [ 929.664748][T15657] xfrm0: left allmulticast mode [ 930.076897][T13512] gspca_topro: reg_r err -32 [ 930.092386][T13512] gspca_topro: Sensor soi763a [ 930.240845][T13512] usb 6-1: USB disconnect, device number 96 [ 930.490178][ T52] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 930.739388][T15674] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 930.966764][ T52] usb 2-1: config 0 has no interfaces? [ 931.060284][ T52] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 931.111711][ T52] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 931.133858][ T52] usb 2-1: Product: syz [ 931.149641][ T52] usb 2-1: Manufacturer: syz [ 931.160109][ T52] usb 2-1: SerialNumber: syz [ 931.222004][ T52] usb 2-1: config 0 descriptor?? [ 931.578359][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.589521][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.758174][T15690] program syz.1.2428 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 931.798759][T15690] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 932.194898][T13509] usb 3-1: unable to get BOS descriptor or descriptor too short [ 932.266324][T13509] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 932.275890][T13509] usb 3-1: can't read configurations, error -71 [ 933.083348][ T30] audit: type=1326 audit(1747739924.826:3590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 933.175121][ T30] audit: type=1326 audit(1747739924.826:3591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 933.197553][ C1] vkms_vblank_simulate: vblank timer overrun [ 933.304488][ T30] audit: type=1326 audit(1747739924.856:3592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 933.330100][ T30] audit: type=1326 audit(1747739924.856:3593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 933.436061][ T30] audit: type=1326 audit(1747739924.856:3594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 933.474329][ T30] audit: type=1326 audit(1747739924.856:3595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 933.497216][ C1] vkms_vblank_simulate: vblank timer overrun [ 933.528785][ T30] audit: type=1326 audit(1747739924.856:3596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fdbd012ab39 code=0x7ffc0000 [ 933.590080][ T30] audit: type=1326 audit(1747739924.856:3597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 933.612557][ C1] vkms_vblank_simulate: vblank timer overrun [ 933.644744][ T30] audit: type=1326 audit(1747739924.856:3598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fdbd012ab39 code=0x7ffc0000 [ 933.702135][ T30] audit: type=1326 audit(1747739924.856:3599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15709 comm="syz.2.2437" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fdbd012ab39 code=0x7ffc0000 [ 933.827301][T15723] FAULT_INJECTION: forcing a failure. [ 933.827301][T15723] name failslab, interval 1, probability 0, space 0, times 0 [ 933.856156][T15723] CPU: 0 UID: 0 PID: 15723 Comm: syz.3.2441 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 933.856187][T15723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 933.856201][T15723] Call Trace: [ 933.856210][T15723] [ 933.856220][T15723] dump_stack_lvl+0x189/0x250 [ 933.856268][T15723] ? __pfx_dump_stack_lvl+0x10/0x10 [ 933.856297][T15723] ? __pfx__printk+0x10/0x10 [ 933.856324][T15723] ? __pfx___might_resched+0x10/0x10 [ 933.856343][T15723] ? fs_reclaim_acquire+0x7d/0x100 [ 933.856378][T15723] should_fail_ex+0x414/0x560 [ 933.856405][T15723] should_failslab+0xa8/0x100 [ 933.856435][T15723] kmem_cache_alloc_noprof+0x73/0x3c0 [ 933.856466][T15723] ? getname_flags+0xb8/0x540 [ 933.856501][T15723] getname_flags+0xb8/0x540 [ 933.856534][T15723] do_sys_openat2+0xbc/0x1c0 [ 933.856557][T15723] ? __pfx_do_sys_openat2+0x10/0x10 [ 933.856578][T15723] ? ksys_write+0x1f0/0x250 [ 933.856601][T15723] ? rcu_is_watching+0x15/0xb0 [ 933.856629][T15723] __x64_sys_open+0x11e/0x150 [ 933.856654][T15723] do_syscall_64+0xf6/0x210 [ 933.856684][T15723] ? clear_bhb_loop+0x60/0xb0 [ 933.856710][T15723] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 933.856731][T15723] RIP: 0033:0x7f466bd8e969 [ 933.856750][T15723] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 933.856768][T15723] RSP: 002b:00007f466cccb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 933.856791][T15723] RAX: ffffffffffffffda RBX: 00007f466bfb5fa0 RCX: 00007f466bd8e969 [ 933.856807][T15723] RDX: 0000000000000000 RSI: 000000000025e041 RDI: 0000200000022ff6 [ 933.856821][T15723] RBP: 00007f466cccb090 R08: 0000000000000000 R09: 0000000000000000 [ 933.856834][T15723] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 933.856847][T15723] R13: 0000000000000000 R14: 00007f466bfb5fa0 R15: 00007f466c0dfa28 [ 933.856879][T15723] [ 934.104549][T15725] netlink: 'syz.5.2442': attribute type 10 has an invalid length. [ 934.441294][T15737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 934.462310][T15737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 935.846046][ T52] usb 6-1: new full-speed USB device number 97 using dummy_hcd [ 936.023901][ T52] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 936.063352][ T52] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 936.074883][ T52] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 936.088186][ T52] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 936.112785][ T52] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 936.124936][ T52] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 936.133486][ T52] usb 6-1: Manufacturer: syz [ 936.191410][ T52] usb 6-1: config 0 descriptor?? [ 936.741440][ T52] rc_core: IR keymap rc-hauppauge not found [ 936.749729][ T52] Registered IR keymap rc-empty [ 936.760365][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 936.790511][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 936.811386][ T52] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 936.828521][ T52] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input84 [ 936.848901][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 936.878226][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 936.909796][ T5877] usb 2-1: USB disconnect, device number 59 [ 936.916686][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 936.950448][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 936.987610][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 937.010204][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 937.072337][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 937.186340][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 937.280165][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 937.333033][ T52] mceusb 6-1:0.0: Error: mce write submit urb error = -90 [ 937.377684][ T52] mceusb 6-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 937.432450][ T52] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 937.573160][T15769] program syz.1.2449 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 938.274427][ T52] usb 6-1: USB disconnect, device number 97 [ 938.529676][T15779] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2453'. [ 938.540151][T13512] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 938.571838][T15779] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2453'. [ 938.598096][T15779] netlink: 'syz.5.2453': attribute type 15 has an invalid length. [ 938.742404][T13512] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 938.772808][T15783] FAULT_INJECTION: forcing a failure. [ 938.772808][T15783] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 938.800017][T13512] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 938.807895][T15783] CPU: 1 UID: 0 PID: 15783 Comm: syz.3.2454 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 938.807927][T15783] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 938.807942][T15783] Call Trace: [ 938.807951][T15783] [ 938.807961][T15783] dump_stack_lvl+0x189/0x250 [ 938.808003][T15783] ? __pfx_dump_stack_lvl+0x10/0x10 [ 938.808035][T15783] ? __pfx__printk+0x10/0x10 [ 938.808092][T15783] should_fail_ex+0x414/0x560 [ 938.808120][T15783] strncpy_from_user+0x36/0x290 [ 938.808148][T15783] getname_flags+0xf3/0x540 [ 938.808183][T15783] do_sys_openat2+0xbc/0x1c0 [ 938.808207][T15783] ? __pfx_do_sys_openat2+0x10/0x10 [ 938.808227][T15783] ? ksys_write+0x1f0/0x250 [ 938.808252][T15783] ? rcu_is_watching+0x15/0xb0 [ 938.808281][T15783] __x64_sys_open+0x11e/0x150 [ 938.808306][T15783] do_syscall_64+0xf6/0x210 [ 938.808337][T15783] ? clear_bhb_loop+0x60/0xb0 [ 938.808364][T15783] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 938.808384][T15783] RIP: 0033:0x7f466bd8e969 [ 938.808405][T15783] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 938.808423][T15783] RSP: 002b:00007f466cccb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 938.808447][T15783] RAX: ffffffffffffffda RBX: 00007f466bfb5fa0 RCX: 00007f466bd8e969 [ 938.808463][T15783] RDX: 0000000000000000 RSI: 000000000025e041 RDI: 0000200000022ff6 [ 938.808478][T15783] RBP: 00007f466cccb090 R08: 0000000000000000 R09: 0000000000000000 [ 938.808492][T15783] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 938.808505][T15783] R13: 0000000000000000 R14: 00007f466bfb5fa0 R15: 00007f466c0dfa28 [ 938.808540][T15783] [ 938.940361][ T52] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 939.216400][T13512] usb 2-1: New USB device found, idVendor=0c70, idProduct=f00d, bcdDevice= 0.00 [ 939.226715][T13512] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.247679][T13512] usb 2-1: config 0 descriptor?? [ 939.280228][ T52] usb 6-1: Using ep0 maxpacket: 16 [ 939.306125][ T52] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 939.328045][ T52] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 939.368505][ T52] usb 6-1: config 0 has no interface number 0 [ 939.385398][ T52] usb 6-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 939.412099][ T52] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 939.430051][T12263] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 939.438538][ T52] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 939.468874][ T52] usb 6-1: Product: syz [ 939.478620][ T52] usb 6-1: SerialNumber: syz [ 939.505087][ T52] usb 6-1: config 0 descriptor?? [ 939.529173][ T52] usbhid 6-1:0.8: couldn't find an input interrupt endpoint [ 939.580225][T12263] usb 3-1: Using ep0 maxpacket: 16 [ 939.589396][T12263] usb 3-1: config index 0 descriptor too short (expected 37, got 36) [ 939.624480][T12263] usb 3-1: config 0 has an invalid descriptor of length 144, skipping remainder of the config [ 939.655784][T12263] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 939.698857][T12263] usb 3-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 939.722750][T12263] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 939.755146][ T52] usb 6-1: USB disconnect, device number 98 [ 939.788550][T12263] usb 3-1: config 0 descriptor?? [ 940.327880][T12263] usb 3-1: USB disconnect, device number 53 [ 940.373419][T15803] mmap: syz.4.2459 (15803): VmData 37457920 exceed data ulimit 1070. Update limits or use boot option ignore_rlimit_data. [ 940.560866][T15806] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2460'. [ 940.949093][T15812] ip6gretap0: entered promiscuous mode [ 940.957161][T15812] macsec1: entered allmulticast mode [ 940.963166][T15812] ip6gretap0: entered allmulticast mode [ 940.977952][T15812] ip6gretap0: left allmulticast mode [ 940.984502][T15812] ip6gretap0: left promiscuous mode [ 940.996919][T15814] binder: 15811:15814 ioctl c0306201 2000000003c0 returned -14 [ 941.290253][T13509] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 941.570438][T13509] usb 3-1: Using ep0 maxpacket: 32 [ 941.589865][T13509] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 941.623326][T13512] usbhid 2-1:0.0: can't add hid device: -71 [ 941.647219][T13509] usb 3-1: config 0 has no interface number 0 [ 941.654387][T13512] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 941.702526][T13509] usb 3-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 941.773990][T13512] usb 2-1: USB disconnect, device number 60 [ 941.790004][T13509] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.798064][T13509] usb 3-1: Product: syz [ 941.861418][T13509] usb 3-1: Manufacturer: syz [ 941.887726][T13509] usb 3-1: SerialNumber: syz [ 941.934119][T13509] usb 3-1: config 0 descriptor?? [ 941.985262][T13509] usb 3-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 942.030221][T13509] usb 3-1: selecting invalid altsetting 1 [ 942.048452][T13509] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 942.087458][T13509] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 942.150137][T13509] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 942.225836][T13509] usb 3-1: media controller created [ 942.356781][T13509] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 942.368837][T13512] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 942.558773][T13509] usb 3-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 942.620077][T13509] zl10353_read_register: readreg error (reg=127, ret==-71) [ 942.713869][T13509] usb 3-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 942.861206][T13512] usb 2-1: Using ep0 maxpacket: 16 [ 943.105196][T13509] usb 3-1: USB disconnect, device number 54 [ 943.114638][T15840] netlink: 'syz.2.2469': attribute type 1 has an invalid length. [ 943.135891][T15841] netlink: 'syz.2.2469': attribute type 1 has an invalid length. [ 943.407303][T12263] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 943.416397][T15840] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 943.426503][T15841] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 943.610124][T12263] usb 6-1: Using ep0 maxpacket: 8 [ 943.702948][T12263] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 943.861219][T12263] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 943.869372][T12263] usb 