last executing test programs:

2m59.828257473s ago: executing program 2 (id=2317):
r0 = epoll_create1(0x80000)
r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff)
sendmsg$TIPC_NL_NET_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000006c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100800000250f00000018"], 0x2c}, 0x1, 0x0, 0x0, 0x2805}, 0x0)
syz_usb_connect(0x6, 0x36, &(0x7f0000000000)=ANY=[@ANYRESHEX=r0], 0x0)
epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000000})
epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f0000000040)={0x40000006})
r4 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x64342, 0x0)
prlimit64(0x0, 0x7, &(0x7f0000000180)={0x1, 0x8}, 0x0)
syz_io_uring_setup(0x3b48, &(0x7f0000000280)={0x0, 0xc5ba, 0x1, 0x1, 0xc3}, 0x0, 0x0)
openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0)
getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000040)={0x0, 0xc, 0x6, [0x4, 0x3, 0x0, 0xa, 0x5, 0x570]}, &(0x7f0000000080)=0x14)
sendfile(r4, r4, 0x0, 0x7ffff000)

2m59.260630828s ago: executing program 2 (id=2320):
openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
syz_usb_connect(0x0, 0x36, 0x0, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
r2 = dup(r1)
r3 = userfaultfd(0x801)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0))
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0)
r4 = userfaultfd(0x80001)
r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$sock_ifreq(r5, 0x8910, &(0x7f0000000000)={'bridge0\x00', @ifru_ivalue=0x2})
ioctl$sock_netdev_private(r5, 0x89f8, &(0x7f0000000000))
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="6c0100001000130700000000fcdbdf002001000000000000000000000000000120010000000000000000000000000001000000004e2100020a0000206c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ac1414aa000000000000000000000000000000fe3200000000000000000000000000ffffac1414bb00000000000000000000000000000000000000000000000008000000000000000000000000000000fcffffffffffffff000000000000000043050000000000000400000000000000ffffffffffffff7f000000000000000000000000000000000000000000000000000000002cbd70000035000002000100500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000060000000210466d38547aa140db9a200000000c538c7cb7a1c00040002"], 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x4004001)
r7 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r7, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="020afc000700000028bd7000fedbdf2505001a00"], 0x38}}, 0x40408c0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000100))
ioctl$I2C_TIMEOUT(r2, 0x702, 0xffffffffffffffff)
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5})
ioctl$UFFDIO_CONTINUE(r3, 0xc020aa07, &(0x7f00000001c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}})
r8 = socket$nl_generic(0x10, 0x3, 0x10)
r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r8)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000005c0)=ANY=[@ANYBLOB="ef52315a", @ANYRES16=r9, @ANYBLOB="0100fdfffffffcdbdf254f0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800ab000000000008000b000000000006001100ffff0000"], 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x90)
write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
prctl$PR_MCE_KILL(0x35, 0x1, 0x8)
prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10)
syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff)
sendmsg$WG_CMD_SET_DEVICE(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[], 0x80}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r0, 0xa471a000)

2m58.508564086s ago: executing program 2 (id=2323):
r0 = openat$binfmt_register(0xffffff9c, &(0x7f0000000180), 0x1, 0x0)
write$binfmt_register(r0, &(0x7f0000000080)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0xc0, 0x3a, '^Y\xd2\x1d\xf5\xec\xc8Qu\xd9\xe8\x89C\xee\xce\xcc3\x14W\x05\xbb\\\xb5t\xeb\xaf\xb9\x88\xe3\x11', 0x3a, ']$@K-^{', 0x3a, './file0', 0x3a, [0x43, 0x50]}, 0x4e)
creat(&(0x7f0000000080)='./file0\x00', 0xac)
mount(&(0x7f0000000180)=@rnullb, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='aufs\x00', 0x2090000, 0x0)

2m58.468410346s ago: executing program 2 (id=2324):
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='exfat\x00', 0x200000, 0x0)
r0 = syz_open_dev$usbmon(&(0x7f00000000c0), 0x24, 0x0)
read$usbmon(r0, &(0x7f0000000100)=""/214, 0xd6) (async)
read$usbmon(r0, &(0x7f0000000100)=""/214, 0xd6)

