last executing test programs: 8m4.921789487s ago: executing program 0 (id=3679): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x7, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x5, &(0x7f0000000000)=0x1) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r0 = eventfd2(0x0, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0xc0000000}) writev(r0, &(0x7f0000000880)=[{&(0x7f0000000780)="fd5b036bf03e493f", 0x8}], 0x1) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x11) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x7, &(0x7f0000006680)) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x9, 0x5, &(0x7f0000000000)=0x1) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) eventfd2(0x0, 0x0) (async) epoll_create1(0x80000) (async) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0xc0000000}) (async) writev(r0, &(0x7f0000000880)=[{&(0x7f0000000780)="fd5b036bf03e493f", 0x8}], 0x1) (async) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x11) (async) 8m1.633896229s ago: executing program 0 (id=3690): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6(0xa, 0x805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}]}, &(0x7f00000002c0)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000001100)={r2, @in={{0x2, 0x4e23, @private=0xa010102}}, 0x1765, 0x9}, &(0x7f0000000040)=0x90) getsockopt$bt_hci(r0, 0x84, 0x81, &(0x7f0000000080)=""/4060, &(0x7f00000010c0)=0xfdc) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x2, &(0x7f0000000200)=[{0x15, 0x0, 0x0, 0xb7a}, {0x6, 0x0, 0x8, 0x7ffffcb9}]}) 8m0.745818473s ago: executing program 0 (id=3696): r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000080)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) (async) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000002000)=ANY=[@ANYBLOB="12010000facf01406e0510401c20000000010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000600)={0x2c, &(0x7f0000000300)={0x0, 0x0, 0x1, 'w'}, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000440)={0x44, &(0x7f00000003c0)={0x20, 0x16, 0x2, "f2ac"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f00000002c0)={0x1c, &(0x7f00000004c0)=ANY=[@ANYBLOB="001494"], 0x0, 0x0}) (async, rerun: 64) syz_usb_control_io$printer(r1, 0x0, 0x0) (rerun: 64) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$uac1(r1, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$printer(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) (async) syz_usb_control_io$printer(r1, 0x0, 0x0) (async) syz_usb_control_io$hid(r1, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000500)={0x0, 0x6, 0x1, '\x00'}, 0x0, 0x0, 0x0, 0x0}) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, &(0x7f00000001c0)={0x3, {{0xa, 0x4e23, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e21, 0x9, @local, 0x4f1}}}, 0x108) (async) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000200)={0x0, {{0xa, 0x4e21, 0x80, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @empty, 0xfffffff7}}}, 0x108) 7m57.352954596s ago: executing program 0 (id=3709): pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000002c0)=[@in6={0xa, 0x4e20, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f00000000c0)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f00000001c0)={r3, @in6={{0xa, 0x4e23, 0x81, @empty, 0x80000000}}}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x19, '\x00', 0x0, @fallback=0x2d}, 0x94) r4 = syz_io_uring_setup(0x10d2, &(0x7f0000000500)={0x0, 0x7736, 0x8000, 0x1, 0x26d}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_CONNECT={0x10, 0x2c, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r4, 0x47bc, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000540)={r3, 0x3, "976925"}, &(0x7f0000000580)=0xb) r7 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$rtl8150(r7, &(0x7f0000000200)={0x14, &(0x7f0000000000)={0x40, 0x4, 0x4e, {0x4e, 0x7, "a9b11503f5cd0bbdc2d1a12b61cc9593a3ca71af4523b1ebc5ef191c1b8dabc466927007d04cd6482d2a9f13c6a53681874fe4258f929bbc32b3d93c41719a8b93b3eee18a0d8d4ff06e8147"}}, &(0x7f0000000140)={0x0, 0x3, 0x8d, @string={0x8d, 0x3, "30b876d607a2d2d1c559222ead09ae7f4ad6e84aec1a54b525847ae86c745c8006e441aa75cee98a27defcc1fb4064383e5468d5dc930b9d194f4c4816ebd8221b8579ed78bbec14e64247d6e9d333db46806fc57ae255d417eaec47117e7964e5af210bc18c4d31c1ab7b3dc0d05b548871ee09578753d6426e2ce50bddcf00f68309303b8161c910ff4d"}}}, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x20, 0x2, 0xc4, "519fd21ce9966cb934fb5131c11aafb5c75d09522bdd1eae9dd5ad2b82dcef7845f5d7acba18ebf428fe4d6ba990caf867eb87f125ba064883691c672f8140efd45da171712fae38a06f4483b38d1544b4d0ad0ecdd2dd76161bb5c78e5bba288a1b1d5a14eadf74cd0a858d330171c5ce3d862a68b531994069cb568d10129f0fe3dd2cb5ffcbcc6a7465b5a2bec3da5988462417e01bac5308ca0008777217dc66a2fe505aa911c47501c2a34c799b3479f6d2a53c9b27a514c08c5d59785743b24585"}, &(0x7f0000000340)={0x0, 0xa, 0x1}, &(0x7f0000000380)={0x0, 0x8, 0x1, 0x80}, &(0x7f0000000480), &(0x7f00000004c0)={0x40, 0x5, 0x1, 'F'}}) r8 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r8, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port1\x00', 0x511e36599023622}) r9 = fsopen(&(0x7f0000000000)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r9, 0x3, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='\x05\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f0000000080)=ANY=[@ANYBLOB="12011001d31ad240f003035842bb0102030109022d0001b5000000000904c50003ff010700090505020800040101090415835c833b6c24f1da4bbfe56503000000dc5618d4375fa3b39223916e148190959176"], 0x0) 7m56.869014651s ago: executing program 0 (id=3710): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) futex(&(0x7f0000000000), 0x5, 0x1, 0x0, &(0x7f0000000100), 0x12000005) getsockopt$inet6_tcp_int(r0, 0x6, 0x6, 0x0, &(0x7f0000000240)) (async) r1 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card2/oss_mixer\x00', 0x450443, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000280)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaa0086dd6072b2af00102f46fe800000000000030000000000000000ff0200000000000000000000000000010000883e001090780200000000000000b7d6ad65276ab7dd413f1d2786d4a5839016edd7a8f134fad6516991957228fdcc0be2d157a616ef83a27140dac64f4953e9bf0e2dd2a0dcd58456e1ebd3264b6ab41648be023f0609c3b2bb6a5b1e71f9072c14a590435c9dcf93d411d95d83abc5d9a88d4ca97f1a262cb20ce9ba9431d4d5149773b5fdbee4d2b3490ae3f698add00f0aa2be6cd2249aca280933780e54f9a873b7a774b9c08a29d90934b8f0600346a7ff1e92eb3346e8"], 0x0) (async) readv(r1, &(0x7f0000000200)=[{&(0x7f0000000040)=""/174}, {&(0x7f0000000100)=""/90}, {&(0x7f0000000180)=""/112}], 0x37) 7m56.495651708s ago: executing program 0 (id=3711): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xc329, 0x4000) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000480)=[@nested_amd_vmload={0x182, 0x18, 0x3}, @uexit={0x0, 0x18, 0x8001}, @wr_drn={0x68, 0x20, {0x3, 0xc4}}, @nested_amd_invlpga={0x17d, 0x20, {0x0, 0xdaae}}, @out_dx={0x6a, 0x28, {0x1581, 0x0, 0x1}}, @code={0xa, 0x56, {"f20f108100680000470f0966b808018ed80f2043410f01d166ba400066ed66baa100b000eec744240051000000c74424020d000000ff1c242ef30fc7b680ffffff410f01f8"}}, @nested_create_vm={0x12d, 0x18, 0x8}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x457, 0x10, 0xffff, 0x2}}, @uexit={0x0, 0x18, 0x2}, @enable_nested={0x12c, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x56, 0x2, 0x4, 0x2}}], 0x1a6}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000a00030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) syz_clone(0x100011, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="7110ffff00000000950000a5a0fee9870000000000"], &(0x7f00000000c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r4 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x22781) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$USBDEVFS_SUBMITURB(r6, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0x8, 0x0, 0x0, 0x48000000, 0x0, 0x5ed7, 0x0}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000005) ioctl$USBDEVFS_REAPURB(r6, 0x4008550c, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800007, 0x11, r4, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) gettid() 7m41.384264535s ago: executing program 32 (id=3711): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xc329, 0x4000) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000480)=[@nested_amd_vmload={0x182, 0x18, 0x3}, @uexit={0x0, 0x18, 0x8001}, @wr_drn={0x68, 0x20, {0x3, 0xc4}}, @nested_amd_invlpga={0x17d, 0x20, {0x0, 0xdaae}}, @out_dx={0x6a, 0x28, {0x1581, 0x0, 0x1}}, @code={0xa, 0x56, {"f20f108100680000470f0966b808018ed80f2043410f01d166ba400066ed66baa100b000eec744240051000000c74424020d000000ff1c242ef30fc7b680ffffff410f01f8"}}, @nested_create_vm={0x12d, 0x18, 0x8}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x2, @save_area=0x457, 0x10, 0xffff, 0x2}}, @uexit={0x0, 0x18, 0x2}, @enable_nested={0x12c, 0x18}, @nested_amd_inject_event={0x180, 0x38, {0x3, 0x56, 0x2, 0x4, 0x2}}], 0x1a6}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000a00030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) syz_clone(0x100011, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="7110ffff00000000950000a5a0fee9870000000000"], &(0x7f00000000c0)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r4 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x22781) r6 = fcntl$dupfd(r5, 0x0, r5) ioctl$USBDEVFS_SUBMITURB(r6, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x0, 0x0, 0x0, 0x7995}, 0x8, 0x0, 0x0, 0x48000000, 0x0, 0x5ed7, 0x0}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000005) ioctl$USBDEVFS_REAPURB(r6, 0x4008550c, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x800007, 0x11, r4, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) gettid() 14.062166244s ago: executing program 1 (id=5233): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r0, 0x0, 0x0) r1 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYRES32=r0], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000180)={0x9, {"a2e3ad214fc752f91b2909094bf70e0dd038e7ff7fc6e5539b324c078b089b3b373b6d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5d38300d106d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df0784c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d618e462071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af44863c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000510b00", 0x1000}}, 0x1006) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r4) sendmsg$DEVLINK_CMD_RATE_SET(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000ffffffff2a00000008005800000000000e0001006e657464657673696d00"], 0x44}, 0x1, 0x0, 0x0, 0x4001}, 0x0) syz_usb_control_io(r1, &(0x7f0000001340)={0x2c, &(0x7f0000000100)={0x20, 0x24, 0x45, {0x45, 0x22, "03cb078a20ee1b29314f5232f581401a5cc2a3792769d2eeb08b8afaa0c2dc72354378510f7e3eacc53ce54e7682bf6b08fa00043339f8e6cbef0aeaa83147b0781c7d"}}, &(0x7f00000011c0)={0x0, 0x3, 0xf2, @string={0xf2, 0x3, "1a9bef56358d7568e1dd19392b59192d3c8b7b5f4f9f20b2cbbbb55a5f4e159ed4c3fff6fdc4852eb23c65e156c78fcc5515cbfb908295c3ade20b632b2da406d4ae8d93a6d4a00b78f95fde986158b2a41fe4c00c71dd09a41721c0a41aed31ff421d65e6a23df2cb7753fc1176085d53828fdb7c54a56de7e00db81b6cf181476e52f7853dd58b10063aa53081d796fe21fcdeb93c8cd9eefe620100c838f9d85dd043e92520b899b0e55a4544374c1af3217e3da21b883b8632e18bd41580376f4aa2944b7f43e6757853abfcbe08631272b31e9f017fbee5674b3c2478fde7226c98126442f820efe074eecf757f"}}, &(0x7f0000000040)={0x0, 0xf, 0x39, {0x5, 0xf, 0x39, 0x4, [@wireless={0xb, 0x10, 0x1, 0x4, 0x20, 0xd, 0xc, 0x3ff, 0x33}, @ss_container_id={0x14, 0x10, 0x4, 0x80, "1fc139c6e49b78c442aa6da0d3cb25e1"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x10, 0x4, 0x0, 0x13c6}, @wireless={0xb, 0x10, 0x1, 0x8, 0x2, 0x3b, 0x8, 0x5, 0x6}]}}, &(0x7f00000012c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x76, 0x60, 0x4, 0x40, "62a3377d", "2ada28fa"}}, &(0x7f0000001300)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xc, 0x1, 0x5c, 0x0, 0xc, 0x9f40, 0x8}}}, &(0x7f0000001840)={0x84, &(0x7f0000001380)={0x0, 0x30, 0xed, "554f403bb61fc52b0591b61e2d15c5f62e1c86696fcb889af069705667c682985da6ed02686225ad0a1ebd33037e5d73d36ad630885a38dd144218472338f2ade6e322791d7826d0f14ddd3ed2bb2bbebf168ab3c967be2f736c2b7d5068496d9b1e478e23ff0eb82e3f7772aad75e12b92d2d0cdbc626e6e6495f2d141b4305b8e046a8883379a9216f4226178dee843f92b49670750305b262e4ee9048f75b61b4e2923f9f0b90fd25e56cbf10e2a6c69c123be9537409ac0c41aea9209e7fe8922c1139dba60c9424f69cb8de53db0878d8899c486b08738953b92378e3bf7996ce6116034ab1ad8c0fe96c"}, &(0x7f0000001480)={0x0, 0xa, 0x1}, &(0x7f00000014c0)={0x0, 0x8, 0x1}, &(0x7f0000001500)={0x20, 0x0, 0x4, {0x0, 0x1}}, &(0x7f0000001540)={0x20, 0x0, 0x4, {0x11a0, 0x20}}, &(0x7f0000001580)={0x40, 0x7, 0x2, 0x8}, &(0x7f00000015c0)={0x40, 0x9, 0x1, 0x54}, &(0x7f0000001600)={0x40, 0xb, 0x2, "4880"}, &(0x7f0000001640)={0x40, 0xf, 0x2, 0x518}, &(0x7f0000001680)={0x40, 0x13, 0x6, @multicast}, &(0x7f00000016c0)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, &(0x7f0000001700)={0x40, 0x19, 0x2, "8294"}, &(0x7f0000001740)={0x40, 0x1a, 0x2, 0x9}, &(0x7f0000001780)={0x40, 0x1c, 0x1, 0x8}, &(0x7f00000017c0)={0x40, 0x1e, 0x1, 0x7}, &(0x7f0000001800)={0x40, 0x21, 0x1, 0x9}}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0xa0201, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'sha3-224\x00'}, 0x58) r7 = accept4(r6, 0x0, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000004140)=[{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000001c0)="14", 0x1}, {&(0x7f0000000280)="3b942cdf3dbb4d708446209c8a7a9893c711167b6aee1ac4a8cc59d92a394f460b20f21b9add9e84d2dba9e6df8034c449e64138a4aea2a8df6d35031bd3263f", 0x7fffefff}], 0x2}], 0x1, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x10000000007, 0x2102) syz_usb_disconnect(r1) close(r8) 11.317377954s ago: executing program 5 (id=5247): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_usb_connect$uac1(0x2, 0xa3, &(0x7f0000000080)=ANY=[@ANYBLOB="12010102000000206b1d01014000010203010902910013010140cc0904000000010100000a2401f5ffff020102132406060406040003000300030003000a000705240501030a24040508e53a273e3108240405047b653609040100000102000009040101010102000008240201080200030905010920003b0008072501020510000904020000010200000904020101010220000905820920"], &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0}) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x20, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x19, 0x0, 0x0, @binary}, @typed={0x8, 0xc, 0x0, 0x0, @uid}]}, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000200)=""/227, 0xe3}, {&(0x7f0000000040)=""/41, 0x29}, {&(0x7f0000000300)=""/120, 0x78}], 0x3) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x2401, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'syz_tun\x00', 0x603}) socket$kcm(0x2, 0xa, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="021800001c000000000000000000000005000600000000000a00030000000000000000000000000000000000000000000000000000000000020012000000000000000000fcffffff0600ff0000000000000000000000000000000000000000000000000001000000fe8000000000002100000000000000bb050005002b0000000a00000000000000fc010000000200000002000000000000000000000000000008001900000000000a00000000000000fe8000000000000000000000000000bb000000000a"], 0xe0}}, 0x0) ioctl$F2FS_IOC_PRECACHE_EXTENTS(r6, 0xf50f, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r7, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r7, &(0x7f0000004200)={0x50, 0x0, r8, {0x7, 0x1f, 0x0, 0x2066012}}, 0x50) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15460100100001ca1f55126701e63d33bf00065d01980ad5373253be5320d2d91abb34080bee000067656e65760000"], 0x3c}}, 0x4000) 10.68289495s ago: executing program 1 (id=5248): r0 = syz_io_uring_setup(0x11cf, &(0x7f0000000280)={0x0, 0xfbaf, 0x1000, 0x4, 0x312}, &(0x7f00000029c0)=0x0, &(0x7f0000000040)=0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100}) io_uring_enter(r0, 0x7277, 0x0, 0x28, 0x0, 0x0) 9.644904553s ago: executing program 1 (id=5253): syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x20d036, 0x0, 0x0, 0x0, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) mount$fuse(0x0, 0x0, 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x89901) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) getrlimit(0x1d, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000c40)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a3200000000140000001100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a0900000000000000001d020000000900010073797a30000000000900030073797a32"], 0x54}}, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000100)={0x1, 0x6d, 0x2, &(0x7f0000000240)={0xa1, "1a9c66bf2f615e427b2644e953449f6c12f206b2855cd8c82b1b9951cf5a1dee93"}}) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x18, 0x140c, 0x300, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x4000) r4 = socket$kcm(0xa, 0x922000000003, 0x11) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000540)={0x14, &(0x7f0000000480)={0x0, 0x24, 0x71, {0x71, 0x22, "15d5595a64d7dc5dc505a061e458623591d61e6eab2499786326d3aa4ef3c735ea459284fec852d70bdb2daf47cd6563bcbe9b8a6d2e602680da1de9bbdbfb3d5ccf2974c5a0fdbf6710d8f6f051f8ccf333bea289736fa771471167f637f6146c957999bd4083c9b9d9ba38824ab8"}}, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000008c0)={0x44, &(0x7f0000000600)={0x40, 0x17, 0x5a, "284a4735f32e1e9a50a714d4505370da367c6ee34a5f4e30b59339807631c77347b468e0a42a038a59d3f04a897848390102553816cd563c5db88f7dcd63760449909e811d8ee7ef4d98bf0642b9caa64ba0819f887a22ed3370"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000a40)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000006c0)={0x20, 0x80, 0x1c, {0x7, 0x7, 0xd, 0x1fd7, 0x0, 0x1c83, 0x1ff, 0x1, 0x10, 0x7, 0xebf, 0xcad}}, &(0x7f0000000700)={0x20, 0x85, 0x4, 0x5}, &(0x7f0000000740)={0x20, 0x83, 0x2}, &(0x7f0000000840)={0x20, 0x87, 0x2, 0xff}, &(0x7f0000000880)={0x20, 0x89, 0x2, 0x1}}) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_MFC(r5, 0x0, 0xcd, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffe, "a1e96e2678b0afa605953ab4536f70c05f8f3c96fc304c0472ec0a7f01a413b4", 0x1, 0x848, 0xff, 0x10001}, 0x3c) setsockopt$sock_attach_bpf(r4, 0x29, 0x24, &(0x7f00000000c0), 0x4) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f00000002c0)={0xfffff679, 0x6, 0x5, 0x1, 0x6, "b0cfc518474653f921e31ed71453439c21edd0", 0xfffffffa, 0xc}) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x0, [{0x0, 0x6, 0xd00}]}]}}, &(0x7f0000000280)=""/265, 0x32, 0x109, 0x1}, 0x28) 7.944338514s ago: executing program 5 (id=5254): r0 = socket$pppoe(0x18, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0xb, 0x8, 0x5, 0xcc0}]}, 0x10) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000080), 0x8) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f00000000c0)) (async) ioctl$SG_GET_VERSION_NUM(r1, 0x2282, &(0x7f0000000100)) (async) syz_kvm_setup_cpu$x86(r1, r1, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, &(0x7f0000000140)="460f005d000f01df640f211e66b8ed008ec0660faef2c4e17d11b200000000420f01c466400f388014fb360f2092c4813515668e", 0x34}], 0x1, 0x1, &(0x7f00000001c0)=[@cr4={0x1, 0x100}, @flags={0x3, 0x51}], 0x2) (async) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000200)={"50fb29d75a1657d6a898ed91ad5ade32d854e796a8332d2b2c51e8696cdd8c8b0a198e69163e9c500ad77af333911fae3fd0be5ed558688d0a4d53603b3845fcd0bd72d6241d403e000b15743b8d965a2266a0c82f5faa4b6b63088d27a2b2f6d15cabda785ef5ecceb5f8e13e2a426d8b71e6b7a547fced3c726fc14edb51fc9badd6377e69aab84f32b5f40fc7c008e875fddf52d564d6df221f83338618d498c4d43fed0900e0b93ab206b4f7282892e58cf30e7b4019c8feef558bfefcdbcaef92f24f49410938811471566e3d8e8742e13368e281b817072e827eb8debc26734e25f5b0ed57b965ef5b06a83e0a5f042936141ca64f654b39321c21a3504e7754d2e4e5c693b2475e0814cb2949189dc22c07e6795fac69a1e9ab385ca06dbeff6213d7d2488ade981b7142e617eac5145f161da7f5837baa9d462e0d1f18b3727574fbc527d17401d0efcc09b28aec34e228dd85631a4f6d6183674ee4ea495435bddf7f23c5ba47c001456bb4851a7808e4f75fbf14586c52671930f6c32e7ccafce11791eeca2786c10c6327fb009b038f9e71900105e79cf78380275b0ba2eff755e15627ec7e6e3ca293014b6b3bb83fffd7b32b01ed4bbecac496379698a266b6329a25be6e6439716facbf638ff115be6d89a4110712788f1b2df8d1ec294588782697e9351d2cafbb0227bc36092a924be00d50074725b2f7f188a14924796fd36161fe9a15cf644359c0d0ea248f06ae5946e746962cddec206fac47550182b8f2ee3bd6904fb99fd9359c3403ddfbab7a4cc61a4c537c37f778fd047bb0d52a61a768524b7aa23d7de641d72d99e870465fe828fc12cac259adb3c38ef87fb42efc08e01bbc619a2638d1dffd68eb0bab74ae23b49e8dd076cd14838e4680486a968e4b9fe387c86fc6818d5222646f22df412a62bf070934e56ed7c020cfdd729b177a222a8ddda38efbd4d24ea1a04dba2f7aa610ee99645df645b41735eba56824e32b7501374f081d4e3de963a36f0c9480bc408b6e0b59959a0d5abf76bcbc590516da389704a3f5b13efea95f5748b76d69a3448453c6fbfb24132b73051ac057bc3e4dda89d7149458a0ba899c5f50532614cb400e4953c2396ed010e6db5b599d04696b736250dfaf38833ad0f91cbd54492d75c54c83c229b3cb5265e03c2120f5918797fca233199856258face19b6f6c1ef28bf43a14bb135f7c238dbef13dc83c14daf670dfcb7472de60979df28b53180208e43834f3d53b33968a0dca94f684a4ba3be27399aced75cbe5412c92cef1a6e12339f6014de78c4097e0121a2fc8ba93211950ff9ea632f8c10978fd8a7871c7ede33091b2cec5660701f07beb7ba21e7ed6fe29ab76f400fed4764a45a5f7fa7e85e74b1f01f49239331b42c9a4b26a0cf5992aaccc4f78c2a3f6fd9a5a5ff3"}) (async, rerun: 64) r2 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000600)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000800)={{r1}, r3, 0x8, @unused=[0x0, 0x7ff, 0x5, 0xfffffffffffffffc], @subvolid=0x1ff}) (async) fallocate(r2, 0x0, 0x0, 0x5) (async, rerun: 32) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f00000018c0)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001880)={&(0x7f0000001840)={0x18, 0x140e, 0x2, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4080}, 0x800) (async, rerun: 32) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001900)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x8}) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x28, 0x3, 0x8, 0xb03, 0x0, 0x0, {0x5, 0x0, 0x9}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}]}, 0x28}, 0x1, 0x0, 0x0, 0x40841}, 0x5) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01864c2, &(0x7f0000001a40)={0x0, 0x0, r1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r1, 0xc01864c1, &(0x7f0000001a80)={r4, 0x1, 0xffffffffffffffff}) (async) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000001b00)={'sit0\x00', &(0x7f0000001ac0)={@dev={0xfe, 0x80, '\x00', 0x19}, @empty, 0xa, 0x11}}) (async, rerun: 32) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000001b40), 0x111200, 0x0) (async) exit_group(0x5) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000001b80)={{r5}, 0x1, 0x3, 0x33}) (async) exit_group(0xffff) (async, rerun: 64) socket(0x1, 0x80000, 0x77) (async, rerun: 64) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000001bc0)={0x48, 0x7, r1, 0x0, 0x10000, 0x0, 0x9, 0x24504, 0x3215b0}) (async) exit_group(0x0) r7 = getpgid(0xffffffffffffffff) fcntl$lock(r2, 0x6, &(0x7f0000001c40)={0x0, 0x4, 0x9, 0x1, r7}) (async, rerun: 64) openat$kvm(0xffffffffffffff9c, &(0x7f0000001c80), 0x2ac000, 0x0) (async, rerun: 64) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000001d80)={'bridge0\x00', &(0x7f0000001cc0)=@ethtool_eeprom={0xb, 0x8000, 0x76, 0x79, "c097cbdac8ab3abbc062e58d6f058eae142f994bf610a8cf87a0768c359e791deb6d0f4e8c25af0e5ab78e2243c67c9e573bc24953feee88a39c7e41c5993c33a9febe8799e361331bf443f5397ca93cdaf34226db783ca929ec90ff37175abe7d54569f06fe4920294fdafa33726b3f99d19c1edfb0378b31"}}) (async) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000001dc0)='syz1\x00') 7.45780081s ago: executing program 5 (id=5256): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000001500)=ANY=[@ANYBLOB="1201500285d5c2086004040031960154030109021b000100031003090458080119662194090586d7"], &(0x7f0000000100)={0x0, 0x0, 0x29, 0x0, 0x2}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7fffffff}]}) (async) gettimeofday(0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x32) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r2, 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x200000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000040)={@remote, 0x200000, 0x2, 0x0, 0xb, 0x3, 0x96}, 0x20) (async) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@arm64={0xb, 0xfe, 0x7, '\x00', 0x8}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'ip6tnl0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6}]}}}]}, 0x50}}, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) (async) r7 = timerfd_create(0x0, 0x80800) timerfd_settime(r7, 0x3, &(0x7f0000000000)={{0x77359400}, {0x0, 0x3938700}}, 0x0) (async) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r6, 0x84, 0x1a, &(0x7f00000000c0)={0x0, 0x35, "13224e475f77bb2a1c8252268a557dc7b2909fe7fe1513c18564c03b00716091d5f660ef96ed63fc72f41689e23913066fbabe4cc1"}, &(0x7f0000000100)=0x3d) (async) syz_open_dev$dri(&(0x7f0000000180), 0x7, 0x40000) 7.366061062s ago: executing program 1 (id=5257): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x587200, 0x0) ioctl$TCGETA(r0, 0x5434, 0x0) ioctl$VT_WAITACTIVE(r0, 0x5607) syz_usb_connect(0x6, 0x36, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0], 0x0) 7.062607189s ago: executing program 2 (id=5259): connect$unix(0xffffffffffffffff, 0x0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000009c0)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650caa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r1 = signalfd4(r0, &(0x7f0000000000)={[0x36]}, 0x8, 0x800) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0xc004aea7, &(0x7f0000000040)=0x3) syz_open_dev$loop(0x0, 0xffff, 0x14f600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x3, &(0x7f0000000200)=[{0x15, 0x0, 0x0, 0xb7a}, {0x2c, 0xe, 0x0, 0x3}, {0x6, 0x0, 0x8, 0x7ffffcb9}]}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpuacct.stat\x00', 0x275a, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00000000170000000400", "f4bd000000801900", [0x100000000, 0x8000000000000000]}}) 6.733665707s ago: executing program 2 (id=5261): syz_usb_connect(0x2, 0x36, &(0x7f0000000800)=ANY=[@ANYBLOB="1201100153a42908f00a71729188110203010902240001060000000904020002ffffff0009050b0000000000000905", @ANYRES16=0x0], 0x0) (async) syz_usb_connect$uac1(0x1, 0xb0, &(0x7f0000000840)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9e, 0x3, 0x1, 0x43, 0xc0, 0x10, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x2000, 0xb3}, [@selector_unit={0x8, 0x24, 0x5, 0x6, 0xa, "e687ce"}, @mixer_unit={0xa, 0x24, 0x4, 0x2, 0xa, "1a425167a3"}, @input_terminal={0xc, 0x24, 0x2, 0x1, 0x101, 0x6, 0x96, 0x28, 0x8, 0x2}, @input_terminal={0xc, 0x24, 0x2, 0x1, 0x201, 0xf, 0x1, 0x4, 0x1, 0x5}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x304, 0x6, 0x4, 0x2a}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x0, 0x4, 0x3, {0x7, 0x25, 0x1, 0x81, 0x8, 0x2000}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x8, 0x1, 0x80, 0x3, "61a7ea02"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0xc, 0x91, 0x6, {0x7, 0x25, 0x1, 0x0, 0x1, 0xfff8}}}}}}}]}}, &(0x7f0000000c80)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0x2, 0x8, 0x6e, 0x10, 0x10}, 0x2b, &(0x7f0000000900)={0x5, 0xf, 0x2b, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x16, 0x1, 0x6, 0x10}, @wireless={0xb, 0x10, 0x1, 0x2, 0x21, 0x1, 0x4, 0x2, 0x5}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "21d6fb71315a867eb42d47063ce1068d"}]}, 0x6, [{0x47, &(0x7f0000000940)=@string={0x47, 0x3, "0aa5f992488701048d64ebfe68e53acc3a40cc28f8dcc2ab116611fe834f145e5339a10027a76e5970ee97aeb665579da5099904c9cc18d8a49197cd58b30a0fa5503427d7"}}, {0xfb, &(0x7f00000009c0)=@string={0xfb, 0x3, "1c15f2f97491a154018ec94fdbb3a0e0fe630722029ddfd73586e73916a27f0325db1bae5fcd589a02d099a90753639009aaec59ec8a00caed38f30abc85c9d699324c14cdcb2cc652abbbdd5d5a2a4ad3c67486e9f0eea65e68ddd342de95a41b0a751456d2b3645f0e7502428f432386c91fc27e73f1a7249ce85759f02ffdda6babbcfbceab75fe2d599426370a9fa3be7898772a8a6d6062578d7fe119ab69ce1361c3fb9be9463e80f290e36ecee63a7b1cae98c3899efeb793ff737798d880a042ce67f2b1f7971438249bb726844accc16f5dc5a627aa90022727c568e43eb1dc2eabde17ccb6c5894ba71cfb5b0363dfbb0e08ed8c"}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x1c0a}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0x40a}}, {0x18, &(0x7f0000000b40)=@string={0x18, 0x3, "1ac63ce3363301d7564a2886ad00c90cf0260823fb64"}}, {0xe0, &(0x7f0000000b80)=@string={0xe0, 0x3, "056f24d9b3dbc7c10b9aa8d5fe4f11e0708f054da6cc37b844a5c71323849715e6e81b45085592e66a962f7faebd661f5087753e888565168d6a96e24e8d7f4c5ccf4c2d9c073ee6a3867fa6c0c612eb9d6395fcba843d56d4d0536507091e2e8a0df0f4c02a0900fbbf914b680c9b5c98245701b15772048751b7214a5b1d6092227576f23b57a7d566232fbaf0ff0bbf9ccf14fa1ac635f13838a4450be300d9e6806a546248004d2d5d5cbe8daae55c43022baff964bbf557d4156e1a8c057c6379a010105d3f44f4946102b045d48236ffaf23be4f729dd33dd15674"}}]}) syz_usb_connect(0x3, 0x6c1, &(0x7f0000000040)=ANY=[@ANYBLOB="1201500286adf240860509347cc6010203010902af06010901b000090404060f5e4b8e078e0a6693f8dd790ee3d8c193675441ec5562e47cee6644322e6be6b2a7035ac88bcbdf2b2593f03a201a1864f3fd80440ad05cc6132be841e067444625a675c964c6059c025a83752d55e6c7d3e8bf54c94652e55aff7b4001cecad48ea0de60c9af0e16a590cf473f6f753b32be67517741a08c32c3e6c8041556c856ef487d001b802a566062dd8d611b04b31709050c10ff030909070725010006440009050c100002040701ae219966f0ebcf17a5215134d8ffc5a4004be13a879b37c91cb47021a36f7a6e19c24c3676466045946d6cff7006947b695efeaade05f7a9c73a3b7c4bfc7ca24f4f2f51d8ac52213aeb658e285f75124e2c87771cf5f5ded42536900c1bf200027e7bef87fdc30f5c04df21550a774d24f8bf6be3243b20ba53470840964c8b2cd71e0647bfc518ede21794f1a6b4d954d202b32035cca3ab5d4a49c0bbfee58471f5cea70528963a4aaf32385c1311ba58fd6657e257df3f0a5358b92b1ed5de09050a0020000703040725010201030009050c08000480f10d0905ea000800fb07d1c70f42e243fba8c7244b38e37ffd9a2464278ea278ed2428b4a5a10a5e97ffe7b4657251a9ae565f1e5902b7b74247ac8978c8ab16c1febbea6d32056ea3255a63b7ca7849f4ef9320e352de5058b3b7f09ce4f20714e24ebb9b492debae70a8c5854b79ee30ffa08a1aefb9327fb880f795a35a55e7bb105147c905c5cf424b8420b7e9e68fda806f55a802c0620f14a666fd755e0f3fc43a40a1aba8865c39b3b8a75fd7ad5454aef34652ec560a58a512ee0a05dbb071151d36c9b5f57967238efd0777954209050d10200002a60109050b004000700006fc0133819df076c5da5752449587871d6432ec5011596274698a67e7aed936131efe8163d35e31984da45141694ed0a893f658c75bb88e29e71013ff7432766fdc8edcac7388657290dafe2abdde615b9391eae75ab9b6b262cfa1db9ccf4e1dca0698c6cf3bfe9ff99e319e9b281c652fb27a64cb80ac40f7148b98392a0df2a05d63bc05c74ebd3b0c1d7bf84294baa1c560204fe45bce7f8a8a3896196387cd7bd7ee37d55d7b3ffa786c78c4906be99f9afb2b41280c0cc548bbadb038fabbd5d835ae3a666f35cb94259d30815372ee014e918c0ffeb1e0f250e4a72e895f5320033971988e14d3c9f4c8cca1c53992a928078a440e77a74b05fd3ae4a8a1a1a537558e2d0725018161ff070905001000040201fc09050e03400010d827780ae4f5dd1bd9f0721ac9c0f703c36c11f75dce22b2056bf0db4cf2883abe316931a7122c35b8bfbfa15a38e5f75fd363d15f2b21b1740584676fe7d6b49df4a4b079029c4b6b647d924d79671e2317a8c39ca77d23018b74669d77651a86d858cc7be4c120a2b0209da269c1894285db9e04f086eb90ec790ae667919873f98700aecfa8cdd90d0a9674752722724561cf6661f263cb553e4c4f273bb2fa46b826609309bf1db203122572562439c5fa61643c196829022085a700762b860cbc1e69f8cb0cb5b749b081b6d25ce1fcfa5b029a1ec8fd612eeff08cbb6c440efad4cf7cef73d7c489603bbad8c6d7642a09050304080035f74e0725010007030041231c3117f9c5e9353c1446ccbf34d4d0a8c2863b7fd75ac59db28c72304246d143694588dbff692fb5fe1a0d3f19619b963124bbdd77fe9a4777c232290f8fb909050900080008050409050a0310000008085b3040d93cde2682cfb4f4d8477b6864bf070c00e10e4442bad988dc47d4acbd946f908e8702edf95a7ae7c8b33060ca4c8a452db6f70c9ed6aa80155147ef64050a0385a01011c613035f69d3982d5d117c648802df288d59b32009050003200004068107250102fe04000725018088090009050402ff030601007e089bc63632e436795ddc77f4cea492ada7ba354b77a20c870422c77c16d79593fed0c8b9599239e938d25701a486be502a77bd30a42153c7a89f3db440d9568c9d558d4da4c25f298561b72d9e847705ccfd5e647a4cc532a9245c45083c7a1f49a274ce3044c9d4c4d38af4fd5fc4e5ace040f48a796962aa67da69e7cf060f4b28a4c9a2c41c0b9e45405dc546b8180bc73f2c9e272c7f8d7eb7bc305b83dc276d912a5f310e9cbfabc554835140ffe34dd287bcc6e2f66f7eac46754bbb1b8555e0bc4f3ad97b0dfdceb1adc1ad18e6279338fad7228cd0f7c86eb30dbcab1312a9d7309c9b7d042bf7107e5041b4075e8ff1cfc6ad1a08ae6fa09f6d1b09caae91a2a4900d38939c3325b2bffc1b19728da3a83729a2743a702ef6b422d167aa399095f8be5ca8d8fc4458a3b8c3c2eee753df971a062255824f339ba8a3bb9a3f6ad266c3cf9333"], &(0x7f00000007c0)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x300, 0x8, 0x7, 0x1, 0xff, 0x81}, 0x1d, &(0x7f0000000780)={0x5, 0xf, 0x1d, 0x4, [@wireless={0xb, 0x10, 0x1, 0xc, 0x22, 0x5, 0x6, 0x9, 0x5}, @ext_cap={0x7, 0x10, 0x2, 0xc, 0x8, 0x8, 0x2}, @ptm_cap={0x3}, @ptm_cap={0x3}]}}) 6.585701986s ago: executing program 1 (id=5262): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x3, 0x75) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@private1={0xfc, 0x1, '\x00', 0x4}, @in=@rand_addr=0x64010101, 0x0, 0x1, 0x4, 0x0, 0x2, 0x0, 0x0, 0x2b}, {0x0, 0x800000, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x2, 0x200000000000000}, {0x0, 0x3, 0xfffffffffffffffd, 0x40000000000}, 0x0, 0x1, 0x1, 0x0, 0x0, 0x3}, {{@in=@local, 0x4d4, 0x32}, 0x0, @in6=@rand_addr=' \x01\x00', 0x1, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x3ffffe}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@mcast2, @in6=@mcast1, 0x4, 0x0, 0x0, 0x0, 0x2, 0x80, 0x20, 0x2f}, {0xfffffefffffffffd, 0xec7, 0x2d, 0x0, 0x0, 0x0, 0x778a, 0x2000000000ffff}, {0x3, 0x0, 0x9}, 0x0, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x4d6, 0x3c}, 0x0, @in=@multicast1, 0x0, 0x0, 0x1}}, 0xe8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(r1) setsockopt$inet6_int(r0, 0x29, 0x2, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet6_int(r0, 0x29, 0x9, &(0x7f0000000040)=0xf2f, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, &(0x7f0000000100)) syz_usb_connect$cdc_ecm(0x2, 0x62, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000020000102505a1a440000800010109025000010106500009040000ff02020000052406000005240002000d240f010000000000000000000c240703000003000300050009058103200000000a0905820220000000000905030208"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x118d7, 0x0, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) read$FUSE(0xffffffffffffffff, &(0x7f00000022c0)={0x2020}, 0x2020) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) io_uring_register$IORING_REGISTER_PBUF_RING(r4, 0x16, &(0x7f0000000700)={&(0x7f0000006000)={[{&(0x7f0000000340)="9311752b2890525422e50a2620cb2b315ca7f8e5f9b088f9109602060581655da1e2a4bec8926f0acf54bee805773938137ac3ac4d2fcc65b79480f6da12ffef3519cf15c82a713330a76a1b2e1ac20cd625fe60496cfc2147b38d8f1f681657fd93edd030bc7d51be5e3876ac562a2e85a6d9af34606582317a3fdad576c96acdd55654895bab479031d19270c10a117fee0efce02c67a353484096cd85bb419a552efd60adb7962c78f5a109df388f59aff121b983d85102086c1e0efc64e15dc19b4db3c5b1b01f05dad1a35b7a821635c2ddc3e60075a05e4788525e6efa0aeb3993b0e02b3e145be8517155c24f0e82f73d5e", 0xf5}, {&(0x7f0000000280)="ccd5ee80db4890b98c599735bb812ea37cfcc67345e0d5eb0d59a5a0cf47bf0c", 0x20, 0x1}, {&(0x7f0000004300)="626a8544f71b82961b5bffc8e5d27ef03e8f2a30806943413e816f8a03949685e409311d6f95fd3fcc68a5947a250a5aa517f9ee122643d9176cd268f12aec526a8372c7567b16231b19d53a3307165c97e923f33b2794b37131bbed7736e72b124600398feb2ebba14e1e0751381e08356d3763cea4d7a0fbc9d38f707cec6ca731fd7a08f851381dd6cce9929db3686820f2ef669899bf5862f0f885eba31eed4eef36a6c86e3ec9e75813b6f633294935c83bc8966f4a3bc56dc2159128750cb1cf3dc9371d372efffd9d34cba4d2a1f2d4eaa2b0be5d0ddd850aae603138aaccc88da302cf6c334d48e23a582f9a1656a4b057ecb284691b62c7c968ca8e70e1ce3e63f3303fd0142a211ba797f930fcf5a7bfc66951412a464a35e8a21995a47806dd3d59d024dc97ad5576f4ec11bc9e958b65290fb4f89136e6cf47ef65cb38c4194383ead2fd6682f1ea3a82547189f42db41cf9c7d9e268aa3ed66a1a7fee9b2c733a0f771e7feab9dcee7bab092113387f20488ab61748798469c572509c5226da7afd9f5b133f8c92c3a0f9375065905ff5e426ee078867e35c11a0dfcd4919941e3f990897505d081d1e5dc72366ff109543951e70b3befd8664fadca58a45da165d5837a69929b9e471b5a27f54f90bd173662b60aa55cbf81cc743fcb42331096d4f2e9709e300633aa4c8dac5f1845f900781000e94eb783574e7fa002ada02e84646df48c73f0829d6f8342cad5efd1c7963c50a4c59bcf3e2816d4b690fd4eb487e88cdcdc13040bc93fc8f34fe0a2fbfa4b8e03d0e034d83467820c32ee126d5283d710cd2dca195069b7f8426e595a5852088978f219dedd9b68010af4b3754c7a1c83a292e15f945af6f0470b47990e6a8827f4f62d285dd2790a935beedb1304a926d84df0edd6c3fae7969b4916a72c4056978e42d236cffa7e0a68210fefc283a907d40f3fbc4d20870ad478f7054f60f87443330655d00b3512ecb3692b326c2ebdc05bbd2323f732e1d7b11272cc7161516258ca2b21d874c4a44ee493215f2480834613dba33624dbcf162d040271df5861e508894ff818d60c329775f94b604c714c16a3d23c2969a243eadb309f5d9f0b415daa536fe64ca952c1b7601fad6f02c5ee5b76c10fb286de1c9ce89372efef9da0c8521a091046a3d7c0887f3396da819a328f7cf0c76b34b4237ef06dad6604c826345fe73b565b5aad0a73b2f2e89519ae281764679018c619b11d7b1dd42c4ba724c8cac5e41d9562793fef9733b748e2372b2f5d34473e542673161b57445d9153159f2fc54868fd0f5b5f0a4fb389fac612c5bfc9f4aeae064d37867e85a72ea60ff7cabbcbfadef3fafec75c0df3986713933727656eda9fca04654a2780b6e84664ea81a1a6c3b6b53a8d8b61fc3f317ade7422f6adc50bb7cd6a41ad5400a044cf76bfc8a6b6790842512a47c18acfaff9123a45948e81353b48a2c0f9e10c7689cacf87c75534d32aebe6169b85afa2f09363dfc587c2056c5ce0df4a2e26b90420595bc1060d76c3891399da3e74a1224f09572be7d161bdeb1a21d019e2822a90f5ef9922280b746e2003745b790f25d70d1de196fdbf395ec226cd3082eeb851b65490bea69df98e11eff57b701818ab68d007d0e08d10cfcc0bfba064435e1d7f91a9c22b473033d56094b7494b67fd792fa0caf598c451241e812552c72dba634f4118ca89ffca77de2a02259646f31254da55672beff4e4845bc60161a6ef15f2787383b6a2426637fe54b1dfdcf023a858c3141d5cc8d06da8bc29af75469532e66058b4bfa16981599131375fa3ffa6cde617618c959430ada19604c2d5d59360d6eaafe30ba46ff42dd83f68518be20a93c6a6249d34b041cd5e2467a4d24872e6d6e695ffa2f4bafd545b84d336865fc387dcdf357e2c232a368d873e81a0dd253331be3f3730d5b2460bfbccd4d0cad9b1759a7faf8dbdd7bb5f5bcf39ded551b69b2e4c24a082340182913f2fd2e18942297de91bc2a8578579385f5f40a080501413eb51664e8b2d550ab94223c518b298e4a648ad96d9073076be48d3ccab3eb89bbcf64dccb94cb73ebdc33969023635a7d3f6b3754ecae06c2b10a7b7538546b323bc2d7692e130cedb365446aee699d1f986b3c9416a40ffa2389c95681e6317ac7c6a587edeff6f4f3b43d0fcbd803b2e2710bfff9128f21b7fea85c1d10628e89387c904b5293bfa4b347e00a0ef153d233526ec744d29fa0322b5b1490133bfff30ef73382c988aab801d7e9ea450d79cf7055b4213d2349bdd3cc8dbca3e098d3fa6e2da2f9fb174262f5e5a6e8a61003111d238dfd6cb44ac25ffacec6180864b035d7abbf2bfaeff56975722f80f2b7ecea8ed15b2fa8af0e8ff0015a29172f6011d08b7c831a67b3871f20e0f2e0d3170210d47e5f098eb55ed1426f714a9bd091fe82d0783dc3a7aba6a78175dd3b37e4f97f508f51263f80f902fc3b9b3fc2ee566d39bd50b288897d096168f2fa7ddead63f4e3e6cd01671f626ddb76a2b6b129cc23e68c1d9679af0e2c43bbafd9fab45fca9d28e8c6cab86bd5aa30c5122d595e82c04604a4ffcedc10b1d6cef4dda665c0851ecc3b7f1c743317b652189d8bc413d4d925bf5c9cea5ca041da7ed1922bd632dbd81f076235e55ba68e688368291c7d1eb69c3442a586fc23a2ae13ce79d057554e4fd0a0e4d6a3ec0f45efa11913152ad5f3ffca5d1799630c8085171e260d50811d63d8dfd129b03d67c130461e8e970dac460cbdf4b10bd962037aa8fe649e273906bb3a03d366ed2e3c63d0904cac153c51752bea6a6925794c47f33fc4152a18c215588b44bfe55e78fd2393438c803fd3a291e08ef8c6c43b45e9f32fb25abb8d8bbe48167e57e230b4fd0f8806231f8c91adacd165500f472431370874c8e84a6539c9fca7987b6dc6274ba7d0bf78e92e12e814166719ffdc5f2133cac179dc533a0e4b74ae3722f1b25274ea633729e8b994cc83f3e62e419abf375ea37c4143ce642367e7616cc0881fcae719e7eae066e8c7cdb18e6296f74ad37cc712b944a5341034a032f9666239740b9c2e59df9238a9d63e7d0c3373b8b3485530088fdd98178c7204b308e0a6d0c55159074d1dec4af821931be36d6a684c6bda3903af9d8c8506478fa674a416a6001d1fada3e114d6780b52c9603c45966f75361f3b44f2ce195b50f7061e3ab30b948e3444d97efbacd0ec4958523bf29a0f2fd5fdbbf8be59d894c6c16d0d9765e1daad6bb129ea9659f304335d1916bb81f1cf001ff66d36e10ecaf5aa75cc1b748ff1e6aea737df7c74ed17b79cce0f3f72ec2a4d8353d856706d161d71e6524af6e6b5a20145f18ce486e5963941ebcb568b55940a6e39a410fb65814c54f41d2b4f6f1220d340e215cc8b2548b3ade39f55b511188cdfdfe7c119b890d820c6e19655560ade287ed95f27e75741461c4bcd13aaeefbefdc09d1474892d907b1cdf2eb7edaf10b4496dfde1382a8e558bc3c327993d961a4fb44ffeb881ee89f1ddf89acc12e341a160976cbf964f6d1be038346cd231c67ac6cdc76661a8a6e409436d5a8ff4e9f726e1e136ebcd16e6d6d066e8abb636d003368e6ea499ee01cedc9afc6d1205c523cc5260b35d16c9d15b13e171619d2bcc3957f0a2f520cf71dba6a891ce682280109bac09fe4de89e77d2a6e8c96587997805a431d0de3e203cdb8464a17149b5a6045cfcca1dfd5b52ecb2058282140e2966e9c5c60785c043827fa5b7e81c942326df5143d3e8264196bb9b84faea83d1733f6072b9711b13ec9277fa6debc46e24d825151fc191ba4a0cab8164b6f8cb19bd2bb7870040462df2de2e21d1da3907ea6365548f49b560fe5c15378041ffea9fa9c90cf382225fa474567c43bf38fd3674f31a2e4c21399e061612d807942ebd696934fb0513b2d1d0ca1289b1f2590bebc4b92fe1e2c4e621a0302a75315eed9c016d8bc8a5a5067ab4e7e516e9dd0325524d8e3cc8b5635cd19af02c6e1dbcd0b52f01940f6c5158f226b9c1d00da1679a5892c3361ac39a377367a2f20446dcb347312cec1fb261a5c83a1d2eabc4cde2c3db9e0bec5779f22acdb5dc76edd34ae7b8d406657b5b6b11c26733faf8558dd51485d232f94303d8c4bbfeca8391189cc306813c0a39935c39bbff4b40206479e843cffc21d00d6174cd2635433d59c48e2cebda5e6bc45fbd15422ebdcbd87cefc5a996d4e6787f2188224dcd39a53819764ad77e325a369449044475ca87f2f25ee333d8726254e8554ab1fab8715133839191e7809df3a8ca8609a2c1cb3de1dc4fb2a280ce9aaf9e267b86ac56e1885e99c063f6e5e9ae186669797be19d215ef04ee29c8504ac3505925ef1af541b86d784c8569e830b87991db40c3dc11f49d87c4e931f7ced8799467f5a0e8e51e620909ac8742eaa598428e003f3aa1e1193c4cb78a885db60ab8d506eabf482a828f859797fc74e8a084d3a3aea14b903e7f7d6ece896edfbbf24aded865d56e02c8ac4b7bb3668e5579ac471eef13b4ae93824c3af1af5b1c1a38d110ea2aa152f5450c35147171ac183320d4b471fd109adefd0ede85de67c2bf473d36e3d2348293c8cce850354bf019f110d9d5e6b0d0672f32d44ba75cc43b4e884091e164b75bbd2e05e19567a12e71fd842f2fddd9e4d78e544ec63e433255a58cb8e37fa4290c0a2a064d8a610eeec00e63b4dbf981c893e763b9e02f6134278d52f43bea4b33918d8c3d5223c07521bdd904cc0758ade69669a9fb646871d3128d6230caa5d18a5a92eefd0a52234033e6044ab16b24b08ae93dba871b4f1717f62c3c69a4f80508d9cb53dbeb2a2ac2a214b5d9c453b047fe3bca7c51def69ebb8b8703940d903a258cdf9609c484619108d0af014fc3b22d95ae99e7787c9202e175a9ba9da9bd938146d96616fe4da30a60176ce52ee1efcf391af568ce4f41b264685095af2a05f81e174817258e7e41f66316c40559331021f32a2b7bdd0a3dfa71740165f6700b9c11c6419626c5cde026d55b934651b4f9bbd4030d4566feed82bfa01c8a26a3e9291ff0dc7388127decf29093fd4389726734a94141a6c86153dca76bfc2cf4fe288c0ab357b3402878727258df13e0e972cf488b35f5131eea7f628c2023110a95918425b22f525d5af3b1ba35547556b574189259b8d0a051f0da834a6c70a4521fd968e92de6312a936d484fcc2a2579ca06206b7b108d015e2e3be00078cca5bc14bb079358134becc6045f129f20468ca9ac6a7ff411d95b8992ad57c6d83d9a26b21e731b1ec260442607739d3a1bdf51d547782599e5ae03e1a3ca90530cbda40919e07f32e1d61f1e1e0ac0eb68f6207cfbfd8109a2af92776be7888ace3b481a8e91b8d17cbdaef214518c25d4e3d62bc0c817c326320a6f05b7fecc2cdca8b87f437799cb80ce7fa1688e66a8715c27c046bd9511b4bf79e4338e798c59448216285798c9830f7cb7a488b83977144b453918f88335a17839747a8218e3ccccbb64d2ec02c20eb6dbe762543dea3611dd95aef68667fedbc083ded664a33526f50d94c9221984c1e6034d9f05864767badd68d07c5d24fad58d1f4ee6efecc3f9704717e6af44c4a489fbdc341790264969c323b81c7720974d10a9726accdd936ecaa57dfe0b147ceb114ef38cb13ea94baf84c2ba664dffd3c77825460914785b2efe5e385f4be0de", 0xff0, 0x2}, {&(0x7f0000000440)="300af27344a50195227146b8db1c7007628b1a676b869597658cebe124ceca282f2f0b61eb5fd4f118c294aaf8f932a7e0ea6030f9849a86a5aec097eba6013c21acd5ba18adf45482a3b7d4218c5422c80dcae805ecc3409a7e7b0d3b1013193ecddfc9e7c9ed6d36571cf11233ba5155aca3de98dd7fd18c742ec7a99af0129be917fbfc1f4af5460a0de577ccbd6fe7a6ca8581eeda02752b103a9f1bfb06e142eeb6040db577911d2e7a21b90c8e3197483c65e8b593906db93c42569cc61e166ad7ac740ca3c51e8bfc2695", 0xce, 0x2}, {&(0x7f0000000540)="8f646dcdf59a6c8f7cda182f03b6192af841432c66758f89e9305d8c743f4b58ab39cab8a7bbd61db9b3708df3c56ce3ca31e29ed8e4010215a78c9484209b6cd9d3bd97f9d64e378fc9c2cf406edf24cfb245ddc1289cf4640ede33ed05b5f028fdd6669dc4d9796489b6097f4e034586ee9bce3c92e9270adfd03e4d2600367f23beecd163b345269f86bbbdfc5778e8157d55a6cd0327d64071d74fce9fc8ba9a13ffd47055ab531c", 0xaa, 0x2}, {&(0x7f0000000640)="4d851546972f53e3086953b1f234292d31361a1a685ace8c95ebb435af78d45ff8383d2ad8433878de3030ef60e5d6a0cfdfa15119c94634e0505adff1249a4071d0e7ae8a137c8c3d9caf7b6c53cca792a698a8000cadbacd5f6ed5a221febc5183291d4042a79df5f94ef13a84cbf3c2473d7ecde349fdcde98aa9626a41fd2b781d63c3f8ee9c7b1a16504a96b75815d1", 0x92, 0x3}]}, 0x6}, 0x1) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000048000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000408000140000000000900010073797a300000000008000a400000000284000000060a010400000000000000000100000008000b40000000000900010073797a30"], 0x124}}, 0x0) 5.817125033s ago: executing program 5 (id=5263): r0 = syz_io_uring_setup(0x11cf, &(0x7f0000000280)={0x0, 0xfbaf, 0x1000, 0x4, 0x312}, &(0x7f00000029c0)=0x0, &(0x7f0000000040)=0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100}) io_uring_enter(r0, 0x7277, 0x0, 0x28, 0x0, 0x0) 5.624674472s ago: executing program 2 (id=5264): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x1}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0xffff0000, 0x2842) r5 = syz_io_uring_setup(0x22f, &(0x7f0000000080)={0x0, 0x466f, 0x2, 0x4003}, &(0x7f0000000300)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r5, 0x7a98, 0x0, 0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r8 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r8, &(0x7f0000000140)="1ba0000016001d0d89fdc5cbdd045798707bed4dca141a780f0f8e", 0xff3b, 0x0, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'lo\x00'}) r11 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r11, 0xc06864b8, 0x0) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000880)=ANY=[@ANYBLOB="a0475b4f05890d167f140001003a002902000000"], 0x14}}, 0x0) sendmsg$nl_route(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001400030500008000fb03df25021f56ff", @ANYRES16=r4, @ANYBLOB="080002007f000001"], 0x20}, 0x1, 0x0, 0x0, 0xc090}, 0x48006) recvfrom$inet6(r8, &(0x7f0000000000)=""/31, 0x39, 0x2002, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x2, 0x0, @ioapic={0x0, 0x9, 0x10001, 0xfffffffe, 0x0, [{0x1, 0x4, 0x87, '\x00', 0x8}, {0x9, 0x48, 0x2, '\x00', 0x6}, {0xff, 0x7f, 0xd5, '\x00', 0x67}, {0x0, 0x5, 0xf5, '\x00', 0xf}, {0x7, 0x9, 0x8, '\x00', 0xb4}, {0x0, 0x23, 0x54, '\x00', 0xff}, {0x75, 0xd5, 0xf1, '\x00', 0x7e}, {0x3, 0x5, 0xc}, {0x7f, 0x4, 0xb, '\x00', 0x19}, {0xd7, 0xd, 0x8, '\x00', 0x6}, {0x0, 0x28, 0x80, '\x00', 0xdc}, {0xff, 0x1, 0xfe, '\x00', 0x1}, {0xfe, 0x7, 0x26}, {0xcf, 0x40, 0x8, '\x00', 0x6}, {0xf, 0xee, 0x7, '\x00', 0x3}, {0x40, 0x2, 0x6, '\x00', 0xb}, {0x9, 0x6, 0x0, '\x00', 0x1}, {0x4, 0xc, 0x5, '\x00', 0xc}, {0x7, 0x1, 0x7, '\x00', 0xc2}, {0x0, 0x80, 0xe, '\x00', 0x7f}, {0x1, 0xc, 0x80, '\x00', 0x7f}, {0x10, 0x6, 0x12, '\x00', 0x10}, {0x1, 0x3, 0xf3, '\x00', 0x4}, {0x7, 0x3, 0x4}]}}) 4.968624787s ago: executing program 4 (id=5267): syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x20d036, 0x0, 0x0, 0x0, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) mount$fuse(0x0, 0x0, 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x89901) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) getrlimit(0x1d, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000c40)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a3200000000140000001100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x8}, @NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x94}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a0900000000000000001d020000000900010073797a30000000000900030073797a32"], 0x54}}, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000100)={0x1, 0x6d, 0x2, &(0x7f0000000240)={0xa1, "1a9c66bf2f615e427b2644e953449f6c12f206b2855cd8c82b1b9951cf5a1dee93"}}) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x18, 0x140c, 0x300, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x4000) r4 = socket$kcm(0xa, 0x922000000003, 0x11) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000540)={0x14, &(0x7f0000000480)={0x0, 0x24, 0x71, {0x71, 0x22, "15d5595a64d7dc5dc505a061e458623591d61e6eab2499786326d3aa4ef3c735ea459284fec852d70bdb2daf47cd6563bcbe9b8a6d2e602680da1de9bbdbfb3d5ccf2974c5a0fdbf6710d8f6f051f8ccf333bea289736fa771471167f637f6146c957999bd4083c9b9d9ba38824ab8"}}, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000008c0)={0x44, &(0x7f0000000600)={0x40, 0x17, 0x5a, "284a4735f32e1e9a50a714d4505370da367c6ee34a5f4e30b59339807631c77347b468e0a42a038a59d3f04a897848390102553816cd563c5db88f7dcd63760449909e811d8ee7ef4d98bf0642b9caa64ba0819f887a22ed3370"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000a40)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000006c0)={0x20, 0x80, 0x1c, {0x7, 0x7, 0xd, 0x1fd7, 0x0, 0x1c83, 0x1ff, 0x1, 0x10, 0x7, 0xebf, 0xcad}}, &(0x7f0000000700)={0x20, 0x85, 0x4, 0x5}, &(0x7f0000000740)={0x20, 0x83, 0x2}, &(0x7f0000000840)={0x20, 0x87, 0x2, 0xff}, &(0x7f0000000880)={0x20, 0x89, 0x2, 0x1}}) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_MFC(r5, 0x0, 0xcd, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffe, "a1e96e2678b0afa605953ab4536f70c05f8f3c96fc304c0472ec0a7f01a413b4", 0x1, 0x848, 0xff, 0x10001}, 0x3c) setsockopt$sock_attach_bpf(r4, 0x29, 0x24, &(0x7f00000000c0), 0x4) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f00000002c0)={0xfffff679, 0x6, 0x5, 0x1, 0x6, "b0cfc518474653f921e31ed71453439c21edd0", 0xfffffffa, 0xc}) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x0, [{0x0, 0x6, 0xd00}]}]}}, &(0x7f0000000280)=""/265, 0x32, 0x109, 0x1}, 0x28) 4.839025892s ago: executing program 5 (id=5268): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in=@broadcast, 0xfffc, 0x0, 0x0, 0x0, 0xa, 0x0, 0x100, 0xbd}, {0x0, 0x0, 0x0, 0x0, 0x800000000}, {0x0, 0x0, 0x1000000000000000}}, {{@in=@multicast2, 0x4d4, 0x33}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x9}}, 