6-1: Product: syz [ 944.019366][T12263] usb 6-1: Manufacturer: syz [ 944.043742][T12263] usb 6-1: SerialNumber: syz [ 944.065240][T12263] usb 6-1: config 0 descriptor?? [ 944.111040][T12263] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 944.119389][T12263] usb 6-1: setting power ON [ 944.120169][T13509] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 944.125115][T12263] dvb-usb: bulk message failed: -22 (2/0) [ 944.149560][T12263] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 944.222334][T12263] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 944.244799][T12263] usb 6-1: media controller created [ 944.335143][T12263] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 944.390137][T13509] usb 3-1: Using ep0 maxpacket: 32 [ 944.456137][T13509] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 944.466689][T12263] usb 6-1: selecting invalid altsetting 6 [ 944.491722][T12263] usb 6-1: digital interface selection failed (-22) [ 944.510921][T13509] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 944.529143][T13509] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 944.557172][T12263] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 944.569421][T13509] usb 3-1: config 1 has no interface number 0 [ 944.577329][T12263] usb 6-1: setting power OFF [ 944.585207][T12263] dvb-usb: bulk message failed: -22 (2/0) [ 944.591751][T13509] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 944.626120][T15856] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 944.634521][T13509] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 944.635056][T12263] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 944.682709][T13509] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 944.685701][T12263] (NULL device *): no alternate interface [ 944.726226][T13509] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 944.768599][T12263] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 944.898641][T13509] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 945.100443][T15862] netlink: 'syz.3.2475': attribute type 1 has an invalid length. [ 945.207172][T12263] usb 6-1: USB disconnect, device number 99 [ 945.221928][T13509] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 945.532832][T13512] usb 2-1: unable to get BOS descriptor or descriptor too short [ 945.637186][T13512] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 945.660487][T13512] usb 2-1: can't read configurations, error -71 [ 946.105211][T15885] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2480'. [ 946.120793][T15882] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2480'. [ 946.294791][T13509] snd_usb_pod 3-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22) [ 946.398675][T13512] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 946.620201][T13512] usb 2-1: config 0 has no interfaces? [ 946.665877][T13512] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 946.879880][T13512] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 946.890085][T13512] usb 2-1: Product: syz [ 946.894362][T13512] usb 2-1: Manufacturer: syz [ 946.899895][T13512] usb 2-1: SerialNumber: syz [ 946.909254][T13512] usb 2-1: config 0 descriptor?? [ 947.261469][T13512] usb 3-1: USB disconnect, device number 55 [ 947.293799][T13512] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 948.250394][T12263] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 948.261745][ C1] raw-gadget.2 gadget.5: ignoring, device is not running [ 948.332888][T15881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 948.343622][T15881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 948.401201][T12263] usb 6-1: device descriptor read/64, error -32 [ 948.660160][T12263] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 949.110152][T12263] usb 6-1: Using ep0 maxpacket: 16 [ 950.556579][T15953] trusted_key: encrypted_key: insufficient parameters specified [ 950.576349][T15953] vlan2: entered allmulticast mode [ 950.581654][T15953] bond0: entered allmulticast mode [ 950.597623][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 950.597642][ T30] audit: type=1326 audit(1747739942.336:3657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15954 comm="syz.2.2503" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x0 [ 952.004926][T15970] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 952.226977][T12263] usb 6-1: unable to get BOS descriptor or descriptor too short [ 952.238741][T12263] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 952.247965][T12263] usb 6-1: can't read configurations, error -71 [ 952.260749][T12263] usb usb6-port1: attempt power cycle [ 952.384091][T15989] loop6: detected capacity change from 0 to 524287999 [ 952.831830][ T52] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 952.869703][ T5877] usb 2-1: USB disconnect, device number 62 [ 952.911648][T15997] netlink: 'syz.3.2513': attribute type 28 has an invalid length. [ 953.002265][ T52] usb 3-1: config 8 has an invalid interface number: 177 but max is 0 [ 953.024027][ T52] usb 3-1: config 8 has no interface number 0 [ 953.033368][ T52] usb 3-1: config 8 interface 177 altsetting 9 has an endpoint descriptor with address 0xAD, changing to 0x8D [ 953.045432][ T52] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x8D has invalid maxpacket 1023, setting to 64 [ 953.060571][ T52] usb 3-1: config 8 interface 177 altsetting 9 endpoint 0x87 has invalid wMaxPacketSize 0 [ 953.073446][ T52] usb 3-1: config 8 interface 177 has no altsetting 0 [ 953.083920][ T52] usb 3-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 953.104735][ T52] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 953.125631][T15993] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 953.133132][T12263] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 953.165232][T12263] usb 6-1: Using ep0 maxpacket: 16 [ 953.401930][ T52] usb 3-1: string descriptor 0 read error: -71 [ 953.438578][ T52] ir_toy 3-1:8.177: required endpoints not found [ 953.481471][ T52] usb 3-1: USB disconnect, device number 56 [ 953.692095][T12263] usb 6-1: unable to get BOS descriptor or descriptor too short [ 953.705922][T12263] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 953.727625][T12263] usb 6-1: can't read configurations, error -71 [ 953.940226][T13509] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 954.151118][T16017] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 954.159110][T13509] usb 2-1: Using ep0 maxpacket: 32 [ 954.160766][T16017] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 954.183932][T13509] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x81 has invalid wMaxPacketSize 0 [ 954.228310][T13509] usb 2-1: config 0 interface 0 altsetting 16 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 954.252063][T13509] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 954.280530][T13509] usb 2-1: config 0 interface 0 altsetting 16 endpoint 0x8F has invalid wMaxPacketSize 0 [ 