2m57.497490894s ago: executing program 2 (id=2329):
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_print_times', 0x40901, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0xc43, 0x0)
flock(r2, 0x5)
write$FUSE_DIRENT(r1, &(0x7f00000002c0)=ANY=[@ANYRESOCT], 0x200001d0)
connect$tipc(r1, &(0x7f0000000400)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}, 0x3}}, 0x10)
r3 = accept$alg(r0, 0x0, 0x0)
sendmsg$alg(r3, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x94}, 0x41)
recvmmsg(r3, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0xd78a}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/15, 0xf}], 0x1}}], 0x2, 0x10000, 0x0)
mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='proc\x00', 0x200000, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000002c0)=0x20)
mmap$fb(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000004, 0x11, r4, 0x6f000)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000200)={'syztnl2\x00', <r5=>0x0, 0x29, 0x7, 0x9a, 0x3, 0x4a, @private1, @remote, 0x10, 0x20, 0x6, 0xfffffffd}})
sendmsg$nl_route_sched_retired(r4, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000800)=@newchain={0x1c78, 0x64, 0x4, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0x1, 0xa}, {0x6, 0xfff1}}, [@f_rsvp6={{0xa}, {0x420, 0x2, [@TCA_RSVP_POLICE={0x414, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_RATE={0x404, 0x2, [0x75e, 0x9, 0xffffffff, 0x9, 0xa17a, 0x2, 0x0, 0x1ff, 0xf, 0x14723a5a, 0x5, 0xab8, 0x0, 0x6, 0x6, 0x5, 0x3, 0x5, 0x9, 0x7c, 0x81, 0x7, 0x9, 0x6, 0x10, 0x5, 0x7fff, 0x5, 0x8000, 0x5, 0x9, 0x10001, 0x400, 0x9, 0x7546, 0x9, 0x0, 0x2, 0x6, 0x5, 0x7, 0x1000, 0xfffffffd, 0xbf, 0xffff8f89, 0x4, 0x7, 0x7ff, 0x2800, 0x0, 0x80000000, 0x10000000, 0x6, 0xbd8, 0xfffffff6, 0x800, 0x0, 0x3, 0x1, 0x1, 0x6fdf, 0x6, 0x65c, 0x5, 0xd94, 0x0, 0xe02f, 0x1, 0x6, 0x4a, 0x0, 0x1000, 0x2928, 0x401, 0x2, 0x5, 0x4, 0x9777, 0xf272, 0xc, 0xfff, 0x6, 0x0, 0x7, 0x2, 0x7, 0x80000000, 0x3, 0x42, 0x40, 0x8, 0x5, 0x8, 0x81b, 0x2, 0x4562, 0x8, 0x101, 0x0, 0x80, 0x4, 0x1, 0xad, 0x7, 0x80, 0x400, 0x4, 0x401, 0x4, 0x8, 0x100, 0xac3e, 0xff, 0xaff, 0x4, 0x5fddd417, 0x4, 0x1a0d, 0x3, 0x4, 0xe, 0x0, 0xd, 0x8, 0x0, 0xe, 0x5, 0x57fb, 0xffff, 0x9, 0xffffffff, 0x2, 0xfff, 0x800, 0x4, 0x8, 0x5f17, 0xfffffffa, 0x9, 0x9, 0x622, 0x5, 0x80, 0x57af, 0x4, 0x9, 0x0, 0x9, 0xfffffff7, 0x5f, 0x0, 0x1, 0x5, 0x9, 0x3, 0x2, 0x1, 0x5, 0x2, 0x5ce, 0xc, 0x6fb8, 0x8, 0x0, 0x81, 0xd7, 0x4, 0x8, 0x6, 0x3, 0xe, 0x3, 0x5, 0x4, 0xff, 0xa, 0x100, 0x5, 0x3, 0x200, 0x8, 0x3, 0x4, 0x4, 0x3, 0x1, 0x8, 0x80, 0x7bf, 0xbe7, 0x4, 0x0, 0xd, 0x7, 0x7, 0x23d062b5, 0x9, 0x703, 0xbd, 0x0, 0x2, 0x9, 0xf, 0x5, 0x100, 0x293, 0x8, 0x3, 0x1, 0x80000001, 0x54, 0x9b1, 0x7ff, 0x4, 0x0, 0x10001, 0x69, 0x8, 0x1, 0xffffffff, 0x4, 0x22a, 0x289, 0x10000000, 0xa, 0xd292, 0x6, 0x8, 0x8, 0x80, 0x6, 0xffff, 0x8, 0xffffffff, 0x80000001, 0x0, 0x3, 0x1, 0x9d, 0x401, 0x1, 0xcb68, 0x3, 0x6, 0x40, 0xc04d, 0x1846, 0x9, 0x3, 0x1, 0x4, 0x19, 0x39, 0x2, 0x0, 0x1]}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0xfff2, 0x7}}]}}, @f_rsvp6={{0xa}, {0x17f8, 0x2, [@TCA_RSVP_ACT={0x12fc, 0x6, [@m_nat={0x48, 0x7, 0x0, 0x0, {{0x8}, {0x4}, {0x20, 0x6, "f15e111d6d7a0f37b748c0ded36f1757cc0f281d7e4f80b2387f1f93"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_csum={0x10f4, 0x11, 0x0, 0x0, {{0x9}, {0xc8, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x0, 0x20000000, 0x0, 0x100}, 0x2d}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0xe08, 0x5, 0x6, 0x1}, 0x52}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x5, 0xa, 0x8, 0x4}, 0x4a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x5, 0xff, 0x6, 0x0, 0x95f8}, 0x2f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xe, 0x101, 0xffffffffffffffff, 0x3}, 0xf}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x200, 0xfffffffe, 0x20000000, 0x0, 0x400}, 0x47}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x0, 0xffffffffffffffff, 0x6, 0x400}, 0x60}}]}, {0x1004, 0x6, "29af72d8dda01a334f3c3aacd3e8a184c0438763bba9302fd2186df940e32229fb10be4bf119a8d0630fc173c39cc788d003c394d3bc688319431f0e82f544ccd71da41387742f11ea26b3fa13975fb630c48f9bee9b7f9b26bff290f5f6d49a9c8030208d028be8654583c54e3af94ac4dfe7e0a9dcff9c4378ef2b786765132298e33c4a0e94ac1fc0348e18b4850d9353e14a77d35aedd80332ed85c53141dbd7291d15b5c568c7b706b006694cb4c2e7eafba3fadf83e3feb3a9551d181009da59f292011744a71ba83c215e48c1ff3c2fb76dcc60b9ca41dda22ae8f804ab662cdd8315db7899f2fb44617b0d7ab148f166aeab1f0954bf610bea55c9df35a7b43caa530e6f1fb16e77f9ed9d10d61a90be77e6bd0c916059a726e22059cc80215bd2d201fd3ffa35ec48c0965aa81aa3c530e53af5a767bcf5c2c92ae4cdc2bd8bfe5b18d440bf904862dd21a7030f338bfc53490dede6289e45bbb263178f0d2be6b6ac2d5a195d72041eaa0ffeebbce44c49e8295011dec4eea9d8a441c13502daa4361b7d42ddb4d75a58fa7c4aaa73feaaaac8450b518fd00fed4392208604eec72f9cdc361b82448828ef7d921e4b557a3411817c1454c4a5a1235d3c473681773ab9f4a96e209fd1a4ce93038b4d7402dcba27caa5f3f800a9d8771dc37d9c9f1aabf2c47df0725717d0e924a67288698ff09c5f76550ccd30b536b41db020a6bc4afcc0485cafe79fa34218e5cd4994153aa3f79f8de554039f248784ceb468293860632382d1bb472871ccc479a3fc5ed8873b9bfa60f365656f278f3596d9cdeac5214bb08b39d3408713c0e93c4d099aec44d7273bf5874a5775e8102c1687984a2892fc86e73f72a79ef2c9d516e67f45c8129d562648a51fbd37adfef41a4c381284a260b631a8a8055509be4327505f9d515faa1c273017215e32e72ebc94eff80564272fc61d0722bb749f6e63555bcfc710781823c470adb3ab4ee06399570442628fbdef6503451df01280147e32e4d5e68805e4c667763fd65b08aefb7b5c58bea77e0d3d2b59683b50f78cf2ae24b103b6a399f3a81342bc284ed156a7a30f7dbf5981f39d20afc1aaff299f48af6a9e7ac7f7a87d9c0b78cf61d9bd564c34c0eb2d1602dc543ef29a1522f37a3d064e6bcac0f38f9ea9478e7f74f7cb8280fd766e6d17ad618d3de0b5e322aa272d3605541809e73c506a3c4bbc294b5abcd015d9065d64e7345ff6e92219f9a3cfb9dea6400cf2c8fac49bd613257a7bb45b5eec80f0bfc282679339eac2b3f508476b8b9afe6a65915465d717680fefe5b33dcbc42a3f4bac5a85303caa7b17964b20d993ddac154da12b4c9cbd6fb842cb2f232822b02c9200f53709b3aa35c8300b676231273947f795499c91c00f98ad41e000611011e93d8006d0f407cceb29ce94c1a05db25d570380936929caa7f58cde931686c75f98365c5f52d3bcf7d322607dde2fe5573038e4b81e49b6d0096f1f968bab09e97f7bab1b0087fb3f2dc095068e20a0d1db91b4c014b7f82e78a6839ba917361132b11d6f105642d88dcaa624a4cbcb11ade39cffe0e2f283dc1ea5f75b21cd099aff52856021eae8a22518782ae5e9b5e9c81f22837c1d26a17425cfb2d8b7419dc0faaf9a611576154fc452f0174ef819416023b0e4ffa593813fcc22122a4fcea16f7104ade71721a9c4161ba0275bd8700cc986d20d131d32604b3a7c9ede23b811cce185825698f177c847dfe7d990f5108342c62fd729e63d0f0b367d42063bbd99fb2e126e42c9681018826f44d16c3c9bbfed0c31135894b2c9c21926fdc566d6ee39f0db1f0eb0a203c33973ad7899f6b657161f879112c680244cd66ab14d63ea021e9d580f54e5fd01ebe0458729a7975ce0b9e7abced232e789dc22d21ea66f3969fce41c3f7643bd5af23a80827417b365bf97e64b9ac2c57b8cbcad0d3c48904c91fea3164d75f72d45d9fbd810dbac55abd4cf3c1a547f23db4ffeeb139cc1836b916c35195e5081ffd01c35f17a1de112ec84bcdb0051a58cd8ce2583cdd71136aae89a48b45f63958b195d99bd5f6ab82cfaaf227a02d48752c29325c32aa1c6f2c4736c3e0376637af9cc37465d3adeb5857268880a614e6dcadfd33737ce7743b5813c7a71c8d2a8dd5225a9ea14c5ac0e8d9250632ec9c902a8e616d7835851ecec725ede10bb514a612345a67bbc0b4236d2522f563969e4824ca0ec20472beff443eeb96c446bb34dde24fa9bcbde380fb5f60feb29604b571eae64480a877c6d6e30e445e0dfa26587cf39e05f88c2af55fd0a1cf22896e0d547d4ab39e2f8642ac9a71cacc4a1662c86ff6056001e39a1f97fe0acc08517d998d7ec836c69d6ca3bf451fe6d04be00ca95effb111407df319461b4b0ee8c4547bdf56edc93a961a7cb63537075ce0565c05bed544fe0f56a8169fd95dd9fbebaa8470cdd4473da0764b8bd5072e516a2e050433b18932544f645142474a967985bd44f2d79d76280d7027b90ceed90b737dc62f88282a44ea5c09673174f57d29002366f7124a93277be073ad6cc2eb824eba18bb23826effcbc3473631643a9c8fd13ad820b7eb13a09e72f7968c412d0c34a2d68ffff7a6bfc727f284d490d3669dd95474928386653bd959ce7160bbb955b631c2e3731490b43a5467854c0c014006d3865b219367dc96bc18c972d5df333cbf4bfe44e167e865d1104512ea49cb866550437a3e45f2533ea2cae357990d32e3a3c08b2c4d073d18baa2d3a3491d417518b4b9c8b869b353362a4f9ad7c8c55282d6b2622571f017db21795b2515a906a9d56ec97c642f86eee7a6a10541bdc1a5fc7592a3f08bb3b8581d7254ce2b07131f276c6f51531596524847a6ec0d4ea54d7b42663db4ab651bb68c86d874a92ca3603b13b4bafd1b00db63c492e301e939fac07ff11cacdfc8f585aeadd65fe1e772a6560362d409a5da1e3a6b29820eb9388138976b10e4c9ffbe14707ffafa47971423ea450d24ef63422fc15ec23d99a8b662f1dbf3d83fded8f14e7484f8f8c1541045c8e066abefb3b7c1f43a40bb8e26f70e6aeed0e2d834da41e22c037ad9eba5be939abf0284bc9707bf1760afb468f0dc0718b08db127e83184f9ca96cecf7a4b01637127a671a931a96c6a68855b87eaf321509aa79a5e75f85b952f71342ce1cc067a93816f6095278ca0b97d5cd4386c70f4786515693c085b2e59abcaa29ac0c7a3c5017c7205ef6b7506287d87ba604be9fade179e94b537d4bfca21779d35018bbb67cc4b5c1d72a8835b76caed0294e8f6bb5fe492772a4f89b0364c44f83afe49e70a99d26f6f924636d6f7a84abd7a733b87533d32b70826b6a8b8e19459f9f04d6d843408a8253f31e31d8b1bba02a208736586b8611cc0c114a6e69f38b6b3b22d8309f9981767e89d27678c0a44a1386f84f2aa24e22bcf2eb569f6017b120fd4797d28721c0b1199a2ddb1287f4fe5fb4a705c23b9e42619a4ca25d59a21396a7dae6357ed3dab6f73b4af68f8bd33a7b1b0052fc79bfbfd382e970bfad36086dd8b353449ea10d91c82c2ec5b9d8ddb3ae6fa77c01af7c35f37770f3bd7dffe22ac2fbc1ba975e8d1dfb37b6a87684a89b38af8203edee0e74b0d96663985b5d063f7380e8711efa367b5102305169cd1e462c758074cc7eaea73e17c9fa7b091a2541d26b52c5436c808b0831bcc3bc8b4d9728ec9b2a6385acde10fb2bae273507be80473692ce66d9cf965a08cc445f8dd355b856a45a7c87836cade15dd164898a1ab07813115b3837ef1ac4950cb6969eb7f8a0e4ea09a3b85b01ebf62daae84a8ee2abd07c6207aeadb6ad02454f97822c9b31f3573e7ead607e28205bca94299cd529a990b70ce0e0568fa3aa8f2235c40be91cbb54c951604e860fb69b5ea55eb55b2f30ba30d67eed3183ac8cfb748bf13c5c697a02d71eed04a24d2fa0e5b277483e8af5640379cfcffc83fb7a5ea42ea78f033d34324a310f9117c232ff560a59a56cbda6c6e310dc3e42bc8bf8c677fbb4ec16f7e2fb3b464772209711380c5541100476b6869e1b500fca9fd8276c28fcefef78fac7594883e41b8105e88a7473a509896a7ebddca597728884097cea4e0ba1b7f18b4dd7cc820637b75b8a70c3532aa6d613d863dfa6f8d72d83b5b4ddd860dfe71c8e8b6d3333ac90c31b66105f6eb47b608eba602901d658cdf94c365f96a7a64eb18d864585d919d51fba62cc09fa1fd780065e79c751a5f5a9e77418faab974c1b7868d44a28a4ac4394bb9233146e9b74d47e5ee13eadc71aa84685d01a47889fea791b7f131c343d0ad78a448c8acb1d4db94953f2db84f5d9e28b2d52bea58d6577d66930f8327ee49eca4d33c3bd1e6b8bac18152f7815ca2c28552e667319184916f610cf9767858c7c1844bc9cd318faf6e2c71413e7898b3488756a73039dfe7ad1c56192becbb51aeb272fa23eddf11f1dca0408d67982e755e3f0cd17183aabd6e5096d7a9be48586f3b922ddb6a5ebc932ac37cf56ee71fa69bd9f0e536dfacc3aa999d57bf74958ebe719d85147f881cbd57d5e45c9950b4dc5768b3de19531bf57a0048b1b9c38663e01567dd2e6d3582ed22cc414df538d67cdb9ded7c302526b556ebcf8cf51329bb210b1851f6ae9e09c4c287ec536ec6f6f866b0229472bcc8f72eb24a98d7fc7fe35a130c8b20140b76631621608f1ed08f43da983dd7c8eb1ad9f699a970d331435301006f99ff5031b9b9ff3949e9411432d22260bbd74e4d345fae6582bac53a49dc5d5116a9cc1d4c3ee077ff063aaa175652996c87a8c5c261381998bee39430020f9f4306a8f3a4ecef24e1d7260b2cff5b3521c200e627be5408e1bc600aa555bf737cfab81692f87fa7d69eef4682429c583da6ab98d1167f3e7b0ef5cbb5e633799a46116c1d26be7c253b341615c36627a86b45ff1d2ead31e75cb825331d5541eb5c8d48b5297bc532af18bd82200d81d8ab3b842ef183e852aa03f319885d09a2fd5210a4b9558ae394e293d7ee5b9ccfbacfb035c87ed79b14cfe2ae69403009ff8c6dca94aba5134cd788cbce7b5a1ccd75f71c8fd6b1128c96e0e52b670d58372389822b763462e594f8d9e045b2f9d4b3898d72dd208023908e6c28c0465b8858e8c1acbca01a0b44b3e1db845e92e9ed9cbab4d32940abb80f85abfb91b724c6f653fb140d457317c9fbbd68a29ed62e973d8191c2612da90cc3d7b0ec9819436d88fa33b6ef58edf19f36c510706671306f6aca03f3906c20d621b0b8d97ee52421945ef695224f3f9b9d934fdfa3720e176ec560ff1f6f11f527c532d7e8f8ad974b940b60e43e29b8ddcac392723436f6fd71eb00d4cce417e0ec90ac9c2830f316112a843caae939e92510a44c8ab9c0194ee449652267b85776685a1780b41ccf1923b3e28d83c0c7cc6c25740fc52f74582208f3624f65ea2ba0ecf9f042486a851f878f5824ce616b9c240d8e0f591f10895e1e16a0013bd6f44103a9761169c63bf7772c074e8ecd32f3148f87ab0c35949c99feaed6ee66b4729e6040a2dc156248112b0bea1de9d35aa24fa0ecfd9484e076c66acafc2cf291ff17e8412ccadbbbb241ebeef6387cc3d65687bd376fc671b48337cdfc97dbba3c73bd6f5fd2b91a2e4a738728bb2d407244a78559bdf7b588b68f31ab2ce656889716fb0693b748152a8c11406ce704e8df206beb4485b7d0fed38f785147ce5a98c72f76a"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_skbmod={0x120, 0x3, 0x0, 0x0, {{0xb}, {0x9c, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x31, 0xf, 0x10000000, 0x1400000, 0x1}, 0x10}}, @TCA_SKBMOD_SMAC={0xa, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @TCA_SKBMOD_SMAC={0xa}, @TCA_SKBMOD_DMAC={0xa, 0x3, @multicast}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x1000, 0x7b, 0x7, 0x7, 0x6}, 0x2}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @multicast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @broadcast}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x2}]}, {0x59, 0x6, "b2e5d4b0f5c40be14af3c83f51ccf282479d779d1b6687513525b2ac5a7d93e6242892354d22dc02f72ba72520778a8929966f36acd42a23caa4dcbcc751fc4a88cd8f4e4e121ee53d22d04f05856681aaf9233dea"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_vlan={0x9c, 0x9, 0x0, 0x0, {{0x9}, {0x5c, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0xa, 0x6, 0x9, 0x1}, 0x1}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x9a6}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x73c}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x5}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xba4}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0x6, 0x2, 0x4f1b275, 0x1ff}, 0x1}}]}, {0x17, 0x6, "570ec2205002a80cb99ff216a54c22b538f4cd"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x8571, 0xd, 0x5}, {0x6, 0x81, 0xe}, 0x11, 0x7, 0x1}}, @TCA_RSVP_POLICE={0x4a4, 0x5, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x5}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x4fc6}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x8, 0x5, 0x7, 0x7ff, {0x10, 0x3, 0xfff9, 0x80, 0x0, 0x3}, {0x3, 0x2, 0x1, 0x6, 0x3, 0x7}, 0xfffffffc, 0xfffffff7, 0x2}}, @TCA_POLICE_TBF={0x3c, 0x1, {0x80000000, 0x5, 0x0, 0x8, 0x80000001, {0x61, 0x0, 0x9, 0x4, 0x2, 0xfffffff8}, {0xa, 0x0, 0x2, 0x5, 0x2, 0x4}, 0x8000, 0x0, 0x4}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xf}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x3ff, 0x9, 0x72, 0x1, 0xfffffff8, 0x1, 0xfa78d2e9, 0x2, 0x2, 0x200000, 0xf2cf, 0xfffffbff, 0x5f20, 0x3, 0x7, 0x4, 0x9, 0x9, 0x50, 0x9, 0x9, 0x8, 0x9, 0x4, 0xbb, 0xa, 0x6, 0x8, 0x10, 0xe, 0x1, 0x7f, 0x6, 0xfffffff4, 0xdd52, 0x7ff, 0x77, 0x9, 0x6, 0x8, 0x6, 0xfffff001, 0xfffffff7, 0x6, 0x10001, 0x30a, 0x80, 0x8, 0x147, 0x3, 0x4, 0x9, 0x7, 0x7, 0x800, 0x46fd06bf, 0x7, 0xc309, 0x2, 0x7a, 0x6d2, 0x6, 0x80000001, 0x9, 0x5f3, 0x3, 0x4, 0x8, 0x8, 0x6, 0x3, 0x5, 0x6, 0x400, 0x7, 0x7ff, 0x86bd, 0x7, 0x61, 0x6, 0xfffffff4, 0x9, 0x7, 0x9, 0x6, 0x2, 0x5, 0xb, 0x62, 0x7, 0x101, 0xd3, 0x7fff, 0x6, 0x8, 0x37, 0x7d05a77e, 0x8, 0x7, 0x4, 0xffffff00, 0x4, 0x6, 0x18, 0x0, 0x9, 0xd, 0x7f, 0x0, 0xc9fa, 0x3, 0x1, 0x6, 0xb, 0x10001, 0x9ce, 0x7ff, 0x817, 0x4, 0x0, 0x5b, 0xf96, 0xb2d, 0x1, 0x4, 0x7f85, 0x10, 0xf5c, 0xffffffff, 0x6, 0x3, 0xffff, 0x1000, 0x4, 0x81, 0x1, 0x9, 0x1, 0x6, 0x35fd, 0x5, 0x1000, 0xfff, 0x6, 0x6, 0x3, 0xd, 0x81, 0x2, 0x2, 0x7fff, 0xfffffff7, 0x8, 0x7fffffff, 0x50, 0x1000, 0x401, 0x40, 0x90f, 0x1, 0x1, 0x6, 0xfffffffd, 0x480000, 0x0, 0xc4, 0x81, 0x81, 0x0, 0x0, 0x1, 0xe, 0x7, 0x1ee12a4a, 0x7fff, 0x33a, 0x80, 0x6, 0x1, 0x9, 0x7, 0x4, 0x3, 0x80000001, 0x0, 0x6, 0xc18, 0x2, 0x96ae, 0x0, 0x1, 0x2472, 0x610, 0x9, 0x9, 0x8398, 0xe2, 0xf, 0x99f, 0x2, 0x1, 0xa, 0x2, 0x8, 0x3, 0x2, 0x81, 0x9, 0xff, 0x0, 0x10, 0xf, 0x2, 0x6, 0x4, 0x2, 0x454, 0x29ced33b, 0xfffffff8, 0xfffffffa, 0x2, 0x0, 0xffff, 0x7fffffff, 0x10, 0xfffffffe, 0x2417e0cf, 0x1, 0x2, 0x14a, 0xaf9, 0x7, 0x1, 0x2, 0x8, 0x6, 0x9, 0x1bbd96ba, 0x4, 0x3, 0x8, 0x3, 0x1, 0x4, 0x1, 0x1, 0x356a64c1, 0x10001, 0xf, 0x5, 0x2, 0x1ff, 0x5, 0x0, 0xe]}]}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x5, 0x3, 0x3ff}, {0x3f, 0x3}, 0x42, 0x9, 0xf}}]}}, @f_rsvp6={{0xa}, {0x18, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private1}]}}]}, 0x1c78}, 0x1, 0x0, 0x0, 0x80}, 0x2000804)
socket$alg(0x26, 0x5, 0x0) (async)
bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) (async)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) (async)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_print_times', 0x40901, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0xc43, 0x0) (async)
flock(r2, 0x5) (async)
write$FUSE_DIRENT(r1, &(0x7f00000002c0)=ANY=[@ANYRESOCT], 0x200001d0) (async)
connect$tipc(r1, &(0x7f0000000400)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}, 0x3}}, 0x10) (async)
accept$alg(r0, 0x0, 0x0) (async)
sendmsg$alg(r3, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x94}, 0x41) (async)
recvmmsg(r3, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0xd78a}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000380)=""/15, 0xf}], 0x1}}], 0x2, 0x10000, 0x0) (async)
mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='proc\x00', 0x200000, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async)
ioctl$FS_IOC_SETFLAGS(r4, 0x40086602, &(0x7f00000002c0)=0x20) (async)
mmap$fb(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000004, 0x11, r4, 0x6f000) (async)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000200)={'syztnl2\x00', 0x0, 0x29, 0x7, 0x9a, 0x3, 0x4a, @private1, @remote, 0x10, 0x20, 0x6, 0xfffffffd}}) (async)
sendmsg$nl_route_sched_retired(r4, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000800)=@newchain={0x1c78, 0x64, 0x4, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x6}, {0x1, 0xa}, {0x6, 0xfff1}}, [@f_rsvp6={{0xa}, {0x420, 0x2, [@TCA_RSVP_POLICE={0x414, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_RATE={0x404, 0x2, [0x75e, 0x9, 0xffffffff, 0x9, 0xa17a, 0x2, 0x0, 0x1ff, 0xf, 0x14723a5a, 0x5, 0xab8, 0x0, 0x6, 0x6, 0x5, 0x3, 0x5, 0x9, 0x7c, 0x81, 0x7, 0x9, 0x6, 0x10, 0x5, 0x7fff, 0x5, 0x8000, 0x5, 0x9, 0x10001, 0x400, 0x9, 0x7546, 0x9, 0x0, 0x2, 0x6, 0x5, 0x7, 0x1000, 0xfffffffd, 0xbf, 0xffff8f89, 0x4, 0x7, 0x7ff, 0x2800, 0x0, 0x80000000, 0x10000000, 0x6, 0xbd8, 0xfffffff6, 0x800, 0x0, 0x3, 0x1, 0x1, 0x6fdf, 0x6, 0x65c, 0x5, 0xd94, 0x0, 0xe02f, 0x1, 0x6, 0x4a, 0x0, 0x1000, 0x2928, 0x401, 0x2, 0x5, 0x4, 0x9777, 0xf272, 0xc, 0xfff, 0x6, 0x0, 0x7, 0x2, 0x7, 0x80000000, 0x3, 0x42, 0x40, 0x8, 0x5, 0x8, 0x81b, 0x2, 0x4562, 0x8, 0x101, 0x0, 0x80, 0x4, 0x1, 0xad, 0x7, 0x80, 0x400, 0x4, 0x401, 0x4, 0x8, 0x100, 0xac3e, 0xff, 0xaff, 0x4, 0x5fddd417, 0x4, 0x1a0d, 0x3, 0x4, 0xe, 0x0, 0xd, 0x8, 0x0, 0xe, 0x5, 0x57fb, 0xffff, 0x9, 0xffffffff, 0x2, 0xfff, 0x800, 0x4, 0x8, 0x5f17, 0xfffffffa, 0x9, 0x9, 0x622, 0x5, 0x80, 0x57af, 0x4, 0x9, 0x0, 0x9, 0xfffffff7, 0x5f, 0x0, 0x1, 0x5, 0x9, 0x3, 0x2, 0x1, 0x5, 0x2, 0x5ce, 0xc, 0x6fb8, 0x8, 0x0, 0x81, 0xd7, 0x4, 0x8, 0x6, 0x3, 0xe, 0x3, 0x5, 0x4, 0xff, 0xa, 0x100, 0x5, 0x3, 0x200, 0x8, 0x3, 0x4, 0x4, 0x3, 0x1, 0x8, 0x80, 0x7bf, 0xbe7, 0x4, 0x0, 0xd, 0x7, 0x7, 0x23d062b5, 0x9, 0x703, 0xbd, 0x0, 0x2, 0x9, 0xf, 0x5, 0x100, 0x293, 0x8, 0x3, 0x1, 0x80000001, 0x54, 0x9b1, 0x7ff, 0x4, 0x0, 0x10001, 0x69, 0x8, 0x1, 0xffffffff, 0x4, 0x22a, 0x289, 0x10000000, 0xa, 0xd292, 0x6, 0x8, 0x8, 0x80, 0x6, 0xffff, 0x8, 0xffffffff, 0x80000001, 0x0, 0x3, 0x1, 0x9d, 0x401, 0x1, 0xcb68, 0x3, 0x6, 0x40, 0xc04d, 0x1846, 0x9, 0x3, 0x1, 0x4, 0x19, 0x39, 0x2, 0x0, 0x1]}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0xfff2, 0x7}}]}}, @f_rsvp6={{0xa}, {0x17f8, 0x2, [@TCA_RSVP_ACT={0x12fc, 0x6, [@m_nat={0x48, 0x7, 0x0, 0x0, {{0x8}, {0x4}, {0x20, 0x6, "f15e111d6d7a0f37b748c0ded36f1757cc0f281d7e4f80b2387f1f93"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_csum={0x10f4, 0x11, 0x0, 0x0, {{0x9}, {0xc8, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x0, 0x20000000, 0x0, 0x100}, 0x2d}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0xe08, 0x5, 0x6, 0x1}, 0x52}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x5, 0xa, 0x8, 0x4}, 0x4a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x5, 0xff, 0x6, 0x0, 0x95f8}, 0x2f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xe, 0x101, 0xffffffffffffffff, 0x3}, 0xf}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x200, 0xfffffffe, 0x20000000, 0x0, 0x400}, 0x47}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x2, 0x0, 0xffffffffffffffff, 0x6, 0x400}, 0x60}}]}, {0x1004, 0x6, "29af72d8dda01a334f3c3aacd3e8a184c0438763bba9302fd2186df940e32229fb10be4bf119a8d0630fc173c39cc788d003c394d3bc688319431f0e82f544ccd71da41387742f11ea26b3fa13975fb630c48f9bee9b7f9b26bff290f5f6d49a9c8030208d028be8654583c54e3af94ac4dfe7e0a9dcff9c4378ef2b786765132298e33c4a0e94ac1fc0348e18b4850d9353e14a77d35aedd80332ed85c53141dbd7291d15b5c568c7b706b006694cb4c2e7eafba3fadf83e3feb3a9551d181009da59f292011744a71ba83c215e48c1ff3c2fb76dcc60b9ca41dda22ae8f804ab662cdd8315db7899f2fb44617b0d7ab148f166aeab1f0954bf610bea55c9df35a7b43caa530e6f1fb16e77f9ed9d10d61a90be77e6bd0c916059a726e22059cc80215bd2d201fd3ffa35ec48c0965aa81aa3c530e53af5a767bcf5c2c92ae4cdc2bd8bfe5b18d440bf904862dd21a7030f338bfc53490dede6289e45bbb263178f0d2be6b6ac2d5a195d72041eaa0ffeebbce44c49e8295011dec4eea9d8a441c13502daa4361b7d42ddb4d75a58fa7c4aaa73feaaaac8450b518fd00fed4392208604eec72f9cdc361b82448828ef7d921e4b557a3411817c1454c4a5a1235d3c473681773ab9f4a96e209fd1a4ce93038b4d7402dcba27caa5f3f800a9d8771dc37d9c9f1aabf2c47df0725717d0e924a67288698ff09c5f76550ccd30b536b41db020a6bc4afcc0485cafe79fa34218e5cd4994153aa3f79f8de554039f248784ceb468293860632382d1bb472871ccc479a3fc5ed8873b9bfa60f365656f278f3596d9cdeac5214bb08b39d3408713c0e93c4d099aec44d7273bf5874a5775e8102c1687984a2892fc86e73f72a79ef2c9d516e67f45c8129d562648a51fbd37adfef41a4c381284a260b631a8a8055509be4327505f9d515faa1c273017215e32e72ebc94eff80564272fc61d0722bb749f6e63555bcfc710781823c470adb3ab4ee06399570442628fbdef6503451df01280147e32e4d5e68805e4c667763fd65b08aefb7b5c58bea77e0d3d2b59683b50f78cf2ae24b103b6a399f3a81342bc284ed156a7a30f7dbf5981f39d20afc1aaff299f48af6a9e7ac7f7a87d9c0b78cf61d9bd564c34c0eb2d1602dc543ef29a1522f37a3d064e6bcac0f38f9ea9478e7f74f7cb8280fd766e6d17ad618d3de0b5e322aa272d3605541809e73c506a3c4bbc294b5abcd015d9065d64e7345ff6e92219f9a3cfb9dea6400cf2c8fac49bd613257a7bb45b5eec80f0bfc282679339eac2b3f508476b8b9afe6a65915465d717680fefe5b33dcbc42a3f4bac5a85303caa7b17964b20d993ddac154da12b4c9cbd6fb842cb2f232822b02c9200f53709b3aa35c8300b676231273947f795499c91c00f98ad41e000611011e93d8006d0f407cceb29ce94c1a05db25d570380936929caa7f58cde931686c75f98365c5f52d3bcf7d322607dde2fe5573038e4b81e49b6d0096f1f968bab09e97f7bab1b0087fb3f2dc095068e20a0d1db91b4c014b7f82e78a6839ba917361132b11d6f105642d88dcaa624a4cbcb11ade39cffe0e2f283dc1ea5f75b21cd099aff52856021eae8a22518782ae5e9b5e9c81f22837c1d26a17425cfb2d8b7419dc0faaf9a611576154fc452f0174ef819416023b0e4ffa593813fcc22122a4fcea16f7104ade71721a9c4161ba0275bd8700cc986d20d131d32604b3a7c9ede23b811cce185825698f177c847dfe7d990f5108342c62fd729e63d0f0b367d42063bbd99fb2e126e42c9681018826f44d16c3c9bbfed0c31135894b2c9c21926fdc566d6ee39f0db1f0eb0a203c33973ad7899f6b657161f879112c680244cd66ab14d63ea021e9d580f54e5fd01ebe0458729a7975ce0b9e7abced232e789dc22d21ea66f3969fce41c3f7643bd5af23a80827417b365bf97e64b9ac2c57b8cbcad0d3c48904c91fea3164d75f72d45d9fbd810dbac55abd4cf3c1a547f23db4ffeeb139cc1836b916c35195e5081ffd01c35f17a1de112ec84bcdb0051a58cd8ce2583cdd71136aae89a48b45f63958b195d99bd5f6ab82cfaaf227a02d48752c29325c32aa1c6f2c4736c3e0376637af9cc37465d3adeb5857268880a614e6dcadfd33737ce7743b5813c7a71c8d2a8dd5225a9ea14c5ac0e8d9250632ec9c902a8e616d7835851ecec725ede10bb514a612345a67bbc0b4236d2522f563969e4824ca0ec20472beff443eeb96c446bb34dde24fa9bcbde380fb5f60feb29604b571eae64480a877c6d6e30e445e0dfa26587cf39e05f88c2af55fd0a1cf22896e0d547d4ab39e2f8642ac9a71cacc4a1662c86ff6056001e39a1f97fe0acc08517d998d7ec836c69d6ca3bf451fe6d04be00ca95effb111407df319461b4b0ee8c4547bdf56edc93a961a7cb63537075ce0565c05bed544fe0f56a8169fd95dd9fbebaa8470cdd4473da0764b8bd5072e516a2e050433b18932544f645142474a967985bd44f2d79d76280d7027b90ceed90b737dc62f88282a44ea5c09673174f57d29002366f7124a93277be073ad6cc2eb824eba18bb23826effcbc3473631643a9c8fd13ad820b7eb13a09e72f7968c412d0c34a2d68ffff7a6bfc727f284d490d3669dd95474928386653bd959ce7160bbb955b631c2e3731490b43a5467854c0c014006d3865b219367dc96bc18c972d5df333cbf4bfe44e167e865d1104512ea49cb866550437a3e45f2533ea2cae357990d32e3a3c08b2c4d073d18baa2d3a3491d417518b4b9c8b869b353362a4f9ad7c8c55282d6b2622571f017db21795b2515a906a9d56ec97c642f86eee7a6a10541bdc1a5fc7592a3f08bb3b8581d7254ce2b07131f276c6f51531596524847a6ec0d4ea54d7b42663db4ab651bb68c86d874a92ca3603b13b4bafd1b00db63c492e301e939fac07ff11cacdfc8f585aeadd65fe1e772a6560362d409a5da1e3a6b29820eb9388138976b10e4c9ffbe14707ffafa47971423ea450d24ef63422fc15ec23d99a8b662f1dbf3d83fded8f14e7484f8f8c1541045c8e066abefb3b7c1f43a40bb8e26f70e6aeed0e2d834da41e22c037ad9eba5be939abf0284bc9707bf1760afb468f0dc0718b08db127e83184f9ca96cecf7a4b01637127a671a931a96c6a68855b87eaf321509aa79a5e75f85b952f71342ce1cc067a93816f6095278ca0b97d5cd4386c70f4786515693c085b2e59abcaa29ac0c7a3c5017c7205ef6b7506287d87ba604be9fade179e94b537d4bfca21779d35018bbb67cc4b5c1d72a8835b76caed0294e8f6bb5fe492772a4f89b0364c44f83afe49e70a99d26f6f924636d6f7a84abd7a733b87533d32b70826b6a8b8e19459f9f04d6d843408a8253f31e31d8b1bba02a208736586b8611cc0c114a6e69f38b6b3b22d8309f9981767e89d27678c0a44a1386f84f2aa24e22bcf2eb569f6017b120fd4797d28721c0b1199a2ddb1287f4fe5fb4a705c23b9e42619a4ca25d59a21396a7dae6357ed3dab6f73b4af68f8bd33a7b1b0052fc79bfbfd382e970bfad36086dd8b353449ea10d91c82c2ec5b9d8ddb3ae6fa77c01af7c35f37770f3bd7dffe22ac2fbc1ba975e8d1dfb37b6a87684a89b38af8203edee0e74b0d96663985b5d063f7380e8711efa367b5102305169cd1e462c758074cc7eaea73e17c9fa7b091a2541d26b52c5436c808b0831bcc3bc8b4d9728ec9b2a6385acde10fb2bae273507be80473692ce66d9cf965a08cc445f8dd355b856a45a7c87836cade15dd164898a1ab07813115b3837ef1ac4950cb6969eb7f8a0e4ea09a3b85b01ebf62daae84a8ee2abd07c6207aeadb6ad02454f97822c9b31f3573e7ead607e28205bca94299cd529a990b70ce0e0568fa3aa8f2235c40be91cbb54c951604e860fb69b5ea55eb55b2f30ba30d67eed3183ac8cfb748bf13c5c697a02d71eed04a24d2fa0e5b277483e8af5640379cfcffc83fb7a5ea42ea78f033d34324a310f9117c232ff560a59a56cbda6c6e310dc3e42bc8bf8c677fbb4ec16f7e2fb3b464772209711380c5541100476b6869e1b500fca9fd8276c28fcefef78fac7594883e41b8105e88a7473a509896a7ebddca597728884097cea4e0ba1b7f18b4dd7cc820637b75b8a70c3532aa6d613d863dfa6f8d72d83b5b4ddd860dfe71c8e8b6d3333ac90c31b66105f6eb47b608eba602901d658cdf94c365f96a7a64eb18d864585d919d51fba62cc09fa1fd780065e79c751a5f5a9e77418faab974c1b7868d44a28a4ac4394bb9233146e9b74d47e5ee13eadc71aa84685d01a47889fea791b7f131c343d0ad78a448c8acb1d4db94953f2db84f5d9e28b2d52bea58d6577d66930f8327ee49eca4d33c3bd1e6b8bac18152f7815ca2c28552e667319184916f610cf9767858c7c1844bc9cd318faf6e2c71413e7898b3488756a73039dfe7ad1c56192becbb51aeb272fa23eddf11f1dca0408d67982e755e3f0cd17183aabd6e5096d7a9be48586f3b922ddb6a5ebc932ac37cf56ee71fa69bd9f0e536dfacc3aa999d57bf74958ebe719d85147f881cbd57d5e45c9950b4dc5768b3de19531bf57a0048b1b9c38663e01567dd2e6d3582ed22cc414df538d67cdb9ded7c302526b556ebcf8cf51329bb210b1851f6ae9e09c4c287ec536ec6f6f866b0229472bcc8f72eb24a98d7fc7fe35a130c8b20140b76631621608f1ed08f43da983dd7c8eb1ad9f699a970d331435301006f99ff5031b9b9ff3949e9411432d22260bbd74e4d345fae6582bac53a49dc5d5116a9cc1d4c3ee077ff063aaa175652996c87a8c5c261381998bee39430020f9f4306a8f3a4ecef24e1d7260b2cff5b3521c200e627be5408e1bc600aa555bf737cfab81692f87fa7d69eef4682429c583da6ab98d1167f3e7b0ef5cbb5e633799a46116c1d26be7c253b341615c36627a86b45ff1d2ead31e75cb825331d5541eb5c8d48b5297bc532af18bd82200d81d8ab3b842ef183e852aa03f319885d09a2fd5210a4b9558ae394e293d7ee5b9ccfbacfb035c87ed79b14cfe2ae69403009ff8c6dca94aba5134cd788cbce7b5a1ccd75f71c8fd6b1128c96e0e52b670d58372389822b763462e594f8d9e045b2f9d4b3898d72dd208023908e6c28c0465b8858e8c1acbca01a0b44b3e1db845e92e9ed9cbab4d32940abb80f85abfb91b724c6f653fb140d457317c9fbbd68a29ed62e973d8191c2612da90cc3d7b0ec9819436d88fa33b6ef58edf19f36c510706671306f6aca03f3906c20d621b0b8d97ee52421945ef695224f3f9b9d934fdfa3720e176ec560ff1f6f11f527c532d7e8f8ad974b940b60e43e29b8ddcac392723436f6fd71eb00d4cce417e0ec90ac9c2830f316112a843caae939e92510a44c8ab9c0194ee449652267b85776685a1780b41ccf1923b3e28d83c0c7cc6c25740fc52f74582208f3624f65ea2ba0ecf9f042486a851f878f5824ce616b9c240d8e0f591f10895e1e16a0013bd6f44103a9761169c63bf7772c074e8ecd32f3148f87ab0c35949c99feaed6ee66b4729e6040a2dc156248112b0bea1de9d35aa24fa0ecfd9484e076c66acafc2cf291ff17e8412ccadbbbb241ebeef6387cc3d65687bd376fc671b48337cdfc97dbba3c73bd6f5fd2b91a2e4a738728bb2d407244a78559bdf7b588b68f31ab2ce656889716fb0693b748152a8c11406ce704e8df206beb4485b7d0fed38f785147ce5a98c72f76a"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_skbmod={0x120, 0x3, 0x0, 0x0, {{0xb}, {0x9c, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x31, 0xf, 0x10000000, 0x1400000, 0x1}, 0x10}}, @TCA_SKBMOD_SMAC={0xa, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, @TCA_SKBMOD_SMAC={0xa}, @TCA_SKBMOD_DMAC={0xa, 0x3, @multicast}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x1000, 0x7b, 0x7, 0x7, 0x6}, 0x2}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @remote}, @TCA_SKBMOD_SMAC={0xa, 0x4, @multicast}, @TCA_SKBMOD_SMAC={0xa, 0x4, @broadcast}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0x2}]}, {0x59, 0x6, "b2e5d4b0f5c40be14af3c83f51ccf282479d779d1b6687513525b2ac5a7d93e6242892354d22dc02f72ba72520778a8929966f36acd42a23caa4dcbcc751fc4a88cd8f4e4e121ee53d22d04f05856681aaf9233dea"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}, @m_vlan={0x9c, 0x9, 0x0, 0x0, {{0x9}, {0x5c, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0xa, 0x6, 0x9, 0x1}, 0x1}}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x9a6}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x73c}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x5}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xba4}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x5, 0x6, 0x2, 0x4f1b275, 0x1ff}, 0x1}}]}, {0x17, 0x6, "570ec2205002a80cb99ff216a54c22b538f4cd"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x8571, 0xd, 0x5}, {0x6, 0x81, 0xe}, 0x11, 0x7, 0x1}}, @TCA_RSVP_POLICE={0x4a4, 0x5, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x5}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x4fc6}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x8, 0x5, 0x7, 0x7ff, {0x10, 0x3, 0xfff9, 0x80, 0x0, 0x3}, {0x3, 0x2, 0x1, 0x6, 0x3, 0x7}, 0xfffffffc, 0xfffffff7, 0x2}}, @TCA_POLICE_TBF={0x3c, 0x1, {0x80000000, 0x5, 0x0, 0x8, 0x80000001, {0x61, 0x0, 0x9, 0x4, 0x2, 0xfffffff8}, {0xa, 0x0, 0x2, 0x5, 0x2, 0x4}, 0x8000, 0x0, 0x4}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0xf}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x3ff, 0x9, 0x72, 0x1, 0xfffffff8, 0x1, 0xfa78d2e9, 0x2, 0x2, 0x200000, 0xf2cf, 0xfffffbff, 0x5f20, 0x3, 0x7, 0x4, 0x9, 0x9, 0x50, 0x9, 0x9, 0x8, 0x9, 0x4, 0xbb, 0xa, 0x6, 0x8, 0x10, 0xe, 0x1, 0x7f, 0x6, 0xfffffff4, 0xdd52, 0x7ff, 0x77, 0x9, 0x6, 0x8, 0x6, 0xfffff001, 0xfffffff7, 0x6, 0x10001, 0x30a, 0x80, 0x8, 0x147, 0x3, 0x4, 0x9, 0x7, 0x7, 0x800, 0x46fd06bf, 0x7, 0xc309, 0x2, 0x7a, 0x6d2, 0x6, 0x80000001, 0x9, 0x5f3, 0x3, 0x4, 0x8, 0x8, 0x6, 0x3, 0x5, 0x6, 0x400, 0x7, 0x7ff, 0x86bd, 0x7, 0x61, 0x6, 0xfffffff4, 0x9, 0x7, 0x9, 0x6, 0x2, 0x5, 0xb, 0x62, 0x7, 0x101, 0xd3, 0x7fff, 0x6, 0x8, 0x37, 0x7d05a77e, 0x8, 0x7, 0x4, 0xffffff00, 0x4, 0x6, 0x18, 0x0, 0x9, 0xd, 0x7f, 0x0, 0xc9fa, 0x3, 0x1, 0x6, 0xb, 0x10001, 0x9ce, 0x7ff, 0x817, 0x4, 0x0, 0x5b, 0xf96, 0xb2d, 0x1, 0x4, 0x7f85, 0x10, 0xf5c, 0xffffffff, 0x6, 0x3, 0xffff, 0x1000, 0x4, 0x81, 0x1, 0x9, 0x1, 0x6, 0x35fd, 0x5, 0x1000, 0xfff, 0x6, 0x6, 0x3, 0xd, 0x81, 0x2, 0x2, 0x7fff, 0xfffffff7, 0x8, 0x7fffffff, 0x50, 0x1000, 0x401, 0x40, 0x90f, 0x1, 0x1, 0x6, 0xfffffffd, 0x480000, 0x0, 0xc4, 0x81, 0x81, 0x0, 0x0, 0x1, 0xe, 0x7, 0x1ee12a4a, 0x7fff, 0x33a, 0x80, 0x6, 0x1, 0x9, 0x7, 0x4, 0x3, 0x80000001, 0x0, 0x6, 0xc18, 0x2, 0x96ae, 0x0, 0x1, 0x2472, 0x610, 0x9, 0x9, 0x8398, 0xe2, 0xf, 0x99f, 0x2, 0x1, 0xa, 0x2, 0x8, 0x3, 0x2, 0x81, 0x9, 0xff, 0x0, 0x10, 0xf, 0x2, 0x6, 0x4, 0x2, 0x454, 0x29ced33b, 0xfffffff8, 0xfffffffa, 0x2, 0x0, 0xffff, 0x7fffffff, 0x10, 0xfffffffe, 0x2417e0cf, 0x1, 0x2, 0x14a, 0xaf9, 0x7, 0x1, 0x2, 0x8, 0x6, 0x9, 0x1bbd96ba, 0x4, 0x3, 0x8, 0x3, 0x1, 0x4, 0x1, 0x1, 0x356a64c1, 0x10001, 0xf, 0x5, 0x2, 0x1ff, 0x5, 0x0, 0xe]}]}, @TCA_RSVP_PINFO={0x20, 0x4, {{0x5, 0x3, 0x3ff}, {0x3f, 0x3}, 0x42, 0x9, 0xf}}]}}, @f_rsvp6={{0xa}, {0x18, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private1}]}}]}, 0x1c78}, 0x1, 0x0, 0x0, 0x80}, 0x2000804) (async)

2m57.453164308s ago: executing program 2 (id=2330):
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0})
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.stat\x00', 0x275a, 0x0)
write$binfmt_aout(r0, &(0x7f0000000400)=ANY=[], 0x1a3)
write$binfmt_misc(r0, &(0x7f0000000040)="0db723740d6678af6874bb74fb7875012c7de0568a8315a6736b7635e00126b713064871082ef63a291542a0bbb266ec7c61a508716f1b1ea80046ef", 0xe5c)
r1 = syz_open_dev$loop(&(0x7f0000000000), 0x8, 0x2180)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r0, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac000000000000000000000000fe0100", "90be8b1c551265406c7f306003d8a0f4bd00"}})

2m51.85773411s ago: executing program 3 (id=2362):
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000100)={0x2, @vbi={0x9, 0x7, 0x34565348, 0x4f565559, [0x1000, 0x1000007], [0x9, 0xffb], 0x108}})

2m51.678128102s ago: executing program 3 (id=2363):
r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$tcp_congestion(r0, 0x0, 0x0)
r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r1)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000b5b30a40450c8f6055b5010203010902120001000000000904"], 0x0)
syz_usb_control_io$printer(r2, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000240)=ANY=[@ANYBLOB="00000003000010"], 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0)
r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
fadvise64(r3, 0x92, 0x5, 0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000003, 0x22052, r3, 0xa4717000)
creat(&(0x7f0000000080)='./file0\x00', 0x21)

2m48.819962897s ago: executing program 3 (id=2375):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
ioctl$BLKPG(r0, 0x1269, &(0x7f0000000140)={0x2, 0x0, 0x98, &(0x7f0000000080)={0x4, 0x3, 0x7}}) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff}) (async)
r2 = syz_open_dev$loop(&(0x7f0000000180), 0x10, 0x2)
ioctl$BLKGETSIZE64(r2, 0x80081272, &(0x7f00000001c0)) (async)
syz_open_dev$ptys(0xc, 0x3, 0x0)
fstat(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setreuid(0x0, r3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