0xe8) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000002640)={0x44, &(0x7f0000000000)=ANY=[@ANYBLOB="400e02"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000b40)=ANY=[@ANYBLOB="400010"], 0x0, 0x0, 0x0, 0x0}) r2 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="8228277d960b000102"], 0x10}}, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = accept4$alg(r3, 0x0, 0x0, 0x0) sendmmsg$alg(r4, 0x0, 0x0, 0x5) io_submit(0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000412ff8)="3665a1", 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') syz_open_procfs(0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 4.66566457s ago: executing program 3 (id=5269): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$F2FS_IOC_SET_PIN_FILE(0xffffffffffffffff, 0x4004f50d, 0x0) syz_open_dev$usbfs(0x0, 0x77, 0x101301) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSMRU1(r2, 0x4020744f, &(0x7f0000000000)=0x10000) r3 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r3, &(0x7f0000000100)={&(0x7f0000000140)={0x2, 0xfffd, @multicast1}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xe0000000}, 0x80) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='ns\x00') name_to_handle_at(r4, &(0x7f0000000300)='./mnt\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="1c00000081000000050000000000000000100000000000f378dc600000000000fcffffff"], &(0x7f0000001500), 0x200) sendmsg$NFT_MSG_GETCHAIN(r4, 0x0, 0x20) ioctl$EVIOCGPROP(r4, 0x40047438, &(0x7f0000000180)=""/246) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0xfce1) r5 = syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x103000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000040)={{0x1, 0x2, 0x7fffffff}}) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r6, 0x80605414, &(0x7f0000010340)) ioctl$CEC_ADAP_S_LOG_ADDRS(r5, 0xc05c6104, &(0x7f00000003c0)={"f2efe21e", 0xffff, 0x3, 0x4d, 0x0, 0x1fc, "2179d46fd08e3c03ed34c7d0c7e6d7", "7ca22e13", '\x00', "ecff5d00", ["1af0b1ba1cb8fd54c9c9b587", "bed0f3d6ce7a5f7389827f04", "33af3b3c60abc64f2fdc95df", "9b3842fc63849f6200a51c00"]}) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB="58010000100001000000000800000000ac1e00010000000000000000000000000000000000000000000000000000000000000000000000000000200000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fffffffff0ffffff00000000000000000000000033000000ac1414aa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000008056000000000000000000000000000000000000000000000000000000100000000900000002000000000000000000000002000100800000000000000048000100736861323536000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020001700010000002bbd700025bd70002dbd70002dbd700006000000d14d0557"], 0x158}}, 0x0) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d3e457201e040b40e73e000000010902120001000000000904"], 0x0) syz_emit_ethernet(0x66, &(0x7f0000000440)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb86dd6000000800303afffe80000000000000000000000000000eff0200000000000000000000000000018700907800000000fe8000000000000000000000000000000000000001012025b07f3c58681f85e74adf2a73bc51e30ace756c437991c9ddd5988300"/125], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000080)={0x24, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0}, 0x0) 4.129386878s ago: executing program 4 (id=5270): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x1, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) syz_emit_ethernet(0x86, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f81fcb", 0x50, 0x3a, 0x0, @private0, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "4aa198", 0x0, 0x3c, 0x0, @ipv4, @ipv4={'\x00', '\xff\xff', @loopback}, [@srh={0x2f, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, [@private0]}, @fragment]}}}}}}}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="9b0f2bbd700002dcdf25010000001c0002800c000180080001000100a7000c0001800800010003000000965cc4bc7a39b5d4f26ab04352c0d2c11a267e6318c42fc13e7c03b73021ff000000d81ca1ec36f0d634f9dcc1bd000000000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x80) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x4040100) ioctl$vim2m_VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f0000000140)={0x0, 0x40, 0x4, {0x2, @raw_data="3d924b8271394fa4ec01eb92492ff84715d1a004d08b012a7cafe27a5f313d31bbdae50511ca5be6bfe92437ed0d21b5180e375be56b3b9306d7dbb26bf9f22de7ac7681cca450055250217bdf1113b4258293ba4efed33147bda8454dd115bd5ba066ba06f2854cc96db9a98055cbde9fd084a1223ada91ed2e832907a01ab5ee65f997b617f73d1aa5a6dfc47acdc5eb834f8e448469d235e4380cbcc3310200970349a3c1374ffec96177b67caa0656f9664277cadb8597e7d911ad1da457ef9744b0993c57a7"}}) read$char_usb(r1, 0x0, 0x11) syz_usb_ep_write(r0, 0x81, 0x1, &(0x7f00000000c0)="ad") 3.852671105s ago: executing program 3 (id=5271): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x10, 0x0, 0x0, 0xa, 0x20, 0x0, 0x62}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000003, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x800, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x1000, 0x0, 0xa, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}, 0x0, 0x6e6bbc}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x0) 3.54898068s ago: executing program 3 (id=5272): r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x2001}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) bind$tipc(r0, 0x0, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), r2) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x30, r3, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x8}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4008000}, 0x9004) 3.179057863s ago: executing program 3 (id=5273): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_NAN(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x28, 0x0, 0x10, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x3ff}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4010000}, 0x48000) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r1) r3 = memfd_create(&(0x7f0000000440)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x3) write$binfmt_script(r3, &(0x7f0000000080)={'#! ', './control/file0', [{0x20, '# '}]}, 0x17) r4 = openat$binfmt_format(0xffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz1\x00', 0x2, 0x0) (async, rerun: 64) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r1) (rerun: 64) sendmsg$ETHTOOL_MSG_WOL_GET(r1, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x48, r5, 0x800, 0x70bd25, 0x25dfdbff, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000000) write$binfmt_format(r4, &(0x7f0000000000)='1\x00', 0x2) (async) execveat(r3, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0xffffffffffffffbe, 0x1, 'syz1\x00'}]}], {0x14}}, 0xb4}}, 0x0) syz_usb_connect(0x3, 0x62, &(0x7f00000003c0)=ANY=[@ANYBLOB="12010000fb5d7d086d04c308166b0102030109025000010000000009041f0000ff0100000a2405c2"], 0x0) 2.81019224s ago: executing program 2 (id=5274): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xe}, 0x1c) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) ioctl$KVM_SET_PIT2(r0, 0x4070aea0, &(0x7f0000000080)={[{0x1, 0x4, 0x3, 0x2, 0xf4, 0xef, 0xff, 0x9, 0x3, 0x0, 0x7, 0x7, 0x4}, {0xfffff98b, 0x9, 0x40, 0x0, 0x1, 0x4, 0x8, 0x0, 0x2, 0xd, 0x7b, 0x80, 0x80000001}, {0x22a, 0x9, 0x0, 0x9, 0x4, 0x80, 0x6, 0x3, 0x35, 0x2, 0xa7, 0x1, 0x1}], 0x4}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r4, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r4, 0x0, 0xffffffffffffffff, 0x1}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r5) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000019080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01000000000000000000390000000800", @ANYRES32, @ANYBLOB], 0x38}}, 0x0) ioctl$IOMMU_IOAS_UNMAP$ALL(r3, 0x3b86, &(0x7f0000000240)={0x18, r4}) r7 = fsopen(&(0x7f0000000040)='ceph\x00', 0x1) socket$nl_sock_diag(0x10, 0x3, 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000680)='/sys/kernel/kexec_crash_size', 0x40901, 0x0) write$FUSE_DIRENT(r9, &(0x7f00000001c0)=ANY=[@ANYRESDEC, @ANYBLOB="737d641d5f23"], 0x200001d0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x4000000) 2.757460754s ago: executing program 3 (id=5275): syz_io_uring_setup(0x313f, &(0x7f0000000080)={0x0, 0xffff7ffd, 0x10100, 0xffffffff, 0x1a7}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r2, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f00000003c0)={0x0, 0xfff, 0xad}) setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000000000), 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x20031, 0xffffffffffffffff, 0x0) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) set_mempolicy(0x8006, &(0x7f0000000040)=0x4, 0x5) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000200), 0x101200, 0x0) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/uevent_seqnum', 0x149b82, 0xb300bb1401d27a12) write$cgroup_int(r7, &(0x7f0000000000)=0x800, 0x12) syz_open_dev$swradio(0x0, 0x0, 0x2) r8 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) 2.754423527s ago: executing program 4 (id=5276): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002000)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000280)="90db78a5c589bcde", 0x8}], 0x1, 0x0, 0x260}}], 0x1, 0x0) (async) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) (async) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001680)) (async) r1 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000001c0)={0x0, r1}) (async, rerun: 64) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001d00)=""/176, 0x0, 0xffff1000}) (async, rerun: 64) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080)=0x5) (async) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000140)={@my=0x1}) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a20000000000a01080000000000000000050000090900010073797a310000000054000000030a03000000000000000000050000030900010073797a31000000000900030073797a3200000000280004800800014000000001080002400a7b1af2140003"], 0x9c}, 0x1, 0x0, 0x0, 0x24000144}, 0x20000050) (async, rerun: 32) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async, rerun: 32) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r4, 0x10f, 0x80, 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4c800}, 0x44000) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x503, 0x70bd27, 0x20000, {0x0, 0x0, 0x0, 0x0, 0x1d961}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @private=0xa010100}]}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x7}]}, 0x40}}, 0x4080) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x38, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x24, 0x18, 0x0, 0x0, @binary="08ac0f0002ac0f0009ac0f00b4c6ea978047236b91931953af0e321188bc14dc"}]}, 0x38}, 0x1, 0x0, 0x0, 0x42804}, 0x0) 2.613010374s ago: executing program 4 (id=5277): openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) r0 = syz_open_dev$vbi(&(0x7f0000001940), 0x3, 0x2) ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000000200)={0x4, @capture={0x0, 0x1, {0x4, 0x10}, 0x6, 0xf}}) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000340), 0x63682, 0x0) fdatasync(r1) unshare(0x22020600) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="183f0000000000000000000003000000950000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0xfe2, &(0x7f0000001840)=""/4066, 0x0, 0x6, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) 1.372208865s ago: executing program 4 (id=5278): r0 = syz_io_uring_setup(0x11cf, &(0x7f0000000280)={0x0, 0xfbaf, 0x1000, 0x4, 0x312}, &(0x7f00000029c0)=0x0, &(0x7f0000000040)=0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$UHID_CREATE2(r3, &(0x7f00000001c0)=ANY=[@ANYBLOB="06"], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r3, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, 0x0, 0x60, 0x185100}) io_uring_enter(r0, 0x7277, 0x0, 0x28, 0x0, 0x0) 952.925454ms ago: executing program 5 (id=5279): syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) pipe2$watch_queue(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r1, 0x5760, 0x11) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r1, 0x5760, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000200)={0x14, &(0x7f0000000100)={0x40, 0x23, 0x92, {0x92, 0x33, "23b4177fa9f0e7dcc979ba69795b6bc935d570a5b1c41ff4d668c8f6a2f11f78dde966327ad827e1cd59ec0828a9b4f205ce89381d213272c29a775a52f1e71a31deb14abaf6961fb6efe391184d3e8ca8f1b2373a014064fa10c007ff621c0d738f09d8551de458941f97f764d89364f7a76698c375eb3d747128ca2e3f61b821bd4e3e71e766944a438d0bb570ca19"}}, &(0x7f00000001c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000004c0)={0x44, &(0x7f0000000240)={0x40, 0x5, 0x1e, "7ae84b14ab5d22ee6c2f440156191e3a16526fd226195ece01b51e5b48f4"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x8}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x2, 0x1, 0xfff, 0x8, 0x1, 0x4a0e, 0x1, 0x400, 0x3ff, 0x9, 0x81, 0xad07}}, &(0x7f0000000380)={0x20, 0x85, 0x4, 0x7}, &(0x7f00000003c0)={0x20, 0x83, 0x2}, &(0x7f0000000400)={0x20, 0x87, 0x2, 0x3}, &(0x7f0000000480)={0x20, 0x89, 0x2}}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x10040, 0x0) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r2, 0x3b82, &(0x7f00000000c0)={0x18, 0x0, 0x3, 0x0, &(0x7f0000000080)=[{0x6, 0x3f}, {0x2, 0x3}, {0x1de, 0x801}]}) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="201006000000065f01"], 0x0, 0x0, 0x0, 0x0}, 0x0) 756.901248ms ago: executing program 1 (id=5280): syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x20d036, 0x0, 0x0, 0x0, 0x0) open_tree(0xffffffffffffff9c, 0x0, 0x89901) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) mount$fuse(0x0, 0x0, 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x89901) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) getrlimit(0x1d, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100024286bd10b00d815522f90102030109021200019ddb10010904"], 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000c40)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x180c}}, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000050a0900000000000000001d020000000900010073797a30000000000900030073797a32"], 0x54}}, 0x0) r2 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000100)={0x1, 0x6d, 0x2, &(0x7f0000000240)={0xa1, "1a9c66bf2f615e427b2644e953449f6c12f206b2855cd8c82b1b9951cf5a1dee93"}}) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x18, 0x140c, 0x300, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x4000) r4 = socket$kcm(0xa, 0x922000000003, 0x11) syz_usb_control_io$cdc_ncm(r1, &(0x7f0000000540)={0x14, &(0x7f0000000480)={0x0, 0x24, 0x71, {0x71, 0x22, "15d5595a64d7dc5dc505a061e458623591d61e6eab2499786326d3aa4ef3c735ea459284fec852d70bdb2daf47cd6563bcbe9b8a6d2e602680da1de9bbdbfb3d5ccf2974c5a0fdbf6710d8f6f051f8ccf333bea289736fa771471167f637f6146c957999bd4083c9b9d9ba38824ab8"}}, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000008c0)={0x44, &(0x7f0000000600)={0x40, 0x17, 0x5a, "284a4735f32e1e9a50a714d4505370da367c6ee34a5f4e30b59339807631c77347b468e0a42a038a59d3f04a897848390102553816cd563c5db88f7dcd63760449909e811d8ee7ef4d98bf0642b9caa64ba0819f887a22ed3370"}, &(0x7f0000000580)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000a40)={0x0, 0x8, 0x1, 0x1}, &(0x7f00000006c0)={0x20, 0x80, 0x1c, {0x7, 0x7, 0xd, 0x1fd7, 0x0, 0x1c83, 0x1ff, 0x1, 0x10, 0x7, 0xebf, 0xcad}}, &(0x7f0000000700)={0x20, 0x85, 0x4, 0x5}, &(0x7f0000000740)={0x20, 0x83, 0x2}, &(0x7f0000000840)={0x20, 0x87, 0x2, 0xff}, &(0x7f0000000880)={0x20, 0x89, 0x2, 0x1}}) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_MFC(r5, 0x0, 0xcd, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffe, "a1e96e2678b0afa605953ab4536f70c05f8f3c96fc304c0472ec0a7f01a413b4", 0x1, 0x848, 0xff, 0x10001}, 0x3c) setsockopt$sock_attach_bpf(r4, 0x29, 0x24, &(0x7f00000000c0), 0x4) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f00000002c0)={0xfffff679, 0x6, 0x5, 0x1, 0x6, "b0cfc518474653f921e31ed71453439c21edd0", 0xfffffffa, 0xc}) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f00000005c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x0, [{0x0, 0x6, 0xd00}]}]}}, &(0x7f0000000280)=""/265, 0x32, 0x109, 0x1}, 0x28) 743.979233ms ago: executing program 4 (id=5281): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a000000050004000000000009"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410072786500140033006c6f0009b01a2c"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x850) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16, @ANYBLOB="01002abd70000000007b280000000c000180080001", @ANYRES32=r1], 0x20}, 0x1, 0x0, 0x0, 0x2000c094}, 0x4044884) (async) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[], 0x0) (async) r2 = socket$kcm(0x10, 0x2, 0x10) (async) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r3, &(0x7f00000005c0)={0x9, {"a2e3ad21ed0d52f91b25090947f70e06d038e7ff7fc6e5539b5b43078b089b3b073172090890e0878f0e1ac6e7049b3371959b6e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d074c0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6b922f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa0b9d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c71568f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897f3411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2de8a50ddefeb12c46342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f02f4cded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) (async) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) 641.068035ms ago: executing program 2 (id=5282): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000740)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@empty, 0x0, 0x10, 0x0, 0x0, 0xa, 0x20, 0x0, 0x62}, {0x8, 0x10, 0x100000002, 0x0, 0xfff, 0xffffffffffffb473, 0xffffffffffffffff}, {0x1000000000, 0x2000000000000003, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x2c000010) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x800, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x1000, 0x0, 0xa, 0x20}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}, 0x0, 0x6e6bbc}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x0) 481.509523ms ago: executing program 2 (id=5283): socket$nl_route(0x10, 0x3, 0x0) openat$kvm(0xffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x18000000, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x8417f, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x0, &(0x7f0000000280)}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r2, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c0827686e59209d2e02c9210fd8048f04ad6c42200fd9232f5aa6a361816bf21afb8473a064f1988536d4b5888807b3aaafaf59f53121782a0a9370dc0feae13c8c2a1dcc8a3122aaa3dcd5b9247a915378e6492e5b94073dcdc87e7c794fb262a7e9ee0b9432f74331c6e9412ac6557c54c6ac72bc24ff70ca2f8", 0xda}], 0x1}}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="bf", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000b40)}}], 0x3, 0x2090) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r2, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) syz_open_procfs$userns(0x0, &(0x7f0000000580)) ptrace$pokeuser(0x6, 0x0, 0x358, 0xffff8880b870e002) capset(&(0x7f0000000740)={0x20071026}, &(0x7f0000000ac0)={0x7ff, 0x9, 0x5, 0x9, 0x5, 0x3}) recvfrom$inet(0xffffffffffffffff, 0x0, 0x0, 0x40000021, 0x0, 0x0) r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) move_pages(0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000000), 0x0) execve(&(0x7f0000000040)='./file0\x00', &(0x7f00000005c0)={[&(0x7f0000000ec0)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000180)='\x7f\xbf\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', 0x0, &(0x7f0000000b00)='\x13\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Th\xb5\xe8Q\x19\x9cx\x1e\x9eOG\x88\xad\x00\x00', &(0x7f0000000480)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000bc0)='\x7f\xb7\xc3\x7f\xa5a\xd6\xd3\x18\xd0\xe0\xd8R\xf02b\xefA|uiWb\x8f\xee\x1ch\x83\x94y\x89\xf1Y{\x87\xd5\xf7\xccMr\xc5\xbdT\x9e\xd4\x84\x06\xcd\x8b\xcd\t\x01\x11\xbc\x86<\x8b\xad\xc4\x80B\xce\x86\x86g\x92\x92w\x89\xfe\xba\xbeeC\x96Ad\t\xc2\xc8\xed\xf3\x1e\x84Ot\x12`=\x98r\x94[\xc8\x91r\xbaG3\xd6a\xca\x05\xd5\xec\xfd\xfa\xaa\xa1\xa7\xcc\x85\xf5D_\xb4$r\xca\x8f\xcf[T\xb9\x0f\xaf\x00\xbc\xa4\xba\xb6=]\x8a\xfb\xaa\xdc+\xbe\a\x06>\r\xe5,i\xa2\xa8\xa2M\xc7\xfb\x11\xd1U\xe5H\xd6\x1b\xf7\xf6B\xcbG\xe4\xe6\xc3{\xf5\xf9_F\x02\x8ah\x15G`+\xf9\xb9\x95V\xa3\xb0\x1b\x0e\xafle%/K\xbb\x9d\x17\xde0\xc2\xa41\x9aS\xe6M\x1e\xb9\xc9\xe8\xf7i\x02e\x8c\xce\xa9\xe7\xc9\x13\xa4\xe8\xf4\x1c\xff\x82\xe13\x89\xeex\xb5\xcf\xce\x108j#\xabH\xc3RU\x00M?\xca\x9c\xefT\xaaJ8*\xe0S\rV\x9c\xaf\xb3yh\x15\xa2\xce>>f\x16\x8d(\xeaot\x83\xe5\x13\xf2bA\xc1O\xbb~\xe5p\x83\x811\x15\x9eP\xea\x00\x00\x00\x00\x00\xfd\x8c\x96\xebw\xdeg\"\xe4\xf6\xfc\x96N\xaf>!\xd9\xaf\x1be\xfa\xedJ\"\xab\x18xK5?\xec\xa0\xc2<\xa8\xdbo\xb1l\nn\xdb#\x97\xbcd\x0e\x93\x9e\xea\xb9\x9d-\xb6u\x7f\xe0\xa6\xef\xb4#\x1b@N\x04\xa0s\xa0\xe1\x90k8\xc3\r\xd0\x1b70b\xda\xe5\xb0\xa8\x01\x14N\xcf\x8dJ\xad\xc69\v\xbc[\xec\x97\xe7\xb2\x90j\xbd\xb1GX\xf2\xed\x15\xceK\xac\x19`a\x1e\x15\x90\x8d\xf4r\xd4Q\xd5\xc19|\xf7\x99\xed\x0e\xaf\xf7\xefR\xa6\xd0:\xe2yB\xfdpG\xf5\xc5\x919\x0f\xfa\xd1R\xc7\x8b\xbc)l\x11\xa8h2V\xe8\x1a\xf7\x8e\x14\xcbF\r\xa7w\xd3\xd3\xb7\xa5\x88\"\xa8\xa4>\xf0*\xbeM\x02\xf0i\x10m(7\xb64\xf5\xa1aZ\x16^\xde\a\xfae\xae\xe7{1\xd0\xa2\t\f\x85\x98\xdaK4]Hi1J\x95\x0e\xa37\x86ch\xcb\xeb\xbfq\xc6\xd3\x98\xd3\x8c_R\xe4oN\xa7\xab\x03\x1c\xc5}\xf1\x92\x82\xe3\xa5~jy<\xf7T\xaf\xabYQ\x82EI\xf0P\x96\x00\x00\x00\x00\x00\x00', &(0x7f0000000000)='\xc1r\x9dnyb`\x00\xa2\xabCg\x13\b\x8f*\xdaA\x822\xf7\xaf\xf6U\xad\xb0\xb2\f\x88s\x19\xa3D\xa9\x82\x8a\xa3\x94\xab\"|\xcf\x1f\x12\x8d\xe1\xe5\xc3\x01\x03\x003\xa9p^\x01^\x16>tnF', &(0x7f00000007c0)='\x00', &(0x7f0000000900)='\x01-\x00\xb6\xb7\xe1\x7fl\xd5\xf8G\xfdQ=\xc3\xd4\x02RP\xb2\xbf\x99\xfc\x10\" \x93)\xc5\x93\x98\x11\xe0\xd4\x14\x9a\f#LU\xda\xeb\f\x03\xa4\xf7\x85\xddYL\xf7\xf2\xc4\xff@+\x04^\xcc\xc8\xa1\x9f\xa7p\xd2\xaa\xa2^\xa6\xd1\v\xd1\xdd+o\x91\xc8\x90\xeebUCE\xdc=\x89\x86\x81S\x038', &(0x7f0000000840)='\x10!%{@{+\x00', &(0x7f0000000880)='.-\\:!\x00\x00\x00\x00\x00y\xa5\x91\x9d:)\x0f\x9d/\xf8\f\xad\xdb|\xcf\x1cHB\xc8\xa3Qo{\xc5|\xa5z\x0e\x0f\xdee\xc2>\xb6\xfe\xeaZ~\xa3\x15\x16l\x00', &(0x7f00000008c0)='-\xf3\x00', &(0x7f0000000980)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000780)='.\\\\:!\x00\x00\x00\x00\x00y\xa5\x91\x9d:)\x0f\x9d/\xf8\f\xad\xdb|\xcf\x1cHB\xc8\xa3Qo{\xc5|\xa5z\x0e\x0f\xdee\xc2>\xb6\xfe\xeaZ~\xa3\x15\x16l\x00', &(0x7f0000000a80)='::-$[]#:{\x00']}, &(0x7f0000000b80)={[&(0x7f0000000800)='.-\\:!