954.300948][T13509] usb 2-1: config 0 interface 0 altsetting 16 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 954.329995][T13509] usb 2-1: config 0 interface 0 has no altsetting 0 [ 954.353842][T13509] usb 2-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 954.360461][ T52] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 954.373326][T13509] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.405121][T13509] usb 2-1: config 0 descriptor?? [ 954.550707][ T52] usb 3-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 954.559862][ T52] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.587721][ T52] usb 3-1: config 0 descriptor?? [ 954.828640][T13509] usbhid 2-1:0.0: can't add hid device: -71 [ 954.850445][T13509] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 954.894850][T13509] usb 2-1: USB disconnect, device number 63 [ 954.986859][T16024] loop8: detected capacity change from 0 to 8 [ 954.994742][T16024] Dev loop8: unable to read RDB block 8 [ 955.001161][T16024] loop8: unable to read partition table [ 955.010321][T16024] loop8: partition table beyond EOD, truncated [ 955.016648][T16024] loop_reread_partitions: partition scan of loop8 (被x^> ) failed (rc=-5) [ 955.030156][T13512] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 955.043023][ T52] [drm] Initialized udl 0.0.1 for 3-1:0.0 on minor 2 [ 955.080538][ T52] [drm] Initialized udl on minor 2 [ 955.200336][T13512] usb 6-1: Using ep0 maxpacket: 32 [ 955.217064][T16022] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 955.217069][ T52] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffe0 [ 955.226608][T13509] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 955.243116][T13512] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 955.253337][T16022] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 955.261409][T13512] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 955.280259][T13512] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 955.292604][ T52] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 955.299694][T13512] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 955.315903][T12263] udl 3-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 955.325867][T13512] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 955.340289][T12263] udl 3-1:0.0: [drm] Cannot find any crtc or sizes [ 955.364466][T12263] usb 3-1: USB disconnect, device number 57 [ 955.380907][T13512] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 955.404615][T13512] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 955.430551][T13509] usb 2-1: device descriptor read/64, error -71 [ 955.443246][T13512] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 955.476386][T13512] usb 6-1: config 0 descriptor?? [ 955.518048][T16053] netlink: 432 bytes leftover after parsing attributes in process `syz.3.2528'. [ 955.527553][T16053] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 955.600165][ T30] audit: type=1326 audit(1747739947.336:3658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 955.629247][ T30] audit: type=1326 audit(1747739947.336:3659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 955.653655][ T30] audit: type=1326 audit(1747739947.336:3660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=243 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 955.676613][ T30] audit: type=1326 audit(1747739947.336:3661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 955.721050][T13509] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 955.792969][T13512] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 104 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 955.839000][T16060] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 955.847716][ T30] audit: type=1326 audit(1747739947.336:3662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 955.856108][T16060] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 955.877945][ C1] vkms_vblank_simulate: vblank timer overrun [ 955.890718][T13509] usb 2-1: device descriptor read/64, error -71 [ 955.897503][T13512] usb 6-1: USB disconnect, device number 104 [ 955.914788][T13512] usblp0: removed [ 955.917231][T16060] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 955.926705][ T30] audit: type=1326 audit(1747739947.336:3663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 955.952084][T16060] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 955.963252][ T30] audit: type=1326 audit(1747739947.336:3664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 955.989730][ T30] audit: type=1326 audit(1747739947.336:3665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 956.012241][ C1] vkms_vblank_simulate: vblank timer overrun [ 956.023451][T13509] usb usb2-port1: attempt power cycle [ 956.028624][ T30] audit: type=1326 audit(1747739947.346:3666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 956.054068][ T30] audit: type=1326 audit(1747739947.346:3667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16054 comm="syz.2.2529" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdbd018e969 code=0x7ffc0000 [ 956.076522][ C1] vkms_vblank_simulate: vblank timer overrun [ 956.330056][T13512] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 956.360010][T13509] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 956.401067][T13509] usb 2-1: device descriptor read/8, error -71 [ 956.500068][T13512] usb 6-1: Using ep0 maxpacket: 32 [ 956.512286][T13512] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 956.538034][T13512] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 956.547347][T13512] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 956.556808][T13512] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 956.606615][T13512] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 956.642342][T13512] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 956.660154][T13509] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 956.698990][T13512] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 956.716732][T13509] usb 2-1: device descriptor read/8, error -71 [ 956.728527][T13512] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 956.765950][T13512] usb 6-1: config 0 descriptor?? [ 956.838565][T13509] usb usb2-port1: unable to enumerate USB device [ 956.959910][T16069] 8021q: adding VLAN 0 to HW filter on device bond1 [ 956.971589][T16074] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 957.001407][T13512] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 105 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 957.024834][T16069] bond0: (slave bond1): Enslaving as an active interface with an up link [ 957.048394][T13512] usb 6-1: USB disconnect, device number 105 [ 957.068528][T13512] usblp0: removed [ 957.110462][T16074] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 957.730159][T12263] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 957.846415][T16097] bridge0: port 1(netdevsim0) entered blocking state [ 