2m48.534292778s ago: executing program 3 (id=2376):
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7ffff000)
r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0)
syz_usb_connect(0x0, 0x56, &(0x7f0000002d80)=ANY=[@ANYBLOB="12010000c9d1c40899040a50b7e70102030109024400020000000009049700010dd5ce0008240201000000000905000000000000000705a3f6d2fb5b09040000014106cf0008240201000000000905c926"], 0x0)
ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0)
exit(0x6)

2m45.162511869s ago: executing program 3 (id=2380):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
setresgid(0xee01, 0x0, 0x0)
fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
setreuid(0x0, r1)
setgid(0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='vxfs\x00', 0x200000, 0x0)

2m44.941987304s ago: executing program 3 (id=2381):
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x60}}, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, 0x0, &(0x7f0000001cc0))
mremap(&(0x7f00006c8000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000a9b000/0x2000)=nil)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x0)
epoll_create1(0x80000)
ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000100)={0x2, @vbi={0x7, 0xa, 0x7ffffffd, 0x4f565559, [0x1000, 0x1000007], [0x5, 0x8], 0x109}})

2m41.177798719s ago: executing program 32 (id=2330):
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0})
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.stat\x00', 0x275a, 0x0)
write$binfmt_aout(r0, &(0x7f0000000400)=ANY=[], 0x1a3)
write$binfmt_misc(r0, &(0x7f0000000040)="0db723740d6678af6874bb74fb7875012c7de0568a8315a6736b7635e00126b713064871082ef63a291542a0bbb266ec7c61a508716f1b1ea80046ef", 0xe5c)
r1 = syz_open_dev$loop(&(0x7f0000000000), 0x8, 0x2180)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r0, 0x0, {0x2a00, 0x80010000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9683dda1af1ea89de2b7fb0a0100000000000000000300", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac000000000000000000000000fe0100", "90be8b1c551265406c7f306003d8a0f4bd00"}})

2m28.139814833s ago: executing program 33 (id=2381):
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x60}}, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, 0x0, &(0x7f0000001cc0))
mremap(&(0x7f00006c8000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000a9b000/0x2000)=nil)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x0)
epoll_create1(0x80000)
ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000100)={0x2, @vbi={0x7, 0xa, 0x7ffffffd, 0x4f565559, [0x1000, 0x1000007], [0x5, 0x8], 0x109}})

3.225712963s ago: executing program 1 (id=3164):
mkdir(&(0x7f0000000540)='./file0\x00', 0x108)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r3 = dup(r2)
ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, 0x0)
r4 = socket(0x2a, 0x2, 0x5)
sendto(r4, 0x0, 0xffffffffffffff2c, 0x0, &(0x7f0000000040)=@qipcrtr={0x2a, 0xffffffff}, 0x80)
mount(&(0x7f0000001400)=@filename='./file0\x00', &(0x7f0000001440)='./file0\x00', &(0x7f0000000000)='romfs\x00', 0x0, 0x0)
r5 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0)
r6 = fsmount(r5, 0x0, 0x0)
fchdir(r6)
mkdir(&(0x7f0000000000)='./control\x00', 0x0)
r7 = open(&(0x7f0000022ff6)='./control\x00', 0x0, 0x0)
mkdirat(r7, &(0x7f0000000100)='./control\x00', 0x0)
getdents64(r7, &(0x7f0000000340)=""/71, 0x47)
unlinkat(r7, &(0x7f0000000140)='./control\x00', 0x200)
rmdir(&(0x7f00000002c0)='./control\x00')
r8 = fspick(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0)
r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_usb_disconnect(0xffffffffffffffff)
r10 = syz_pidfd_open(r9, 0x0)
process_mrelease(r10, 0x0)
r11 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x410040, 0x40)
fsconfig$FSCONFIG_SET_PATH(r8, 0x3, &(0x7f0000000080)='romfs\x00', &(0x7f00000000c0)='./file0\x00', r11)

2.390163132s ago: executing program 0 (id=3170):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0) (async)
r4 = socket$igmp6(0xa, 0x3, 0x2)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000007c80), 0xffffffffffffffff) (async)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000040)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_PMKSA(r5, &(0x7f0000007dc0)={0x0, 0x0, &(0x7f0000007d80)={&(0x7f00000001c0)={0x1c, r6, 0x1, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x0)
setsockopt$sock_int(r3, 0x1, 0x3c, &(0x7f0000000200)=0x7, 0x4) (async)
ioctl$FIONCLEX(r0, 0x5450) (async)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async)
syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="1201000094037b40fd080200fdca010203010902120001000000000904"], 0x0) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

2.259111117s ago: executing program 5 (id=3171):
mkdir(&(0x7f0000000000)='./file0\x00', 0x18a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './bus'}}], [], 0x2c})
setxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x9, 0x0) (fail_nth: 3)

2.154257482s ago: executing program 1 (id=3172):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000200)=ANY=[@ANYBLOB="ec000000210001002dbd7000fedbdf25fe880000000000000000000000000101ac1414bb0000000000000000000000004e240002000700010a0080a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="af6b6e00010000009c0011001901010000000000000000000000000020010000000000000000000000000001ac14143e0000000000c8b10000000000ac1414bb00000000000000000000000032fcff00073500000a0002000000000000ffffff8800020000000000ac1e01010000000000000000000000000a010102000000000000000000000000fe80000000000000000000000000002f33"], 0xec}}, 0x20000000)

2.154010099s ago: executing program 0 (id=3173):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0, {0xd}}, './file0\x00'})
r2 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc)
r3 = socket$netlink(0x10, 0x3, 0x0)
writev(r3, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1)
writev(r3, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1)
r4 = socket$inet(0x2, 0x2, 0x0)
set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000140)}, 0x40804)
setsockopt$inet_mreqn(r4, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40)
setsockopt$inet_msfilter(r4, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57)
setsockopt$inet_mreqsrc(r2, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc)
r5 = socket$inet(0x2, 0x2, 0x0)
setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @empty}, 0xc)
statx(r1, &(0x7f0000000040)='./file0\x00', 0x0, 0x200, &(0x7f00000002c0))
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r6=>0xffffffffffffffff})
ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000000c0))
fstat(r6, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r7=>0x0})
setreuid(0x0, r7)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendmmsg(r8, &(0x7f0000001880)=[{{&(0x7f00000001c0)=@pppoe={0x18, 0x0, {0x3, @multicast, 'rose0\x00'}}, 0x80, 0x0}}], 0x1, 0x24048090)
r9 = syz_usb_connect(0x1, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="120100004f92b90857152077ebb7000000010902120001000000000904"], 0x0)
syz_usb_control_io(r9, 0x0, &(0x7f0000000800)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)={0x40, 0x13, 0x6, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
rt_sigtimedwait(&(0x7f0000000240)={[0x5]}, 0x0, &(0x7f0000000280), 0x8)
syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="04080400c8000918427cb54617817e12adfb34e56b94861451a5350d9e377dc7ab15a148"], 0x7)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x103080, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r11, 0x4038ae7a, &(0x7f0000000180)={0x1, 0x40000099, 0x0, 0x0})

1.951031951s ago: executing program 1 (id=3174):
mkdir(&(0x7f0000000000)='./file0\x00', 0x18a)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r0, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe)
setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './bus'}}], [], 0x2c})
setxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x9, 0x0)
ioctl$FIGETBSZ(0xffffffffffffffff, 0x2, &(0x7f0000000040))

1.750403498s ago: executing program 5 (id=3175):
syz_io_uring_setup(0x18d6, &(0x7f0000000040)={0x0, 0x3, 0x0, 0x0, 0xad}, 0x0, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x40400, 0x0)
openat$vnet(0xffffff9c, &(0x7f0000000200), 0x2, 0x0)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f0000000080)=ANY=[@ANYRES16=r1])
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='nfs\x00', 0x200000, 0x0)
r3 = socket$inet(0x2, 0x0, 0x8)
r4 = socket$nl_audit(0x10, 0x3, 0x9)
syz_clone3(&(0x7f0000002500)={0x2000100, 0x0, 0x0, 0x0, {0x12}, &(0x7f0000002440)=""/52, 0x34, 0x0, 0x0}, 0x45)
r5 = socket$kcm(0xa, 0x1, 0x106)
setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f0000000340)=0x1, 0x4)
sendmsg$kcm(r5, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x20000001)
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
close_range(r6, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000000c0)={'bond_slave_0\x00', &(0x7f0000000240)=@ethtool_gstrings={0x1b, 0x7}})
ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f00000000c0)={{0x2, 0x4e22, @empty}, {0x1, @remote}, 0xf0, {0x2, 0x4e20, @multicast1}, 'veth1_to_team\x00'})

1.622122682s ago: executing program 4 (id=3176):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0xf648b000)
creat(&(0x7f0000000240)='./file0\x00', 0x0)
pipe2$9p(&(0x7f0000001900)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x0)
mremap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffd000/0x2000)=nil)
write$P9_RVERSION(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15)
r3 = dup(r2)
write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_NOTIFY_RETRIEVE(r3, &(0x7f00000000c0)={0x14c}, 0x137)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB=',cache=mmap'])
chmod(&(0x7f0000000140)='./file0\x00', 0x0)
r4 = creat(&(0x7f0000000300)='./file0\x00', 0x0)
write$UHID_INPUT(r4, &(0x7f0000001940)={0x8, {"1a17924ab218eacb15a3fccf929e2dd2497903c1f853d95b995c65e99449ff953fa11c7723b2149ecdaa7f833f60e13b19a66e963f7e8da4297ebbfdda5b36fb4d01bd02e6c652dc4d99e2cb82c2a1d4a45e4c89ba9994e82f854bbc34a40b3a58aa256c9b4512fbf91b9846446c4909e4ec53982e7d7fd11ee0bdeab0bb4c469c9665dde8cb58f0ca148223b6cc4e2f306cfbeccedec8db5212f2fc4e14f836c68bdace4db1afbde9d463e5ac24567925b5fdf0e3af1a52dbd7669fe9227302c8f635bc2ddbf5bd7dccd7b92a9bd5c7363375a57851c2bc72509f2005f138f5a59cf85e9ddb1c972c89d50806e8941b7059cd3eca77527a7f20af70841b4d6f026614bdbb276a6814cc74d91856b968c5fdb52674d892a90d01ab91841b6811def78bdac9bc6f9df2598569fbdfef75079832b2750801dc83fd1987713c61136ac9e5f2f7e67f302109bb9a7fea75290b506a89a19d7e0e472937a8c9ecfe16ef6eb88c7a88a060756196d55d6a3d3f7cdf9915d22b6b3af69ec55017b821ec0621e8a59414efc2b46977a85846b53ae75a350947afcafbdef7233cc371bc2a6f29c0315b352ac2741c81df534303ddb30a4408db5679d05d245259c245c9d7f861711cc287cfd0462b948512623b921060386c587fd166df29e71ecfc8ed90031e95b2af1406b5ae73f6084e39e88194e3d37dc801982656b5b66342d74100f9f5b8c94c1e91b626bbf426a07b4be91dbdb76a6e40d0b788f89359e462e69bc4499fd4f9aa1e7f0c3f73a996b6ecef606c7651286e1f18a6823eed7191cd542057eaaf09aa32e8ce370c09050278b85fd359b8ca23e66e9d294ec57b3ddd90409d9b1ca28c6993b244f8ca46f6bf478ff22fb1df53e33abdda4b2b1e5cff7de19957bdc8e7ca39e4762204b1f9f33b9375b7282422b91841706751038e42023ba45c1cd0998c1794c1c2a5ff65466189bbb27bcbf01e5a48bfd8b6845f7d5c87d977df4ded5273ebf56b96c50b4eadc44bfaa0994259eeb1031644415fa9d729753d2138b06f9b7b624d9eeb1ef71dfdff0b639078f058c7a070451c4670af0c6eb1202f77be82faba9b6287995066b5f7e59b7967706d8d8c5bde48137e13df537ae54664fe4e8460b1bdf5b92a1dcf39ee1726bc6690d0ac5f799bcfab918c59cb132c45054ba17b8a44d505ad3eaeee95b4275b25b2087da8902552727a1e739014df348cfa3a1102661c35a6a38df6c410f5343577955dd57de5af089e3f1bcdf96d4ef1d5944243470b0ed10616144cccc5cac44e36fefd9441120c5d047867af0ea353da21fc0ae73b78b84d53a62efeb94ea8d441cc698c92fd7b36cf41472d036c5093bbdf943620c29ffa3b21ef4a0bb9274912b046834ee6f855ceadf18fb488040d5829ab6e8bf69a90315f7f84d002ac4e929e9f1010a8486746bd316799ba3a65744980c388202324ba50768c77a8481ba74d135da7507048c82714a8234837b69922126e4084a68f7418bfd26417cade786c7f8185e2492e3b64eb9d2c2c721504c7b4aeb383503f745fd69315c56b5b0158decd1b1606a63366b7e2d2b9124b6efca4480c703c8f37d6ddff55b0ec15f2ce6be6c902d06aec2ccabeba13b442b608076c33d19e690ab66cf6678d679758d22fb5d8d963f25d00c45576f8b2938543080297b9cb6c305e3131d2f412f00370c285251909f8ebefc3d18a23e25a183997b08251450b29fff32781e6a70e6e070ab3921f3f809392deb732d6f30cc034b5f77d41218bca86d515b16da0457dbf7aaefdcef9d5358e7b4f1e5d1a410f55449e765609d122f938fd57b71482244dff0523067cabfd322fc47aca1c331112e3d969f5fe3594c3c7adea7c36e9b9af6754cdea5ccf05b139f783d4b24540c50a6a9f7dff472d47c87c151d8439b5740cd1f423335dae2680050bd44766159cba66666b7dbc9e190130494327a0d8c9dbed5c8b831ce2b2bb236353ff7175a48b61a0f3209fa3db44f07a21a485ef1682a33cdf632ac2d6ca993b6cd90913e31704bb851711e1f2b5ebb19baaba102dd42d550933e9dfc17311665fef4d0206d7debbcbbd97efafffb905bf9a77b8eeb67d5f8bef8526f6f8607672bb3c50b14e16c264265594e05fa481f724290abdc9f60a899f26033236e3b90548c24288a7b627b51c4d7c638c359ec6325b0d79e1d69cf18cd9136a263b6aa84ad062b9831fc7c201b7ccec7d3b7ea2132ee4579632bf614bcde285527c36ef8a8e12651ef34a677a8d2f84360afa2f2245e4e0d61a12e8e446045fae61375082f983363795f11848edad24b3f7ae53f0eeb329fa62b6d7b446e3b2c1257981f9c0c3ea371c71021af834a285203b2e3177ddf5251044ea215c048f78701dec36a94ca3c435278d1fd889996adf5ea7c8db62f2b1331bc22c4b7798d587a5c4e619b7b576e19d92996bc0bdc0c8c15374e11b6eeda0e18b35aac4b96db9cdba025080bf5bea4ffdf4fa3c93ec5feede0a140f7f6727ef255783565935d59d348aaa6d12c060afd5f6d084346309d8cbf54b33050ecccf30ae083c4034165880214a94a5296427e2fcb6d90692a82212b6b8d86c6d163f0643944aaba4af1171aed463994f1374e1ec1654b89b04e9d635074e8d131bc2443daf1caad455671470329a287f4c711cb907403d5c05184cd3a647823b5b9c6dc4451fdde92dc1cb87010197026458b40d4809ab60aca1af6bb3702a3e0506cdd21faa6d9909f4ed74723de75fc48d44314fa3cc0c8e8ea226ec1d5875b9595aeacdff0a9f75b4a60dde781c58179f997ecb6479c91ecacc65bfe293a2d26c21ae7c1d7be1241cc1c4ea86a6cf8d93012bd98508aae8db723ff167026298cab227b7d0062c27ccc8e81df7268423ad063638760b44e77147ee9bd84140166ae2bfd592f845ca68c719f7520ae3c9988cc89db73bf93ad6f2f7d9394b2288f0176723acd167081ade4e066a26832f7b655cd874aa5026a7369bb9912c90599d1407f0488a9c540a31997890f5433bd1df91ba13a9e0721c9a707eac7cff1c3efef6cd716779c7ad631c3560caa2031d9d2591329c1867d0d5f96b5897cac2c6a381f0ce5c27969c2b3e7d188e1e896d815b01a3e177933817325953140272ad718a36ae522d43de109ba92255ee66d2a14897f2b2014dc9a495c108727e0eef54df617e269e43a0c48d28a91aaf14d58719e21ea39c1c534e39a1dfabb61377b55d2f69fe79c7d5111b8b952c388925ea8ab1503ae68bce95a34a10a85aa0e5da52add14b93eaac5861a6504e23dda8034e809253c1071ddda934663faac454cd378c5725f5c6f4d943779994357185e512a4b6993156e624f25d86d24e7254d3e9b231aa80ed5a32e108cb528d402f93e58c25ac937420ff7dcd7d9ec2126c7fe7cefa47c038f23de40523d5e026fe3bb4cfd3040f9bd9631cf5a2cde1e20a6032703cd64c2ad97ea95d05a7aa3ea3b3b9d5a86961116dd1338c0a2caae0ceab3178ac7736dfa8a949cd81d261748e6678cb730b57468fb2b7e22c5eb08ad496e76775dce0c31950a596580ad7d6c3fd9ce90dded340f20b77fe53e81fb6e2a7a6c450b8ac9009c7c077893f704457a90401fb758c0769fbfd38e40ae692e410b889bbf0b09a32dc731b6768c0fa3963a5b6279b6a5db611174339f3218fff567f6cfb7377ddc8e2c730da35cc3ec680a6bc95010dd03834caab7afb2c0023ad9ce3aae3c0fd1ece42ea840bf5fc798a0b5fbe7692f13549cdba4a0b68f722ef6877856a76fc3c39f7cfd760675a9f341d9f09f381972be9171e50455ed13e665e61a03b0c2a79276a871c25fc5c486639a71a8dfdf36174373b8995014752aba3026045be6b43074ac3824d687bbf5f6544228cea52791828f54980ee9f728534ea32edd205aaace717adcf61ce28f92719048d44b09812bcfd2d22cc9d7a45ed6b4634756f6b3189908c71728c373ea94aa5c74ce4a73c20138b8cb21db6e2dfb35329b86b1805a5208dd370b8342ca8aa3cbd3e7a3ec79d7b8ee677b04e19c524ddc6de0b22443ac15de908f61719399d0f9890ca2b0283a7db914944f424af10ba0ec9e3e253c060d7b28552eaae5eed1e906f8f93c2195293deabdad6cb38ddab51603e4a96ef1e086de911fb716ffbca467294d9e66e5d0f8225bc28d6c074c4ffba76706f61b0b386b7e4b6500a15fad291f34f6c84f1596a97512f31196a529a7a5725437c038e17d531da3838c8aef3bade6bc1d4c7624560d4fba72e5f8be2c5dc905e1e4bcb2aa7eddb275408ef4288ac69c7a18ae58fb26c2f5a6964f051b81d2e426fc2a5d8617050341b96d5a746e3419fbe94bd3752403868b655c2dba6f48ef109a2e6ec0041842fae52bfab70481ecfe8d27f3d5e444f1b941d871c8057cbe35df68665bc3aadea02d203b106d1179a428daa7d9fea9dbddd8955bb289a92ec790de74cd6a1edf925ab85471633dedf8ba46abe456963a2381addce2aa16c06dd80bb54d8e53d7c82607916af175061da29122afde8687add6b6f42233b76a1164893dcc1ec3dcf935576d2d0f3ab3b1adbace086da915234b4f9bad0afc2915608fc4f6611dc3b91d7e0e48cb0a0f3fdc70ef70ef82043afbd3325f0f6186390ab28ca9f0009184637530d79f0c5a77c6e912afbe6533988f543fc6c02d3d44fbdb0e2ebfad2680184f1ed451991667df958a71fb41cf4367bdb931389ea8b6340e225b312a09dadd8e2ac2d200db6e75323d48c73c6b819e13f92b01bf405e796a2e10b863e773598abcbcc196987e18b19530337809b56480778207103a12acfff1c0ad62846088251a1a0d0d6b300059a99698c84ccac78d53eb32e3984001978db7679960b4d75d71b49696909826c66320526fe02a060265821d15b8b2337121a201402a118ec03ff0d4f3dfa48f2dadd20b510ecdf4e6440b5b2466b9bf28e32327189f0405245694a6371dbe4eae7a8293cdc15193c284123d64690120634f808096a8f3f7a04a5bac9dd86c09f2e4e87c7d7c98d0b370e84ea5f265730f5480eb1375d4f82c7d4efbb6e58c5a92848331b2becd2531f6c456b5d0e690b102dd8faec55bde56f95727f4abf52c58543faaeb9cefd39bba788bd7e2b02b27ecbc1679a1ac00823c83e1ae29690cd25544d3ae0a8db25e963e9fb5bd94987637ac3546b9b312bf04d5c6211c135e806525d423fde9ccb5ef7962ec1e056e6f29adaeebb331f6c234586d1fe21577f56d620c6942a29d4915772144cc60008d1236db21100d5a3112c29396b9e18cdb5b104bed2df2b6ea72c9aa03bb6082f3eb07f0eae359864967a749492d21005b0d39c9613c20b1e21700ab66a4f5ca03ec08d67b95f759252d758743820ba243032e1708447fbaebc27e1316af4cf547cef3ac4966a1f04dd07012f257a0204107c23a0046b12493d9784b24dc561c1f88e591056bcc3b338ab1de65e5ad578021f26f93e9b12f00b5f8c8ae2db6b7b8f254303c7ff06514735974e65fb9a93dc79b115a12310040490ca11ef315340af104e20a2e22dcd132f7d7a61d9d3a12e832ee048a2170dbe03d747ed7402180eb964fde0ecb77e778b18a4e5a83479bb7e0ea0a7d5145ffed4607bd7e6b8f961625d5e3dcac2d4a05e71dc9c2e52195bd55aed4e6749dc1c329e2cda966d18e9bf882c05db627c1047fc71533bbba2c8a83d04db5bad6da349a9ad1992eb88e0274d32a16137e2396ad973c0ecbbc2d243e68b6959bf9b", 0x1000}}, 0x1006)
r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$uinput_user_dev(r5, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3ff, 0x8, 0xfffffffd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5248, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xffffffff, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0xa0000000, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4771], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x3, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x10c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c)
ioctl$UI_DEV_CREATE(r5, 0x5501)
ioctl$UI_GET_SYSNAME(r5, 0x8040552c, 0x0)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

1.578219025s ago: executing program 1 (id=3177):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000002, 0x22052, r0, 0x93774000)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0})
r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0)
write$cgroup_subtree(r4, 0x0, 0x0)
ioctl$RTC_EPOCH_SET(r4, 0x4008700e, 0xfff)
ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000000c0)=0xa)
poll(&(0x7f0000000040)=[{r3, 0x488}], 0x1, 0x6)
r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, <r6=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r6, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000})
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, 0x0)
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r5, 0x3ba0, &(0x7f0000000180)={0x48, 0x5, r6, 0x0, <r7=>0xffffffffffffffff, 0x1})
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000680)={0x48, 0x7, r7, 0x0, 0x10000, 0x0, 0x2, 0x42876, 0x3d8e95})
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r5, 0x3ba0, &(0x7f0000000400)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0x6, 0xa9613, 0x1000000})
r8 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100), 0x8902, 0x0)
r9 = accept$phonet_pipe(r8, &(0x7f0000000240), &(0x7f0000000280)=0x10)
bind$phonet(r9, &(0x7f0000000000)={0x23, 0x80, 0xfa}, 0x10)
socket$phonet_pipe(0x23, 0x5, 0x2)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r10, 0x8983, &(0x7f0000000580)={0x0, 'veth0_vlan\x00', {}, 0x4})
r11 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x250401, 0x0)
ioctl$SNAPSHOT_SET_SWAP_AREA(r11, 0x400c330d, &(0x7f0000000140)={0x6, 0x1})
ioctl$VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000440)=@multiplanar_userptr={0x6, 0xa, 0x4, 0x1000, 0x2, {}, {0x1, 0x1, 0x0, 0x2, 0x4, 0x3, "9648976d"}, 0x7, 0x2, {0x0}, 0xb})

1.40528927s ago: executing program 4 (id=3178):
creat(&(0x7f0000001380)='./file0\x00', 0xe)
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth1_to_bridge\x00', <r1=>0x0})
r2 = socket$inet6_mptcp(0xa, 0x1, 0x106)
ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000100)={@local, 0x0, r1})
r3 = socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000140)={@mcast2, @mcast1, @private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0022})
ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@private0={0xfc, 0x0, '\x00', 0x4}, @remote, @dev={0xfe, 0x80, '\x00', 0x21}, 0x4, 0x0, 0x206, 0x300, 0x1, 0x0, r1})
ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000540)={@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x0, 0x6})
r4 = socket$inet6_mptcp(0xa, 0x1, 0x106)
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'veth1_to_bridge\x00'})
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000090, &(0x7f00000005c0)={0xa, 0x4e20, 0xa3, @loopback, 0x1ff}, 0x1c)
r5 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10)
sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a0005181b01ccae12fb00000a"], 0x164}}, 0x40014)
mount(&(0x7f0000001400)=@nullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000040)='omfs\x00', 0x0, 0x0)
creat(&(0x7f0000001380)='./file0\x00', 0xe) (async)
socket$inet6_mptcp(0xa, 0x1, 0x106) (async)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth1_to_bridge\x00'}) (async)
socket$inet6_mptcp(0xa, 0x1, 0x106) (async)
ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000100)={@local, 0x0, r1}) (async)
socket$inet6_udplite(0xa, 0x2, 0x88) (async)
ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000140)={@mcast2, @mcast1, @private2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0022}) (async)
ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000240)={@private0={0xfc, 0x0, '\x00', 0x4}, @remote, @dev={0xfe, 0x80, '\x00', 0x21}, 0x4, 0x0, 0x206, 0x300, 0x1, 0x0, r1}) (async)
ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000540)={@remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) (async)
socket$inet6_mptcp(0xa, 0x1, 0x106) (async)
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000100)={'veth1_to_bridge\x00'}) (async)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000090, &(0x7f00000005c0)={0xa, 0x4e20, 0xa3, @loopback, 0x1ff}, 0x1c) (async)
socket(0x10, 0x3, 0x0) (async)
setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) (async)
sendmsg$nl_generic(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="640100004a0005181b01ccae12fb00000a"], 0x164}}, 0x40014) (async)
mount(&(0x7f0000001400)=@nullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000040)='omfs\x00', 0x0, 0x0) (async)

1.154236981s ago: executing program 5 (id=3179):
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) (async)
mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) (async)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x104000, 0x0) (async)
mount$bind(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x803400, 0x0) (async)
mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x1814, 0x0)
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$inet_int(r0, 0x0, 0x12, 0x0, 0x0) (async)
umount2(&(0x7f0000000200)='./file0\x00', 0x0)
r1 = socket$inet6(0xa, 0x80002, 0x0)
writev(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=')\x00', 0x2}], 0x1) (async)
bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, 0x1c)
r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4ce000, 0x0) (async)
getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000280)=@assoc_value, &(0x7f0000000300)=0x8) (async)
socket$can_bcm(0x1d, 0x2, 0x2) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x52)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc)
r5 = socket$inet6(0xa, 0x80003, 0x6)
connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async)
setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) (async)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (async)
sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) (async)
socket$key(0xf, 0x3, 0x2) (async)
mmap(&(0x7f000078a000/0x11000)=nil, 0x11000, 0x5a051feb1f984a1d, 0x202812, r2, 0x7dfff000) (async)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="0c010000000101010000000000000000020000060c0006800800020064010102080007400000000960000e80060003400003000006000340ca7a000006000d40000400000c00028005000100880000002c0001801400030000000000000000000000ffff64010102140004000000009b0000000000000000000000000c00028005000100110000000c000d8008000100e00000026800018006000340000100000600034000010000060003400003000006000340000100002c00018014000300fc0100000000000000000000000000001400040000000000000000000000ffffac1414bb060003400001000006000340000200000600034000030000100004800c0003800800024000000800"], 0x10c}, 0x1, 0x0, 0x0, 0x20008000}, 0x10)