\x00\x00\x00\x00\x00y\xa5\x91\x9d:)\x0f\x9d/\xf8\f\xad\xdb|\xcf\x1cHB\xc8\xa3Qo{\xc5|\xa5z\x0e\x0f\xdee\xc2>\xb6\xfe\xeaZ~\xa3\x15\x16l\x00\x00\x00\x00\x00', &(0x7f00000000c0)='-\xf3\x00']}) ioctl$VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000140)={0x0, 0x5, 0x1, {0xa, @pix_mp={0x9, 0x800, 0x0, 0x8, 0xa, [{0xd, 0x2}, {0x3, 0x8000}, {0xa64a80ed, 0x7fffffff}, {0x200, 0x4}, {0x5, 0x1}, {0x4ce, 0x8}, {0x7ff, 0xd}, {0x200006, 0x1}], 0x7, 0xff, 0x7, 0x1, 0x5}}}) 0s ago: executing program 3 (id=5284): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x100000, 0x100000, 0x10, 0x1, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x2000, 0xf, 0xf6, 0x0, 0x0, 0x1, 0xff, 0x8, 0x0, 0x5}, {0xd000, 0xdddd7002, 0x0, 0x80, 0xf9, 0x0, 0xff, 0x0, 0x23, 0x0, 0x4}, {0x5000, 0x2, 0xf, 0x41, 0x0, 0x2, 0x1, 0x7, 0x0, 0x3}, {0x4000, 0xdddd1000, 0xc, 0x21, 0x3, 0x10, 0xc0, 0x0, 0x1, 0x0, 0x4}, {0x0, 0x100000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, {0xdddd1000, 0x2000, 0xa, 0x0, 0x2, 0xfd, 0x0, 0x7, 0x3a, 0x2}, {0xeeef0000, 0x2, 0x0, 0x2, 0x7, 0x6, 0x7, 0x0, 0xfe, 0x0, 0xfe, 0x5}, {0x0, 0x400}, {}, 0xddf8ffdb, 0x0, 0x0, 0x100, 0x7, 0x4000, 0xffff1000, [0x400000000000000, 0x10000000020, 0x2]}) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000001280)={0x0, 0xdddd0000, 0x2, 0x5, 0x50}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) r4 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100"}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000200)={0xb, "34ad9987ffed3bbabd18cf501922de974a27000000000000000000f6ffffff00"}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x8, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x1, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0xa9e, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000006, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r6 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000240)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x0, 0x56a, 0x0, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x5, 0x80, 0xff, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x1, 0x6, 0xfb, {0x9, 0x21, 0x1ff, 0x40, 0x1, {0x22, 0x85e}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x9, 0x0, 0x8}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x4, 0x8, 0x8}}]}}}]}}]}}, &(0x7f0000000d40)={0xa, &(0x7f0000000300)={0xa, 0x6, 0x110, 0xc, 0xbd, 0x2, 0x8, 0x32}, 0x2a, &(0x7f0000000880)={0x5, 0xf, 0x2a, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x2, 0x1, 0x8, 0x5}, @wireless={0xb, 0x10, 0x1, 0x8, 0x94, 0x5, 0x9, 0x8, 0x8}, @ssp_cap={0x10, 0x10, 0xa, 0xf8, 0x1, 0x8000, 0xf00f, 0x6e9, [0x30]}, @ptm_cap={0x3}]}, 0xa, [{0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x1809}}, {0x6e, &(0x7f0000000940)=@string={0x6e, 0x3, "926cb4f34ecbde50164b9c951099f521c1e009e319abd8a4f4e5747085909166bbf1b492c7a59a846ddfaa0f35e40d20c3eb0bf6ede23bcba0d294a8d4ece198b16bd017fc63d3053df1baa3d4642ffdae3b7158b301ffcb71e5495d9ce0a2cb9888c6fd5a4387e0939e8d79"}}, {0x56, &(0x7f00000009c0)=@string={0x56, 0x3, "c65134b40f1fae1a03eb5ca1afcff231e44822239c9da8a3b903f14b28103a80b6ef016cde91a5add9c24f5f3adf0a9c465ead4a4e9ef6157c84f902ed12f058e7ded3dce903910956e25840032e78aad0938380"}}, {0xbd, &(0x7f0000000a40)=@string={0xbd, 0x3, "7d1ceb7f9526b5df0f42d3027a0a04435ec7df04125dfdf3a17f7830b81b1868c45fadb0dd1525117c0aee18bb482ad8f321428fd07dc8f7b612cba6bc0f480b26930750bd0f9a97016d77c2071bd755ee86561daf784e6489482d7a7589ba2e47863fe268477c4d54370f9a5625133cc250a3ce95ec6e1ddc6e52139445b2a25b10847d900aba3993f20adafe94610f6747f9736d1a81f3483d4237ad5d72d90007a37874f856dcafb4a8063c214f3cb78f7c5f45863f231f306a"}}, {0xf1, &(0x7f0000000b00)=@string={0xf1, 0x3, "8b311174748fa59244698deeef0ed0d6cfecfd4b243f9f6fe6d3b2f49a6758f36337c86389076bfce09522b5afb4dbf3ef05f1179c125c15faea1b2f4fef2f9babc06b79b4a21c2ef42f0d11f7fc92b453d9738e5391b9c636b691d4ec5df285fd798f16313c4e2d65aff0e0a87248b2cc6462644654ff6319f7ebc349be562dc2ab42d69456a32236dfb13bfbecf817c86be8881894761d8a208eb2e0d24c4838b40cb258ddee63bd6c8df9129aa1b366ba250b6b8fc9ce67e61006268502c37efe6d810702a9808725cb17776ddff87ee3bbf7d364d11f4ca648e559a5dce4785a03dd090c623b43d452215be385"}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x44e}}, {0x4, &(0x7f0000000c40)=@lang_id={0x4, 0x3, 0x2c01}}, {0x4, &(0x7f0000000c80)=@lang_id={0x4, 0x3, 0x814}}, {0x4, &(0x7f0000000cc0)=@lang_id={0x4, 0x3, 0x403}}, {0x2b, &(0x7f0000000d00)=@string={0x2b, 0x3, "a6020e2b2758a7b3695b5dc6ba4861713e43b039a4ea52e1d614c0a6a01f896e9c1e21450aa79c6623"}}]}) syz_usb_ep_write(r6, 0x27, 0x77, &(0x7f0000000e00)="2010f23bbb878d926a71341350dc4b1ed03f6e9d499f971d0c2983954e123c5130ae95a5366e57cbbfb663cb3a7c26b8fdb37d029f5ebfc8ef511146ea74c35d3b2e47695d2f515e65525944574bf8cac7ac4d505f84a40382d9c3cf4df2c96231d22dde1094e456671d3f4a562ccdf4912cead790a7ff") ioctl$SW_SYNC_IOC_INC(r5, 0x40045701, &(0x7f00000002c0)=0x3) r7 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r8 = syz_clone(0x20300000, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = syz_open_procfs(r8, &(0x7f0000000280)='io\x00') preadv(r9, &(0x7f00000001c0)=[{&(0x7f0000000340)=""/230, 0xe6}], 0x1, 0x401, 0x9) ioctl$I2C_RDWR(r7, 0x707, &(0x7f0000000200)={&(0x7f0000000040)=[{0xff, 0x5201, 0x0, 0x0}], 0x1}) pwrite64(r3, 0x0, 0x0, 0x239c1317) kernel console output (not intermixed with test programs): f642028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1536.729129][T25561] RAX: ffffffffffffffda RBX: 00007f293ea15fa0 RCX: 00007f293e79aeb9 [ 1536.729143][T25561] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1536.729156][T25561] RBP: 00007f293f642090 R08: 0000000000000000 R09: 0000000000000000 [ 1536.729169][T25561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1536.729181][T25561] R13: 00007f293ea16038 R14: 00007f293ea15fa0 R15: 00007f293eb3fa48 [ 1536.729212][T25561] [ 1537.277390][T21269] usb 6-1: USB disconnect, device number 50 [ 1537.806477][T25569] FAULT_INJECTION: forcing a failure. [ 1537.806477][T25569] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1537.885392][T25569] CPU: 0 UID: 0 PID: 25569 Comm: syz.1.4882 Tainted: G L syzkaller #0 PREEMPT(full) [ 1537.885420][T25569] Tainted: [L]=SOFTLOCKUP [ 1537.885426][T25569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1537.885436][T25569] Call Trace: [ 1537.885443][T25569] [ 1537.885452][T25569] dump_stack_lvl+0xe8/0x150 [ 1537.885480][T25569] should_fail_ex+0x412/0x560 [ 1537.885504][T25569] _copy_from_user+0x2d/0xb0 [ 1537.885530][T25569] ___sys_sendmsg+0x1c6/0x360 [ 1537.885552][T25569] ? __lock_acquire+0x6b5/0x2cf0 [ 1537.885579][T25569] ? __pfx____sys_sendmsg+0x10/0x10 [ 1537.885624][T25569] ? __fget_files+0x2a/0x420 [ 1537.886134][T25569] ? __fget_files+0x3a0/0x420 [ 1537.886159][T25569] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1537.886187][T25569] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1537.886215][T25569] ? __pfx_ksys_write+0x10/0x10 [ 1537.886247][T25569] do_syscall_64+0xe2/0xf80 [ 1537.886267][T25569] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1537.886282][T25569] ? trace_irq_disable+0x37/0x100 [ 1537.886298][T25569] ? clear_bhb_loop+0x60/0xb0 [ 1537.886317][T25569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1537.886333][T25569] RIP: 0033:0x7f00d1f9aeb9 [ 1537.886352][T25569] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1537.886365][T25569] RSP: 002b:00007f00d2ee3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1537.886384][T25569] RAX: ffffffffffffffda RBX: 00007f00d2215fa0 RCX: 00007f00d1f9aeb9 [ 1537.886753][T25569] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1537.886777][T25569] RBP: 00007f00d2ee3090 R08: 0000000000000000 R09: 0000000000000000 [ 1537.886790][T25569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1537.886802][T25569] R13: 00007f00d2216038 R14: 00007f00d2215fa0 R15: 00007f00d233fa48 [ 1537.886837][T25569] [ 1538.245070][T25574] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1538.271937][T25570] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1538.461512][T25574] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1538.777995][T17752] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 1538.940502][T17752] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 1538.959323][T17752] usb 4-1: config 0 has no interface number 0 [ 1539.100813][T17752] usb 4-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 1539.164773][T17752] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1539.231184][T17752] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 1539.242640][ T10] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1539.298397][T17752] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1539.331919][T17752] usb 4-1: Product: syz [ 1539.336767][T17752] usb 4-1: Manufacturer: syz [ 1539.416938][ T10] usb 5-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 1539.458638][T25589] macvtap0: refused to change device tx_queue_len [ 1539.473089][T25589] A link change request failed with some changes committed already. Interface macvtap0 may have been left with an inconsistent configuration, please check. [ 1539.487828][ T10] usb 5-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 1539.520204][T17752] usb 4-1: SerialNumber: syz [ 1539.529754][T17752] usb 4-1: config 0 descriptor?? [ 1539.537585][T25576] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 1539.556506][ T10] usb 5-1: config 1 interface 0 has no altsetting 0 [ 1539.568047][T17752] cyberjack 4-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 1539.585942][ T10] usb 5-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 1539.611682][T17752] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1539.623280][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1539.639706][ T10] usb 5-1: Product: syz [ 1539.655189][ T10] usb 5-1: Manufacturer: syz [ 1539.672119][ T10] usb 5-1: SerialNumber: syz [ 1539.716393][T25582] raw-gadget.5 gadget.4: fail, usb_ep_enable returned -22 [ 1539.765468][T25582] raw-gadget.5 gadget.4: fail, usb_ep_enable returned -22 [ 1539.780257][ C0] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 1539.982541][T25576] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1540.034901][T25576] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1540.076082][T25582] input: syz0 as /devices/virtual/input/input103 [ 1540.140533][ T5936] usb 4-1: USB disconnect, device number 53 [ 1540.158274][ T5936] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1540.159078][ T5936] cyberjack 4-1:0.69: device disconnected [ 1540.564124][ T10] rtl8150 5-1:1.0: couldn't reset the device [ 1540.578494][ T10] rtl8150 5-1:1.0: probe with driver rtl8150 failed with error -5 [ 1540.730382][ T10] usb 5-1: USB disconnect, device number 26 [ 1541.339020][T25611] netlink: 28 bytes leftover after parsing attributes in process `syz.5.4896'. [ 1541.598832][T25615] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4896'. [ 1542.551056][T25636] netlink: 'syz.5.4903': attribute type 29 has an invalid length. [ 1542.638327][ T10] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1542.672114][T25639] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4904'. [ 1542.808754][T12234] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1542.822529][ T10] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1542.837380][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 97, changing to 10 [ 1542.890215][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 24929, setting to 1024 [ 1542.948211][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1542.970210][T12234] usb 4-1: Using ep0 maxpacket: 16 [ 1542.992558][T18395] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 1543.036363][ T10] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1543.061487][T25648] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1543.086086][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1543.131250][ T10] usb 2-1: config 0 descriptor?? [ 1543.156538][T12234] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1543.178609][T18395] usb 6-1: Using ep0 maxpacket: 16 [ 1543.200984][T18395] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1543.237944][T18395] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1543.321043][T12234] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1543.328113][T18395] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1543.414571][T18395] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1543.431351][T18395] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1543.497946][T25652] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4907'. [ 1543.552812][T12234] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1543.671110][T12234] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1543.733071][T18395] usb 6-1: config 0 descriptor?? [ 1543.745768][T12234] usb 4-1: Product: syz [ 1543.798903][T12234] usb 4-1: Manufacturer: syz [ 1543.826229][T12234] usb 4-1: SerialNumber: syz [ 1544.385011][T18395] hid_parser_main: 133 callbacks suppressed [ 1544.385034][T18395] microsoft 0003:045E:07DA.004C: unknown main item tag 0x0 [ 1544.504819][T18395] microsoft 0003:045E:07DA.004C: unknown main item tag 0x0 [ 1544.523814][T17752] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1544.621213][T18395] microsoft 0003:045E:07DA.004C: unknown main item tag 0x0 [ 1544.686197][T25658] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1544.719174][T18395] microsoft 0003:045E:07DA.004C: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 1544.773656][T25658] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1544.799354][T18395] microsoft 0003:045E:07DA.004C: no inputs found [ 1544.821753][T17752] usb 5-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55 [ 1544.847890][T18395] microsoft 0003:045E:07DA.004C: could not initialize ff, continuing anyway [ 1544.867727][T17752] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1544.910433][T17752] usb 5-1: Product: syz [ 1544.975877][T17752] usb 5-1: Manufacturer: syz [ 1544.992232][T18395] usb 6-1: USB disconnect, device number 51 [ 1545.024917][T17752] usb 5-1: SerialNumber: syz [ 1545.129932][T17752] usb 5-1: config 0 descriptor?? [ 1545.322799][T12234] usb 4-1: 0:2 : does not exist [ 1545.347105][T12234] usb 4-1: 5:0: failed to get current value for ch 0 (-22) [ 1545.390510][T17752] gspca_main: sonixb-2.14.0 probing 0c45:6005 [ 1545.500642][T25659] fido_id[25659]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 1545.741683][T25665] netlink: 60 bytes leftover after parsing attributes in process `syz.5.4910'. [ 1545.833374][T17752] input: sonixb as /devices/platform/dummy_hcd.4/usb5/5-1/input/input104 [ 1545.916765][T12234] usb 4-1: USB disconnect, device number 54 [ 1546.231875][T25656] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1546.374012][T25656] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1546.452645][T22502] usb 5-1: USB disconnect, device number 27 [ 1546.826569][T25420] udevd[25420]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1547.629055][T25674] netlink: 'syz.5.4911': attribute type 10 has an invalid length. [ 1547.745330][T25673] binder: 25672:25673 ioctl 8004af81 200000000300 returned -22 [ 1548.206542][ T10] usbhid 2-1:0.0: can't add hid device: -71 [ 1548.250653][ T10] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1548.307912][ T10] usb 2-1: USB disconnect, device number 30 [ 1549.034217][T25694] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (200000 ns). Using initial count to start timer. [ 1550.367735][T22502] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 1550.548736][T22502] usb 6-1: Using ep0 maxpacket: 32 [ 1550.562235][T25712] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1550.590747][T25712] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1550.608008][T17752] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1550.627417][T22502] usb 6-1: config 0 has an invalid interface number: 37 but max is 0 [ 1550.639106][T22502] usb 6-1: config 0 has no interface number 0 [ 1550.691844][T22502] usb 6-1: config 0 interface 37 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1550.706975][T22502] usb 6-1: config 0 interface 37 has no altsetting 0 [ 1550.727176][T22502] usb 6-1: New USB device found, idVendor=07b8, idProduct=401a, bcdDevice=10.8f [ 1550.744770][T22502] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1550.765401][T22502] usb 6-1: Product: syz [ 1550.770736][T22502] usb 6-1: Manufacturer: syz [ 1550.786288][T22502] usb 6-1: SerialNumber: syz [ 1550.822131][T22502] usb 6-1: config 0 descriptor?? [ 1550.828269][T17752] usb 2-1: Using ep0 maxpacket: 8 [ 1550.840484][T17752] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1550.855867][T22502] rtl8150 6-1:0.37: couldn't find required endpoints [ 1550.865162][T22502] rtl8150 6-1:0.37: probe with driver rtl8150 failed with error -5 [ 1550.875967][T17752] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1550.918000][T17752] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1550.937927][T17752] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1550.964619][T17752] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1550.976740][T17752] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1551.237988][T17752] usb 2-1: GET_CAPABILITIES returned 0 [ 1551.238054][T17752] usbtmc 2-1:16.0: can't read capabilities [ 1551.258304][T25705] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1551.259210][T25705] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1551.280924][T25704] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1551.281219][T25704] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1551.281845][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 1551.281863][ T30] audit: type=1326 audit(1769631307.412:2057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25715 comm="syz.3.4923" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff9f779aeb9 code=0x0 [ 1551.313218][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1551.313288][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1552.208513][ T5936] usb 4-1: new full-speed USB device number 55 using dummy_hcd [ 1552.353031][T21259] usb 6-1: USB disconnect, device number 52 [ 1552.385703][ T5936] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1552.406035][ T5936] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1552.423832][ T5936] usb 4-1: Product: syz [ 1552.431208][ T5936] usb 4-1: Manufacturer: syz [ 1552.442083][ T5936] usb 4-1: SerialNumber: syz [ 1552.462569][ T5936] usb 4-1: config 0 descriptor?? [ 1552.678968][ T5936] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1552.732923][ T5936] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1552.791432][ T5936] usb 4-1: USB disconnect, device number 55 [ 1552.886535][T25734] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4927'. [ 1553.290514][T25745] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1553.358549][ T5936] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 1553.470451][T25749] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1553.969969][T25749] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1554.008282][ T5936] usb 4-1: Using ep0 maxpacket: 32 [ 1554.077233][ T5936] usb 4-1: config 0 has an invalid interface number: 67 but max is 0 [ 1554.090310][ T5936] usb 4-1: config 0 has no interface number 0 [ 1554.104972][ T5936] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1554.121577][ T5936] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1554.142030][ T5936] usb 4-1: Product: syz [ 1554.162459][ T5936] usb 4-1: Manufacturer: syz [ 1554.171626][T25751] FAULT_INJECTION: forcing a failure. [ 1554.171626][T25751] name failslab, interval 1, probability 0, space 0, times 0 [ 1554.207187][ T5936] usb 4-1: SerialNumber: syz [ 1554.216489][ T5936] usb 4-1: config 0 descriptor?? [ 1554.247112][T17752] usb 2-1: USB disconnect, device number 31 [ 1554.402549][T25751] CPU: 0 UID: 0 PID: 25751 Comm: syz.4.4933 Tainted: G L syzkaller #0 PREEMPT(full) [ 1554.403031][T25751] Tainted: [L]=SOFTLOCKUP [ 1554.403039][T25751] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1554.403052][T25751] Call Trace: [ 1554.403067][T25751] [ 1554.403078][T25751] dump_stack_lvl+0xe8/0x150 [ 1554.403114][T25751] should_fail_ex+0x412/0x560 [ 1554.403146][T25751] should_failslab+0xa8/0x100 [ 1554.403173][T25751] kmem_cache_alloc_noprof+0x87/0x6e0 [ 1554.403203][T25751] ? __netlink_lookup+0xc6/0x8b0 [ 1554.403227][T25751] ? skb_clone+0x212/0x3a0 [ 1554.403262][T25751] skb_clone+0x212/0x3a0 [ 1554.403297][T25751] __netlink_deliver_tap+0x404/0x850 [ 1554.403334][T25751] ? netlink_deliver_tap+0x2e/0x1b0 [ 1554.403359][T25751] netlink_deliver_tap+0x19c/0x1b0 [ 1554.403383][T25751] netlink_unicast+0x7e3/0x9b0 [ 1554.403472][T25751] ? __pfx_netlink_unicast+0x10/0x10 [ 1554.403502][T25751] ? __alloc_skb+0x193/0x390 [ 1554.403526][T25751] ? netlink_sendmsg+0x650/0xb40 [ 1554.403545][T25751] ? skb_put+0x11b/0x210 [ 1554.403574][T25751] netlink_sendmsg+0x813/0xb40 [ 1554.403609][T25751] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1554.403636][T25751] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1554.404029][T25751] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1554.404061][T25751] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1554.404084][T25751] ____sys_sendmsg+0xa68/0xad0 [ 1554.404116][T25751] ? __might_fault+0xaf/0x130 [ 1554.404157][T25751] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1554.404196][T25751] ? import_iovec+0x73/0xa0 [ 1554.404240][T25751] ___sys_sendmsg+0x2a5/0x360 [ 1554.404268][T25751] ? __lock_acquire+0x6b5/0x2cf0 [ 1554.404306][T25751] ? __pfx____sys_sendmsg+0x10/0x10 [ 1554.404375][T25751] ? __fget_files+0x2a/0x420 [ 1554.404408][T25751] ? __fget_files+0x3a0/0x420 [ 1554.404439][T25751] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1554.404470][T25751] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1554.404509][T25751] ? __pfx_ksys_write+0x10/0x10 [ 1554.404556][T25751] do_syscall_64+0xe2/0xf80 [ 1554.404582][T25751] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1554.404603][T25751] ? trace_irq_disable+0x37/0x100 [ 1554.404625][T25751] ? clear_bhb_loop+0x60/0xb0 [ 1554.405403][T25751] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1554.405452][T25751] RIP: 0033:0x7f126719aeb9 [ 1554.405476][T25751] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1554.405494][T25751] RSP: 002b:00007f1267fce028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1554.405517][T25751] RAX: ffffffffffffffda RBX: 00007f1267415fa0 RCX: 00007f126719aeb9 [ 1554.405532][T25751] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1554.405546][T25751] RBP: 00007f1267fce090 R08: 0000000000000000 R09: 0000000000000000 [ 1554.405559][T25751] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1554.405573][T25751] R13: 00007f1267416038 R14: 00007f1267415fa0 R15: 00007f126753fa48 [ 1554.405607][T25751] [ 1554.759843][T25751] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4933'. [ 1554.956549][ T5936] smsc95xx v2.0.0 [ 1554.998966][T25754] loop5: detected capacity change from 0 to 7 [ 1555.008806][T25754] Dev loop5: unable to read RDB block 7 [ 1555.015498][T25754] loop5: unable to read partition table [ 1555.043479][T25754] loop5: partition table beyond EOD, truncated [ 1555.069768][T25754] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1555.294825][T25760] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4935'. [ 1555.366833][ T5936] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1555.382878][T25762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1555.411924][ T5936] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1555.419372][T25762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1555.938258][T17752] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1556.097910][T17752] usb 5-1: Using ep0 maxpacket: 32 [ 1556.114285][T17752] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 1556.138708][T17752] usb 5-1: config 0 has no interface number 0 [ 1556.165099][T17752] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1556.197043][T17752] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1556.208436][T17752] usb 5-1: Product: syz [ 1556.223218][T17752] usb 5-1: Manufacturer: syz [ 1556.235930][T17752] usb 5-1: SerialNumber: syz [ 1556.269343][T17752] usb 5-1: config 0 descriptor?? [ 1556.288227][T17752] smsc95xx v2.0.0 [ 1556.388601][T25785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1556.413973][T25785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1556.498591][T12234] usb 6-1: new full-speed USB device number 53 using dummy_hcd [ 1556.688750][T12234] usb 6-1: device descriptor read/64, error -71 [ 1556.938763][T12234] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 1557.096499][T17752] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 1557.118479][T12234] usb 6-1: device descriptor read/64, error -71 [ 1557.138531][ T5936] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000038: -32 [ 1557.138910][ T5936] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -32 [ 1557.280477][T12234] usb usb6-port1: attempt power cycle [ 1557.297032][T25768] netlink: 'syz.4.4939': attribute type 10 has an invalid length. [ 1557.299404][T25775] netlink: 104 bytes leftover after parsing attributes in process `syz.1.4941'. [ 1557.371198][T25768] team0: Port device dummy0 added [ 1557.423228][T25790] x_tables: duplicate underflow at hook 2 [ 1557.424085][T25790] netlink: 'syz.4.4939': attribute type 10 has an invalid length. [ 1557.592333][T25790] team0: Port device dummy0 removed [ 1557.637600][T12234] usb 6-1: new full-speed USB device number 55 using dummy_hcd [ 1557.646171][T25790] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1557.662143][T12234] usb 6-1: device descriptor read/8, error -71 [ 1557.895540][T25795] FAULT_INJECTION: forcing a failure. [ 1557.895540][T25795] name failslab, interval 1, probability 0, space 0, times 0 [ 1557.895662][T25795] CPU: 0 UID: 0 PID: 25795 Comm: syz.1.4945 Tainted: G L syzkaller #0 PREEMPT(full) [ 1557.895692][T25795] Tainted: [L]=SOFTLOCKUP [ 1557.895701][T25795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1557.895715][T25795] Call Trace: [ 1557.895723][T25795] [ 1557.895732][T25795] dump_stack_lvl+0xe8/0x150 [ 1557.895768][T25795] should_fail_ex+0x412/0x560 [ 1557.895804][T25795] should_failslab+0xa8/0x100 [ 1557.895831][T25795] __kmalloc_cache_noprof+0x83/0x6e0 [ 1557.895852][T25795] ? nft_pernet+0x23/0x240 [ 1557.895878][T25795] ? nft_pernet+0x23/0x240 [ 1557.895903][T25795] ? nf_tables_newtable+0x435/0x1910 [ 1557.895936][T25795] nf_tables_newtable+0x435/0x1910 [ 1557.895961][T25795] ? __pfx_nfnl_pernet+0x2/0x10 [ 1557.896022][T25795] nfnetlink_rcv+0x1240/0x27b0 [ 1557.896352][T25795] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1557.896431][T25795] ? ref_tracker_free+0x693/0x840 [ 1557.896485][T25795] ? __netlink_deliver_tap+0x807/0x850 [ 1557.896509][T25795] ? netlink_deliver_tap+0x2e/0x1b0 [ 1557.896547][T25795] netlink_unicast+0x80f/0x9b0 [ 1557.896586][T25795] ? __pfx_netlink_unicast+0x10/0x10 [ 1557.896617][T25795] ? __alloc_skb+0x193/0x390 [ 1557.896644][T25795] ? netlink_sendmsg+0x650/0xb40 [ 1557.896665][T25795] ? skb_put+0x11b/0x210 [ 1557.896696][T25795] netlink_sendmsg+0x813/0xb40 [ 