957.855653][T16097] bridge0: port 1(netdevsim0) entered disabled state [ 957.866830][T16097] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 957.879338][T16097] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 957.896822][T16097] bridge0: port 1(netdevsim0) entered blocking state [ 957.904262][T16097] bridge0: port 1(netdevsim0) entered forwarding state [ 957.920900][T12263] usb 6-1: Using ep0 maxpacket: 16 [ 957.950858][T16098] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2540'. [ 957.974654][T12263] usb 6-1: unable to get BOS descriptor or descriptor too short [ 957.980086][T13512] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 958.020249][T16097] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2540'. [ 958.045259][T12263] usb 6-1: config 1 interface 0 altsetting 8 has an endpoint descriptor with address 0x68, changing to 0x8 [ 958.090576][T12263] usb 6-1: config 1 interface 0 has no altsetting 0 [ 958.143984][T13512] usb 5-1: Using ep0 maxpacket: 32 [ 958.167373][T13512] usb 5-1: config index 0 descriptor too short (expected 2210, got 1175) [ 958.184972][T13512] usb 5-1: config 0 has an invalid interface number: 241 but max is 2 [ 958.198327][T16100] loop2: detected capacity change from 0 to 7 [ 958.224709][T13512] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 958.224817][T12263] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.40 [ 958.256010][T13512] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 958.272725][T13512] usb 5-1: config 0 has no interface number 0 [ 958.279539][T13512] usb 5-1: config 0 interface 241 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 958.294759][ T6145] loop2: p1 [ 958.298176][ T6145] loop2: partition table partially beyond EOD, truncated [ 958.312746][T13512] usb 5-1: config 0 interface 241 altsetting 4 has an endpoint descriptor with address 0xAE, changing to 0x8E [ 958.324688][T12263] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 958.325568][ T6145] loop2: p1 size 1919251295 extends beyond EOD, [ 958.332799][T12263] usb 6-1: Product: syz [ 958.332823][T12263] usb 6-1: Manufacturer: syz [ 958.332840][T12263] usb 6-1: SerialNumber: syz [ 958.352969][T13512] usb 5-1: config 0 interface 241 altsetting 4 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 958.365369][T13512] usb 5-1: config 0 interface 241 altsetting 4 endpoint 0x8E has invalid wMaxPacketSize 0 [ 958.387624][ T6145] truncated [ 958.392072][T13512] usb 5-1: config 0 interface 241 altsetting 4 has 3 endpoint descriptors, different from the interface descriptor's value: 14 [ 958.409824][T13512] usb 5-1: config 0 interface 241 has no altsetting 0 [ 958.425016][T16100] loop2: p1 [ 958.426086][T13512] usb 5-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=e0.70 [ 958.438492][T13512] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 958.447170][T16100] loop2: partition table partially beyond EOD, truncated [ 958.452636][T13512] usb 5-1: Product: syz [ 958.459174][T13512] usb 5-1: Manufacturer: syz [ 958.466443][T13512] usb 5-1: SerialNumber: syz [ 958.478815][T16100] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 958.489744][T13512] usb 5-1: config 0 descriptor?? [ 958.532991][ T5199] loop2: p1 [ 958.536330][ T5199] loop2: partition table partially beyond EOD, truncated [ 958.567082][ T5199] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 959.010228][T13524] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 959.046961][T16114] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2545'. [ 959.063073][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 959.114095][T16115] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2545'. [ 959.195832][T13524] usb 3-1: Using ep0 maxpacket: 16 [ 959.202768][T13512] usb 5-1: USB disconnect, device number 100 [ 959.233597][T16114] ip6tnl1: entered promiscuous mode [ 959.262188][T13524] usb 3-1: config 95 has too many interfaces: 118, using maximum allowed: 32 [ 959.279735][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 959.282483][T16114] ip6tnl1: entered allmulticast mode [ 959.303483][T16117] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 959.314467][T13524] usb 3-1: config 95 has an invalid descriptor of length 99, skipping remainder of the config [ 959.342223][T16117] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 959.360966][T13524] usb 3-1: config 95 has 0 interfaces, different from the descriptor's value: 118 [ 959.403450][T13524] usb 3-1: New USB device found, idVendor=046d, idProduct=c623, bcdDevice= 0.00 [ 959.417141][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 959.434538][T13524] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.682925][T16124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 959.730905][T16124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 959.806920][T16124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 959.849375][T16124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 959.947931][T16107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 960.050608][T16107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 960.136422][T16128] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2549'. [ 961.063689][T16142] loop2: detected capacity change from 0 to 7 [ 961.310281][T16142] Dev loop2: unable to read RDB block 7 [ 961.316213][T16142] loop2: unable to read partition table [ 961.322982][T16142] loop2: partition table beyond EOD, truncated [ 961.404211][T16142] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 961.959714][T13524] usb 3-1: string descriptor 0 read error: -71 [ 961.995466][T13524] usb 3-1: USB disconnect, device number 58 [ 962.239566][T12263] usbhid 6-1:1.0: couldn't find an input interrupt endpoint [ 962.294310][T12263] usb 6-1: USB disconnect, device number 106 [ 962.393286][T16149] loop2: detected capacity change from 0 to 7 [ 962.417215][T16149] loop2: p1 [ 962.420785][T16149] loop2: partition table partially beyond EOD, truncated [ 962.439242][T16149] loop2: p1 size 1919251295 extends beyond EOD, truncated [ 962.622756][T11469] udevd[11469]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 962.720734][T16152] random: crng reseeded on system resumption [ 963.353955][T16157] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 963.742826][T16178] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 963.867238][T16181] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2562'. [ 964.610489][T13524] usb 6-1: new full-speed USB device number 107 using dummy_hcd [ 964.802042][T13524] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 964.834208][T13524] usb 6-1: New USB device found, idVendor=0711, idProduct=0920, bcdDevice=38.d2 [ 964.890829][T13524] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 964.900042][T13524] usb 6-1: Product: syz [ 964.904483][T13524] usb 6-1: Manufacturer: syz [ 964.909252][T13524] usb 6-1: SerialNumber: syz [ 964.953036][T13524] usb 6-1: config 0 descriptor?? [ 965.084960][T13524] sisusb 