1.153917297s ago: executing program 0 (id=3180):
mkdir(&(0x7f0000000000)='./file0\x00', 0x18a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './bus'}}], [], 0x2c})
setxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x9, 0x100000)

1.083388298s ago: executing program 4 (id=3181):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
fadvise64(r0, 0x94, 0x20000006e, 0x5)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0)
r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_x25_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={@null, 0xa, 'syzkaller0\x00'})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10)
setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4)
sendto$inet(r2, 0x0, 0x0, 0x4000, &(0x7f00000002c0)={0x2, 0x4e21, @broadcast}, 0x10)
r3 = dup(0xffffffffffffffff)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66)
ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x1, 0x6, 0x10, 0x10, 0x18, "f893638989c90f81afe49d5fbb8d93402c4491"})
shmget$private(0x0, 0x1000, 0x7800088c, &(0x7f0000fef000/0x1000)=nil)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={<r5=>0xffffffffffffffff})
r6 = dup(r5)
getsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, 0x0, 0x0)
r7 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080), 0x7c5c83, 0x0)
write$FUSE_DIRENT(r7, &(0x7f0000000000)=ANY=[], 0x40)
madvise(&(0x7f0000a47000/0x1000)=nil, 0x1000, 0x19)
ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000100)={0x3, 0x0, @pic={0x76, 0xff, 0xf1, 0x6, 0x7, 0x44, 0x10, 0xff, 0x0, 0x4, 0x0, 0xfc, 0x6, 0xe, 0x80, 0x40}})
r8 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r9 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r9, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900})
ioctl$RTC_WKALM_SET(r8, 0x4028700f, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x0, 0xfffffffe, 0x18, 0x0, 0x60}})
r10 = syz_init_net_socket$llc(0x1a, 0x1, 0x0)
setsockopt$sock_int(r10, 0x1, 0x3e, &(0x7f00000000c0)=0xb, 0x4)
sendmmsg$inet(r10, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1e1730a30afb6559, 0x8014)
ioctl$AUTOFS_IOC_ASKUMOUNT(r4, 0x80049370, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x97ae8000)

955.578765ms ago: executing program 0 (id=3182):
timer_create(0x9, &(0x7f0000002c00)={0x0, 0x25, 0x1}, &(0x7f0000002c40)=<r0=>0x0)
timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x77359400}}, &(0x7f0000000080)) (async)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r1, 0xdf3e7000)
sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x14, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44}, 0x48004) (async)
r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_debug_messages', 0x101a02, 0x0)
write$sysctl(r2, &(0x7f0000000000)='4\x00', 0x2)
fadvise64(r2, 0x0, 0x0, 0x0) (async)
ioctl$PTP_PIN_SETFUNC2(r2, 0x40603d10, &(0x7f0000000140)={'\x00', 0x3aa, 0x3, 0x7}) (async)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='devices.list\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28012, r3, 0x0)
ioctl$KVM_CAP_X86_NOTIFY_VMEXIT(r3, 0x4068aea3, &(0x7f00000001c0)={0xdb, 0x0, 0x7})

782.282274ms ago: executing program 5 (id=3183):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000200)=ANY=[@ANYBLOB="ec000000210001002dbd7000fedbdf25fe880000000000000000000000000101ac1414bb0000000000000000000000004e240002000700010a0080a000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="af6b6e00010000009c0011001901010000000000000000000000000020010000000000000000000000000001ac14143e0000000000c8b10000000000ac1414bb00000000000000000000000032fcff00073500000a0002000000000000000001a800020000000000ac1e01010000000000000000000000000a010102000000000000000000000000fe80000000000000000000000000002f33"], 0xec}}, 0x20000000)

737.632036ms ago: executing program 0 (id=3184):
mkdir(&(0x7f0000000000)='./file0\x00', 0x18a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './bus'}}], [], 0x2c})
setxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x9, 0x0) (fail_nth: 4)

673.188943ms ago: executing program 4 (id=3185):
r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0xa)
fchdir(r1)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85)
lseek(r2, 0x101, 0x1)
getdents64(r2, 0x0, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000004800010000000000000000000a00806e0805000000000001140001800d2a79075827af5aa534d6815c2e93f10c0002"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004880)
mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x3000000, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xeb9a0000)
r4 = socket$l2tp(0x2, 0x2, 0x73)
setsockopt$EBT_SO_SET_COUNTERS(r4, 0x0, 0x81, &(0x7f00000000c0)={'filter\x00', 0x0, 0x0, 0x0, [0xfffffffffffffffc, 0xbfeb, 0x5, 0x1, 0x1, 0x3], 0x0, 0x0}, 0x78)
creat(&(0x7f0000001380)='./file0\x00', 0x4)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000001440)='./file1\x00', &(0x7f0000000080)='btrfs\x00', 0x8000, 0x0)

417.192355ms ago: executing program 5 (id=3186):
mkdir(&(0x7f0000000000)='./file0\x00', 0x18a)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './bus'}}], [], 0x2c})
setxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x9, 0x0)

416.935358ms ago: executing program 0 (id=3187):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2200, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, 0x0})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000240)='vxfs\x00', 0x8, 0x0)

268.823871ms ago: executing program 1 (id=3188):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_mtu(r1, 0x0, 0xa, 0x0, &(0x7f0000001780))
r2 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000280)={0x5, 0x32315258, 0x1, @stepwise={0x7, 0x9, 0x7e, 0x58d, 0x0, 0x9}})
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0)
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, r3, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_COALESCE_TX_MAX_FRAMES_HIGH={0x8, 0x16, 0x912c}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5}, @ETHTOOL_A_COALESCE_STATS_BLOCK_USECS={0x8, 0xa, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x8800)
r4 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000340)="d8000000190081054e81f782db0000070a000a000900142603600e1208001e0000050401a8000400027c035c0461c1d67f6f94007134cf6efb8001a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d302fe7c3f5aeb4edbb57a5025ccca9e008026f6e6ddba61f5fad95667e006dcdf639500d1d6e3ebd063a851270e98bebfeb789d005f5f188976000000000000d5e1cace81ed6c117ab5d6d69bda4039e81f86f60f0bffece0b42a9ecbee5de6ccd40dd6e4edef3985000092954b43", 0xd8}], 0x1}, 0x0)
r5 = syz_open_procfs(0x0, &(0x7f00000005c0)='smaps_rollup\x00')
lseek(r5, 0x2000, 0x0)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000e01f00ffdbdf250c00000018000180140002006261746164765f736c6176655f30000014000380100003800c000180"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10) (async)
socket$inet_sctp(0x2, 0x1, 0x84) (async)
getsockopt$inet_mtu(r1, 0x0, 0xa, 0x0, &(0x7f0000001780)) (async)
openat$vim2m(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) (async)
ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000280)={0x5, 0x32315258, 0x1, @stepwise={0x7, 0x9, 0x7e, 0x58d, 0x0, 0x9}}) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000d00), 0xffffffffffffffff) (async)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x5d032, 0xffffffffffffffff, 0x0) (async)
sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, r3, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_COALESCE_TX_MAX_FRAMES_HIGH={0x8, 0x16, 0x912c}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5}, @ETHTOOL_A_COALESCE_STATS_BLOCK_USECS={0x8, 0xa, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x8800) (async)
socket$kcm(0x10, 0x2, 0x0) (async)
sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000340)="d8000000190081054e81f782db0000070a000a000900142603600e1208001e0000050401a8000400027c035c0461c1d67f6f94007134cf6efb8001a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d302fe7c3f5aeb4edbb57a5025ccca9e008026f6e6ddba61f5fad95667e006dcdf639500d1d6e3ebd063a851270e98bebfeb789d005f5f188976000000000000d5e1cace81ed6c117ab5d6d69bda4039e81f86f60f0bffece0b42a9ecbee5de6ccd40dd6e4edef3985000092954b43", 0xd8}], 0x1}, 0x0) (async)
syz_open_procfs(0x0, &(0x7f00000005c0)='smaps_rollup\x00') (async)
lseek(r5, 0x2000, 0x0) (async)
sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000e01f00ffdbdf250c00000018000180140002006261746164765f736c6176655f30000014000380100003800c000180"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async)
mount(&(0x7f0000000000)=@rnullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='hpfs\x00', 0x0, 0x0) (async)

256.416507ms ago: executing program 5 (id=3189):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000280)={0x0, <r1=>0x0, <r2=>0x0}, &(0x7f00000002c0)=0xc)
r3 = socket$igmp(0x2, 0x3, 0x2)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r4=>0x0}, &(0x7f0000000080)=0xc)
setgid(r4)
ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r3, 0x8982, &(0x7f0000000380)={0x8, 'macvtap0\x00', {'hsr0\x00'}, 0x103})
r5 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0)
recvmsg$kcm(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000140)=""/191, 0xbf}, {&(0x7f0000000200)=""/205, 0xcd}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f00000000c0)=""/64, 0x40}, {&(0x7f0000000300)=""/50, 0x32}, {&(0x7f0000000340)=""/158, 0x9e}, {&(0x7f0000000500)=""/214, 0xd6}], 0x8}, 0x40012100)
recvmsg$kcm(r5, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x40010022)
mount$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x8000, &(0x7f0000000300)=ANY=[@ANYBLOB="67652198", @ANYRESHEX=r2, @ANYBLOB=',quota,usrquota,huge=advise,gid=', @ANYRESHEX=r4, @ANYBLOB=',fsname=(+,\x00'])
mbind(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4003, &(0x7f0000000000)=0x7, 0x44, 0x0)
mbind(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4003, &(0x7f0000000000)=0x2, 0x44, 0x0)
prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, &(0x7f00000000c0)='0\x00')
r6 = socket$phonet_pipe(0x23, 0x5, 0x2)
r7 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1)
accept$nfc_llcp(r7, 0x0, 0x0)
sendmmsg$inet(r6, &(0x7f00000001c0)=[{{&(0x7f0000000040)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000100)="b2fbe0a280fdf4ab39b51fb093739f1ab3cd0de0028c426c7938b0cb328023221b2b1277034f394225237c0466a15646dd3aac5c23578f017e9831fa71218cea6b295331b1adade3e80fa695a2d984a53c2a1eff7af5aaa72c05c340cbfd1cae5262cb845f6ec0442db792bb1b0bdb7f6b345fefd8dfd7c4", 0x78}], 0x1, &(0x7f0000000180)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x8}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x6}}], 0x30}}], 0x1, 0x40)
fadvise64(r0, 0x94, 0x6e, 0x5)
setfsuid(r1)
mremap(&(0x7f0000546000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000591000/0x3000)=nil)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

138.148081ms ago: executing program 4 (id=3190):
mkdir(&(0x7f0000000000)='./file0\x00', 0x18a)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f00000002c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './bus'}}], [], 0x2c})
setxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x9, 0x4000000)

26.242875ms ago: executing program 4 (id=3191):
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x9e, 0x17, 0x36, 0x10, 0x17ef, 0x721e, 0xde06, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2, 0x6}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000ac0)={0x34, &(0x7f0000000680)={0x40, 0x18, 0x8, "6d1a2667a780471f"}, 0x0, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x17}, 0x0, 0x0, &(0x7f0000000800)={0x20, 0x0, 0x1, 0x92}})
r1 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000040)=0x525a8c3b, 0x4)
rt_sigaction(0xd, 0x0, 0x0, 0x0, 0x0)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c)
sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4001c00)
mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='dax\x00', 0x0, 0x0)

0s ago: executing program 1 (id=3192):
r0 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000001100)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10)
getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={<r1=>0x0}, &(0x7f0000001080)=0x8)
getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000140)={r1, 0x2, 0x7, 0x1}, &(0x7f0000000040)=0x10) (async)
mount(&(0x7f0000000100)=@rnullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000240)='udf\x00', 0x200000, 0x0)

kernel console output (not intermixed with test programs):

