last executing test programs: 8m9.248523909s ago: executing program 0 (id=304): prctl$PR_SCHED_CORE(0x3e, 0x4000002, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0xce) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_GETMODE(r2, 0x5601, 0xffffffffffffffff) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={0x0, @rand_addr, @multicast2}, &(0x7f00000000c0)=0xc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000780), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4000000010003b1500000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="41000000015001001800128008000100677470000c00028008000100", @ANYRES32, @ANYBLOB='\x00\x00', @ANYRES32=0xffffffffffffffff, @ANYBLOB], 0x40}}, 0x2400c080) prlimit64(0x0, 0x7, &(0x7f00000003c0), 0x0) ioctl$KVM_CAP_HALT_POLL(r4, 0x4068aea3, &(0x7f0000000000)={0xdf, 0x0, 0x10000}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/bus/input/handlers\x00', 0x0, 0x0) pread64(r7, &(0x7f0000000280)=""/211, 0xd3, 0xea6) r8 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r8, &(0x7f0000000000)={0x2a, 0xffffffff, 0x3fff}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x1010, 0x89}, 0x50) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x3, &(0x7f0000006340)=ANY=[@ANYRES32=r6], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x26, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x19}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000200)=@generic={0x0, r9}, 0x18) mkdirat(0xffffffffffffff9c, 0x0, 0x0) 8m6.403312231s ago: executing program 0 (id=313): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x4d0180) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000405000/0x2000)=nil, 0x2000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x3564e000) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'bridge_slave_0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@gettclass={0x24, 0x2a, 0x0, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xa, 0x6}, {0xa, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x40001}, 0x48805) socket(0x28, 0x2, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x10000004) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) r7 = socket(0x10, 0x80000, 0x20) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="7fff0000000000002800128009000100766c616e000000001800028006000100", @ANYRES32], 0x50}}, 0x0) getsockopt$packet_int(r6, 0x107, 0xe, 0x0, &(0x7f0000000200)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f00000003c0)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@delchain={0x24, 0x5f, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0x5, 0x2}, {0x1, 0xe}}}, 0x24}}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000880)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004}}, {{&(0x7f0000000400)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000800)=[{&(0x7f00000004c0)="acefeb926764e9da1aea277a167186f4e09e37bacd47ddf8c2a909beb83f46d6adcbf54b7ecdaffd7ae40282fd66351fedbbd2b5e4cf5fbe956f7d5e27084d8194f434ca4c9a1b564c95314724dd77f5c496ea179896e36343", 0x59}, {&(0x7f0000000540)="0555c82d0675f3897ba72f4f6f24db3aae8dd9715ee8baf317ae17f54238280b688b698838bdc68e36db311c679fe919820a00047226ddfc62242683ee393767a2cb5ca458903e5dd8853fa554a3d5e5726729b8701305b8c4857d14e1beb163c93a933b9406d575c4e9957b54da6eca487275cffea5f30545c3467c4de8274a279df9d0ecab5bd2cbd2120b015a1ed4fe2d96ac70b15a323892cfed698b40e686074f5cb1711cc58ec651e825739f3b6d9f727512f2df9d54acbb262dcb524455255fe7b4630022f7dd275b886a89734f0197dbe47b0afb99c9", 0xda}, {&(0x7f0000000640)="df64b77c495199d9379b939a2fa153635272f0cb207fbfcff1e03bf55f6206f024d962296d7443e09bb911d36d8faf926f88e39416fc3bffd69bc4aa6a73400aea53e5b89ae793cf67094d01f8eebe1c51f0faf391053333864662d417043d6f7c4bcd4f2d669b1dc11ebdae3517f5fc323f5d0564f14daac17b90207b2e349113d21afe40b8e5", 0x87}, {&(0x7f00000000c0)="48773f3c2ca0ea79e5c4839d06181c2c5439592cabf7", 0x16}, {&(0x7f0000000700)="2e06c56098355f85721c2fa31a886c56fa9f6ae27100c25d7aa0cfecfca381a8e5e23a3e5b4051e71572f391bd5c65cf1bdc2d695c56046e44e88e71266cb1ec1c75dce8aa1d0d7a51e0f2bfc7198cde61f8a4493dff44210b732231f8a048e6aeb530db6b2df4c48cc4e11ebd589786f29e8861c03e9c478285c209b84d2c8ddbf29a953055e5c0d92d1a2f4ecd1c9b0b332c2d83267167dcc9b90e7c416c03c79798faa134f5897f7c20581069a8e85435f80f9b1ce89d4235c33b5838a83c9025d92911aa7b0b", 0xc8}], 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="20000000000000000100000001000000", @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r4, @ANYRES32=r3, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000100"], 0x40}}], 0x2, 0x0) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000380), 0x48) r9 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f0000000040)=0xf) 8m4.395497701s ago: executing program 0 (id=322): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001d906e20501dc6609b620103000109021b0001000010000904f7000176246700090582020002"], 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x20}}}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) munmap(&(0x7f0000ff5000/0x9000)=nil, 0x9000) set_mempolicy_home_node(&(0x7f0000ff6000/0x2000)=nil, 0x2000, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @mcast2, 0x8}, 0x58) sendmmsg$inet(r0, &(0x7f00000066c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001cc0)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0x3}}], 0x30}}], 0x1, 0x2084020) landlock_restrict_self(0xffffffffffffffff, 0xe837cd994334571b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="901200000000000000010000010004010407480000000010630000000400000000000000000000000000000080000000000000e30e000000000000080000000000000000000080000000000300000000000000000000000000000005020006c2040000195e0502000607280000000308094a004000000000000000000000000000000000000000000000000900000000000000c2040000000900000006000000"], 0xa0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc) socket$inet6(0xa, 0x3, 0x2f) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYRES32], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x40000) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000800)={{0x12, 0x1, 0x110, 0xc6, 0x91, 0x9f, 0x40, 0x174f, 0x5212, 0x6041, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x5b, 0x3, 0x1, 0xe, 0x1, 0x0, 0x7, [], [{{0x9, 0x5, 0x5, 0xf, 0x400, 0xc, 0x5, 0x83}}]}}]}}]}}, 0x0) sendmsg$nl_route(r3, 0x0, 0x20000000) recvmmsg(r2, &(0x7f0000006880)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4100}, 0x80000001}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000440)=""/183, 0xb7}, {&(0x7f00000007c0)=""/242, 0xf2}, {&(0x7f0000000400)=""/57, 0x39}, {&(0x7f0000002900)=""/4114, 0x1012}, {&(0x7f0000000340)=""/75, 0x4b}, {&(0x7f0000000600)=""/244, 0xf4}], 0x6}, 0x80000000}], 0x4, 0x4022, 0x0) r4 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) writev(r4, &(0x7f0000000040), 0x100000000000014c) 8m1.222415485s ago: executing program 0 (id=336): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa000905820240"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f00000002c0)={0x0, 0x1, 0x6, "cc17fc47a9ae"}, 0x0, 0x0}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') connect$inet(r3, &(0x7f0000000500)={0x2, 0x4e20, @empty}, 0x10) sendfile(r4, r4, &(0x7f0000000000)=0x2eb4, 0x2000007ff) r5 = gettid() r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) read(r6, &(0x7f0000000440)=""/247, 0x26) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r6, 0x4040534e, &(0x7f0000000080)={0x31, @time={0x7, 0x1}, 0x0, {0xfd, 0x8}, 0xfe, 0x0, 0x4}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r6, 0xc0bc5310, &(0x7f0000000040)={0x87, @time={0xbc, 0x7}, 0x0, {0x71, 0x6}, 0x6, 0x0, 0x1}) tkill(r5, 0x7) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000540)={0x40000000}) read(0xffffffffffffffff, &(0x7f0000000440)=""/138, 0x8a) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYBLOB="1201000000000040c41090ea00000000000109022400010000002009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io(r7, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r7, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="2001d4"], 0x0}) syz_usb_control_io$hid(r7, 0x0, &(0x7f0000000540)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="20010e"], 0x0}) 7m57.8795454s ago: executing program 0 (id=344): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x2, 0x300) r1 = syz_open_dev$sg(0x0, 0xe6, 0x2602) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x380000f, 0x11, r1, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3400000011000100000000000000000007000000", @ANYRES32, @ANYBLOB="000000002000000014001a80100003800c000180"], 0x34}}, 0x0) 7m57.103021203s ago: executing program 0 (id=348): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x86dd, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x70bd29, 0xfffffffe, {0x7, r1}, [@MDBA_SET_ENTRY={0x20, 0x1, {r1, 0x1, 0x0, 0x2, {@ip4=@broadcast}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x51dcb31a43476434) 7m56.542049007s ago: executing program 32 (id=348): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x86dd, &(0x7f0000000040)={&(0x7f00000001c0)=@RTM_NEWMDB={0x38, 0x54, 0x1e5, 0x70bd29, 0xfffffffe, {0x7, r1}, [@MDBA_SET_ENTRY={0x20, 0x1, {r1, 0x1, 0x0, 0x2, {@ip4=@broadcast}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x51dcb31a43476434) 15.435559749s ago: executing program 3 (id=1930): r0 = syz_open_dev$loop(&(0x7f0000000100), 0xdf6, 0x0) io_setup(0x10, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f0000002280)=[&(0x7f0000000200)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r0, &(0x7f0000000080)="d76cb3", 0x3, 0x0, 0x0, 0x2}]) (fail_nth: 3) 15.084576863s ago: executing program 3 (id=1931): syz_emit_ethernet(0x74, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1}, {0x0, 0x0, 0xfffffe9a, 0x0, @gue={{0x2, 0x0, 0x0, 0x0, 0x0, @val=0x7f000000}}}}}}}, 0x0) 15.022837165s ago: executing program 3 (id=1932): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x44, &(0x7f0000000340)={0x40, 0xf, 0x1, 'V'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x20, 0xd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f00000004c0)={0x0, 0xa}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000002c0)={0x2c, &(0x7f0000000780)=ANY=[], 0x0, 0x0, 0x0, 0x0}) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0xa) sendmmsg(r1, 0x0, 0x45, 0x9200000000000000) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(r2, 0x0, 0x0, 0x40000001, 0x0) 12.398492074s ago: executing program 1 (id=1942): r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000280)={0x60, 0x1, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0x3, 0x79dc8089b2c841c4, 0x0, 0xa5, 0x5c}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000008c0)=@ipv4_newroute={0x38, 0x18, 0x1, 0x0, 0x25dfdbfe, {0x2, 0x0, 0x0, 0x0, 0xff, 0x1, 0xc8, 0x9, 0x2700}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x2}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, @LWTUNNEL_IP_OPT_ERSPAN_VER={0x5, 0x1, 0x2}}}}]}, 0x38}}, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r5 = socket$netlink(0x10, 0x3, 0x0) (rerun: 32) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) (async, rerun: 32) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) (async, rerun: 32) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r8, 0x25, &(0x7f00000000c0)) (async, rerun: 32) r9 = gettid() (rerun: 32) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r9}, &(0x7f0000000040)=0x0) timer_settime(r10, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000040)='percpu_alloc_percpu\x00'}, 0x10) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4040) (async, rerun: 64) connect$inet(r11, 0x0, 0x0) (rerun: 64) writev(r11, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r12 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r12, 0xc25c4110, &(0x7f0000000080)={0x0, [[0x7fff], [0xfffffffc, 0xffffffff], [0x48]], '\x00', [{0x0, 0x5}], '\x00', 0x100}) (async, rerun: 64) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x44, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_CT_ZONE_MASK={0x6, 0x5e, 0x8}, @TCA_FLOWER_KEY_CT_ZONE={0x6, 0x5d, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x24, 0x1, 0x1, 0x101, 0x0, 0x0, {0x0, 0x0, 0x3}, [@CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x7}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x40020}, 0x8010) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001200)=@newlink={0x5c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x50a32, 0x823}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @loopback={0xff00000000000000}}, @IFLA_GRE_LOCAL={0x14, 0x6, @loopback={0x300}}]}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000080}, 0xc010) 12.206520572s ago: executing program 1 (id=1943): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0258ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100090810000000000000040000", 0x58}], 0x1) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) getsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x20, 0x0, &(0x7f0000001040)=0x5d) r5 = syz_genetlink_get_family_id$tipc2(0x0, r4) sendmsg$TIPC_NL_MEDIA_GET(r4, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="080025bd7000fcdbdf250b00000004000180"], 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040040) preadv2(r3, &(0x7f00000002c0)=[{&(0x7f0000000340)=""/88, 0x58}, {&(0x7f00000003c0)=""/186, 0xba}], 0x2, 0xffffffff, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r6 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000b80)="d800000019008111e00212ba0d8105040a610200ff0f040b067c55a1bc000900b800069903000000b0000500808178a8001500030001400200000901ac040000d69b6f940071009807a290457f0189b316277ce06bbade8017cbec4c0000001fb791643a5ee4b11602b2a10e11ce1b25d6d9300000730d7a5025ccca262f2240fad95667e04adcdf634c1f215ce3bb9ad809d5e15de6ccd40dd6e4edef3d93452a9230000e9703000000000000000000000000129ae100000000000000000000080000400000000000000000000080b6fcdb2ab01ec2bb13", 0xd8}], 0x1}, 0x8000194) write$6lowpan_control(r6, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, &(0x7f0000000000)=0xffff0018) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f00000001c0)=0x7) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) r8 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEY(r8, 0x110, 0xffe, 0x0, 0x0) write$6lowpan_control(r6, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$USBDEVFS_FORBID_SUSPEND(0xffffffffffffffff, 0x5521) 9.873844263s ago: executing program 3 (id=1946): socket$nl_generic(0x10, 0x3, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000004c0)={'syztnl1\x00', 0x0}) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2c0c2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x4, 0x8004, 0x0, 0xb49, 0x200000000001, 0x6, 0x8, 0x3}, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed00000001090224000100000000090400000303000000"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x3f, 0x0) close_range(r3, r3, 0x0) syz_usb_connect$cdc_ecm(0x3, 0x4f, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x3695a90434db9d5e, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3d, 0x1, 0x1, 0x1, 0x40, 0x10, [{{0x9, 0x4, 0x0, 0x8, 0x3, 0x2, 0x6, 0x0, 0x7, {{0x7, 0x24, 0x6, 0x0, 0x0, "6ea1"}, {0x5, 0x24, 0x0, 0x80}, {0xd, 0x24, 0xf, 0x1, 0xfffffffc, 0x3ff, 0xf8f7, 0x7}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x2, 0x9a, 0x69}}, {{0x9, 0x5, 0x3, 0x2, 0x8, 0x7, 0x9, 0x10}}}}}]}}]}}, &(0x7f0000000a00)={0x0, 0x0, 0x5, &(0x7f0000000180)={0x5, 0xf, 0x5}}) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffc}, 0x0, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x200000000000000) syz_open_dev$media(&(0x7f00000006c0), 0x4, 0x0) fchdir(0xffffffffffffffff) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000030000000abc010000000a05000000000000000000010000000900010073797a3000000000d30006003407ae8929b5d5805c2cb15c6832bdf04f6f732bf6c75790a071b67033b0bb7e81aac8c9ccb093263d99fcafa58fe6c7126fc1d2ccbc1888abd4a61e1818723b358b147b8836997950921d849981687e7eb599e28bd439758eefcbda6f7906db339e68d3869e4011ddfb254a2dda9b523f928b3626f8faa75357d4f9cb925df5cde675f9e8bb05e4f8cc9a0610fb2945b1b755b94883afb3697a7535ea5f9db3ce21c1f0cc3fb343e830c6a947f512c56b1a706b86e76bc58a075f7cb0322f7fa6fb5df1718361423df5cbd47608ca000900010073797a310000000008000240000000030c000440000000000000000499000600db2b252f3c9b3b419bda841c524cb69270214a733fee6d8e10561ce9d682ad271b8a317d699b2f000178b2aca7c7058e0df489887ebdcf11c4ddf03bc9b1284f5fb568bac9b64b06c9d8c2acf08c892fb2abeb7c72bc9c8fa0c7425b5aa3df8074d8412d67fad836b6cc1c0be2fff19dbd1830e29ae4bc6aaa4f42c244e40238dc8e2a247b1792a177693b55dc155f631634db5af90000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a320000000098000000060a010400000000000000000100000008000b40000000005c000480580001800b000100746172676574000048000280300003005fad843dc5c1efe84ced18d4422d5b0b86e8441958d3d2ea41149f1e55359af069a2a5e039ccf56f068a5a0b09000100534e41540000000008000240000000020900010073797a30"], 