6-1:0.0: Invalid USB2VGA device [ 965.192118][T13524] sisusb 6-1:0.0: probe with driver sisusb failed with error -22 [ 965.557800][T16204] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2570'. [ 965.625137][T16206] program syz.2.2568 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 965.931155][T13524] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 966.100827][T16222] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 966.112198][T16222] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 966.132291][T13524] usb 3-1: too many configurations: 24, using maximum allowed: 8 [ 966.146252][T13524] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 966.159062][T13524] usb 3-1: can't read configurations, error -61 [ 966.290112][T13524] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 966.330520][T12263] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 966.350214][T13512] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 966.454486][T13524] usb 3-1: too many configurations: 24, using maximum allowed: 8 [ 966.464124][T13524] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 966.472369][T13524] usb 3-1: can't read configurations, error -61 [ 966.479831][T13524] usb usb3-port1: attempt power cycle [ 966.491834][T12263] usb 2-1: Using ep0 maxpacket: 32 [ 966.500552][T12263] usb 2-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 966.510308][T13512] usb 5-1: Using ep0 maxpacket: 32 [ 966.517947][T13512] usb 5-1: config 8 has an invalid interface number: 203 but max is 0 [ 966.520279][T12263] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 966.526717][T13512] usb 5-1: config 8 has no interface number 0 [ 966.541019][T13512] usb 5-1: config 8 interface 203 altsetting 1 has an endpoint descriptor with address 0x93, changing to 0x83 [ 966.542844][T12263] usb 2-1: config 0 descriptor?? [ 966.553224][T13512] usb 5-1: config 8 interface 203 altsetting 1 bulk endpoint 0x83 has invalid maxpacket 1024 [ 966.572210][T12263] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 966.583775][T13512] usb 5-1: config 8 interface 203 altsetting 1 bulk endpoint 0xB has invalid maxpacket 1023 [ 966.594144][T13512] usb 5-1: config 8 interface 203 altsetting 1 endpoint 0xD has invalid maxpacket 1023, setting to 64 [ 966.605679][T13512] usb 5-1: config 8 interface 203 has no altsetting 0 [ 966.616077][T13512] usb 5-1: New USB device found, idVendor=054c, idProduct=06c3, bcdDevice=eb.7a [ 966.628913][T13512] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 966.637829][T13512] usb 5-1: Product: syz [ 966.644849][T13512] usb 5-1: Manufacturer: syz [ 966.649574][T13512] usb 5-1: SerialNumber: syz [ 966.660558][T16220] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 966.667991][T16220] raw-gadget.3 gadget.4: fail, usb_ep_enable returned -22 [ 966.850297][T13524] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 966.898893][T13524] usb 3-1: too many configurations: 24, using maximum allowed: 8 [ 966.953044][T13524] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 966.974313][T13524] usb 3-1: can't read configurations, error -61 [ 967.130320][T13524] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 967.155896][T13524] usb 3-1: too many configurations: 24, using maximum allowed: 8 [ 967.166302][T13524] usb 3-1: unable to read config index 0 descriptor/start: -61 [ 967.175183][T13524] usb 3-1: can't read configurations, error -61 [ 967.190749][T13524] usb usb3-port1: unable to enumerate USB device [ 967.218687][T13524] usb 6-1: USB disconnect, device number 107 [ 967.616133][ C0] port100 5-1:8.203: NFC: Urb failure (status -71) [ 967.634879][ C0] port100 5-1:8.203: NFC: Urb failure (status -71) [ 967.660370][T13512] port100 5-1:8.203: NFC: Could not get supported command types [ 967.690763][T13512] usb 5-1: USB disconnect, device number 101 [ 967.882697][ T5877] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 968.042050][ T5877] usb 6-1: Using ep0 maxpacket: 16 [ 968.079714][ T5877] usb 6-1: config 0 has an invalid interface number: 95 but max is 0 [ 968.098525][ T5877] usb 6-1: config 0 has no interface number 0 [ 968.108786][ T5877] usb 6-1: config 0 interface 95 has no altsetting 0 [ 968.122899][T12263] gspca_nw80x: reg_w err -71 [ 968.127676][T12263] nw80x 2-1:0.0: probe with driver nw80x failed with error -71 [ 968.154430][ T5877] usb 6-1: New USB device found, idVendor=07ca, idProduct=a815, bcdDevice=99.a3 [ 968.177912][T12263] usb 2-1: USB disconnect, device number 68 [ 968.184670][ T5877] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 968.212441][ T5877] usb 6-1: Product: syz [ 968.217487][ T5877] usb 6-1: Manufacturer: syz [ 968.227275][ T5877] usb 6-1: SerialNumber: syz [ 968.238119][ T5877] usb 6-1: config 0 descriptor?? [ 968.457251][T13512] usb 6-1: USB disconnect, device number 108 [ 968.855905][ T30] kauditd_printk_skb: 75 callbacks suppressed [ 968.855925][ T30] audit: type=1326 audit(1747739960.596:3743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 968.990522][ T30] audit: type=1326 audit(1747739960.636:3744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 969.012969][ C1] vkms_vblank_simulate: vblank timer overrun [ 969.020936][ T30] audit: type=1326 audit(1747739960.636:3745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f016718d2d0 code=0x7ffc0000 [ 969.043384][ C1] vkms_vblank_simulate: vblank timer overrun [ 969.067710][T16263] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2585'. [ 969.090151][ T30] audit: type=1326 audit(1747739960.636:3746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 969.288630][ T30] audit: type=1326 audit(1747739960.636:3747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 969.311159][ C1] vkms_vblank_simulate: vblank timer overrun [ 969.538000][ T30] audit: type=1326 audit(1747739960.646:3748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 969.684035][ T30] audit: type=1326 audit(1747739960.646:3749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 969.717941][ T30] audit: type=1326 audit(1747739960.646:3750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 969.801386][ T30] audit: type=1326 audit(1747739960.646:3751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 969.824665][ T30] audit: type=1326 audit(1747739960.646:3752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16254 comm="syz.4.2585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f016718e969 code=0x7ffc0000 [ 969.847075][ C1] vkms_vblank_simulate: vblank timer overrun [ 969.968984][T16270] block device autoloading is deprecated and will be removed. [ 970.012667][T16270] syz.1.2584: attempt to access beyond end of device [ 970.012667][T16270] md2: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 970.528224][T16276] @: renamed from vlan0 [ 970.770079][T12263] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 970.832721][T16286] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2590'. [ 