last executing test programs: 52m15.222842867s ago: executing program 0 (id=151): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r1, &(0x7f0000000540)=""/88, 0x58) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) 52m13.907543977s ago: executing program 0 (id=153): keyctl$invalidate(0x15, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) 52m9.904483012s ago: executing program 0 (id=166): openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8, 0x5}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x42, 0x6, 0x8, 0x0, 0x1}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c00000004000000040000000180000000000000", @ANYRES32=r2], 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000, r3}, 0x38) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000080)={0x0, 0x1, 0x2, "d0f84e565c6f0f308072785ebd9ca8ac00", 0x3032344d}) 52m8.196901868s ago: executing program 0 (id=179): mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000077ee000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffff900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0xffffffffffffffff}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x80, 0x0, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x2080) ioctl$LOOP_SET_FD(r3, 0x4c00, r2) ioctl$LOOP_SET_FD(r3, 0x4c05, r3) dup2(r2, r0) 52m7.789949989s ago: executing program 0 (id=172): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x55) listen(r0, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x8, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r1, &(0x7f0000000540)={0xa, 0x4e22, 0x7, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x42) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) listen(r2, 0x80000003) 52m7.377267719s ago: executing program 0 (id=176): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff}, &(0x7f0000000080)={&(0x7f0000000040)=""/2, 0x0, 0x2}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f00000001c0), 0x0, 0x840, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, 0x0, &(0x7f0000000100)) r2 = syz_usb_connect$hid(0x2, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000400b060a70000002000001090224000100000000090400000103000000092100000001220500090581030000"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000003c0)={0x18, &(0x7f0000000680)=ANY=[@ANYBLOB="0000570000005700a7ea3163fd3bc518194b120c1e73d54cfc4ad2841ef4f6a3"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x200) 52m6.064269585s ago: executing program 32 (id=176): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$BLKTRACESETUP(r0, 0xc0481273, 0x0) sigaltstack(&(0x7f0000000000)={0xffffffffffffffff}, &(0x7f0000000080)={&(0x7f0000000040)=""/2, 0x0, 0x2}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f00000001c0), 0x0, 0x840, 0x0, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, 0x0, &(0x7f0000000100)) r2 = syz_usb_connect$hid(0x2, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000400b060a70000002000001090224000100000000090400000103000000092100000001220500090581030000"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000003c0)={0x18, &(0x7f0000000680)=ANY=[@ANYBLOB="0000570000005700a7ea3163fd3bc518194b120c1e73d54cfc4ad2841ef4f6a3"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) syz_open_dev$hidraw(&(0x7f0000000100), 0x0, 0x200) 7.593951877s ago: executing program 1 (id=9612): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002800), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000002e40)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000001740)=""/192, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) add_key$user(&(0x7f0000000140), 0x0, 0x0, 0x0, 0xfffffffffffffffb) connect$vsock_stream(r1, &(0x7f0000001500)={0x28, 0x0, 0x0, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xeeef0000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0) 6.583516434s ago: executing program 1 (id=9621): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1000000}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000b32000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000001c0)=0x40) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, 0x0) r4 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r4, 0x80845663, 0x0) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) sendmsg$NFNL_MSG_CTHELPER_GET(r3, &(0x7f00000003c0)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x14, 0x1, 0x9, 0x3, 0x0, 0x0, {0x1, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x48801}, 0x4040090) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000380), 0x4401, 0x0) ioctl$I2C_PEC(0xffffffffffffffff, 0x708, 0x10000) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) socket(0x10, 0x2, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f0000001b80)={0x1, 0x0, [{0x0, 0x0, 0x0}]}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(0xffffffffffffffff, 0xe, &(0x7f0000000540)={0x6, 0x0, 0x0, &(0x7f00000004c0)}, 0x20) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x40000, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="400000001000030426bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB], 0x40}}, 0x440088c4) add_key(0x0, &(0x7f0000000340)={'syz', 0x3}, &(0x7f0000000580)="27bbb1597dc47f6337451576aeb8dfb5bd94109520e8e86f17154f1f9cf65ecb99c8d4a09b832e2b06377bd6f3465578f7e4bd03f416c956da02a542dee2d985d0a7b21a2186c034b3296ef41bac2493e03b", 0x52, 0xfffffffffffffff9) 6.070098334s ago: executing program 5 (id=9625): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x4}}}]}]}], {0x14}}, 0x54}}, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000a00)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb015c291d00090509"], 0x0) r0 = syz_open_dev$audion(&(0x7f0000000000), 0x3, 0x1) write$P9_RVERSION(r0, &(0x7f0000000640)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.L'}, 0x5ce) 5.347252178s ago: executing program 1 (id=9628): openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = io_uring_setup(0x7534, &(0x7f00000003c0)={0x0, 0x48c7, 0x80, 0x0, 0xffffffff}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.161931511s ago: executing program 1 (id=9629): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000052c0)=ANY=[@ANYBLOB="5c6e7c0fc438763700", @ANYBLOB="0100000000000000000017000000480006804400040067636d28616573290000000000000000000000000000000000e5b971990000001c000000ffcaf35c8375f28a0a45aea9d25fd91f3dbaf77f283b9112e5ffdd3f728a2661e171b43f95a6addc98b409fe959f712de476f584022152d010dd26e30ab34c440890b7f8e5e47cbb499ae61b60a0654aa1776c02bca09fba064fb369a0e0dfc2198206ec46b42052da43f454eefdcbe1d82ac9cd3304b7395c466dfc"], 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00'}) r2 = fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x1, 0x0) unlinkat(r3, &(0x7f00000000c0)='./bus\x00', 0x200) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000001dc0)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000440)=ANY=[@ANYBLOB="2c0000006c00010029bd7000fedbdf2509000d0073797a300000000010003b800c001680"], 0x2c}], 0x1, 0x0, 0x0, 0x20004880}, 0xc000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000300)=ANY=[], 0x50) r5 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000c2bd0b20f8061b3039bb0102030109021b0001000000000904"], 0x0) mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NL80211_CMD_GET_POWER_SAVE(r1, &(0x7f00000055c0)={&(0x7f0000004100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000005580)={&(0x7f0000005600)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="24a0d6d79afa6ff340a41947ecfe34bf5729d3512d77d01832612496c21121c101e470ac0f69fe6be6a3f8c40bf521ce7be674d73b92d4ae139ffccbb50105a3b48389aa7bb6073fe404078ae0ca06fb6639c469b6678868bf79b4722a16efd780b8dc10441e8841c0f594092d0cdd532a86e24c54dd8090d8a8e86139b05d9c2eb1f2ca5c37c48bddcd6d7fcca3989d03022b"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x80c0) sendmsg$kcm(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000b80)="d800000019008111e00212ba0d8105040a610200ff0f040b067c55a1bc000900b800069903000000b0000500808178a8001500030001400200000901ac040000d69b6f94007100a007a290457f0189b316277ce06bbace8017cbec4c0000001fb791643a5ee4b11602b2a10c11ce1b25d6d9300000730d7a5025ccca262f2240fad95667e04adcdf634c1f215ce3bb9ad809d5e15de6ccd40dd6e4edef3d93452a9230000e9703000000000000000000000000129ae100000000000000000000080000000000000000000000000080b6fcdb2ab01ec2bb13", 0xd8}], 0x1}, 0x8040150) recvmsg(r0, &(0x7f00000057c0)={&(0x7f00000056c0)=@nfc, 0x80, &(0x7f0000004140)=[{&(0x7f0000005740)=""/117, 0x75}], 0x1}, 0x0) mount$fuse(0x0, &(0x7f0000002000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000003000), 0x2100820, &(0x7f0000004180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000020000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d0f260cabfb7d81", @ANYRESDEC, @ANYBLOB=',\x00']) openat$tun(0xffffff9c, &(0x7f0000004080), 0x101000, 0x0) umount2(&(0x7f0000001000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xf) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) r7 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) openat$nvme_fabrics(0xffffff9c, &(0x7f00000040c0), 0x40200, 0x0) syz_usb_connect$cdc_ncm(0x5, 0x7a, &(0x7f0000005200)=ANY=[@ANYBLOB="12011001020000402505a1a44000010203010902680002010690080904000001020d00000a2406000138ade40976052400e10c0d240f0101000050000003000706241a040022072414030018000905810310000702020904010000020d00000904010102020d000009058202ff03050404060000000002b60400"], &(0x7f0000005400)={0xa, &(0x7f0000005280)={0xa, 0x6, 0x201, 0x8, 0x6, 0xf8, 0x10, 0xe}, 0xff, &(0x7f0000005440)=ANY=[@ANYBLOB="050fff00050a100300000007015e7414100404eae6b623c5312a81ed305001c8a93e57be100297853f7203a527e925659e26e4614df00ccccc6c9708b466905cdc79d9c09225c1f38a2197abdd707dd338082e5aeafcf4fb4ed230b1d930d74529ac1ba488af43ae08364ad2247c232b0388b718faed90914dbb570ee88211f7ed2f5c801183434a950c88c07ee99d2b6a95ee8ea81fece91a726472e88e625adf8ac91c4018c26a62c304e035e0d834fa1c21f18a0c8ef43dd089269e44ccec75c6a56a5c48c050942a577e0ac1dbce83399efeeb27a97aa5553e72d98a13184d948eb4a61410040e621212c657d995b4e52e"], 0x1, [{0x4, &(0x7f00000053c0)=@lang_id={0x4, 0x3, 0x380a}}]}) setrlimit(0x2, &(0x7f00000000c0)={0x0, 0x2400000}) pivot_root(&(0x7f0000003080)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000004200)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000003040)='highspeed', 0x9) 4.529462345s ago: executing program 5 (id=9634): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r2, 0x6, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd26, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x2, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x1000, 0x20000000, 0xfffffffc, 0x7ff}}]}, {0x4}, {0x2, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) sendmsg$nl_route_sched(r4, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x32, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) unshare(0x2040400) r7 = fsopen(&(0x7f0000000440)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) unshare(0x2000400) fsmount(r7, 0x0, 0x0) r8 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r8, 0xc02c564a, &(0x7f0000001b00)={0x0, 0x34325842, 0x1, @discrete={0x1, 0x100}}) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x4b0, 0x2fc, 0x18c, 0x203, 0x0, 0x19030000, 0x3e8, 0x2e0, 0x2e0, 0x3e8, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d4, 0x2fc, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x1d}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {0xfffc, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {0xffff}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4, 0x0, 0x10}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa4, 0xec}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x50c) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r9 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) 3.899820649s ago: executing program 2 (id=9639): capset(&(0x7f00000004c0)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200006, 0x801, 0x4, 0x7, 0xb0}) unshare(0x2c020400) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x1a6) 3.610121109s ago: executing program 2 (id=9644): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000340)={0x1d, r1, 0x0, {0x1, 0xf0, 0x4}, 0xfe}, 0x18) sendmmsg(r0, &(0x7f0000003040)=[{{&(0x7f00000001c0)=@can={0x1d, r1}, 0x80, &(0x7f0000000080)=[{0x0}, {&(0x7f0000000800)="5fa8cb3e7614b2daea3d4d01885bc27d448217d1251c39b7a73f5912a48cd055c3d3a468c36b3e7e867a193d4d5d25a491828dcf6e81180f271352ea09a37a360e793e31013d098be5e88eecd8e65ede9fbdeba19b1ea417e7b2f36220e8", 0x5e}], 0x2}}], 0x1, 0x20000008) 3.571302489s ago: executing program 3 (id=9645): mq_open(&(0x7f00000000c0)='${$\x00', 0x840, 0x0, 0x0) r0 = syz_io_uring_setup(0x1e1e, &(0x7f0000000140)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r0, 0x48e9, 0x300, 0x2, 0x0, 0x0) 3.485487673s ago: executing program 2 (id=9646): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000580)={0x24, &(0x7f00000001c0)={0x20, 0x18, 0x2, "ce05"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000180)={0x0, 0xd, 0x3, &(0x7f0000000100)={0x17, "c6c1f7b51030c4b7c54bf28facb1ed3ee2dfe97a04bc517b5452b3b94bce47509d"}}) 3.48527965s ago: executing program 3 (id=9647): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @rand_addr, 0x1}, 0x1c) sendmmsg$inet6(r0, &(0x7f000000bf40)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000340)={0xa, 0x4e20, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x7}, 0x1c, 0x0}}], 0x2, 0x2) 3.417607179s ago: executing program 3 (id=9648): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xa31e3000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) set_mempolicy(0x3, &(0x7f0000000240)=0x4c929393, 0x4) 2.228863961s ago: executing program 3 (id=9651): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002800), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000002e40)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000001740)=""/192, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) add_key$user(&(0x7f0000000140), 0x0, 0x0, 0x0, 0xfffffffffffffffb) connect$vsock_stream(r1, &(0x7f0000001500)={0x28, 0x0, 0x0, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xeeef0000}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, 0x0) 2.088810329s ago: executing program 1 (id=9652): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000012c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109024a0001100000000904000003fe03010009cd8d1f00020000000905050200067e001009058b1e", @ANYRESHEX], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000001580)={0x34, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, &(0x7f0000000180)='0', 0xfe64) 1.77063766s ago: executing program 2 (id=9653): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000002300)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x4000000}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x9, 0x0, 0x0, {0x0, 0x0, 0xf5}}], {0x14}}, 0x3c}}, 0x0) 1.770115175s ago: executing program 4 (id=9654): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, 0x0, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r4, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x1018}, './file0\x00'}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r5, 0xc05064a7, &(0x7f0000000400)={0x0, 0x0, 0x0, &(0x7f00000003c0), 0x0, 0x0, 0x0, 0x0, r6}) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fc, 0x4000}, 0x10) r8 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r8, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvfrom(r7, &(0x7f0000000140)=""/104, 0x68, 0x12020, 0x0, 0x0) setsockopt$TIPC_MCAST_REPLICAST(r8, 0x10f, 0x86) ioctl$DRM_IOCTL_MODE_ATOMIC(r5, 0xc03864bc, &(0x7f0000000500)={0x200, 0x1, &(0x7f0000000180)=[r6], 0x0, 0x0, &(0x7f0000000040)}) sendmsg$NL80211_CMD_GET_WOWLAN(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x28, r1, 0x10, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void, @val={0xc, 0x99, {0x89fb, 0x2b}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x10001) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0x14, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_FORWARDING={0x5, 0x13, 0x1}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x48041}, 0x40840) 1.717999504s ago: executing program 2 (id=9655): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x8, 0x0, 0xb45, 0x9, 0x200008, 0x2, 0x3}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$int_in(0xffffffffffffffff, 0x5452, 0x0) shutdown(0xffffffffffffffff, 0x1) setsockopt(0xffffffffffffffff, 0x84, 0x400, 0x0, 0xffffffffffffff94) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) bind$inet(r2, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x40, &(0x7f00000000c0)=0x3, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETTABLE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="20000000010a01080000000000000000010000050900010073797a30000000004a6c4080609c41c130010e6273c0d4e90055d6f6cc5659e171521a90388b0e9b1d6e729bb8d4ab66298bbe1e028e267a355b35e66543e3671079ede6c579a6d7a7fdcab2a08d3b96e10786f8492f39c14e3fc8dea872c6142f4cb0693b4a54bc0a319674da81a656c2f8fb62b664aee460b09ffd0b74f826d2288ecee86aa442fc711ad5d55e164556a57c3f45cf06128e10973d5d5444251dec360af32a3957f9bd7b1054b50f2fb22d06cbbace2eda7014a22b97d780261f1433538f4f1f1e361b23c7ff51e08d69b75f"], 0x20}}, 0x4804) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000200), 0x0) sendto$inet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000d80), 0x36f, 0x20102, 0x0) sendmsg$nl_route(r2, 0x0, 0x2000800) rt_sigpending(&(0x7f0000000180), 0x8) r4 = socket$inet6_udp(0xa, 0x2, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x4}}, 0x26) r6 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r6, &(0x7f0000000280)=[{{&(0x7f0000003e80)={0xa, 0x4e22, 0x5, @mcast1}, 0x1c, 0x0}}, {{&(0x7f0000000000)={0xa, 0x4e22, 0x8, @mcast2, 0x7101}, 0x1c, 0x0}}], 0x2, 0x4008810) sendmsg$inet(r5, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x4041) 1.572069931s ago: executing program 5 (id=9656): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x5, @loopback, 0x4}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e21, 0x659, @empty, 0xff}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000100), 0x4) 1.518933225s ago: executing program 5 (id=9657): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@bridge_dellink={0x2c, 0x11, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x8400, 0x40000}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x4, 0x0, 0x1, {0x4, 0x5}}]}]}, 0x2c}}, 0x0) 1.442199428s ago: executing program 5 (id=9658): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1000000}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000b32000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000001c0)=0x40) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x5, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, 0x0) r4 = syz_open_dev$vbi(0x0, 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r4, 0x80845663, 0x0) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1) sendmsg$NFNL_MSG_CTHELPER_GET(r3, &(0x7f00000003c0)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x14, 0x1, 0x9, 0x3, 0x0, 0x0, {0x1, 0x0, 0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x48801}, 0x4040090) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000380), 0x4401, 0x0) ioctl$I2C_PEC(0xffffffffffffffff, 0x708, 0x10000) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000240)={0x0, 0x1000000}) socket(0x10, 0x2, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r5, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f0000001b80)={0x1, 0x0, [{0x0, 0x0, 