0x2a8}, 0x1, 0x0, 0x0, 0x84}, 0x0) 8.675500483s ago: executing program 5 (id=1953): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0x9, 0x4, 0x9b97) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0xc8, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r4, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x2, 0x0, 0xc, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8001]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x6, 0x100, 0x5d, 0x0, 0x7ff, 0x200}}, {0x4}}]}]}, 0xc8}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="310000006900100527bd7000fcdbdf2500000000000000000800010002000000080001000200000008000100010000005b007abb000000000000010002000000"], 0x38}, 0x1, 0x0, 0x0, 0x24008800}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000f00)={{0x12, 0x1, 0x0, 0x7c, 0xe7, 0xc8, 0x10, 0x4d8, 0xa30, 0xce47, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xd, 0xe6, 0x7a, 0x0, [], [{{0x9, 0x5, 0x4, 0x2}}, {{0x9, 0x5, 0x81, 0x2, 0x3ff}}]}}]}}]}}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0xfffffffc, 0x0, 0x0, 0xfffffffffffffffe, 0x4f7, 0x40}, 0x0) bpf$MAP_CREATE(0xc00000000000018, 0x0, 0x48) r6 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r7, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002001100000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x8090) ioctl$VIDIOC_S_SELECTION(r6, 0xc040565f, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x14}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) recvfrom(r10, 0x0, 0x0, 0x2120, 0x0, 0x0) sendmsg$NFT_MSG_GETSETELEM(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) r11 = socket$netlink(0x10, 0x3, 0x4) ioctl$sock_SIOCBRDELBR(r11, 0x89a2, &(0x7f0000000000)='bridge0\x00') openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) 7.949911805s ago: executing program 1 (id=1954): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 6.355437539s ago: executing program 4 (id=1955): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000cc0)={0x30, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0xc, 0x2, 0x0, 0x1, [@nested={0x8, 0x14, 0x0, 0x1, [@nested={0x4, 0x6}]}]}]}, 0x30}, 0x1, 0x7000000, 0x0, 0x4048011}, 0xc000) 5.795219408s ago: executing program 4 (id=1956): socket$inet_tcp(0x2, 0x1, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$audio(0xffffff9c, 0x0, 0x402, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='smaps_rollup\x00') r3 = userfaultfd(0x80801) socket$nl_generic(0x10, 0x3, 0x10) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x5, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) (async) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001300), 0x28200, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) (async) dup(r7) r8 = syz_io_uring_setup(0xc0f, &(0x7f00000000c0)={0x0, 0x6efd, 0x8000, 0xffffffff, 0x1a}, &(0x7f00000003c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000000)=@IORING_OP_FADVISE={0x18, 0x64, 0x0, @fd_index=0x9, 0x100000000, 0x0, 0x101, 0x2}) io_uring_enter(r8, 0x47f5, 0x0, 0x0, 0x0, 0x0) (async) write$UHID_INPUT(r6, &(0x7f00000029c0)={0x9, {"a2e3ad214fc752f91b5d090932f70e0dd038e7ff7fc6e5539b324c078b089b3438076d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b35310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e01000000138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12d3099dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f6dc7bcbf2a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509301815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827466cfa5c482a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d951061ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033095563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db87195358bfee2916580dacae008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc311f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2df086dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36ffffffff00000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817b97c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000f4ff000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) (async) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) ioctl$UFFDIO_ZEROPAGE(r3, 0xc020aa08, 0x0) (async) read$FUSE(r2, &(0x7f0000000fc0)={0x2020}, 0x2020) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x0, 0x4000010) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 5.579685757s ago: executing program 1 (id=1957): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00'}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x9, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000140)=@abs={0x0, 0x0, 0xfffffffd}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="09000000180001000000200000000000021400000000000a0000000005001b0002000000"], 0x24}}, 0x4000000) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x406}, 0x20) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000000000000000000010000000900010073797a30001000000900020073797a310000000014000380080001400000000008040000000000004800000016160101000b008000000000010000000900020073797a3100000000090001ad8e3abd2d9dbbfd001c000380180003801400010070676d36726567310000000000000000140000001000010000000000000000000000000a33dff2cf"], 0xd0}}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r6 = socket$pppl2tp(0x18, 0x1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x42}, 0x94) sendmsg$NL80211_CMD_SET_TID_CONFIG(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCSIFMTU(r6, 0x8923, &(0x7f0000000100)={'syz_tun\x00', 0x40}) socket$inet_mptcp(0x2, 0x1, 0x106) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r7, &(0x7f0000000080)={0x0, 0xb, &(0x7f0000000000)=[{&(0x7f00000001c0)="5c00000026006bab9a3fe3d86e17aa31106b876c1d0000007ea60864160af36504001a0038001d004231a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb5b64f69853362ac3407173ec", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x4080) recvmsg$kcm(r7, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) socket(0x400000000010, 0x80000, 0x4008000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) 5.40251596s ago: executing program 4 (id=1958): socket$kcm(0x10, 0x3, 0x10) socket$inet(0x10, 0x2, 0x2) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x18, 0x0, 0x0) syz_io_uring_setup(0x24fa, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000180)=0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, 0x0, 0x0) syz_io_uring_submit(r2, r3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES32=0x0, @ANYRES32], 0x50) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000080)="67400f07c40249af4b8bb9800000c00f3235010200000f300f20a366450f769e00000100440f20c03588001d00445b66baf80cb88cf4b684ef66bafc0ced460f01c9c4827d24c366ba4cf0ff07ef87f345a57a43e16806a4", 0x58}], 0x1, 0x7c, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000080)={0x29, 0x2, 0x0, "b42c17000480000010000000000000000000000000000000000000000100", 0x34324d59}) 4.879423457s ago: executing program 2 (id=1959): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0258ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100090810000000000000040000", 0x58}], 0x1) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) getsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x20, 0x0, &(0x7f0000001040)=0x5d) r5 = syz_genetlink_get_family_id$tipc2(0x0, r4) sendmsg$TIPC_NL_MEDIA_GET(r4, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES16=r5, @ANYBLOB="080025bd7000fcdbdf250b00000004000180"], 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x4040040) preadv2(r3, &(0x7f00000002c0)=[{&(0x7f0000000340)=""/88, 0x58}, {&(0x7f00000003c0)=""/186, 0xba}], 0x2, 0xffffffff, 0x2, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000b80)="d800000019008111e00212ba0d8105040a610200ff0f040b067c55a1bc000900b800069903000000b0000500808178a8001500030001400200000901ac040000d69b6f940071009807a290457f0189b316277ce06bbade8017cbec4c0000001fb791643a5ee4b11602b2a10e11ce1b25d6d9300000730d7a5025ccca262f2240fad95667e04adcdf634c1f215ce3bb9ad809d5e15de6ccd40dd6e4edef3d93452a9230000e9703000000000000000000000000129ae100000000000000000000080000400000000000000000000080b6fcdb2ab01ec2bb13", 0xd8}], 0x1}, 0x8000194) write$6lowpan_control(0xffffffffffffffff, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000000000)=0xffff0018) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f00000001c0)=0x7) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) r7 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEY(r7, 0x110, 0xffe, 0x0, 0x0) write$6lowpan_control(0xffffffffffffffff, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$USBDEVFS_FORBID_SUSPEND(0xffffffffffffffff, 0x5521) 4.755107451s ago: executing program 4 (id=1960): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, &(0x7f0000000240)=0x2, 0x4) bpf$MAP_CREATE(0x0, 0x0, 0x0) syz_usb_connect(0x1, 0x36, &(0x7f0000000000)=ANY=[@ANYRES8=r0, @ANYRES16], 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000100)=0x40) setsockopt$sock_linger(r0, 0x1, 0x3d, &(0x7f00000001c0)={0x3, 0xfffffffc}, 0x8) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x10, 0x4, 0x0, 0x1002}, 0x10) sendmsg$nl_route(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000001a172da63f325d4c594b2218d8f07fabae30066c51f58cd063f65fd28953f1c8e5f8b829b21d58813c11cc56fc39188dcb48d5f11c8d9050a4fc703b4962223df860b2bc9b6019d99e4eee3010f5a11ebc0000000000007a5f9150baf08492e68d9a8c79f65284f1b2b152f3342bfde8075cbc1f7b60d60229a68072971a54ba9e13586c38b7ed5890ff9f0fdb39e349244755db24951e78ed6e0e8d12"], 0x1c}}, 0x4000004) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x275a, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140), 0x596e81, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r6, 0x4611, 0x3) r7 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r7, 0x890b, &(0x7f0000000000)) socket$kcm(0xa, 0x2, 0x0) 4.325956997s ago: executing program 5 (id=1961): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, &(0x7f0000000080)) sendmsg$inet_sctp(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x1}], 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="200000000000000084000000020000004a5f0000000000000000000203"], 0x20, 0x2400e044}, 0x0) 4.323491833s ago: executing program 3 (id=1962): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = fsopen(&(0x7f00000000c0)='debugfs\x00', 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, 0x0, 0x0, 0x4) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000440)={"db4c1421593cb4d3f8fe6094dc821bbbe06520701fc6de7b0349f34b0f8c556a9e9aff1355aab8d6da26d74608530f150f127f9e3f0a2f1fff0be9774c95d6c007c91903f78616596487bf50017c56b15385ab264cba5b168c62d971e67e6f3e73d60b5a8adbaaf2af8610c6a91c0a116f619adce4aa91d5a68faf8ee98693d32d8d8244381b5720ef596600e39491d216c22d0725904bab7d90fa8afb8fa04b707410aa300ef098609b4fa6dd77b1b7c321b1fc6356564ce3f90826be3a9a5be186ffc48eb13824e9dae77ed212a0f802074ff4f1725c4ad88cf5bbd36e3406bc59d96e82047631d8be9462ee7e54e5b2897c3fff38eabf67e1e160c2b5e18be06457844d89c9a606b7d25fbde713f4759da0bee1fabe3f71dcca63540f113a2b5edc4b327d1f9610377b97265d4aa875b4bc3c44bf8110d5df1beb1fe54794a0aa52dfc80df1caf7d812b4f1cdba1a6836b45ea2180d08439d411ce8e0755868cc839eaeac73e5d28f9f1990584038cf5fa6bee0c4095a27cc8c7b59519bf2a9bf1fedf54cc2dc6aea6c42c32de40c291e5f422f5c7792a08926af160fb379576dd81bac746232fb246817fc3248097914b75e83cc5eb518ce8fb643b34ca69c3b61f0d94e7db62dd480198d41e0862f1ec4429ab637569884a5ba446a0b09edfd986a2b3e15ee35bbd18610dad6271681ed240b0ffab9199b541013c0aadc36484da57511896c14776a41602aa1426edfbb828897d9c218b7936a0572840ebbc796e888a439b24e640324b511deb6ed0b2ce2f7567447826944b4f34101e492e8d20a2deda950e96e78f86d6d4c976f0c99041c94944309e6ce08d84a7c96677d570d9a57ec0506a4321d9e049b55be883ca3648c27772fc5dbaea5e6c2ded2ce72fb68989ae381fe1394cf6966ab04285d5ff8256bc2e85462b8d89aeeebd5432157c945b5dc1960d9282c6cc007fe029325d6078aef94d4954f956c71bcdf846f41392ebe0d3b289438d24ec4bc073617459a6b232445dd636a9f21140e14b162fd5ef1d626b0ff84884fd63d22cc1b05befb77ea937f3045cc15b125479b262c1e32fca75a5468423288c5776efee744b1fccb5e6d661d9d287cfa8582c96ea34a33c1bbc29c0035657da66a87150bbb885be5ee123e431fd793ea179a0fc77aaee66d874c0616cb32324826b36d0e27d14217ad1131cace3bae4ef82dfbc790e78de53a9bfbdb468bf0eb3ff134073b380858965de2d108862daf3fc6b49ad46f20832238aeaa5d010cf08e37938f0bb7bbeaa970c39ce9327a16fe07565708266ce9ef639bfa08538693b456228aa1c370d64ef9795b7cc208a2c528d381a042d149ed5c7f34ed26a7d5a4401b86434f054389e5dac7a4ee896e406d7b27240d925d478e0eb2202797832d3e2c74f4925ad58377b0d6ae9b97034f94"}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000004c0), 0x107080, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f0000000fc0)={0xfffffffffffffff7}) r6 = fsopen(&(0x7f0000000080)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000040)='source', &(0x7f0000000740)='//_:e\xa4/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\xa5\x94\x0e\x0et\x8d@\xdc\x03+\xcf\xbf\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) timer_getoverrun(r7) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 4.122911504s ago: executing program 5 (id=1963): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="8c0000000906010200000000000000000200ffff08000940000000390900020073797a310000000005000100070000005c0008801c000780180001"], 0x8c}, 0x1, 0x0, 0x0, 0x10000182}, 0x4000080) 3.924300009s ago: executing program 5 (id=1964): syz_emit_vhci(&(0x7f00000001c0)=@HCI_EVENT_PKT={0x4, @hci_ev_change_link_key_complete={{0x9, 0x3}, {0xe, 0xc8}}}, 0x6) creat(&(0x7f0000000400)='./bus\x00', 0x0) syz_emit_vhci(&(0x7f0000000140)=@HCI_SCODATA_PKT={0x3, {0x65, 0x24}, "6531f074c9f23ef7d625801fc0068430128eabd0e9c1fc9ca02da425b96b3ce6322b04ce"}, 0x28) r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000280), 0x22802, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$video(0x0, 0xf, 0x0) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x2}, 0x90) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) setsockopt$SO_TIMESTAMP(r5, 0x1, 0x3f, &(0x7f0000000280)=0x7, 0x4) sendmsg$inet(r5, &(0x7f0000000780)={&(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000001600)=[{&(0x7f0000000140)="be38", 0xffdf}], 0x1, &(0x7f0000001100)=ANY=[@ANYBLOB="1c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001c0000000000000000000000070000004404730001000000e736f53aa500a029b4fff380b1208d2517faab10d57912ea57285a512c15273dd90873706db2ce3f1fd2709c8fca22cf77f29736f1e80045368c6d61cfefe19acae96300000000000000022fa79f00000000d114c4e16cb59c3b813222b23474ebab0566f62853"], 0x40}, 0x0) read$char_usb(r5, &(0x7f0000000080)=""/139, 0xfdef) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000140)={0xc, 0x0, 0x0}) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x48, &(0x7f0000000000), 0x4) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000100)={0x28, 0x4, r6, 0x0, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x5}) r8 = io_uring_setup(0x2c23, 0x0) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r8, 0x13, &(0x7f0000000400)=[0xe758, 0x3], 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) 3.507443584s ago: executing program 3 (id=1965): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da05000000000001090224"], 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x100000000, 0xfa11, 0xffffffff}, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x32, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000071103a00000000009c050100000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000}, 0x10}, 0x94) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x40, 0x1781, 0x898, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xfa, 0x60, 0xc0, [{{0x9, 0x4, 0x0, 0x66, 0x2, 0x3, 0x1, 0x1, 0xc, {0x9, 0x21, 0xe, 0x4, 0x1, {0x22, 0x86f}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x6, 0x5, 0x5}}}}}]}}]}}, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x2, 0x5a, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x84) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000040)='cgroup.max.depth\x00', 0x2, 0x0) sendfile(r3, r3, 0x0, 0x5) preadv(0xffffffffffffffff, 0x0, 0x0, 0x5f, 0xfffffffc) close(0xffffffffffffffff) socket$rds(0x15, 0x5, 0x0) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, 0xffffffffffffffff, 0x0, 0x4004) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000e00)=ANY=[], 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) readv(0xffffffffffffffff, &(0x7f0000000600)=[{&(0x7f0000000740)=""/187, 0xbb}, {&(0x7f0000001c00)=""/4096, 0x1000}], 0x2) 1.62375182s ago: executing program 1 (id=1966): socket$nl_generic(0x10, 0x3, 