970.954131][T12263] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 971.000142][T12263] usb 3-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 971.065769][T12263] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 971.133244][T12263] usb 3-1: config 0 descriptor?? [ 971.168719][T16291] netlink: 440 bytes leftover after parsing attributes in process `syz.4.2594'. [ 971.221830][T16292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 971.260486][T16292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 971.544810][T16300] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2598'. [ 971.690993][ T5877] usb 2-1: new full-speed USB device number 69 using dummy_hcd [ 971.722681][T13512] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 971.741046][T12263] lg-g15 0003:046D:C222.0023: hidraw0: USB HID v10.00 Device [HID 046d:c222] on usb-dummy_hcd.2-1/input0 [ 971.862444][ T5877] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 971.896853][ T5877] usb 2-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 971.941819][ T5877] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 971.970772][ T5877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.988775][ T5877] usb 2-1: Product: syz [ 972.003118][ T5877] usb 2-1: Manufacturer: syz [ 972.010536][ T5877] usb 2-1: SerialNumber: syz [ 972.017431][T13512] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 972.053478][ T5877] usb 2-1: config 0 descriptor?? [ 972.073878][T16296] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 972.079786][T13512] usb 6-1: New USB device found, idVendor=0867, idProduct=9812, bcdDevice=40.85 [ 972.105037][T16310] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 972.107607][T13512] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 972.116511][ T5877] usb 2-1: ucan: probing device on interface #0 [ 972.151163][T13512] usb 6-1: config 0 descriptor?? [ 972.165545][T16310] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 972.175214][ T5877] usb 2-1: ucan: invalid EP count (1) [ 972.182546][ T5877] usb 2-1: ucan: probe failed; try to update the device firmware [ 972.206916][T13512] comedi comedi0: Wrong number of endpoints [ 972.222699][T13512] dt9812 6-1:0.0: driver 'dt9812' failed to auto-configure device. [ 972.299645][T16311] IPv6: Can't replace route, no match found [ 972.370528][T16296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 972.383524][T13512] usb 6-1: USB disconnect, device number 109 [ 972.390498][T16296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 973.558496][T13512] usb 3-1: USB disconnect, device number 63 [ 973.745919][T16336] netlink: 440 bytes leftover after parsing attributes in process `syz.4.2606'. [ 974.569011][T13512] usb 2-1: USB disconnect, device number 69 [ 975.250618][T16364] netlink: 168 bytes leftover after parsing attributes in process `syz.5.2613'. [ 975.410266][T13512] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 975.451552][T16372] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2615'. [ 975.492842][T16372] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2615'. [ 975.560126][T16372] netlink: 'syz.3.2615': attribute type 12 has an invalid length. [ 975.600133][T13512] usb 2-1: Using ep0 maxpacket: 16 [ 975.970891][T16382] netlink: 440 bytes leftover after parsing attributes in process `syz.3.2618'. [ 976.229312][T16384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 976.266961][T16384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 976.485354][T16388] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2620'. [ 976.497277][T16384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 976.522170][T16384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 976.673024][T16392] netlink: 'syz.4.2621': attribute type 10 has an invalid length. [ 976.687792][T16392] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2621'. [ 976.705023][T16392] bridge0: port 1(dummy0) entered blocking state [ 976.721753][T16392] bridge0: port 1(dummy0) entered disabled state [ 976.734756][T16392] dummy0: entered allmulticast mode [ 976.747879][T16392] dummy0: left allmulticast mode [ 976.787183][T16392] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 977.153391][T16404] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 977.173030][T16404] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 977.320231][ T5877] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 977.425713][T16390] ------------[ cut here ]------------ [ 977.432297][T16390] WARNING: CPU: 0 PID: 16390 at drivers/gpu/drm/vkms/vkms_crtc.c:97 vkms_get_vblank_timestamp+0x137/0x160 [ 977.443766][T16390] Modules linked in: [ 977.448915][T16390] CPU: 0 UID: 0 PID: 16390 Comm: syz.4.2621 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 977.459421][T16390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 977.469568][T16390] RIP: 0010:vkms_get_vblank_timestamp+0x137/0x160 [ 977.476128][T16390] Code: 42 80 3c 28 00 74 08 48 89 df e8 74 09 3d fc 4c 89 33 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 0a 0e db fb 90 <0f> 0b 90 eb e3 44 89 e1 80 e1 07 38 c1 0f 8c ff fe ff ff 4c 89 e7 [ 977.496068][T16390] RSP: 0018:ffffc9000bae7668 EFLAGS: 00010293 [ 977.502448][T16390] RAX: ffffffff85e4e3c6 RBX: ffffc9000bae77e0 RCX: ffff8880338d0000 [ 977.503926][ T5877] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 977.510561][T16390] RDX: 0000000000000000 RSI: 000000e3914556e9 RDI: 000000e3914556e9 [ 977.529605][T16390] RBP: 1ffff9200175cefc R08: ffffffff8f7f3377 R09: 1ffffffff1efe66e [ 977.537699][T16390] R10: dffffc0000000000 R11: ffffffff85e4e290 R12: 000000e3914556e9 [ 977.545768][T16390] R13: dffffc0000000000 R14: ffff888024448028 R15: 000000e3914556e9 [ 977.554104][T16390] FS: 0000555559ed6500(0000) GS:ffff8881260c2000(0000) knlGS:0000000000000000 [ 977.563227][T16390] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 977.569849][T16390] CR2: 000020000017b030 CR3: 000000006bb00000 CR4: 00000000003526f0 [ 977.578044][T16390] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 977.586097][T16390] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 977.594197][T16390] Call Trace: [ 977.597535][T16390] [ 977.600674][T16390] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 977.607026][T16390] drm_crtc_next_vblank_start+0x226/0x470 [ 977.612863][T16390] ? ktime_get+0x3e/0x1f0 [ 977.617236][T16390] ? __pfx_drm_crtc_next_vblank_start+0x10/0x10 [ 977.623565][T16390] ? seqcount_lockdep_reader_access+0x123/0x1c0 [ 977.629846][T16390] ? lockdep_hardirqs_on+0x9c/0x150 [ 977.635184][T16390] drm_atomic_helper_wait_for_fences+0x265/0x8c0 [ 977.641615][T16390] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 977.648506][T16390] ? do_raw_spin_unlock+0x122/0x240 [ 977.653915][T16390] ? read_tsc+0x9/0x20 [ 977.658031][T16390] ? ktime_get+0x1cb/0x1f0 [ 977.662557][T16390] commit_tail+0x79/0x3a0 [ 977.666951][T16390] drm_atomic_helper_commit+0xa6b/0xb10 [ 977.672644][T16390] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 