1557.896727][T25795] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1557.896753][T25795] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1557.896784][T25795] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1557.896811][T25795] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1557.896832][T25795] ____sys_sendmsg+0xa68/0xad0 [ 1557.896862][T25795] ? __might_fault+0xaf/0x130 [ 1557.896904][T25795] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1557.896941][T25795] ? import_iovec+0x73/0xa0 [ 1557.896978][T25795] ___sys_sendmsg+0x2a5/0x360 [ 1557.897006][T25795] ? __lock_acquire+0x6b5/0x2cf0 [ 1557.897042][T25795] ? __pfx____sys_sendmsg+0x10/0x10 [ 1557.897156][T25795] ? __fget_files+0x2a/0x420 [ 1557.897180][T25795] ? __fget_files+0x3a0/0x420 [ 1557.897215][T25795] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1557.897248][T25795] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1557.897285][T25795] ? __pfx_ksys_write+0x10/0x10 [ 1557.897331][T25795] do_syscall_64+0xe2/0xf80 [ 1557.897357][T25795] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1557.897378][T25795] ? trace_irq_disable+0x37/0x100 [ 1557.897399][T25795] ? clear_bhb_loop+0x60/0xb0 [ 1557.897426][T25795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1557.897448][T25795] RIP: 0033:0x7f00d1f9aeb9 [ 1557.897470][T25795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1557.897487][T25795] RSP: 002b:00007f00d2ee3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1557.897510][T25795] RAX: ffffffffffffffda RBX: 00007f00d2215fa0 RCX: 00007f00d1f9aeb9 [ 1557.897525][T25795] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1557.897537][T25795] RBP: 00007f00d2ee3090 R08: 0000000000000000 R09: 0000000000000000 [ 1557.897550][T25795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1557.897562][T25795] R13: 00007f00d2216038 R14: 00007f00d2215fa0 R15: 00007f00d233fa48 [ 1557.897594][T25795] [ 1557.898691][T12234] usb 6-1: new full-speed USB device number 56 using dummy_hcd [ 1557.934958][T12234] usb 6-1: device descriptor read/8, error -71 [ 1558.044700][T12234] usb usb6-port1: unable to enumerate USB device [ 1558.973434][T17752] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1558.983741][T17752] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 1559.078176][T17752] usb 5-1: USB disconnect, device number 28 [ 1559.442136][T12234] usb 4-1: USB disconnect, device number 56 [ 1559.627802][T17752] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1559.669771][T25808] netlink: 'syz.3.4949': attribute type 2 has an invalid length. [ 1559.764612][T25811] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1559.806519][T25811] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1559.843833][T17752] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 193, using maximum allowed: 30 [ 1559.882585][T17752] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 193 [ 1559.935964][T17752] usb 5-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 1559.957745][T17752] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.305131][T17752] usb 5-1: config 0 descriptor?? [ 1560.643707][T25818] loop5: detected capacity change from 0 to 7 [ 1560.659428][T25818] Dev loop5: unable to read RDB block 7 [ 1560.667158][T25818] loop5: unable to read partition table [ 1560.708766][T25818] loop5: partition table beyond EOD, truncated [ 1560.725311][T25818] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1560.768838][T17752] magicmouse 0003:05AC:0269.004D: hidraw0: USB HID v11.da Device [HID 05ac:0269] on usb-dummy_hcd.4-1/input0 [ 1560.950942][ T5936] usb 5-1: USB disconnect, device number 29 [ 1561.288442][ T5936] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 1561.462251][ T5936] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1561.478111][ T5936] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1561.540722][ T5936] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d50, bcdDevice= 0.00 [ 1561.568275][ T5936] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1561.587292][T25831] kAFS: unable to lookup cell '' [ 1561.610496][ T5936] usb 5-1: config 0 descriptor?? [ 1561.790348][T25833] kAFS: unable to lookup cell '(,c' [ 1561.923186][T25837] FAULT_INJECTION: forcing a failure. [ 1561.923186][T25837] name failslab, interval 1, probability 0, space 0, times 0 [ 1561.949860][T25837] CPU: 0 UID: 0 PID: 25837 Comm: syz.1.4956 Tainted: G L syzkaller #0 PREEMPT(full) [ 1561.949894][T25837] Tainted: [L]=SOFTLOCKUP [ 1561.949902][T25837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1561.949915][T25837] Call Trace: [ 1561.949925][T25837] [ 1561.949935][T25837] dump_stack_lvl+0xe8/0x150 [ 1561.949969][T25837] should_fail_ex+0x412/0x560 [ 1561.950003][T25837] should_failslab+0xa8/0x100 [ 1561.950029][T25837] __kmalloc_cache_noprof+0x83/0x6e0 [ 1561.950050][T25837] ? nft_pernet+0x23/0x240 [ 1561.950073][T25837] ? nft_pernet+0x23/0x240 [ 1561.950098][T25837] ? nf_tables_newtable+0x435/0x1910 [ 1561.950123][T25837] nf_tables_newtable+0x435/0x1910 [ 1561.950144][T25837] ? __pfx_nfnl_pernet+0x2/0x10 [ 1561.950184][T25837] nfnetlink_rcv+0x1240/0x27b0 [ 1561.950243][T25837] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1561.950287][T25837] ? ref_tracker_free+0x693/0x840 [ 1561.950333][T25837] ? __netlink_deliver_tap+0x807/0x850 [ 1561.950353][T25837] ? netlink_deliver_tap+0x2e/0x1b0 [ 1561.950388][T25837] netlink_unicast+0x80f/0x9b0 [ 1561.950421][T25837] ? __pfx_netlink_unicast+0x10/0x10 [ 1561.950445][T25837] ? __alloc_skb+0x193/0x390 [ 1561.950467][T25837] ? netlink_sendmsg+0x650/0xb40 [ 1561.950483][T25837] ? skb_put+0x11b/0x210 [ 1561.950512][T25837] netlink_sendmsg+0x813/0xb40 [ 1561.950537][T25837] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1561.950558][T25837] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1561.950590][T25837] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1561.950612][T25837] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1561.950629][T25837] ____sys_sendmsg+0xa68/0xad0 [ 1561.950658][T25837] ? __might_fault+0xaf/0x130 [ 1561.950690][T25837] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1561.950719][T25837] ? import_iovec+0x73/0xa0 [ 1561.950749][T25837] ___sys_sendmsg+0x2a5/0x360 [ 1561.950773][T25837] ? __lock_acquire+0x6b5/0x2cf0 [ 1561.950804][T25837] ? __pfx____sys_sendmsg+0x10/0x10 [ 1561.950857][T25837] ? __fget_files+0x2a/0x420 [ 1561.950876][T25837] ? __fget_files+0x3a0/0x420 [ 1561.950903][T25837] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1561.950934][T25837] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1561.950965][T25837] ? __pfx_ksys_write+0x10/0x10 [ 1561.951014][T25837] do_syscall_64+0xe2/0xf80 [ 1561.951034][T25837] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1561.951052][T25837] ? trace_irq_disable+0x37/0x100 [ 1561.951075][T25837] ? clear_bhb_loop+0x60/0xb0 [ 1561.951097][T25837] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1561.951114][T25837] RIP: 0033:0x7f00d1f9aeb9 [ 1561.951131][T25837] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1561.951147][T25837] RSP: 002b:00007f00d2ee3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1561.951167][T25837] RAX: ffffffffffffffda RBX: 00007f00d2215fa0 RCX: 00007f00d1f9aeb9 [ 1561.951180][T25837] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1561.951191][T25837] RBP: 00007f00d2ee3090 R08: 0000000000000000 R09: 0000000000000000 [ 1561.951204][T25837] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1561.951218][T25837] R13: 00007f00d2216038 R14: 00007f00d2215fa0 R15: 00007f00d233fa48 [ 1561.951246][T25837] [ 1562.412588][ T5936] kovaplus 0003:1E7D:2D50.004E: hidraw0: USB HID v0.00 Device [HID 1e7d:2d50] on usb-dummy_hcd.4-1/input0 [ 1562.849799][ T5936] kovaplus 0003:1E7D:2D50.004E: couldn't init struct kovaplus_device [ 1562.881093][ T5936] kovaplus 0003:1E7D:2D50.004E: couldn't install mouse [ 1562.949825][ T5936] kovaplus 0003:1E7D:2D50.004E: probe with driver kovaplus failed with error -71 [ 1562.995298][ T5936] usb 5-1: USB disconnect, device number 30 [ 1563.102357][T25841] fido_id[25841]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1563.260103][ T30] audit: type=1326 audit(1769631319.412:2058): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25854 comm="syz.2.4962" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f293e79aeb9 code=0x0 [ 1563.288618][T21259] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 1563.449156][T21259] usb 6-1: Using ep0 maxpacket: 16 [ 1563.460675][T21259] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1563.492011][T21259] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1563.515574][T21259] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1563.549353][T21259] usb 6-1: config 0 descriptor?? [ 1563.767942][T25868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1563.805325][T25868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1563.871075][T21259] mcp2221 0003:04D8:00DD.004F: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 1564.051801][T21259] usb 6-1: USB disconnect, device number 57 [ 1564.530255][T21259] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 1564.734197][T21259] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1564.806050][T21259] usb 6-1: config 3 has an invalid interface number: 8 but max is 3 [ 1564.842365][T21259] usb 6-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 1564.950201][T21259] usb 6-1: config 3 has 1 interface, different from the descriptor's value: 4 [ 1564.982065][T21259] usb 6-1: config 3 has no interface number 0 [ 1565.038337][T21259] usb 6-1: config 3 interface 8 altsetting 6 endpoint 0x82 has an invalid bInterval 248, changing to 11 [ 1565.118320][T21259] usb 6-1: config 3 interface 8 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1565.161492][T21259] usb 6-1: config 3 interface 8 has no altsetting 0 [ 1565.230613][T21259] usb 6-1: New USB device found, idVendor=05ac, idProduct=921d, bcdDevice=c2.be [ 1565.257818][T21259] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1565.452760][T21259] usb 6-1: Product: syz [ 1565.510646][T21259] usb 6-1: Manufacturer: syz [ 1565.531151][T21259] usb 6-1: SerialNumber: syz [ 1565.696939][T25893] FAULT_INJECTION: forcing a failure. [ 1565.696939][T25893] name failslab, interval 1, probability 0, space 0, times 0 [ 1565.718084][T25893] CPU: 0 UID: 0 PID: 25893 Comm: syz.1.4973 Tainted: G L syzkaller #0 PREEMPT(full) [ 1565.718125][T25893] Tainted: [L]=SOFTLOCKUP [ 1565.718134][T25893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1565.718148][T25893] Call Trace: [ 1565.718160][T25893] [ 1565.718171][T25893] dump_stack_lvl+0xe8/0x150 [ 1565.718207][T25893] should_fail_ex+0x412/0x560 [ 1565.718254][T25893] should_failslab+0xa8/0x100 [ 1565.718283][T25893] __kmalloc_noprof+0xde/0x7e0 [ 1565.718305][T25893] ? tomoyo_encode+0x28b/0x550 [ 1565.718340][T25893] tomoyo_encode+0x28b/0x550 [ 1565.718376][T25893] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1565.718432][T25893] tomoyo_path_perm+0x283/0x560 [ 1565.718456][T25893] ? tomoyo_path_perm+0x251/0x560 [ 1565.718478][T25893] ? __pfx_tomoyo_path_perm+0x10/0x10 [ 1565.718513][T25893] ? filemap_check_errors+0xd2/0x120 [ 1565.718601][T25893] ? bdev_mark_dead+0x9f/0x170 [ 1565.718636][T25893] security_inode_getattr+0x12b/0x310 [ 1565.718671][T25893] vfs_getattr+0x23/0x70 [ 1565.718699][T25893] loop_assign_backing_file+0x27a/0x4b0 [ 1565.718723][T25893] ? __pfx_loop_assign_backing_file+0x10/0x10 [ 1565.718742][T25893] ? bd_prepare_to_claim+0x40f/0x4a0 [ 1565.718803][T25893] ? __asan_memcpy+0x40/0x70 [ 1565.718915][T25893] ? loop_set_status_from_info+0x185/0x250 [ 1565.718947][T25893] loop_configure+0x838/0xdf0 [ 1565.718976][T25893] ? __pfx_loop_configure+0x10/0x10 [ 1565.719093][T25893] lo_ioctl+0xad4/0x2010 [ 1565.719126][T25893] ? __lock_acquire+0x6b5/0x2cf0 [ 1565.719150][T25893] ? __pfx_lo_ioctl+0x10/0x10 [ 1565.719167][T25893] ? ima_match_policy+0x112/0x21e0 [ 1565.719186][T25893] ? ima_match_policy+0x2146/0x21e0 [ 1565.719224][T25893] ? __lock_acquire+0x6b5/0x2cf0 [ 1565.719262][T25893] ? __lock_acquire+0x6b5/0x2cf0 [ 1565.719294][T25893] ? __lock_acquire+0x6b5/0x2cf0 [ 1565.719318][T25893] ? __lock_acquire+0x6b5/0x2cf0 [ 1565.719343][T25893] ? __lock_acquire+0x6b5/0x2cf0 [ 1565.719422][T25893] ? __lock_acquire+0x6b5/0x2cf0 [ 1565.719462][T25893] ? unwind_next_frame+0xa5/0x23c0 [ 1565.719486][T25893] ? unwind_next_frame+0xa5/0x23c0 [ 1565.719504][T25893] ? is_bpf_text_address+0x26/0x2b0 [ 1565.719547][T25893] ? is_bpf_text_address+0x26/0x2b0 [ 1565.719577][T25893] ? is_bpf_text_address+0x292/0x2b0 [ 1565.719600][T25893] ? is_bpf_text_address+0x26/0x2b0 [ 1565.719628][T25893] ? kernel_text_address+0xa5/0xe0 [ 1565.719655][T25893] ? __kernel_text_address+0xd/0x30 [ 1565.719819][T25893] ? unwind_get_return_address+0x4d/0x90 [ 1565.720055][T25893] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1565.720090][T25893] ? arch_stack_walk+0xfb/0x150 [ 1565.720126][T25893] ? stack_trace_save+0xa9/0x100 [ 1565.720158][T25893] ? __pfx_stack_trace_save+0x10/0x10 [ 1565.720179][T25893] ? stack_depot_save_flags+0x33/0x810 [ 1565.720228][T25893] ? kasan_save_track+0x4f/0x80 [ 1565.720248][T25893] ? kasan_save_track+0x3e/0x80 [ 1565.720265][T25893] ? kasan_save_free_info+0x46/0x50 [ 1565.720290][T25893] ? __kasan_slab_free+0x5c/0x80 [ 1565.720312][T25893] ? kfree+0x1be/0x650 [ 1565.720333][T25893] ? tomoyo_path_number_perm+0x501/0x630 [ 1565.720350][T25893] ? security_file_ioctl+0xc3/0x2a0 [ 1565.720460][T25893] ? __se_sys_ioctl+0x47/0x170 [ 1565.720482][T25893] ? do_syscall_64+0xe2/0xf80 [ 1565.720498][T25893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1565.720536][T25893] ? __asan_memset+0x22/0x50 [ 1565.720566][T25893] ? blk_get_meta_cap+0x16d/0x7a0 [ 1565.720596][T25893] ? __pfx_blk_get_meta_cap+0x10/0x10 [ 1565.720631][T25893] ? blkdev_common_ioctl+0x14b7/0x3250 [ 1565.720661][T25893] ? __pfx_blkdev_common_ioctl+0x10/0x10 [ 1565.720701][T25893] ? kasan_quarantine_put+0xbb/0x1f0 [ 1565.720743][T25893] ? tomoyo_path_number_perm+0x219/0x630 [ 1565.720767][T25893] ? tomoyo_path_number_perm+0x219/0x630 [ 1565.720795][T25893] ? do_vfs_ioctl+0x1166/0x1530 [ 1565.720873][T25893] ? __pfx_lo_ioctl+0x10/0x10 [ 1565.720902][T25893] blkdev_ioctl+0x5e3/0x740 [ 1565.720935][T25893] ? __pfx_blkdev_ioctl+0x10/0x10 [ 1565.720955][T25893] ? __fget_files+0x2a/0x420 [ 1565.720976][T25893] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1565.721012][T25893] ? __pfx_blkdev_ioctl+0x10/0x10 [ 1565.721038][T25893] __se_sys_ioctl+0xfc/0x170 [ 1565.721071][T25893] do_syscall_64+0xe2/0xf80 [ 1565.721099][T25893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1565.721115][T25893] ? trace_irq_disable+0x37/0x100 [ 1565.721131][T25893] ? clear_bhb_loop+0x60/0xb0 [ 1565.721150][T25893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1565.721185][T25893] RIP: 0033:0x7f00d1f9aeb9 [ 1565.721210][T25893] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1565.721228][T25893] RSP: 002b:00007f00d2ee3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1565.721258][T25893] RAX: ffffffffffffffda RBX: 00007f00d2215fa0 RCX: 00007f00d1f9aeb9 [ 1565.721271][T25893] RDX: 00002000000002c0 RSI: 0000000000004c0a RDI: 0000000000000004 [ 1565.721281][T25893] RBP: 00007f00d2ee3090 R08: 0000000000000000 R09: 0000000000000000 [ 1565.721291][T25893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1565.721300][T25893] R13: 00007f00d2216038 R14: 00007f00d2215fa0 R15: 00007f00d233fa48 [ 1565.721346][T25893] [ 1565.721753][T25893] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1566.540197][T25893] loop5: detected capacity change from 0 to 7 [ 1566.561050][T25893] Dev loop5: unable to read RDB block 7 [ 1566.614339][T21259] appledisplay 6-1:3.8: Error while getting initial brightness: -71 [ 1566.636247][T25893] loop5: unable to read partition table [ 1566.673078][T21259] appledisplay 6-1:3.8: probe with driver appledisplay failed with error -71 [ 1566.694910][T25893] loop5: partition table beyond EOD, truncated [ 1566.715026][T21259] usbhid 6-1:3.8: fixing wrong optional hid class descriptors count [ 1566.732596][T21259] usbhid 6-1:3.8: can't add hid device: -22 [ 1566.748183][T25893] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1566.778615][T21259] usbhid 6-1:3.8: probe with driver usbhid failed with error -22 [ 1566.848113][T21259] usb 6-1: USB disconnect, device number 58 [ 1567.233645][T25910] loop5: detected capacity change from 0 to 7 [ 1567.295634][T25289] Dev loop5: unable to read RDB block 7 [ 1567.305584][T25289] loop5: unable to read partition table [ 1567.366040][T25289] loop5: partition table beyond EOD, truncated [ 1567.395442][T25910] Dev loop5: unable to read RDB block 7 [ 1567.409207][T25910] loop5: unable to read partition table [ 1567.448085][T25910] loop5: partition table beyond EOD, truncated [ 1567.466885][T25910] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1567.618060][T18395] usb 5-1: new full-speed USB device number 31 using dummy_hcd [ 1567.830057][T18395] usb 5-1: config 0 has an invalid interface number: 110 but max is 0 [ 1567.879859][ T30] audit: type=1326 audit(1769631324.002:2059): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1567.898003][T18395] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1567.936499][T25922] netlink: 'syz.1.4982': attribute type 4 has an invalid length. [ 1568.008550][T25924] netlink: 'syz.1.4982': attribute type 4 has an invalid length. [ 1568.018041][T18395] usb 5-1: config 0 has no interface number 0 [ 1568.028754][T18395] usb 5-1: config 0 interface 110 altsetting 2 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1568.040313][T18395] usb 5-1: config 0 interface 110 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1568.092866][T18395] usb 5-1: config 0 interface 110 has no altsetting 0 [ 1568.092894][ T30] audit: type=1326 audit(1769631324.012:2060): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.150736][ T30] audit: type=1326 audit(1769631324.012:2061): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.188765][ T30] audit: type=1326 audit(1769631324.012:2062): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.201179][T25925] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4983'. [ 1568.235654][ T30] audit: type=1326 audit(1769631324.012:2063): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.254636][T18395] usb 5-1: New USB device found, idVendor=0547, idProduct=2720, bcdDevice=af.55 [ 1568.334909][T18395] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1568.364397][ T30] audit: type=1326 audit(1769631324.012:2064): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.443067][T18395] usb 5-1: Product: syz [ 1568.485930][ T30] audit: type=1326 audit(1769631324.012:2065): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.556664][ T30] audit: type=1326 audit(1769631324.012:2066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.562918][T18395] usb 5-1: Manufacturer: syz [ 1568.635224][ T30] audit: type=1326 audit(1769631324.012:2067): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.732952][ T30] audit: type=1326 audit(1769631324.012:2068): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.788361][T18395] usb 5-1: SerialNumber: syz [ 1568.828335][T18395] usb 5-1: config 0 descriptor?? [ 1568.854511][ T30] audit: type=1326 audit(1769631324.012:2069): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1568.982535][ T30] audit: type=1326 audit(1769631324.012:2070): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1569.055244][T18395] cdc_subset 5-1:0.110: probe with driver cdc_subset failed with error -22 [ 1569.145104][ T30] audit: type=1326 audit(1769631324.012:2071): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1569.203722][T25934] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1569.239320][T25934] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1569.261303][ T5936] usb 5-1: USB disconnect, device number 31 [ 1569.338485][ T30] audit: type=1326 audit(1769631324.012:2072): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1569.419641][ T30] audit: type=1326 audit(1769631324.012:2073): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25919 comm="syz.1.4982" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1570.857089][T25964] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4991'. [ 1570.868745][T25964] netlink: 'syz.5.4991': attribute type 13 has an invalid length. [ 1571.082629][T25964] erspan0: refused to change device tx_queue_len [ 1571.111780][T25964] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1571.939305][T25973] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4995'. [ 1573.309127][T25989] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4998'. [ 1573.353757][T25989] netlink: 'syz.2.4998': attribute type 5 has an invalid length. [ 1573.528127][T22502] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1573.638034][T18395] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 1573.698335][T22502] usb 2-1: Using ep0 maxpacket: 16 [ 1573.725983][T22502] usb 2-1: config 0 has an invalid interface number: 63 but max is 0 [ 1573.777323][T22502] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1573.844500][T18395] usb 5-1: device descriptor read/64, error -71 [ 1574.068766][T22502] usb 2-1: config 0 has no interface number 0 [ 1574.171471][T22502] usb 2-1: config 0 interface 63 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 1574.220294][T22502] usb 2-1: config 0 interface 63 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1574.304111][T22502] usb 2-1: New USB device found, idVendor=0644, idProduct=800e, bcdDevice=41.e6 [ 1574.317149][T18395] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 1574.360954][T22502] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1574.421254][T22502] usb 2-1: config 0 descriptor?? [ 1574.481177][T18395] usb 5-1: device descriptor read/64, error -71 [ 1574.668739][T18395] usb usb5-port1: attempt power cycle [ 1574.769651][ T5936] usb 2-1: USB disconnect, device number 32 [ 1574.986471][T26001] loop5: detected capacity change from 0 to 7 [ 1575.013252][T25289] Dev loop5: unable to read RDB block 7 [ 1575.023862][T25289] loop5: unable to read partition table [ 1575.035314][T25289] loop5: partition table beyond EOD, truncated [ 1575.045905][T26001] Dev loop5: unable to read RDB block 7 [ 1575.068259][T18395] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1575.088205][T26001] loop5: unable to read partition table [ 1575.108477][T26001] loop5: partition table beyond EOD, truncated [ 1575.128048][T26001] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1575.141933][T18395] usb 5-1: device descriptor read/8, error -71 [ 1575.303137][T26004] netlink: 144 bytes leftover after parsing attributes in process `syz.3.5005'. [ 1575.408167][T18395] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 1575.458864][T18395] usb 5-1: device descriptor read/8, error -71 [ 1575.586635][T26013] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5008'. [ 1575.611282][T18395] usb usb5-port1: unable to enumerate USB device [ 1575.721742][T26016] bond4: entered allmulticast mode [ 1575.731731][T26016] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1575.933450][T26025] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5011'. [ 1575.953500][T26025] netlink: 'syz.3.5011': attribute type 7 has an invalid length. [ 1575.998381][T26025] netlink: 'syz.3.5011': attribute type 8 has an invalid length. [ 1576.015049][T26028] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5012'. [ 1576.027127][T26025] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5011'. [ 1576.111266][ T797] usb 6-1: new full-speed USB device number 59 using dummy_hcd [ 1576.140864][T26025] ip6gretap0: entered promiscuous mode [ 1576.151521][T26025] ip6gretap0: left promiscuous mode [ 1576.295029][ T797] usb 6-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1576.312560][ T797] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1576.328015][ T797] usb 6-1: Product: syz [ 1576.333023][ T797] usb 6-1: Manufacturer: syz [ 1576.339621][ T797] usb 6-1: SerialNumber: syz [ 1576.351892][T26032] Invalid logical block size (34) [ 1576.362592][T26034] loop5: detected capacity change from 0 to 7 [ 1576.374749][ T797] usb 6-1: config 0 descriptor?? [ 1576.382312][T26034] Dev loop5: unable to read RDB block 7 [ 1576.382367][T26034] loop5: unable to read partition table [ 1576.388787][T26034] loop5: partition table beyond EOD, truncated [ 1576.430707][ T797] gspca_main: sq930x-2.14.0 probing 2770:930c [ 1576.437978][T26034] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1576.822212][T26044] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 1576.838123][T26044] team0: Port device batadv2 added [ 1576.864244][ T797] gspca_sq930x: ucbus_write failed -71 [ 1577.767683][T22502] usb 2-1: new high-speed USB device number 33 using dummy_hcd [ 1577.778338][ T797] gspca_sq930x: Unknown sensor [ 1577.784441][ T797] sq930x 6-1:0.0: probe with driver sq930x failed with error -22 [ 1577.819081][ T797] usb 6-1: USB disconnect, device number 59 [ 1577.938306][T22502] usb 2-1: Using ep0 maxpacket: 16 [ 1577.969828][T22502] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1577.998501][T22502] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1578.043994][T22502] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1578.104121][T22502] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1578.142472][T22502] usb 2-1: Product: syz [ 1578.148267][T22502] usb 2-1: Manufacturer: syz [ 1578.154469][T22502] usb 2-1: SerialNumber: syz [ 1578.636783][T22502] usb 2-1: 0:2 : does not exist [ 1578.706191][T26082] x_tables: duplicate underflow at hook 2 [ 1578.721314][T26082] sctp: [Deprecated]: syz.3.5027 (pid 26082) Use of int in maxseg socket option. [ 1578.721314][T26082] Use struct sctp_assoc_value instead [ 1578.777032][T26082] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1579.078169][T22502] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 1579.116781][ T30] kauditd_printk_skb: 46 callbacks suppressed [ 1579.116802][ T30] audit: type=1326 audit(1769631335.262:2120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26085 comm="syz.5.5031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44dfb9aeb9 code=0x7ffc0000 [ 1579.155726][T22502] usb 2-1: USB disconnect, device number 33 [ 1579.266016][ T30] audit: type=1326 audit(1769631335.262:2121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26085 comm="syz.5.5031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44dfb9aeb9 code=0x7ffc0000 [ 1579.333886][T25289] udevd[25289]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1579.403065][ T30] audit: type=1326 audit(1769631335.322:2122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26085 comm="syz.5.5031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f44dfb9aeb9 code=0x7ffc0000 [ 1579.473187][ T30] audit: type=1326 audit(1769631335.322:2123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26085 comm="syz.5.5031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44dfb9aeb9 code=0x7ffc0000 [ 1579.600409][ T30] audit: type=1326 audit(1769631335.322:2124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26085 comm="syz.5.5031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44dfb9aeb9 code=0x7ffc0000 [ 1579.660952][ T30] audit: type=1326 audit(1769631335.372:2125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26085 comm="syz.5.5031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=81 compat=0 ip=0x7f44dfb9aeb9 code=0x7ffc0000 [ 1579.693475][ T30] audit: type=1326 audit(1769631335.372:2126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26085 comm="syz.5.5031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44dfb9aeb9 code=0x7ffc0000 [ 1579.756080][ T30] audit: type=1326 audit(1769631335.372:2127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26085 comm="syz.5.5031" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f44dfb9aeb9 code=0x7ffc0000 [ 1579.907613][T12234] usb 5-1: new full-speed USB device number 36 using dummy_hcd [ 1579.930497][T26099] Invalid logical block size (211) [ 1579.970632][ T5936] hid (null): unknown global tag 0xc [ 1579.990657][ T5936] hid (null): report_id 0 is invalid [ 1580.019730][ T5936] hid (null): unknown global tag 0xc [ 1580.027023][ T5936] hid (null): invalid report_count -220433898 [ 1580.055138][ T5936] hid (null): unknown global tag 0xd [ 1580.076585][T12234] usb 5-1: config 0 has an invalid interface number: 231 but max is 0 [ 1580.101130][ T5936] hid (null): report_id 32402 is invalid [ 1580.128048][T12234] usb 5-1: config 0 has no interface number 0 [ 1580.139532][ T5936] hid (null): bogus close delimiter [ 1580.146116][ T5936] hid (null): invalid report_count 22446 [ 1580.154307][T12234] usb 5-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1580.174508][ T5936] hid (null): unknown global tag 0xd [ 1580.184151][ T5936] hid (null): unknown global tag 0xe [ 1580.195107][T12234] usb 5-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 1580.208895][T12234] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1580.220043][ T5936] hid (null): unknown global tag 0xd [ 1580.226329][ T5936] hid (null): unknown global tag 0xd [ 1580.234464][T12234] usb 5-1: Product: syz [ 1580.256823][ T5936] hid (null): report_id 0 is invalid [ 1580.264888][T12234] usb 5-1: Manufacturer: syz [ 1580.278105][T12234] usb 5-1: SerialNumber: syz [ 1580.284748][ T5936] hid (null): unknown global tag 0xc [ 1580.314938][ T5936] hid (null): bogus close delimiter [ 1580.323786][T12234] usb 5-1: config 0 descriptor?? [ 1580.345288][ T5936] hid (null): unknown global tag 0xe [ 1580.355157][T26094] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1580.381410][ T5936] hid (null): unknown global tag 0x3d [ 1580.400875][ T5936] hid (null): unknown global tag 0xc [ 1580.409523][T26107] Invalid logical block size (510) [ 1580.419670][ T5936] hid (null): invalid report_count 19859 [ 1580.439840][T12234] plusb 5-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.4-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 86:9e:3a:92:af:87 [ 1580.480198][ T5936] hid (null): invalid report_size -955577027 [ 1580.489250][ T5936] hid (null): invalid report_size 323527888 [ 1580.496573][ T5936] hid (null): unknown global tag 0xc [ 1580.508857][ T5936] hid (null): unknown global tag 0xc [ 1580.517190][ T5936] hid (null): unknown global tag 0xc [ 1580.525614][ T5936] hid (null): unknown global tag 0xc [ 1580.534719][ T5936] hid (null): report_id 0 is invalid [ 1580.543336][ T5936] hid (null): bogus close delimiter [ 1580.549950][ T5936] hid (null): bogus close delimiter [ 1580.556010][ T5936] hid (null): report_id 40774 is invalid [ 1580.564051][ T5936] hid (null): unknown global tag 0xe [ 1580.588416][ T5936] hid (null): invalid report_count 27538 [ 1580.608440][ T5936] hid (null): unknown global tag 0x27 [ 1580.644531][ T5936] hid-generic 0003:0000:FFFFFF80.0050: unknown global tag 0xc [ 1580.657310][ T5936] hid-generic 0003:0000:FFFFFF80.0050: item 0 1 1 12 parsing failed [ 1580.673483][ T5936] hid-generic 0003:0000:FFFFFF80.0050: probe with driver hid-generic failed with error -22 [ 1580.701076][T22502] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 1580.894470][T22502] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 1580.908145][T22502] usb 2-1: config 0 has an invalid descriptor of length 226, skipping remainder of the config [ 1580.934902][T22502] usb 2-1: config 0 has no interface number 0 [ 1580.960063][T22502] usb 2-1: config 0 interface 50 altsetting 193 has 0 endpoint descriptors, different from the interface descriptor's value: 28 [ 1581.027246][T22502] usb 2-1: config 0 interface 50 has no altsetting 0 [ 1581.096331][T22502] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1581.115300][T22502] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1581.145930][T22502] usb 2-1: Product: syz [ 1581.158984][T22502] usb 2-1: Manufacturer: syz [ 1581.176378][T22502] usb 2-1: SerialNumber: syz [ 1581.206464][T22502] usb 2-1: config 0 descriptor?? [ 1581.708690][T26108] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1581.767157][T26108] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1582.744648][T17752] usb 5-1: USB disconnect, device number 36 [ 1582.792521][T17752] plusb 5-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.4-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 1583.126487][T26135] netlink: 'syz.4.5043': attribute type 1 has an invalid length. [ 1583.393153][T22502] yurex 2-1:0.50: Could not find endpoints [ 1583.476921][T22502] usb 2-1: USB disconnect, device number 34 [ 1584.947936][T26157] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5046'. [ 1585.430963][T26166] netlink: 'syz.4.5049': attribute type 4 has an invalid length. [ 1585.971209][T26189] netlink: 104 bytes leftover after parsing attributes in process `syz.5.5053'. [ 1586.146468][T26198] netlink: 'syz.5.5057': attribute type 4 has an invalid length. [ 1586.151799][T26193] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5054'. [ 1586.288473][T26204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5054'. [ 1586.651865][T26209] netlink: 408 bytes leftover after parsing attributes in process `syz.4.5059'. [ 1587.772436][T26228] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1587.839851][T26228] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1588.063089][T26235] overlayfs: missing 'lowerdir' [ 1588.085946][T26237] netlink: 'syz.4.5068': attribute type 4 has an invalid length. [ 1588.418113][T12234] usb 5-1: new high-speed USB device number 37 using dummy_hcd [ 1588.583340][T12234] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1588.616340][T12234] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1588.669410][T26250] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1588.684711][T26250] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1588.719624][T12234] usb 5-1: config 0 descriptor?? [ 1589.151854][T12234] ath6kl: Unsupported hardware version: 0x0 [ 1589.182658][T12234] ath6kl: Failed to init ath6kl core: -22 [ 1589.221055][T12234] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -22 [ 1589.945974][T26273] xt_cgroup: invalid path, errno=-2 [ 1590.196278][T26277] netlink: 'syz.3.5079': attribute type 4 has an invalid length. [ 1590.292693][T26279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1590.312008][T26279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1590.849127][T26298] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1590.865018][T26298] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1590.985569][T26301] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5084'. [ 1591.004592][T26301] IPv6: addrconf: prefix option has invalid lifetime [ 1591.058605][T12234] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1591.078239][ T5936] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1591.223887][T12234] usb 4-1: too many endpoints for config 4 interface 0 altsetting 0: 79, using maximum allowed: 30 [ 1591.252246][ T5936] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1591.281847][T12234] usb 4-1: config 4 interface 0 altsetting 0 has an endpoint descriptor with address 0x32, changing to 0x2 [ 1591.305508][ T5936] usb 6-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1591.349958][ T5936] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1591.361398][T12234] usb 4-1: config 4 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 91 [ 1591.408554][T12234] usb 4-1: config 4 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 79 [ 1591.425854][ T5936] usb 6-1: config 0 descriptor?? [ 1591.450386][ T5936] pwc: Askey VC010 type 2 USB webcam detected. [ 1591.473160][T12234] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1591.503238][T12234] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1591.543569][T26295] raw-gadget.5 gadget.3: fail, usb_ep_enable returned -22 [ 1591.560036][T18395] usb 5-1: USB disconnect, device number 37 [ 1591.766303][T12234] ath6kl: Failed to submit usb control message: -71 [ 1591.787045][T12234] ath6kl: unable to send the bmi data to the device: -71 [ 1591.798629][T12234] ath6kl: Unable to send get target info: -71 [ 1591.811991][T12234] ath6kl: Failed to init ath6kl core: -71 [ 1591.821789][T12234] ath6kl_usb 4-1:4.0: probe with driver ath6kl_usb failed with error -71 [ 1591.852004][T12234] usb 4-1: USB disconnect, device number 57 [ 1591.872153][ T5936] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1591.891102][ T5936] pwc: recv_control_msg error -32 req 02 val 2700 [ 1591.902513][ T5936] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1591.926608][ T5936] pwc: recv_control_msg error -32 req 04 val 1000 [ 1591.937142][ T5936] pwc: recv_control_msg error -32 req 04 val 1300 [ 1591.982344][ T5936] pwc: recv_control_msg error -71 req 04 val 1400 [ 1592.000456][ T5936] pwc: recv_control_msg error -71 req 02 val 2000 [ 1592.012244][ T5936] pwc: recv_control_msg error -71 req 02 val 2100 [ 1592.023644][ T5936] pwc: recv_control_msg error -71 req 04 val 1500 [ 1592.033283][ T5936] pwc: recv_control_msg error -71 req 02 val 2500 [ 1592.058133][ T5936] pwc: recv_control_msg error -71 req 02 val 2400 [ 1592.069141][ T5936] pwc: recv_control_msg error -71 req 02 val 2600 [ 1592.090094][ T5936] pwc: recv_control_msg error -71 req 02 val 2900 [ 1592.104482][ T5936] pwc: recv_control_msg error -71 req 02 val 2800 [ 1592.116738][ T5936] pwc: recv_control_msg error -71 req 04 val 1100 [ 1592.117152][T26319] netlink: 'syz.1.5090': attribute type 4 has an invalid length. [ 1592.132161][ T5936] pwc: recv_control_msg error -71 req 04 val 1200 [ 1592.159170][ T5936] pwc: Registered as video103. [ 1592.195037][ T5936] input: PWC snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/input/input105 [ 1592.235743][ T5936] usb 6-1: USB disconnect, device number 60 [ 1592.364089][T26324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1592.412283][T26324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1593.510039][ T797] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 1593.792532][ T797] usb 4-1: config 1 has an invalid interface number: 7 but max is 0 [ 1593.809314][ T797] usb 4-1: config 1 has no interface number 0 [ 1593.821116][ T797] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 1593.836504][ T797] usb 4-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 64 [ 1594.074808][ T797] usb 4-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1594.105268][ T797] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1594.122859][ T797] usb 4-1: Product: syz [ 1594.129303][ T797] usb 4-1: Manufacturer: syz [ 1594.142248][ T797] usb 4-1: SerialNumber: syz [ 1594.269034][T26331] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 1594.325725][T26331] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 1594.404453][ T797] usb 4-1: Error in usbnet_get_endpoints (-22) [ 1594.878089][ T797] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 1594.923930][ T30] audit: type=1326 audit(1769631351.072:2128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26343 comm="syz.4.5097" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f126719aeb9 code=0x0 [ 1595.038447][ T797] usb 6-1: Using ep0 maxpacket: 32 [ 1595.069176][ T797] usb 6-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 1595.081114][ T797] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.092760][ T797] usb 6-1: Product: syz [ 1595.123579][ T797] usb 6-1: Manufacturer: syz [ 1595.133379][ T797] usb 6-1: SerialNumber: syz [ 1595.171938][ T797] usb 6-1: config 0 descriptor?? [ 1595.186840][ T797] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 1595.211543][ T797] dvb-usb: bulk message failed: -22 (4/0) [ 1595.221895][ T797] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1595.242433][ T797] dvb-usb: bulk message failed: -22 (5/0) [ 1595.255591][ T797] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1595.293136][ T797] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1595.307117][ T797] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 1595.322980][ T797] usb 6-1: media controller created [ 1595.403460][T26342] ttusb2: i2c wr len=8192 too high [ 1595.414625][T26342] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1595.531038][T26342] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1595.553466][ T797] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1595.771515][ T797] usb 6-1: selecting invalid altsetting 3 [ 1595.779384][ T797] ttusb2: set interface to alts=3 failed [ 1595.973513][ T797] DVB: Unable to find symbol tda10086_attach() [ 1595.982070][ T797] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 1595.992625][ T797] dvb-usb: bulk message failed: -22 (4/0) [ 1595.999390][ T797] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1596.026828][ T797] dvb-usb: bulk message failed: -22 (5/0) [ 1596.036162][ T797] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 1596.048565][ T797] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 1596.131670][ T797] usb 6-1: USB disconnect, device number 61 [ 1596.145989][T26358] netlink: 39 bytes leftover after parsing attributes in process `syz.4.5101'. [ 1596.164888][T26358] netlink: 29 bytes leftover after parsing attributes in process `syz.4.5101'. [ 1596.225056][T18395] usb 4-1: USB disconnect, device number 58 [ 1596.539502][T26363] netlink: 'syz.2.5102': attribute type 4 has an invalid length. [ 1596.562965][ T797] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 1596.575786][T21269] usb 5-1: new full-speed USB device number 38 using dummy_hcd [ 1596.718667][T21269] usb 5-1: device descriptor read/64, error -71 [ 1596.937808][ T797] usb 6-1: new full-speed USB device number 62 using dummy_hcd [ 1596.961213][T21269] usb 5-1: new full-speed USB device number 39 using dummy_hcd [ 1597.098271][T21269] usb 5-1: device descriptor read/64, error -71 [ 1597.130021][ T797] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1597.141388][ T797] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 10 [ 1597.186646][ T797] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 255, setting to 64 [ 1597.208622][T21269] usb usb5-port1: attempt power cycle [ 1597.288586][ T797] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de [ 1597.328243][ T797] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1597.358137][ T797] usb 6-1: config 0 descriptor?? [ 1597.366081][T26353] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1597.388985][ T5882] kworker/0:4 (5882) used greatest stack depth: 15256 bytes left [ 1597.624598][ T797] ath6kl: Failed to submit usb control message: -71 [ 1597.658337][ T797] ath6kl: unable to send the bmi data to the device: -71 [ 1597.665888][ T797] ath6kl: Unable to send get target info: -71 [ 1597.673937][T21269] usb 5-1: new full-speed USB device number 40 using dummy_hcd [ 1597.719238][ T797] ath6kl: Failed to init ath6kl core: -71 [ 1597.766538][T21269] usb 5-1: device descriptor read/8, error -71 [ 1597.776330][ T797] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 1597.848531][ T797] usb 6-1: USB disconnect, device number 62 [ 1598.028592][T21269] usb 5-1: new full-speed USB device number 41 using dummy_hcd [ 1598.068740][T21269] usb 5-1: device descriptor read/8, error -71 [ 1598.201336][T21269] usb usb5-port1: unable to enumerate USB device [ 1600.629008][T21269] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 1600.746299][T26400] netlink: 'syz.5.5114': attribute type 4 has an invalid length. [ 1600.829113][T21269] usb 5-1: Using ep0 maxpacket: 16 [ 1600.839785][T21269] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1600.888759][T21269] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1600.946364][T21269] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1601.000498][T21269] usb 5-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1601.036836][T21269] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1601.094082][T21269] usb 5-1: config 0 descriptor?? [ 1601.573960][T26410] netlink: 104 bytes leftover after parsing attributes in process `syz.5.5116'. [ 1601.611393][T21269] input: HID 0955:7214 Haptics as /devices/virtual/input/input106 [ 1601.735813][T21269] shield 0003:0955:7214.0051: Registered Thunderstrike controller [ 1601.764293][T26396] random: crng reseeded on system resumption [ 1601.781716][T26414] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5113'. [ 1601.802910][T21269] shield 0003:0955:7214.0051: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.4-1/input0 [ 1601.821925][T26415] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1601.840276][T26415] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1601.913073][T12234] shield 0003:0955:7214.0051: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1601.940992][T21269] usb 5-1: USB disconnect, device number 42 [ 1601.956663][T12234] shield 0003:0955:7214.0051: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1602.006356][T12234] shield 0003:0955:7214.0051: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1602.028776][T12234] shield 0003:0955:7214.0051: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1602.458174][T21269] usb 4-1: new full-speed USB device number 59 using dummy_hcd [ 1602.620976][T21269] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1602.641600][T21269] usb 4-1: not running at top speed; connect to a high speed hub [ 1602.654447][T21269] usb 4-1: config 253 has an invalid descriptor of length 83, skipping remainder of the config [ 1602.668726][T21269] usb 4-1: config 253 interface 0 altsetting 57 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1602.684427][T21269] usb 4-1: config 253 interface 0 has no altsetting 0 [ 1602.698987][T21269] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1602.711760][T21269] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1602.723000][T21269] usb 4-1: Product: syz [ 1602.761363][T21269] usb 4-1: Manufacturer: syz [ 1602.774634][T21269] usb 4-1: SerialNumber: syz [ 1602.980076][T12234] usb 2-1: new full-speed USB device number 35 using dummy_hcd [ 1603.176926][T12234] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1603.225533][T12234] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1603.256504][T12234] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1603.281469][T12234] usb 2-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 1603.316042][T12234] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1603.450135][T12234] usb 2-1: config 0 descriptor?? [ 1603.493513][T21269] cdc_ether 4-1:253.0: skipping garbage [ 1603.592084][T21269] usb 4-1: bad CDC descriptors [ 1603.641022][T21269] usb 4-1: USB disconnect, device number 59 [ 1603.725698][T26448] netlink: 'syz.2.5125': attribute type 4 has an invalid length. [ 1603.938104][T26431] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1603.989482][T26431] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1604.154770][T12234] hid-steam 0003:28DE:1102.0052: item fetching failed at offset 4/5 [ 1604.178811][T12234] hid-steam 0003:28DE:1102.0052: steam_probe:parse of hid interface failed [ 1604.210528][T12234] hid-steam 0003:28DE:1102.0052: probe with driver hid-steam failed with error -22 [ 1604.351299][T18395] usb 2-1: USB disconnect, device number 35 [ 1604.390853][T26452] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5126'. [ 1604.807842][T26458] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5127'. [ 1605.406745][T26465] kvm: requested 188571 ns i8254 timer period limited to 200000 ns [ 1605.417021][T26465] kvm: requested 38552 ns i8254 timer period limited to 200000 ns [ 1605.450145][T26465] kvm: requested 6704 ns i8254 timer period limited to 200000 ns [ 1605.477686][T26465] kvm: requested 158400 ns i8254 timer period limited to 200000 ns [ 1605.497011][T26465] kvm: requested 93866 ns i8254 timer period limited to 200000 ns [ 1605.518770][T26465] kvm: requested 127390 ns i8254 timer period limited to 200000 ns [ 1605.539438][T26465] kvm: requested 42742 ns i8254 timer period limited to 200000 ns [ 1605.624937][T26472] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5131'. [ 1605.675733][T26472] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5131'. [ 1606.358036][T22502] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 1606.562879][T22502] usb 2-1: device descriptor read/64, error -71 [ 1606.801184][T26489] netlink: 'syz.3.5136': attribute type 4 has an invalid length. [ 1606.838194][T22502] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 1606.999370][T22502] usb 2-1: device descriptor read/64, error -71 [ 1607.138317][T22502] usb usb2-port1: attempt power cycle [ 1607.208128][ T797] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 1607.368546][ T797] usb 4-1: device descriptor read/64, error -71 [ 1607.537110][T26498] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5139'. [ 1607.575910][T22502] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1607.602810][T22502] usb 2-1: device descriptor read/8, error -71 [ 1607.604015][T26500] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.5140'. [ 1607.620522][ T797] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1607.638516][T21269] usb 6-1: new full-speed USB device number 63 using dummy_hcd [ 1607.778994][ T797] usb 4-1: device descriptor read/64, error -71 [ 1607.840738][T21269] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1607.868747][T21269] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1607.888857][ T797] usb usb4-port1: attempt power cycle [ 1607.916315][T21269] usb 6-1: New USB device found, idVendor=0755, idProduct=2626, bcdDevice= 0.00 [ 1607.946609][T22502] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 1607.955305][T21269] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1607.987063][T21269] usb 6-1: config 0 descriptor?? [ 1608.016801][T22502] usb 2-1: device descriptor