0x10) io_setup(0x23, &(0x7f0000000280)=0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x0) pipe2$watch_queue(0x0, 0x80) r3 = add_key$user(&(0x7f00000000c0), &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000340)="eee8d80672e3cb2d1630e7c2937d377dd0b4083f41f08494cdb4ac47ca08a341b98de19d1c8bf89a2e7a0abb5a5af41f3322ba019a1af1cef76739ec6ea379e6c43795c997f7f0013415810000000000000002e6620b9bb7c8446855af6fdea8ea5b", 0x62, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r3, 0xffffffffffffffff, 0xdc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYRES64, @ANYRESDEC=r3, @ANYRESOCT=r0], 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x24040840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, 0x0, 0x8) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@remote, 0x4e23, 0x10000, 0x0, 0x812d5c, 0x12d5c}}, 0x44) sendmsg$sock(r5, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0xb00, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 1.540076682s ago: executing program 4 (id=1967): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f9015cc99e570000723c21c90b000000000000721a5dbb56a3d9e16e7c2179c9b5b24722944820e624fc5b17d0822ca4232c98a9936ba722475ca5", 0x72}, {&(0x7f0000000440)="63f805d7649496db72959832930469edc7b700c9e37eed5653ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d33330e2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb00"/135, 0x87}, {&(0x7f0000001400)="7f4ba13c5a27118dc920175650f0c9ba1809dd13a6e2d5b38f40adfa278c09e0e3bd05add4d780cd753b50f06f3b51f43761c7783f38ceaefc2dad57889d8b3a2d21314410f64ec2fa92e3a14b0141b39c020021d1edd011fbccb808a317fff4cf49aab12da619d67102048ec43c76cdb9d395e8b7b6e589d788aeeecb5080fc3d5ec6ccd656e49c0a642671d3fc363b46240bbc46ad965399b71db3c8f2b269b20870a3d2a6a8de5213b0f9d41c510c827056b7284391da244ec7653648b670f9a3483b314d861992ed7fb369eda093e1643c300b94d996fc592adb22c379be070ce5cd806da85a492dd4199cceb4c5b750222485325cf1073bf87e93bdf7da8af8f5f626541afd142e24ee8f4be9f038453c0edf500deabfe4d1a7a9de51df012bc2f3b767b3c03be6ace8c37ad571323cd363116e01f98a8ff8148d3900a65b788e99ddf9d9a2383f1730c7868d2dd031034bce5a77bd1ef3385105968be7bd830bde788092f657be36f89ea55ced486e18982d01339ed04a934a43c7b3be5e6bd03cbe773a938f621809345ec07cfceb013e3d76d500d97c8bee6ff54980ac3d221fcb35724ba64adb29ae8db909e097d78ff9542196635a14266944b850c9d436e96cc806a88090cbfc9db7ce83231bc043ded67966cfd68b800f6030a85f6bb070a2a5b372be2dacea7884b42e76e164af04e47f90ce0694623dce23cd1471f1a6029f68331317073e1a2d8cfb16f821c867d35a609649cf36aa781fa0a381f934844366d4e3ab8dd239c6ec35c15f307a7ed07869aacec38d787fd9c08e9dda1a28bf1a15b004bb1d88aa429ee8e927f5a1e1445685d8923cad92c90c79726d5e73dfe741de35498842cf51a4f09b97b1c14d33213705b95e84a8853fab4e1ced6faecea9d9203b038594bceb202a9d47f862c4f1853db9a0a7bf98ed9d2e3012358b38d092bd1ed7efb1a9e582ac5ef30c9b476e185f537f40ae8189528b480436122a939967e8d862e01172245ebced9f5251dd302e7e974c1db40be1e9e79799c27384caf6485e7c469b77cd6b28f71e39f84d2adbe074dd2bed6636e6853655adc3d1a47eff697e8edba53e6b281aea94798d82da7d3e86d09d869e5e345316eeeced4e15fc39234a0b0104e0b205c95eda632d0e86b095b284f441a62cb0e7262bc1967ee75f5c2d459011b0c15f4c85b02150a8834eda7f84cc96dde04e4abbdf5985a9c7218797820251b5804cae80c9a726afddf36793ae52cfb38e4e19740d6e07e4ed7c01001ab87b7fb12d5b70a75938d234c83d863b1763aec37b41d204fc319c6e802734ed681ea179fe6cad4857c3ca0e236e7b9867688d8bd7749e919f2d4f57f2249c9ccaf76a23760569b0fbde2db12ca0169e74982c1f4f0494aae13f4838b3f50d9ab0f6e328250d6fc34c0156e4b754c5c648b4ef8af32c91859f9706048f029634cefd0d767e8b7743262cb8a468ad37dfa47a745495e3f03cfa1d4ed71af55453c0a25fa1122a9054bcc4d9960c9a54f36b6db55154ab7dd19890d9f8ff3549e0fbd5a655319566b7f9c72be0242e7ffb59020356c3ffb5b9c43858e69d7b677a9bc5b8a64721a51b75a254e07199a73726834bea05901455ad53b38116b953c970b2002d0d1f91deb73ccb7266fbb21aa8555599daed7585575ef3efbd737f2523018ba4645d862889d5c3d91b12f04166db8bffecde54ee278d0d5351f3bf1f8902ff3f4c24a8c0c8a4e6addc9baadc471813589324d3128a1b193137c15c01be9f367317b1c885301ff8e9df728efa37df27f65eb0464055091f2ed469fdab48f413e3978f73ff9dffeb85453e841f86594612ac91b50add8d14910748bfa903033662f3e735ce6d299ce52338a96035aa89f63bd59d151fb20c38125236cbc0d795ac6f8da4cafc74714ed62a23b017e15adcaade58385b78c6945fb30a2539c42b1e415879433b9fb6966c6d19ed19f9f90cbd360d936a8b9f8e03bca5a83c063651b4636a7783bbda6417c83e470a16dfb115344a527436242ace9341432b5816b5e6609d97d600e142ca3cf74cbc00e1d9ee203cdfad339ce460b294f3931c5bd8ae6da8fc14d66a01bae4a212ef3d914e58c13217c8ad91628636b56257c7ca41b404cc2d4b5d50e26ebefc74656c62b1b4e9b6c5b6cc8d79101460f719d95925630bf99e042018439c50026513d680ea573620132ded57dea9e2da4e16f17dbc171642b1e80a3f41311ee73441302285668792160db6614fdb30d25a5719d2ae03ab98ea167597c48dd8197e7faf6189d801134462027901506c5ff1ae2558d96722217f65131d2f429693ae9fae19c101319473608976d08cc1c0d98f789b0c364e8aca574321ab2857af1015f1588afd313503085db4d99961a9391db06c10477ceb44199f1648594e8f9b452fafdab49b1962d02ee77ebd31b7931174a729fa943cb18102130e7e08eaba77df066069c2c3564fc85881ba0dad12c4f06a9e6dea9fea53931ff85e38505eb7ad60a52e2a8a248b3f4d0d55eee31f75f110c70e3b12409a79a5a98b0156c6d2a5d94604b8fa202b12746a365c708c671316cc0ffff6e9b7139b337953be22672a4910e1eb28cccc023b77028e20a6d377a339372f0dc235069f41c2692b0a3a7e0f315f4aebeef435a46b2e8b8462739293f9184c01b1434e87bf3fd48be54bf437056a1d2cff0c7aa52578013f96b1d5100ca936ff029cfd6f9a093621f684196ed7e1d363a97c647c34fe5f2370e7ab9dc718a1fc317779ab8a04bc12c01b778d17eea0b546bce03475fc6373c860714df0322dde550186c553ebd61ed18c0b80655f0827a63d209117ca23b026c1ad30bac4d43a4611292c7049f855b829a3a17fd2b83c142078beed8ca07b7cb7cd624705ccc160246c81174a4d3a9f2057caffe84b1ac073375e065c1ff4e9e22e7d87b3adb40f", 0x837}], 0x3}, 0x0) 1.319310979s ago: executing program 5 (id=1968): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="d5"], 0x24}}, 0x0) recvmmsg$unix(r1, &(0x7f0000001dc0)=[{{0x0, 0x0, &(0x7f0000001800)=[{&(0x7f00000002c0)=""/182, 0xb6}, {&(0x7f0000000380)=""/252, 0xfc}, {&(0x7f0000000480)=""/4096, 0x1000}, {0x0}, {&(0x7f0000000140)=""/52, 0x34}, {&(0x7f0000001480)=""/233, 0xe9}, {&(0x7f00000001c0)=""/78, 0x4e}, {&(0x7f0000001940)=""/157, 0x9d}, {&(0x7f0000001700)=""/194, 0xc2}], 0x9}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) write(r1, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r2, 0x80045007, 0x0) unshare(0x24060400) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x92, 0x5, 0x6, 0x4}, 0x3a, [0x8000, 0x2c95a, 0xf, 0x8, 0x80, 0x1, 0x1, 0x80000000, 0x20000006, 0x4d, 0x6, 0x5d, 0x8, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x5, 0x3c5b, 0x1, 0x24, 0xd, 0x3, 0x0, 0x800, 0x4, 0x4, 0x7, 0x3, 0x8, 0x10, 0x80000000, 0xfffffffe, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x40017, 0x0, 0x7, 0x5, 0x3e, 0x3, 0x6, 0xffff, 0x0, 0x9, 0x4, 0x8008, 0x400, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e6, 0x40c8, 0xf9, 0xe, 0x82c0, 0x6c7, 0x8, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x5, 0xea4, 0x0, 0x2, 0x7, 0x7fff, 0x1c000, 0x3fe, 0x403, 0x200006, 0x4, 0xff, 0x5, 0x1000005, 0x5f31, 0x2d, 0x4e2, 0x5, 0x4, 0xb, 0x2000004, 0x9, 0x80000001, 0x9, 0x6, 0x47, 0x8200, 0x1, 0xfe000000, 0x8, 0xffffffff, 0x4, 0x80004, 0x3, 0x51, 0x9, 0x1, 0x3, 0x3, 0x81, 0x48c93690, 0x42, 0x3], [0x7, 0x407, 0x7, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0xa2, 0x8000, 0x0, 0x5, 0xb, 0x5, 0x5, 0x5, 0x4000000, 0x1eb, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0x5, 0x2, 0xfffffffe, 0x3, 0x20000008, 0x4, 0x6d01, 0x2, 0x38, 0x800083, 0x200, 0x80, 0x3, 0x8000004, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x4005, 0x6, 0x8, 0xca, 0x1ff, 0x3, 0x7ff, 0xbe, 0x4, 0x7, 0xe, 0x0, 0x5, 0x1c, 0x8, 0x4, 0x8, 0x80a2ed, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2, 0x5, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x9, 0x2, 0x101, 0x10000, 0x2000004, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x6, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xffffffd9, 0xfffff000, 0x10010000, 0x0, 0x7e, 0x9, 0x9602, 0x40008, 0x8f, 0x5, 0x6, 0x7, 0x2, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf3c, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x1, 0xb1e, 0xd7, 0x201, 0xffff3441, 0x4]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 1.318640024s ago: executing program 4 (id=1969): syz_usb_connect(0x5, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007516b7108c0d0e008f8e0018030109021b0001000000000904", @ANYBLOB="8fcf"], 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCMGET(r0, 0x541e, &(0x7f0000000040)) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0xc0a85320, &(0x7f0000000180)={{0x80}, 'port0\x00', 0x7e, 0xa1c07, 0x6, 0x0, 0x100000}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x5, 0x7, 0x9, 0x3, 0x12, "4bf8269dc8c718c9d46b6fed87700d14836709"}) write$UHID_INPUT(r2, &(0x7f0000001040)={0xc, {"a2e3ad21ed0d52f91b5d360887f70e06d038e7ff7fc6e5539b3272298b089b07081b4d090890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b39070d075d0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc825d8e524b2451138e495bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546850a27af9544ae15a7e454dea05918b4fd42513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c9000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cfe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdc80c47ee4f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2691491abf8ab9c015073014d9e08d4338b8780bdecd436cf0541e4505bc3a45237f104b962102de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78ff95b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd735892892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af0000807e0000000002d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5407000000e3ad038f2211f1033195563c7f93cd54b9094f226e78b271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b4051db55e0510a6e4114a53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005008000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a6d8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546def271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652770711935f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f42f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599af40005b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fd30d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb84d9a88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678458fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000000000000000000000000bd700", 0x1000}}, 0x375) r3 = epoll_create(0x101) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000080)={0x40000014}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) socket$inet(0x2, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) rt_sigqueueinfo(0x0, 0xe, &(0x7f00000004c0)={0x22, 0x6, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) socket(0x10, 0x80002, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) open(&(0x7f00000001c0)='./cgroup\x00', 0x0, 0x157) 1.211757053s ago: executing program 2 (id=1970): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000000c0)=r3, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x803e000000000000) 1.116819487s ago: executing program 2 (id=1971): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000400"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r1}, &(0x7f0000000840), &(0x7f0000000880)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r1, &(0x7f0000000900), 0x0, 0x2000000}, 0x20) 1.111903225s ago: executing program 5 (id=1972): r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="840060004f00000076000000000000002700000000000095000000000000005a34973532de9a433e99d5c0c09cac0a312c1158807fad892d8455aabd831dfc9e37a4b8c6e2537181dc2cedc82ee773562bca151ed2ef5731f76dd6cfcb909498a6d0c328b02866b8fb8a40fec5eca436ef9f03c3ff79f2050e77498d7db4d96b4415b6f6faeb6442d10f9e50e32f909b39e498de0b3f4c9b4f353e662fbbbbfca9526e909e4f5821c1908465e57fbfaeb9205d95c14926921b0877158b0cda038622e2e85bb478417e63b45c1cf30efe733ae4fcf38536264a0616838af9d71d12d9e0c264267568f960086790e28d79fcb316a7eb8e37c4"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @cgroup_skb=0x1}, 0x94) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000780)=ANY=[@ANYRESHEX=r0], 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x7c9102, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000002540)=[{{&(0x7f0000000380)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000002100)=[{&(0x7f00000008c0)=""/139, 0x8b}, {&(0x7f0000000980)=""/130, 0x82}, {&(0x7f0000000a40)=""/4096, 0x1000}, {&(0x7f0000001d40)=""/111, 0x6f}, {&(0x7f0000000400)=""/64, 0x40}, {&(0x7f0000002b00)=""/257, 0x101}, {&(0x7f0000002700)=""/210, 0xd2}], 0x7, &(0x7f0000001a80)=""/219, 0xdb}, 0x3}, {{&(0x7f0000001b80)=@alg, 0x80, &(0x7f0000001f40)=[{&(0x7f0000001c00)=""/20, 0x14}, {&(0x7f0000001c40)=""/213, 0xd5}, {&(0x7f0000002600)=""/218, 0xda}, {&(0x7f0000001e40)=""/184, 0xb8}, {&(0x7f0000001f00)}], 0x5, &(0x7f0000001fc0)=""/13, 0xd}, 0x101}, {{&(0x7f0000002000)=@isdn, 0x80, &(0x7f00000023c0)=[{&(0x7f0000002800)=""/112, 0x70}, {&(0x7f00000006c0)=""/170, 0xaa}, {&(0x7f0000002200)=""/54, 0x36}, {&(0x7f0000000480)=""/112, 0x70}, {&(0x7f00000022c0)=""/222, 0xde}], 0x5, &(0x7f0000002440)=""/243, 0xf3}, 0x14001}], 0x3, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdb0}, 0xc000) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x5, 0x8, 0x0, 0xb}, 0x0) epoll_create(0x100) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x7c}}, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000001a40)=@req={0x1, 0xd, 0x338737d4}, 0x10) r5 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r5, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000500)="c4d694b35d155a12aec4d0474825efba5bc7e1253295b95dc06ef327e9b42ece0e5b6ab46ff9e431c344d24d84601609a9176c9631908d9d703aeaf16ef7ec217db85de8bb300b43759dc65f1b6ba7236350a558d3d333e3150e39ed8d79715141613c235f6d47522a6af5df05515f61b6ce9b54694a7eed07b6043c8d1bc6bf1794717fab59fd238c5793ef053ab8e90166a52a12f75465cac92e95c9f1fad850875653f0f6f22f5d895531a976", 0xae}, {&(0x7f00000007c0)="8f752daaeb5c0ccdee3764094c27cad70071d632cec33705423e6804b63642cb3168b7060bb1e8fc70cdee5fc72372e5d80c89ec3f3d550871c3eeb5202f4b8b36fd75f51933bf96a81cb6c169d70fd7fa0a96dc07eb4c473b7889340e38039c00ae5e045e83c0b58d4009d319638b029db6ba2a4a8fd51683a0e3d1147c4fa36a1dfb39f7ec36bd94975b1fd4aebe05a1ab50b26965b7d840cc508e47c76a50ad5e231414b34868098690aa956cf07d47542dd20520462bb9134197b5d4a05400f68f3d5f42660318bddb7c4a7dbcb6ccd63fa62c7c0ecbc66ede93675c110456c9065b2689d22d65", 0xe9}], 0x2}}], 0x1, 0x9200000000000000) setsockopt$sock_int(r4, 0x1, 0x5, 0x0, 0x0) recvfrom(r4, &(0x7f0000000140)=""/104, 0x68, 0x40000103, 0x0, 0x0) syz_usb_connect(0x3, 0x2d, 0x0, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002980)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYBLOB="3872b2663ffeca95251bc23187bb07c948c24d5dba59d1cc27f79139626947fe680457338cbdcc16c7a86b2c798cbe4c786b01c1e7080c8a34752d9374bad6a9381b3ba2ddfb83859facb45da9323f5b48e8740fd634dfab77b2aa0d892fb571574c993b1bc0c53c5089e9b671e8151aa8fbc3a65cd3802989712adb4150f1edb1873d6dbc62eda02dc6362fba6dbc5517637b9d6e4f0a5b42a668c292f03cd06edf8b625112d7aab25af7422da53513b9a09fed4c932111b5db1197f3bccdc02b94afc0ea67550c54bee3df8dba75a054781028a8f9fe6c1b3317c33a7e8ae95c5ec7488897ed5967dff6512e0504f5fab513a83642e58b9d0bb4", @ANYBLOB=',group_id=', @ANYRES16], 0x0, 0x0, 0x0) umount2(&(0x7f0000000180)='./file0\x00', 0x9) write$FUSE_NOTIFY_RETRIEVE(r6, &(0x7f00000021c0)={0x30, 0x5, 0x0, {0x0, 0x1, 0x3fe0000000000, 0xfffffffd}}, 0x30) 1.031205706s ago: executing program 2 (id=1973): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, &(0x7f0000000080)) sendmsg$inet_sctp(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x1}], 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="200000000000000084000000020000004a5f0000000000000000000203"], 0x20, 0x2400e044}, 0x0) 927.324943ms ago: executing program 2 (id=1974): socket$packet(0x11, 0x3, 0x300) syz_usb_connect(0x4, 0x1b, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x80, 0xdf, 0xf5, 0x8, 0x4cb, 0x113, 0xfb69, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9, 0x0, 0x2, 0x0, 0x90, 0x3}}]}}, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000000c0)=0xffffffffffffffff, 0x12) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3}, 0x50) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a32000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000040000000000a40000000160a01080000000000000000020000000900020073797a30000000000900010073797a3000000000140003800800024000000000080001400000000014000000110001"], 0x68}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETFLOWTABLE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="20000000170a010300"], 0x20}, 0x1, 0x0, 0x0, 0x44000}, 0x8094) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x4, 0x1, 