0x0}]}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(0xffffffffffffffff, 0xe, &(0x7f0000000540)={0x6, 0x0, 0x0, &(0x7f00000004c0)}, 0x20) ioctl$VHOST_VSOCK_SET_RUNNING(r5, 0x4004af61, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x40000, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="400000001000030426bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB], 0x40}}, 0x440088c4) add_key(0x0, &(0x7f0000000340)={'syz', 0x3}, &(0x7f0000000580)="27bbb1597dc47f6337451576aeb8dfb5bd94109520e8e86f17154f1f9cf65ecb99c8d4a09b832e2b06377bd6f3465578f7e4bd03f416c956da02a542dee2d985d0a7b21a2186c034b3296ef41bac2493e03b", 0x52, 0xfffffffffffffff9) 1.227127826s ago: executing program 3 (id=9659): syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424"], 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x70, 0x103301) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect) 595.095239ms ago: executing program 4 (id=9660): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000000)={@in6={{0xa, 0x0, 0x9, @loopback}}, 0x0, 0x0, 0x46, 0x0, "2431d0edd9b36cb74d7df7671eacf04be3b08353efa3641776f56c7556fd3713097bd0072577bc6fefb4cdc9e94e420b0ea4fbc5b07a32056eff5e6c42784b46ddab72b1b8fc87f208ad6db80d8dfe25"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000001c0)={@in6={{0xa, 0x4e22, 0xffffffff, @remote}}, 0x0, 0x0, 0x4, 0x0, "aeb81d8ee3a82d67eea9e5bdf2247481041a5b9cddbc936efc471c56ae3d5f6945d296a281858a891a3b4e7bff572ef69992da867f406182d70f47773434b8349435f2ad628d62a3b45bb98872fb1900"}, 0xd8) sendmmsg$inet6(r0, &(0x7f0000000040)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0x7fe}, 0x1c, 0x0}}], 0x1, 0x20048000) 501.565532ms ago: executing program 4 (id=9661): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x10}}}}}}, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000340)='G', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) 447.838676ms ago: executing program 4 (id=9663): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000d00)=@ipv6_newroute={0x44, 0x18, 0x1, 0x0, 0x25dfdbff, {}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x7}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x14, 0x1, {{0x2, {0x6, 0x0, 0x4, 0x0, 0x9, 0x40, 0xff}}}}}]}, 0x44}}, 0x0) 366.008681ms ago: executing program 4 (id=9664): r0 = socket(0x10, 0x3, 0x6) r1 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x90, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0xfffffffffffffd95, 0x2, {{0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x5], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x2, 0x2], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}, @TCA_INGRESS_BLOCK={0x0, 0xd, 0x1}]}, 0x90}}, 0x20008010) 317.303649ms ago: executing program 3 (id=9665): r0 = socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x4e24, @empty}, 0x10) syz_emit_ethernet(0x6f, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x61, 0x68, 0x0, 0x0, 0x88, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @local}, {0x1, 0x4e24, 0x4d, 0x0, @gue={{0x2, 0x0, 0x3, 0xe6}, "ea6c0858ccfeb6f2f7140070c5accb455d83c80d55bd0b2bcc048236a02c86463890ad1b837103d1ccd42ae3e99f9744572967db76b52b4e3f7299f277"}}}}}}, 0x0) recvfrom(r0, 0x0, 0x0, 0x10120, 0x0, 0x0) 254.633628ms ago: executing program 4 (id=9666): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x8040) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) munmap(&(0x7f00006bb000/0x1000)=nil, 0x1000) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS2(r7, 0x4068aea3, &(0x7f0000000000)={0xd5, 0x0, 0x10}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r8, 0x4138ae84, &(0x7f00000001c0)={{0x0, 0xdddd0000, 0x0, 0xf0, 0x40, 0xfd, 0x7, 0xd4, 0x0, 0x4, 0x7, 0x6}, {0xffff1000, 0x2, 0xd, 0x9, 0x8, 0x40, 0x6, 0x8, 0x5, 0xf, 0x3, 0xca}, {0xeeee0000, 0xe6e50002, 0xb, 0x0, 0x2, 0x7, 0x4, 0x1, 0xc, 0x0, 0x6, 0x5}, {0xeeef0000, 0x3000, 0xd, 0xf, 0x43, 0x46, 0x2, 0xd, 0x6, 0x3, 0xfc, 0x1}, {0x100000, 0x0, 0x3, 0x1, 0x3, 0x9, 0x9, 0x7, 0x5, 0x4, 0x1e, 0x4b}, {0x2, 0xd000, 0x9, 0x7, 0x4, 0x6e, 0x1, 0xfb, 0x4, 0x80, 0x1, 0xfc}, {0x6000, 0x2000, 0xf, 0x9d, 0x3, 0x0, 0x1, 0xb, 0x5, 0x7, 0x0, 0xf8}, {0xffff1000, 0x8000000, 0xd, 0x5, 0x3, 0x3, 0xa, 0x9, 0x54, 0x6, 0x2, 0x7}, {0x100000, 0x5}, {0xdddd1000, 0x9}, 0x40010000, 0x0, 0xf000, 0x300, 0x9, 0x0, 0xeeef0000, [0x4, 0x402, 0x8, 0x8]}) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f0000000440)={0x1, 0x0, [{0x1, 0x47, 0x3, 0xe3, 0x3, 0x5, 0x80000000}]}) read$FUSE(r5, &(0x7f0000005180)={0x2020}, 0x2020) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) set_mempolicy(0x2, 0x0, 0x4) set_mempolicy(0x3, &(0x7f0000000000)=0x7, 0xf) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r9, 0x0, 0x485, 0x0, 0x0) unshare(0x6a040000) 47.020373ms ago: executing program 5 (id=9667): r0 = syz_open_dev$evdev(&(0x7f0000001080), 0xb, 0x1) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) write$evdev(r1, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) 5.883312ms ago: executing program 1 (id=9668): r0 = open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) fcntl$setlease(r0, 0x400, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x2}) 0s ago: executing program 2 (id=9669): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xc, &(0x7f0000000140)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={r2, 0x1, 0x1, 0xfe, 0xffffff7f, 0x3}, &(0x7f00000000c0)=0x14) kernel console output (not intermixed with test programs): z.1.8404" exe="/root/syz-executor" sig=0 arch=40000003 syscall=442 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3082.115725][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 3082.125808][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 3082.161593][ T30] audit: type=1326 audit(1770025694.743:3749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12662 comm="syz.1.8404" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3082.188748][ T30] audit: type=1326 audit(1770025694.743:3750): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12662 comm="syz.1.8404" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3082.219229][ T30] audit: type=1326 audit(1770025694.743:3751): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12662 comm="syz.1.8404" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3082.245724][ T30] audit: type=1326 audit(1770025694.753:3752): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12662 comm="syz.1.8404" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3083.049048][ T5883] usb 3-1: USB disconnect, device number 88 [ 3083.268622][T12687] binder: 12682:12687 ioctl 4018620d 0 returned -22 [ 3083.637917][T12689] netdevsim netdevsim5: Direct firmware load for / [ 3083.637917][T12689] failed with error -2 [ 3083.665438][T12689] netdevsim netdevsim5: Falling back to sysfs fallback for: / [ 3083.665438][T12689] [ 3084.529485][T12685] delete_channel: no stack [ 3085.203837][ T36] net_ratelimit: 110 callbacks suppressed [ 3085.203858][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.231327][T12709] ALSA: seq fatal error: cannot create timer (-22) [ 3085.241187][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.263609][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.294538][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.323877][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.347966][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.393526][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.413489][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.433995][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.473878][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3085.966617][T12719] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8415'. [ 3086.148772][T12721] tipc: Enabling of bearer rejected, already enabled [ 3086.184748][T12721] tipc: Enabling of bearer rejected, already enabled [ 3086.442732][T12726] netlink: 'syz.5.8416': attribute type 5 has an invalid length. [ 3086.616580][T12726] ip6erspan0: entered promiscuous mode [ 3087.040673][T12732] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8417'. [ 3087.750155][T12739] binder: 12735:12739 ioctl 4018620d 0 returned -22 [ 3088.779863][T12747] wireguard9: entered promiscuous mode [ 3089.980316][T12762] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8425'. [ 3090.015973][T12762] ip6gre4: entered promiscuous mode [ 3090.021231][T12762] ip6gre4: entered allmulticast mode [ 3090.029805][ T1340] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 3090.051009][ T1340] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 3090.060968][ T4677] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 3090.157823][ T30] kauditd_printk_skb: 24 callbacks suppressed [ 3090.157836][ T30] audit: type=1800 audit(1770025703.063:3777): pid=12766 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.8423" name="file1" dev="tmpfs" ino=9149 res=0 errno=0 [ 3090.213776][ T1340] net_ratelimit: 122 callbacks suppressed [ 3090.213791][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.243989][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.273056][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.294405][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.314246][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.329680][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3090.434110][ T4677] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 3090.468232][T12769] wireguard5: entered promiscuous mode [ 3090.542025][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.583845][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.634449][ T4677] usb 2-1: Using ep0 maxpacket: 16 [ 3090.639701][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.652612][ T4677] usb 2-1: config 0 has no interfaces? [ 3090.681694][ T4677] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 3090.691491][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3090.721814][ T4677] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 3090.731815][ T5883] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 3090.761688][ T4677] usb 2-1: Manufacturer: syz [ 3090.801433][ T4677] usb 2-1: config 0 descriptor?? [ 3091.009938][T12762] netlink: 28 bytes leftover after parsing attributes in process `syz.4.8425'. [ 3091.041174][T12762] fuse: Unknown parameter 'w1 [ 3091.041174][T12762] Éó•‚' [ 3091.054059][ T4677] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 3091.515851][T12764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3091.586961][T12764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3092.457497][T12795] bond0: option lp_interval: invalid value (0) [ 3092.465525][T12795] bond0: option lp_interval: allowed values 1 - 2147483647 [ 3093.407571][ T49] usb 2-1: USB disconnect, device number 85 [ 3093.773131][ C0] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 3093.840714][T12812] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8431'. [ 3093.870755][T12812] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8431'. [ 3094.428827][ T30] audit: type=1326 audit(1770025707.333:3778): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3094.460968][ T30] audit: type=1326 audit(1770025707.333:3779): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3094.491948][ T30] audit: type=1326 audit(1770025707.333:3780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=428 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3094.520084][ T30] audit: type=1326 audit(1770025707.353:3781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3094.544003][ T30] audit: type=1326 audit(1770025707.363:3782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3094.570726][ T30] audit: type=1326 audit(1770025707.393:3783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=442 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3094.594594][ T30] audit: type=1326 audit(1770025707.393:3784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3094.644876][ T30] audit: type=1326 audit(1770025707.393:3785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3094.680008][ T30] audit: type=1326 audit(1770025707.393:3786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12814 comm="syz.5.8434" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3095.274347][ T1340] net_ratelimit: 91 callbacks suppressed [ 3095.274363][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3095.288381][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3095.403934][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3095.412917][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3095.564474][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3095.572506][ T36] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3095.705551][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3095.718066][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3095.789652][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 3095.789669][ T30] audit: type=1800 audit(1770025708.693:3803): pid=12827 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.8437" name="file1" dev="tmpfs" ino=8543 res=0 errno=0 [ 3095.843502][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3095.851447][ T3555] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3096.215622][T12839] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8441'. [ 3096.244113][T14058] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 3096.428622][T14058] usb 3-1: Using ep0 maxpacket: 8 [ 3096.464881][T14058] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3096.495146][T14058] usb 3-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=21.c6 [ 3096.525782][T14058] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3096.569422][T12843] bridge10: port 1(veth9) entered blocking state [ 3096.579458][T12843] bridge10: port 1(veth9) entered disabled state [ 3096.600135][T14058] usb 3-1: config 0 descriptor?? [ 3096.626106][T12843] veth9: entered allmulticast mode [ 3096.641289][T12843] veth9: entered promiscuous mode [ 3096.667153][T12844] veth0_to_bond: left allmulticast mode [ 3096.675101][T12844] veth0_to_bond: left promiscuous mode [ 3096.688013][T12844] bridge9: port 2(veth0_to_bond) entered disabled state [ 3096.956333][T12844] bridge10: port 2(veth0_to_bond) entered blocking state [ 3096.968865][T12844] bridge10: port 2(veth0_to_bond) entered disabled state [ 3096.988697][T12844] veth0_to_bond: entered allmulticast mode [ 3097.019128][T12844] veth0_to_bond: entered promiscuous mode [ 3097.277643][T12845] bridge10: port 3(veth11) entered blocking state [ 3097.298462][T12845] bridge10: port 3(veth11) entered disabled state [ 3097.316450][T12845] veth11: entered allmulticast mode [ 3097.336061][T12845] veth11: entered promiscuous mode [ 3098.016804][T12854] tls_set_device_offload_rx: netdev not found [ 3098.190629][T12863] netlink: 'syz.1.8445': attribute type 29 has an invalid length. [ 3098.200315][T12863] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8445'. [ 3098.649049][T12867] xt_CT: No such helper "snmp" [ 3099.396987][T12874] syz.5.8447 (12874): drop_caches: 2 [ 3100.098640][T12881] netlink: 'syz.1.8448': attribute type 5 has an invalid length. [ 3100.283816][ T9991] net_ratelimit: 108 callbacks suppressed [ 3100.283832][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3100.304583][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3100.413717][ T30] audit: type=1800 audit(1770025713.313:3804): pid=12884 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8449" name="file1" dev="tmpfs" ino=8292 res=0 errno=0 [ 3100.434198][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3100.442601][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3100.565721][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3100.580736][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3100.697344][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3100.708674][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3100.834438][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3100.852688][ T3555] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3101.004374][ T49] usb 3-1: USB disconnect, device number 89 [ 3101.183205][T14058] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 3101.293109][ C0] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 3101.347591][T14058] usb 6-1: config index 0 descriptor too short (expected 65535, got 146) [ 3101.379481][T14058] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3101.403632][T14058] usb 6-1: config 0 has no interfaces? [ 3101.434130][T14058] usb 6-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 3101.465136][T14058] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 3101.476858][T14058] usb 6-1: SerialNumber: syz [ 3101.534671][T14058] usb 6-1: config 0 descriptor?? [ 3101.566202][T12901] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8453'. [ 3103.064368][ T7777] usb 3-1: new full-speed USB device number 90 using dummy_hcd [ 3103.234700][ T7777] usb 3-1: not running at top speed; connect to a high speed hub [ 3103.259113][ T7777] usb 3-1: config 1 interface 0 altsetting 8 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 3103.274387][ T7777] usb 3-1: config 1 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 3103.288522][ T7777] usb 3-1: config 1 interface 0 has no altsetting 0 [ 3103.337698][ T7777] usb 3-1: New USB device found, idVendor=05ac, idProduct=0223, bcdDevice= 0.40 [ 3103.348023][ T7777] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3103.356704][ T7777] usb 3-1: Product: syz [ 3103.361553][ T7777] usb 3-1: Manufacturer: syz [ 3103.367768][ T7777] usb 3-1: SerialNumber: syz [ 3103.386203][T12912] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 3103.695051][ T7777] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/input/input161 [ 3103.719606][ T5180] bcm5974 3-1:1.0: could not read from device [ 3103.962323][T12923] netlink: 'syz.3.8459': attribute type 29 has an invalid length. [ 3103.973604][T12923] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8459'. [ 3104.140969][ T4677] usb 6-1: USB disconnect, device number 79 [ 3104.311282][ T30] audit: type=1800 audit(1770025717.213:3805): pid=12926 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8460" name="file1" dev="tmpfs" ino=8308 res=0 errno=0 [ 3104.865555][ T5180] bcm5974 3-1:1.0: could not read from device [ 3104.878434][ T5180] bcm5974 3-1:1.0: could not read from device [ 3104.896057][ T5180] bcm5974 3-1:1.0: could not read from device [ 3104.904021][ T7777] usb 3-1: USB disconnect, device number 90 [ 3105.073894][T14058] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 3105.217579][T12938] xt_CT: No such helper "snmp" [ 3105.243419][T14058] usb 6-1: Using ep0 maxpacket: 16 [ 3105.255945][T14058] usb 6-1: New USB device found, idVendor=1004, idProduct=61aa, bcdDevice=4f.75 [ 3105.275431][T14058] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3105.313651][ T3555] net_ratelimit: 79 callbacks suppressed [ 3105.313673][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3105.328933][T14058] usb 6-1: Product: syz [ 3105.349051][T14058] usb 6-1: Manufacturer: syz [ 3105.365702][T14058] usb 6-1: SerialNumber: syz [ 3105.385461][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3105.398664][T14058] usb 6-1: config 0 descriptor?? [ 3105.423538][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3105.446384][T14058] usb 6-1: bad CDC descriptors [ 3105.453974][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3105.486790][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3105.517149][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3105.550207][ T3555] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3105.664940][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3105.674312][ T36] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3105.675230][T14058] usb 6-1: USB disconnect, device number 80 [ 3105.784082][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3105.945508][T12947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3105.994358][T12947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3106.314376][T12954] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8466'. [ 3106.353759][ T7777] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 3106.524057][ T7777] usb 3-1: Using ep0 maxpacket: 32 [ 3106.531129][ T7777] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 3106.556183][ T7777] usb 3-1: config 0 has no interface number 0 [ 3106.570201][ T7777] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 3106.600884][ T7777] usb 3-1: config 0 interface 196 has no altsetting 0 [ 3106.620086][ T7777] usb 3-1: New USB device found, idVendor=05ac, idProduct=77c2, bcdDevice=eb.3a [ 3106.633895][ T4677] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 3106.649933][ T7777] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3106.681418][ T7777] usb 3-1: Product: syz [ 3106.695483][ T7777] usb 3-1: Manufacturer: syz [ 3106.706693][ T7777] usb 3-1: SerialNumber: syz [ 3106.736092][ T7777] usb 3-1: config 0 descriptor?? [ 3106.737279][T12932] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 3106.813756][ T4677] usb 2-1: Using ep0 maxpacket: 8 [ 3106.868063][ T4677] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 3106.879709][ T4677] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 3106.900460][ T4677] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 3106.934384][ T4677] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 3106.954231][ T4677] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 3106.970705][ T4677] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 3107.024693][ T4677] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3107.124551][ T7777] ipheth 3-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 3107.148824][ T7777] ipheth 3-1:0.196: probe with driver ipheth failed with error -71 [ 3107.186373][ T7777] usb 3-1: USB disconnect, device number 91 [ 3107.271842][T12969] xt_bpf: check failed: parse error [ 3107.280202][ T4677] usb 2-1: GET_CAPABILITIES returned 0 [ 3107.330055][ T4677] usbtmc 2-1:16.0: can't read capabilities [ 3107.584470][ T7777] usb 2-1: USB disconnect, device number 86 [ 3108.652639][ T30] audit: type=1800 audit(1770025721.553:3806): pid=12979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.8473" name="file1" dev="tmpfs" ino=8595 res=0 errno=0 [ 3109.156310][T12987] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8477'. [ 3109.192008][T12987] ip6gre2: entered promiscuous mode [ 3109.204331][T12987] ip6gre2: entered allmulticast mode [ 3109.230646][ T36] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3109.239969][ T36] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3109.253745][ T7777] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3109.523589][ T5919] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3109.573540][ T7777] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 3109.674220][ T5919] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3109.741785][T12997] netlink: 'syz.4.8478': attribute type 5 has an invalid length. [ 3109.801513][ T7777] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xD4, changing to 0x84 [ 3109.814320][ T7777] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 51544, setting to 1024 [ 3109.873249][ T7777] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1024 [ 3109.900406][ T7777] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 3109.913481][ T7777] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3109.944172][ T7777] usb 3-1: Product: syz [ 3109.948377][ T7777] usb 3-1: Manufacturer: syz [ 3109.954750][ T7777] usb 3-1: SerialNumber: syz [ 3109.965008][T12998] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8488'. [ 3109.974478][T12998] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8488'. [ 3109.979248][ T7777] usb 3-1: config 0 descriptor?? [ 3110.006953][T12985] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 3110.374776][ T9991] net_ratelimit: 89 callbacks suppressed [ 3110.374798][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.390716][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3110.534406][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.554157][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.573971][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.605147][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.614540][T12985] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 3110.663495][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.733372][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.785902][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.873751][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3110.939220][T13005] wireguard6: entered promiscuous mode [ 3111.262448][T12987] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8477'. [ 3111.288830][T12987] fuse: Unknown parameter 'w1 [ 3111.288830][T12987] Éó•‚' [ 3112.068841][T13035] binder: 13028:13035 ioctl 4018620d 0 returned -22 [ 3112.614151][ T7777] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 3113.190612][T13042] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8489'. [ 3113.207700][T13042] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8489'. [ 3113.374048][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3113.908448][ T5883] usb 3-1: USB disconnect, device number 92 [ 3114.003608][ T5919] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 3114.194132][ T5919] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF4, changing to 0x84 [ 3114.206065][ T5919] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1023 [ 3114.216761][ T5919] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 3114.244391][T13051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3114.254541][ T5919] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 3114.277053][ T5919] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 3114.314520][ T7777] usb 2-1: config 0 has no interfaces? [ 3114.321318][T13051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3114.349520][ T5919] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 3114.364528][ T5919] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3114.372720][ T7777] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 3114.384273][ T7777] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3114.393775][ T5919] usb 6-1: Product: syz [ 3114.397961][ T5919] usb 6-1: Manufacturer: syz [ 3114.402572][ T5919] usb 6-1: SerialNumber: syz [ 3114.411367][ T7777] usb 2-1: Product: syz [ 3114.419191][ T7777] usb 2-1: Manufacturer: syz [ 3114.426594][ T5919] usb 6-1: config 0 descriptor?? [ 3114.434532][ T7777] usb 2-1: SerialNumber: syz [ 3114.440175][T13045] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 3114.468666][ T5919] usb 6-1: ucan: probing device on interface #0 [ 3114.479290][ T7777] usb 2-1: config 0 descriptor?? [ 3114.486472][ T5919] usb 6-1: ucan: invalid endpoint configuration [ 3114.501719][ T5919] usb 6-1: ucan: probe failed; try to update the device firmware [ 3114.527868][ T30] audit: type=1326 audit(1770025727.433:3807): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13044 comm="syz.3.8490" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x0 [ 3114.706896][ T7777] usb 2-1: can't set config #0, error -71 [ 3114.729558][ T7777] usb 2-1: USB disconnect, device number 87 [ 3114.778258][ T5883] usb 6-1: USB disconnect, device number 81 [ 3115.423607][ T36] net_ratelimit: 93 callbacks suppressed [ 3115.423629][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3115.441757][ T36] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3115.563997][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3115.572142][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3115.683758][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3115.691655][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3115.813618][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3115.822124][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3115.940793][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3115.950853][ T3555] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3116.162709][T13071] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8497'. [ 3116.507010][T13078] wireguard9: entered promiscuous mode [ 3116.588083][T13080] xt_CT: No such helper "snmp" [ 3116.615828][T13081] bridge8: port 1(veth7) entered blocking state [ 3116.642759][T13081] bridge8: port 1(veth7) entered disabled state [ 3116.653032][ C0] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 3116.668775][T13081] veth7: entered allmulticast mode [ 3116.682292][T13081] veth7: entered promiscuous mode [ 3116.727678][T13089] veth0_to_bond: left allmulticast mode [ 3116.739271][T13089] veth0_to_bond: left promiscuous mode [ 3116.745428][T13089] bridge7: port 2(veth0_to_bond) entered disabled state [ 3116.807532][T13089] bridge8: port 2(veth0_to_bond) entered blocking state [ 3116.815749][T13089] bridge8: port 2(veth0_to_bond) entered disabled state [ 3116.865966][T13089] veth0_to_bond: entered allmulticast mode [ 3116.995092][T13089] veth0_to_bond: entered promiscuous mode [ 3117.235483][T13090] bridge8: port 3(veth9) entered blocking state [ 3117.345239][T13090] bridge8: port 3(veth9) entered disabled state [ 3117.353808][T13090] veth9: entered allmulticast mode [ 3117.445052][T13090] veth9: entered promiscuous mode [ 3118.177260][T13102] binder: 13101:13102 ioctl 4018620d 0 returned -22 [ 3118.563950][ T5883] usb 3-1: new full-speed USB device number 93 using dummy_hcd [ 3118.730283][ T5883] usb 3-1: config 0 has an invalid interface number: 6 but max is 0 [ 3118.739348][ T5883] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3118.754385][ T5883] usb 3-1: config 0 has no interface number 0 [ 3118.760651][ T5883] usb 3-1: config 0 interface 6 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 3118.775189][ T5883] usb 3-1: config 0 interface 6 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 3118.791739][ T5883] usb 3-1: New USB device found, idVendor=10cf, idProduct=8061, bcdDevice=b7.12 [ 3118.803933][ T5883] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3118.811962][ T5883] usb 3-1: Product: syz [ 3118.828121][ T5883] usb 3-1: Manufacturer: syz [ 3118.832835][ T5883] usb 3-1: SerialNumber: syz [ 3118.844106][ T5883] usb 3-1: config 0 descriptor?? [ 3118.849964][T13104] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 3118.872588][ T5883] vmk80xx 3-1:0.6: driver 'vmk80xx' failed to auto-configure device. [ 3118.890145][ T5883] vmk80xx 3-1:0.6: probe with driver vmk80xx failed with error -22 [ 3119.079701][ T5883] usb 3-1: USB disconnect, device number 93 [ 3119.223711][ T4677] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 3119.386276][ T4677] usb 6-1: unable to get BOS descriptor or descriptor too short [ 3119.396273][ T4677] usb 6-1: config 81 has an invalid interface number: 13 but max is 0 [ 3119.405414][ T4677] usb 6-1: config 81 has an invalid descriptor of length 0, skipping remainder of the config [ 3119.425886][ T4677] usb 6-1: config 81 has no interface number 0 [ 3119.432218][ T4677] usb 6-1: config 81 interface 13 has no altsetting 0 [ 3119.494183][ T4677] usb 6-1: New USB device found, idVendor=12d1, idProduct=0ec1, bcdDevice=29.23 [ 3119.507531][ T4677] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3119.516422][ T4677] usb 6-1: Product: syz [ 3119.520624][ T4677] usb 6-1: Manufacturer: syz [ 3119.525954][ T4677] usb 6-1: SerialNumber: syz [ 3119.764778][ T4677] qmi_wwan 6-1:81.13: bogus CDC Union: master=0, slave=1 [ 3119.774317][ T4677] qmi_wwan 6-1:81.13: probe with driver qmi_wwan failed with error -22 [ 3119.789264][ T4677] usb 6-1: USB disconnect, device number 82 [ 3119.804022][ T7777] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 3119.917621][T13128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3119.926985][T13128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3119.975068][ T7777] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 3119.985976][ T7777] usb 2-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 3119.996121][ T7777] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 3120.012455][ T7777] usb 2-1: config 220 interface 0 has no altsetting 0 [ 3120.020305][ T7777] usb 2-1: config 220 interface 1 has no altsetting 0 [ 3120.029986][ T7777] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 3120.039694][ T7777] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3120.048122][ T7777] usb 2-1: Product: syz [ 3120.052284][ T7777] usb 2-1: Manufacturer: syz [ 3120.057466][ T7777] usb 2-1: SerialNumber: syz [ 3120.123914][ T4677] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 3120.275070][ T4677] usb 3-1: Using ep0 maxpacket: 16 [ 3120.276310][ T7777] usb 2-1: selecting invalid altsetting 0 [ 3120.302800][ T7777] usb 2-1: selecting invalid altsetting 0 [ 3120.304552][ T4677] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3120.310276][ T7777] uvcvideo 2-1:220.0: probe with driver uvcvideo failed with error -22 [ 3120.335627][ T7777] usb 2-1: selecting invalid altsetting 0 [ 3120.342830][ T7777] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 3120.344849][ T4677] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x33, changing to 0x3 [ 3120.391437][ T7777] usb 2-1: USB disconnect, device number 88 [ 3120.394439][ T4677] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 3120.432754][ T4677] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 95 [ 3120.443794][ T4677] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 3120.468652][ T4677] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 3120.485957][ T4677] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 3120.497552][ T4677] usb 3-1: Manufacturer: syz [ 3120.514350][ T1340] net_ratelimit: 124 callbacks suppressed [ 3120.514372][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3120.551162][ T4677] usb 3-1: config 0 descriptor?? [ 3120.557193][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3120.669488][T13137] binder: 13135:13137 ioctl 4018620d 0 returned -22 [ 3120.684394][T29305] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3120.695451][T29305] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3120.813576][T29305] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3120.821553][T29305] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3120.851659][T14058] usb 3-1: USB disconnect, device number 94 [ 3120.944067][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3120.974264][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3121.002995][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3121.036588][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3121.397874][T13144] xt_CT: No such helper "snmp" [ 3121.903741][T13156] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8521'. [ 3121.945077][T13156] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8521'. [ 3122.413569][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3122.836886][T13161] wireguard7: entered promiscuous mode [ 3123.669897][T13186] binder: 13182:13186 ioctl 4018620d 0 returned -22 [ 3124.013626][ T7777] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 3124.176464][ T7777] usb 6-1: Using ep0 maxpacket: 8 [ 3124.202530][ T7777] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 3124.224562][ T7777] usb 6-1: config 179 has no interface number 0 [ 3124.236897][ T7777] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 3124.249741][ T7777] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 3124.268030][ T7777] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 3124.280439][ T7777] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 3124.300285][ T7777] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 3124.335524][ T7777] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 3124.365253][ T7777] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3124.402091][T13187] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 3125.554148][ T1340] net_ratelimit: 167 callbacks suppressed [ 3125.554171][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3125.570250][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3125.638391][T13208] wireguard7: entered promiscuous mode [ 3125.684044][T29305] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3125.694313][T29305] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3125.733963][ T4677] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 3125.759529][T13214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3125.785865][T13214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3125.805678][T29305] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3125.816208][T29305] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3125.894229][ T4677] usb 2-1: Using ep0 maxpacket: 8 [ 3125.902659][ T4677] usb 2-1: config 0 has an invalid interface number: 239 but max is 0 [ 3125.912247][ T4677] usb 2-1: config 0 has no interface number 0 [ 3125.920053][ T4677] usb 2-1: config 0 interface 239 altsetting 0 has an endpoint descriptor with address 0x64, changing to 0x4 [ 3125.933967][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3125.941977][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3125.942015][ T4677] usb 2-1: config 0 interface 239 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 8 [ 3125.967840][ T4677] usb 2-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=99.1a [ 3125.978860][ T4677] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3125.988266][ T4677] usb 2-1: Product: syz [ 3125.994090][ T4677] usb 2-1: Manufacturer: syz [ 3125.998910][ T4677] usb 2-1: SerialNumber: syz [ 3126.008799][ T4677] usb 2-1: config 0 descriptor?? [ 3126.021301][T13206] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 3126.083289][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3126.092809][ T9991] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3126.281577][ T4677] ath6kl: Failed to submit usb control message: -71 [ 3126.309020][ T4677] ath6kl: unable to send the bmi data to the device: -71 [ 3126.319754][ T4677] ath6kl: Unable to send get target info: -71 [ 3126.348209][ T4677] ath6kl: Failed to init ath6kl core: -71 [ 3126.348304][T14058] usb 6-1: USB disconnect, device number 83 [ 3126.348368][ C1] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 3126.368550][ C1] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 3126.386557][ T4677] ath6kl_usb 2-1:0.239: probe with driver ath6kl_usb failed with error -71 [ 3126.426233][ T4677] usb 2-1: USB disconnect, device number 89 [ 3126.618349][T13221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3126.641601][T13221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3126.934015][ T4677] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 3126.978374][T13232] binder: 13229:13232 ioctl 4018620d 0 returned -22 [ 3127.087201][ T4677] usb 3-1: Using ep0 maxpacket: 16 [ 3127.102711][ T4677] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 32 [ 3127.135451][ T4677] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 3127.154093][ T4677] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3127.173695][ T4677] usb 3-1: Product: syz [ 3127.186449][ T4677] usb 3-1: Manufacturer: syz [ 3127.197771][ T4677] usb 3-1: SerialNumber: syz [ 3127.215898][ T4677] usb 3-1: config 0 descriptor?? [ 3127.234513][T13227] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 3127.320533][ T4677] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 3127.669314][ T9991] usb 3-1: Failed to submit usb control message: -71 [ 3127.669630][T14058] usb 3-1: USB disconnect, device number 95 [ 3127.694616][ T9991] usb 3-1: unable to send the bmi data to the device: -71 [ 3127.736039][ T9991] usb 3-1: unable to get target info from device [ 3127.742414][ T9991] usb 3-1: could not get target info (-71) [ 3127.764011][ T9991] usb 3-1: could not probe fw (-71) [ 3128.056707][T13243] xt_CT: No such helper "snmp" [ 3128.088492][T13250] binder: 13249:13250 ioctl 4018620d 0 returned -22 [ 3129.013571][T14058] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 3129.203451][T14058] usb 3-1: Using ep0 maxpacket: 8 [ 3129.210734][T14058] usb 3-1: unable to get BOS descriptor or descriptor too short [ 3129.225095][T14058] usb 3-1: config 7 has an invalid interface number: 142 but max is 0 [ 3129.234338][T14058] usb 3-1: config 7 has no interface number 0 [ 3129.256641][T14058] usb 3-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice=dd.6d [ 3129.266305][T14058] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3129.276156][T14058] usb 3-1: Product: syz [ 3129.280347][T14058] usb 3-1: Manufacturer: syz [ 3129.293467][T14058] usb 3-1: SerialNumber: syz [ 3129.522781][T14058] usb 3-1: USB disconnect, device number 96 [ 3130.004104][T14058] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 3130.195955][T14058] usb 6-1: Using ep0 maxpacket: 32 [ 3130.207146][T14058] usb 6-1: unable to get BOS descriptor or descriptor too short [ 3130.239588][T14058] usb 6-1: config 64 has an invalid interface number: 2 but max is 1 [ 3130.266922][T14058] usb 6-1: config 64 has an invalid interface number: 2 but max is 1 [ 3130.298304][T14058] usb 6-1: config 64 has 1 interface, different from the descriptor's value: 2 [ 3130.319746][T14058] usb 6-1: config 64 has no interface number 0 [ 3130.364836][T14058] usb 6-1: config 64 interface 2 altsetting 14 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 3130.385912][T14058] usb 6-1: config 64 interface 2 altsetting 14 endpoint 0x3 has invalid maxpacket 1023, setting to 64 [ 3130.406394][T14058] usb 6-1: config 64 interface 2 has no altsetting 0 [ 3130.428327][T14058] usb 6-1: config 64 interface 2 has no altsetting 1 [ 3130.446038][T14058] usb 6-1: New USB device found, idVendor=0582, idProduct=0120, bcdDevice=cf.3d [ 3130.456510][T14058] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3130.466104][T14058] usb 6-1: Product: syz [ 3130.470604][T14058] usb 6-1: Manufacturer: syz [ 3130.477960][T14058] usb 6-1: SerialNumber: syz [ 3130.653915][ T9980] net_ratelimit: 97 callbacks suppressed [ 3130.653954][ T9980] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3130.688236][ T9980] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3130.806591][T14058] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 3130.825602][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3130.835260][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3130.865145][T14058] snd-usb-audio 6-1:64.2: probe with driver snd-usb-audio failed with error -2 [ 3130.901520][T14058] usb 6-1: USB disconnect, device number 84 [ 3130.947969][ T5281] udevd[5281]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:64.2/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 3130.974944][ T8365] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3130.982830][ T8365] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3131.113653][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3131.121649][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3131.243526][ T5919] usb 2-1: new full-speed USB device number 90 using dummy_hcd [ 3131.244293][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3131.264127][ T1340] bond3: (slave ip6gretap1): failed to get link speed/duplex [ 3131.371989][T13308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3131.387568][T13308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3131.467749][ T5919] usb 2-1: config 0 has an invalid interface number: 138 but max is 0 [ 3131.476489][ T5919] usb 2-1: config 0 has no interface number 0 [ 3131.490833][ T5919] usb 2-1: config 0 interface 138 altsetting 0 has an endpoint descriptor with address 0xE4, changing to 0x84 [ 3131.522128][ T5919] usb 2-1: config 0 interface 138 altsetting 0 endpoint 0x84 has an invalid bInterval 87, changing to 4 [ 3131.551077][ T5919] usb 2-1: config 0 interface 138 altsetting 0 endpoint 0xB has an invalid bInterval 0, changing to 4 [ 3131.579238][ T5919] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=c8.66 [ 3131.592551][ T5919] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3131.612215][ T5919] usb 2-1: config 0 descriptor?? [ 3131.661181][T13311] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 3131.865424][ T5919] usb 2-1: string descriptor 0 read error: -71 [ 3131.878360][ T5919] usbtest 2-1:0.138: Linux gadget zero [ 3131.893630][ T5919] usbtest 2-1:0.138: full-speed {control in/out iso-in iso-out} tests (+alt) [ 3131.926024][ T5919] usb 2-1: USB disconnect, device number 90 [ 3132.325815][T13327] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3132.353841][T13327] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3132.442258][T13330] wireguard10: entered promiscuous mode [ 3133.168213][T13345] mmap: syz.4.8582 (13345): VmData 37388288 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 3133.279107][T13351] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8585'. [ 3133.582416][T13363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3133.599406][T13363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3134.060119][T13375] wireguard8: entered promiscuous mode [ 3134.224011][T14064] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 3134.386049][T14064] usb 2-1: Using ep0 maxpacket: 8 [ 3134.405771][T14064] usb 2-1: unable to get BOS descriptor or descriptor too short [ 3134.418956][T14064] usb 2-1: config 0 has an invalid interface number: 240 but max is 0 [ 3134.461420][T14064] usb 2-1: config 0 has no interface number 0 [ 3134.482101][T13387] xt_bpf: check failed: parse error [ 3134.488075][T14064] usb 2-1: config 0 interface 240 has no altsetting 0 [ 3134.560202][T14064] usb 2-1: New USB device found, idVendor=8086, idProduct=0b5b, bcdDevice=e2.ef [ 3134.586507][T14064] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3134.611711][T14064] usb 2-1: Product: syz [ 3134.710570][T14064] usb 2-1: Manufacturer: syz [ 3134.809608][T14064] usb 2-1: SerialNumber: syz [ 3135.026407][T14064] usb 2-1: config 0 descriptor?? [ 3135.112283][T13401] binder: 13394:13401 ioctl 4018620d 0 returned -22 [ 3135.308518][T14064] uvcvideo 2-1:0.240: Found multiple Units with ID 1 [ 3135.325660][T14064] uvcvideo 2-1:0.240: Found UVC 0.00 device syz (8086:0b5b) [ 3135.342275][T14064] uvcvideo 2-1:0.240: No valid video chain found. [ 3135.367200][T14064] usb 2-1: USB disconnect, device number 91 [ 3135.540743][T13402] xt_bpf: check failed: parse error [ 3135.716835][ T1340] net_ratelimit: 86 callbacks suppressed [ 3135.716851][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3135.736180][T13414] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8601'. [ 3135.749622][T13414] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8601'. [ 3135.785092][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3135.824650][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3135.857149][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3135.953539][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3135.992650][ T8365] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3136.054836][ T8365] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3136.100027][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3136.184060][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3136.246282][ T36] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3136.623932][ T30] audit: type=1326 audit(1770025749.503:3808): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13423 comm="syz.3.8606" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x0 [ 3137.544994][T13458] xt_bpf: check failed: parse error [ 3137.597609][T13440] wireguard9: entered promiscuous mode [ 3138.235537][T13469] netlink: 'syz.3.8623': attribute type 1 has an invalid length. [ 3138.554724][T13484] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8629'. [ 3138.899266][T13494] fuse: Bad value for 'group_id' [ 3138.915963][T13494] fuse: Bad value for 'group_id' [ 3138.934097][ T30] audit: type=1800 audit(1770025751.843:3809): pid=13494 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.8633" name="file1" dev="tmpfs" ino=9432 res=0 errno=0 [ 3139.002342][T13500] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8637'. [ 3139.063056][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3139.301449][T13513] binder: 13507:13513 ioctl 4018620d 0 returned -22 [ 3140.617473][ T30] audit: type=1326 audit(1770025753.523:3810): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13540 comm="syz.1.8651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3140.684258][ T30] audit: type=1326 audit(1770025753.543:3811): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13540 comm="syz.1.8651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3140.731102][ T30] audit: type=1326 audit(1770025753.563:3812): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13540 comm="syz.1.8651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=241 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3140.763617][ T30] audit: type=1326 audit(1770025753.593:3813): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13540 comm="syz.1.8651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3140.767881][ T1340] net_ratelimit: 131 callbacks suppressed [ 3140.767900][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3140.815230][ T30] audit: type=1326 audit(1770025753.593:3814): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13540 comm="syz.1.8651" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fc4539 code=0x7ffc0000 [ 3140.843514][ T9980] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3140.863502][ T9980] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3140.883942][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3140.906567][ T1340] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3140.933746][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3140.963457][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3140.983655][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3141.003996][ T9991] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3141.033661][ T3555] bond3: (slave ip6gretap1): link status up, enabling it in 0 ms [ 3141.518612][T13555] wireguard10: entered promiscuous mode [ 3141.658652][T13566] xt_bpf: check failed: parse error [ 3142.113467][ T5919] usb 2-1: new full-speed USB device number 92 using dummy_hcd [ 3142.280517][ T5919] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3142.326458][ T5919] usb 2-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 3142.336848][ T5919] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3142.360901][ T5919] usb 2-1: Product: syz [ 3142.375053][ T5919] usb 2-1: Manufacturer: syz [ 3142.400692][ T5919] usb 2-1: SerialNumber: syz [ 3142.415980][ T5919] usb 2-1: config 0 descriptor?? [ 3142.445092][ T5919] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3142.476494][T13581] binder: 13576:13581 ioctl 4018620d 0 returned -22 [ 3143.177974][T13584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3143.258513][T13584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3143.494099][ T5919] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 3143.501354][ T5919] gspca_pac7302 2-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 3143.536619][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 3143.544080][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 3143.904430][T13603] fuse: Bad value for 'user_id' [ 3143.915146][T13603] fuse: Bad value for 'user_id' [ 3143.926462][ T30] audit: type=1800 audit(1770025756.833:3815): pid=13603 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.8671" name="file1" dev="tmpfs" ino=9463 res=0 errno=0 [ 3144.440855][T13606] tipc: Resetting bearer [ 3145.349597][T13606] tipc: Resetting bearer [ 3145.656429][T14064] usb 2-1: USB disconnect, device number 92 [ 3145.665848][ T1340] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3145.694005][ T1340] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3145.707104][ T1340] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 3146.325706][T13630] binder: 13627:13630 ioctl 4018620d 0 returned -22 [ 3146.886558][T13650] netlink: 'syz.5.8689': attribute type 21 has an invalid length. [ 3147.234800][T13660] wireguard8: entered promiscuous mode [ 3147.786344][T13679] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8699'. [ 3148.290055][T13693] wireguard10: entered promiscuous mode [ 3148.350360][T13702] xt_bpf: check failed: parse error [ 3148.377495][T13705] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8708'. [ 3148.430442][T13706] binder: 13697:13706 ioctl 4018620d 0 returned -22 [ 3149.749847][T13738] net_ratelimit: 125 callbacks suppressed [ 3149.749862][T13738] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 3149.872247][T13740] fuse: Bad value for 'user_id' [ 3149.884379][T13740] fuse: Bad value for 'user_id' [ 3149.902475][ T30] audit: type=1800 audit(1770025762.803:3816): pid=13740 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8719" name="file1" dev="tmpfs" ino=8582 res=0 errno=0 [ 3150.099917][T13749] binder: 13744:13749 ioctl 4018620d 0 returned -22 [ 3150.639443][T13761] xt_bpf: check failed: parse error [ 3151.248098][T13781] binder: 13775:13781 ioctl 4018620d 0 returned -22 [ 3151.594998][T13786] xt_bpf: check failed: parse error [ 3152.331890][T13804] fuse: Unknown parameter 'grou0x0000000000000000' [ 3152.374721][ T30] audit: type=1800 audit(1770025765.283:3817): pid=13804 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8741" name="file1" dev="tmpfs" ino=8618 res=0 errno=0 [ 3152.766403][T13824] netlink: 'syz.3.8750': attribute type 4 has an invalid length. [ 3152.911745][T13831] usb 4-1: USB disconnect, device number 87 [ 3152.921524][T13832] binder: 13830:13832 ioctl c018620c 800000c0 returned -22 [ 3153.087533][T13836] fuse: Unknown parameter 'grou0x0000000000000000' [ 3153.171789][ T30] audit: type=1800 audit(1770025766.073:3818): pid=13843 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.8756" name="file1" dev="tmpfs" ino=8895 res=0 errno=0 [ 3153.294121][T13845] bond10: entered allmulticast mode [ 3153.304852][T13845] 8021q: adding VLAN 0 to HW filter on device bond10 [ 3153.418605][T13834] wireguard10: entered promiscuous mode [ 3154.749463][T13866] netlink: 'syz.3.8764': attribute type 3 has an invalid length. [ 3154.881739][T13870] netlink: 2 bytes leftover after parsing attributes in process `syz.3.8766'. [ 3154.893875][T13870] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8766'. [ 3154.903728][T13870] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8766'. [ 3154.912653][T13870] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8766'. [ 3155.219424][T13883] binder: 13873:13883 ioctl 4018620d 0 returned -22 [ 3156.677034][T13918] openvswitch: netlink: IP tunnel TTL not specified. [ 3156.735845][T13922] netlink: 'syz.3.8786': attribute type 10 has an invalid length. [ 3156.754275][T13922] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 3156.919077][T13928] openvswitch: netlink: IP tunnel dst address not specified [ 3157.422701][T13950] program syz.5.8800 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 3158.140716][T13987] netlink: 48 bytes leftover after parsing attributes in process `syz.4.8814'. [ 3158.230515][T13989] lo: entered promiscuous mode [ 3158.728900][T14003] wireguard11: entered promiscuous mode [ 3160.927763][T14053] netlink: 'syz.3.8836': attribute type 29 has an invalid length. [ 3161.235525][T14066] bond15: entered promiscuous mode [ 3161.240956][T14066] 8021q: adding VLAN 0 to HW filter on device bond15 [ 3161.325539][T14071] netlink: 32 bytes leftover after parsing attributes in process `syz.2.8841'. [ 3161.400190][T14074] fuse: Unknown parameter 'group_id0x0000000000000000' [ 3161.453584][ T30] audit: type=1800 audit(1770025774.333:3819): pid=14074 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.8842" name="file1" dev="tmpfs" ino=8961 res=0 errno=0 [ 3161.772706][T14075] wireguard12: entered promiscuous mode [ 3162.149239][T14088] usb usb8: usbfs: process 14088 (syz.5.8846) did not claim interface 0 before use [ 3162.311556][T14091] netlink: 'syz.5.8848': attribute type 1 has an invalid length. [ 3162.322437][T14091] netlink: 4 bytes leftover after parsing attributes in process `syz.5.8848'. [ 3162.719314][T14110] fuse: Unknown parameter 'group_id0x0000000000000000' [ 3162.729261][ T30] audit: type=1800 audit(1770025775.633:3820): pid=14110 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.8856" name="file1" dev="tmpfs" ino=8793 res=0 errno=0 [ 3162.952018][T14115] wireguard11: entered promiscuous mode [ 3163.281018][T14136] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8865'. [ 3164.112212][T14147] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8869'. [ 3164.231048][T14151] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 3164.461299][T14160] openvswitch: netlink: IP tunnel TTL not specified. [ 3164.861978][T14184] fuse: Bad value for 'user_id' [ 3164.877892][T14184] fuse: Bad value for 'user_id' [ 3164.896381][ T30] audit: type=1800 audit(1770025777.803:3821): pid=14184 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.8886" name="file1" dev="tmpfs" ino=8791 res=0 errno=0 [ 3164.923698][T14180] binder: 14176:14180 ioctl 4018620d 0 returned -22 [ 3165.021341][T14193] netlink: 144 bytes leftover after parsing attributes in process `syz.5.8888'. [ 3165.838351][T14217] fuse: Bad value for 'user_id' [ 3165.844564][T14217] fuse: Bad value for 'user_id' [ 3165.905349][ T30] audit: type=1800 audit(1770025778.803:3822): pid=14217 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.8899" name="file1" dev="tmpfs" ino=9954 res=0 errno=0 [ 3166.200690][T14230] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8904'. [ 3166.458142][T14241] binder: 14234:14241 ioctl 4018620d 0 returned -22 [ 3166.791707][T14251] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8912'. [ 3167.055882][T14257] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 3167.799226][T14273] binder: 14272:14273 ioctl 4018620d 0 returned -22 [ 3168.131919][T14282] xt_CT: You must specify a L4 protocol and not use inversions on it [ 3168.469816][T14301] binder: 14299:14301 ioctl 4018620d 0 returned -22 [ 3168.539154][T14307] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8937'. [ 3168.901771][ T30] audit: type=1326 audit(1770025781.803:3823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14325 comm="syz.3.8944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3168.926097][ T30] audit: type=1326 