read/8, error -71 [ 1608.162988][T22502] usb usb2-port1: unable to enumerate USB device [ 1608.263482][ T797] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 1608.459322][ T797] usb 4-1: device descriptor read/8, error -71 [ 1608.786570][T21269] aureal 0003:0755:2626.0053: unknown main item tag 0x0 [ 1608.816374][T21269] aureal 0003:0755:2626.0053: unknown main item tag 0x0 [ 1608.884907][T21269] aureal 0003:0755:2626.0053: unknown main item tag 0x0 [ 1608.909008][ T797] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 1608.923719][T26509] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5138'. [ 1608.935355][T21269] aureal 0003:0755:2626.0053: unknown main item tag 0x0 [ 1608.935890][T26509] bridge_slave_1: left allmulticast mode [ 1608.964949][T26509] bridge_slave_1: left promiscuous mode [ 1608.976660][T21269] aureal 0003:0755:2626.0053: unknown main item tag 0x0 [ 1608.986668][ T797] usb 4-1: device descriptor read/8, error -71 [ 1609.015459][T21269] aureal 0003:0755:2626.0053: unknown main item tag 0x0 [ 1609.046240][T21269] aureal 0003:0755:2626.0053: unknown main item tag 0x0 [ 1609.112669][T26509] bridge0: port 2(bridge_slave_1) entered disabled state [ 1609.120780][ T797] usb usb4-port1: unable to enumerate USB device [ 1609.129209][T21269] aureal 0003:0755:2626.0053: hidraw0: USB HID v1.ff Device [HID 0755:2626] on usb-dummy_hcd.5-1/input0 [ 1609.365482][T26509] bridge_slave_0: left allmulticast mode [ 1609.388174][T26509] bridge_slave_0: left promiscuous mode [ 1609.472178][T26509] bridge0: port 1(bridge_slave_0) entered disabled state [ 1609.979554][ T797] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 1610.035684][T26521] kAFS: unable to lookup cell '' [ 1610.195355][ T797] usb 2-1: Using ep0 maxpacket: 16 [ 1610.292930][ T797] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 1610.311952][ T797] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 1610.340559][ T797] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1610.390184][ T797] usb 2-1: Product: syz [ 1610.424399][ T797] usb 2-1: Manufacturer: syz [ 1610.444178][ T797] usb 2-1: SerialNumber: syz [ 1610.486850][ T797] usb 2-1: config 0 descriptor?? [ 1610.519478][ T797] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 1610.538180][T17752] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 1610.567211][ T797] usb 2-1: Detected FT232R [ 1610.649511][T26531] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 1610.715148][T17752] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1610.725740][ T797] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 1610.752072][T17752] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1610.768348][T18395] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 1610.799938][T17752] usb 5-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 1610.827213][T17752] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1610.856717][T17752] usb 5-1: config 0 descriptor?? [ 1610.936823][ T797] ftdi_sio 2-1:0.0: GPIO initialisation failed: -32 [ 1610.950454][T18395] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1610.969548][ T797] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1610.986285][T18395] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1611.030721][T12234] usb 6-1: USB disconnect, device number 63 [ 1611.070838][T18395] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1611.151945][T18395] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1611.194576][T18395] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1611.298533][T18395] usb 4-1: config 0 descriptor?? [ 1611.763558][T18395] plantronics 0003:047F:FFFF.0054: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 1611.796388][T26544] netlink: 'syz.2.5151': attribute type 1 has an invalid length. [ 1612.484160][T26544] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5151'. [ 1612.523115][T26543] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1612.568477][T26543] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 1612.694784][ T797] usb 2-1: USB disconnect, device number 40 [ 1612.710154][ T797] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1612.751134][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1612.760099][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1612.785891][ T797] ftdi_sio 2-1:0.0: device disconnected [ 1612.831787][T26544] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1613.097819][T18395] usb 4-1: reset high-speed USB device number 64 using dummy_hcd [ 1613.288753][ T797] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1613.486076][ T797] usb 2-1: Using ep0 maxpacket: 16 [ 1613.496616][ T797] usb 2-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1613.510144][ T797] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1613.546015][ T797] usb 2-1: New USB device found, idVendor=0079, idProduct=1844, bcdDevice= 0.00 [ 1613.561978][ T797] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1613.604320][ T797] usb 2-1: config 0 descriptor?? [ 1614.273359][ T797] usbhid 2-1:0.0: can't add hid device: -71 [ 1614.308463][ T797] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1614.354594][ T797] usb 2-1: USB disconnect, device number 41 [ 1614.529587][ T10] usb 5-1: USB disconnect, device number 43 [ 1615.112547][T26576] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5158'. [ 1615.505545][T26582] kvm: requested 187733 ns i8254 timer period limited to 200000 ns [ 1615.537962][T17746] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 1615.651199][T26582] kvm: requested 181866 ns i8254 timer period limited to 200000 ns [ 1615.689243][T26582] kvm: requested 120685 ns i8254 timer period limited to 200000 ns [ 1615.699398][T26582] kvm: requested 166781 ns i8254 timer period limited to 200000 ns [ 1615.723590][T17746] usb 6-1: config 0 has no interfaces? [ 1615.734511][T17746] usb 6-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1615.756396][T26582] kvm: requested 139123 ns i8254 timer period limited to 200000 ns [ 1615.765040][T17746] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1615.784250][T26582] kvm: requested 133257 ns i8254 timer period limited to 200000 ns [ 1615.806752][T17746] usb 6-1: config 0 descriptor?? [ 1615.839039][T26582] kvm: requested 134095 ns i8254 timer period limited to 200000 ns [ 1615.916959][T26582] kvm: requested 12571 ns i8254 timer period limited to 200000 ns [ 1615.966714][T26582] kvm: requested 21790 ns i8254 timer period limited to 200000 ns [ 1616.016989][T26582] kvm: requested 136609 ns i8254 timer period limited to 200000 ns [ 1616.056216][T17746] usb 6-1: USB disconnect, device number 64 [ 1616.541693][T26590] pim6reg1: entered promiscuous mode [ 1616.570507][T26590] pim6reg1: entered allmulticast mode [ 1616.801424][T26591] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5160'. [ 1617.178427][T26591] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5160'. [ 1617.750378][T26606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1617.789441][T26606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1617.828335][T26606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1617.863513][T26606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1617.938337][T17746] usb 6-1: new full-speed USB device number 65 using dummy_hcd [ 1618.008417][T26610] netlink: 'syz.1.5166': attribute type 1 has an invalid length. [ 1618.064858][T26611] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5166'. [ 1618.196840][T17746] usb 6-1: config 0 interface 0 altsetting 66 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1618.217807][T17746] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1618.225225][T17746] usb 6-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 1618.256846][T17746] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1618.280337][T17746] usb 6-1: config 0 descriptor?? [ 1618.318771][T26615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1618.335321][T26615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1618.370243][T18395] usb 4-1: device descriptor read/64, error -110 [ 1618.625812][T18395] usb 4-1: reset high-speed USB device number 64 using dummy_hcd [ 1618.714713][T17746] cypress 0003:04B4:0001.0055: hidraw1: USB HID v0.01 Device [HID 04b4:0001] on usb-dummy_hcd.5-1/input0 [ 1618.758288][T18395] usb 4-1: device descriptor read/64, error -32 [ 1618.833522][T26622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1618.857993][T26622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1618.925020][T17746] usb 6-1: USB disconnect, device number 65 [ 1619.022993][T18395] usb 4-1: reset high-speed USB device number 64 using dummy_hcd [ 1619.101783][T18395] usb 4-1: device descriptor read/8, error -32 [ 1619.389391][T18395] usb 4-1: reset high-speed USB device number 64 using dummy_hcd [ 1619.433806][T18395] usb 4-1: device descriptor read/8, error -32 [ 1619.450435][T26610] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1619.549440][T18395] raw-gadget.6 gadget.3: failed to queue suspend event [ 1619.624576][T22502] usb 4-1: USB disconnect, device number 64 [ 1619.686389][T22502] raw-gadget.6 gadget.3: failed to queue reset event [ 1619.788308][T22502] raw-gadget.6 gadget.3: failed to queue resume event [ 1619.868045][T22502] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1619.878514][ C0] raw-gadget.6 gadget.3: ignoring, device is not running [ 1619.900702][T22502] raw-gadget.6 gadget.3: failed to queue reset event [ 1619.985567][T22502] raw-gadget.6 gadget.3: failed to queue resume event [ 1620.458171][T22502] usb 4-1: device descriptor read/64, error -32 [ 1620.567961][T22502] raw-gadget.6 gadget.3: failed to queue suspend event [ 1620.737258][T22502] raw-gadget.6 gadget.3: failed to queue reset event [ 1620.838871][T22502] raw-gadget.6 gadget.3: failed to queue resume event [ 1620.947964][T22502] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1620.983851][ C0] raw-gadget.6 gadget.3: ignoring, device is not running [ 1620.997470][T22502] raw-gadget.6 gadget.3: failed to queue reset event [ 1621.055648][T26644] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1621.082842][T22502] raw-gadget.6 gadget.3: failed to queue resume event [ 1621.167365][T26647] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5173'. [ 1621.191527][T26647] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5173'. [ 1621.248716][T24589] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1621.260952][ T30] audit: type=1326 audit(1769631377.312:2129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1621.279168][T26644] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1621.350345][ T9237] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1621.374422][T22502] usb 4-1: device descriptor read/64, error -32 [ 1621.388558][ T30] audit: type=1326 audit(1769631377.312:2130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1621.451141][ T9237] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1621.499741][ T9237] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1621.578230][T21269] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1621.578352][T22502] raw-gadget.6 gadget.3: failed to queue suspend event [ 1621.641339][T22502] usb usb4-port1: attempt power cycle [ 1621.678406][T22502] raw-gadget.6 gadget.3: failed to queue disconnect event [ 1622.014001][T21269] usb 2-1: Using ep0 maxpacket: 32 [ 1622.039663][T22502] raw-gadget.6 gadget.3: failed to queue reset event [ 1622.135705][ T30] audit: type=1326 audit(1769631377.312:2131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1622.233306][T22502] raw-gadget.6 gadget.3: failed to queue resume event [ 1622.300290][T21269] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1622.336466][T22502] raw-gadget.6 gadget.3: failed to queue reset event [ 1622.369334][T21269] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1622.386326][ T30] audit: type=1326 audit(1769631377.312:2132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1622.477766][T21269] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1622.537137][T21269] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1622.558668][ T30] audit: type=1326 audit(1769631377.312:2133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1622.635443][T21269] usb 2-1: config 0 descriptor?? [ 1622.678777][T22502] raw-gadget.6 gadget.3: failed to queue resume event [ 1622.781100][ T30] audit: type=1326 audit(1769631377.312:2134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1622.847930][T22502] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1622.878537][ T30] audit: type=1326 audit(1769631377.312:2135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1622.938193][ C0] raw-gadget.6 gadget.3: ignoring, device is not running [ 1622.948420][T22502] usb 4-1: device descriptor read/8, error -32 [ 1623.060248][ T30] audit: type=1326 audit(1769631377.312:2136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1623.088663][T22502] raw-gadget.6 gadget.3: failed to queue suspend event [ 1623.146551][T26658] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5170'. [ 1623.158561][T22502] raw-gadget.6 gadget.3: failed to queue reset event [ 1623.288488][T26655] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 1623.296253][T26655] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1623.340137][ T30] audit: type=1326 audit(1769631377.312:2137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1623.381099][T22502] raw-gadget.6 gadget.3: failed to queue resume event [ 1623.488611][T22502] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 1623.513257][ T30] audit: type=1326 audit(1769631377.312:2138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26643 comm="syz.1.5173" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1623.558502][ C0] raw-gadget.6 gadget.3: ignoring, device is not running [ 1623.574708][T22502] usb 4-1: device descriptor read/8, error -32 [ 1623.599168][T26655] vhci_hcd vhci_hcd.0: Device attached [ 1623.838568][T22502] raw-gadget.6 gadget.3: failed to queue suspend event [ 1623.904053][T26656] vhci_hcd: connection closed [ 1623.912906][ T9237] vhci_hcd vhci_hcd.4: stop threads [ 1623.928704][T17746] usb 42-1: SetAddress Request (15) to port 0 [ 1623.935750][T17746] usb 42-1: new SuperSpeed USB device number 15 using vhci_hcd [ 1623.944569][ T9237] vhci_hcd vhci_hcd.4: release socket [ 1623.985205][T22502] usb usb4-port1: unable to enumerate USB device [ 1624.042081][ T9237] vhci_hcd vhci_hcd.4: disconnect device [ 1624.318614][T22502] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 1624.504805][T22502] usb 6-1: Using ep0 maxpacket: 32 [ 1624.532229][T22502] usb 6-1: config 0 has no interfaces? [ 1624.574056][T22502] usb 6-1: New USB device found, idVendor=0bb4, idProduct=0a15, bcdDevice=3f.85 [ 1624.878522][T22502] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1624.918181][T22502] usb 6-1: Product: syz [ 1624.940702][T22502] usb 6-1: Manufacturer: syz [ 1624.977705][T22502] usb 6-1: SerialNumber: syz [ 1624.999530][T22502] usb 6-1: config 0 descriptor?? [ 1625.263822][T22502] usb 6-1: USB disconnect, device number 66 [ 1626.074589][T21269] usbhid 2-1:0.0: can't add hid device: -71 [ 1626.088649][T21269] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1626.105579][T21269] usb 2-1: USB disconnect, device number 42 [ 1626.853243][T26689] openvswitch: netlink: Key 4 has unexpected len 2 expected 12 [ 1626.909274][T26689] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5184'. [ 1627.308969][T22502] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 1629.149626][T17746] usb 42-1: device descriptor read/8, error -110 [ 1629.569167][T17746] usb usb42-port1: attempt power cycle [ 1630.322374][T26751] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1630.367314][T26751] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1630.479552][T17746] usb usb42-port1: unable to enumerate USB device [ 1630.987187][T26764] syzkaller0: entered promiscuous mode [ 1630.996664][T26764] syzkaller0: entered allmulticast mode [ 1631.110688][T12234] hid-generic 0000:0000:0000.0056: unknown main item tag 0x0 [ 1631.159947][T12234] hid-generic 0000:0000:0000.0056: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1633.332746][T26788] dlm: no locking on control device [ 1634.336896][T26797] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1634.349042][T26797] IPv6: NLM_F_CREATE should be set when creating new route [ 1634.428279][T17746] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 1634.555247][T26797] bridge0: port 2(bridge_slave_1) entered disabled state [ 1634.564395][T26797] bridge0: port 1(bridge_slave_0) entered disabled state [ 1634.650597][T17746] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1634.699551][T17746] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1634.769012][T17746] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1634.797928][T17746] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1634.938798][T26797] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1634.959424][T26797] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1635.228552][T17746] usb 6-1: Product: syz [ 1635.236265][T24589] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1635.283936][T17746] usb 6-1: Manufacturer: syz [ 1635.304872][T17746] usb 6-1: SerialNumber: syz [ 1635.328324][T24589] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1635.350889][T17746] cdc_mbim 6-1:1.0: skipping garbage [ 1635.387919][T24589] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1635.463143][T24589] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1635.559416][T26795] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1636.192666][T26803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1636.216145][T26803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1636.291143][T26795] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1636.322095][T17746] cdc_mbim 6-1:1.0: cdc-wdm0: USB WDM device [ 1636.433186][T17746] wwan wwan0: port wwan0mbim0 attached [ 1636.529212][T17746] cdc_mbim 6-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.5-1, CDC MBIM, 96:a2:aa:04:b6:0a [ 1636.546460][T26795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1636.556001][T26795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1636.651759][T17746] usb 6-1: USB disconnect, device number 67 [ 1636.745617][T17746] cdc_mbim 6-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.5-1, CDC MBIM [ 1636.952029][T17746] wwan wwan0: port wwan0mbim0 disconnected [ 1637.133403][T26808] netlink: 188928 bytes leftover after parsing attributes in process `syz.5.5212'. [ 1637.628352][T17746] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 1637.838185][T17746] usb 5-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1637.871919][T17746] usb 5-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1637.913413][T17746] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1637.976132][T17746] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1638.586839][T26827] loop5: detected capacity change from 0 to 7 [ 1638.636021][T25289] Dev loop5: unable to read RDB block 7 [ 1638.657764][T25289] loop5: unable to read partition table [ 1638.673479][T25289] loop5: partition table beyond EOD, truncated [ 1638.683352][T26827] Dev loop5: unable to read RDB block 7 [ 1638.702036][T26827] loop5: unable to read partition table [ 1638.730478][T26827] loop5: partition table beyond EOD, truncated [ 1638.755835][T26827] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1638.806818][T26818] tipc: Enabled bearer , priority 0 [ 1638.839134][T26818] syzkaller0: entered promiscuous mode [ 1638.878209][T26818] syzkaller0: entered allmulticast mode [ 1638.899338][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 1638.899358][ T30] audit: type=1326 audit(1769631395.052:2196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1638.981010][ T30] audit: type=1326 audit(1769631395.052:2197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1639.108397][ T30] audit: type=1326 audit(1769631395.052:2198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1639.157769][ T10] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1639.200686][ T30] audit: type=1326 audit(1769631395.052:2199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=275 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1639.249219][T17746] stv0680 5-1:4.0: STV(e): camera ping failed!! [ 1639.289359][T26841] tipc: Resetting bearer [ 1639.318178][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 1639.353383][ T10] usb 2-1: New USB device found, idVendor=046d, idProduct=08b7, bcdDevice=99.db [ 1639.407275][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1639.442694][ T30] audit: type=1326 audit(1769631395.052:2200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1639.496899][ T10] usb 2-1: config 0 descriptor?? [ 1639.570611][ T30] audit: type=1326 audit(1769631395.052:2201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1639.683948][ T10] pwc: Logitech ViewPort AV 100 webcam detected. [ 1639.722637][ T30] audit: type=1326 audit(1769631395.052:2202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1639.784020][T17746] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -110 [ 1639.803971][T17746] stv0680 5-1:4.0: last error: 0, command = 0x0 [ 1639.826212][T26840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1639.885319][T26840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1639.917963][T26817] tipc: Resetting bearer [ 1639.919290][ T30] audit: type=1326 audit(1769631395.052:2203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1639.968106][ T10] pwc: Failed to set LED on/off time (-71) [ 1640.017589][ T30] audit: type=1326 audit(1769631395.052:2204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00d1f9aeb9 code=0x7ffc0000 [ 1640.061783][ T10] pwc: send_video_command error -71 [ 1640.075716][ T10] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 1640.127934][T26817] tipc: Disabling bearer [ 1640.135525][ T10] Philips webcam 2-1:0.0: probe with driver Philips webcam failed with error -71 [ 1640.158393][ T30] audit: type=1326 audit(1769631395.062:2205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26839 comm="syz.1.5219" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f00d1f5b78e code=0x7ffc0000 [ 1640.202306][ T10] usb 2-1: USB disconnect, device number 43 [ 1640.278622][T12234] tipc: Node number set to 4278321153 [ 1640.350386][T12234] usb 5-1: USB disconnect, device number 45 [ 1640.397292][T26854] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5223'. [ 1640.424541][T26854] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5223'. [ 1640.693710][T26843] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1640.738718][T21259] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1640.808180][T12234] usb 2-1: new full-speed USB device number 44 using dummy_hcd [ 1640.908577][T21259] usb 6-1: Using ep0 maxpacket: 16 [ 1640.924176][T21259] usb 6-1: config 1 interface 0 altsetting 111 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1640.938421][T21259] usb 6-1: config 1 interface 0 altsetting 111 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1640.955280][T21259] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1640.980165][T12234] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1641.020820][T21259] usb 6-1: New USB device found, idVendor=03f0, idProduct=0004, bcdDevice= 0.40 [ 1641.036234][T12234] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1641.051054][T21259] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1641.061912][T21259] usb 6-1: Product: 〉 [ 1641.066635][T21259] usb 6-1: Manufacturer:  [ 1641.073648][T12234] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 1641.088615][T21259] usb 6-1: SerialNumber: 䵛뽪഼뺭ꍺ韚ừퟣꮵ皺棵㡥㍐톂맍衯 [ 1641.100044][T12234] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 1641.128669][T26854] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1641.136532][T26854] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1641.161728][T12234] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1641.200911][T26867] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5228'. [ 1641.212387][T12234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1641.247380][T12234] usb 2-1: Product: syz [ 1641.281506][T12234] usb 2-1: Manufacturer: syz [ 1641.286908][T12234] usb 2-1: SerialNumber: syz [ 1641.315882][T26859] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 1641.509562][T21269] usb 5-1: new full-speed USB device number 46 using dummy_hcd [ 1641.541714][T26859] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 1641.556900][T26859] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 1641.611656][T21259] usb 6-1: USB disconnect, device number 68 [ 1641.752646][T21269] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1641.764249][T21269] usb 5-1: not running at top speed; connect to a high speed hub [ 1641.781266][T21269] usb 5-1: config 