0x0, 0x0, @adapter={0x80000001, 0x7fff, 0xfff, 0x80, 0x3}}]}) r7 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) io_setup(0x7e, &(0x7f0000000080)=0x0) r9 = open(&(0x7f0000000140)='./bus\x00', 0x14507e, 0x0) io_submit(r8, 0x1, &(0x7f0000001d00)=[&(0x7f00000000c0)={0x200000002000000, 0x0, 0x0, 0x7, 0x0, r9, &(0x7f0000000340)='p', 0x300, 0xeffdffffffffffff}]) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r11, 0x40505331, &(0x7f00000000c0)={{0x6, 0x9}, {0x0, 0x1}, 0x1, 0x5, 0x6}) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x50, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_BR_AGEING_TIME={0x8, 0x8, 0xffffa888}, @IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x7}, @IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xd}}]}}}]}, 0x50}}, 0x0) ioctl$VIDIOC_S_INPUT(0xffffffffffffffff, 0xc0045627, &(0x7f00000000c0)=0x3) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) 236.86927ms ago: executing program 1 (id=1975): setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, &(0x7f0000000000), 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000280), &(0x7f0000000200)="22cff5", 0x3, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0x10, 0x80000, 0x3) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9, 0x8, 0x88, 0x7ee}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=@newqdisc={0x98, 0x24, 0x100, 0x70bd2d, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x68, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION={0xc, 0x9, 0x8}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0xd], 0x0, [0x8, 0x4, 0x0, 0x1002, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}]}}]}, 0x98}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x122}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_80211_join_ibss(&(0x7f00000002c0)='wlan0\x00', &(0x7f0000000340)=@default_ap_ssid, 0x6, 0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000300)={0x0, 0x2, 0xffffffffffffffff, 0x7ff}) r5 = syz_open_dev$evdev(0x0, 0x3, 0x822b01) r6 = syz_open_dev$mouse(&(0x7f0000000680), 0x0, 0x14b200) write$char_usb(r5, &(0x7f0000000040)="e2", 0x918) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r7, &(0x7f0000000e80)={0x0, 0xe703, &(0x7f0000000e40)={&(0x7f00000002c0)={0x1c, r9, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x24004084}, 0x40000) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000024000103008000008000000011000000", @ANYRESHEX=r1, @ANYRES16=r5, @ANYRES16=r7], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f0000000440)=ANY=[@ANYBLOB="0e004900c30c4f6c2443a46b7669507256a770ffb2c30ee561aeffff0000207e45669624fb8cda074aa45fab27befe5230b7cb28b47d319ba7490cde0c89ac4cac0f39303864433d6ad46e98787facca381f5fb9594f0539aa4394b8f02e0eda01ffec66b08d31d7b5f898bd16cab483ec00006ac6d086b3000000000cf04b6e0000000000000000b99e12777a35ac446affd540bf07ed83f085bf039d9f40021d8851a299a0c3afd2b78f961f287f88612c490fffc7a646fc6391311be2644937eadcb2e3533a4b7bd014c493df14a2bf8892f6a9"], 0x89) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) 0s ago: executing program 2 (id=1976): openat$kvm(0xffffffffffffff9c, 0x0, 0x800, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000580)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000300)={0xc4, r3, 0x4, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x9, 0x19}}}}, [@NL80211_ATTR_MESH_CONFIG={0x54, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_ELEMENT_TTL={0x5, 0xf, 0x8}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5, 0x7, 0x2}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0x2}, @NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x3}, @NL80211_MESHCONF_CONFIRM_TIMEOUT={0x6, 0x2, 0xcf}, @NL80211_MESHCONF_MAX_PEER_LINKS={0x6, 0x4, 0xfd}, @NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT={0x8, 0x17, 0x80000000}, @NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0x41}, @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES={0x5, 0x8, 0x77}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5, 0x7, 0x9}]}, @NL80211_ATTR_MESH_CONFIG={0x34, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x10}, @NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0xf}, @NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL={0x6, 0x19, 0x1}, @NL80211_MESHCONF_HWMP_RANN_INTERVAL={0x6, 0x10, 0x8a5c}, @NL80211_MESHCONF_GATE_ANNOUNCEMENTS={0x5, 0x11, 0x1}, @NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0x5}]}, @NL80211_ATTR_MCAST_RATE={0x8}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x2}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}]}, 0xc4}, 0x1, 0x0, 0x0, 0x24040804}, 0x4000) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) syz_genetlink_get_family_id$nl80211(0x0, r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0) close(r5) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0x6}, {0xffe6, 0xb}, {0x7, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x8, 0x5, 0x8, 0xe, 0x5cb1, 0x80, 0x9e4, 0xa5}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008050) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) kernel console output (not intermixed with test programs): process `syz.3.1520'. [ 561.068100][T11243] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 561.237681][T11243] usb 5-1: Using ep0 maxpacket: 32 [ 561.252305][T11243] usb 5-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 561.261985][T11243] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.273527][T11243] usb 5-1: config 0 descriptor?? [ 561.289685][T11243] gspca_main: sq930x-2.14.0 probing 041e:403c [ 561.418758][ T5866] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 561.653696][ T5866] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 561.682824][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 561.714939][ T5866] usb 2-1: Product: syz [ 561.732012][ T5866] usb 2-1: Manufacturer: syz [ 561.734969][T11243] gspca_sq930x: ucbus_write failed -71 [ 561.747180][ T5866] usb 2-1: SerialNumber: syz [ 561.759607][T11243] sq930x 5-1:0.0: probe with driver sq930x failed with error -71 [ 561.791081][T11243] usb 5-1: USB disconnect, device number 82 [ 561.811829][T11641] fuse: Unknown parameter '0x0000000000000004' [ 561.819409][ T5866] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 561.838163][ T980] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 562.343466][ T5866] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 562.416962][ T5969] usb 3-1: new full-speed USB device number 85 using dummy_hcd [ 562.465079][T11243] usb 2-1: USB disconnect, device number 85 [ 562.522185][ T5866] usb 4-1: Using ep0 maxpacket: 32 [ 562.534160][ T5866] usb 4-1: unable to get BOS descriptor or descriptor too short [ 562.550675][ T5866] usb 4-1: config 5 has an invalid interface number: 196 but max is 0 [ 562.559159][ T5969] usb 3-1: device descriptor read/64, error -71 [ 562.578110][ T5866] usb 4-1: config 5 has no interface number 0 [ 562.616978][ T5866] usb 4-1: config 5 interface 196 has no altsetting 0 [ 562.682990][ T5866] usb 4-1: New USB device found, idVendor=045b, idProduct=0212, bcdDevice=18.36 [ 562.720705][ T5866] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.752710][ T5866] usb 4-1: Product: syz [ 562.764387][ T5866] usb 4-1: Manufacturer: syz [ 562.782458][ T5866] usb 4-1: SerialNumber: syz [ 562.816976][ T5969] usb 3-1: new full-speed USB device number 86 using dummy_hcd [ 562.917164][ T980] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 563.017383][ T5969] usb 3-1: device descriptor read/64, error -71 [ 563.032762][ T980] ath9k_htc: Failed to initialize the device [ 563.080315][T11243] usb 2-1: ath9k_htc: USB layer deinitialized [ 563.157459][ T5969] usb usb3-port1: attempt power cycle [ 563.214066][T11658] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0) [ 563.319885][ T5866] upd78f0730 4-1:5.196: upd78f0730 converter detected [ 563.369001][ T5866] usb 4-1: upd78f0730 converter now attached to ttyUSB0 [ 563.426966][ T5866] usb 4-1: USB disconnect, device number 79 [ 563.464682][ T5866] upd78f0730 ttyUSB0: upd78f0730 converter now disconnected from ttyUSB0 [ 563.487223][ T5866] upd78f0730 4-1:5.196: device disconnected [ 563.507660][ T5969] usb 3-1: new full-speed USB device number 87 using dummy_hcd [ 563.588892][ T5969] usb 3-1: device descriptor read/8, error -71 [ 563.637187][T11243] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 563.746920][ T43] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 563.827785][ T5969] usb 3-1: new full-speed USB device number 88 using dummy_hcd [ 563.868219][T11243] usb 2-1: Using ep0 maxpacket: 32 [ 563.868656][ T5969] usb 3-1: device descriptor read/8, error -71 [ 563.888513][T11243] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 563.901997][T11243] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 563.907069][ T43] usb 5-1: device descriptor read/64, error -71 [ 563.914922][T11243] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 563.931603][T11243] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 563.954429][T11243] usb 2-1: config 0 descriptor?? [ 563.969295][T11243] hub 2-1:0.0: USB hub found [ 563.990698][ T5969] usb usb3-port1: unable to enumerate USB device [ 564.156935][ T43] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 564.169606][T11243] hub 2-1:0.0: 1 port detected [ 564.216927][ T5961] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 564.287006][ T43] usb 5-1: device descriptor read/64, error -71 [ 564.287301][T11553] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 564.369460][ T5961] usb 6-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 564.382427][ T5961] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 564.393473][ T5961] usb 6-1: config 0 descriptor?? [ 564.403369][ T43] usb usb5-port1: attempt power cycle [ 564.446971][T11553] usb 4-1: Using ep0 maxpacket: 16 [ 564.454541][T11553] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 564.471801][T11553] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 564.481152][T11553] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.489374][T11553] usb 4-1: Product: syz [ 564.493595][T11553] usb 4-1: Manufacturer: syz [ 564.498336][T11553] usb 4-1: SerialNumber: syz [ 564.506542][T11553] usb 4-1: config 0 descriptor?? [ 564.612661][ T5961] usb 6-1: Cannot read MAC address [ 564.618463][ T5961] MOSCHIP usb-ethernet driver 6-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 564.633881][ T5961] usb 6-1: USB disconnect, device number 56 [ 564.746890][ T43] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 564.770505][ T43] usb 5-1: device descriptor read/8, error -71 [ 564.785608][T11243] hub 2-1:0.0: activate --> -90 [ 564.989506][T11243] usb 2-1-port1: config error [ 565.016876][ T43] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 565.037652][ T43] usb 5-1: device descriptor read/8, error -71 [ 565.147157][ T43] usb usb5-port1: unable to enumerate USB device [ 565.199071][ T5961] usb 2-1: USB disconnect, device number 86 [ 565.437932][ T43] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 565.606907][ T43] usb 6-1: Using ep0 maxpacket: 16 [ 565.616371][ T43] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 565.625692][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.633752][ T43] usb 6-1: Product: syz [ 565.643587][ T43] usb 6-1: Manufacturer: syz [ 565.648888][ T43] usb 6-1: SerialNumber: syz [ 565.661965][ T43] r8152-cfgselector 6-1: Unknown version 0x0000 [ 565.668362][ T43] r8152-cfgselector 6-1: config 0 descriptor?? [ 566.067459][ T5961] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 566.080977][ T5932] r8152-cfgselector 6-1: USB disconnect, device number 57 [ 566.217021][ T5961] usb 2-1: Using ep0 maxpacket: 16 [ 566.224109][ T5961] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 566.235269][ T5961] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 566.245111][ T5961] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 566.258107][ T5961] usb 2-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 566.267335][ T5961] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.277890][ T5961] usb 2-1: config 0 descriptor?? [ 566.707463][T11695] loop6: detected capacity change from 0 to 524288000 [ 566.878430][ T5961] hid_parser_main: 8 callbacks suppressed [ 566.878450][ T5961] shield 0003:0955:7214.0018: unknown main item tag 0x0 [ 566.895774][T11696] support for the xor transformation has been removed. [ 566.939532][ T5961] shield 0003:0955:7214.0018: unknown main item tag 0x0 [ 567.005669][ T5961] shield 0003:0955:7214.0018: unknown main item tag 0x0 [ 567.021187][ T5961] shield 0003:0955:7214.0018: unknown main item tag 0x0 [ 567.044096][ T5961] shield 0003:0955:7214.0018: unknown main item tag 0x0 [ 567.070531][T11690] random: crng reseeded on system resumption [ 567.079302][ T5961] input: HID 0955:7214 Haptics as /devices/virtual/input/input36 [ 567.219083][ T43] usb 4-1: USB disconnect, device number 80 [ 567.263125][ T5961] shield 0003:0955:7214.0018: Registered Thunderstrike controller [ 567.318983][ T5961] shield 0003:0955:7214.0018: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.1-1/input0 [ 567.887038][ T5961] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 568.046919][ T5961] usb 4-1: device descriptor read/64, error -71 [ 568.117001][ T43] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 568.361863][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.371795][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.391544][ T5961] usb 4-1: new full-speed USB device number 82 using dummy_hcd [ 568.399295][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 568.439373][ T43] usb 3-1: config 0 has an invalid interface number: 78 but max is 0 [ 568.490428][ T43] usb 3-1: config 0 has no interface number 0 [ 568.516887][ T980] shield 0003:0955:7214.0018: Failed to output Thunderstrike HOSTCMD request HID report due to -ESHUTDOWN [ 568.557168][ T43] usb 3-1: New USB device found, idVendor=0c98, idProduct=1140, bcdDevice=f0.21 [ 568.646599][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 568.647002][ T5961] usb 4-1: device descriptor read/64, error -71 [ 568.667113][ T43] usb 3-1: Product: syz [ 568.676798][ T43] usb 3-1: Manufacturer: syz [ 568.681486][ T43] usb 3-1: SerialNumber: syz [ 568.686222][ T980] shield 0003:0955:7214.0018: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 568.761408][ T5969] usb 2-1: reset high-speed USB device number 87 using dummy_hcd [ 568.789468][ T980] shield 0003:0955:7214.0018: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 568.818786][ T43] usb 3-1: config 0 descriptor?? [ 568.885046][ T980] shield 0003:0955:7214.0018: Failed to output Thunderstrike HOSTCMD request HID report due to -EPIPE [ 568.900130][ T5961] usb usb4-port1: attempt power cycle [ 568.924461][ T5969] usb 2-1: device descriptor read/64, error -32 [ 569.091779][ T43] pcwd_usb: This driver only supports 1 device [ 569.180758][ T43] usbhid 3-1:0.78: couldn't find an input interrupt endpoint [ 569.194247][ T43] usb 3-1: USB disconnect, device number 89 [ 569.306988][ T5961] usb 4-1: new full-speed USB device number 83 using dummy_hcd [ 569.337829][ T5961] usb 4-1: device descriptor read/8, error -71 [ 569.437026][ T5932] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 569.527605][ T5969] usb 2-1: reset high-speed USB device number 87 using dummy_hcd [ 569.540391][ T5969] usb 2-1: device reset changed ep0 maxpacket size! [ 569.553659][ T5866] usb 2-1: USB disconnect, device number 87 [ 569.576948][ T5932] usb 6-1: device descriptor read/64, error -71 [ 569.577072][ T5961] usb 4-1: new full-speed USB device number 84 using dummy_hcd [ 569.651922][ T5961] usb 4-1: device descriptor read/8, error -71 [ 569.756907][ T5866] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 569.779289][ T5961] usb usb4-port1: unable to enumerate USB device [ 569.826889][ T5932] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 569.942741][ T5866] usb 2-1: unable to get BOS descriptor or descriptor too short [ 569.965179][ T5866] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 569.966969][ T5932] usb 6-1: device descriptor read/64, error -71 [ 569.993500][ T5866] usb 2-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 570.023473][ T5866] usb 2-1: config 1 interface 0 has no altsetting 1 [ 570.049268][T11734] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1558'. [ 570.059795][ T5866] usb 2-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 570.071800][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 570.079890][ T5866] usb 2-1: Product: syz [ 570.084086][ T5866] usb 2-1: Manufacturer: syz [ 570.087304][ T5932] usb usb6-port1: attempt power cycle [ 570.105699][ T5866] usb 2-1: SerialNumber: syz [ 570.143120][ T5866] smsusb:smsusb_probe: board id=8, interface number 0 [ 570.392935][T11736] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1556'. [ 570.403393][T11736] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1556'. [ 570.468701][ T5932] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 570.507851][ T5932] usb 6-1: device descriptor read/8, error -71 [ 570.561658][T11738] dummy0: entered promiscuous mode [ 570.571824][T11738] dummy0: left promiscuous mode [ 570.764670][ T5932] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 570.813379][ T5932] usb 6-1: device descriptor read/8, error -71 [ 570.941633][ T5932] usb usb6-port1: unable to enumerate USB device [ 571.194297][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 571.194317][ T30] audit: type=1326 audit(1759108463.683:576): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11749 comm="syz.4.1564" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa0a858eec9 code=0x0 [ 572.007021][ T5961] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 572.187003][ T5961] usb 3-1: Using ep0 maxpacket: 16 [ 572.225255][ T5961] usb 3-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 572.290022][ T5961] usb 3-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 572.321492][ T5866] smsusb:smsusb_probe: usb_set_interface failed, rc -71 [ 572.345349][ T5961] usb 3-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 572.366918][ T5866] smsusb 2-1:1.0: probe with driver smsusb failed with error -71 [ 572.396977][ T5866] usb 2-1: USB disconnect, device number 88 [ 572.406189][ T5961] usb 3-1: config 1 interface 0 has no altsetting 0 [ 572.436441][ T5961] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 572.449596][ T5961] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.479595][ T5961] usb 3-1: Product: syz [ 572.507439][ T5961] usb 3-1: Manufacturer: syz [ 572.521496][ T5961] usb 3-1: SerialNumber: syz [ 572.686981][ T5962] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 572.755901][ T5961] usblp 3-1:1.0: usblp0: USB Unidirectional printer dev 90 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 572.857071][ T5962] usb 6-1: Using ep0 maxpacket: 8 [ 572.866412][ T5962] usb 6-1: config 0 has an invalid interface number: 78 but max is 0 [ 572.893157][ T5962] usb 6-1: config 0 has no interface number 0 [ 572.913584][ T5962] usb 6-1: New USB device found, idVendor=0c98, idProduct=1140, bcdDevice=f0.21 [ 572.917072][ T5932] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 572.930021][ T5962] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.940563][ T5962] usb 6-1: Product: syz [ 572.944784][ T5962] usb 6-1: Manufacturer: syz [ 572.950009][ T5962] usb 6-1: SerialNumber: syz [ 572.965846][ T5962] usb 6-1: config 0 descriptor?? [ 573.064343][T11757] usblp0:failed reading printer status (-32) [ 573.087090][ T5990] usb 2-1: new high-speed USB device number 89 using dummy_hcd [ 573.098546][ T5932] usb 5-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 573.108986][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 573.114292][ T5969] usb 3-1: USB disconnect, device number 90 [ 573.117165][ T5932] usb 5-1: Product: syz [ 573.117190][ T5932] usb 5-1: SerialNumber: syz [ 573.140052][ T5969] usblp0: removed [ 573.145855][ T5932] usb 5-1: config 0 descriptor?? [ 573.182494][ T5962] pcwd_usb: This driver only supports 1 device [ 573.191502][ T5962] usbhid 6-1:0.78: couldn't find an input interrupt endpoint [ 573.202943][ T5962] usb 6-1: USB disconnect, device number 62 [ 573.237044][ T5990] usb 2-1: device descriptor read/64, error -71 [ 573.257102][ T5961] usb 4-1: new full-speed USB device number 85 using dummy_hcd [ 573.421772][ T5961] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 573.431750][ T5961] usb 4-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 573.441020][ T5961] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.452398][ T5961] usb 4-1: config 0 descriptor?? [ 573.480923][ T5990] usb 2-1: new high-speed USB device number 90 using dummy_hcd [ 573.566036][ T5932] usb 5-1: USB disconnect, device number 87 [ 573.618832][ T5990] usb 2-1: device descriptor read/64, error -71 [ 573.734483][ T5990] usb usb2-port1: attempt power cycle [ 573.843482][T11791] netlink: 26 bytes leftover after parsing attributes in process `syz.5.1579'. [ 573.874597][ T5961] nintendo 0003:057E:200E.0019: unbalanced collection at end of report description [ 573.888572][ T5961] nintendo 0003:057E:200E.0019: HID parse failed [ 573.895402][ T5961] nintendo 0003:057E:200E.0019: probe - fail = -22 [ 573.902412][ T5961] nintendo 0003:057E:200E.0019: probe with driver nintendo failed with error -22 [ 573.937071][T11243] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 574.075787][ T5961] usb 4-1: USB disconnect, device number 85 [ 574.086973][ T5990] usb 2-1: new high-speed USB device number 91 using dummy_hcd [ 574.121701][T11243] usb 3-1: no configurations [ 574.126379][T11243] usb 3-1: can't read configurations, error -22 [ 574.166975][ T5990] usb 2-1: device descriptor read/8, error -71 [ 574.297066][T11243] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 574.426883][ T5990] usb 2-1: new high-speed USB device number 92 using dummy_hcd [ 574.457616][T11243] usb 3-1: no configurations [ 574.465187][T11243] usb 3-1: can't read configurations, error -22 [ 574.483038][ T5990] usb 2-1: device descriptor read/8, error -71 [ 574.505953][T11243] usb usb3-port1: attempt power cycle [ 574.610926][ T5990] usb usb2-port1: unable to enumerate USB device [ 574.867158][T11243] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 574.924818][T11243] usb 3-1: no configurations [ 574.934010][T11243] usb 3-1: can't read configurations, error -22 [ 575.077234][T11243] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 575.122118][T11243] usb 3-1: no configurations [ 575.146936][T11243] usb 3-1: can't read configurations, error -22 [ 575.171414][T11243] usb usb3-port1: unable to enumerate USB device [ 575.909889][T11811] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 576.352671][T11820] netlink: 'syz.1.1586': attribute type 21 has an invalid length. [ 576.458960][T11820] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1586'. [ 576.756950][ T5990] usb 2-1: new high-speed USB device number 93 using dummy_hcd [ 576.966862][ T5969] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 576.970300][ T5990] usb 2-1: Using ep0 maxpacket: 16 [ 577.075069][ T5990] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 577.137158][ T5990] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 577.158673][ T5969] usb 5-1: Using ep0 maxpacket: 16 [ 577.171247][ T5990] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 577.196699][ T5990] usb 2-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 577.210978][ T5990] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 577.220768][ T5969] usb 5-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 577.268761][ T5990] usb 2-1: config 0 descriptor?? [ 577.272256][ T5969] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.304266][ T5969] usb 5-1: Product: syz [ 577.322968][ T5969] usb 5-1: Manufacturer: syz [ 577.333742][ T5969] usb 5-1: SerialNumber: syz [ 577.384138][ T5969] r8152-cfgselector 5-1: Unknown version 0x0000 [ 577.465473][ T5969] r8152-cfgselector 5-1: config 0 descriptor?? [ 577.705606][ T5990] usbhid 2-1:0.0: can't add hid device: -71 [ 577.723891][ T5990] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 577.776409][ T5990] usb 2-1: USB disconnect, device number 93 [ 577.802850][T11835] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1590'. [ 577.920800][T11243] r8152-cfgselector 5-1: USB disconnect, device number 88 [ 578.142100][T11835] team0: Port device vlan0 removed [ 578.157084][ T5932] usb 4-1: new full-speed USB device number 86 using dummy_hcd [ 578.346233][ T5932] usb 4-1: config 0 has an invalid descriptor of length 32, skipping remainder of the config [ 578.382018][ T5932] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 578.456527][ T5932] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 578.502374][ T5932] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 65535, setting to 64 [ 578.567781][ T5932] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid maxpacket 25304, setting to 64 [ 578.628881][ T5932] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 578.637045][ T5962] usb 2-1: new high-speed USB device number 94 using dummy_hcd [ 578.643198][T11847] FAULT_INJECTION: forcing a failure. [ 578.643198][T11847] name failslab, interval 1, probability 0, space 0, times 0 [ 578.712539][ T5932] usb 4-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 578.736352][T11847] CPU: 0 UID: 0 PID: 11847 Comm: syz.4.1595 Not tainted syzkaller #0 PREEMPT(full) [ 578.736379][T11847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 578.736391][T11847] Call Trace: [ 578.736399][T11847] [ 578.736406][T11847] dump_stack_lvl+0x189/0x250 [ 578.736442][T11847] ? __pfx____ratelimit+0x10/0x10 [ 578.736468][T11847] ? __pfx_dump_stack_lvl+0x10/0x10 [ 578.736498][T11847] ? __pfx__printk+0x10/0x10 [ 578.736536][T11847] ? __pfx___might_resched+0x10/0x10 [ 578.736561][T11847] ? fs_reclaim_acquire+0x7d/0x100 [ 578.736587][T11847] should_fail_ex+0x414/0x560 [ 578.736616][T11847] should_failslab+0xa8/0x100 [ 578.736643][T11847] __kmalloc_cache_noprof+0x70/0x3d0 [ 578.736665][T11847] ? snd_pcm_hw_param_near+0x7f/0x500 [ 578.736696][T11847] snd_pcm_hw_param_near+0x7f/0x500 [ 578.736733][T11847] ? snd_pcm_oss_change_params_locked+0xff9/0x3e40 [ 578.736769][T11847] ? kfree+0x18e/0x440 [ 578.736796][T11847] ? snd_pcm_hw_param_value+0x2b9/0x510 [ 578.736831][T11847] snd_pcm_oss_change_params_locked+0x1048/0x3e40 [ 578.736892][T11847] ? __mutex_lock+0x335/0x1350 [ 578.736935][T11847] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 578.736971][T11847] ? aa_file_perm+0x44d/0x1550 [ 578.737015][T11847] ? _parse_integer_limit+0x1ae/0x1f0 [ 578.737041][T11847] ? __pfx_aa_file_perm+0x10/0x10 [ 578.737071][T11847] snd_pcm_oss_write+0x2fb/0x11a0 [ 578.737106][T11847] ? __lock_acquire+0xab9/0xd20 [ 578.737160][T11847] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 578.737198][T11847] ? bpf_lsm_file_permission+0x9/0x20 [ 578.737227][T11847] ? security_file_permission+0x75/0x290 [ 578.737262][T11847] ? rw_verify_area+0x255/0x4d0 [ 578.737297][T11847] vfs_writev+0x4b6/0x960 [ 578.737325][T11847] ? __pfx_snd_pcm_oss_write+0x10/0x10 [ 578.737366][T11847] ? __pfx_vfs_writev+0x10/0x10 [ 578.737408][T11847] ? __fget_files+0x2a/0x420 [ 578.737435][T11847] ? __fget_files+0x3a0/0x420 [ 578.737455][T11847] ? __fget_files+0x2a/0x420 [ 578.737487][T11847] do_writev+0x14d/0x2d0 [ 578.737515][T11847] ? __pfx_do_writev+0x10/0x10 [ 578.737535][T11847] ? rcu_is_watching+0x15/0xb0 [ 578.737565][T11847] ? do_syscall_64+0xbe/0x3b0 [ 578.737598][T11847] do_syscall_64+0xfa/0x3b0 [ 578.737625][T11847] ? lockdep_hardirqs_on+0x9c/0x150 [ 578.737650][T11847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.737674][T11847] ? clear_bhb_loop+0x60/0xb0 [ 578.737703][T11847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.737726][T11847] RIP: 0033:0x7fa0a858eec9 [ 578.737748][T11847] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 578.737769][T11847] RSP: 002b:00007fa0a94dd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 578.737794][T11847] RAX: ffffffffffffffda RBX: 00007fa0a87e5fa0 RCX: 00007fa0a858eec9 [ 578.737819][T11847] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003 [ 578.737835][T11847] RBP: 00007fa0a94dd090 R08: 0000000000000000 R09: 0000000000000000 [ 578.737850][T11847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 578.737864][T11847] R13: 00007fa0a87e6038 R14: 00007fa0a87e5fa0 R15: 00007fa0a890fa28 [ 578.737903][T11847] [ 579.051182][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 579.059356][ T5932] usb 4-1: Product: syz [ 579.063571][ T5932] usb 4-1: Manufacturer: syz [ 579.068291][ T5932] usb 4-1: SerialNumber: syz [ 579.069752][ T5962] usb 2-1: no configurations [ 579.077746][ T5962] usb 2-1: can't read configurations, error -22 [ 579.176380][T11850] FAULT_INJECTION: forcing a failure. [ 579.176380][T11850] name failslab, interval 1, probability 0, space 0, times 0 [ 579.189480][T11850] CPU: 1 UID: 0 PID: 11850 Comm: syz.4.1598 Not tainted syzkaller #0 PREEMPT(full) [ 579.189518][T11850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 579.189533][T11850] Call Trace: [ 579.189542][T11850] [ 579.189553][T11850] dump_stack_lvl+0x189/0x250 [ 579.189585][T11850] ? __pfx____ratelimit+0x10/0x10 [ 579.189610][T11850] ? __pfx_dump_stack_lvl+0x10/0x10 [ 579.189637][T11850] ? __pfx__printk+0x10/0x10 [ 579.189675][T11850] ? __pfx___might_resched+0x10/0x10 [ 579.189696][T11850] ? fs_reclaim_acquire+0x7d/0x100 [ 579.189723][T11850] should_fail_ex+0x414/0x560 [ 579.189762][T11850] should_failslab+0xa8/0x100 [ 579.189799][T11850] __kmalloc_cache_noprof+0x70/0x3d0 [ 579.189831][T11850] ? nf_tables_newchain+0x1d01/0x2900 [ 579.189867][T11850] nf_tables_newchain+0x1d01/0x2900 [ 579.189915][T11850] ? __pfx_nf_tables_newchain+0x10/0x10 [ 579.189984][T11850] ? nfnl_pernet+0x23/0x240 [ 579.190030][T11850] ? __nla_parse+0x40/0x60 [ 579.190059][T11850] nfnetlink_rcv+0x112f/0x2520 [ 579.190131][T11850] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 579.190185][T11850] ? ref_tracker_free+0x63a/0x7d0 [ 579.190239][T11850] ? __netlink_deliver_tap+0x807/0x850 [ 579.190265][T11850] ? netlink_deliver_tap+0x2e/0x1b0 [ 579.190311][T11850] netlink_unicast+0x82f/0x9e0 [ 579.190356][T11850] ? __pfx_netlink_unicast+0x10/0x10 [ 579.190395][T11850] ? netlink_sendmsg+0x642/0xb30 [ 579.190417][T11850] ? skb_put+0x11b/0x210 [ 579.190448][T11850] netlink_sendmsg+0x805/0xb30 [ 579.190484][T11850] ? __pfx_netlink_sendmsg+0x10/0x10 [ 579.190520][T11850] ? aa_sock_msg_perm+0xf1/0x1d0 [ 579.190545][T11850] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 579.190569][T11850] ? __pfx_netlink_sendmsg+0x10/0x10 [ 579.190595][T11850] __sock_sendmsg+0x219/0x270 [ 579.190634][T11850] ____sys_sendmsg+0x505/0x830 [ 579.190669][T11850] ? __pfx_____sys_sendmsg+0x10/0x10 [ 579.190708][T11850] ? import_iovec+0x74/0xa0 [ 579.190742][T11850] ___sys_sendmsg+0x21f/0x2a0 [ 579.190774][T11850] ? __pfx____sys_sendmsg+0x10/0x10 [ 579.190845][T11850] ? __fget_files+0x2a/0x420 [ 579.190864][T11850] ? __fget_files+0x3a0/0x420 [ 579.190897][T11850] __x64_sys_sendmsg+0x19b/0x260 [ 579.190928][T11850] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 579.190968][T11850] ? __pfx_ksys_write+0x10/0x10 [ 579.190996][T11850] ? rcu_is_watching+0x15/0xb0 [ 579.191024][T11850] ? do_syscall_64+0xbe/0x3b0 [ 579.191054][T11850] do_syscall_64+0xfa/0x3b0 [ 579.191078][T11850] ? lockdep_hardirqs_on+0x9c/0x150 [ 579.191100][T11850] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.191122][T11850] ? clear_bhb_loop+0x60/0xb0 [ 579.191150][T11850] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.191171][T11850] RIP: 0033:0x7fa0a858eec9 [ 579.191191][T11850] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 579.191211][T11850] RSP: 002b:00007fa0a94dd038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 579.191235][T11850] RAX: ffffffffffffffda RBX: 00007fa0a87e5fa0 RCX: 00007fa0a858eec9 [ 579.191252][T11850] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 579.191266][T11850] RBP: 00007fa0a94dd090 R08: 0000000000000000 R09: 0000000000000000 [ 579.191280][T11850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 579.191294][T11850] R13: 00007fa0a87e6038 R14: 00007fa0a87e5fa0 R15: 00007fa0a890fa28 [ 579.191329][T11850] [ 579.537407][ T5962] usb 2-1: new high-speed USB device number 95 using dummy_hcd [ 579.547991][ T5932] usb 4-1: config 0 descriptor?? [ 579.554253][T11836] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 579.562415][T11836] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 579.737453][ T5962] usb 2-1: no configurations [ 579.742343][ T5962] usb 2-1: can't read configurations, error -22 [ 579.749196][ T5962] usb usb2-port1: attempt power cycle [ 580.086862][ T5961] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 580.086922][T11243] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 580.095184][ T5962] usb 2-1: new high-speed USB device number 96 using dummy_hcd [ 580.141116][ T5962] usb 2-1: no configurations [ 580.145820][ T5962] usb 2-1: can't read configurations, error -22 [ 580.256855][ T5961] usb 6-1: Using ep0 maxpacket: 16 [ 580.262044][T11243] usb 3-1: no configurations [ 580.262076][T11243] usb 3-1: can't read configurations, error -22 [ 580.282409][ T5961] usb 6-1: config 0 has an invalid interface number: 8 but max is 0 [ 580.290714][ T5962] usb 