audit(1770025781.803:3824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14325 comm="syz.3.8944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3168.953748][ T30] audit: type=1326 audit(1770025781.813:3825): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14325 comm="syz.3.8944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=70 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3168.985954][ T30] audit: type=1326 audit(1770025781.813:3826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14325 comm="syz.3.8944" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3169.418264][T14335] netlink: 'syz.3.8948': attribute type 32 has an invalid length. [ 3169.428137][T14335] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8948'. [ 3169.438697][T14335] netlink: 'syz.3.8948': attribute type 32 has an invalid length. [ 3170.312007][T14363] xt_bpf: check failed: parse error [ 3170.969823][T14378] openvswitch: netlink: IP tunnel dst address not specified [ 3171.196404][T14388] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8968'. [ 3171.294589][T14394] netlink: 'syz.3.8970': attribute type 1 has an invalid length. [ 3171.693028][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3171.919221][T14407] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8975'. [ 3172.212112][T14412] netlink: 6 bytes leftover after parsing attributes in process `syz.5.8976'. [ 3172.229774][T14412] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 3172.891901][T14441] netlink: 'syz.4.8990': attribute type 11 has an invalid length. [ 3173.110716][T14448] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8988'. [ 3173.398908][T14459] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8995'. [ 3173.921937][T14476] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9001'. [ 3174.885106][T14503] binder: 14496:14503 ioctl 4018620d 0 returned -22 [ 3175.216764][ T30] audit: type=1326 audit(1770025788.113:3827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14515 comm="syz.5.9016" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3175.251158][ T30] audit: type=1326 audit(1770025788.113:3828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14515 comm="syz.5.9016" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3175.285886][ T30] audit: type=1326 audit(1770025788.153:3829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14515 comm="syz.5.9016" exe="/root/syz-executor" sig=0 arch=40000003 syscall=162 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3175.329794][ T30] audit: type=1326 audit(1770025788.213:3830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14515 comm="syz.5.9016" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3175.371671][ T30] audit: type=1326 audit(1770025788.213:3831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14515 comm="syz.5.9016" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x7ffc0000 [ 3175.526362][T14520] : entered promiscuous mode [ 3176.337250][T14538] xt_bpf: check failed: parse error [ 3176.425915][T14545] fuse: Bad value for 'fd' [ 3176.451752][ T30] audit: type=1800 audit(1770025789.353:3832): pid=14545 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.9028" name="file1" dev="tmpfs" ino=8919 res=0 errno=0 [ 3176.663807][T14557] binder: 14548:14557 ioctl 4018620d 0 returned -22 [ 3177.011109][T14570] netlink: 'syz.3.9039': attribute type 10 has an invalid length. [ 3177.228698][T14573] netlink: zone id is out of range [ 3177.294776][T14573] netlink: set zone limit has 4 unknown bytes [ 3177.394096][T14572] wireguard13: entered promiscuous mode [ 3177.749748][T14586] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9044'. [ 3179.395609][T14633] binder: 14629:14633 ioctl 4018620d 0 returned -22 [ 3179.786833][T14643] fuse: Bad value for 'rootmode' [ 3179.852486][ T30] audit: type=1800 audit(1770025792.753:3833): pid=14643 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.9061" name="file1" dev="tmpfs" ino=9134 res=0 errno=0 [ 3180.566755][T14658] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9065'. [ 3180.762677][T14667] xt_bpf: check failed: parse error [ 3180.878883][T14656] wireguard9: entered promiscuous mode [ 3181.127768][T14677] binder: 14673:14677 ioctl 4018620d 0 returned -22 [ 3181.545068][T14681] netlink: 'syz.3.9073': attribute type 5 has an invalid length. [ 3181.708092][T14688] binder: 14683:14688 ioctl 4018620d 0 returned -22 [ 3183.691466][T14743] netlink: 312 bytes leftover after parsing attributes in process `syz.4.9096'. [ 3183.702104][T14743] netlink: 312 bytes leftover after parsing attributes in process `syz.4.9096'. [ 3183.939185][T14751] vlan0: entered allmulticast mode [ 3183.946997][T14751] macsec0: entered allmulticast mode [ 3184.092439][T14759] IPv6: NLM_F_CREATE should be specified when creating new route [ 3184.831971][T14798] xt_bpf: check failed: parse error [ 3185.296823][T14811] xt_bpf: check failed: parse error [ 3185.367274][T14813] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9125'. [ 3185.498819][T14817] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 3186.455909][T14836] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9131'. [ 3186.523110][T14836] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9131'. [ 3186.560550][T14847] netlink: 'syz.1.9134': attribute type 16 has an invalid length. [ 3186.609076][T14852] xt_bpf: check failed: parse error [ 3186.918702][T14845] tipc: Bearer : already 2 bearers with priority 10 [ 3186.957561][T14845] tipc: Bearer : trying with adjusted priority [ 3187.018348][T14845] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 3187.558807][T14882] xt_bpf: check failed: parse error [ 3187.671139][T14888] xt_bpf: check failed: parse error [ 3188.771725][T14919] netlink: 19 bytes leftover after parsing attributes in process `syz.3.9163'. [ 3189.203646][ T4677] usb 3-1: new full-speed USB device number 97 using dummy_hcd [ 3189.364350][ T4677] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 3189.379004][ T4677] usb 3-1: config 0 has no interface number 0 [ 3189.400401][ T4677] usb 3-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 3189.424095][ T4677] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3189.450750][ T4677] usb 3-1: config 0 descriptor?? [ 3189.466298][ T4677] usb 3-1: selecting invalid altsetting 1 [ 3189.490293][ T4677] dvb_ttusb_budget: ttusb_init_controller: error [ 3189.512032][ T4677] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 3189.669615][ T4677] DVB: Unable to find symbol cx22700_attach() [ 3189.774096][ T4677] DVB: Unable to find symbol tda10046_attach() [ 3189.793940][ T4677] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 3189.817385][ T4677] usb 3-1: USB disconnect, device number 97 [ 3190.603043][T14959] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3190.647072][T14959] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3190.969281][T14975] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9179'. [ 3191.007540][T14975] ipvlan0: entered promiscuous mode [ 3191.357863][T14989] xt_bpf: check failed: parse error [ 3191.988887][T15007] xt_bpf: check failed: parse error [ 3192.623744][ T4677] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 3192.784020][ T4677] usb 6-1: Using ep0 maxpacket: 16 [ 3192.806156][ T4677] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3192.818161][ T4677] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3192.833973][ T4677] usb 6-1: New USB device found, idVendor=05ac, idProduct=0247, bcdDevice= 0.00 [ 3192.844508][ T4677] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3192.894976][ T4677] usb 6-1: config 0 descriptor?? [ 3193.326408][ T4677] hid_parser_main: 5 callbacks suppressed [ 3193.326425][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.349194][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.357261][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.365063][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.371956][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.379938][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.387354][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.394268][ T7777] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 3193.402336][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.410518][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.419814][ T4677] apple 0003:05AC:0247.004A: unknown main item tag 0x0 [ 3193.430003][ T4677] apple 0003:05AC:0247.004A: unbalanced collection at end of report description [ 3193.441446][ T4677] apple 0003:05AC:0247.004A: parse failed [ 3193.454989][ T4677] apple 0003:05AC:0247.004A: probe with driver apple failed with error -22 [ 3193.558611][ T4677] usb 6-1: USB disconnect, device number 85 [ 3193.565511][ T7777] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3193.565546][ T7777] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3193.565592][ T7777] usb 3-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 3193.565615][ T7777] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3193.568333][ T7777] usb 3-1: config 0 descriptor?? [ 3193.828455][T15031] xt_bpf: check failed: parse error [ 3194.066945][ T7777] arvo 0003:1E7D:30D4.004B: global environment stack underflow [ 3194.103484][ T7777] arvo 0003:1E7D:30D4.004B: item 0 2 1 11 parsing failed [ 3194.120467][ T7777] arvo 0003:1E7D:30D4.004B: parse failed [ 3194.138950][ T7777] arvo 0003:1E7D:30D4.004B: probe with driver arvo failed with error -22 [ 3194.276374][T15040] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9202'. [ 3194.323302][T15040] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9202'. [ 3194.356197][ T4677] usb 3-1: USB disconnect, device number 98 [ 3194.397730][T15039] xt_bpf: check failed: parse error [ 3195.892684][T15077] netlink: 'syz.4.9219': attribute type 1 has an invalid length. [ 3195.902724][T15080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3195.926106][T15080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3196.033744][ T4677] usb 6-1: new full-speed USB device number 86 using dummy_hcd [ 3196.153694][T14064] usb 3-1: new full-speed USB device number 99 using dummy_hcd [ 3196.195208][ T4677] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3196.205739][ T4677] usb 6-1: New USB device found, idVendor=0925, idProduct=8866, bcdDevice= 0.00 [ 3196.215794][ T4677] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3196.226607][ T4677] usb 6-1: config 0 descriptor?? [ 3196.305483][T14064] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3196.318378][T14064] usb 3-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 3196.328790][T14064] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3196.333406][ T7777] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 3196.337912][T14064] usb 3-1: Product: syz [ 3196.349650][T14064] usb 3-1: Manufacturer: syz [ 3196.354982][T14064] usb 3-1: SerialNumber: syz [ 3196.361423][T14064] usb 3-1: config 0 descriptor?? [ 3196.372585][T14064] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3196.503873][ T7777] usb 2-1: Using ep0 maxpacket: 16 [ 3196.511552][ T7777] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3196.523843][ T7777] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3196.534445][ T7777] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3196.547839][ T7777] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 3196.557044][ T7777] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3196.575262][ T7777] usb 2-1: config 0 descriptor?? [ 3196.620204][T15094] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9225'. [ 3196.651693][T15094] wireguard12: entered promiscuous mode [ 3196.656160][ T4677] smartjoyplus 0003:0925:8866.004C: hidraw0: USB HID v0.00 Device [HID 0925:8866] on usb-dummy_hcd.5-1/input0 [ 3196.698883][ T4677] smartjoyplus 0003:0925:8866.004C: no output reports found [ 3196.889215][ T4677] usb 6-1: USB disconnect, device number 86 [ 3197.000299][ T7777] microsoft 0003:045E:07DA.004D: item 0 0 0 9 parsing failed [ 3197.011261][ T7777] microsoft 0003:045E:07DA.004D: parse failed [ 3197.020581][ T7777] microsoft 0003:045E:07DA.004D: probe with driver microsoft failed with error -22 [ 3197.047964][T15096] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3197.064627][T15096] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3197.256787][ T7777] usb 2-1: USB disconnect, device number 93 [ 3197.344072][T14064] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 3197.351069][T14064] gspca_pac7302 3-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 3197.623564][T15110] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9228'. [ 3197.632659][T15110] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9228'. [ 3197.647296][T15110] xt_bpf: check failed: parse error [ 3197.773816][T14064] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 3197.925341][T14064] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3197.937403][T14064] usb 6-1: New USB device found, idVendor=17ef, idProduct=60a3, bcdDevice= 0.00 [ 3197.947616][T14064] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3197.971176][T14064] usb 6-1: config 0 descriptor?? [ 3198.395743][T14064] lenovo 0003:17EF:60A3.004E: hidraw0: USB HID v0.00 Device [HID 17ef:60a3] on usb-dummy_hcd.5-1/input0 [ 3198.640904][T14064] usb 6-1: USB disconnect, device number 87 [ 3198.921704][T14064] usb 3-1: USB disconnect, device number 99 [ 3198.996314][T15122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3199.018406][T15122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3199.298755][T15138] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9237'. [ 3199.345431][T15138] wireguard14: entered promiscuous mode [ 3201.224701][T14064] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 3201.237550][T15199] macvtap1: entered promiscuous mode [ 3201.243604][T15199] batadv0: entered promiscuous mode [ 3201.250068][T15199] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 3201.259424][T15199] batadv0: left promiscuous mode [ 3201.286553][T15200] IPVS: Unknown mcast interface: veth0_macvtap [ 3201.294198][T15201] IPVS: stopping backup sync thread 25982 ... [ 3201.383987][T14064] usb 3-1: Using ep0 maxpacket: 8 [ 3201.395105][T14064] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3201.413486][T14064] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3201.429007][T14064] usb 3-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 3201.446601][T14064] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3201.466924][T14064] usb 3-1: config 0 descriptor?? [ 3201.723872][ T7777] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 3201.883400][ T7777] usb 6-1: Using ep0 maxpacket: 8 [ 3201.890473][ T7777] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3201.902538][ T7777] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 3201.908936][T14064] hid_parser_main: 136 callbacks suppressed [ 3201.908958][T14064] isku 0003:1E7D:319C.004F: unknown main item tag 0x0 [ 3201.932082][T14064] isku 0003:1E7D:319C.004F: unknown main item tag 0x0 [ 3201.946099][ T7777] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 3201.947565][T14064] isku 0003:1E7D:319C.004F: hidraw0: USB HID v0.00 Device [HID 1e7d:319c] on usb-dummy_hcd.2-1/input0 [ 3201.963479][ T7777] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 3201.984738][ T7777] usb 6-1: Product: syz [ 3201.989235][ T7777] usb 6-1: Manufacturer: syz [ 3201.995509][ T7777] usb 6-1: SerialNumber: syz [ 3202.025380][ T7777] usb 6-1: config 0 descriptor?? [ 3202.044771][ T7777] radio-si470x 6-1:0.0: could not find interrupt in endpoint [ 3202.052420][ T7777] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 3202.073887][ T7777] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 3202.104271][ T4677] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 3202.165970][T14064] usb 3-1: USB disconnect, device number 100 [ 3202.266858][T15207] netlink: 'syz.5.9267': attribute type 3 has an invalid length. [ 3202.276867][ T4677] usb 2-1: Using ep0 maxpacket: 32 [ 3202.287104][ T4677] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 3202.295982][ T4677] usb 2-1: config 0 has no interface number 0 [ 3202.306099][ T4677] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 3202.324161][ T4677] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3202.339313][T15207] netlink: 666 bytes leftover after parsing attributes in process `syz.5.9267'. [ 3202.368347][ T4677] usb 2-1: Product: syz [ 3202.372547][ T4677] usb 2-1: Manufacturer: syz [ 3202.377938][ T4677] usb 2-1: SerialNumber: syz [ 3202.385754][ T4677] usb 2-1: config 0 descriptor?? [ 3202.422427][ T4677] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 3202.496269][ T7777] usb 6-1: USB disconnect, device number 88 [ 3202.690318][ T4677] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 3202.734819][ T4677] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 3203.251479][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 3203.251935][ T7777] usb 2-1: USB disconnect, device number 94 [ 3203.295676][ T7777] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 3203.347676][ T7777] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 3203.380832][ T7777] quatech2 2-1:0.51: device disconnected [ 3204.375024][T15265] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9288'. [ 3204.548466][T15272] netlink: 56 bytes leftover after parsing attributes in process `syz.5.9291'. [ 3204.568169][T15272] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9291'. [ 3204.836656][ T30] audit: type=1326 audit(1770025817.743:3834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3204.863932][ T30] audit: type=1326 audit(1770025817.763:3835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3204.885732][ T7777] usb 3-1: new high-speed USB device number 101 using dummy_hcd [ 3204.915510][ T30] audit: type=1326 audit(1770025817.773:3836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="syz.3.9297" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3204.944020][ T30] audit: type=1326 audit(1770025817.773:3837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3204.970130][ T30] audit: type=1326 audit(1770025817.773:3838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3204.999277][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 3205.007642][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 3205.018565][ T30] audit: type=1326 audit(1770025817.773:3839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3205.044094][ T30] audit: type=1326 audit(1770025817.773:3840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="syz.3.9297" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3205.070854][ T30] audit: type=1326 audit(1770025817.773:3841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="syz.3.9297" exe="/root/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3205.094587][ T30] audit: type=1326 audit(1770025817.773:3842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15281 comm="syz.3.9297" exe="/root/syz-executor" sig=0 arch=40000003 syscall=252 compat=1 ip=0xf742d539 code=0x7ffc0000 [ 3205.119335][ T7777] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3205.130622][ T7777] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 3205.153137][ T7777] usb 3-1: New USB device found, idVendor=048d, idProduct=ce50, bcdDevice= 0.00 [ 3205.163582][ T7777] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3205.190940][ T7777] usb 3-1: config 0 descriptor?? [ 3205.341616][T15292] fuse: Unknown parameter 'fd0x0000000000000004' [ 3205.351615][ T30] audit: type=1800 audit(1770025818.253:3843): pid=15292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.9300" name="file1" dev="tmpfs" ino=9131 res=0 errno=0 [ 3205.663996][ T7777] asus 0003:048D:CE50.0050: item fetching failed at offset 2/5 [ 3205.688605][ T7777] asus 0003:048D:CE50.0050: Asus hid parse failed: -22 [ 3205.702358][ T7777] asus 0003:048D:CE50.0050: probe with driver asus failed with error -22 [ 3205.860562][ T4677] usb 3-1: USB disconnect, device number 101 [ 3206.626570][T15337] fuse: Unknown parameter 'fd0x0000000000000004' [ 3206.813774][ T4677] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 3206.860420][T15352] netlink: 'syz.2.9317': attribute type 30 has an invalid length. [ 3206.994457][ T4677] usb 2-1: Using ep0 maxpacket: 32 [ 3207.061455][ T4677] usb 2-1: too many endpoints for config 0 interface 0 altsetting 32: 253, using maximum allowed: 30 [ 3207.076626][ T4677] usb 2-1: config 0 interface 0 altsetting 32 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3207.090671][ T4677] usb 2-1: config 0 interface 0 altsetting 32 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 3207.105850][ T4677] usb 2-1: config 0 interface 0 has no altsetting 0 [ 3207.117220][ T4677] usb 2-1: New USB device found, idVendor=0c12, idProduct=0030, bcdDevice= 0.00 [ 3207.130457][ T4677] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3207.186527][ T4677] usb 2-1: config 0 descriptor?? [ 3207.631859][ T4677] zeroplus 0003:0C12:0030.0051: item fetching failed at offset 5/7 [ 3207.658205][ T4677] zeroplus 0003:0C12:0030.0051: parse failed [ 3207.682198][ T4677] zeroplus 0003:0C12:0030.0051: probe with driver zeroplus failed with error -22 [ 3207.875940][ T4677] usb 2-1: USB disconnect, device number 95 [ 3208.278825][T15377] binder: 15371:15377 ioctl 4018620d 0 returned -22 [ 3208.586764][T15383] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3208.684142][T15383] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3209.101836][T15390] tipc: Resetting bearer [ 3209.117897][T15390] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 3209.202309][T15392] netlink: 2 bytes leftover after parsing attributes in process `syz.4.9332'. [ 3209.470995][T15401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3209.510104][T15401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3209.694106][T15408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3209.749006][T15408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3210.023938][ T7777] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 3210.137303][T15422] xt_bpf: check failed: parse error [ 3210.173979][ T7777] usb 6-1: Using ep0 maxpacket: 32 [ 3210.264904][ T7777] usb 6-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 3210.284437][ T7777] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3210.306729][ T7777] usb 6-1: Product: syz [ 3210.310970][ T7777] usb 6-1: Manufacturer: syz [ 3210.317596][ T7777] usb 6-1: SerialNumber: syz [ 3210.334733][ T7777] usb 6-1: config 0 descriptor?? [ 3210.350398][ T7777] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 3210.366626][ T7777] dvb-usb: bulk message failed: -22 (2/0) [ 3210.385282][ T7777] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 3210.399735][ T7777] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 3210.408475][ T5919] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 3210.425195][ T7777] usb 6-1: media controller created [ 3210.461425][ T7777] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 3210.508616][ T7777] usb 6-1: selecting invalid altsetting 7 [ 3210.519743][ T7777] cxusb: set interface failed [ 3210.529900][ T7777] dvb-usb: bulk message failed: -22 (1/0) [ 3210.565463][ T5919] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 3210.601845][ T5919] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 3210.629380][ T7777] DVB: Unable to find symbol lgdt330x_attach() [ 3210.638796][ T5919] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 3210.652108][ T7777] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 3210.694813][ T5919] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 3210.716494][ T5919] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3210.747018][ T5919] usb 2-1: Product: syz [ 3210.761525][ T5919] usb 2-1: Manufacturer: syz [ 3210.773459][ T5919] usb 2-1: SerialNumber: syz [ 3210.802442][ T5919] usb 2-1: config 0 descriptor?? [ 3210.808855][ T7777] rc_core: IR keymap rc-dvico-portable not found [ 3210.819875][T15424] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 3210.832571][ T7777] Registered IR keymap rc-empty [ 3210.848075][ T7777] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 3210.877821][ T7777] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input163 [ 3210.895009][T15424] raw-gadget.4 gadget.1: fail, usb_ep_enable returned -22 [ 3210.921546][ T7777] dvb-usb: schedule remote query interval to 100 msecs. [ 3210.934598][ T5919] usb 2-1: ucan: probing device on interface #0 [ 3210.946943][ T7777] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 3211.000674][ T7777] usb 6-1: USB disconnect, device number 89 [ 3211.177307][ T7777] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 3211.430694][T15433] netlink: 56 bytes leftover after parsing attributes in process `syz.4.9347'. [ 3211.443281][T15433] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9347'. [ 3211.571451][ T5919] ucan 2-1:0.0: probe with driver ucan failed with error -71 [ 3211.614729][ T5919] usb 2-1: USB disconnect, device number 96 [ 3211.727827][T15443] binder: 15437:15443 ioctl 4018620d 0 returned -22 [ 3211.901415][T15452] netlink: 20 bytes leftover after parsing attributes in process `syz.4.9354'. [ 3211.911033][T15452] netlink: 'syz.4.9354': attribute type 4 has an invalid length. [ 3212.179599][T15460] netlink: 'syz.5.9356': attribute type 2 has an invalid length. [ 3212.767674][T15472] xt_bpf: check failed: parse error [ 3213.003677][ T4677] usb 3-1: new full-speed USB device number 102 using dummy_hcd [ 3213.027856][T15477] wireguard13: entered promiscuous mode [ 3213.207662][ T4677] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3213.222930][ T4677] usb 3-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 3213.283815][ T4677] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3213.294389][ T4677] usb 3-1: Product: syz [ 3213.298732][ T4677] usb 3-1: Manufacturer: syz [ 3213.309066][ T4677] usb 3-1: SerialNumber: syz [ 3213.350474][ T4677] usb 3-1: config 0 descriptor?? [ 3213.365448][ T4677] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3214.117711][T15495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3214.149757][T15495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3214.394186][ T4677] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 3214.401461][ T4677] gspca_pac7302 3-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 3215.009840][T15534] xt_bpf: check failed: parse error [ 3215.156512][T15539] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9384'. [ 3215.193688][T15539] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9384'. [ 3215.790208][ T5919] usb 3-1: USB disconnect, device number 102 [ 3215.985842][T15550] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3216.004901][T15550] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3216.396925][T15561] xt_bpf: check failed: parse error [ 3216.764693][T15565] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9392'. [ 3216.820699][T15565] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9392'. [ 3216.930533][T15566] xt_bpf: check failed: parse error [ 3217.513747][ T4677] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 3217.664154][ T4677] usb 6-1: Using ep0 maxpacket: 16 [ 3217.672387][ T4677] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3217.694701][ T4677] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3217.705096][ T4677] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3217.723627][ T4677] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 3217.734200][ T4677] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3217.759942][ T4677] usb 6-1: config 0 descriptor?? [ 3218.179797][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.189762][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.198750][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.207510][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.216169][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.226783][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.236613][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.244951][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.258122][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.263350][T15593] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9401'. [ 3218.274768][ T4677] microsoft 0003:045E:07DA.0052: unknown main item tag 0x0 [ 3218.285642][T15593] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9401'. [ 3218.296785][ T4677] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0052/input/input164 [ 3218.324480][ T4677] microsoft 0003:045E:07DA.0052: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 3218.509610][ T4677] usb 6-1: USB disconnect, device number 90 [ 3219.105434][T15608] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9406'. [ 3219.121967][T15608] x_tables: ip_tables: udp match: only valid for protocol 17 [ 3219.219243][T15613] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9409'. [ 3219.263531][ T5919] usb 3-1: new high-speed USB device number 103 using dummy_hcd [ 3219.424486][ T5919] usb 3-1: Using ep0 maxpacket: 8 [ 3219.431267][ T5919] usb 3-1: config 2 has an invalid interface number: 31 but max is 0 [ 3219.442142][ T5919] usb 3-1: config 2 has no interface number 0 [ 3219.458612][ T5919] usb 3-1: config 2 interface 31 has no altsetting 0 [ 3219.471471][ T5919] usb 3-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 3219.482253][ T5919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3219.495714][ T5919] usb 3-1: Product: syz [ 3219.504673][ T5919] usb 3-1: Manufacturer: syz [ 3219.510620][ T5919] usb 3-1: SerialNumber: syz [ 3219.582566][T15625] bridge_slave_1: Caught tx_queue_len zero misconfig [ 3219.863082][T15633] program syz.1.9417 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 3220.087989][T15635] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9418'. [ 3220.154291][ T5919] ch9200 3-1:2.31: probe with driver ch9200 failed with error -22 [ 3220.197075][ T5919] usb 3-1: USB disconnect, device number 103 [ 3220.494042][T14064] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 3220.644231][T14064] usb 2-1: Using ep0 maxpacket: 8 [ 3220.654707][T14064] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3220.673865][T14064] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3220.685711][T14064] usb 2-1: config 0 interface 0 has no altsetting 0 [ 3220.697453][T14064] usb 2-1: New USB device found, idVendor=046d, idProduct=c50c, bcdDevice= 0.00 [ 3220.714188][T14064] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3220.734543][T14064] usb 2-1: config 0 descriptor?? [ 3221.153969][ T5919] usb 3-1: new high-speed USB device number 104 using dummy_hcd [ 3221.164643][T14064] logitech 0003:046D:C50C.0053: hidraw0: USB HID v8.15 Device [HID 046d:c50c] on usb-dummy_hcd.1-1/input0 [ 3221.176570][ T4677] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 3221.255345][T15665] macvtap1: entered promiscuous mode [ 3221.267405][T15665] bridge0: entered promiscuous mode [ 3221.276645][T15665] macvtap1: entered allmulticast mode [ 3221.282082][T15665] bridge0: entered allmulticast mode [ 3221.292222][T15665] bridge0: port 1(macvtap1) entered blocking state [ 3221.300075][T15665] bridge0: port 1(macvtap1) entered disabled state [ 3221.311093][T15665] bridge0: left allmulticast mode [ 3221.318802][T15665] bridge0: left promiscuous mode [ 3221.327431][ T5919] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3221.333893][ T4677] usb 6-1: Using ep0 maxpacket: 16 [ 3221.340546][ T5919] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3221.357354][ T5919] usb 3-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 3221.372752][T14058] usb 2-1: USB disconnect, device number 97 [ 3221.376017][ T4677] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 3221.381519][ T5919] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3221.387986][ T4677] usb 6-1: config 0 has no interface number 0 [ 3221.406750][ T4677] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 3221.420049][ T5919] usb 3-1: config 0 descriptor?? [ 3221.422556][ T4677] usb 6-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 3221.444281][ T4677] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 3221.454470][ T4677] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 3221.462574][ T4677] usb 6-1: Product: syz [ 3221.467979][ T4677] usb 6-1: SerialNumber: syz [ 3221.476569][ T4677] usb 6-1: config 0 descriptor?? [ 3221.487919][ T4677] cm109 6-1:0.8: invalid payload size 0, expected 4 [ 3221.498011][ T4677] input: CM109 USB driver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.8/input/input165 [ 3221.847530][ C0] cm109 6-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 3221.847715][T14058] usb 6-1: USB disconnect, device number 91 [ 3221.854927][ C0] cm109 6-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 3221.888751][T14058] cm109 6-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 3221.906195][ T5919] steelseries 0003:1038:1410.0054: missing HID_OUTPUT_REPORT 0 [ 3222.189679][T15681] binder: 15678:15681 ioctl 4018620d 0 returned -22 [ 3222.219602][ T4677] usb 3-1: USB disconnect, device number 104 [ 3222.996413][T15704] xt_socket: unknown flags 0xe4 [ 3223.306194][T15712] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9446'. [ 3223.382003][T15712] wireguard11: entered promiscuous mode [ 3223.993764][ T4677] usb 3-1: new high-speed USB device number 105 using dummy_hcd [ 3224.147697][ T4677] usb 3-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 3224.157744][ T4677] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3224.167161][ T4677] usb 3-1: Product: syz [ 3224.171472][ T4677] usb 3-1: Manufacturer: syz [ 3224.177448][ T4677] usb 3-1: SerialNumber: syz [ 3224.186600][ T4677] usb 3-1: config 0 descriptor?? [ 3224.205983][ T4677] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 3224.773902][T14058] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 3224.809272][ T5919] usb 3-1: USB disconnect, device number 105 [ 3224.925028][T14058] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3224.936780][T14058] usb 2-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 3224.950409][T14058] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3224.960447][T14058] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3224.971393][T14058] usb 2-1: Product: syz [ 3224.976590][T14058] usb 2-1: Manufacturer: syz [ 3224.982722][T14058] usb 2-1: SerialNumber: syz [ 3225.210126][T14058] cdc_ncm 2-1:1.0: bind() failure [ 3225.225312][T14058] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 3225.237153][T14058] cdc_ncm 2-1:1.1: bind() failure [ 3225.271680][T14058] usb 2-1: USB disconnect, device number 98 [ 3225.573858][ T4677] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 3225.633779][ T5919] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 3225.737061][ T4677] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1025, setting to 1024 [ 3225.756411][ T4677] usb 6-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 3225.771248][ T4677] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3225.792245][ T4677] usb 6-1: config 0 descriptor?? [ 3225.804103][ T5919] usb 3-1: Using ep0 maxpacket: 8 [ 3225.809625][T15759] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 3225.831310][ T5919] usb 3-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 3225.849628][ T5919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3225.860330][ T5919] usb 3-1: Product: syz [ 3225.867438][ T5919] usb 3-1: Manufacturer: syz [ 3225.872505][ T5919] usb 3-1: SerialNumber: syz [ 3225.886350][ T5919] usb 3-1: config 0 descriptor?? [ 3225.897358][ T5919] gspca_main: se401-2.14.0 probing 047d:5003 [ 3225.906372][T15771] bridge0: entered promiscuous mode [ 3225.919016][T15771] bridge0: entered allmulticast mode [ 3226.314359][ T5919] gspca_se401: Too many frame sizes [ 3226.331458][ T4677] hid_parser_main: 2 callbacks suppressed [ 3226.331482][ T4677] uclogic 0003:5543:0064.0055: unknown main item tag 0x0 [ 3226.357635][ T4677] uclogic 0003:5543:0064.0055: item fetching failed at offset 3/5 [ 3226.374944][ T4677] uclogic 0003:5543:0064.0055: parse failed [ 3226.396956][ T4677] uclogic 0003:5543:0064.0055: probe with driver uclogic failed with error -22 [ 3226.528557][ T5919] usb 3-1: USB disconnect, device number 106 [ 3226.578818][ T4677] usb 6-1: USB disconnect, device number 92 [ 3226.884227][ T5883] usb 2-1: new high-speed USB device number 99 using dummy_hcd [ 3227.043205][ T5883] usb 2-1: Using ep0 maxpacket: 16 [ 3227.052333][ T5883] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3227.064982][ T5883] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 3227.075683][ T5883] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3227.095079][ T5883] usb 2-1: config 0 descriptor?? [ 3227.337270][T15799] xt_bpf: check failed: parse error [ 3227.392232][T15800] binder: 15796:15800 ioctl 4018620d 0 returned -22 [ 3227.519607][ T5883] mcp2221 0003:04D8:00DD.0056: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.1-1/input0 [ 3227.574777][T15802] erspan0: entered promiscuous mode [ 3227.926878][ T5919] usb 2-1: USB disconnect, device number 99 [ 3228.600386][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 3228.600402][ T30] audit: type=1326 audit(1770025841.503:3845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15824 comm="syz.5.9491" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x0 [ 3228.866658][T15840] binder: 15833:15840 ioctl 4018620d 0 returned -22 [ 3228.974461][T15841] xt_bpf: check failed: parse error [ 3229.056413][ T5919] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 3229.228149][ T5919] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 0 [ 3229.322091][ T5919] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3229.331813][ T5919] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3229.357652][ T5919] usb 2-1: Product: syz [ 3229.373587][ T5919] usb 2-1: Manufacturer: syz [ 3229.407478][ T5919] usb 2-1: SerialNumber: syz [ 3229.671931][T15836] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3229.701584][T15836] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3229.731666][ T5919] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -22 [ 3229.771137][ T5919] usb 2-1: USB disconnect, device number 100 [ 3229.914368][ T4677] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 3230.099623][ T4677] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 3230.113864][ T4677] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3230.121884][ T4677] usb 6-1: Product: syz [ 3230.136087][ T4677] usb 6-1: Manufacturer: syz [ 3230.146300][ T4677] usb 6-1: SerialNumber: syz [ 3230.162930][ T4677] usb 6-1: config 0 descriptor?? [ 3230.213427][ T5919] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 3230.305920][T15858] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3230.327507][T15858] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3230.373568][ T5919] usb 2-1: Using ep0 