g off device on rfkill (-110)
[  503.004873][T14207] netlink: 'syz.4.2565': attribute type 1 has an invalid length.
[  503.024768][T14207] netlink: 'syz.4.2565': attribute type 1 has an invalid length.
[  503.255938][    T9] usb 1-1: USB disconnect, device number 106
[  503.315780][ T5902] usb 2-1: new full-speed USB device number 67 using dummy_hcd
[  503.387169][ T5902] usb 2-1: device descriptor read/8, error -71
[  503.604015][T14220] netlink: 'syz.4.2568': attribute type 10 has an invalid length.
[  503.622787][T14220] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2568'.
[  503.646229][T14220] dummy0: entered promiscuous mode
[  503.653153][T14220] bridge0: port 3(dummy0) entered blocking state
[  503.667646][ T5902] usb 2-1: new full-speed USB device number 68 using dummy_hcd
[  503.697081][T14220] bridge0: port 3(dummy0) entered disabled state
[  503.708073][ T5902] usb 2-1: device descriptor read/8, error -71
[  503.729541][T14220] dummy0: entered allmulticast mode
[  503.752151][T14220] bridge0: port 3(dummy0) entered blocking state
[  503.758896][T14220] bridge0: port 3(dummy0) entered forwarding state
[  503.840058][ T5902] usb usb2-port1: unable to enumerate USB device
[  504.319926][T14236] input: syz1 as /devices/virtual/input/input75
[  504.389516][T14236] loop4: detected capacity change from 0 to 1
[  504.429901][T14236] Dev loop4: unable to read RDB block 1
[  504.435534][T14236]  loop4: unable to read partition table
[  504.472093][T14236] loop4: partition table beyond EOD, truncated
[  504.478332][T14236] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5)
[  504.555008][ T5918] usb 1-1: new high-speed USB device number 107 using dummy_hcd
[  504.720789][ T5918] usb 1-1: Using ep0 maxpacket: 32
[  504.727988][ T5918] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 16129, setting to 1024
[  504.750430][ T5918] usb 1-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024
[  504.776143][ T5918] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  504.785848][ T5902] usb 5-1: new full-speed USB device number 19 using dummy_hcd
[  504.806307][ T5918] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  504.818325][ T5918] usb 1-1: Product: syz
[  504.823907][ T5918] usb 1-1: Manufacturer: syz
[  504.828768][ T5918] usb 1-1: SerialNumber: syz
[  504.953395][ T5902] usb 5-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e
[  504.971991][ T5902] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  505.002664][ T5902] usb 5-1: config 0 descriptor??
[  505.147922][ T5918] cdc_ncm 1-1:1.0: bind() failure
[  505.180362][ T5918] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found
[  505.197123][ T5918] cdc_ncm 1-1:1.1: bind() failure
[  505.234218][ T5918] usb 1-1: USB disconnect, device number 107
[  507.532971][    T9] usb 5-1: USB disconnect, device number 19
[  527.281314][ T1304] ieee802154 phy0 wpan0: encryption failed: -22
[  527.287886][ T1304] ieee802154 phy1 wpan1: encryption failed: -22
[  531.976706][ T5915] usb 1-1: new high-speed USB device number 108 using dummy_hcd
[  532.168955][ T5915] usb 1-1: Using ep0 maxpacket: 8
[  532.192398][ T5915] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b
[  532.200955][ T5902] usb 6-1: new high-speed USB device number 15 using dummy_hcd
[  532.201549][ T5915] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  532.236154][ T5915] pvrusb2: Hardware description: Terratec Grabster AV400
[  532.254229][ T5915] pvrusb2: **********
[  532.258283][ T5915] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[  532.269564][ T5915] pvrusb2: Important functionality might not be entirely working.
[  532.277935][ T5915] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[  532.289919][ T5915] pvrusb2: **********
[  532.374797][ T5902] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 129, changing to 11
[  532.389691][ T5902] usb 6-1: New USB device found, idVendor=046d, idProduct=ca03, bcdDevice= 0.00
[  532.402155][ T5902] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  532.419910][ T5902] usb 6-1: config 0 descriptor??
[  532.462554][ T2349] pvrusb2: Invalid write control endpoint
[  532.666673][ T2349] pvrusb2: Invalid write control endpoint
[  532.719104][ T2349] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[  532.741077][ T2349] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[  532.800082][ T2349] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[  532.821259][ T2349] pvrusb2: Device being rendered inoperable
[  532.900576][ T5902] logitech 0003:046D:CA03.0013: unbalanced delimiter at end of report description
[  532.906371][T14275] pvrusb2: Attempted to execute control transfer when device not ok
[  532.927120][ T5902] logitech 0003:046D:CA03.0013: parse failed
[  532.946949][ T5902] logitech 0003:046D:CA03.0013: probe with driver logitech failed with error -22
[  532.981761][ T2349] cx25840 1-0044: Unable to detect h/w, assuming cx23887
[  532.989323][ T2349] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[  533.021491][ T2349] pvrusb2: Attached sub-driver cx25840
[  533.047931][ T2349] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  533.079155][ T2349] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  533.132384][ T5902] usb 6-1: USB disconnect, device number 15
[  533.363809][T14308] input: syz1 as /devices/virtual/input/input76
[  533.428926][ T5902] usb 1-1: USB disconnect, device number 108
[  534.348301][T14333] batadv_slave_1: entered promiscuous mode
[  534.581336][T14338] batadv_slave_1: left promiscuous mode
[  534.970911][    T9] usb 1-1: new high-speed USB device number 109 using dummy_hcd
[  535.029745][T14355] input: syz1 as /devices/virtual/input/input77
[  535.190784][    T9] usb 1-1: Using ep0 maxpacket: 8
[  535.207079][    T9] usb 1-1: config 32 has 1 interface, different from the descriptor's value: 2
[  535.249095][    T9] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7
[  535.283581][    T9] usb 1-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0
[  535.308705][    T9] usb 1-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7
[  535.333183][    T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  535.588342][T14349] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  535.620527][T14349] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  535.716177][T14373] 9pnet_virtio: no channels available for device /dev/sr0
[  535.958221][T14381] vim2m vim2m.0: Fourcc format (0x47425247) invalid.
[  536.381033][ T1220] usb 2-1: new high-speed USB device number 69 using dummy_hcd
[  536.610020][ T1220] usb 2-1: Using ep0 maxpacket: 8
[  536.629793][ T1220] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb
[  536.658938][ T1220] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  536.674643][ T1220] usb 2-1: config 0 descriptor??
[  537.077689][T14401] /dev/rnullb0: Can't open blockdev
[  537.546606][T14384] 9pnet_fd: Insufficient options for proto=fd
[  537.585946][ T1220] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71
[  537.625536][ T1220] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to write GPIO value 0x0080: ffffffb9
[  537.634071][T14415] netlink: 'syz.4.2609': attribute type 11 has an invalid length.
[  537.662564][    T9] usb 1-1: string descriptor 0 read error: -71
[  537.670836][ T1220] asix 2-1:0.0: probe with driver asix failed with error -71
[  537.698885][ T1220] usb 2-1: USB disconnect, device number 69
[  537.733800][    T9] usb 1-1: USB disconnect, device number 109
[  537.963273][ T5830] usb 5-1: new high-speed USB device number 20 using dummy_hcd
[  538.123424][ T5830] usb 5-1: Using ep0 maxpacket: 16
[  538.136456][ T5830] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06
[  538.160033][ T5830] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  538.172834][ T5830] usb 5-1: Product: syz
[  538.186004][ T5830] usb 5-1: Manufacturer: syz
[  538.214076][ T5830] usb 5-1: SerialNumber: syz
[  538.247044][ T5830] r8152-cfgselector 5-1: Unknown version 0x0000
[  538.253853][ T5830] r8152-cfgselector 5-1: config 0 descriptor??
[  538.458993][T14423] comedi comedi3: 8255: I/O port conflict (0x5,4)
[  538.473224][T14423] comedi comedi3: 8255: I/O port conflict (0x2,4)
[  538.483396][T14423] comedi comedi3: 8255: I/O port conflict (0x1,4)
[  538.515098][T14423] comedi comedi3: 8255: I/O port conflict (0x5c952399,4)
[  538.524856][T14423] comedi comedi3: 8255: I/O port conflict (0x5,4)
[  538.542238][T14423] comedi comedi3: 8255: I/O port conflict (0x3ff,4)
[  538.560795][T14423] comedi comedi3: 8255: I/O port conflict (0x2,4)
[  538.571651][T14423] comedi comedi3: 8255: I/O port conflict (0x1,4)
[  538.592709][T14423] comedi comedi3: 8255: I/O port conflict (0x1,4)
[  538.617529][T14423] comedi comedi3: 8255: I/O port conflict (0x9,4)
[  538.618482][T14429] program syz.0.2614 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  538.881657][ T1220] usb 2-1: new high-speed USB device number 70 using dummy_hcd
[  539.053511][ T1220] usb 2-1: Using ep0 maxpacket: 16
[  539.069697][ T1220] usb 2-1: too many configurations: 97, using maximum allowed: 8
[  539.090151][ T1220] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  539.117580][ T1220] usb 2-1: config 0 has no interfaces?
[  539.124503][ T1220] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  539.145741][ T1220] usb 2-1: config 0 has no interfaces?
[  539.157708][ T1220] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  539.180480][ T1220] usb 2-1: config 0 has no interfaces?
[  539.193719][ T1220] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  539.213841][ T1220] usb 2-1: config 0 has no interfaces?
[  539.229491][ T1220] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  539.258677][ T1220] usb 2-1: config 0 has no interfaces?
[  539.265626][ T1220] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  539.287120][ T1220] usb 2-1: config 0 has no interfaces?
[  539.299198][ T1220] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  539.320325][ T1220] usb 2-1: config 0 has no interfaces?
[  539.333300][ T1220] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  539.352802][ T1220] usb 2-1: config 0 has no interfaces?
[  539.605276][ T1220] usb 2-1: string descriptor 0 read error: -71
[  539.626019][ T1220] usb 2-1: New USB device found, idVendor=2304, idProduct=023b, bcdDevice=7b.5c
[  539.643230][ T1220] usb 2-1: New USB device strings: Mfr=249, Product=204, SerialNumber=224
[  539.685276][ T1220] usb 2-1: config 0 descriptor??
[  539.701273][ T1220] usb 2-1: can't set config #0, error -71
[  539.708286][T14455] /dev/rnullb0: Can't open blockdev
[  539.717079][ T1220] usb 2-1: USB disconnect, device number 70
[  540.187558][T14468] /dev/rnullb0: Can't open blockdev
[  540.382640][T14472] netlink: 'syz.5.2626': attribute type 4 has an invalid length.
[  540.631907][T14474] /dev/rnullb0: Can't open blockdev
[  540.726908][T14477] input: syz1 as /devices/virtual/input/input81
[  540.848249][    T9] r8152-cfgselector 5-1: USB disconnect, device number 20
[  541.171584][T14479] /dev/rnullb0: Can't open blockdev
[  541.405515][T14493] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4)
[  541.412085][T14493] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed)
[  541.465086][T14493] vhci_hcd vhci_hcd.0: Device attached
[  541.702261][T14508] /dev/rnullb0: Can't open blockdev
[  541.744940][   T10] usb 42-1: SetAddress Request (2) to port 0
[  541.766073][   T10] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd
[  541.773848][ T1220] usb 5-1: new low-speed USB device number 21 using dummy_hcd
[  541.844187][    T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!!
[  541.855174][    T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!!
[  541.877185][    T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!!
[  541.877789][T14513] /dev/rnullb0: Can't open blockdev
[  541.886813][    T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!!
[  542.130401][T14517] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_virt_wifi, syncid = 33554432, id = 0
[  542.152362][ T1220] usb 5-1: unable to get BOS descriptor or descriptor too short
[  542.174348][ T1220] usb 5-1: config 9 has an invalid interface number: 236 but max is 0
[  542.229118][ T1220] usb 5-1: config 9 has no interface number 0
[  542.235270][ T1220] usb 5-1: config 9 interface 236 altsetting 0 endpoint 0x4 has invalid maxpacket 16, setting to 8
[  542.282544][ T1220] usb 5-1: config 9 interface 236 altsetting 0 has a duplicate endpoint with address 0x4, skipping
[  542.310956][ T1220] usb 5-1: config 9 interface 236 altsetting 0 has an endpoint descriptor with address 0x51, changing to 0x1
[  542.335660][ T1220] usb 5-1: config 9 interface 236 altsetting 0 endpoint 0x1 has invalid maxpacket 18441, setting to 8
[  542.384916][ T1220] usb 5-1: config 9 interface 236 altsetting 0 endpoint 0x9 is Bulk; changing to Interrupt
[  542.399946][ T1220] usb 5-1: config 9 interface 236 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3
[  542.446110][ T1220] usb 5-1: string descriptor 0 read error: -22
[  542.452444][ T1220] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice=55.e2
[  542.476732][ T1220] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  542.503642][T14493] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  542.511629][T14493] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  542.529880][ T1220] usb 5-1: ath9k_htc: Device endpoint numbers are not the expected ones
[  542.603744][T14530] No control pipe specified
[  542.674550][T14535] /dev/rnullb0: Can't open blockdev
[  542.758697][T14494] vhci_hcd: connection reset by peer
[  542.764647][ T5830] usb 5-1: USB disconnect, device number 21
[  542.795494][   T13] vhci_hcd: stop threads
[  542.820459][   T13] vhci_hcd: release socket
[  542.854461][   T13] vhci_hcd: disconnect device
[  542.977483][    T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!!
[  543.188954][T14549] /dev/rnullb0: Can't open blockdev
[  543.447391][ T5830] usb 2-1: new high-speed USB device number 71 using dummy_hcd
[  543.650476][ T5830] usb 2-1: Using ep0 maxpacket: 16
[  543.663313][ T5830] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  543.706446][ T5830] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  543.750111][ T5830] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  543.810984][ T5830] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  543.820689][ T5830] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  543.910347][ T5830] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  543.950077][ T5830] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  543.958127][ T5830] usb 2-1: Manufacturer: syz
[  544.004350][ T5830] usb 2-1: config 0 descriptor??
[  544.014393][    T9] usb 1-1: new full-speed USB device number 110 using dummy_hcd
[  544.055069][T14567] /dev/rnullb0: Can't open blockdev
[  544.200436][    T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  544.252306][    T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  544.281220][    T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  544.316044][    T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  544.356288][    T9] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  544.394416][    T9] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  544.432565][    T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  544.462044][    T9] usb 1-1: Product: syz
[  544.480943][    T9] usb 1-1: Manufacturer: syz
[  544.505372][    T9] usb 1-1: SerialNumber: syz
[  544.545075][    T9] usb 1-1: config 0 descriptor??
[  544.635420][T14577] /dev/rnullb0: Can't open blockdev
[  544.827123][    T9] radio-si470x 1-1:0.0: DeviceID=0x0000 ChipID=0x0000
[  544.860026][    T9] radio-si470x 1-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0.
[  545.032914][    T9] radio-si470x 1-1:0.0: software version 0, hardware version 0
[  545.052886][    T9] radio-si470x 1-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0.
[  545.093771][    T9] radio-si470x 1-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org
[  545.258733][    T9] radio-si470x 1-1:0.0: submitting int urb failed (-90)
[  545.724928][    T9] radio-si470x 1-1:0.0: si470x_set_report: usb_control_msg returned -71
[  545.766989][    T9] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -22
[  545.798109][    T9] usb 1-1: USB disconnect, device number 110
[  545.874440][  T927] usb 6-1: new high-speed USB device number 16 using dummy_hcd
[  545.964452][T14603] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  546.068448][  T927] usb 6-1: Using ep0 maxpacket: 8
[  546.083054][  T927] usb 6-1: config 9 has an invalid interface number: 70 but max is 0
[  546.104118][  T927] usb 6-1: config 9 has no interface number 0
[  546.122839][  T927] usb 6-1: too many endpoints for config 9 interface 70 altsetting 0: 109, using maximum allowed: 30
[  546.152138][  T927] usb 6-1: config 9 interface 70 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 109
[  546.188440][  T927] usb 6-1: New USB device found, idVendor=0b48, idProduct=1006, bcdDevice=b7.7d
[  546.211252][  T927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  546.237722][  T927] usb 6-1: Product: syz
[  546.252534][  T927] usb 6-1: Manufacturer: syz
[  546.263875][  T927] usb 6-1: SerialNumber: syz
[  546.279133][T14608] /dev/rnullb0: Can't open blockdev
[  546.505020][ T5830] rc_core: IR keymap rc-hauppauge not found
[  546.511046][ T5830] Registered IR keymap rc-empty
[  546.543423][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  546.604961][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  546.645561][ T5830] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0
[  546.696269][T14618] block device autoloading is deprecated and will be removed.
[  546.721653][ T5830] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input85
[  546.745494][T14618] syz.0.2669: attempt to access beyond end of device
[  546.745494][T14618] loop0: rw=2048, sector=0, nr_sectors = 8 limit=0
[  546.792649][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  546.836328][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  546.880921][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  546.975332][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  547.018118][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  547.048679][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  547.104101][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  547.112301][T14632] overlayfs: failed to resolve './bus': -2
[  547.136058][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  547.178454][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  547.199873][   T10] usb 42-1: device descriptor read/8, error -110
[  547.223541][ T5830] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  547.266650][ T5830] mceusb 2-1:0.0: Registered  with mce emulator interface version 1
[  547.296015][ T5830] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  547.320690][T14638] /dev/rnullb0: Can't open blockdev
[  547.325249][ T5830] usb 2-1: USB disconnect, device number 71
[  547.745012][ T5902] usb 5-1: new high-speed USB device number 22 using dummy_hcd
[  547.810502][   T10] usb usb42-port1: attempt power cycle
[  547.869321][T14645] /dev/rnullb0: Can't open blockdev
[  547.919699][ T5902] usb 5-1: Using ep0 maxpacket: 16
[  547.937599][ T5830] usb 2-1: new high-speed USB device number 72 using dummy_hcd
[  547.959198][ T5902] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  547.981927][ T5902] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  548.023451][ T5902] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  548.056867][ T5902] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  548.076359][ T5902] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  548.108563][ T5902] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  548.142608][ T5902] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  548.151703][ T5830] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  548.173176][ T5830] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  548.184551][ T5902] usb 5-1: Manufacturer: syz
[  548.193713][ T5902] usb 5-1: config 0 descriptor??
[  548.204718][ T5830] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  548.236342][ T5830] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  548.258166][ T5830] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  548.310919][ T5830] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  548.348209][   T30] audit: type=1326 audit(1753838349.983:2439): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14650 comm="syz.0.2680" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fa74678e9a9 code=0x0
[  548.382034][ T5830] usb 2-1: config 0 descriptor??
[  548.431365][   T10] usb usb42-port1: unable to enumerate USB device
[  548.859959][ T5830] plantronics 0003:047F:FFFF.0014: unknown main item tag 0x0
[  548.927587][ T5830] plantronics 0003:047F:FFFF.0014: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0
[  549.150170][T14661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  549.164521][T14661] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  549.227072][T14665] overlayfs: failed to resolve './bus': -2
[  549.357474][T14667] /dev/rnullb0: Can't open blockdev
[  549.405189][   T10] usb 2-1: USB disconnect, device number 72
[  549.565711][T14671] /dev/rnullb0: Can't open blockdev
[  549.874265][T14670] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  549.916455][T14681] /dev/rnullb0: Can't open blockdev
[  549.953363][T14681] /dev/rnullb0: Can't open blockdev
[  550.348771][T14696] overlayfs: failed to resolve './bus': -2
[  550.701557][  T927] ttusb_dec_send_command: command bulk message failed: error -22
[  550.731855][  T927] ttusb-dec 6-1:9.70: probe with driver ttusb-dec failed with error -22
[  550.780405][  T927] usb 6-1: USB disconnect, device number 16
[  550.791891][ T5902] rc_core: IR keymap rc-hauppauge not found
[  550.818052][ T5902] Registered IR keymap rc-empty
[  550.845287][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  550.898876][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  550.932076][ T5902] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0
[  550.980400][ T5902] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input87
[  551.015843][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.038376][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.129279][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.169117][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.208756][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.268368][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.305621][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.347751][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.396922][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.433804][ T5902] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  551.466572][ T5902] mceusb 5-1:0.0: Registered  with mce emulator interface version 1
[  551.486131][ T5902] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  551.502854][T14728] /dev/rnullb0: Can't open blockdev
[  551.512889][ T5902] usb 5-1: USB disconnect, device number 22
[  551.535180][T14732] loop2: detected capacity change from 0 to 7
[  551.552736][T14732]  loop2: [CUMANA/ADFS] p1 [ADFS] p1
[  551.584206][T14732] loop2: partition table partially beyond EOD, truncated
[  551.614259][T14732] loop2: p1 size 872559382 extends beyond EOD, truncated
[  551.893047][   T24] usb 2-1: new high-speed USB device number 73 using dummy_hcd
[  551.901895][T14740] /dev/rnullb0: Can't open blockdev
[  551.908318][ T5902] usb 5-1: new high-speed USB device number 23 using dummy_hcd
[  551.978480][  T927] usb 6-1: new high-speed USB device number 17 using dummy_hcd
[  552.063976][ T5902] usb 5-1: device descriptor read/64, error -71
[  552.077165][   T24] usb 2-1: config 0 has an invalid interface number: 108 but max is 0
[  552.085521][   T24] usb 2-1: config 0 has no interface number 0
[  552.091664][   T24] usb 2-1: config 0 interface 108 altsetting 253 bulk endpoint 0xE has invalid maxpacket 1024
[  552.128286][   T24] usb 2-1: config 0 interface 108 has no altsetting 0
[  552.149510][  T927] usb 6-1: Using ep0 maxpacket: 16
[  552.166832][   T24] usb 2-1: New USB device found, idVendor=05f9, idProduct=ffff, bcdDevice= e.b7
[  552.193026][   T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  552.201234][  T927] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  552.222646][  T927] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  552.241880][   T24] usb 2-1: config 0 descriptor??
[  552.267303][  T927] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  552.277568][T14733] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  552.287448][   T24] usbserial_generic 2-1:0.108: The "generic" usb-serial driver is only for testing and one-off prototypes.
[  552.310193][  T927] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  552.320907][ T5902] usb 5-1: new high-speed USB device number 24 using dummy_hcd
[  552.333035][   T24] usbserial_generic 2-1:0.108: Tell linux-usb@vger.kernel.org to add your device to a proper driver.
[  552.352793][  T927] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  552.373986][   T24] usbserial_generic 2-1:0.108: generic converter detected
[  552.392264][  T927] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  552.403358][   T24] usb 2-1: generic converter now attached to ttyUSB0
[  552.436547][  T927] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  552.465195][  T927] usb 6-1: Manufacturer: syz
[  552.495086][  T927] usb 6-1: config 0 descriptor??
[  552.503046][ T5902] usb 5-1: device descriptor read/64, error -71
[  552.520723][T14732] /dev/rnullb0: Can't open blockdev
[  552.545075][ T5830] usb 2-1: USB disconnect, device number 73
[  552.573623][ T5830] generic ttyUSB0: generic converter now disconnected from ttyUSB0
[  552.602494][ T5830] usbserial_generic 2-1:0.108: device disconnected
[  552.622812][ T5902] usb usb5-port1: attempt power cycle
[  552.724335][T14751] /dev/rnullb0: Can't open blockdev
[  552.925715][T14755] /dev/rnullb0: Can't open blockdev
[  553.015978][ T5902] usb 5-1: new high-speed USB device number 25 using dummy_hcd
[  553.048802][ T5902] usb 5-1: device descriptor read/8, error -71
[  553.145172][T14759] /dev/rnullb0: Can't open blockdev
[  553.313920][ T5902] usb 5-1: new high-speed USB device number 26 using dummy_hcd
[  553.349070][ T5902] usb 5-1: device descriptor read/8, error -71
[  553.479524][ T5902] usb usb5-port1: unable to enumerate USB device
[  554.259866][T14785] /dev/rnullb0: Can't open blockdev
[  554.429203][T14791] /dev/rnullb0: Can't open blockdev
[  554.624639][T14793] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2730'.
[  554.641139][T14796] syz.4.2731: attempt to access beyond end of device
[  554.641139][T14796] nbd4: rw=4096, sector=2, nr_sectors = 2 limit=0
[  554.656442][T14793] /dev/rnullb0: Can't open blockdev
[  554.665759][T14796] EXT4-fs (nbd4): unable to read superblock
[  554.684975][T14793] /dev/rnullb0: Can't open blockdev
[  554.942144][  T927] rc_core: IR keymap rc-hauppauge not found
[  554.959414][  T927] Registered IR keymap rc-empty
[  554.970298][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  554.982255][T14812] sctp: [Deprecated]: syz.0.2734 (pid 14812) Use of int in max_burst socket option.
[  554.982255][T14812] Use struct sctp_assoc_value instead
[  555.004588][T14813] sctp: [Deprecated]: syz.0.2734 (pid 14813) Use of int in max_burst socket option.
[  555.004588][T14813] Use struct sctp_assoc_value instead
[  555.035995][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.060625][  T927] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0
[  555.104862][  T927] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input88
[  555.143041][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.185694][ T5830] usb 5-1: new high-speed USB device number 27 using dummy_hcd
[  555.193621][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.239111][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.271258][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.300073][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.335357][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.367356][ T5830] usb 5-1: device descriptor read/64, error -71
[  555.373769][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.431561][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.463610][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.501543][  T927] mceusb 6-1:0.0: Error: mce write submit urb error = -90
[  555.529883][  T927] mceusb 6-1:0.0: Registered  with mce emulator interface version 1
[  555.553865][  T927] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  555.583005][  T927] usb 6-1: USB disconnect, device number 17
[  555.623914][ T5830] usb 5-1: new high-speed USB device number 28 using dummy_hcd
[  555.688242][    T9] usb 2-1: new high-speed USB device number 74 using dummy_hcd
[  555.774261][ T5830] usb 5-1: device descriptor read/64, error -71
[  555.863698][    T9] usb 2-1: config 0 interface 0 has no altsetting 0
[  555.873665][    T9] usb 2-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75
[  555.891964][ T5830] usb usb5-port1: attempt power cycle
[  555.894058][    T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  555.912593][ T5918] usb 1-1: new high-speed USB device number 111 using dummy_hcd
[  555.928030][    T9] usb 2-1: config 0 descriptor??
[  555.944827][  T927] usb 6-1: new high-speed USB device number 18 using dummy_hcd
[  556.094837][ T5918] usb 1-1: Using ep0 maxpacket: 16
[  556.107254][ T5918] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  556.129305][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  556.141283][  T927] usb 6-1: config 1 contains an unexpected descriptor of type 0x1, skipping
[  556.154683][    T9]  (null): keene_cmd_main failed (-71)
[  556.157208][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  556.172748][  T927] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  556.188779][    T9] video4linux radio48: keene_cmd_main failed (-71)
[  556.196532][  T927] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2
[  556.205604][ T5918] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  556.216847][  T927] usb 6-1: config 1 has no interface number 0
[  556.224455][ T5918] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  556.226159][    T9] radio-keene 2-1:0.0: V4L2 device registered as radio48
[  556.241925][  T927] usb 6-1: too many endpoints for config 1 interface 1 altsetting 1: 32, using maximum allowed: 30
[  556.255955][ T5830] usb 5-1: new high-speed USB device number 29 using dummy_hcd
[  556.271629][  T927] usb 6-1: config 1 interface 1 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 32
[  556.286240][ T5918] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  556.303909][ T5830] usb 5-1: device descriptor read/8, error -71
[  556.308489][    T9] usb 2-1: USB disconnect, device number 74
[  556.311911][ T5918] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  556.325865][ T5918] usb 1-1: Manufacturer: syz
[  556.332270][  T927] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  556.341886][  T927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  556.349898][  T927] usb 6-1: Product: syz
[  556.356711][  T927] usb 6-1: Manufacturer: syz
[  556.361351][  T927] usb 6-1: SerialNumber: syz
[  556.366971][ T5918] usb 1-1: config 0 descriptor??
[  556.577343][ T5830] usb 5-1: new high-speed USB device number 30 using dummy_hcd
[  556.622095][ T5830] usb 5-1: device descriptor read/8, error -71
[  556.632694][  T927] cdc_mbim 6-1:1.1: probe with driver cdc_mbim failed with error -71
[  556.664090][  T927] usb 6-1: USB disconnect, device number 18
[  556.736199][ T5830] usb usb5-port1: unable to enumerate USB device
[  557.148356][T14836] /dev/rnullb0: Can't open blockdev
[  557.366587][ T1220] usb 2-1: new high-speed USB device number 75 using dummy_hcd
[  557.516437][ T1220] usb 2-1: device descriptor read/64, error -71
[  557.783625][ T1220] usb 2-1: new high-speed USB device number 76 using dummy_hcd