6 has an invalid interface number: 30 but max is 0 [ 1641.793259][T21269] usb 5-1: config 6 has no interface number 0 [ 1641.802441][T21269] usb 5-1: config 6 interface 30 altsetting 0 has an endpoint descriptor with address 0x47, changing to 0x7 [ 1641.888414][T21269] usb 5-1: config 6 interface 30 altsetting 0 endpoint 0x7 has invalid maxpacket 40968, setting to 64 [ 1642.138133][T21269] usb 5-1: config 6 interface 30 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 1642.223640][T21269] usb 5-1: New USB device found, idVendor=ffff, idProduct=9cf0, bcdDevice=ee.7b [ 1642.246943][T21269] usb 5-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 1642.269540][T21269] usb 5-1: Product: syz [ 1642.276986][T21269] usb 5-1: Manufacturer: syz [ 1642.283767][T26859] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 1642.292628][T26859] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 1642.306532][T21269] usb 5-1: SerialNumber: syz [ 1642.342920][T26867] raw-gadget.5 gadget.4: fail, usb_ep_enable returned -22 [ 1642.504540][T12234] cdc_ncm 2-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1642.517023][T12234] cdc_ncm 2-1:1.0: setting tx_max = 36 [ 1642.572401][T12234] cdc_ncm 2-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.1-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1642.618984][T21269] usb 5-1: USB disconnect, device number 46 [ 1642.723955][T12234] usb 2-1: USB disconnect, device number 44 [ 1642.731940][T12234] cdc_ncm 2-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.1-1, CDC NCM (NO ZLP) [ 1643.159210][T26880] bond5: option packets_per_slave: invalid value (18446744073709551615) [ 1643.193341][T26880] bond5: option packets_per_slave: allowed values 0 - 65535 [ 1643.220908][T26880] bond5 (unregistering): Released all slaves [ 1643.675713][T26897] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1643.704234][T26897] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1643.721394][T22502] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 1643.743746][T26890] netlink: 56 bytes leftover after parsing attributes in process `syz.5.5235'. [ 1643.868045][T22502] usb 2-1: device descriptor read/64, error -71 [ 1644.279277][T22502] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 1644.296306][T26906] netlink: 104 bytes leftover after parsing attributes in process `syz.5.5239'. [ 1644.417729][T22502] usb 2-1: device descriptor read/64, error -71 [ 1644.528279][T22502] usb usb2-port1: attempt power cycle [ 1644.815759][T26913] xt_CT: No such helper "snmp" [ 1644.837546][ T10] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 1644.867894][T22502] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 1644.898465][T22502] usb 2-1: device descriptor read/8, error -71 [ 1644.998440][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 1645.012239][ T10] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1645.039642][ T10] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1645.064981][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1645.092045][ T10] usb 6-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.00 [ 1645.122056][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1645.157557][T22502] usb 2-1: new full-speed USB device number 48 using dummy_hcd [ 1645.171069][ T10] usb 6-1: config 0 descriptor?? [ 1645.228254][T22502] usb 2-1: device descriptor read/8, error -71 [ 1645.272188][T26930] dvmrp1: tun_chr_ioctl cmd 2147767517 [ 1645.371519][T26932] openvswitch: netlink: Multiple metadata blocks provided [ 1645.384911][T22502] usb usb2-port1: unable to enumerate USB device [ 1645.402395][T26932] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5245'. [ 1645.493791][ T10] usbhid 6-1:0.0: can't add hid device: -71 [ 1645.514199][ T10] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1645.555954][ T10] usb 6-1: USB disconnect, device number 69 [ 1645.708728][T26932] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1645.749447][T26932] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1646.317721][ T10] usb 6-1: new full-speed USB device number 70 using dummy_hcd [ 1646.360787][T26938] loop5: detected capacity change from 0 to 7 [ 1646.373993][T25289] Dev loop5: unable to read RDB block 7 [ 1646.389905][T25289] loop5: AHDI p1 [ 1646.449073][T25289] loop5: partition table partially beyond EOD, truncated [ 1646.523835][T26938] Dev loop5: unable to read RDB block 7 [ 1646.529904][T26938] loop5: AHDI p1 [ 1646.536727][T26938] loop5: partition table partially beyond EOD, truncated [ 1646.547913][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1646.558251][ T10] usb 6-1: not running at top speed; connect to a high speed hub [ 1646.569076][ T10] usb 6-1: config 1 has an invalid interface descriptor of length 5, skipping [ 1646.582925][ T10] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1646.596372][ T10] usb 6-1: config 1 has 3 interfaces, different from the descriptor's value: 19 [ 1646.614127][ T10] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 59, changing to 4 [ 1646.647658][ T10] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 1646.719046][ T10] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1646.736744][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1646.805992][ T10] usb 6-1: Product: syz [ 1646.833262][ T10] usb 6-1: Manufacturer: syz [ 1646.875454][ T10] usb 6-1: SerialNumber: syz [ 1646.952330][T26944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1646.976203][T26944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1647.580086][T26954] netlink: 28 bytes leftover after parsing attributes in process `syz.5.5247'. [ 1647.867203][ T797] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 1648.038596][ T797] usb 5-1: Using ep0 maxpacket: 32 [ 1648.054778][ T797] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 1648.064388][ T797] usb 5-1: config 0 has no interface number 0 [ 1648.072826][ T797] usb 5-1: config 0 interface 89 has no altsetting 0 [ 1648.112294][ T797] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1648.152810][ T797] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1648.196438][ T797] usb 5-1: Product: syz [ 1648.208005][T22502] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 1648.215603][ T797] usb 5-1: Manufacturer: syz [ 1648.235088][ T797] usb 5-1: SerialNumber: syz [ 1648.280225][ T797] usb 5-1: config 0 descriptor?? [ 1648.321139][ T797] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1648.349443][ T797] em28xx 5-1:0.89: Video interface 89 found: bulk [ 1648.442561][T22502] usb 2-1: Using ep0 maxpacket: 16 [ 1648.473869][T22502] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 1648.486315][T22502] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1648.525345][T22502] usb 2-1: Product: syz [ 1648.552164][T22502] usb 2-1: Manufacturer: syz [ 1648.573813][T22502] usb 2-1: SerialNumber: syz [ 1648.814446][T22502] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 1648.862198][T22502] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1648.919672][ T797] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 1648.935008][T22502] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 1648.975313][T22502] usb 2-1: media controller created [ 1649.125538][T22502] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1649.277933][T22502] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1649.401630][ T10] usb 6-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1649.574950][ T10] usb 6-1: USB disconnect, device number 70 [ 1649.605919][T22502] dvb_usb_gl861 2-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 1649.665328][T22502] usb 2-1: USB disconnect, device number 49 [ 1649.677006][ T797] em28xx 5-1:0.89: read from i2c device at 0xa0 failed with unknown error (status=64) [ 1649.716767][ T797] em28xx 5-1:0.89: board has no eeprom [ 1649.753397][T25420] udevd[25420]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1649.966179][T26967] tipc: Enabled bearer , priority 0 [ 1650.017054][T26968] syzkaller0: entered promiscuous mode [ 1650.057626][T26968] syzkaller0: entered allmulticast mode [ 1650.085301][T26956] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1650.096759][T26967] tipc: Resetting bearer [ 1650.108930][T26956] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1650.149698][T26966] tipc: Resetting bearer [ 1650.178917][ T797] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 1650.188946][ T797] em28xx 5-1:0.89: analog set to bulk mode. [ 1650.195307][T12234] em28xx 5-1:0.89: Registering V4L2 extension [ 1650.259877][T26966] tipc: Disabling bearer [ 1650.297846][ T10] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1650.405212][T26981] loop5: detected capacity change from 0 to 7 [ 1650.429398][T26981] Dev loop5: unable to read RDB block 7 [ 1650.436168][T26981] loop5: unable to read partition table [ 1650.443874][T26981] loop5: partition table beyond EOD, truncated [ 1650.465265][T26981] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1650.486789][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 1650.503301][ T10] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1650.521808][ T10] usb 6-1: config 0 has an invalid interface number: 88 but max is 0 [ 1650.546794][ T10] usb 6-1: config 0 has no interface number 0 [ 1650.563973][ T10] usb 6-1: config 0 interface 88 altsetting 8 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1650.606707][ T10] usb 6-1: config 0 interface 88 altsetting 8 endpoint 0x86 has invalid wMaxPacketSize 0 [ 1650.648772][ T10] usb 6-1: config 0 interface 88 has no altsetting 0 [ 1650.660200][ T10] usb 6-1: string descriptor 0 read error: -22 [ 1650.670766][ T10] usb 6-1: New USB device found, idVendor=0460, idProduct=0004, bcdDevice=96.31 [ 1650.687977][ T10] usb 6-1: New USB device strings: Mfr=1, Product=84, SerialNumber=3 [ 1650.705016][T26985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1650.733605][T26985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1650.761925][T26987] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1650.763827][ T10] usb 6-1: config 0 descriptor?? [ 1650.906628][T26987] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1650.971111][T26985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1651.034528][T26985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1651.052588][ T10] input: USB Acecad Flair Tablet 0460:0004 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.88/input/input108 [ 1651.389379][T12234] em28xx 5-1:0.89: reading from i2c device at 0x4a failed (error=-5) [ 1651.425936][T12234] em28xx 5-1:0.89: reading from i2c device at 0x48 failed (error=-5) [ 1651.466550][T21269] usb 6-1: USB disconnect, device number 71 [ 1651.476432][T12234] em28xx 5-1:0.89: reading from i2c device at 0x42 failed (error=-5) [ 1651.508781][T12234] em28xx 5-1:0.89: reading from i2c device at 0x40 failed (error=-5) [ 1651.529022][T25420] udevd[25420]: Error opening device "/dev/input/event4": Input/output error [ 1651.544953][T12234] em28xx 5-1:0.89: Config register raw data: 0xfffffffb [ 1651.568798][T25420] udevd[25420]: Unable to EVIOCGABS device "/dev/input/event4" [ 1651.581189][T25420] udevd[25420]: Unable to EVIOCGABS device "/dev/input/event4" [ 1651.591949][T12234] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 1651.601811][T12234] em28xx 5-1:0.89: No AC97 audio processor [ 1651.670424][T12234] usb 5-1: Decoder not found [ 1651.675415][T12234] em28xx 5-1:0.89: failed to create media graph [ 1651.701101][T12234] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 1651.810359][T12234] em28xx 5-1:0.89: Registering snapshot button... [ 1651.867369][T27000] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1651.908760][T12234] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input109 [ 1651.932294][T27000] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1651.982147][T27001] netlink: 'syz.3.5265': attribute type 1 has an invalid length. [ 1652.152423][T12234] em28xx 5-1:0.89: Remote control support is not available for this card. [ 1652.257297][T27005] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5264'. [ 1652.423273][T27012] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5266'. [ 1652.564971][T27015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1652.611319][T27015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1652.639049][T12234] usb 2-1: new full-speed USB device number 50 using dummy_hcd [ 1652.825009][T27019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1652.838790][T27019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1652.859773][T12234] usb 2-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 1652.880564][T12234] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1652.918796][T12234] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 255 [ 1652.970913][T12234] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1652.981810][ T797] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1653.025883][T12234] usb 2-1: New USB device strings: Mfr=8, Product=0, SerialNumber=1 [ 1653.046215][T12234] usb 2-1: Manufacturer: syz [ 1653.067297][T12234] usb 2-1: SerialNumber: syz [ 1653.161915][ T797] usb 6-1: Using ep0 maxpacket: 32 [ 1653.184930][ T797] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 1653.211767][ T797] usb 6-1: config 0 has no interface number 0 [ 1653.258376][ T797] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1653.293180][ T797] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1653.336891][ T797] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1653.378652][ T797] usb 6-1: Product: syz [ 1653.383407][ T797] usb 6-1: Manufacturer: syz [ 1653.408744][T27021] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1653.440207][ T797] usb 6-1: SerialNumber: syz [ 1653.466311][T27021] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1653.481806][ T797] usb 6-1: config 0 descriptor?? [ 1653.497089][T27022] netlink: 92 bytes leftover after parsing attributes in process `syz.1.5262'. [ 1653.596623][T27017] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 1653.710780][T27024] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5271'. [ 1653.843429][T27017] raw-gadget.4 gadget.5: fail, usb_ep_enable returned -22 [ 1653.852689][T27021] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1653.910176][T27021] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1654.492758][ T797] asix 6-1:0.188 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1654.864594][T27044] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5274'. [ 1655.065656][T12234] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 1655.755312][T12234] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 1655.899304][T12234] usb 2-1: USB disconnect, device number 50 [ 1656.139032][ T797] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1656.181316][ T797] asix 6-1:0.188 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 1656.248656][ T797] asix 6-1:0.188: probe with driver asix failed with error -71 [ 1656.307833][ T797] usb 6-1: USB disconnect, device number 72 [ 1656.825863][T27060] netlink: 194768 bytes leftover after parsing attributes in process `syz.4.5281'. [ 1656.842534][T27062] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5282'. [ 1656.928357][ T797] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1657.028406][T12234] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1657.095380][ T797] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1657.095408][ T797] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1657.099750][ T797] usb 6-1: config 0 descriptor?? [ 1657.188166][T12234] usb 2-1: Using ep0 maxpacket: 16 [ 1657.195378][T12234] usb 2-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 1657.195408][T12234] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1657.195425][T12234] usb 2-1: Product: syz [ 1657.195437][T12234] usb 2-1: Manufacturer: syz [ 1657.195450][T12234] usb 2-1: SerialNumber: syz [ 1657.373222][ T797] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1657.425419][T12234] usb 2-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 1657.439817][T12234] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1657.441391][T12234] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 1657.441435][T12234] usb 2-1: media controller created [ 1657.478896][T12234] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1657.700508][ T797] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 2 [ 1657.700566][ T797] [drm] Initialized udl on minor 2 [ 1657.771827][T27071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1657.772191][T27071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1657.775046][T27071] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1657.775365][T27071] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1657.780190][T12234] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1657.844375][T27069] ------------[ cut here ]------------ [ 1657.844434][T27069] usb 2-1: BOGUS control dir, pipe 80003380 doesn't match bRequestType c0 [ 1657.844467][T27069] WARNING: drivers/usb/core/urb.c:414 at usb_submit_urb+0x1052/0x18b0, CPU#1: syz.3.5284/27069 [ 1657.844502][T27069] Modules linked in: [ 1657.844530][T27069] CPU: 1 UID: 0 PID: 27069 Comm: syz.3.5284 Tainted: G L syzkaller #0 PREEMPT(full) [ 1657.844558][T27069] Tainted: [L]=SOFTLOCKUP [ 1657.844565][T27069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1657.844577][T27069] RIP: 0010:usb_submit_urb+0x1114/0x18b0 [ 1657.844613][T27069] Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c2 f2 ff ff 89 e9 [ 1657.844628][T27069] RSP: 0018:ffffc9000b3178c8 EFLAGS: 00010246 [ 1657.844644][T27069] RAX: 0000000000000000 RBX: ffff88803409d600 RCX: 0000000080003380 [ 1657.844657][T27069] RDX: ffff888038795cc0 RSI: ffffffff8c5dcc40 RDI: ffffffff8ffc2c70 [ 1657.844670][T27069] RBP: 1ffff11009f65020 R08: 00000000000000c0 R09: 0000000000000000 [ 1657.844682][T27069] R10: ffffc9000b3179c0 R11: fffff52001662f44 R12: ffff88804c081100 [ 1657.844695][T27069] R13: ffff88804fb28100 R14: 0000000080003380 R15: ffff888038795cc0 [ 1657.844708][T27069] FS: 00007ff9f86726c0(0000) GS:ffff8881257f5000(0000) knlGS:0000000000000000 [ 1657.844723][T27069] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1657.844752][T27069] CR2: 00007ff9f8671ff8 CR3: 0000000038942000 CR4: 00000000003526f0 [ 1657.844768][T27069] Call Trace: [ 1657.844776][T27069] [ 1657.844789][T27069] ? __init_swait_queue_head+0xa9/0x150 [ 1657.844813][T27069] usb_start_wait_urb+0x12b/0x510 [ 1657.844837][T27069] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1657.844887][T27069] usb_control_msg+0x232/0x3e0 [ 1657.844911][T27069] gl861_ctrl_msg+0x207/0x420 [ 1657.844938][T27069] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 1657.844967][T27069] gl861_i2c_master_xfer+0x439/0x6a0 [ 1657.844992][T27069] __i2c_transfer+0x79a/0x1ee0 [ 1657.845034][T27069] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1657.845064][T27069] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1657.845090][T27069] ? i2c_transfer+0xc8/0x2d0 [ 1657.845115][T27069] i2c_transfer+0x1cc/0x2d0 [ 1657.845141][T27069] i2cdev_ioctl_rdwr+0x460/0x740 [ 1657.845189][T27069] i2cdev_ioctl+0x6a5/0x880 [ 1657.845213][T27069] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1657.845239][T27069] ? __fget_files+0x3a0/0x420 [ 1657.845258][T27069] ? __fget_files+0x2a/0x420 [ 1657.845278][T27069] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1657.845316][T27069] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1657.845341][T27069] __se_sys_ioctl+0xfc/0x170 [ 1657.845366][T27069] do_syscall_64+0xe2/0xf80 [ 1657.845384][T27069] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1657.845401][T27069] ? trace_irq_disable+0x37/0x100 [ 1657.845418][T27069] ? clear_bhb_loop+0x60/0xb0 [ 1657.845454][T27069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1657.845471][T27069] RIP: 0033:0x7ff9f779aeb9 [ 1657.845486][T27069] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1657.845500][T27069] RSP: 002b:00007ff9f8672028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1657.845518][T27069] RAX: ffffffffffffffda RBX: 00007ff9f7a15fa0 RCX: 00007ff9f779aeb9 [ 1657.845531][T27069] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 000000000000000b [ 1657.845548][T27069] RBP: 00007ff9f7808c1f R08: 0000000000000000 R09: 0000000000000000 [ 1657.845559][T27069] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1657.845586][T27069] R13: 00007ff9f7a16038 R14: 00007ff9f7a15fa0 R15: 00007ff9f7b3fa48 [ 1657.845612][T27069] [ 1657.845623][T27069] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1657.845636][T27069] CPU: 1 UID: 0 PID: 27069 Comm: syz.3.5284 Tainted: G L syzkaller #0 PREEMPT(full) [ 1657.845657][T27069] Tainted: [L]=SOFTLOCKUP [ 1657.845664][T27069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 1657.845674][T27069] Call Trace: [ 1657.845682][T27069] [ 1657.845688][T27069] vpanic+0x1e0/0x670 [ 1657.845714][T27069] panic+0xc5/0xd0 [ 1657.845734][T27069] ? __pfx_panic+0x10/0x10 [ 1657.845766][T27069] __warn+0x315/0x4a0 [ 1657.845784][T27069] ? usb_submit_urb+0x1052/0x18b0 [ 1657.845802][T27069] ? usb_submit_urb+0x1052/0x18b0 [ 1657.845818][T27069] __report_bug+0x29a/0x540 [ 1657.845840][T27069] ? usb_submit_urb+0x1052/0x18b0 [ 1657.845856][T27069] ? __pfx___report_bug+0x10/0x10 [ 1657.845876][T27069] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1657.845900][T27069] ? lockdep_hardirqs_on+0x7a/0x110 [ 1657.845917][T27069] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1657.845942][T27069] ? stack_depot_save_flags+0x3f3/0x810 [ 1657.845967][T27069] report_bug_entry+0x19a/0x290 [ 1657.845983][T27069] ? usb_submit_urb+0x1114/0x18b0 [ 1657.845998][T27069] ? usb_submit_urb+0x1119/0x18b0 [ 1657.846014][T27069] handle_bug+0xca/0x200 [ 1657.846034][T27069] exc_invalid_op+0x1a/0x50 [ 1657.846054][T27069] asm_exc_invalid_op+0x1a/0x20 [ 1657.846068][T27069] RIP: 0010:usb_submit_urb+0x1114/0x18b0 [ 1657.846085][T27069] Code: 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 91 05 00 00 45 0f b6 45 00 48 8b 7c 24 18 48 8b 74 24 10 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 c2 f2 ff ff 89 e9 [ 1657.846098][T27069] RSP: 0018:ffffc9000b3178c8 EFLAGS: 00010246 [ 1657.846112][T27069] RAX: 0000000000000000 RBX: ffff88803409d600 RCX: 0000000080003380 [ 1657.846124][T27069] RDX: ffff888038795cc0 RSI: ffffffff8c5dcc40 RDI: ffffffff8ffc2c70 [ 1657.846137][T27069] RBP: 1ffff11009f65020 R08: 00000000000000c0 R09: 0000000000000000 [ 1657.846148][T27069] R10: ffffc9000b3179c0 R11: fffff52001662f44 R12: ffff88804c081100 [ 1657.846160][T27069] R13: ffff88804fb28100 R14: 0000000080003380 R15: ffff888038795cc0 [ 1657.846184][T27069] ? usb_submit_urb+0x10a3/0x18b0 [ 1657.846204][T27069] ? __init_swait_queue_head+0xa9/0x150 [ 1657.846225][T27069] usb_start_wait_urb+0x12b/0x510 [ 1657.846248][T27069] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 1657.846281][T27069] usb_control_msg+0x232/0x3e0 [ 1657.846303][T27069] gl861_ctrl_msg+0x207/0x420 [ 1657.846329][T27069] ? __pfx_gl861_ctrl_msg+0x10/0x10 [ 1657.846358][T27069] gl861_i2c_master_xfer+0x439/0x6a0 [ 1657.846382][T27069] __i2c_transfer+0x79a/0x1ee0 [ 1657.846406][T27069] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1657.846433][T27069] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1657.846459][T27069] ? i2c_transfer+0xc8/0x2d0 [ 1657.846484][T27069] i2c_transfer+0x1cc/0x2d0 [ 1657.846509][T27069] i2cdev_ioctl_rdwr+0x460/0x740 [ 1657.846540][T27069] i2cdev_ioctl+0x6a5/0x880 [ 1657.846570][T27069] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1657.846596][T27069] ? __fget_files+0x3a0/0x420 [ 1657.846613][T27069] ? __fget_files+0x2a/0x420 [ 1657.846633][T27069] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1657.846654][T27069] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 1657.846677][T27069] __se_sys_ioctl+0xfc/0x170 [ 1657.846702][T27069] do_syscall_64+0xe2/0xf80 [ 1657.846719][T27069] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1657.846735][T27069] ? trace_irq_disable+0x37/0x100 [ 1657.846750][T27069] ? clear_bhb_loop+0x60/0xb0 [ 1657.846769][T27069] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1657.846785][T27069] RIP: 0033:0x7ff9f779aeb9 [ 1657.846798][T27069] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1657.846811][T27069] RSP: 002b:00007ff9f8672028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1657.846827][T27069] RAX: ffffffffffffffda RBX: 00007ff9f7a15fa0 RCX: 00007ff9f779aeb9 [ 1657.846840][T27069] RDX: 0000200000000200 RSI: 0000000000000707 RDI: 000000000000000b [ 1657.846851][T27069] RBP: 00007ff9f7808c1f R08: 0000000000000000 R09: 0000000000000000 [ 1657.846861][T27069] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1657.846871][T27069] R13: 00007ff9f7a16038 R14: 00007ff9f7a15fa0 R15: 00007ff9f7b3fa48 [ 1657.846896][T27069] [ 1657.847569][T27069] Kernel Offset: disabled