maxpacket: 8 [ 3230.381355][ T5919] usb 2-1: config index 0 descriptor too short (expected 301, got 72) [ 3230.390407][ T5919] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 3230.401987][ T5919] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 3230.412736][ T5919] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 3230.424330][ T5919] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3230.424861][ T5883] usb 6-1: USB disconnect, device number 93 [ 3230.435386][ T5919] usb 2-1: config 16 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 3 [ 3230.456411][ T5919] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 3230.470059][ T5919] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3230.697482][ T5919] usb 2-1: usb_control_msg returned -71 [ 3230.703736][ T5919] usbtmc 2-1:16.0: can't read capabilities [ 3230.710292][ T5919] usbtmc 2-1:16.0: Failed to submit iin_urb [ 3230.720364][ T5919] usbtmc 2-1:16.0: probe with driver usbtmc failed with error -90 [ 3230.740893][ T5919] usb 2-1: USB disconnect, device number 101 [ 3230.906612][T15860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3230.917561][T15860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3231.224091][ T5883] usb 3-1: new full-speed USB device number 107 using dummy_hcd [ 3231.386179][ T5883] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3231.398861][ T5883] usb 3-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 3231.408249][ T5883] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3231.417093][ T5883] usb 3-1: Product: syz [ 3231.421306][ T5883] usb 3-1: Manufacturer: syz [ 3231.426905][ T5883] usb 3-1: SerialNumber: syz [ 3231.434162][ T5883] usb 3-1: config 0 descriptor?? [ 3231.446382][ T5883] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3231.454209][ T4677] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 3231.554898][ T5919] usb 2-1: new full-speed USB device number 102 using dummy_hcd [ 3231.590207][T15876] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3231.601949][T15876] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3231.611135][ T4677] usb 6-1: Using ep0 maxpacket: 16 [ 3231.619678][ T4677] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3231.631566][ T4677] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3231.642438][ T4677] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3231.657682][ T4677] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 3231.667795][ T4677] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3231.685265][ T4677] usb 6-1: config 0 descriptor?? [ 3231.715412][ T5919] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3231.728102][ T5919] usb 2-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 3231.738080][ T5919] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3231.746753][ T5919] usb 2-1: Product: syz [ 3231.751086][ T5919] usb 2-1: Manufacturer: syz [ 3231.756192][ T5919] usb 2-1: SerialNumber: syz [ 3231.763899][ T5919] usb 2-1: config 0 descriptor?? [ 3231.771909][ T5919] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3232.111926][ T4677] microsoft 0003:045E:07DA.0057: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 3232.126202][T15877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3232.138280][ T4677] microsoft 0003:045E:07DA.0057: no inputs found [ 3232.146328][ T4677] microsoft 0003:045E:07DA.0057: could not initialize ff, continuing anyway [ 3232.194578][T15877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3232.239177][T15881] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9512'. [ 3232.335646][ T7777] usb 6-1: USB disconnect, device number 94 [ 3232.425737][ T5883] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 3232.432766][ T5883] gspca_pac7302 3-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 3232.451403][T15878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3232.465036][T15878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3232.744095][ T5919] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 3232.751226][ T5919] gspca_pac7302 2-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 3232.784999][T15893] dummy0: mtu less than device minimum [ 3234.001696][ T5883] usb 3-1: USB disconnect, device number 107 [ 3234.079551][T15922] pimreg: tun_chr_ioctl cmd 2148553947 [ 3234.137512][T15928] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3234.147391][T15928] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3234.416014][T15932] wireguard10: entered promiscuous mode [ 3234.484717][ T5919] usb 2-1: USB disconnect, device number 102 [ 3235.253592][ T5883] usb 2-1: new full-speed USB device number 103 using dummy_hcd [ 3235.402605][T15963] xt_bpf: check failed: parse error [ 3235.411321][ T5883] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3235.436482][ T5883] usb 2-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 3235.454872][ T5883] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3235.464567][ T5883] usb 2-1: Product: syz [ 3235.468773][ T5883] usb 2-1: Manufacturer: syz [ 3235.482125][ T5883] usb 2-1: SerialNumber: syz [ 3235.495043][ T5883] usb 2-1: config 0 descriptor?? [ 3235.504945][ T5883] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3235.586887][ T30] audit: type=1804 audit(1770025848.493:3846): pid=15967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.9542" name="/newroot/1828/file1" dev="fuse" ino=1 res=1 errno=0 [ 3235.885745][T15975] xt_bpf: check failed: parse error [ 3236.215913][T15972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3236.402245][T15972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3236.495737][ T5883] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 3236.514404][ T5883] gspca_pac7302 2-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 3237.196935][T15990] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9549'. [ 3237.282126][T15991] dvmrp1: tun_chr_ioctl cmd 35108 [ 3237.475213][T16000] netlink: 27 bytes leftover after parsing attributes in process `syz.5.9553'. [ 3237.757494][T16010] wireguard14: entered promiscuous mode [ 3237.989996][ T5883] usb 2-1: USB disconnect, device number 103 [ 3238.771636][T16029] xt_bpf: check failed: parse error [ 3238.890929][T16037] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3238.912719][T16037] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3239.208232][T16042] xt_bpf: check failed: parse error [ 3239.237142][T16047] netlink: 2196 bytes leftover after parsing attributes in process `syz.2.9567'. [ 3240.219935][T16069] binder: 16061:16069 ioctl 4018620d 0 returned -22 [ 3240.813743][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 3240.842008][ T5883] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 3241.004253][ T5883] usb 6-1: Using ep0 maxpacket: 32 [ 3241.014211][ T5883] usb 6-1: config 0 has an invalid interface number: 56 but max is 0 [ 3241.022410][ T30] audit: type=1326 audit(1770025853.923:3847): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff2539 code=0x7ffc0000 [ 3241.045444][ T5883] usb 6-1: config 0 has no interface number 0 [ 3241.053893][ T30] audit: type=1326 audit(1770025853.923:3848): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff2539 code=0x7ffc0000 [ 3241.077797][ T30] audit: type=1326 audit(1770025853.923:3849): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=260 compat=1 ip=0xf7ff2539 code=0x7ffc0000 [ 3241.104385][ T30] audit: type=1326 audit(1770025853.923:3850): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff2558 code=0x7ffc0000 [ 3241.128057][ T30] audit: type=1326 audit(1770025853.923:3851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff2558 code=0x7ffc0000 [ 3241.152133][ T5883] usb 6-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=b8.4d [ 3241.174220][ T5883] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3241.182256][ T5883] usb 6-1: Product: syz [ 3241.190867][ T5883] usb 6-1: Manufacturer: syz [ 3241.201189][ T5883] usb 6-1: SerialNumber: syz [ 3241.207177][ T30] audit: type=1326 audit(1770025853.923:3852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff2558 code=0x7ffc0000 [ 3241.235074][ T5883] usb 6-1: config 0 descriptor?? [ 3241.266601][ T30] audit: type=1326 audit(1770025853.923:3853): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff2558 code=0x7ffc0000 [ 3241.290001][ T5883] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3241.324147][ T30] audit: type=1326 audit(1770025853.923:3854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff2558 code=0x7ffc0000 [ 3241.360823][ T30] audit: type=1326 audit(1770025853.923:3855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff2558 code=0x7ffc0000 [ 3241.408850][ T30] audit: type=1326 audit(1770025853.923:3856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16079 comm="syz.4.9578" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7ff2558 code=0x7ffc0000 [ 3241.925370][T16090] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3241.978734][T16090] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3242.060793][ T5883] gspca_pac7302: reg_w() failed i: 78 v: 40 error -71 [ 3242.075119][ T5883] gspca_pac7302 6-1:0.56: probe with driver gspca_pac7302 failed with error -71 [ 3242.109553][ T5883] usb 6-1: USB disconnect, device number 95 [ 3242.967721][T16094] tap0: tun_chr_ioctl cmd 1074025675 [ 3243.017782][T16094] tap0: persist disabled [ 3243.214257][ T5883] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 3243.374107][ T5883] usb 6-1: Using ep0 maxpacket: 16 [ 3243.397164][ T5883] usb 6-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 3243.414132][ T5883] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3243.441389][ T5883] usb 6-1: Product: syz [ 3243.457527][ T5883] usb 6-1: Manufacturer: syz [ 3243.472425][ T5883] usb 6-1: SerialNumber: syz [ 3243.635240][T16106] vlan4: entered allmulticast mode [ 3243.733521][ T5919] usb 3-1: new full-speed USB device number 108 using dummy_hcd [ 3243.758093][ T5883] usb 6-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 3243.794506][ T5883] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 3243.824290][ T5883] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 3243.843973][ T5883] usb 6-1: media controller created [ 3243.895575][ T5883] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 3243.896077][T16108] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3243.932050][ T5919] usb 3-1: config 0 has an invalid interface number: 128 but max is 0 [ 3243.952178][ T5919] usb 3-1: config 0 has no interface number 0 [ 3243.979210][ T5919] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 3244.000151][ T5919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3244.001083][ T5883] zl10353_read_register: readreg error (reg=127, ret==-71) [ 3244.018454][ T5919] usb 3-1: Product: syz [ 3244.033470][ T5919] usb 3-1: Manufacturer: syz [ 3244.038269][ T5919] usb 3-1: SerialNumber: syz [ 3244.069851][ T5919] usb 3-1: config 0 descriptor?? [ 3244.082361][T16108] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3244.117009][ T5883] dvb_usb_gl861 6-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 3244.141512][ T5883] usb 6-1: USB disconnect, device number 96 [ 3244.373848][ T4677] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 3244.512430][ T5919] usb 3-1: Firmware: major: 0, minor: 107, hardware type: RZUSB (3) [ 3244.523938][ T4677] usb 2-1: Using ep0 maxpacket: 32 [ 3244.533955][ T4677] usb 2-1: New USB device found, idVendor=05a9, idProduct=1550, bcdDevice=e4.bb [ 3244.544359][ T4677] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3244.552364][ T4677] usb 2-1: Product: syz [ 3244.557847][ T4677] usb 2-1: Manufacturer: syz [ 3244.562450][ T4677] usb 2-1: SerialNumber: syz [ 3244.571195][ T4677] usb 2-1: config 0 descriptor?? [ 3244.579717][ T4677] gspca_main: ov534_9-2.14.0 probing 05a9:1550 [ 3244.720987][ T5919] usb 3-1: failed to fetch extended address, random address set [ 3244.772065][ T5919] usb 3-1: USB disconnect, device number 108 [ 3244.964529][ T7777] usb 6-1: new full-speed USB device number 97 using dummy_hcd [ 3245.125017][ T7777] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3245.137848][ T7777] usb 6-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 3245.147828][ T7777] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3245.156139][ T7777] usb 6-1: Product: syz [ 3245.160430][ T7777] usb 6-1: Manufacturer: syz [ 3245.165138][ T7777] usb 6-1: SerialNumber: syz [ 3245.181279][ T7777] usb 6-1: config 0 descriptor?? [ 3245.194332][ T7777] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3245.281801][T16132] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3245.294955][T16132] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3245.398366][ T4677] gspca_ov534_9: reg_w failed -71 [ 3245.693709][ T4677] gspca_ov534_9: Unknown sensor 0000 [ 3245.693816][ T4677] ov534_9 2-1:0.0: probe with driver ov534_9 failed with error -22 [ 3245.710889][ T4677] usb 2-1: USB disconnect, device number 104 [ 3245.870195][T16133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3245.903726][T16133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3246.035215][T16143] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3246.049982][T16143] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3246.116663][T16147] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9602'. [ 3246.175081][ T7777] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 3246.182535][ T7777] gspca_pac7302 6-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 3246.627943][T16150] tap0: tun_chr_ioctl cmd 1074025677 [ 3246.634535][T16150] tap0: linktype set to 804 [ 3246.800588][T16156] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3246.810458][T16156] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3247.123681][ T7777] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 3247.283501][ T7777] usb 3-1: Using ep0 maxpacket: 16 [ 3247.292395][ T7777] usb 3-1: New USB device found, idVendor=0403, idProduct=b8d8, bcdDevice=30.bb [ 3247.302359][ T7777] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3247.314763][ T7777] usb 3-1: Product: syz [ 3247.318955][ T7777] usb 3-1: Manufacturer: syz [ 3247.323951][ T7777] usb 3-1: SerialNumber: syz [ 3247.526359][T16177] binder: 16174:16177 ioctl 4018620d 0 returned -22 [ 3247.739804][ T4677] usb 6-1: USB disconnect, device number 97 [ 3247.747676][ T7777] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 3247.983665][ T7777] snd-usb-audio 3-1:222.0: probe with driver snd-usb-audio failed with error -71 [ 3248.004686][ T7777] usb 3-1: USB disconnect, device number 109 [ 3248.034074][T14934] udevd[14934]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:222.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 3248.227216][T16191] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9621'. [ 3248.903545][ T4677] usb 6-1: new full-speed USB device number 98 using dummy_hcd [ 3248.934734][T16202] xt_bpf: check failed: parse error [ 3248.942213][T16204] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3248.957720][T16204] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3249.073361][ T4677] usb 6-1: config 0 interface 0 has no altsetting 0 [ 3249.101075][ T4677] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 3249.111641][ T4677] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 3249.130953][ T4677] usb 6-1: Product: syz [ 3249.136179][ T4677] usb 6-1: Manufacturer: syz [ 3249.140779][ T4677] usb 6-1: SerialNumber: syz [ 3249.147948][ T4677] usb 6-1: config 0 descriptor?? [ 3249.172303][ T4677] usb 6-1: selecting invalid altsetting 0 [ 3249.418399][T16198] usb 6-1: cannot submit urb 0, error -2: endpoint not enabled [ 3249.439643][ T7777] usb 6-1: USB disconnect, device number 98 [ 3249.624164][ T4677] usb 2-1: new full-speed USB device number 105 using dummy_hcd [ 3249.785850][ T4677] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3249.802567][ T4677] usb 2-1: New USB device found, idVendor=06f8, idProduct=301b, bcdDevice=bb.39 [ 3249.815221][ T4677] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3249.824635][ T4677] usb 2-1: Product: syz [ 3249.825897][T16217] tun0: tun_chr_ioctl cmd 1074025681 [ 3249.828936][ T4677] usb 2-1: Manufacturer: syz [ 3249.840236][ T4677] usb 2-1: SerialNumber: syz [ 3249.849241][ T4677] usb 2-1: config 0 descriptor?? [ 3249.860438][ T4677] gspca_main: gspca_pac7302-2.14.0 probing 06f8:301b [ 3250.207506][T16226] xt_bpf: check failed: parse error [ 3250.536567][T16224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3250.555932][T16224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3250.849410][ T4677] gspca_pac7302: reg_w() failed i: ff v: 01 error -110 [ 3250.857727][ T4677] gspca_pac7302 2-1:0.0: probe with driver gspca_pac7302 failed with error -110 [ 3251.334248][ T4677] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 3251.506023][ T4677] usb 3-1: Using ep0 maxpacket: 32 [ 3251.551567][ T4677] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 3251.575944][ T4677] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3251.616716][ T4677] usb 3-1: config 0 descriptor?? [ 3251.876822][ T4677] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 3251.886534][ T4677] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 3251.901792][ T4677] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 3251.930834][ T4677] usb 3-1: media controller created [ 3251.992368][ T4677] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 3252.088149][ T4677] az6027: usb out operation failed. (-71) [ 3252.098713][ T4677] az6027: usb out operation failed. (-71) [ 3252.105877][ T4677] stb0899_attach: Driver disabled by Kconfig [ 3252.111983][ T4677] az6027: no front-end attached [ 3252.111983][ T4677] [ 3252.279818][ T4677] az6027: usb out operation failed. (-71) [ 3252.309644][ T4677] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 3252.329372][ T4677] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input167 [ 3252.382718][ T4677] dvb-usb: schedule remote query interval to 400 msecs. [ 3252.403487][ T4677] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 3252.412292][ T7777] usb 2-1: USB disconnect, device number 105 [ 3252.447896][ T4677] usb 3-1: USB disconnect, device number 110 [ 3252.522393][ T4677] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 3252.914987][ T7777] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 3253.074273][ T7777] usb 2-1: Using ep0 maxpacket: 8 [ 3253.086900][ T7777] usb 2-1: config index 0 descriptor too short (expected 74, got 45) [ 3253.095754][ T7777] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 3253.113427][ T7777] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 3253.134530][ T7777] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024 [ 3253.146736][ T7777] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 3253.158243][ T7777] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 3253.199295][ T7777] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 3253.226599][ T7777] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3253.458476][T16297] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9658'. [ 3253.507456][T16299] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3253.520549][T16299] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3253.538771][ T7777] usb 2-1: GET_CAPABILITIES returned 0 [ 3253.559164][ T7777] usbtmc 2-1:16.0: can't read capabilities [ 3253.800175][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 3253.809452][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 3253.818706][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 3253.827965][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 3253.837223][ C0] usbtmc 2-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 3253.894947][T16274] usbtmc 2-1:16.0: Unable to send data, error -71 [ 3253.952468][ T4677] usb 2-1: USB disconnect, device number 106 [ 3254.206656][T16308] netlink: 96 bytes leftover after parsing attributes in process `syz.4.9664'. [ 3254.436658][T16316] binder: 16311:16316 ioctl 4018620d 0 returned -22 [ 3254.630744][ T30] kauditd_printk_skb: 5409 callbacks suppressed [ 3254.630762][ T30] audit: type=1326 audit(1770025867.533:9266): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16319 comm="syz.1.9668" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fc4539 code=0x0 [ 3254.686580][T16324] [ 3254.688930][T16324] ===================================================== [ 3254.695853][T16324] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 3254.703306][T16324] syzkaller #0 Tainted: G L [ 3254.709261][T16324] ----------------------------------------------------- [ 3254.716173][T16324] syz.5.9667/16324 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 3254.723881][T16324] ffff888058991e88 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x199/0x4d0 [ 3254.732572][T16324] [ 3254.732572][T16324] and this task is already holding: [ 3254.739921][T16324] ffff8880948fe028 (&client->buffer_lock){....