[  557.954541][ T1220] usb 2-1: device descriptor read/64, error -71
[  558.083087][ T1220] usb usb2-port1: attempt power cycle
[  558.480122][ T1220] usb 2-1: new high-speed USB device number 77 using dummy_hcd
[  558.528939][ T1220] usb 2-1: device descriptor read/8, error -71
[  558.813373][ T1220] usb 2-1: new high-speed USB device number 78 using dummy_hcd
[  558.855249][ T1220] usb 2-1: device descriptor read/8, error -71
[  558.869499][T14861] /dev/rnullb0: Can't open blockdev
[  558.880858][T14861] /dev/rnullb0: Can't open blockdev
[  558.959534][ T5918] rc_core: IR keymap rc-hauppauge not found
[  558.969056][ T5918] Registered IR keymap rc-empty
[  558.982746][ T1220] usb usb2-port1: unable to enumerate USB device
[  558.986078][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.038025][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.089149][ T5918] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
[  559.119222][ T5918] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input89
[  559.160154][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.216097][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.243229][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.264907][T14870] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  559.273440][T14870] /dev/rnullb0: Can't open blockdev
[  559.280420][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.312284][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.339797][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.391375][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.392309][T14874] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  559.432320][T14874] /dev/rnullb0: Can't open blockdev
[  559.440563][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.461923][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.490808][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  559.536434][T14879] /dev/rnullb0: Can't open blockdev
[  559.545155][ T5918] mceusb 1-1:0.0: Registered  with mce emulator interface version 1
[  559.592425][ T5918] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  559.638605][ T5918] usb 1-1: USB disconnect, device number 111
[  559.912152][T14889] binder: 14881:14889 ioctl c0306201 0 returned -14
[  559.938619][T14891] overlayfs: failed to resolve './bus': -2
[  560.097337][T14893] /dev/rnullb0: Can't open blockdev
[  560.146229][ T5918] usb 1-1: new high-speed USB device number 112 using dummy_hcd
[  560.311197][ T5918] usb 1-1: Using ep0 maxpacket: 16
[  560.322572][ T5918] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  560.344078][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  560.381222][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  560.412669][ T5918] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  560.463317][ T5918] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  560.517785][ T5918] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  560.537961][ T5918] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  560.559433][ T5918] usb 1-1: Manufacturer: syz
[  560.585430][ T5918] usb 1-1: config 0 descriptor??
[  560.830572][ T1220] usb 2-1: new full-speed USB device number 79 using dummy_hcd
[  560.948005][  T927] usb 6-1: new full-speed USB device number 19 using dummy_hcd
[  561.008211][ T1220] usb 2-1: unable to get BOS descriptor or descriptor too short
[  561.086861][  T927] usb 6-1: device descriptor read/64, error -71
[  561.193742][ T1220] usb 2-1: not running at top speed; connect to a high speed hub
[  561.213715][ T1220] usb 2-1: config 232 has an invalid interface number: 239 but max is 0
[  561.222520][ T1220] usb 2-1: config 232 has no interface number 0
[  561.236771][ T1220] usb 2-1: config 232 interface 239 altsetting 0 endpoint 0xC has an invalid bInterval 80, changing to 4
[  561.262185][ T1220] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a4, bcdDevice=e4.a6
[  561.279343][ T1220] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  561.298185][ T1220] usb 2-1: Product: syz
[  561.311371][ T1220] usb 2-1: Manufacturer: syz
[  561.316038][ T1220] usb 2-1: SerialNumber: syz
[  561.343525][  T927] usb 6-1: new full-speed USB device number 20 using dummy_hcd
[  561.503810][  T927] usb 6-1: device descriptor read/64, error -71
[  561.552236][T14897] /dev/rnullb0: Can't open blockdev
[  561.565822][ T1220] usbtest 2-1:232.239: couldn't get endpoints, -22
[  561.578953][ T1220] usbtest 2-1:232.239: probe with driver usbtest failed with error -22
[  561.609093][ T1220] usb 2-1: USB disconnect, device number 79
[  561.622103][  T927] usb usb6-port1: attempt power cycle
[  561.825287][ T5830] usb 5-1: new high-speed USB device number 31 using dummy_hcd
[  561.995691][  T927] usb 6-1: new full-speed USB device number 21 using dummy_hcd
[  562.008659][ T5830] usb 5-1: Using ep0 maxpacket: 16
[  562.018702][  T927] usb 6-1: device descriptor read/8, error -71
[  562.026521][ T5830] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  562.043734][ T5830] usb 5-1: New USB device found, idVendor=0458, idProduct=0087, bcdDevice= 0.00
[  562.053601][ T5830] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  562.074331][ T5830] usb 5-1: config 0 descriptor??
[  562.205353][T14912] /dev/rnullb0: Can't open blockdev
[  562.273552][  T927] usb 6-1: new full-speed USB device number 22 using dummy_hcd
[  562.283617][T14915] overlayfs: failed to resolve './bus': -2
[  562.306532][  T927] usb 6-1: device descriptor read/8, error -71
[  562.377828][ T5830] usbhid 5-1:0.0: can't add hid device: -71
[  562.400714][ T5830] usbhid 5-1:0.0: probe with driver usbhid failed with error -71
[  562.445626][  T927] usb usb6-port1: unable to enumerate USB device
[  562.461082][ T5830] usb 5-1: USB disconnect, device number 31
[  562.473947][T14920] /dev/rnullb0: Can't open blockdev
[  562.544240][T14922] /dev/rnullb0: Can't open blockdev
[  562.908424][T14932] FAULT_INJECTION: forcing a failure.
[  562.908424][T14932] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  562.971299][T14932] CPU: 1 UID: 0 PID: 14932 Comm: syz.1.2779 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  562.971329][T14932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  562.971348][T14932] Call Trace:
[  562.971358][T14932]  <TASK>
[  562.971367][T14932]  dump_stack_lvl+0x189/0x250
[  562.971401][T14932]  ? __pfx____ratelimit+0x10/0x10
[  562.971433][T14932]  ? __pfx_dump_stack_lvl+0x10/0x10
[  562.971462][T14932]  ? __pfx__printk+0x10/0x10
[  562.971503][T14932]  ? __might_fault+0xb0/0x130
[  562.971537][T14932]  should_fail_ex+0x414/0x560
[  562.971569][T14932]  _copy_from_iter+0x1db/0x16f0
[  562.971592][T14932]  ? __lock_acquire+0xab9/0xd20
[  562.971622][T14932]  ? __pfx__copy_from_iter+0x10/0x10
[  562.971672][T14932]  tun_get_user+0x219/0x3e20
[  562.971710][T14932]  ? aa_file_perm+0x13e/0x11b0
[  562.971732][T14932]  ? aa_file_perm+0x3ed/0x11b0
[  562.971751][T14932]  ? __pfx_tun_get_user+0x10/0x10
[  562.971772][T14932]  ? _parse_integer_limit+0x1ae/0x1f0
[  562.971808][T14932]  ? __lock_acquire+0xab9/0xd20
[  562.971837][T14932]  ? ref_tracker_alloc+0x318/0x460
[  562.971861][T14932]  ? __lock_acquire+0xab9/0xd20
[  562.971887][T14932]  ? __pfx_ref_tracker_alloc+0x10/0x10
[  562.971920][T14932]  ? tun_get+0x1c/0x2f0
[  562.971958][T14932]  ? tun_get+0x1c/0x2f0
[  562.971979][T14932]  ? tun_get+0x1c/0x2f0
[  562.972005][T14932]  tun_chr_write_iter+0x113/0x200
[  562.972029][T14932]  vfs_write+0x54b/0xa90
[  562.972061][T14932]  ? __pfx_tun_chr_write_iter+0x10/0x10
[  562.972084][T14932]  ? __pfx_vfs_write+0x10/0x10
[  562.972121][T14932]  ? __fget_files+0x2a/0x420
[  562.972161][T14932]  ksys_write+0x145/0x250
[  562.972188][T14932]  ? __pfx_ksys_write+0x10/0x10
[  562.972210][T14932]  ? rcu_is_watching+0x15/0xb0
[  562.972239][T14932]  ? do_syscall_64+0xbe/0x3b0
[  562.972273][T14932]  do_syscall_64+0xfa/0x3b0
[  562.972301][T14932]  ? lockdep_hardirqs_on+0x9c/0x150
[  562.972327][T14932]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  562.972348][T14932]  ? clear_bhb_loop+0x60/0xb0
[  562.972372][T14932]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  562.972400][T14932] RIP: 0033:0x7fc24358e9a9
[  562.972419][T14932] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  562.972437][T14932] RSP: 002b:00007fc244416038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  562.972457][T14932] RAX: ffffffffffffffda RBX: 00007fc2437b5fa0 RCX: 00007fc24358e9a9
[  562.972473][T14932] RDX: 000000000000fdef RSI: 0000200000000440 RDI: 0000000000000004
[  562.972486][T14932] RBP: 00007fc244416090 R08: 0000000000000000 R09: 0000000000000000
[  562.972498][T14932] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  562.972510][T14932] R13: 0000000000000000 R14: 00007fc2437b5fa0 R15: 00007ffc335e4228
[  562.972541][T14932]  </TASK>
[  563.280186][ T5918] rc_core: IR keymap rc-hauppauge not found
[  563.286181][ T5918] Registered IR keymap rc-empty
[  563.295510][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.304978][T14938] input: syz1 as /devices/virtual/input/input91
[  563.321663][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.336974][T14939] overlayfs: failed to resolve './bus': -2
[  563.397676][ T5918] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
[  563.411607][ T5918] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input90
[  563.456340][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.481587][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.503042][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.524337][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.545709][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.567083][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.588536][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.609848][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.643100][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.698603][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  563.714985][T14952] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2785'.
[  563.733725][ T5918] mceusb 1-1:0.0: Registered  with mce emulator interface version 1
[  563.738253][T14952] input: syz1 as /devices/virtual/input/input92
[  563.766244][ T5918] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  563.805192][ T5918] usb 1-1: USB disconnect, device number 112
[  564.159950][T14956] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(8)
[  564.166511][T14956] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed)
[  564.215543][T14956] vhci_hcd vhci_hcd.0: Device attached
[  564.244956][T14958] vhci_hcd: connection closed
[  564.246031][ T1334] vhci_hcd: stop threads
[  564.262425][ T1334] vhci_hcd: release socket
[  564.273276][ T1334] vhci_hcd: disconnect device
[  564.306422][T14961] netlink: 'syz.1.2788': attribute type 22 has an invalid length.
[  564.314536][T14961] netlink: 14380 bytes leftover after parsing attributes in process `syz.1.2788'.
[  564.329019][T14961] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2788'.
[  564.604406][ T1220] usb 2-1: new high-speed USB device number 80 using dummy_hcd
[  564.764499][ T1220] usb 2-1: Using ep0 maxpacket: 32
[  564.771566][ T1220] usb 2-1: config 0 has an invalid interface number: 230 but max is 0
[  564.783790][ T1220] usb 2-1: config 0 has no interface number 0
[  564.793318][ T1220] usb 2-1: config 0 interface 230 has no altsetting 0
[  564.809060][ T1220] usb 2-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05
[  564.818617][   T10] usb 5-1: new high-speed USB device number 32 using dummy_hcd
[  564.832932][ T1220] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  564.841980][ T1220] usb 2-1: Product: syz
[  564.846164][ T1220] usb 2-1: Manufacturer: syz
[  564.854974][ T1220] usb 2-1: SerialNumber: syz
[  564.863809][ T1220] usb 2-1: config 0 descriptor??
[  564.880834][ T1220] ums-usbat 2-1:0.230: USB Mass Storage device detected
[  564.900085][ T1220] ums-usbat 2-1:0.230: Quirks match for vid 0781 pid 0005: 1
[  564.999715][   T10] usb 5-1: Using ep0 maxpacket: 16
[  565.013188][   T10] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  565.034268][   T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  565.045528][   T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  565.055834][   T10] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  565.065948][   T10] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  565.081369][   T10] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  565.091006][   T10] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  565.103175][   T10] usb 5-1: Manufacturer: syz
[  565.117884][   T10] usb 5-1: config 0 descriptor??
[  565.416591][   T10] rc_core: IR keymap rc-hauppauge not found
[  565.427222][   T10] Registered IR keymap rc-empty
[  565.438481][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.459649][T14980] input: syz1 as /devices/virtual/input/input94
[  565.470050][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.501266][   T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0
[  565.535023][   T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input93
[  565.579216][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.613044][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.662460][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.694580][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.718217][T14987] /dev/rnullb0: Can't open blockdev
[  565.731889][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.769579][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.829493][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.855192][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.879149][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.908611][   T10] mceusb 5-1:0.0: Error: mce write submit urb error = -90
[  565.932290][   T10] mceusb 5-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  565.942219][   T10] mceusb 5-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  565.966516][   T10] usb 5-1: USB disconnect, device number 32
[  566.444796][T15012] /dev/rnullb0: Can't open blockdev
[  567.340441][ T1220] ums-usbat 2-1:0.230: probe with driver ums-usbat failed with error -5
[  567.384376][ T5918] usb 1-1: new high-speed USB device number 113 using dummy_hcd
[  567.399938][T15047] FAULT_INJECTION: forcing a failure.
[  567.399938][T15047] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  567.451507][T15047] CPU: 0 UID: 0 PID: 15047 Comm: syz.4.2813 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  567.451538][T15047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  567.451551][T15047] Call Trace:
[  567.451560][T15047]  <TASK>
[  567.451570][T15047]  dump_stack_lvl+0x189/0x250
[  567.451603][T15047]  ? __pfx____ratelimit+0x10/0x10
[  567.451634][T15047]  ? __pfx_dump_stack_lvl+0x10/0x10
[  567.451663][T15047]  ? __pfx__printk+0x10/0x10
[  567.451693][T15047]  ? __might_fault+0xb0/0x130
[  567.451728][T15047]  should_fail_ex+0x414/0x560
[  567.451759][T15047]  _copy_from_iter+0x1db/0x16f0
[  567.451789][T15047]  ? lockdep_hardirqs_on+0x9c/0x150
[  567.451818][T15047]  ? __pfx__copy_from_iter+0x10/0x10
[  567.451853][T15047]  ? pskb_expand_head+0x382/0x1150
[  567.451877][T15047]  ? kmem_cache_free+0x18f/0x400
[  567.451911][T15047]  skb_copy_datagram_from_iter+0xf5/0x720
[  567.451949][T15047]  tun_get_user+0x1691/0x3e20
[  567.451990][T15047]  ? aa_file_perm+0x13e/0x11b0
[  567.452011][T15047]  ? aa_file_perm+0x3ed/0x11b0
[  567.452030][T15047]  ? __pfx_tun_get_user+0x10/0x10
[  567.452051][T15047]  ? _parse_integer_limit+0x1ae/0x1f0
[  567.452089][T15047]  ? __lock_acquire+0xab9/0xd20
[  567.452118][T15047]  ? ref_tracker_alloc+0x318/0x460
[  567.452144][T15047]  ? __lock_acquire+0xab9/0xd20
[  567.452168][T15047]  ? __pfx_ref_tracker_alloc+0x10/0x10
[  567.452202][T15047]  ? tun_get+0x1c/0x2f0
[  567.452229][T15047]  ? tun_get+0x1c/0x2f0
[  567.452250][T15047]  ? tun_get+0x1c/0x2f0
[  567.452276][T15047]  tun_chr_write_iter+0x113/0x200
[  567.452301][T15047]  vfs_write+0x54b/0xa90
[  567.452334][T15047]  ? __pfx_tun_chr_write_iter+0x10/0x10
[  567.452363][T15047]  ? __pfx_vfs_write+0x10/0x10
[  567.452401][T15047]  ? __fget_files+0x2a/0x420
[  567.452442][T15047]  ksys_write+0x145/0x250
[  567.452471][T15047]  ? __pfx_ksys_write+0x10/0x10
[  567.452495][T15047]  ? rcu_is_watching+0x15/0xb0
[  567.452530][T15047]  ? do_syscall_64+0xbe/0x3b0
[  567.452565][T15047]  do_syscall_64+0xfa/0x3b0
[  567.452597][T15047]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  567.452616][T15047]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  567.452636][T15047]  ? clear_bhb_loop+0x60/0xb0
[  567.452661][T15047]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  567.452681][T15047] RIP: 0033:0x7f93cd98e9a9
[  567.452700][T15047] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  567.452717][T15047] RSP: 002b:00007f93ce7c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  567.452740][T15047] RAX: ffffffffffffffda RBX: 00007f93cdbb5fa0 RCX: 00007f93cd98e9a9
[  567.452755][T15047] RDX: 000000000000fdef RSI: 0000200000000440 RDI: 0000000000000004
[  567.452769][T15047] RBP: 00007f93ce7c7090 R08: 0000000000000000 R09: 0000000000000000
[  567.452782][T15047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  567.452795][T15047] R13: 0000000000000000 R14: 00007f93cdbb5fa0 R15: 00007fffa6a252e8
[  567.452828][T15047]  </TASK>
[  567.565386][ T5918] usb 1-1: Using ep0 maxpacket: 16
[  567.567804][ T5918] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  567.862730][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  567.865737][ T1220] usb 6-1: new high-speed USB device number 23 using dummy_hcd
[  567.893312][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  567.911083][ T5918] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  567.923708][ T5918] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  567.948984][ T5918] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  567.969143][ T5918] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  567.979941][ T5918] usb 1-1: Manufacturer: syz
[  568.009326][ T5918] usb 1-1: config 0 descriptor??
[  568.099961][ T1220] usb 6-1: Using ep0 maxpacket: 8
[  568.116277][ T1220] usb 6-1: config 11 has an invalid interface number: 236 but max is 0
[  568.127566][ T1220] usb 6-1: config 11 has no interface number 0
[  568.147771][ T1220] usb 6-1: config 11 interface 236 has no altsetting 0
[  568.169070][ T1220] usb 6-1: New USB device found, idVendor=05ac, idProduct=024d, bcdDevice=78.63
[  568.186234][ T1220] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  568.205406][ T1220] usb 6-1: Product: syz
[  568.215103][ T1220] usb 6-1: Manufacturer: syz
[  568.228129][ T1220] usb 6-1: SerialNumber: syz
[  568.402222][ T5918] rc_core: IR keymap rc-hauppauge not found
[  568.424951][  T927] usb 2-1: USB disconnect, device number 80
[  568.437611][ T5918] Registered IR keymap rc-empty
[  568.457542][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.519530][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.566753][ T5918] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
[  568.626974][ T5918] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input95
[  568.655669][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.701266][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.756892][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.784933][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.806686][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.859356][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.902430][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.944684][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  568.976913][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  569.019806][ T5918] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  569.060037][ T5918] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  569.095164][ T5918] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  569.141513][ T5918] usb 1-1: USB disconnect, device number 113
[  569.189915][T15082] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  569.231831][T15082] /dev/rnullb0: Can't open blockdev
[  569.986684][T15097] FAULT_INJECTION: forcing a failure.
[  569.986684][T15097] name failslab, interval 1, probability 0, space 0, times 0
[  569.999918][T15097] CPU: 1 UID: 0 PID: 15097 Comm: syz.1.2824 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  569.999946][T15097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  569.999960][T15097] Call Trace:
[  569.999968][T15097]  <TASK>
[  569.999978][T15097]  dump_stack_lvl+0x189/0x250
[  570.000012][T15097]  ? __pfx____ratelimit+0x10/0x10
[  570.000042][T15097]  ? __pfx_dump_stack_lvl+0x10/0x10
[  570.000071][T15097]  ? __pfx__printk+0x10/0x10
[  570.000103][T15097]  ? __lock_acquire+0xab9/0xd20
[  570.000136][T15097]  should_fail_ex+0x414/0x560
[  570.000168][T15097]  should_failslab+0xa8/0x100
[  570.000196][T15097]  kmem_cache_alloc_noprof+0x73/0x3c0
[  570.000225][T15097]  ? dst_alloc+0x105/0x170
[  570.000254][T15097]  dst_alloc+0x105/0x170
[  570.000302][T15097]  ip_route_input_rcu+0x138c/0x2ff0
[  570.000339][T15097]  ? kernel_text_address+0xa5/0xe0
[  570.000370][T15097]  ? ipt_do_table+0x13dd/0x1640
[  570.000401][T15097]  ? __pfx_ip_route_input_rcu+0x10/0x10
[  570.000433][T15097]  ? __lock_acquire+0xab9/0xd20
[  570.000464][T15097]  ? ip_route_input_noref+0x98/0x250
[  570.000490][T15097]  ? ip_route_input_noref+0x98/0x250
[  570.000516][T15097]  ? ipt_do_table+0x2a3/0x1640
[  570.000552][T15097]  ? ip_route_input_noref+0x98/0x250
[  570.000578][T15097]  ip_route_input_noref+0x167/0x250
[  570.000605][T15097]  ? __pfx_ip_route_input_noref+0x10/0x10
[  570.000639][T15097]  ? nf_hook_slow_list+0x2af/0x390
[  570.000671][T15097]  ? ip_sublist_rcv+0x74c/0x9b0
[  570.000707][T15097]  ip_rcv_finish_core+0x5af/0x1c00
[  570.000751][T15097]  ip_sublist_rcv+0x397/0x9b0
[  570.000798][T15097]  ? __pfx_ip_sublist_rcv+0x10/0x10
[  570.000830][T15097]  ? skb_orphan+0xaf/0xd0
[  570.000864][T15097]  ? __pfx_ip_rcv_finish+0x10/0x10
[  570.000908][T15097]  ip_list_rcv+0x3e2/0x430
[  570.000949][T15097]  ? __pfx_ip_list_rcv+0x10/0x10
[  570.000987][T15097]  ? __pfx_ip_list_rcv+0x10/0x10
[  570.001020][T15097]  __netif_receive_skb_list_core+0x7d2/0x800
[  570.001066][T15097]  ? __pfx___netif_receive_skb_list_core+0x10/0x10
[  570.001108][T15097]  ? netif_receive_skb_list_internal+0x4fd/0xcc0
[  570.001139][T15097]  netif_receive_skb_list_internal+0x975/0xcc0
[  570.001168][T15097]  ? inet_gro_receive+0x904/0xcc0
[  570.001201][T15097]  ? netif_receive_skb_list_internal+0x4fd/0xcc0
[  570.001235][T15097]  ? __pfx_netif_receive_skb_list_internal+0x10/0x10
[  570.001264][T15097]  ? dev_gro_receive+0x10f4/0x23b0
[  570.001298][T15097]  ? dev_gro_receive+0x10b0/0x23b0
[  570.001337][T15097]  ? eth_type_trans+0x3a8/0x760
[  570.001372][T15097]  napi_complete_done+0x2f2/0x7c0
[  570.001410][T15097]  ? __pfx_napi_complete_done+0x10/0x10
[  570.001438][T15097]  ? rcu_is_watching+0x15/0xb0
[  570.001466][T15097]  ? napi_gro_frags+0x975/0x1030
[  570.001510][T15097]  ? tun_get_user+0x266c/0x3e20
[  570.001533][T15097]  tun_get_user+0x28d5/0x3e20
[  570.001572][T15097]  ? tun_get_user+0x266c/0x3e20
[  570.001597][T15097]  ? aa_file_perm+0x13e/0x11b0
[  570.001619][T15097]  ? aa_file_perm+0x3ed/0x11b0
[  570.001640][T15097]  ? __pfx_tun_get_user+0x10/0x10
[  570.001676][T15097]  ? __lock_acquire+0xab9/0xd20
[  570.001708][T15097]  ? ref_tracker_alloc+0x318/0x460
[  570.001736][T15097]  ? __lock_acquire+0xab9/0xd20
[  570.001763][T15097]  ? __pfx_ref_tracker_alloc+0x10/0x10
[  570.001799][T15097]  ? tun_get+0x1c/0x2f0
[  570.001828][T15097]  ? tun_get+0x1c/0x2f0
[  570.001851][T15097]  ? tun_get+0x1c/0x2f0
[  570.001879][T15097]  tun_chr_write_iter+0x113/0x200
[  570.001905][T15097]  vfs_write+0x54b/0xa90
[  570.001938][T15097]  ? __pfx_tun_chr_write_iter+0x10/0x10
[  570.001962][T15097]  ? __pfx_vfs_write+0x10/0x10
[  570.002002][T15097]  ? __fget_files+0x2a/0x420
[  570.002045][T15097]  ksys_write+0x145/0x250
[  570.002075][T15097]  ? __pfx_ksys_write+0x10/0x10
[  570.002099][T15097]  ? rcu_is_watching+0x15/0xb0
[  570.002131][T15097]  ? do_syscall_64+0xbe/0x3b0
[  570.002167][T15097]  do_syscall_64+0xfa/0x3b0
[  570.002196][T15097]  ? lockdep_hardirqs_on+0x9c/0x150
[  570.002225][T15097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  570.002245][T15097]  ? clear_bhb_loop+0x60/0xb0
[  570.002271][T15097]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  570.002295][T15097] RIP: 0033:0x7fc24358e9a9
[  570.002315][T15097] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  570.002338][T15097] RSP: 002b:00007fc244416038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  570.002360][T15097] RAX: ffffffffffffffda RBX: 00007fc2437b5fa0 RCX: 00007fc24358e9a9
[  570.002375][T15097] RDX: 000000000000fdef RSI: 0000200000000440 RDI: 0000000000000004
[  570.002388][T15097] RBP: 00007fc244416090 R08: 0000000000000000 R09: 0000000000000000
[  570.002401][T15097] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  570.002413][T15097] R13: 0000000000000000 R14: 00007fc2437b5fa0 R15: 00007ffc335e4228
[  570.002447][T15097]  </TASK>
[  571.013716][T15057] syz.5.2815 (15057): drop_caches: 2
[  571.271161][ T1220] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:11.236/input/input96
[  571.319731][ T5202] bcm5974 6-1:11.236: could not read from device
[  571.350879][   T10] usb 1-1: new low-speed USB device number 114 using dummy_hcd
[  571.387047][ T5202] bcm5974 6-1:11.236: could not read from device
[  571.436743][ T1220] usb 6-1: USB disconnect, device number 23
[  571.465405][T14278] bcm5974 6-1:11.236: could not read from device
[  571.487207][ T5202] bcm5974 6-1:11.236: could not read from device
[  571.494059][    T9] usb 2-1: new high-speed USB device number 81 using dummy_hcd
[  571.536560][   T10] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b
[  571.537416][T15105] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(9)
[  571.552152][T15105] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed)
[  571.564387][   T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  571.586526][T15105] vhci_hcd vhci_hcd.0: Device attached
[  571.614207][T15107] usbip_core: unknown command
[  571.621043][   T10] pvrusb2: Hardware description: Terratec Grabster AV400
[  571.643017][   T10] pvrusb2: **********
[  571.647032][   T10] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[  571.649727][T15107] vhci_hcd: unknown pdu 0
[  571.671166][    T9] usb 2-1: Using ep0 maxpacket: 16
[  571.681554][T15107] usbip_core: unknown command
[  571.685611][    T9] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  571.702642][ T1334] vhci_hcd: stop threads
[  571.710023][   T10] pvrusb2: Important functionality might not be entirely working.
[  571.710833][ T1334] vhci_hcd: release socket
[  571.722974][    T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  571.740366][   T10] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[  571.751778][ T1334] vhci_hcd: disconnect device
[  571.779988][    T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  571.799142][   T10] pvrusb2: **********
[  571.803646][    T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  571.833666][    T9] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  571.870639][    T9] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  571.898007][ T2349] pvrusb2: Invalid write control endpoint
[  571.905427][    T9] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  571.916660][   T10] usb 1-1: USB disconnect, device number 114
[  571.938092][    T9] usb 2-1: Manufacturer: syz
[  571.953615][    T9] usb 2-1: config 0 descriptor??
[  572.078177][ T2349] pvrusb2: Invalid write control endpoint
[  572.087500][ T2349] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[  572.096837][ T2349] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[  572.130333][ T2349] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[  572.140386][ T2349] pvrusb2: Device being rendered inoperable
[  572.162451][ T2349] cx25840 1-0044: Unable to detect h/w, assuming cx23887
[  572.169575][ T2349] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[  572.196809][ T2349] pvrusb2: Attached sub-driver cx25840
[  572.215769][ T2349] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  572.225963][ T2349] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  572.333358][    T9] rc_core: IR keymap rc-hauppauge not found
[  572.339524][    T9] Registered IR keymap rc-empty
[  572.345083][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.365725][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.411144][    T9] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0
[  572.474524][    T9] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input97
[  572.530987][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.568653][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.611728][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.654098][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.691609][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.739899][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.788482][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.815083][  T927] usb 6-1: new full-speed USB device number 24 using dummy_hcd
[  572.825366][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.868561][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.910858][    T9] mceusb 2-1:0.0: Error: mce write submit urb error = -90
[  572.935422][    T9] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  572.974889][    T9] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  573.006961][    T9] usb 2-1: USB disconnect, device number 81
[  573.062773][  T927] usb 6-1: config index 0 descriptor too short (expected 69, got 36)
[  573.071229][  T927] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  573.084054][  T927] usb 6-1: New USB device found, idVendor=093a, idProduct=2622, bcdDevice=b7.89
[  573.093540][  T927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  573.103154][  T927] usb 6-1: Product: syz
[  573.110975][  T927] usb 6-1: Manufacturer: syz
[  573.130415][  T927] usb 6-1: SerialNumber: syz
[  573.181439][  T927] usb 6-1: config 0 descriptor??
[  573.205684][  T927] gspca_main: gspca_pac7302-2.14.0 probing 093a:2622
[  573.376837][T15133] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3)
[  573.383421][T15133] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  573.505393][T15133] vhci_hcd vhci_hcd.0: Device attached
[  573.628330][T15135] vhci_hcd: connection closed
[  573.629289][   T36] vhci_hcd: stop threads
[  573.646021][T15120] /dev/rnullb0: Can't open blockdev
[  573.674778][  T927] gspca_pac7302: reg_w() failed i: 78 v: 00 error -71
[  573.713062][  T927] gspca_pac7302 6-1:0.0: probe with driver gspca_pac7302 failed with error -71
[  573.722274][   T36] vhci_hcd: release socket
[  573.758470][ T5918] usb 35-1: new high-speed USB device number 3 using vhci_hcd
[  573.766202][   T36] vhci_hcd: disconnect device
[  573.793901][ T5918] usb 35-1: enqueue for inactive port 0
[  573.809338][  T927] usb 6-1: USB disconnect, device number 24
[  573.906538][ T5918] vhci_hcd: vhci_device speed not set
[  574.554415][    T9] usb 5-1: new high-speed USB device number 33 using dummy_hcd
[  574.766250][T15154] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.2843'.
[  574.777555][    T9] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  574.794362][    T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3
[  574.804285][T15154] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  574.811480][T15157] /dev/rnullb0: Can't open blockdev
[  574.826674][    T9] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  574.845893][    T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  574.853915][    T9] usb 5-1: SerialNumber: syz
[  574.873165][T15154] /dev/rnullb0: Can't open blockdev
[  575.179842][    T9] usb 5-1: 0:2 : does not exist
[  575.195682][    T9] usb 5-1: unit 5: unexpected type 0x0b