2-1: new high-speed USB device number 97 using dummy_hcd [ 580.297000][T11553] usb 5-1: new full-speed USB device number 89 using dummy_hcd [ 580.299022][ T5961] usb 6-1: config 0 has no interface number 0 [ 580.326438][ T5961] usb 6-1: config 0 interface 8 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 580.342766][ T5962] usb 2-1: no configurations [ 580.354986][ T5962] usb 2-1: can't read configurations, error -22 [ 580.373802][ T5961] usb 6-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 580.385382][ T5962] usb usb2-port1: unable to enumerate USB device [ 580.392651][ T5961] usb 6-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 580.407077][T11243] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 580.421700][ T5961] usb 6-1: Product: syz [ 580.431413][ T5961] usb 6-1: SerialNumber: syz [ 580.440305][T11553] usb 5-1: device descriptor read/64, error -71 [ 580.450650][ T5961] usb 6-1: config 0 descriptor?? [ 580.470870][ T5961] usbhid 6-1:0.8: couldn't find an input interrupt endpoint [ 580.569006][T11243] usb 3-1: no configurations [ 580.574023][T11243] usb 3-1: can't read configurations, error -22 [ 580.585722][T11243] usb usb3-port1: attempt power cycle [ 580.686972][T11553] usb 5-1: new full-speed USB device number 90 using dummy_hcd [ 580.716851][ T5932] rc_core: IR keymap rc-snapstream-firefly not found [ 580.716877][ T5932] Registered IR keymap rc-empty [ 580.717987][ T5932] rc rc0: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 580.719701][ T5932] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input37 [ 580.774536][ T5932] input: syz syz mouse as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input38 [ 580.874416][T11553] usb 5-1: device descriptor read/64, error -71 [ 580.952401][T11243] usb 3-1: new high-speed USB device number 97 using dummy_hcd [ 580.979231][T11553] usb usb5-port1: attempt power cycle [ 581.077765][T11243] usb 3-1: no configurations [ 581.077791][T11243] usb 3-1: can't read configurations, error -22 [ 581.228496][T11243] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 581.268348][T11243] usb 3-1: no configurations [ 581.273210][T11243] usb 3-1: can't read configurations, error -22 [ 581.288733][T11243] usb usb3-port1: unable to enumerate USB device [ 581.343041][ T5961] usb 4-1: USB disconnect, device number 86 [ 581.343165][ C0] ati_remote 4-1:0.0: ati_remote_irq_in: usb_submit_urb()=-19 [ 581.500386][T11553] usb 5-1: new full-speed USB device number 91 using dummy_hcd [ 581.527483][T11553] usb 5-1: device descriptor read/8, error -71 [ 581.606093][ T5932] usb 6-1: USB disconnect, device number 63 [ 581.779827][T11553] usb 5-1: new full-speed USB device number 92 using dummy_hcd [ 581.818799][T11553] usb 5-1: device descriptor read/8, error -71 [ 581.940075][T11553] usb usb5-port1: unable to enumerate USB device [ 582.647051][ T5961] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 582.790587][T11900] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1614'. [ 582.874538][ T5961] usb 6-1: Using ep0 maxpacket: 32 [ 582.969130][T11902] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1615'. [ 583.457846][ T5961] usb 6-1: config 0 has an invalid interface number: 51 but max is 0 [ 583.548614][ T5961] usb 6-1: config 0 has no interface number 0 [ 583.733735][ T5961] usb 6-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 583.853086][ T5961] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 583.919455][ T5961] usb 6-1: Product: syz [ 583.932024][ T5961] usb 6-1: Manufacturer: syz [ 583.936718][ T5961] usb 6-1: SerialNumber: syz [ 583.977539][ T5961] usb 6-1: config 0 descriptor?? [ 584.118734][ T5961] quatech2 6-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 584.216988][ T5932] usb 2-1: new high-speed USB device number 98 using dummy_hcd [ 584.460977][ T5932] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 584.535066][ T5932] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 584.579358][ T5932] usb 2-1: Product: syz [ 584.591717][ T5932] usb 2-1: SerialNumber: syz [ 584.608241][ T5932] usb 2-1: config 0 descriptor?? [ 585.060881][ T5932] usb 2-1: USB disconnect, device number 98 [ 586.316883][ T43] usb 2-1: new full-speed USB device number 99 using dummy_hcd [ 586.610697][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 586.730935][ T43] usb 2-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 586.780246][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.816001][ T43] usb 2-1: config 0 descriptor?? [ 587.016906][ T5962] usb 3-1: new full-speed USB device number 99 using dummy_hcd [ 587.222340][ T5962] usb 3-1: no configurations [ 587.232624][ T5962] usb 3-1: can't read configurations, error -22 [ 587.326549][ T43] nintendo 0003:057E:200E.001A: unknown main item tag 0x0 [ 587.354730][ T43] nintendo 0003:057E:200E.001A: unknown main item tag 0x0 [ 587.413374][ T5962] usb 3-1: new full-speed USB device number 100 using dummy_hcd [ 587.421310][ T43] nintendo 0003:057E:200E.001A: unbalanced collection at end of report description [ 587.471787][ T5961] usb 6-1: qt2_attach - failed to power on unit: -71 [ 587.481105][ T43] nintendo 0003:057E:200E.001A: HID parse failed [ 587.558457][ T5961] quatech2 6-1:0.51: probe with driver quatech2 failed with error -71 [ 587.601444][ T43] nintendo 0003:057E:200E.001A: probe - fail = -22 [ 587.644642][ T5962] usb 3-1: no configurations [ 587.657233][ T43] nintendo 0003:057E:200E.001A: probe with driver nintendo failed with error -22 [ 587.666649][ T5962] usb 3-1: can't read configurations, error -22 [ 587.684202][ T5961] usb 6-1: USB disconnect, device number 64 [ 587.715503][ T5962] usb usb3-port1: attempt power cycle [ 587.771510][ T43] usb 2-1: USB disconnect, device number 99 [ 588.132789][ T5962] usb 3-1: new full-speed USB device number 101 using dummy_hcd [ 588.190170][ T5962] usb 3-1: no configurations [ 588.205188][ T5962] usb 3-1: can't read configurations, error -22 [ 588.386842][ T5962] usb 3-1: new full-speed USB device number 102 using dummy_hcd [ 588.408255][ T5962] usb 3-1: no configurations [ 588.412900][ T5962] usb 3-1: can't read configurations, error -22 [ 588.428442][ T5962] usb usb3-port1: unable to enumerate USB device [ 591.667287][T12005] fuse: Bad value for 'fd' [ 592.373769][T11990] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 592.484166][T11990] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 592.500812][T11990] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 592.521973][T11990] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 592.539169][T11990] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 592.866844][T11553] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 593.033599][T11553] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 593.054937][T11553] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 593.063396][T11243] usb 3-1: new full-speed USB device number 103 using dummy_hcd [ 593.093613][T11553] usb 6-1: Product: syz [ 593.104882][T11553] usb 6-1: Manufacturer: syz [ 593.135934][T11553] usb 6-1: SerialNumber: syz [ 593.157201][ T5874] Bluetooth: hci1: command 0x0406 tx timeout [ 593.164170][T11553] usb 6-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 593.203219][ T5932] usb 6-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 593.253652][T11243] usb 3-1: no configurations [ 593.263578][T11243] usb 3-1: can't read configurations, error -22 [ 593.408954][T11243] usb 3-1: new full-speed USB device number 104 using dummy_hcd [ 593.577729][T11243] usb 3-1: no configurations [ 593.594762][T11243] usb 3-1: can't read configurations, error -22 [ 593.624946][T11243] usb usb3-port1: attempt power cycle [ 593.860082][ T5969] usb 6-1: USB disconnect, device number 65 [ 593.977338][ T43] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 594.048681][T11243] usb 3-1: new full-speed USB device number 105 using dummy_hcd [ 594.119023][T11243] usb 3-1: no configurations [ 594.132676][T11243] usb 3-1: can't read configurations, error -22 [ 594.204039][ T43] usb 4-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 594.216965][ T43] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 594.232038][ T43] usb 4-1: config 0 descriptor?? [ 594.277297][ T5932] ath9k_htc 6-1:1.0: ath9k_htc: Target is unresponsive [ 594.309588][T11243] usb 3-1: new full-speed USB device number 106 using dummy_hcd [ 594.328217][ T5932] ath9k_htc: Failed to initialize the device [ 594.404899][ T5969] usb 6-1: ath9k_htc: USB layer deinitialized [ 594.416467][T11243] usb 3-1: no configurations [ 594.476502][T11243] usb 3-1: can't read configurations, error -22 [ 594.526910][ T5874] Bluetooth: hci3: command 0x0406 tx timeout [ 594.527316][ T5186] Bluetooth: hci2: command 0x0406 tx timeout [ 594.564088][T11243] usb usb3-port1: unable to enumerate USB device [ 594.600840][ T5186] Bluetooth: hci0: command 0x0406 tx timeout [ 594.608002][ T5186] Bluetooth: hci4: command 0x0406 tx timeout [ 595.641785][ T43] pegasus 4-1:0.0: probe with driver pegasus failed with error -32 [ 596.622865][T12056] fuse: Unknown parameter 'root' [ 597.682162][ T5969] usb 4-1: USB disconnect, device number 87 [ 598.636954][T11243] usb 5-1: new full-speed USB device number 93 using dummy_hcd [ 598.826647][T12077] binder: 12074:12077 ioctl 801c581f 2000000002c0 returned -22 [ 598.849072][T11243] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 598.892546][T11243] usb 5-1: New USB device found, idVendor=5543, idProduct=0064, bcdDevice= 0.00 [ 598.960515][T11243] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 599.002766][T11243] usb 5-1: config 0 descriptor?? [ 599.029453][T12071] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 599.186869][ T5969] usb 6-1: new full-speed USB device number 66 using dummy_hcd [ 599.407475][ T5969] usb 6-1: no configurations [ 599.427007][ T5969] usb 6-1: can't read configurations, error -22 [ 599.586933][ T5969] usb 6-1: new full-speed USB device number 67 using dummy_hcd [ 599.681191][T11243] usbhid 5-1:0.0: can't add hid device: -71 [ 599.701178][T11243] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 599.747429][T11243] usb 5-1: USB disconnect, device number 93 [ 599.776877][T11553] usb 4-1: new high-speed USB device number 88 using dummy_hcd [ 599.781045][ T5969] usb 6-1: no configurations [ 599.815319][ T5969] usb 6-1: can't read configurations, error -22 [ 599.830881][ T5969] usb usb6-port1: attempt power cycle [ 599.986993][T11553] usb 4-1: device descriptor read/64, error -71 [ 600.186975][ T5969] usb 6-1: new full-speed USB device number 68 using dummy_hcd [ 600.250323][ T5969] usb 6-1: no configurations [ 600.255009][ T5969] usb 6-1: can't read configurations, error -22 [ 600.271800][T11553] usb 4-1: new high-speed USB device number 89 using dummy_hcd [ 600.407012][ T5969] usb 6-1: new full-speed USB device number 69 using dummy_hcd [ 600.417297][T11553] usb 4-1: device descriptor read/64, error -71 [ 600.441768][ T5969] usb 6-1: no configurations [ 600.450969][ T5969] usb 6-1: can't read configurations, error -22 [ 600.475125][ T5969] usb usb6-port1: unable to enumerate USB device [ 600.533980][T12100] netlink: 164 bytes leftover after parsing attributes in process `syz.1.1674'. [ 600.569936][T11553] usb usb4-port1: attempt power cycle [ 600.937152][T11553] usb 4-1: new high-speed USB device number 90 using dummy_hcd [ 601.028364][T11553] usb 4-1: device descriptor read/8, error -71 [ 601.036874][T11243] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 601.250169][T11243] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 601.261603][T11243] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 601.271597][T11243] usb 3-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 601.282931][T11243] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.300347][T11243] usb 3-1: config 0 descriptor?? [ 601.326939][T11553] usb 4-1: new high-speed USB device number 91 using dummy_hcd [ 601.377771][T11553] usb 4-1: device descriptor read/8, error -71 [ 601.519490][T11553] usb usb4-port1: unable to enumerate USB device [ 601.937085][T11553] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 602.123089][T11553] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 602.132687][T11553] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.140881][T11553] usb 5-1: Product: syz [ 602.145619][T11553] usb 5-1: Manufacturer: syz [ 602.150537][T11243] usb 2-1: new high-speed USB device number 100 using dummy_hcd [ 602.160686][T11553] usb 5-1: SerialNumber: syz [ 602.173892][T11553] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 602.194582][ T5990] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 602.316990][T11243] usb 2-1: Using ep0 maxpacket: 16 [ 602.324223][T11243] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 602.335906][T11243] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 602.350077][T11243] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 602.359435][T11243] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 602.367946][T11243] usb 2-1: Product: syz [ 602.372214][T11243] usb 2-1: Manufacturer: syz [ 602.377073][T11243] usb 2-1: SerialNumber: syz [ 602.384734][T11243] usb 2-1: config 0 descriptor?? [ 602.404904][T11243] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 602.414422][T11243] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 602.807220][ T5969] usb 5-1: USB disconnect, device number 94 [ 603.005915][T11243] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 603.024775][T11243] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 603.031113][T12128] ptrace attach of "./syz-executor exec"[5888] was attempted by "./syz-executor exec"[12128] [ 603.056008][T11243] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 603.072170][T11243] em28xx 2-1:0.0: No AC97 audio processor [ 603.243621][ T5990] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 603.262674][ T5990] ath9k_htc: Failed to initialize the device [ 603.286031][ T5969] usb 5-1: ath9k_htc: USB layer deinitialized [ 603.810680][ T5969] usb 3-1: USB disconnect, device number 107 [ 603.827692][ T5990] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 603.893147][T12138] FAULT_INJECTION: forcing a failure. [ 603.893147][T12138] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 603.906879][T12138] CPU: 1 UID: 0 PID: 12138 Comm: syz.2.1686 Not tainted syzkaller #0 PREEMPT(full) [ 603.906918][T12138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 603.906933][T12138] Call Trace: [ 603.906942][T12138] [ 603.906952][T12138] dump_stack_lvl+0x189/0x250 [ 603.906985][T12138] ? __pfx____ratelimit+0x10/0x10 [ 603.907010][T12138] ? __pfx_dump_stack_lvl+0x10/0x10 [ 603.907038][T12138] ? __pfx__printk+0x10/0x10 [ 603.907069][T12138] ? __might_fault+0xb0/0x130 [ 603.907115][T12138] should_fail_ex+0x414/0x560 [ 603.907156][T12138] _copy_from_user+0x2d/0xb0 [ 603.907187][T12138] kstrtouint_from_user+0xc4/0x170 [ 603.907216][T12138] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 603.907261][T12138] proc_fail_nth_write+0x88/0x200 [ 603.907288][T12138] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 603.907321][T12138] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 603.907349][T12138] vfs_write+0x27b/0xb30 [ 603.907391][T12138] ? __pfx_vfs_write+0x10/0x10 [ 603.907423][T12138] ? __fget_files+0x2a/0x420 [ 603.907449][T12138] ? __fget_files+0x3a0/0x420 [ 603.907467][T12138] ? __fget_files+0x2a/0x420 [ 603.907498][T12138] ksys_write+0x145/0x250 [ 603.907531][T12138] ? __pfx_ksys_write+0x10/0x10 [ 603.907557][T12138] ? rcu_is_watching+0x15/0xb0 [ 603.907586][T12138] ? do_syscall_64+0xbe/0x3b0 [ 603.907616][T12138] do_syscall_64+0xfa/0x3b0 [ 603.907640][T12138] ? lockdep_hardirqs_on+0x9c/0x150 [ 603.907663][T12138] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.907684][T12138] ? clear_bhb_loop+0x60/0xb0 [ 603.907711][T12138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.907733][T12138] RIP: 0033:0x7f51b6f8d97f [ 603.907753][T12138] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 603.907772][T12138] RSP: 002b:00007f51b51f6030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 603.907795][T12138] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f51b6f8d97f [ 603.907811][T12138] RDX: 0000000000000001 RSI: 00007f51b51f60a0 RDI: 0000000000000004 [ 603.907824][T12138] RBP: 00007f51b51f6090 R08: 0000000000000000 R09: 0000000000000000 [ 603.907838][T12138] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 603.907851][T12138] R13: 00007f51b71e6038 R14: 00007f51b71e5fa0 R15: 00007f51b730fa28 [ 603.907887][T12138] [ 603.909974][T11243] usb 4-1: new high-speed USB device number 92 using dummy_hcd [ 604.007646][T12141] openvswitch: netlink: Unexpected mask (mask=810, allowed=10058) [ 604.097117][ T5990] usb 5-1: device descriptor read/64, error -71 [ 604.235232][T12145] netlink: 'syz.2.1688': attribute type 3 has an invalid length. [ 604.246927][T11243] usb 4-1: Using ep0 maxpacket: 8 [ 604.248038][T12145] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1688'. [ 604.278920][T11243] usb 4-1: config 0 has an invalid interface number: 254 but max is 2 [ 604.289043][T11243] usb 4-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 604.298979][T11243] usb 4-1: config 0 has an invalid interface number: 127 but max is 2 [ 604.319315][T11243] usb 4-1: config 0 has an invalid interface number: 221 but max is 2 [ 604.331083][T11243] usb 4-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 604.352901][T11243] usb 4-1: config 0 has no interface number 0 [ 604.364925][T11243] usb 4-1: config 0 has no interface number 1 [ 604.372144][T11243] usb 4-1: config 0 has no interface number 2 [ 604.378727][T11243] usb 4-1: config 0 interface 254 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 604.390734][T11243] usb 4-1: config 0 interface 254 altsetting 255 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 604.404767][T11243] usb 4-1: config 0 interface 254 altsetting 255 has a duplicate endpoint with address 0x1, skipping [ 604.425682][T11243] usb 4-1: config 0 interface 254 altsetting 255 has a duplicate endpoint with address 0xC, skipping [ 604.440506][ T5990] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 604.448899][T11243] usb 4-1: config 0 interface 254 altsetting 255 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 604.463493][T11243] usb 4-1: config 0 interface 254 altsetting 255 has an invalid descriptor for endpoint zero, skipping [ 604.474848][T11243] usb 4-1: config 0 interface 254 altsetting 255 bulk endpoint 0x2 has invalid maxpacket 64 [ 604.485298][T11243] usb 4-1: config 0 interface 254 altsetting 255 has a duplicate endpoint with address 0xC, skipping [ 604.496337][T11243] usb 4-1: config 0 interface 127 altsetting 64 has a duplicate endpoint with address 0x8, skipping [ 604.514140][T11243] usb 4-1: config 0 interface 127 altsetting 64 endpoint 0xA has invalid maxpacket 1024, setting to 64 [ 604.525335][T11243] usb 4-1: config 0 interface 127 altsetting 64 has an invalid descriptor for endpoint zero, skipping [ 604.537391][T11243] usb 4-1: config 0 interface 127 altsetting 64 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 604.548684][T11243] usb 4-1: config 0 interface 127 altsetting 64 has a duplicate endpoint with address 0x5, skipping [ 604.559583][T11243] usb 4-1: config 0 interface 221 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 604.570578][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0xC, skipping [ 604.582020][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0x4, skipping [ 604.596911][ T5990] usb 5-1: device descriptor read/64, error -71 [ 604.607274][ T5969] usb 3-1: new full-speed USB device number 108 using dummy_hcd [ 604.617151][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0x7, skipping [ 604.637022][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 604.648262][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 604.659150][T11243] usb 4-1: config 0 interface 221 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 604.670684][T11243] usb 4-1: config 0 interface 221 altsetting 0 has an endpoint descriptor with address 0x4B, changing to 0xB [ 604.683023][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0xB, skipping [ 604.695000][T11243] usb 4-1: config 0 interface 221 altsetting 0 has an endpoint descriptor with address 0x72, changing to 0x2 [ 604.708276][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 604.719544][T11243] usb 4-1: config 0 interface 221 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 604.731287][ T5990] usb usb5-port1: attempt power cycle [ 604.739973][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0x7, skipping [ 604.751734][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 604.763100][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 604.774122][T11243] usb 4-1: config 0 interface 221 altsetting 0 has a duplicate endpoint with address 0xC, skipping [ 604.778965][ T5969] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 604.784955][T11243] usb 4-1: config 0 interface 221 altsetting 0 has 16 endpoint descriptors, different from the interface descriptor's value: 15 [ 604.795648][ T5969] usb 3-1: config 0 has no interfaces? [ 604.813829][T11243] usb 4-1: config 0 interface 254 has no altsetting 0 [ 604.815315][ T5969] usb 3-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 604.823031][T11243] usb 4-1: config 0 interface 127 has no altsetting 0 [ 604.835955][ T5969] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.856415][T11243] usb 4-1: New USB device found, idVendor=0af0, idProduct=d257, bcdDevice=61.f1 [ 604.863303][ T5969] usb 3-1: config 0 descriptor?? [ 604.874118][T11243] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.889534][T11243] usb 4-1: Product: syz [ 604.899013][T12158] capability: warning: `syz.5.1692' uses deprecated v2 capabilities in a way that may be insecure [ 604.924630][T11243] usb 4-1: Manufacturer: syz [ 604.939116][T11243] usb 4-1: SerialNumber: syz [ 604.948324][T11243] usb 4-1: config 0 descriptor?? [ 604.956164][T12133] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 604.968231][ T5969] usb 2-1: USB disconnect, device number 100 [ 604.975782][ T5969] em28xx 2-1:0.0: Disconnecting em28xx [ 604.994471][ T5969] em28xx 2-1:0.0: Freeing device [ 605.087463][ T5990] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 605.127555][ T5990] usb 5-1: device descriptor read/8, error -71 [ 605.154109][T12161] bridge0: port 2(bridge_slave_1) entered disabled state [ 605.191586][T12162] netlink: 'syz.1.1693': attribute type 6 has an invalid length. [ 605.215711][T12133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 605.297493][T12133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 605.325321][T11243] hso 4-1:0.254: Not our interface [ 605.367974][ T5990] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 605.388517][ T5990] usb 5-1: device descriptor read/8, error -71 [ 605.435122][T11243] hso 4-1:0.221: Not our interface [ 605.474815][T11243] usb 4-1: USB disconnect, device number 92 [ 605.527862][ T5990] usb usb5-port1: unable to enumerate USB device [ 605.656979][ T5969] usb 2-1: new high-speed USB device number 101 using dummy_hcd [ 605.836870][ T5969] usb 2-1: Using ep0 maxpacket: 16 [ 605.854637][ T5969] usb 2-1: config 0 interface 0 has no altsetting 0 [ 605.894825][ T5969] usb 2-1: New USB device found, idVendor=0dfc, idProduct=0101, bcdDevice= 0.00 [ 605.935196][T12176] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1696'. [ 605.951889][ T5969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.014562][ T5969] usb 2-1: config 0 descriptor?? [ 606.224954][T12181] netlink: 72 bytes leftover after parsing attributes in process `syz.5.1698'. [ 606.234334][ T5969] usbhid 2-1:0.0: can't add hid device: -71 [ 606.241636][ T5969] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 606.254321][ T5969] usb 2-1: USB disconnect, device number 101 [ 606.256983][ T5990] usb 4-1: new high-speed USB device number 93 using dummy_hcd [ 606.427252][ T5990] usb 4-1: Using ep0 maxpacket: 32 [ 606.440483][ T5990] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 606.454512][ T5990] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 606.465815][ T5990] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 606.475848][ T5990] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 606.493836][ T5990] usb 4-1: config 0 descriptor?? [ 606.542900][ T5990] hub 4-1:0.0: USB hub found [ 606.871827][ T5990] hub 4-1:0.0: 1 port detected [ 607.116901][ T5969] usb 2-1: new high-speed USB device number 102 using dummy_hcd [ 607.307207][ T5969] usb 2-1: Using ep0 maxpacket: 16 [ 607.325088][ T5969] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 607.339569][ T5969] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 607.354198][ T5969] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 607.364443][ T5969] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.376176][ T5969] usb 2-1: Product: syz [ 607.381072][ T5969] usb 2-1: Manufacturer: syz [ 607.386100][ T5969] usb 2-1: SerialNumber: syz [ 607.394881][ T5969] usb 2-1: config 0 descriptor?? [ 607.407479][ T5969] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 607.417042][ T5969] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 607.494278][ T5990] hub 4-1:0.0: activate --> -90 [ 607.704628][ T5990] hub 4-1:0.0: hub_ext_port_status failed (err = 0) [ 607.997287][T11553] usb 3-1: USB disconnect, device number 108 [ 608.030264][ T5969] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 608.030875][ T5990] usb 4-1: USB disconnect, device number 93 [ 608.067393][ T5969] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 608.102079][ T5969] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 608.139726][ T5969] em28xx 2-1:0.0: No AC97 audio processor [ 608.866971][T11553] usb 4-1: new high-speed USB device number 94 using dummy_hcd [ 609.007013][T11553] usb 4-1: device descriptor read/64, error -71 [ 609.286916][T11553] usb 4-1: new high-speed USB device number 95 using dummy_hcd [ 609.427957][T11553] usb 4-1: device descriptor read/64, error -71 [ 609.558117][T11553] usb usb4-port1: attempt power cycle [ 609.676969][ T5961] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 609.839903][ T5961] usb 5-1: device descriptor read/64, error -71 [ 609.896956][T11553] usb 4-1: new high-speed USB device number 96 using dummy_hcd [ 609.937573][T11553] usb 4-1: device descriptor read/8, error -71 [ 609.970075][ T5969] usb 2-1: USB disconnect, device number 102 [ 609.977558][ T5969] em28xx 2-1:0.0: Disconnecting em28xx [ 609.998060][ T5969] em28xx 2-1:0.0: Freeing device [ 610.167208][ T5961] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 610.187162][T11553] usb 4-1: new high-speed USB device number 97 using dummy_hcd [ 610.227575][T11553] usb 4-1: device descriptor read/8, error -71 [ 610.340233][ T5961] usb 5-1: device descriptor read/64, error -71 [ 610.358270][T11553] usb usb4-port1: unable to enumerate USB device [ 610.487320][ T5961] usb usb5-port1: attempt power cycle [ 610.636897][T11553] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 610.689562][ T5969] usb 2-1: new high-speed USB device number 103 using dummy_hcd [ 610.800358][T11553] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 610.810968][T11553] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 610.820374][T11553] usb 3-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 610.830054][T11553] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.839936][ T5961] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 610.849753][T11553] usb 3-1: config 0 descriptor?? [ 610.853705][ T5969] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 610.870597][ T5969] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 610.880561][ T5961] usb 5-1: device descriptor read/8, error -71 [ 610.890618][ T5969] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.901568][ T5969] usb 2-1: config 0 descriptor?? [ 611.138516][ T5961] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 611.176785][ T5961] usb 5-1: device descriptor read/8, error -71 [ 611.287513][ T5961] usb usb5-port1: unable to enumerate USB device [ 611.322984][ T5969] keytouch 0003:0926:3333.001B: fixing up Keytouch IEC report descriptor [ 611.352515][ T5969] input: HID 0926:3333 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:0926:3333.001B/input/input39 [ 611.486250][ T5969] keytouch 0003:0926:3333.001B: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.1-1/input0 [ 612.367030][ T5990] usb 4-1: new high-speed USB device number 98 using dummy_hcd [ 612.529438][ T5990] usb 4-1: Using ep0 maxpacket: 8 [ 612.665752][ T5990] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 612.703364][ T5990] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 612.723282][ T5990] usb 4-1: Product: syz [ 612.735860][ T5990] usb 4-1: Manufacturer: syz [ 612.752568][ T5990] usb 4-1: SerialNumber: syz [ 612.789206][ T5990] usb 4-1: config 0 descriptor?? [ 612.850176][ T5990] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 613.467134][ T43] usb 3-1: USB disconnect, device number 109 [ 613.567686][ T5969] usb 2-1: USB disconnect, device number 103 [ 613.609113][T12277] netlink: 92 bytes leftover after parsing attributes in process `syz.2.1724'. [ 613.698787][T11553] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 613.897335][T11553] usb 6-1: Using ep0 maxpacket: 16 [ 613.913533][T11553] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 613.941834][T11553] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 613.960212][T11553] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 613.970804][T11553] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 613.980429][T11553] usb 6-1: Product: syz [ 613.984730][T11553] usb 6-1: Manufacturer: syz [ 613.989873][T11553] usb 6-1: SerialNumber: syz [ 614.014384][T11553] usb 6-1: config 0 descriptor?? [ 614.024507][T11553] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 614.035250][T11553] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 614.651839][T11553] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 614.663387][T11553] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 614.675717][T11553] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 614.688216][T11553] em28xx 6-1:0.0: No AC97 audio processor [ 615.660408][T11553] usb 4-1: USB disconnect, device number 98 [ 615.777962][T12301] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1729'. [ 615.956901][ T5874] Bluetooth: hci1: command 0x0406 tx timeout [ 615.963454][T12281] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 616.084975][T12307] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1730'. [ 616.139944][T12281] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 616.142602][T12307] team1: entered promiscuous mode [ 616.151790][T12281] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 616.161867][T12307] team1: entered allmulticast mode [ 616.162793][T12281] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 616.175736][T12281] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 616.515005][ T5961] usb 6-1: USB disconnect, device number 70 [ 616.525571][ T5961] em28xx 6-1:0.0: Disconnecting em28xx [ 616.564083][ T5961] em28xx 6-1:0.0: Freeing device [ 616.751193][T12322] netlink: 92 bytes leftover after parsing attributes in process `syz.2.1736'. [ 617.639879][ T5932] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 617.995928][T12348] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1742'. [ 618.086839][ T5874] Bluetooth: hci2: command 0x0406 tx timeout [ 618.197053][ T5874] Bluetooth: hci0: command 0x0406 tx timeout [ 618.203823][ T5874] Bluetooth: hci4: command 0x0406 tx timeout [ 618.210613][ T5186] Bluetooth: hci3: command 0x0406 tx timeout [ 618.229589][ T43] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 618.237475][ T5932] usb 3-1: Using ep0 maxpacket: 8 [ 618.245597][ T5932] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 618.264168][ T5932] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xF1, changing to 0x81 [ 618.299484][ T5932] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 54240, setting to 1024 [ 618.322782][ T5932] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1024 [ 618.362763][ T5932] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 618.392008][ T5932] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice=26.40 [ 618.403404][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.411728][T11553] usb 4-1: new high-speed USB device number 99 using dummy_hcd [ 618.422152][ T5932] usb 3-1: Product: syz [ 618.430511][ T5932] usb 3-1: Manufacturer: syz [ 618.435713][ T5932] usb 3-1: SerialNumber: syz [ 618.452402][T12334] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 618.463979][ T43] usb 6-1: Using ep0 maxpacket: 32 [ 618.478641][ T43] usb 6-1: config index 0 descriptor too short (expected 35577, got 27) [ 618.490040][T12334] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 618.498664][ T43] usb 6-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 618.506260][ T5932] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 618.516579][ T5932] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 618.578158][T11553] usb 4-1: Using ep0 maxpacket: 32 [ 618.585138][T11553] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 618.598179][T11553] usb 4-1: config 0 has no interface number 0 [ 