}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 3254.749669][T16324] which would create a new lock dependency: [ 3254.755565][T16324] (&client->buffer_lock){....}-{3:3} -> (&new->fa_lock){....}-{3:3} [ 3254.763646][T16324] [ 3254.763646][T16324] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 3254.773082][T16324] (&dev->event_lock#2){..-.}-{3:3} [ 3254.773107][T16324] [ 3254.773107][T16324] ... which became SOFTIRQ-irq-safe at: [ 3254.785963][T16324] lock_acquire+0x106/0x330 [ 3254.790555][T16324] _raw_spin_lock_irqsave+0x40/0x60 [ 3254.795856][T16324] input_inject_event+0xa5/0x340 [ 3254.800888][T16324] led_trigger_event+0x138/0x210 [ 3254.805912][T16324] kbd_bh+0x1f3/0x300 [ 3254.809989][T16324] tasklet_action_common+0x2da/0x4b0 [ 3254.815350][T16324] handle_softirqs+0x22a/0x7c0 [ 3254.820189][T16324] run_ksoftirqd+0x36/0x60 [ 3254.824700][T16324] smpboot_thread_fn+0x541/0xa50 [ 3254.829711][T16324] kthread+0x726/0x8b0 [ 3254.833876][T16324] ret_from_fork+0x51b/0xa40 [ 3254.838552][T16324] ret_from_fork_asm+0x1a/0x30 [ 3254.843397][T16324] [ 3254.843397][T16324] to a SOFTIRQ-irq-unsafe lock: [ 3254.850406][T16324] (tasklist_lock){.+.+}-{3:3} [ 3254.850436][T16324] [ 3254.850436][T16324] ... which became SOFTIRQ-irq-unsafe at: [ 3254.863041][T16324] ... [ 3254.863049][T16324] lock_acquire+0x106/0x330 [ 3254.870195][T16324] _raw_read_lock+0x36/0x50 [ 3254.874770][T16324] __do_wait+0xde/0x740 [ 3254.879005][T16324] do_wait+0x1e7/0x4f0 [ 3254.883147][T16324] kernel_wait+0xd6/0x1c0 [ 3254.887552][T16324] call_usermodehelper_exec_work+0xbe/0x230 [ 3254.893529][T16324] process_scheduled_works+0xaec/0x17a0 [ 3254.899175][T16324] worker_thread+0xda6/0x1360 [ 3254.903949][T16324] kthread+0x726/0x8b0 [ 3254.908093][T16324] ret_from_fork+0x51b/0xa40 [ 3254.912762][T16324] ret_from_fork_asm+0x1a/0x30 [ 3254.917607][T16324] [ 3254.917607][T16324] other info that might help us debug this: [ 3254.917607][T16324] [ 3254.927826][T16324] Chain exists of: [ 3254.927826][T16324] &dev->event_lock#2 --> &client->buffer_lock --> tasklist_lock [ 3254.927826][T16324] [ 3254.941384][T16324] Possible interrupt unsafe locking scenario: [ 3254.941384][T16324] [ 3254.949819][T16324] CPU0 CPU1 [ 3254.955179][T16324] ---- ---- [ 3254.960528][T16324] lock(tasklist_lock); [ 3254.964762][T16324] local_irq_disable(); [ 3254.971502][T16324] lock(&dev->event_lock#2); [ 3254.978692][T16324] lock(&client->buffer_lock); [ 3254.986063][T16324] [ 3254.989503][T16324] lock(&dev->event_lock#2); [ 3254.994349][T16324] [ 3254.994349][T16324] *** DEADLOCK *** [ 3254.994349][T16324] [ 3255.002483][T16324] 7 locks held by syz.5.9667/16324: [ 3255.007663][T16324] #0: ffff888146b06118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x1ae/0x4c0 [ 3255.016806][T16324] #1: ffff8881442a5230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0xa5/0x340 [ 3255.026899][T16324] #2: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xb6/0x340 [ 3255.036555][T16324] #3: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x8d/0x890 [ 3255.046122][T16324] #4: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x79/0x340 [ 3255.055264][T16324] #5: ffff8880948fe028 (&client->buffer_lock){....}-{3:3}, at: evdev_pass_values+0xb9/0xbd0 [ 3255.065438][T16324] #6: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x53/0x4d0 [ 3255.074483][T16324] [ 3255.074483][T16324] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 3255.084871][T16324] -> (&dev->event_lock#2){..-.}-{3:3} { [ 3255.090515][T16324] IN-SOFTIRQ-W at: [ 3255.094571][T16324] lock_acquire+0x106/0x330 [ 3255.100895][T16324] _raw_spin_lock_irqsave+0x40/0x60 [ 3255.107917][T16324] input_inject_event+0xa5/0x340 [ 3255.114671][T16324] led_trigger_event+0x138/0x210 [ 3255.121445][T16324] kbd_bh+0x1f3/0x300 [ 3255.127238][T16324] tasklet_action_common+0x2da/0x4b0 [ 3255.134331][T16324] handle_softirqs+0x22a/0x7c0 [ 3255.140913][T16324] run_ksoftirqd+0x36/0x60 [ 3255.147141][T16324] smpboot_thread_fn+0x541/0xa50 [ 3255.153912][T16324] kthread+0x726/0x8b0 [ 3255.159792][T16324] ret_from_fork+0x51b/0xa40 [ 3255.166197][T16324] ret_from_fork_asm+0x1a/0x30 [ 3255.172800][T16324] INITIAL USE at: [ 3255.176764][T16324] lock_acquire+0x106/0x330 [ 3255.182991][T16324] _raw_spin_lock_irqsave+0x40/0x60 [ 3255.189916][T16324] input_inject_event+0xa5/0x340 [ 3255.196580][T16324] kbd_led_trigger_activate+0xbc/0x100 [ 3255.203777][T16324] led_trigger_set+0x535/0x960 [ 3255.210267][T16324] led_trigger_set_default+0x260/0x2a0 [ 3255.217540][T16324] led_classdev_register_ext+0x787/0x9c0 [ 3255.224904][T16324] input_leds_connect+0x517/0x790 [ 3255.231651][T16324] input_register_device+0xd00/0x1160 [ 3255.238747][T16324] atkbd_connect+0x731/0xa50 [ 3255.245065][T16324] serio_driver_probe+0x82/0xd0 [ 3255.251648][T16324] really_probe+0x267/0xaf0 [ 3255.257876][T16324] __driver_probe_device+0x18c/0x320 [ 3255.264887][T16324] driver_probe_device+0x4f/0x240 [ 3255.271639][T16324] __driver_attach+0x349/0x640 [ 3255.278121][T16324] bus_for_each_dev+0x23b/0x2c0 [ 3255.284710][T16324] serio_handle_event+0x232/0x10d0 [ 3255.291635][T16324] process_scheduled_works+0xaec/0x17a0 [ 3255.298917][T16324] worker_thread+0xda6/0x1360 [ 3255.305374][T16324] kthread+0x726/0x8b0 [ 3255.311169][T16324] ret_from_fork+0x51b/0xa40 [ 3255.317485][T16324] ret_from_fork_asm+0x1a/0x30 [ 3255.323979][T16324] } [ 3255.326546][T16324] ... key at: [] input_allocate_device.__key.7+0x0/0x20 [ 3255.335644][T16324] -> (&client->buffer_lock){....}-{3:3} { [ 3255.341364][T16324] INITIAL USE at: [ 3255.345247][T16324] lock_acquire+0x106/0x330 [ 3255.351394][T16324] _raw_spin_lock+0x2e/0x40 [ 3255.357454][T16324] evdev_pass_values+0xb9/0xbd0 [ 3255.363859][T16324] evdev_events+0x1e6/0x340 [ 3255.369932][T16324] input_pass_values+0x288/0x890 [ 3255.376445][T16324] input_event_dispose+0x330/0x6b0 [ 3255.383124][T16324] input_inject_event+0x1dd/0x340 [ 3255.389710][T16324] evdev_write+0x325/0x4c0 [ 3255.395683][T16324] vfs_write+0x29a/0xb90 [ 3255.401501][T16324] ksys_write+0x150/0x270 [ 3255.407406][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3255.414173][T16324] do_fast_syscall_32+0x33/0x70 [ 3255.420575][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3255.428455][T16324] } [ 3255.430934][T16324] ... key at: [] evdev_open.__key.27+0x0/0x20 [ 3255.439172][T16324] ... acquired at: [ 3255.442960][T16324] _raw_spin_lock+0x2e/0x40 [ 3255.447640][T16324] evdev_pass_values+0xb9/0xbd0 [ 3255.452661][T16324] evdev_events+0x1e6/0x340 [ 3255.457327][T16324] input_pass_values+0x288/0x890 [ 3255.462424][T16324] input_event_dispose+0x330/0x6b0 [ 3255.467689][T16324] input_inject_event+0x1dd/0x340 [ 3255.472880][T16324] evdev_write+0x325/0x4c0 [ 3255.477576][T16324] vfs_write+0x29a/0xb90 [ 3255.482068][T16324] ksys_write+0x150/0x270 [ 3255.486559][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3255.491933][T16324] do_fast_syscall_32+0x33/0x70 [ 3255.496949][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3255.503459][T16324] [ 3255.505783][T16324] [ 3255.505783][T16324] the dependencies between the lock to be acquired [ 3255.505796][T16324] and SOFTIRQ-irq-unsafe lock: [ 3255.519390][T16324] -> (tasklist_lock){.+.+}-{3:3} { [ 3255.524708][T16324] HARDIRQ-ON-R at: [ 3255.528847][T16324] lock_acquire+0x106/0x330 [ 3255.535348][T16324] _raw_read_lock+0x36/0x50 [ 3255.541833][T16324] __do_wait+0xde/0x740 [ 3255.547982][T16324] do_wait+0x1e7/0x4f0 [ 3255.554049][T16324] kernel_wait+0xd6/0x1c0 [ 3255.560377][T16324] call_usermodehelper_exec_work+0xbe/0x230 [ 3255.568270][T16324] process_scheduled_works+0xaec/0x17a0 [ 3255.575830][T16324] worker_thread+0xda6/0x1360 [ 3255.582602][T16324] kthread+0x726/0x8b0 [ 3255.588656][T16324] ret_from_fork+0x51b/0xa40 [ 3255.595241][T16324] ret_from_fork_asm+0x1a/0x30 [ 3255.602001][T16324] SOFTIRQ-ON-R at: [ 3255.606142][T16324] lock_acquire+0x106/0x330 [ 3255.612636][T16324] _raw_read_lock+0x36/0x50 [ 3255.619120][T16324] __do_wait+0xde/0x740 [ 3255.625258][T16324] do_wait+0x1e7/0x4f0 [ 3255.631313][T16324] kernel_wait+0xd6/0x1c0 [ 3255.637627][T16324] call_usermodehelper_exec_work+0xbe/0x230 [ 3255.645509][T16324] process_scheduled_works+0xaec/0x17a0 [ 3255.653047][T16324] worker_thread+0xda6/0x1360 [ 3255.659728][T16324] kthread+0x726/0x8b0 [ 3255.665778][T16324] ret_from_fork+0x51b/0xa40 [ 3255.672363][T16324] ret_from_fork_asm+0x1a/0x30 [ 3255.679112][T16324] INITIAL USE at: [ 3255.683168][T16324] lock_acquire+0x106/0x330 [ 3255.689573][T16324] _raw_write_lock_irq+0x3d/0x50 [ 3255.696411][T16324] copy_process+0x2199/0x3980 [ 3255.702991][T16324] kernel_clone+0x248/0x870 [ 3255.709391][T16324] user_mode_thread+0x110/0x180 [ 3255.716136][T16324] rest_init+0x23/0x300 [ 3255.722286][T16324] start_kernel+0x380/0x3d0 [ 3255.728699][T16324] x86_64_start_reservations+0x24/0x30 [ 3255.736053][T16324] x86_64_start_kernel+0x143/0x1c0 [ 3255.743061][T16324] common_startup_64+0x13e/0x147 [ 3255.749911][T16324] INITIAL READ USE at: [ 3255.754405][T16324] lock_acquire+0x106/0x330 [ 3255.761250][T16324] _raw_read_lock+0x36/0x50 [ 3255.768081][T16324] __do_wait+0xde/0x740 [ 3255.774568][T16324] do_wait+0x1e7/0x4f0 [ 3255.780969][T16324] kernel_wait+0xd6/0x1c0 [ 3255.787631][T16324] call_usermodehelper_exec_work+0xbe/0x230 [ 3255.795866][T16324] process_scheduled_works+0xaec/0x17a0 [ 3255.803764][T16324] worker_thread+0xda6/0x1360 [ 3255.810778][T16324] kthread+0x726/0x8b0 [ 3255.817177][T16324] ret_from_fork+0x51b/0xa40 [ 3255.824101][T16324] ret_from_fork_asm+0x1a/0x30 [ 3255.831199][T16324] } [ 3255.833856][T16324] ... key at: [] tasklist_lock+0x18/0x40 [ 3255.841821][T16324] ... acquired at: [ 3255.845785][T16324] _raw_read_lock+0x36/0x50 [ 3255.850453][T16324] send_sigio+0x101/0x370 [ 3255.854947][T16324] kill_fasync+0x24d/0x4d0 [ 3255.859528][T16324] lease_break_callback+0x26/0x30 [ 3255.864710][T16324] __break_lease+0x741/0x1b80 [ 3255.869554][T16324] vfs_truncate+0x449/0x540 [ 3255.874219][T16324] do_sys_truncate+0xf1/0x1c0 [ 3255.879061][T16324] __ia32_compat_sys_truncate+0x5b/0x70 [ 3255.884773][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3255.890149][T16324] do_fast_syscall_32+0x33/0x70 [ 3255.895188][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3255.901701][T16324] [ 3255.904016][T16324] -> (&f_owner->lock){....}-{3:3} { [ 3255.909307][T16324] INITIAL USE at: [ 3255.913280][T16324] lock_acquire+0x106/0x330 [ 3255.919510][T16324] _raw_write_lock_irq+0x3d/0x50 [ 3255.926170][T16324] __f_setown+0x67/0x370 [ 3255.932136][T16324] generic_setlease+0xba2/0xed0 [ 3255.938707][T16324] do_fcntl_add_lease+0x35e/0x470 [ 3255.945468][T16324] fcntl_setdeleg+0x14c/0x1e0 [ 3255.951875][T16324] do_fcntl+0xe6d/0x1a20 [ 3255.957848][T16324] do_compat_fcntl64+0x51e/0x7e0 [ 3255.964515][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3255.971438][T16324] do_fast_syscall_32+0x33/0x70 [ 3255.978010][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3255.986068][T16324] INITIAL READ USE at: [ 3255.990480][T16324] lock_acquire+0x106/0x330 [ 3255.997172][T16324] _raw_read_lock_irqsave+0x48/0x60 [ 3256.004540][T16324] send_sigio+0x38/0x370 [ 3256.010943][T16324] kill_fasync+0x24d/0x4d0 [ 3256.017520][T16324] lease_break_callback+0x26/0x30 [ 3256.024703][T16324] __break_lease+0x741/0x1b80 [ 3256.031657][T16324] vfs_set_acl+0x4b0/0xb00 [ 3256.038229][T16324] do_set_acl+0xf5/0x190 [ 3256.044633][T16324] filename_setxattr+0x2fc/0x630 [ 3256.051738][T16324] path_setxattrat+0x3f3/0x430 [ 3256.058661][T16324] __ia32_sys_setxattr+0xbc/0xe0 [ 3256.065756][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3256.073117][T16324] do_fast_syscall_32+0x33/0x70 [ 3256.080127][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3256.088614][T16324] } [ 3256.091183][T16324] ... key at: [] file_f_owner_allocate.__key+0x0/0x20 [ 3256.100116][T16324] ... acquired at: [ 3256.103998][T16324] _raw_read_lock_irqsave+0x48/0x60 [ 3256.109358][T16324] send_sigio+0x38/0x370 [ 3256.113762][T16324] kill_fasync+0x24d/0x4d0 [ 3256.118341][T16324] lease_break_callback+0x26/0x30 [ 3256.123530][T16324] __break_lease+0x741/0x1b80 [ 3256.128371][T16324] vfs_set_acl+0x4b0/0xb00 [ 3256.132946][T16324] do_set_acl+0xf5/0x190 [ 3256.137346][T16324] filename_setxattr+0x2fc/0x630 [ 3256.142440][T16324] path_setxattrat+0x3f3/0x430 [ 3256.147371][T16324] __ia32_sys_setxattr+0xbc/0xe0 [ 3256.152486][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3256.157950][T16324] do_fast_syscall_32+0x33/0x70 [ 3256.162960][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3256.169453][T16324] [ 3256.171761][T16324] -> (&new->fa_lock){....}-{3:3} { [ 3256.176879][T16324] INITIAL USE at: [ 3256.180756][T16324] lock_acquire+0x106/0x330 [ 3256.186809][T16324] _raw_write_lock_irq+0x3d/0x50 [ 3256.193303][T16324] fasync_remove_entry+0xf1/0x1c0 [ 3256.199896][T16324] lease_modify+0x4f7/0x6c0 [ 3256.205963][T16324] locks_remove_file+0x554/0xee0 [ 3256.212451][T16324] __fput+0x3ae/0xa70 [ 3256.217982][T16324] task_work_run+0x1d9/0x270 [ 3256.224122][T16324] exit_to_user_mode_loop+0xed/0x480 [ 3256.230959][T16324] __do_fast_syscall_32+0x38e/0x540 [ 3256.237716][T16324] do_fast_syscall_32+0x33/0x70 [ 3256.244119][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3256.252020][T16324] INITIAL READ USE at: [ 3256.256364][T16324] lock_acquire+0x106/0x330 [ 3256.262868][T16324] _raw_read_lock_irqsave+0x48/0x60 [ 3256.270050][T16324] kill_fasync+0x199/0x4d0 [ 3256.276457][T16324] lease_break_callback+0x26/0x30 [ 3256.283465][T16324] __break_lease+0x741/0x1b80 [ 3256.290132][T16324] vfs_set_acl+0x4b0/0xb00 [ 3256.296538][T16324] do_set_acl+0xf5/0x190 [ 3256.302774][T16324] filename_setxattr+0x2fc/0x630 [ 3256.309704][T16324] path_setxattrat+0x3f3/0x430 [ 3256.316454][T16324] __ia32_sys_setxattr+0xbc/0xe0 [ 3256.323375][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3256.330559][T16324] do_fast_syscall_32+0x33/0x70 [ 3256.337390][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3256.345709][T16324] } [ 3256.348197][T16324] ... key at: [] fasync_insert_entry.__key+0x0/0x20 [ 3256.356861][T16324] ... acquired at: [ 3256.360646][T16324] _raw_read_lock_irqsave+0x48/0x60 [ 3256.366002][T16324] kill_fasync+0x199/0x4d0 [ 3256.370583][T16324] evdev_pass_values+0x627/0xbd0 [ 3256.375693][T16324] evdev_events+0x1e6/0x340 [ 3256.380357][T16324] input_pass_values+0x288/0x890 [ 3256.385474][T16324] input_event_dispose+0x330/0x6b0 [ 3256.390768][T16324] input_inject_event+0x1dd/0x340 [ 3256.395971][T16324] evdev_write+0x325/0x4c0 [ 3256.400568][T16324] vfs_write+0x29a/0xb90 [ 3256.404974][T16324] ksys_write+0x150/0x270 [ 3256.409466][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3256.414826][T16324] do_fast_syscall_32+0x33/0x70 [ 3256.419838][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3256.426324][T16324] [ 3256.428643][T16324] [ 3256.428643][T16324] stack backtrace: [ 3256.434556][T16324] CPU: 1 UID: 0 PID: 16324 Comm: syz.5.9667 Tainted: G L syzkaller #0 PREEMPT(full) [ 3256.434583][T16324] Tainted: [L]=SOFTLOCKUP [ 3256.434589][T16324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 3256.434619][T16324] Call Trace: [ 3256.434630][T16324] [ 3256.434638][T16324] dump_stack_lvl+0xe8/0x150 [ 3256.434663][T16324] __lock_acquire+0x2a94/0x2cf0 [ 3256.434692][T16324] ? kill_fasync+0x199/0x4d0 [ 3256.434711][T16324] lock_acquire+0x106/0x330 [ 3256.434730][T16324] ? kill_fasync+0x199/0x4d0 [ 3256.434749][T16324] ? do_raw_spin_lock+0x12b/0x2f0 [ 3256.434768][T16324] _raw_read_lock_irqsave+0x48/0x60 [ 3256.434783][T16324] ? kill_fasync+0x199/0x4d0 [ 3256.434805][T16324] kill_fasync+0x199/0x4d0 [ 3256.434823][T16324] ? kill_fasync+0x53/0x4d0 [ 3256.434842][T16324] evdev_pass_values+0x627/0xbd0 [ 3256.434865][T16324] ? evdev_pass_values+0x631/0xbd0 [ 3256.434887][T16324] evdev_events+0x1e6/0x340 [ 3256.434906][T16324] ? evdev_events+0x79/0x340 [ 3256.434925][T16324] ? input_pass_values+0x8d/0x890 [ 3256.434944][T16324] input_pass_values+0x288/0x890 [ 3256.434966][T16324] ? input_handle_event+0x70c/0xf30 [ 3256.434983][T16324] input_event_dispose+0x330/0x6b0 [ 3256.435001][T16324] input_inject_event+0x1dd/0x340 [ 3256.435018][T16324] ? input_inject_event+0xb6/0x340 [ 3256.435035][T16324] evdev_write+0x325/0x4c0 [ 3256.435055][T16324] ? __lock_acquire+0x6b5/0x2cf0 [ 3256.435076][T16324] ? __pfx_evdev_write+0x10/0x10 [ 3256.435097][T16324] ? bpf_lsm_file_permission+0x9/0x20 [ 3256.435114][T16324] ? security_file_permission+0x75/0x260 [ 3256.435131][T16324] ? rw_verify_area+0x255/0x4d0 [ 3256.435150][T16324] ? __pfx_evdev_write+0x10/0x10 [ 3256.435171][T16324] vfs_write+0x29a/0xb90 [ 3256.435193][T16324] ? __pfx_vfs_write+0x10/0x10 [ 3256.435213][T16324] ? __fget_files+0x2a/0x420 [ 3256.435231][T16324] ? __fget_files+0x2a/0x420 [ 3256.435246][T16324] ? __fget_files+0x3a0/0x420 [ 3256.435261][T16324] ? __fget_files+0x2a/0x420 [ 3256.435279][T16324] ksys_write+0x150/0x270 [ 3256.435300][T16324] ? __pfx_ksys_write+0x10/0x10 [ 3256.435323][T16324] __do_fast_syscall_32+0x1d2/0x540 [ 3256.435340][T16324] ? lockdep_hardirqs_on+0x7a/0x110 [ 3256.435354][T16324] ? do_fast_syscall_32+0x33/0x70 [ 3256.435370][T16324] ? asm_int80_emulation+0x1a/0x20 [ 3256.435385][T16324] ? do_int80_emulation+0x20e/0x400 [ 3256.435402][T16324] do_fast_syscall_32+0x33/0x70 [ 3256.435419][T16324] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 3256.435440][T16324] RIP: 0023:0xf73dd539 [ 3256.435459][T16324] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 3256.435472][T16324] RSP: 002b:00000000f540650c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 3256.435490][T16324] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000040 [ 3256.435501][T16324] RDX: 0000000000000037 RSI: 0000000000000000 RDI: 0000000000000000 [ 3256.435511][T16324] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 3256.435520][T16324] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 3256.435530][T16324] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 3256.435545][T16324]