[  575.228182][    T9] usb 5-1: USB disconnect, device number 33
[  575.277661][T14736] udevd[14736]: setting owner of /dev/snd/controlC3 to uid=0, gid=29 failed: No such file or directory
[  575.390488][T15169] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2848'.
[  575.405561][T15169] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2848'.
[  575.421789][T15169] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2848'.
[  575.436372][T15169] Invalid source name
[  575.440496][T15169] UBIFS error (pid: 15169): cannot open "usrquota", error -22
[  575.730345][T15177] overlayfs: missing 'lowerdir'
[  575.994351][T15190] /dev/rnullb0: Can't open blockdev
[  576.067679][T15183] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2854'.
[  576.401740][T15204] overlayfs: missing 'lowerdir'
[  576.427914][ T5918] usb 5-1: new high-speed USB device number 34 using dummy_hcd
[  576.588594][ T5918] usb 5-1: device descriptor read/64, error -71
[  576.598184][T15212] fuse: Bad value for 'fd'
[  576.634114][T15212] input: syz1 as /devices/virtual/input/input100
[  576.700410][T15217] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8)
[  576.706964][T15217] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed)
[  576.724705][T15217] vhci_hcd vhci_hcd.0: Device attached
[  576.735526][T15217] /dev/rnullb0: Can't open blockdev
[  576.754263][T15219] vhci_hcd: connection closed
[  576.754614][ T1334] vhci_hcd: stop threads
[  576.799825][ T1334] vhci_hcd: release socket
[  576.812968][ T1334] vhci_hcd: disconnect device
[  576.877431][ T5918] usb 5-1: new high-speed USB device number 35 using dummy_hcd
[  576.942723][T15225] /dev/rnullb0: Can't open blockdev
[  577.048351][ T5918] usb 5-1: device descriptor read/64, error -71
[  577.166122][ T5918] usb usb5-port1: attempt power cycle
[  577.315662][T13548] usb 2-1: new high-speed USB device number 82 using dummy_hcd
[  577.402143][T15236] overlayfs: missing 'lowerdir'
[  577.422074][    T9] usb 6-1: new high-speed USB device number 25 using dummy_hcd
[  577.461970][T13548] usb 2-1: device descriptor read/64, error -71
[  577.540520][ T5918] usb 5-1: new high-speed USB device number 36 using dummy_hcd
[  577.582416][    T9] usb 6-1: Using ep0 maxpacket: 32
[  577.583119][ T5918] usb 5-1: device descriptor read/8, error -71
[  577.595833][    T9] usb 6-1: config 0 has an invalid interface number: 184 but max is 0
[  577.614463][    T9] usb 6-1: config 0 has no interface number 0
[  577.623465][    T9] usb 6-1: config 0 interface 184 has no altsetting 0
[  577.633567][    T9] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee
[  577.654091][    T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  577.665581][T15240] /dev/rnullb0: Can't open blockdev
[  577.667918][    T9] usb 6-1: Product: syz
[  577.684053][    T9] usb 6-1: Manufacturer: syz
[  577.699698][    T9] usb 6-1: SerialNumber: syz
[  577.707309][    T9] usb 6-1: config 0 descriptor??
[  577.725940][    T9] smsc75xx v1.0.0
[  577.743095][T13548] usb 2-1: new high-speed USB device number 83 using dummy_hcd
[  577.871192][ T5918] usb 5-1: new high-speed USB device number 37 using dummy_hcd
[  577.892701][T13548] usb 2-1: device descriptor read/64, error -71
[  577.904009][ T5918] usb 5-1: device descriptor read/8, error -71
[  578.022042][T13548] usb usb2-port1: attempt power cycle
[  578.031911][ T5918] usb usb5-port1: unable to enumerate USB device
[  578.063702][ T1220] usb 1-1: new high-speed USB device number 115 using dummy_hcd
[  578.241729][ T1220] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  578.253310][ T1220] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  578.268653][ T1220] usb 1-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00
[  578.281355][ T1220] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  578.298479][ T1220] usb 1-1: config 0 descriptor??
[  578.372216][    T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32
[  578.388042][    T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  578.397912][T13548] usb 2-1: new high-speed USB device number 84 using dummy_hcd
[  578.432890][T13548] usb 2-1: device descriptor read/8, error -71
[  578.694297][T13548] usb 2-1: new high-speed USB device number 85 using dummy_hcd
[  578.716575][T13548] usb 2-1: device descriptor read/8, error -71
[  578.749055][ T1220] arvo 0003:1E7D:30D4.0015: item fetching failed at offset 5/7
[  578.769979][ T1220] arvo 0003:1E7D:30D4.0015: parse failed
[  578.776046][ T1220] arvo 0003:1E7D:30D4.0015: probe with driver arvo failed with error -22
[  578.835019][T13548] usb usb2-port1: unable to enumerate USB device
[  578.845858][T15234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  578.860927][T15234] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  578.893180][    T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000010: -71
[  578.905245][    T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to write HW_CFG: -71
[  578.915441][    T9] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71
[  578.927285][    T9] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71
[  578.950091][    T9] usb 6-1: USB disconnect, device number 25
[  578.965659][T15244] input: syz1 as /devices/virtual/input/input101
[  578.990291][  T927] usb 1-1: USB disconnect, device number 115
[  579.774251][  T927] usb 6-1: new low-speed USB device number 26 using dummy_hcd
[  579.930832][T15262] overlayfs: missing 'lowerdir'
[  579.967548][  T927] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  579.990964][  T927] usb 6-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  580.013396][  T927] usb 6-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 32, setting to 8
[  580.043447][  T927] usb 6-1: config 0 interface 0 has no altsetting 0
[  580.055863][  T927] usb 6-1: New USB device found, idVendor=046d, idProduct=c086, bcdDevice= 0.00
[  580.079232][  T927] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  580.121051][  T927] usb 6-1: config 0 descriptor??
[  580.152242][T15249] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  580.430695][T15276] block device autoloading is deprecated and will be removed.
[  580.453164][T15278] input: syz1 as /devices/virtual/input/input102
[  580.479666][    T9] usb 1-1: new high-speed USB device number 116 using dummy_hcd
[  580.640309][    T9] usb 1-1: device descriptor read/64, error -71
[  580.950603][    T9] usb 1-1: new high-speed USB device number 117 using dummy_hcd
[  581.026588][  T927] logitech-hidpp-device 0003:046D:C086.0016: unknown main item tag 0x0
[  581.035014][  T927] logitech-hidpp-device 0003:046D:C086.0016: unknown main item tag 0x0
[  581.067800][  T927] logitech-hidpp-device 0003:046D:C086.0016: unknown main item tag 0x0
[  581.076109][  T927] logitech-hidpp-device 0003:046D:C086.0016: unknown main item tag 0x0
[  581.113331][    T9] usb 1-1: device descriptor read/64, error -71
[  581.115928][  T927] logitech-hidpp-device 0003:046D:C086.0016: unknown main item tag 0x0
[  581.142435][  T927] logitech-hidpp-device 0003:046D:C086.0016: unknown main item tag 0x0
[  581.156509][  T927] logitech-hidpp-device 0003:046D:C086.0016: unknown main item tag 0x0
[  581.187429][T15287] tipc: Started in network mode
[  581.189132][  T927] logitech-hidpp-device 0003:046D:C086.0016: unknown main item tag 0x0
[  581.198291][T15287] tipc: Node identity d2d2908d62c, cluster identity 4711
[  581.213417][  T927] logitech-hidpp-device 0003:046D:C086.0016: hidraw0: USB HID v0.00 Device [HID 046d:c086] on usb-dummy_hcd.5-1/input0
[  581.222738][T15287] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  581.249962][    T9] usb usb1-port1: attempt power cycle
[  581.271028][T15289] syzkaller0: entered promiscuous mode
[  581.276545][T15289] syzkaller0: entered allmulticast mode
[  581.366061][T15287] tipc: Resetting bearer <eth:syzkaller0>
[  581.430192][  T927] usb 6-1: USB disconnect, device number 26
[  581.443349][T15287] /dev/rnullb0: Can't open blockdev
[  581.455197][T15285] tipc: Resetting bearer <eth:syzkaller0>
[  581.497479][T15285] tipc: Disabling bearer <eth:syzkaller0>
[  581.669343][    T9] usb 1-1: new high-speed USB device number 118 using dummy_hcd
[  581.710030][    T9] usb 1-1: device descriptor read/8, error -71
[  581.743421][T15293] overlayfs: missing 'lowerdir'
[  581.800386][T15295] netlink: 'syz.4.2892': attribute type 10 has an invalid length.
[  581.809564][T15295] bridge0: port 3(dummy0) entered disabled state
[  581.816208][T15295] bridge0: port 2(bridge_slave_1) entered disabled state
[  581.824582][T15295] bridge0: port 1(bridge_slave_0) entered disabled state
[  581.872158][T15298] /dev/rnullb0: Can't open blockdev
[  581.884685][T15295] bridge0: port 3(dummy0) entered blocking state
[  581.891249][T15295] bridge0: port 3(dummy0) entered forwarding state
[  581.898078][T15295] bridge0: port 2(bridge_slave_1) entered blocking state
[  581.905323][T15295] bridge0: port 2(bridge_slave_1) entered forwarding state
[  581.912888][T15295] bridge0: port 1(bridge_slave_0) entered blocking state
[  581.920098][T15295] bridge0: port 1(bridge_slave_0) entered forwarding state
[  581.936725][T15295] bond0: (slave bridge0): Enslaving as an active interface with an up link
[  581.987133][    T9] usb 1-1: new high-speed USB device number 119 using dummy_hcd
[  582.020655][    T9] usb 1-1: device descriptor read/8, error -71
[  582.089521][T15300] /dev/rnullb0: Can't open blockdev
[  582.136743][ T5830] usb 5-1: new high-speed USB device number 38 using dummy_hcd
[  582.158392][    T9] usb usb1-port1: unable to enumerate USB device
[  582.313159][ T5830] usb 5-1: config 156 has an invalid descriptor of length 0, skipping remainder of the config
[  582.342359][ T5830] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0093, bcdDevice=23.5a
[  582.353241][T15307] /dev/rnullb0: Can't open blockdev
[  582.361100][ T5830] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  582.369149][ T5830] usb 5-1: Product: syz
[  582.382509][ T5830] usb 5-1: Manufacturer: syz
[  582.387171][ T5830] usb 5-1: SerialNumber: syz
[  582.493793][T15308] binder: 15304:15308 ioctl c0306201 0 returned -14
[  582.652598][ T5830] usb 5-1: dvb_usb_v2: usb_bulk_msg() failed=-22
[  582.659059][ T5830] dvb_usb_af9035 5-1:156.0: probe with driver dvb_usb_af9035 failed with error -22
[  582.708212][ T5830] usb 5-1: USB disconnect, device number 38
[  582.773741][T15314] input: syz1 as /devices/virtual/input/input103
[  582.778649][  T927] usb 2-1: new high-speed USB device number 86 using dummy_hcd
[  582.946734][T15318] overlayfs: missing 'lowerdir'
[  582.951926][  T927] usb 2-1: Using ep0 maxpacket: 32
[  582.976411][  T927] usb 2-1: config 0 has no interfaces?
[  582.984722][  T927] usb 2-1: New USB device found, idVendor=0cf3, idProduct=817a, bcdDevice=eb.19
[  583.000225][  T927] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  583.012604][  T927] usb 2-1: Product: syz
[  583.017120][  T927] usb 2-1: Manufacturer: syz
[  583.021747][  T927] usb 2-1: SerialNumber: syz
[  583.037293][  T927] usb 2-1: config 0 descriptor??
[  583.437987][T15327] pim6reg: entered allmulticast mode
[  583.611574][T15342] /dev/rnullb0: Can't open blockdev
[  583.708172][  T927] usb 5-1: new high-speed USB device number 39 using dummy_hcd
[  583.814251][ T5830] usb 2-1: USB disconnect, device number 86
[  583.880046][  T927] usb 5-1: Using ep0 maxpacket: 8
[  583.891985][  T927] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  583.912755][  T927] usb 5-1: New USB device found, idVendor=05ac, idProduct=0263, bcdDevice= 0.40
[  583.924479][  T927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  583.943322][  T927] usb 5-1: Product: syz
[  583.949974][  T927] usb 5-1: Manufacturer: syz
[  583.960527][  T927] usb 5-1: SerialNumber: syz
[  584.196734][T15355] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore
[  584.210957][T15355] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  584.227391][  T927] input: bcm5974 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input104
[  584.259296][ T5202] bcm5974 5-1:1.0: could not read from device
[  584.277159][ T5202] bcm5974 5-1:1.0: could not read from device
[  584.295116][  T927] usb 5-1: USB disconnect, device number 39
[  584.317328][ T5202] bcm5974 5-1:1.0: could not read from device
[  584.981497][T15371] syz.0.2916: attempt to access beyond end of device
[  584.981497][T15371] nbd0: rw=0, sector=6, nr_sectors = 2 limit=0
[  585.037522][T15371] ADFS-fs (nbd0): error: unable to read block 3, try 0
[  585.153410][    T9] usb 2-1: new high-speed USB device number 87 using dummy_hcd
[  585.245575][T15379] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore
[  585.254705][T15379] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  585.322537][    T9] usb 2-1: Using ep0 maxpacket: 16
[  585.328181][T15381] /dev/rnullb0: Can't open blockdev
[  585.335598][    T9] usb 2-1: config 1 has an invalid interface number: 4 but max is 2
[  585.343994][    T9] usb 2-1: config 1 has no interface number 1
[  585.354956][    T9] usb 2-1: too many endpoints for config 1 interface 4 altsetting 0: 102, using maximum allowed: 30
[  585.375984][    T9] usb 2-1: config 1 interface 4 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 102
[  585.402973][    T9] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  585.414532][    T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  585.431712][    T9] usb 2-1: Product: syz
[  585.444104][    T9] usb 2-1: Manufacturer: syz
[  585.450135][    T9] usb 2-1: SerialNumber: syz
[  585.653053][T15387] input: syz1 as /devices/virtual/input/input105
[  585.755458][    T9] usb 2-1: 2:1: cannot set freq 11835083 to ep 0x82
[  585.801722][T15389] /dev/rnullb0: Can't open blockdev
[  585.839817][    T9] usb 2-1: USB disconnect, device number 87
[  585.939326][T14481] udevd[14481]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  586.295317][  T927] usb 1-1: new high-speed USB device number 120 using dummy_hcd
[  586.468446][  T927] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  586.487745][  T927] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40
[  586.511834][  T927] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  586.539308][  T927] usb 1-1: config 0 descriptor??
[  586.693448][T15399] binder: 15398:15399 ioctl c0306201 0 returned -14
[  586.700529][T15402] binder: 15400:15402 ioctl c018620c 200000000140 returned -22
[  586.723372][T15402] /dev/rnullb0: Can't open blockdev
[  586.908140][T15406] /dev/rnullb0: Can't open blockdev
[  586.917190][T15405] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore
[  586.943879][T15405] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
[  587.002264][  T927] keytouch 0003:0926:3333.0017: fixing up Keytouch IEC report descriptor
[  587.038135][  T927] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.0017/input/input106
[  587.176945][  T927] keytouch 0003:0926:3333.0017: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0
[  587.500398][T15421] /dev/rnullb0: Can't open blockdev
[  587.714660][    T9] usb 1-1: USB disconnect, device number 120
[  587.963343][ T1220] usb 2-1: new high-speed USB device number 88 using dummy_hcd
[  588.062512][T15432] overlayfs: missing 'lowerdir'
[  588.150244][ T1220] usb 2-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  588.187506][ T1220] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  588.219813][ T1220] usb 2-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  588.271326][ T1220] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00
[  588.302118][ T1220] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  588.328506][T15423] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22
[  588.780321][T15456] overlayfs: missing 'lowerdir'
[  588.991068][T15467] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2950'.
[  589.005196][T15467] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2950'.
[  589.129053][T15470] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2953'.
[  589.512210][T15479] netlink: 'syz.5.2956': attribute type 5 has an invalid length.
[  589.561832][T15479] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(10)
[  589.568485][T15479] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed)
[  589.608267][T15479] vhci_hcd vhci_hcd.0: Device attached
[  589.630008][T15485] vhci_hcd: connection closed
[  589.631467][   T36] vhci_hcd: stop threads
[  589.663843][   T36] vhci_hcd: release socket
[  589.669954][   T36] vhci_hcd: disconnect device
[  589.700748][T15489] overlayfs: missing 'lowerdir'
[  590.018922][ T1220] aiptek 2-1:17.0: Aiptek using 400 ms programming speed
[  590.037942][ T1220] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:17.0/input/input107
[  590.141854][T15503] /dev/rnullb0: Can't open blockdev
[  590.153242][ T1220] usb 2-1: USB disconnect, device number 88
[  590.159516][    C0] aiptek 2-1:17.0: aiptek_irq - usb_submit_urb failed with result -19
[  590.400675][   T24] usb 1-1: new high-speed USB device number 121 using dummy_hcd
[  590.538718][T15512] input: syz1 as /devices/virtual/input/input109
[  590.561056][   T24] usb 1-1: Using ep0 maxpacket: 8
[  590.574373][   T24] usb 1-1: config 179 has an invalid interface number: 65 but max is 0
[  590.592986][   T24] usb 1-1: config 179 has no interface number 0
[  590.609372][   T24] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7
[  590.624568][T15514] overlayfs: missing 'workdir'
[  590.635160][   T24] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024
[  590.655795][   T24] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  590.671652][   T24] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024
[  590.684430][   T24] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23
[  590.701687][   T24] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb
[  590.712621][   T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  590.733692][T15504] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  591.184604][T13548] usb 1-1: USB disconnect, device number 121
[  591.184734][    C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
[  591.200256][    C1] dummy_hcd dummy_hcd.0: timer fired with no URBs pending?
[  591.445357][T15530] netlink: 'syz.5.2974': attribute type 4 has an invalid length.
[  591.489265][T15530] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2974'.
[  591.510829][T15538] netlink: 156 bytes leftover after parsing attributes in process `syz.5.2974'.
[  591.626018][T15540] overlayfs: missing 'workdir'
[  591.738210][T15544] netlink: 'syz.5.2978': attribute type 10 has an invalid length.
[  591.761537][T15544] bridge0: port 2(bridge_slave_1) entered disabled state
[  591.769373][T15544] bridge0: port 1(bridge_slave_0) entered disabled state
[  591.810052][T15544] bridge0: port 2(bridge_slave_1) entered blocking state
[  591.817308][T15544] bridge0: port 2(bridge_slave_1) entered forwarding state
[  591.824874][T15544] bridge0: port 1(bridge_slave_0) entered blocking state
[  591.832047][T15544] bridge0: port 1(bridge_slave_0) entered forwarding state
[  591.890260][T15544] bond0: (slave bridge0): Enslaving as an active interface with an up link
[  591.911697][T15549] netlink: 'syz.1.2980': attribute type 21 has an invalid length.
[  591.923127][T15549] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2980'.
[  592.057780][T13548] usb 6-1: new high-speed USB device number 27 using dummy_hcd
[  592.252362][T13548] usb 6-1: config 156 has an invalid descriptor of length 0, skipping remainder of the config
[  592.282360][T13548] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0093, bcdDevice=23.5a
[  592.291522][T13548] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  592.345033][T13548] usb 6-1: Product: syz
[  592.367570][T13548] usb 6-1: Manufacturer: syz
[  592.372264][T13548] usb 6-1: SerialNumber: syz
[  592.665741][T13548] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22
[  592.683152][T13548] dvb_usb_af9035 6-1:156.0: probe with driver dvb_usb_af9035 failed with error -22
[  592.742018][T13548] usb 6-1: USB disconnect, device number 27
[  592.968120][ T1304] ieee802154 phy0 wpan0: encryption failed: -22
[  592.974470][ T1304] ieee802154 phy1 wpan1: encryption failed: -22
[  593.042687][T15586] /dev/rnullb0: Can't open blockdev
[  593.048801][T15584] overlayfs: missing 'workdir'
[  593.114482][T15588] /dev/rnullb0: Can't open blockdev
[  593.334886][T15597] overlayfs: failed to resolve './file1/file0': -2
[  593.458807][T13548] usb 2-1: new high-speed USB device number 89 using dummy_hcd
[  593.510473][T15603] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2996'.
[  593.522227][ T1220] usb 5-1: new high-speed USB device number 40 using dummy_hcd
[  593.561057][T15606] /dev/rnullb0: Can't open blockdev
[  593.642039][T13548] usb 2-1: Using ep0 maxpacket: 16
[  593.654911][T13548] usb 2-1: config 0 has an invalid interface number: 214 but max is 0
[  593.671845][T13548] usb 2-1: config 0 has no interface number 0
[  593.680424][T13548] usb 2-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 1023, setting to 64
[  593.702836][ T1220] usb 5-1: Using ep0 maxpacket: 16
[  593.712295][ T1220] usb 5-1: New USB device found, idVendor=046d, idProduct=08b2, bcdDevice=80.59
[  593.727033][T13548] usb 2-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5
[  593.746585][ T1220] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  593.754732][T13548] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  593.763509][ T1220] usb 5-1: Product: syz
[  593.778566][ T1220] usb 5-1: Manufacturer: syz
[  593.783399][ T1220] usb 5-1: SerialNumber: syz
[  593.789460][T13548] usb 2-1: Product: syz
[  593.793653][T13548] usb 2-1: Manufacturer: syz
[  593.809405][ T1220] usb 5-1: config 0 descriptor??
[  593.815406][T13548] usb 2-1: SerialNumber: syz
[  593.821473][   T10] usb 6-1: new full-speed USB device number 28 using dummy_hcd
[  593.843851][ T1220] pwc: Logitech QuickCam 4000 Pro USB webcam detected.
[  593.862595][T13548] usb 2-1: config 0 descriptor??
[  594.005385][   T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  594.021646][   T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  594.053352][   T10] usb 6-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00
[  594.073473][   T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  594.106938][   T10] usb 6-1: config 0 descriptor??
[  594.128681][T15618] /dev/rnullb0: Can't open blockdev
[  594.188053][T15620] /dev/rnullb0: Can't open blockdev
[  594.204310][ T1220] pwc: Failed to set LED on/off time (-71)
[  594.224754][ T1220] pwc: send_video_command error -71
[  594.239018][ T1220] pwc: Failed to set video mode VGA@30 fps; return code = -71
[  594.267197][ T1220] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71
[  594.307516][T15590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  594.310129][ T1220] usb 5-1: USB disconnect, device number 40
[  594.349516][T15590] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  594.383966][T13548] usbtouchscreen 2-1:0.214: probe with driver usbtouchscreen failed with error -71
[  594.405050][T13548] usb 2-1: USB disconnect, device number 89
[  594.604985][   T10] konepure 0003:1E7D:2DBE.0018: hidraw0: USB HID v0.00 Device [HID 1e7d:2dbe] on usb-dummy_hcd.5-1/input0
[  594.918344][T15632] /dev/rnullb0: Can't open blockdev
[  595.324115][T15646] /dev/rnullb0: Can't open blockdev
[  595.433232][T15650] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3012'.
[  595.586660][T15650] netlink: 'syz.0.3012': attribute type 16 has an invalid length.
[  595.605055][T15654] /dev/rnullb0: Can't open blockdev
[  595.614718][T15650] /dev/rnullb0: Can't open blockdev
[  595.847073][T15662] /dev/rnullb0: Can't open blockdev
[  596.069113][T15673] /dev/rnullb0: Can't open blockdev
[  596.089895][T15673] /dev/rnullb0: Can't open blockdev
[  596.686989][ T5918] usb 5-1: new high-speed USB device number 41 using dummy_hcd
[  596.732456][T15683] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3022'.
[  596.747493][T15683] /dev/rnullb0: Can't open blockdev
[  596.790002][ T5830] usb 6-1: USB disconnect, device number 28
[  596.868650][ T5918] usb 5-1: Using ep0 maxpacket: 32
[  596.883784][ T5918] usb 5-1: config 0 has an invalid interface number: 51 but max is 0
[  596.911132][ T5918] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  596.932114][ T5918] usb 5-1: config 0 has no interface number 0
[  596.942934][ T5918] usb 5-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 8
[  596.977912][ T5918] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f
[  596.988296][ T5918] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  596.996324][ T5918] usb 5-1: Product: syz
[  597.017315][ T5918] usb 5-1: Manufacturer: syz
[  597.022285][ T5918] usb 5-1: SerialNumber: syz
[  597.050356][ T5918] usb 5-1: config 0 descriptor??
[  597.069036][ T5918] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected
[  597.295612][ T5918] usb 5-1: qt2_setup_urbs - submit read urb failed -8
[  597.302959][ T5918] quatech2 5-1:0.51: probe with driver quatech2 failed with error -8
[  597.779432][T15695] program syz.0.3027 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  597.878427][T15698] /dev/rnullb0: Can't open blockdev
[  598.419933][T15708] tmpfs: Bad value for 'mpol'
[  598.481919][T15710] netlink: 'syz.1.3033': attribute type 10 has an invalid length.
[  598.516226][T15710] hsr_slave_0: entered allmulticast mode
[  598.537525][T15710] team0: Device hsr_slave_0 is up. Set it down before adding it as a team port
[  599.147600][T15717] /dev/rnullb0: Can't open blockdev
[  599.638809][T13548] usb 5-1: USB disconnect, device number 41
[  599.716994][T15727] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3040'.
[  599.789881][T15727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3040'.
[  599.822878][T15727] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3040'.
[  599.852047][T15727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3040'.
[  599.876985][T15727] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3040'.
[  600.150382][   T24] usb 2-1: new high-speed USB device number 90 using dummy_hcd
[  600.312603][   T24] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  600.325779][   T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  600.354852][   T24] usb 2-1: config 0 descriptor??
[  600.366917][   T24] cp210x 2-1:0.0: cp210x converter detected
[  600.803053][   T24] cp210x 2-1:0.0: failed to get vendor val 0x000e size 3: -32
[  600.857884][T15739] /dev/rnullb0: Can't open blockdev
[  601.048913][   T24] usb 2-1: cp210x converter now attached to ttyUSB0
[  601.203175][T15745] team_slave_1: entered promiscuous mode
[  601.219958][T15745] team_slave_1: entered allmulticast mode
[  601.258004][    T9] usb 2-1: USB disconnect, device number 90
[  601.271678][T15745] vivid-001: disconnect
[  601.292479][    T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  601.301230][T15745] vivid-001: reconnect
[  601.349786][    T9] cp210x 2-1:0.0: device disconnected
[  601.438601][T15748] /dev/rnullb0: Can't open blockdev
[  601.605798][T15753] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3049'.
[  601.660116][T15753] /dev/rnullb0: Can't open blockdev
[  602.078506][T15771] /dev/rnullb0: Can't open blockdev
[  602.212421][T15780] /dev/rnullb0: Can't open blockdev
[  602.649743][T15805] syz.1.3065: attempt to access beyond end of device
[  602.649743][T15805] loop1: rw=0, sector=64, nr_sectors = 1 limit=0
[  602.706734][T15805] syz.1.3065: attempt to access beyond end of device
[  602.706734][T15805] loop1: rw=0, sector=256, nr_sectors = 1 limit=0
[  602.773300][T15805] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256
[  602.844601][T15805] syz.1.3065: attempt to access beyond end of device
[  602.844601][T15805] loop1: rw=0, sector=512, nr_sectors = 1 limit=0
[  602.871433][T15812] comedi comedi2: aio_iiro_16: I/O port conflict (0x4f28,8)
[  602.901452][T15805] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512
[  602.903063][T15805] syz.1.3065: attempt to access beyond end of device
[  602.903063][T15805] loop1: rw=0, sector=64, nr_sectors = 2 limit=0
[  602.927818][  T927] IPVS: starting estimator thread 0...
[  602.929830][T15814] tipc: Started in network mode
[  602.929859][T15814] tipc: Node identity ff120000000000000000000000000001, cluster identity 4711
[  602.929916][T15814] tipc: Enabling of bearer <udp:s> rejected, failed to enable media
[  602.958949][T15816] /dev/rnullb0: Can't open blockdev
[  602.968883][T15805] syz.1.3065: attempt to access beyond end of device
[  602.968883][T15805] loop1: rw=0, sector=512, nr_sectors = 2 limit=0
[  603.015570][T15815] IPVS: using max 29 ests per chain, 69600 per kthread
[  603.064706][T15805] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256
[  603.064922][T15805] syz.1.3065: attempt to access beyond end of device
[  603.064922][T15805] loop1: rw=0, sector=1024, nr_sectors = 2 limit=0
[  603.065018][T15805] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512
[  603.067406][T15805] syz.1.3065: attempt to access beyond end of device
[  603.067406][T15805] loop1: rw=0, sector=64, nr_sectors = 4 limit=0
[  603.067759][T15805] syz.1.3065: attempt to access beyond end of device
[  603.067759][T15805] loop1: rw=0, sector=1024, nr_sectors = 4 limit=0
[  603.067821][T15805] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256
[  603.068049][T15805] syz.1.3065: attempt to access beyond end of device
[  603.068049][T15805] loop1: rw=0, sector=2048, nr_sectors = 4 limit=0
[  603.068109][T15805] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512
[  603.068552][T15805] syz.1.3065: attempt to access beyond end of device
[  603.068552][T15805] loop1: rw=0, sector=64, nr_sectors = 8 limit=0
[  603.078821][T15805] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256
[  603.078986][T15805] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=512, location=512
[  603.079005][T15805] UDF-fs: warning (device loop1): udf_fill_super: No partition found (1)
[  603.582002][  T927] usb 6-1: new high-speed USB device number 29 using dummy_hcd
[  603.646190][    T9] usb 2-1: new high-speed USB device number 91 using dummy_hcd
[  603.753174][  T927] usb 6-1: Using ep0 maxpacket: 32
[  603.772051][  T927] usb 6-1: config 0 has an invalid interface number: 184 but max is 0
[  603.792505][  T927] usb 6-1: config 0 has no interface number 0
[  603.803311][  T927] usb 6-1: config 0 interface 184 has no altsetting 0
[  603.810624][T15843] efs: cannot read volume header
[  603.820227][  T927] usb 6-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee
[  603.830673][    T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  603.838733][  T927] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  603.853456][    T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  603.876945][T15846] binder: 15842:15846 ioctl c018620c 200000000000 returned -1
[  603.881536][  T927] usb 6-1: Product: syz
[  603.884833][    T9] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  603.892411][  T927] usb 6-1: Manufacturer: syz
[  603.945898][  T927] usb 6-1: SerialNumber: syz
[  603.949367][    T9] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  603.968435][  T927] usb 6-1: config 0 descriptor??
[  603.984634][    T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  603.995907][  T927] smsc75xx v1.0.0
[  604.039266][    T9] usb 2-1: config 0 descriptor??
[  604.334797][    T9] usbhid 2-1:0.0: can't add hid device: -71
[  604.348831][    T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  604.374424][    T9] usb 2-1: USB disconnect, device number 91
[  604.479067][T15864] /dev/rnullb0: Can't open blockdev
[  604.639781][T15869] /dev/rnullb0: Can't open blockdev
[  604.875681][   T24] usb 2-1: new high-speed USB device number 92 using dummy_hcd
[  604.922242][T15823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  604.944475][T15823] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  604.957652][T15823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  604.971019][T15823] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  604.981195][T15823] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  604.998589][T15823] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  605.011978][  T927] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71