977.678761][T16390] drm_atomic_commit+0x25f/0x2c0 [ 977.683790][T16390] ? __pfx_drm_atomic_commit+0x10/0x10 [ 977.689319][T16390] ? __pfx___drm_printfn_info+0x10/0x10 [ 977.695008][T16390] drm_client_modeset_commit_atomic+0x620/0x760 [ 977.701399][T16390] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 977.708211][T16390] ? trace_contention_end+0x39/0x120 [ 977.713653][T16390] drm_client_modeset_commit_locked+0xcb/0x4d0 [ 977.719971][T16390] drm_client_modeset_commit+0x4a/0x70 [ 977.725585][T16390] drm_fb_helper_lastclose+0xa4/0x1c0 [ 977.731226][T16390] drm_fbdev_client_restore+0x34/0x40 [ 977.736642][T16390] drm_client_dev_restore+0x13c/0x270 [ 977.742105][T16390] drm_release+0x318/0x3f0 [ 977.746576][T16390] ? __pfx_drm_release+0x10/0x10 [ 977.751595][T16390] __fput+0x44c/0xa70 [ 977.755633][T16390] task_work_run+0x1d1/0x260 [ 977.760350][T16390] ? __pfx_task_work_run+0x10/0x10 [ 977.765515][T16390] resume_user_mode_work+0x5e/0x80 [ 977.770700][T16390] syscall_exit_to_user_mode+0x9a/0x120 [ 977.776296][T16390] do_syscall_64+0x103/0x210 [ 977.780984][T16390] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 977.787171][T16390] ? clear_bhb_loop+0x60/0xb0 [ 977.791933][T16390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.797861][T16390] RIP: 0033:0x7f016718e969 [ 977.802398][T16390] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 977.822308][T16390] RSP: 002b:00007f01674dfb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 977.830850][T16390] RAX: 0000000000000000 RBX: 00007f01673b7ba0 RCX: 00007f016718e969 [ 977.838875][T16390] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 977.846993][T16390] RBP: 00007f01673b7ba0 R08: 0000000000000204 R09: 0000001d674dfe7f [ 977.855097][T16390] R10: 00007f01673b7ac0 R11: 0000000000000246 R12: 00000000000ee9d7 [ 977.863172][T16390] R13: 00007f01673b6160 R14: ffffffffffffffff R15: 00007f01674dfca0 [ 977.871361][T16390] [ 977.874413][T16390] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 977.881704][T16390] CPU: 0 UID: 0 PID: 16390 Comm: syz.4.2621 Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full) [ 977.892039][T16390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 977.902103][T16390] Call Trace: [ 977.905390][T16390] [ 977.908330][T16390] dump_stack_lvl+0x99/0x250 [ 977.912940][T16390] ? __asan_memcpy+0x40/0x70 [ 977.917545][T16390] ? __pfx_dump_stack_lvl+0x10/0x10 [ 977.922773][T16390] ? __pfx__printk+0x10/0x10 [ 977.927412][T16390] panic+0x2db/0x790 [ 977.931348][T16390] ? __pfx_panic+0x10/0x10 [ 977.935801][T16390] ? show_trace_log_lvl+0x4fb/0x550 [ 977.941040][T16390] __warn+0x31b/0x4b0 [ 977.945044][T16390] ? vkms_get_vblank_timestamp+0x137/0x160 [ 977.950869][T16390] ? vkms_get_vblank_timestamp+0x137/0x160 [ 977.956691][T16390] report_bug+0x2be/0x4f0 [ 977.961037][T16390] ? vkms_get_vblank_timestamp+0x137/0x160 [ 977.966872][T16390] ? vkms_get_vblank_timestamp+0x137/0x160 [ 977.972702][T16390] ? vkms_get_vblank_timestamp+0x139/0x160 [ 977.978523][T16390] handle_bug+0x84/0x160 [ 977.982794][T16390] exc_invalid_op+0x1a/0x50 [ 977.987320][T16390] asm_exc_invalid_op+0x1a/0x20 [ 977.992180][T16390] RIP: 0010:vkms_get_vblank_timestamp+0x137/0x160 [ 977.998614][T16390] Code: 42 80 3c 28 00 74 08 48 89 df e8 74 09 3d fc 4c 89 33 b0 01 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 0a 0e db fb 90 <0f> 0b 90 eb e3 44 89 e1 80 e1 07 38 c1 0f 8c ff fe ff ff 4c 89 e7 [ 978.018235][T16390] RSP: 0018:ffffc9000bae7668 EFLAGS: 00010293 [ 978.024315][T16390] RAX: ffffffff85e4e3c6 RBX: ffffc9000bae77e0 RCX: ffff8880338d0000 [ 978.032294][T16390] RDX: 0000000000000000 RSI: 000000e3914556e9 RDI: 000000e3914556e9 [ 978.040275][T16390] RBP: 1ffff9200175cefc R08: ffffffff8f7f3377 R09: 1ffffffff1efe66e [ 978.048271][T16390] R10: dffffc0000000000 R11: ffffffff85e4e290 R12: 000000e3914556e9 [ 978.056255][T16390] R13: dffffc0000000000 R14: ffff888024448028 R15: 000000e3914556e9 [ 978.064244][T16390] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 978.070421][T16390] ? vkms_get_vblank_timestamp+0x136/0x160 [ 978.076254][T16390] ? vkms_get_vblank_timestamp+0x136/0x160 [ 978.082078][T16390] ? __pfx_vkms_get_vblank_timestamp+0x10/0x10 [ 978.088254][T16390] drm_crtc_next_vblank_start+0x226/0x470 [ 978.093995][T16390] ? ktime_get+0x3e/0x1f0 [ 978.098346][T16390] ? __pfx_drm_crtc_next_vblank_start+0x10/0x10 [ 978.104600][T16390] ? seqcount_lockdep_reader_access+0x123/0x1c0 [ 978.110855][T16390] ? lockdep_hardirqs_on+0x9c/0x150 [ 978.116072][T16390] drm_atomic_helper_wait_for_fences+0x265/0x8c0 [ 978.122419][T16390] ? __pfx_drm_atomic_helper_wait_for_fences+0x10/0x10 [ 978.129287][T16390] ? do_raw_spin_unlock+0x122/0x240 [ 978.134504][T16390] ? read_tsc+0x9/0x20 [ 978.138586][T16390] ? ktime_get+0x1cb/0x1f0 [ 978.143017][T16390] commit_tail+0x79/0x3a0 [ 978.147369][T16390] drm_atomic_helper_commit+0xa6b/0xb10 [ 978.152936][T16390] ? __pfx_drm_atomic_helper_commit+0x10/0x10 [ 978.159018][T16390] drm_atomic_commit+0x25f/0x2c0 [ 978.163970][T16390] ? __pfx_drm_atomic_commit+0x10/0x10 [ 978.169448][T16390] ? __pfx___drm_printfn_info+0x10/0x10 [ 978.175029][T16390] drm_client_modeset_commit_atomic+0x620/0x760 [ 978.181304][T16390] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 978.188084][T16390] ? trace_contention_end+0x39/0x120 [ 978.193412][T16390] drm_client_modeset_commit_locked+0xcb/0x4d0 [ 978.199592][T16390] drm_client_modeset_commit+0x4a/0x70 [ 978.205074][T16390] drm_fb_helper_lastclose+0xa4/0x1c0 [ 978.210467][T16390] drm_fbdev_client_restore+0x34/0x40 [ 978.215872][T16390] drm_client_dev_restore+0x13c/0x270 [ 978.221274][T16390] drm_release+0x318/0x3f0 [ 978.225712][T16390] ? __pfx_drm_release+0x10/0x10 [ 978.230667][T16390] __fput+0x44c/0xa70 [ 978.234668][T16390] task_work_run+0x1d1/0x260 [ 978.239278][T16390] ? __pfx_task_work_run+0x10/0x10 [ 978.244415][T16390] resume_user_mode_work+0x5e/0x80 [ 978.249547][T16390] syscall_exit_to_user_mode+0x9a/0x120 [ 978.255127][T16390] do_syscall_64+0x103/0x210 [ 978.259735][T16390] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 978.265902][T16390] ? clear_bhb_loop+0x60/0xb0 [ 978.270591][T16390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 978.276499][T16390] RIP: 0033:0x7f016718e969 [ 978.280948][T16390] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 978.300566][T16390] RSP: 002b:00007f01674dfb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 978.308991][T16390] RAX: 0000000000000000 RBX: 00007f01673b7ba0 RCX: 00007f016718e969 [ 978.316975][T16390] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 978.324954][T16390] RBP: 00007f01673b7ba0 R08: 0000000000000204 R09: 0000001d674dfe7f [ 978.332964][T16390] R10: 00007f01673b7ac0 R11: 0000000000000246 R12: 00000000000ee9d7 [ 978.340943][T16390] R13: 00007f01673b6160 R14: ffffffffffffffff R15: 00007f01674dfca0 [ 978.348942][T16390] [ 978.352322][T16390] Kernel Offset: disabled [ 978.356652][T16390] Rebooting in 86400 seconds..