[  605.045337][  T927] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  605.065709][  T927] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71
[  605.077056][   T24] usb 2-1: Using ep0 maxpacket: 8
[  605.079156][    T9] usb 5-1: new high-speed USB device number 42 using dummy_hcd
[  605.092957][   T24] usb 2-1: config 204 has an invalid interface number: 132 but max is 1
[  605.111005][  T927] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71
[  605.121838][   T24] usb 2-1: config 204 has an invalid interface number: 236 but max is 1
[  605.130193][   T24] usb 2-1: config 204 has no interface number 0
[  605.142819][  T927] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset
[  605.158401][   T24] usb 2-1: config 204 has no interface number 1
[  605.169725][  T927] smsc75xx 6-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71
[  605.180317][T15875] netlink: 'syz.0.3089': attribute type 2 has an invalid length.
[  605.188313][   T24] usb 2-1: config 204 interface 132 has no altsetting 0
[  605.195755][  T927] smsc75xx 6-1:0.184: probe with driver smsc75xx failed with error -71
[  605.204713][   T24] usb 2-1: config 204 interface 236 has no altsetting 0
[  605.215289][T15875] /dev/rnullb0: Can't open blockdev
[  605.229709][  T927] usb 6-1: USB disconnect, device number 29
[  605.236643][   T24] usb 2-1: New USB device found, idVendor=04cb, idProduct=010b, bcdDevice=55.3e
[  605.250179][   T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  605.262301][   T24] usb 2-1: Product: syz
[  605.266831][   T24] usb 2-1: Manufacturer: syz
[  605.272109][   T24] usb 2-1: SerialNumber: syz
[  605.282114][    T9] usb 5-1: Using ep0 maxpacket: 8
[  605.306163][    T9] usb 5-1: config 25 has an invalid interface number: 77 but max is 0
[  605.318635][    T9] usb 5-1: config 25 has no interface number 0
[  605.334403][    T9] usb 5-1: config 25 interface 77 has no altsetting 0
[  605.365936][    T9] usb 5-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=f2.d1
[  605.383516][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  605.404889][    T9] usb 5-1: Product: syz
[  605.409099][    T9] usb 5-1: Manufacturer: syz
[  605.420611][    T9] usb 5-1: SerialNumber: syz
[  605.519976][T15868] /dev/rnullb0: Can't open blockdev
[  605.567953][   T24] usb 2-1: USB disconnect, device number 92
[  605.882845][T15891] /dev/rnullb0: Can't open blockdev
[  606.144582][    T9] gspca_main: sunplus-2.14.0 probing 046d:0960
[  606.158795][    T9] gspca_sunplus: reg_w_riv err -71
[  606.164014][    T9] sunplus 5-1:25.77: probe with driver sunplus failed with error -71
[  606.182125][T15900] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3095'.
[  606.192818][    T9] usb 5-1: USB disconnect, device number 42
[  606.223411][T15900] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3095'.
[  606.243670][T15900] /dev/rnullb0: Can't open blockdev
[  606.536262][T15912] 9pnet_fd: Insufficient options for proto=fd
[  607.001979][T15917] /dev/rnullb0: Can't open blockdev
[  607.025527][T15917] cgroup: Unknown subsys name 'pcr'
[  607.149241][T15927] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  607.172054][T15927] /dev/rnullb0: Can't open blockdev
[  607.239845][T15931] /dev/rnullb0: Can't open blockdev
[  607.409307][   T24] usb 2-1: new high-speed USB device number 93 using dummy_hcd
[  607.556666][T15939] /dev/rnullb0: Can't open blockdev
[  607.580445][   T24] usb 2-1: Using ep0 maxpacket: 8
[  607.597173][   T24] usb 2-1: config index 0 descriptor too short (expected 6427, got 27)
[  607.611923][   T24] usb 2-1: config 0 has an invalid interface number: 21 but max is 0
[  607.632702][   T24] usb 2-1: config 0 has no interface number 0
[  607.641396][   T24] usb 2-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  607.654957][   T24] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11
[  607.681187][   T24] usb 2-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  607.694925][   T24] usb 2-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4
[  607.715122][   T24] usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[  607.734243][   T24] usb 2-1: Product: syz
[  607.747009][T15944] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 11
[  607.747740][   T24] usb 2-1: config 0 descriptor??
[  607.785044][T15929] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  608.286992][T15957] /dev/rnullb0: Can't open blockdev
[  608.655788][T15964] /dev/rnullb0: Can't open blockdev
[  608.667799][T15965] /dev/rnullb0: Can't open blockdev
[  609.854985][T15972] /dev/rnullb0: Can't open blockdev
[  610.199481][    T9] usb 1-1: new full-speed USB device number 122 using dummy_hcd
[  610.370142][    T9] usb 1-1: config 0 has an invalid interface number: 214 but max is 0
[  610.381968][    T9] usb 1-1: config 0 has no interface number 0
[  610.388116][    T9] usb 1-1: config 0 interface 214 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64
[  610.418920][   T24] usb 2-1: USB disconnect, device number 93
[  610.432496][    T9] usb 1-1: config 0 interface 214 has no altsetting 0
[  610.455110][    T9] usb 1-1: New USB device found, idVendor=07c9, idProduct=000e, bcdDevice=5d.4f
[  610.466368][    T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  610.497119][    T9] usb 1-1: Product: syz
[  610.502682][    T9] usb 1-1: Manufacturer: syz
[  610.509853][    T9] usb 1-1: SerialNumber: syz
[  610.524051][    T9] usb 1-1: config 0 descriptor??
[  610.549522][T16001] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22
[  610.730190][T16015] /dev/rnullb0: Can't open blockdev
[  610.779537][T16001] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22
[  610.872779][T16023] /dev/rnullb0: Can't open blockdev
[  611.062416][T16030] /dev/rnullb0: Can't open blockdev
[  611.775171][T16056] FAULT_INJECTION: forcing a failure.
[  611.775171][T16056] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  611.788870][T16056] CPU: 1 UID: 0 PID: 16056 Comm: syz.5.3148 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  611.788899][T16056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  611.788912][T16056] Call Trace:
[  611.788921][T16056]  <TASK>
[  611.788930][T16056]  dump_stack_lvl+0x189/0x250
[  611.788964][T16056]  ? __pfx____ratelimit+0x10/0x10
[  611.788994][T16056]  ? __pfx_dump_stack_lvl+0x10/0x10
[  611.789023][T16056]  ? __pfx__printk+0x10/0x10
[  611.789065][T16056]  should_fail_ex+0x414/0x560
[  611.789097][T16056]  strncpy_from_user+0x36/0x290
[  611.789126][T16056]  path_setxattrat+0x150/0x3a0
[  611.789170][T16056]  ? __pfx_path_setxattrat+0x10/0x10
[  611.789189][T16056]  ? __mutex_unlock_slowpath+0x1a1/0x760
[  611.789243][T16056]  ? ksys_write+0x22a/0x250
[  611.789269][T16056]  ? __pfx_ksys_write+0x10/0x10
[  611.789291][T16056]  ? rcu_is_watching+0x15/0xb0
[  611.789320][T16056]  __x64_sys_setxattr+0xbc/0xe0
[  611.789352][T16056]  do_syscall_64+0xfa/0x3b0
[  611.789379][T16056]  ? lockdep_hardirqs_on+0x9c/0x150
[  611.789406][T16056]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  611.789425][T16056]  ? clear_bhb_loop+0x60/0xb0
[  611.789448][T16056]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  611.789467][T16056] RIP: 0033:0x7feda1b8e9a9
[  611.789483][T16056] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  611.789500][T16056] RSP: 002b:00007fed9f9f6038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
[  611.789527][T16056] RAX: ffffffffffffffda RBX: 00007feda1db5fa0 RCX: 00007feda1b8e9a9
[  611.789542][T16056] RDX: 0000200000000480 RSI: 00002000000001c0 RDI: 0000200000000140
[  611.789555][T16056] RBP: 00007fed9f9f6090 R08: 0000000000000000 R09: 0000000000000000
[  611.789568][T16056] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001
[  611.789579][T16056] R13: 0000000000000000 R14: 00007feda1db5fa0 R15: 00007fff9e69e4b8
[  611.789608][T16056]  </TASK>
[  611.985202][    C1] vkms_vblank_simulate: vblank timer overrun
[  611.996411][   T24] usb 5-1: new high-speed USB device number 43 using dummy_hcd
[  612.227631][T16062] overlay: Unknown parameter 'fsmagic'
[  612.315087][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71
[  612.338634][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0006: -71
[  612.370351][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): invalid MAC address, using random
[  612.385130][   T24] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[  612.394348][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0006: -71
[  612.394811][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0005: -71
[  612.432284][   T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  612.451301][   T24] usb 5-1: Product: syz
[  612.462332][   T24] usb 5-1: Manufacturer: syz
[  612.467241][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71
[  612.476649][   T24] usb 5-1: SerialNumber: syz
[  612.492924][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71
[  612.519755][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71
[  612.528660][   T24] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested
[  612.542391][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71
[  612.559047][  T927] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[  612.636446][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71
[  612.708476][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71
[  612.743302][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0002: -71
[  612.767910][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71
[  612.812368][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0001: -71
[  612.841559][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0001: -71
[  612.875103][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71
[  612.915117][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x0019: -71
[  612.958426][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x001f: -71
[  612.989992][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71
[  613.022873][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71
[  613.043578][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71
[  613.082622][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x000e: -71
[  613.121138][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71
[  613.155256][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71
[  613.171917][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000d: -71
[  613.208769][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to write reg index 0x000e: -71
[  613.240311][    T9] ax88179_178a 1-1:0.214 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71
[  613.314085][    T9] ax88179_178a 1-1:0.214 eth5: register 'ax88179_178a' at usb-dummy_hcd.0-1, AT-UMC2000 USB 3.0/USB 3.1 Gen 1 to Gigabit Ethernet Adapter, 82:68:f6:24:a9:ae
[  613.387876][T16083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  613.407717][    T9] usb 1-1: USB disconnect, device number 122
[  613.418349][T16083] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  613.467975][    T9] ax88179_178a 1-1:0.214 eth5: unregister 'ax88179_178a' usb-dummy_hcd.0-1, AT-UMC2000 USB 3.0/USB 3.1 Gen 1 to Gigabit Ethernet Adapter
[  613.495066][T16089] ieee802154 phy0 wpan0: encryption failed: -22
[  613.585677][T16092] FAULT_INJECTION: forcing a failure.
[  613.585677][T16092] name failslab, interval 1, probability 0, space 0, times 0
[  613.620961][T16092] CPU: 1 UID: 0 PID: 16092 Comm: syz.5.3159 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  613.620995][T16092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  613.621009][T16092] Call Trace:
[  613.621030][T16092]  <TASK>
[  613.621039][T16092]  dump_stack_lvl+0x189/0x250
[  613.621072][T16092]  ? __pfx____ratelimit+0x10/0x10
[  613.621102][T16092]  ? __pfx_dump_stack_lvl+0x10/0x10
[  613.621130][T16092]  ? __pfx__printk+0x10/0x10
[  613.621164][T16092]  ? __pfx___might_resched+0x10/0x10
[  613.621195][T16092]  should_fail_ex+0x414/0x560
[  613.621225][T16092]  ? vmemdup_user+0x26/0xd0
[  613.621252][T16092]  should_failslab+0xa8/0x100
[  613.621277][T16092]  __kvmalloc_node_noprof+0x161/0x5f0
[  613.621303][T16092]  ? vmemdup_user+0x26/0xd0
[  613.621336][T16092]  vmemdup_user+0x26/0xd0
[  613.621365][T16092]  path_setxattrat+0x244/0x3a0
[  613.621398][T16092]  ? __pfx_path_setxattrat+0x10/0x10
[  613.621418][T16092]  ? __mutex_unlock_slowpath+0x1a1/0x760
[  613.621485][T16092]  ? ksys_write+0x22a/0x250
[  613.621512][T16092]  ? __pfx_ksys_write+0x10/0x10
[  613.621533][T16092]  ? rcu_is_watching+0x15/0xb0
[  613.621563][T16092]  __x64_sys_setxattr+0xbc/0xe0
[  613.621602][T16092]  do_syscall_64+0xfa/0x3b0
[  613.621629][T16092]  ? lockdep_hardirqs_on+0x9c/0x150
[  613.621655][T16092]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  613.621674][T16092]  ? clear_bhb_loop+0x60/0xb0
[  613.621697][T16092]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  613.621715][T16092] RIP: 0033:0x7feda1b8e9a9
[  613.621732][T16092] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  613.621747][T16092] RSP: 002b:00007fed9f9f6038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
[  613.621767][T16092] RAX: ffffffffffffffda RBX: 00007feda1db5fa0 RCX: 00007feda1b8e9a9
[  613.621781][T16092] RDX: 0000200000000480 RSI: 00002000000001c0 RDI: 0000200000000140
[  613.621794][T16092] RBP: 00007fed9f9f6090 R08: 0000000000000000 R09: 0000000000000000
[  613.621806][T16092] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001
[  613.621818][T16092] R13: 0000000000000000 R14: 00007feda1db5fa0 R15: 00007fff9e69e4b8
[  613.621846][T16092]  </TASK>
[  613.847726][    C1] vkms_vblank_simulate: vblank timer overrun
[  613.948085][T16096] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  613.963971][T16096] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  614.187682][  T927] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive
[  614.195016][  T927] ath9k_htc: Failed to initialize the device
[  614.252988][  T927] usb 5-1: ath9k_htc: USB layer deinitialized
[  614.453762][T16108] MTD: Couldn't look up './file0': -15
[  614.775719][T16117] /dev/rnullb0: Can't open blockdev
[  615.495606][T16150] FAULT_INJECTION: forcing a failure.
[  615.495606][T16150] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  615.511108][T16150] CPU: 1 UID: 0 PID: 16150 Comm: syz.5.3171 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  615.511138][T16150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  615.511153][T16150] Call Trace:
[  615.511162][T16150]  <TASK>
[  615.511171][T16150]  dump_stack_lvl+0x189/0x250
[  615.511206][T16150]  ? __pfx____ratelimit+0x10/0x10
[  615.511238][T16150]  ? __pfx_dump_stack_lvl+0x10/0x10
[  615.511268][T16150]  ? __pfx__printk+0x10/0x10
[  615.511298][T16150]  ? __might_fault+0xb0/0x130
[  615.511334][T16150]  should_fail_ex+0x414/0x560
[  615.511367][T16150]  _copy_from_user+0x2d/0xb0
[  615.511391][T16150]  vmemdup_user+0x59/0xd0
[  615.511433][T16150]  path_setxattrat+0x244/0x3a0
[  615.511466][T16150]  ? __pfx_path_setxattrat+0x10/0x10
[  615.511488][T16150]  ? __mutex_unlock_slowpath+0x1a1/0x760
[  615.511559][T16150]  ? ksys_write+0x22a/0x250
[  615.511588][T16150]  ? __pfx_ksys_write+0x10/0x10
[  615.511611][T16150]  ? rcu_is_watching+0x15/0xb0
[  615.511643][T16150]  __x64_sys_setxattr+0xbc/0xe0
[  615.511679][T16150]  do_syscall_64+0xfa/0x3b0
[  615.511708][T16150]  ? lockdep_hardirqs_on+0x9c/0x150
[  615.511736][T16150]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  615.511756][T16150]  ? clear_bhb_loop+0x60/0xb0
[  615.511781][T16150]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  615.511801][T16150] RIP: 0033:0x7feda1b8e9a9
[  615.511819][T16150] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  615.511837][T16150] RSP: 002b:00007fed9f9f6038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
[  615.511859][T16150] RAX: ffffffffffffffda RBX: 00007feda1db5fa0 RCX: 00007feda1b8e9a9
[  615.511874][T16150] RDX: 0000200000000480 RSI: 00002000000001c0 RDI: 0000200000000140
[  615.511888][T16150] RBP: 00007fed9f9f6090 R08: 0000000000000000 R09: 0000000000000000
[  615.511902][T16150] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001
[  615.511914][T16150] R13: 0000000000000000 R14: 00007feda1db5fa0 R15: 00007fff9e69e4b8
[  615.511945][T16150]  </TASK>
[  615.589697][T16151] netlink: 'syz.0.3173': attribute type 4 has an invalid length.
[  615.593915][    C1] vkms_vblank_simulate: vblank timer overrun
[  615.641077][T16151] netlink: 'syz.0.3173': attribute type 4 has an invalid length.
[  615.643646][    C1] vkms_vblank_simulate: vblank timer overrun
[  615.741836][    C1] hrtimer: interrupt took 214410521 ns
[  615.836434][T13548] usb 5-1: USB disconnect, device number 43
[  615.841902][    C1] vkms_vblank_simulate: vblank timer overrun
[  616.252284][ T1113] bridge0: port 2(bridge_slave_1) entered disabled state
[  616.265056][T16173] omfs: Invalid superblock (0)
[  616.780732][T16164] binder: 16163:16164 ioctl c0306201 0 returned -14
[  616.938327][T16196] FAULT_INJECTION: forcing a failure.
[  616.938327][T16196] name failslab, interval 1, probability 0, space 0, times 0
[  616.978295][T16196] CPU: 1 UID: 0 PID: 16196 Comm: syz.0.3184 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  616.978324][T16196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  616.978335][T16196] Call Trace:
[  616.978344][T16196]  <TASK>
[  616.978353][T16196]  dump_stack_lvl+0x189/0x250
[  616.978387][T16196]  ? __pfx____ratelimit+0x10/0x10
[  616.978417][T16196]  ? __pfx_dump_stack_lvl+0x10/0x10
[  616.978445][T16196]  ? __pfx__printk+0x10/0x10
[  616.978480][T16196]  ? __pfx___might_resched+0x10/0x10
[  616.978503][T16196]  ? fs_reclaim_acquire+0x7d/0x100
[  616.978535][T16196]  should_fail_ex+0x414/0x560
[  616.978572][T16196]  should_failslab+0xa8/0x100
[  616.978599][T16196]  kmem_cache_alloc_noprof+0x73/0x3c0
[  616.978620][T16196]  ? getname_flags+0xb8/0x540
[  616.978644][T16196]  getname_flags+0xb8/0x540
[  616.978661][T16196]  ? _copy_from_user+0x94/0xb0
[  616.978687][T16196]  path_setxattrat+0x2ac/0x3a0
[  616.978720][T16196]  ? __pfx_path_setxattrat+0x10/0x10
[  616.978741][T16196]  ? __mutex_unlock_slowpath+0x1a1/0x760
[  616.978799][T16196]  ? ksys_write+0x22a/0x250
[  616.978827][T16196]  ? __pfx_ksys_write+0x10/0x10
[  616.978850][T16196]  ? rcu_is_watching+0x15/0xb0
[  616.978882][T16196]  __x64_sys_setxattr+0xbc/0xe0
[  616.978915][T16196]  do_syscall_64+0xfa/0x3b0
[  616.978943][T16196]  ? lockdep_hardirqs_on+0x9c/0x150
[  616.978970][T16196]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  616.978990][T16196]  ? clear_bhb_loop+0x60/0xb0
[  616.979015][T16196]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  616.979035][T16196] RIP: 0033:0x7fa74678e9a9
[  616.979053][T16196] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  616.979071][T16196] RSP: 002b:00007fa7475c3038 EFLAGS: 00000246 ORIG_RAX: 00000000000000bc
[  616.979103][T16196] RAX: ffffffffffffffda RBX: 00007fa7469b5fa0 RCX: 00007fa74678e9a9
[  616.979117][T16196] RDX: 0000200000000480 RSI: 00002000000001c0 RDI: 0000200000000140
[  616.979131][T16196] RBP: 00007fa7475c3090 R08: 0000000000000000 R09: 0000000000000000
[  616.979144][T16196] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000000001
[  616.979155][T16196] R13: 0000000000000000 R14: 00007fa7469b5fa0 R15: 00007fff413cfbb8
[  616.979185][T16196]  </TASK>
[  616.989925][T16198] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3185'.
[  617.389322][T16206] netlink: 'syz.1.3188': attribute type 4 has an invalid length.
[  617.416558][T16206] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3188'.
[  617.447570][T16206] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3188'.
[  617.480718][T16206] /dev/rnullb0: Can't open blockdev
[  617.486177][T16210] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3189'.
[  617.545523][T16216] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3189'.
[  617.576876][T16210] netlink: 60 bytes leftover after parsing attributes in process `syz.5.3189'.
[  617.595321][   T31] INFO: task syz.3.2381:13134 blocked for more than 143 seconds.
[  617.614878][   T31]       Not tainted 6.16.0-rc6-next-20250718-syzkaller #0
[  617.665179][   T31]       Blocked by coredump.
[  617.666977][T16222] /dev/rnullb0: Can't open blockdev
[  617.669949][   T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  617.699745][   T31] task:syz.3.2381      state:D stack:26920 pid:13134 tgid:13134 ppid:5849   task_flags:0x40044c flags:0x00004006
[  617.726923][   T31] Call Trace:
[  617.733915][   T31]  <TASK>
[  617.740953][   T31]  __schedule+0x1737/0x4d30
[  617.751542][   T31]  ? __lock_acquire+0xab9/0xd20
[  617.762547][   T31]  ? schedule+0x165/0x360
[  617.771666][   T31]  ? __lock_acquire+0xab9/0xd20
[  617.782600][   T31]  ? __pfx___schedule+0x10/0x10
[  617.792462][   T31]  ? schedule+0x91/0x360
[  617.802956][   T31]  schedule+0x165/0x360
[  617.810779][   T31]  schedule_preempt_disabled+0x13/0x30
[  617.822045][   T31]  rwsem_down_read_slowpath+0x5fd/0x8f0
[  617.835244][   T31]  ? rwsem_down_read_slowpath+0x4b8/0x8f0
[  617.851920][   T31]  ? __pfx_rwsem_down_read_slowpath+0x10/0x10
[  617.871332][   T31]  ? exit_mm+0xcc/0x2c0
[  617.875381][  T927] usb 5-1: new high-speed USB device number 44 using dummy_hcd
[  617.890083][   T31]  ? __pfx_mm_release+0x10/0x10
[  617.895083][   T31]  ? lockdep_hardirqs_on+0x9c/0x150
[  617.911087][   T31]  down_read+0x98/0x2e0
[  617.915413][   T31]  exit_mm+0xcc/0x2c0
[  617.920513][   T31]  ? __pfx_exit_mm+0x10/0x10
[  617.925157][   T31]  ? rcu_is_watching+0x15/0xb0
[  617.941247][   T31]  do_exit+0x648/0x2300
[  617.952105][   T31]  ? do_raw_spin_lock+0x121/0x290
[  617.961076][   T31]  ? __pfx_do_exit+0x10/0x10
[  617.968091][   T31]  do_group_exit+0x21c/0x2d0
[  617.978867][   T31]  ? lockdep_hardirqs_on+0x9c/0x150
[  617.987481][   T31]  get_signal+0x1286/0x1340
[  617.998279][   T31]  arch_do_signal_or_restart+0x9a/0x750
[  618.009055][   T31]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  618.025061][   T31]  ? exit_to_user_mode_loop+0x40/0x110
[  618.030821][   T31]  exit_to_user_mode_loop+0x75/0x110
[  618.036496][  T927] usb 5-1: Using ep0 maxpacket: 16
[  618.049938][  T927] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06
[  618.062789][   T31]  do_syscall_64+0x2bd/0x3b0
[  618.069976][  T927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  618.078811][   T31]  ? lockdep_hardirqs_on+0x9c/0x150
[  618.089120][   T31]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  618.089600][  T927] usb 5-1: Product: syz
[  618.103524][  T927] usb 5-1: Manufacturer: syz
[  618.106172][   T31]  ? clear_bhb_loop+0x60/0xb0
[  618.114099][  T927] usb 5-1: SerialNumber: syz
[  618.121218][   T31]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  618.137982][  T927] r8152-cfgselector 5-1: Unknown version 0x0000
[  618.142556][   T31] RIP: 0033:0x7f3436f8e9e3
[  618.144466][  T927] r8152-cfgselector 5-1: config 0 descriptor??
[  618.157844][   T31] RSP: 002b:00007ffdfc7c0978 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[  618.185467][   T31] RAX: fffffffffffffffc RBX: 00007f34355f76c0 RCX: 00007f3436f8e9e3
[  618.199377][   T31] RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000
[  618.217496][   T31] RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
[  618.230219][   T31] R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffdfc7c0ad0
[  618.249137][   T31] R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000
[  618.272194][   T31]  </TASK>
[  618.275372][   T31] 
[  618.275372][   T31] Showing all locks held in the system:
[  618.306703][   T31] 1 lock held by khungtaskd/31:
[  618.311604][   T31]  #0: ffffffff8e53d8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
[  618.333515][   T31] 5 locks held by kworker/1:2/927:
[  618.347104][   T31]  #0: ffff888021ea9548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  618.361759][   T31]  #1: ffffc9000397fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  618.380821][   T31]  #2: ffff88802856a198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20
[  618.395267][   T31]  #3: ffff88805e8ad198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400
[  618.396067][  T927] r8152-cfgselector 5-1: Needed 1 retries to read version
[  618.405145][   T31]  #4: ffff88804c6ed160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400
[  618.426083][   T31] 2 locks held by kworker/u8:6/1113:
[  618.431362][  T927] r8152-cfgselector 5-1: Unknown version 0x6420
[  618.437986][   T31]  #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140
[  618.443450][  T927] r8152-cfgselector 5-1: bad CDC descriptors
[  618.453405][   T31]  #1: ffff8880b8624008 (per_cpu_ptr(&psi_seq, cpu)){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880
[  618.467776][   T31] 2 locks held by getty/5604:
[  618.472573][   T31]  #0: ffff88814d20e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
[  618.499379][   T31]  #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400
[  618.509889][   T31] 1 lock held by syz.3.2381/13134:
[  618.515103][   T31]  #0: ffff8880289b2220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0xcc/0x2c0
[  618.524369][   T31] 1 lock held by syz.3.2381/13135:
[  618.530915][   T31] 1 lock held by syz.0.3187/16209:
[  618.536224][   T31]  #0: ffffffff8e543200 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570
[  618.546546][   T31] 
[  618.556001][   T31] =============================================
[  618.556001][   T31] 
[  618.590382][   T31] NMI backtrace for cpu 0
[  618.590406][   T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  618.590432][   T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  618.590446][   T31] Call Trace:
[  618.590455][   T31]  <TASK>
[  618.590464][   T31]  dump_stack_lvl+0x189/0x250
[  618.590502][   T31]  ? __pfx_dump_stack_lvl+0x10/0x10
[  618.590533][   T31]  ? __pfx__printk+0x10/0x10
[  618.590576][   T31]  nmi_cpu_backtrace+0x39e/0x3d0
[  618.590605][   T31]  ? __pfx_nmi_cpu_backtrace+0x10/0x10
[  618.590634][   T31]  ? __pfx__printk+0x10/0x10
[  618.590668][   T31]  ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
[  618.590696][   T31]  nmi_trigger_cpumask_backtrace+0x17a/0x300
[  618.590725][   T31]  watchdog+0xf93/0xfe0
[  618.590752][   T31]  ? watchdog+0x1de/0xfe0
[  618.590780][   T31]  kthread+0x70e/0x8a0
[  618.590814][   T31]  ? __pfx_watchdog+0x10/0x10
[  618.590836][   T31]  ? __pfx_kthread+0x10/0x10
[  618.590868][   T31]  ? _raw_spin_unlock_irq+0x23/0x50
[  618.590895][   T31]  ? lockdep_hardirqs_on+0x9c/0x150
[  618.590925][   T31]  ? __pfx_kthread+0x10/0x10
[  618.590955][   T31]  ret_from_fork+0x3f9/0x770
[  618.590984][   T31]  ? __pfx_ret_from_fork+0x10/0x10
[  618.591016][   T31]  ? __switch_to_asm+0x39/0x70
[  618.591034][   T31]  ? __switch_to_asm+0x33/0x70
[  618.591050][   T31]  ? __pfx_kthread+0x10/0x10
[  618.591081][   T31]  ret_from_fork_asm+0x1a/0x30
[  618.591117][   T31]  </TASK>
[  618.591146][   T31] Sending NMI from CPU 0 to CPUs 1:
[  618.739143][    C1] NMI backtrace for cpu 1
[  618.739160][    C1] CPU: 1 UID: 0 PID: 1113 Comm: kworker/u8:6 Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  618.739180][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  618.739193][    C1] Workqueue: bat_events batadv_nc_worker
[  618.739237][    C1] RIP: 0010:validate_chain+0xaa/0x2140
[  618.739263][    C1] Code: 6c 8e e5 ff 90 0f 0b 90 90 90 48 bb eb 83 b5 80 46 86 c8 61 49 0f af df 48 c1 eb 2d 48 8b 04 dd 60 13 ab 93 48 85 c0 0f 94 c1 <48> 83 c0 f8 0f 94 c2 08 ca 0f 84 24 01 00 00 e8 e2 9b ff ff 83 3d
[  618.739278][    C1] RSP: 0018:ffffc90003e47728 EFLAGS: 00000086
[  618.739294][    C1] RAX: ffffffff9400ae78 RBX: 0000000000056252 RCX: 0000000000040000
[  618.739307][    C1] RDX: 0000000000000000 RSI: ffff8880271b8b40 RDI: ffff8880271b8000
[  618.739319][    C1] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8b4d7867
[  618.739330][    C1] R10: dffffc0000000000 R11: fffffbfff1fc79e7 R12: 0000000000000000
[  618.739343][    C1] R13: ffff8880271b8af0 R14: ffff8880271b8b40 R15: 9cfb5689cb986212
[  618.739356][    C1] FS:  0000000000000000(0000) GS:ffff8881258ab000(0000) knlGS:0000000000000000
[  618.739371][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  618.739383][    C1] CR2: 00007fa746983178 CR3: 000000007e912000 CR4: 00000000003526f0
[  618.739401][    C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  618.739412][    C1] DR3: 00000000000032e7 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[  618.739429][    C1] Call Trace:
[  618.739436][    C1]  <TASK>
[  618.739447][    C1]  ? do_raw_spin_unlock+0x122/0x240
[  618.739481][    C1]  __lock_acquire+0xab9/0xd20
[  618.739503][    C1]  ? batadv_nc_purge_paths+0xe7/0x3b0
[  618.739526][    C1]  lock_acquire+0x120/0x360
[  618.739556][    C1]  ? batadv_nc_purge_paths+0xe7/0x3b0
[  618.739579][    C1]  ? __pfx___local_bh_enable_ip+0x10/0x10
[  618.739603][    C1]  ? batadv_nc_purge_paths+0xe7/0x3b0
[  618.739625][    C1]  _raw_spin_lock_bh+0x36/0x50
[  618.739646][    C1]  ? batadv_nc_purge_paths+0xe7/0x3b0
[  618.739667][    C1]  ? __pfx_batadv_nc_to_purge_nc_path_decoding+0x10/0x10
[  618.739691][    C1]  batadv_nc_purge_paths+0xe7/0x3b0
[  618.739719][    C1]  batadv_nc_worker+0x369/0x610
[  618.739740][    C1]  ? process_scheduled_works+0x9ef/0x17b0
[  618.739761][    C1]  process_scheduled_works+0xade/0x17b0
[  618.739793][    C1]  ? __pfx_process_scheduled_works+0x10/0x10
[  618.739820][    C1]  worker_thread+0x8a0/0xda0
[  618.739841][    C1]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  618.739867][    C1]  ? __kthread_parkme+0x7b/0x200
[  618.739892][    C1]  kthread+0x70e/0x8a0
[  618.739917][    C1]  ? __pfx_worker_thread+0x10/0x10
[  618.739936][    C1]  ? __pfx_kthread+0x10/0x10
[  618.739960][    C1]  ? _raw_spin_unlock_irq+0x23/0x50
[  618.739981][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  618.740003][    C1]  ? __pfx_kthread+0x10/0x10
[  618.740027][    C1]  ret_from_fork+0x3f9/0x770
[  618.740048][    C1]  ? __pfx_ret_from_fork+0x10/0x10
[  618.740071][    C1]  ? __switch_to_asm+0x39/0x70
[  618.740086][    C1]  ? __switch_to_asm+0x33/0x70
[  618.740099][    C1]  ? __pfx_kthread+0x10/0x10
[  618.740123][    C1]  ret_from_fork_asm+0x1a/0x30
[  618.740145][    C1]  </TASK>
[  618.742417][   T31] Kernel panic - not syncing: hung_task: blocked tasks
[  618.742437][   T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-next-20250718-syzkaller #0 PREEMPT(full) 
[  618.742466][   T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  618.742482][   T31] Call Trace:
[  618.742492][   T31]  <TASK>
[  618.742502][   T31]  dump_stack_lvl+0x99/0x250
[  618.742538][   T31]  ? __asan_memcpy+0x40/0x70
[  618.742574][   T31]  ? __pfx_dump_stack_lvl+0x10/0x10
[  618.742607][   T31]  ? __pfx__printk+0x10/0x10
[  618.742654][   T31]  vpanic+0x281/0x750
[  618.742685][   T31]  ? __pfx_vpanic+0x10/0x10
[  618.742713][   T31]  ? preempt_schedule+0xae/0xc0
[  618.742747][   T31]  ? preempt_schedule_common+0x83/0xd0
[  618.742787][   T31]  panic+0xb9/0xc0
[  618.742812][   T31]  ? __pfx_panic+0x10/0x10
[  618.742841][   T31]  ? preempt_schedule_thunk+0x16/0x30
[  618.742875][   T31]  ? nmi_trigger_cpumask_backtrace+0x2bb/0x300
[  618.742906][   T31]  watchdog+0xfd2/0xfe0
[  618.742938][   T31]  ? watchdog+0x1de/0xfe0
[  618.742968][   T31]  kthread+0x70e/0x8a0
[  618.743004][   T31]  ? __pfx_watchdog+0x10/0x10
[  618.743027][   T31]  ? __pfx_kthread+0x10/0x10
[  618.743062][   T31]  ? _raw_spin_unlock_irq+0x23/0x50
[  618.743091][   T31]  ? lockdep_hardirqs_on+0x9c/0x150
[  618.743121][   T31]  ? __pfx_kthread+0x10/0x10
[  618.743155][   T31]  ret_from_fork+0x3f9/0x770
[  618.743194][   T31]  ? __pfx_ret_from_fork+0x10/0x10
[  618.743229][   T31]  ? __switch_to_asm+0x39/0x70
[  618.743248][   T31]  ? __switch_to_asm+0x33/0x70
[  618.743267][   T31]  ? __pfx_kthread+0x10/0x10
[  618.743301][   T31]  ret_from_fork_asm+0x1a/0x30
[  618.743339][   T31]  </TASK>
[  619.205586][   T31] Kernel Offset: disabled
[  619.209906][   T31] Rebooting in 86400 seconds..