618.604340][T11553] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 618.620850][T11553] usb 4-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 618.634959][T11553] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 618.648491][T11553] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.660100][T11553] usb 4-1: Product: syz [ 618.664332][T11553] usb 4-1: Manufacturer: syz [ 618.669948][T11553] usb 4-1: SerialNumber: syz [ 618.687271][T11553] usb 4-1: config 0 descriptor?? [ 618.706922][T11243] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 618.781475][ T43] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 618.788868][ T5940] usb 3-1: USB disconnect, device number 110 [ 618.790911][ T43] usb 6-1: config 1 has no interface number 0 [ 618.860095][T11243] usb 5-1: Using ep0 maxpacket: 16 [ 618.868107][T11243] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 618.885166][T11243] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 618.907736][T11243] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 618.922136][T11243] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.934879][T11243] usb 5-1: Product: syz [ 618.942793][T11243] usb 5-1: Manufacturer: syz [ 618.950472][T11243] usb 5-1: SerialNumber: syz [ 618.966456][T11553] radio-si470x 4-1:0.35: this is not a si470x device. [ 618.987555][ T5932] usb 2-1: new high-speed USB device number 104 using dummy_hcd [ 618.998343][T11553] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 619.006461][T11243] usb 5-1: config 0 descriptor?? [ 619.020454][T11553] usb 4-1: USB disconnect, device number 99 [ 619.035592][T11243] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 619.070507][T11243] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 619.084082][ T43] usb 6-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 619.200656][ T5932] usb 2-1: config index 0 descriptor too short (expected 126, got 72) [ 619.220910][ T5932] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 619.235422][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.245676][ T5932] usb 2-1: Product: syz [ 619.253335][ T5932] usb 2-1: Manufacturer: syz [ 619.258638][ T5932] usb 2-1: SerialNumber: syz [ 619.279823][ T5932] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 619.334767][ T43] usb 6-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 619.345227][T11553] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 619.506882][ T43] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 619.516518][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 619.599666][ T43] snd_usb_pod 6-1:1.1: Line 6 Pocket POD found [ 619.767044][T11243] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 619.774570][T11243] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 619.788593][T11243] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 619.813395][ T43] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now attached [ 619.933488][T11243] em28xx 5-1:0.0: No AC97 audio processor [ 620.243611][ T43] usb 6-1: USB disconnect, device number 71 [ 620.261590][ T43] snd_usb_pod 6-1:1.1: Line 6 Pocket POD now disconnected [ 620.859459][T11553] usb 2-1: Service connection timeout for: 256 [ 620.883689][T11553] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services [ 621.152352][T12366] 8021q: VLANs not supported on nlmon0 [ 621.315342][T11553] ath9k_htc: Failed to initialize the device [ 621.359564][T11553] usb 2-1: ath9k_htc: USB layer deinitialized [ 621.505924][ T43] usb 5-1: USB disconnect, device number 103 [ 621.521133][ T43] em28xx 5-1:0.0: Disconnecting em28xx [ 621.572109][ T43] em28xx 5-1:0.0: Freeing device [ 621.653645][T12370] netlink: 92 bytes leftover after parsing attributes in process `syz.4.1747'. [ 622.093545][ T5961] usb 2-1: USB disconnect, device number 104 [ 622.516853][ T5874] Bluetooth: hci1: command 0x0406 tx timeout [ 622.525009][T12359] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 622.693351][T12383] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0) [ 622.720430][T12359] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 622.727977][T12359] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 622.736686][T12359] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 622.746560][T12359] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 623.007129][T11553] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 623.017312][ T5932] usb 2-1: new high-speed USB device number 105 using dummy_hcd [ 623.197237][T11553] usb 5-1: Using ep0 maxpacket: 16 [ 623.205605][T11553] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 623.217674][ T5932] usb 2-1: device descriptor read/64, error -71 [ 623.229652][T11553] usb 5-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 623.240319][T11553] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 623.250224][T11553] usb 5-1: Product: syz [ 623.254529][T11553] usb 5-1: Manufacturer: syz [ 623.259464][T11553] usb 5-1: SerialNumber: syz [ 623.272247][T11553] usb 5-1: config 0 descriptor?? [ 623.283431][T11553] hub 5-1:0.0: bad descriptor, ignoring hub [ 623.290139][T11553] hub 5-1:0.0: probe with driver hub failed with error -5 [ 623.301499][T11553] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 623.406902][T11243] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 623.456885][ T5932] usb 2-1: new high-speed USB device number 106 using dummy_hcd [ 623.576871][T11243] usb 6-1: Using ep0 maxpacket: 16 [ 623.586411][T11243] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 623.598685][ T5932] usb 2-1: device descriptor read/64, error -71 [ 623.605483][T11243] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 623.606973][ T5969] usb 4-1: new high-speed USB device number 100 using dummy_hcd [ 623.621526][T11243] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 623.638287][T11243] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 623.646619][T11243] usb 6-1: Product: syz [ 623.652441][T11243] usb 6-1: Manufacturer: syz [ 623.657575][T11243] usb 6-1: SerialNumber: syz [ 623.666684][T11243] usb 6-1: config 0 descriptor?? [ 623.684309][T11243] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 623.701400][T11243] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 623.727333][ T5932] usb usb2-port1: attempt power cycle [ 623.856836][ T5969] usb 4-1: Using ep0 maxpacket: 16 [ 624.060218][ T5969] usb 4-1: config 0 has no interfaces? [ 624.070127][ T5969] usb 4-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 624.083529][ T5969] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.087062][ T5932] usb 2-1: new high-speed USB device number 107 using dummy_hcd [ 624.100069][ T5969] usb 4-1: Product: syz [ 624.110492][ T5969] usb 4-1: Manufacturer: syz [ 624.119954][ T5969] usb 4-1: SerialNumber: syz [ 624.134487][ T5969] usb 4-1: config 0 descriptor?? [ 624.154167][ T5932] usb 2-1: device descriptor read/8, error -71 [ 624.300358][T11243] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 624.311461][T11243] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 624.320136][T11243] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 624.328122][T11243] em28xx 6-1:0.0: No AC97 audio processor [ 624.411657][T11243] usb 4-1: USB disconnect, device number 100 [ 624.422207][ T5932] usb 2-1: new high-speed USB device number 108 using dummy_hcd [ 624.479113][ T5932] usb 2-1: device descriptor read/8, error -71 [ 624.587747][ T5932] usb usb2-port1: unable to enumerate USB device [ 624.607805][ T5874] Bluetooth: hci2: command 0x0406 tx timeout [ 624.756907][ T5874] Bluetooth: hci4: command 0x0406 tx timeout [ 624.756936][ T5186] Bluetooth: hci3: command 0x0406 tx timeout [ 624.769243][ T5874] Bluetooth: hci0: command 0x0406 tx timeout [ 624.836995][ T5969] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 624.991907][T12403] program syz.3.1760 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 625.001653][ T5969] usb 3-1: Using ep0 maxpacket: 32 [ 625.009190][ T5969] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 625.017727][ T5969] usb 3-1: config 0 has no interface number 0 [ 625.024392][ T5969] usb 3-1: config 0 interface 184 has no altsetting 0 [ 625.034584][ T5969] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 625.044376][ T5969] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.052748][ T5969] usb 3-1: Product: syz [ 625.057797][ T5969] usb 3-1: Manufacturer: syz [ 625.062581][ T5969] usb 3-1: SerialNumber: syz [ 625.080067][ T5969] usb 3-1: config 0 descriptor?? [ 625.096074][ T5969] smsc75xx v1.0.0 [ 625.241389][ T43] usb 5-1: USB disconnect, device number 104 [ 625.697037][ T43] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 625.718827][ T5969] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 625.730047][ T5969] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 625.756864][ T5961] usb 4-1: new full-speed USB device number 101 using dummy_hcd [ 625.872686][ T43] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 625.885759][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.896442][ T43] usb 5-1: Product: syz [ 625.901272][ T43] usb 5-1: Manufacturer: syz [ 625.905947][ T43] usb 5-1: SerialNumber: syz [ 625.920642][ T5961] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 625.931839][ T43] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 625.940305][ T5961] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 625.956829][ T5961] usb 4-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 625.967882][ T5961] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 625.983726][ T5962] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 625.996209][ T5961] usb 4-1: config 0 descriptor?? [ 626.208260][T11243] usb 6-1: USB disconnect, device number 72 [ 626.215914][T11243] em28xx 6-1:0.0: Disconnecting em28xx [ 626.224439][T11243] em28xx 6-1:0.0: Freeing device [ 626.668008][ T5932] usb 5-1: USB disconnect, device number 105 [ 627.121565][ T5962] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 627.129372][ T5962] ath9k_htc: Failed to initialize the device [ 627.215451][ T5932] usb 5-1: ath9k_htc: USB layer deinitialized [ 627.841525][ T5969] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000304: -71 [ 627.869052][ T5969] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to write ADDR_FILTX+4: -71 [ 627.915374][ T5969] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to set mac address [ 627.943712][ T5969] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 627.963292][ T5969] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 627.989509][ T5969] usb 3-1: USB disconnect, device number 111 [ 628.697893][ T5932] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 628.896879][T11243] usb 2-1: new high-speed USB device number 109 using dummy_hcd [ 628.904851][ T5932] usb 5-1: Using ep0 maxpacket: 16 [ 628.913947][ T5932] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 628.930403][ T5932] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 628.945737][ T5932] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 628.955985][ T5932] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.964553][ T5932] usb 5-1: Product: syz [ 628.976326][ T5932] usb 5-1: Manufacturer: syz [ 628.983498][ T5932] usb 5-1: SerialNumber: syz [ 628.992330][ T5932] usb 5-1: config 0 descriptor?? [ 629.009658][ T5932] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 629.021406][ T5932] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 629.066895][T11243] usb 2-1: Using ep0 maxpacket: 16 [ 629.181056][T11243] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 629.189227][T11243] usb 2-1: config 0 has no interface number 0 [ 629.221908][T11243] usb 2-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 629.266950][T11243] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 629.306930][T11243] usb 2-1: Product: syz [ 629.333528][T11243] usb 2-1: Manufacturer: syz [ 629.340005][ T5990] usb 4-1: USB disconnect, device number 101 [ 629.379147][T11243] usb 2-1: SerialNumber: syz [ 629.438330][T11243] usb 2-1: config 0 descriptor?? [ 629.472345][T11243] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 629.654232][ T5932] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 629.668046][ T5932] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 629.800876][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 629.808720][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 629.889345][ T5932] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 629.901913][ T5932] em28xx 5-1:0.0: No AC97 audio processor [ 630.296836][ T5969] usb 4-1: new high-speed USB device number 102 using dummy_hcd [ 630.483351][ T5969] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 630.508668][ T5969] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 630.542300][ T5969] usb 4-1: Product: syz [ 630.555608][ T5969] usb 4-1: SerialNumber: syz [ 630.573416][ T5969] usb 4-1: config 0 descriptor?? [ 630.795886][ T5969] hso 4-1:0.0: Failed to find BULK IN ep [ 630.896817][ T5962] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 630.925517][T11243] gspca_spca1528: reg_w err -71 [ 630.932452][T11243] spca1528 2-1:0.1: probe with driver spca1528 failed with error -71 [ 630.947294][T11243] usb 2-1: USB disconnect, device number 109 [ 630.997080][T12475] fuse: Bad value for 'fd' [ 631.003767][T12475] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.014716][T12475] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 631.047005][ T5962] usb 3-1: Using ep0 maxpacket: 16 [ 631.059066][ T5962] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 631.071163][ T5962] usb 3-1: config 0 has no interface number 0 [ 631.091068][ T5962] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 631.105908][ T5990] usb 4-1: USB disconnect, device number 102 [ 631.107084][ T5962] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 631.126547][ T5962] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 631.135690][ T5962] usb 3-1: Product: syz [ 631.143496][ T5962] usb 3-1: SerialNumber: syz [ 631.151236][ T5962] usb 3-1: config 0 descriptor?? [ 631.161426][ T5962] cm109 3-1:0.8: invalid payload size 208, expected 4 [ 631.172304][ T5962] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.8/input/input40 [ 631.511128][T11243] usb 5-1: USB disconnect, device number 106 [ 631.544808][T11243] em28xx 5-1:0.0: Disconnecting em28xx [ 631.570366][T11243] em28xx 5-1:0.0: Freeing device [ 631.772559][T12481] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 631.786485][T12481] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 631.890352][T12481] 8021q: adding VLAN 0 to HW filter on device bond2 [ 631.902867][T12499] netlink: 364 bytes leftover after parsing attributes in process `syz.1.1790'. [ 631.912244][T11243] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 631.954596][ C1] cm109 3-1:0.8: cm109_urb_irq_callback: urb status -71 [ 631.962172][ C1] cm109_urb_ctl_callback: 9 callbacks suppressed [ 631.962198][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 631.975839][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 631.983118][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 631.990283][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 631.997527][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 632.004871][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 632.014906][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 632.022140][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 632.029381][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 632.036707][ C1] cm109 3-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 632.047485][ T5962] usb 3-1: USB disconnect, device number 112 [ 632.053600][ C1] cm109 3-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 632.070058][T11243] usb 5-1: config 0 interface 0 has no altsetting 0 [ 632.096213][T11243] usb 5-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 632.117883][ T5962] cm109 3-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 632.123042][T11243] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.155306][T11243] usb 5-1: config 0 descriptor?? [ 632.381049][ T5932] usb 2-1: new high-speed USB device number 110 using dummy_hcd [ 632.511699][T12514] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1792'. [ 632.537330][ T5932] usb 2-1: Using ep0 maxpacket: 8 [ 632.549482][ T5932] usb 2-1: config 2 has an invalid interface number: 169 but max is 0 [ 632.568615][ T5932] usb 2-1: config 2 has no interface number 0 [ 632.585049][ T5932] usb 2-1: config 2 interface 169 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 632.616980][ T5932] usb 2-1: config 2 interface 169 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 632.656192][ T5932] usb 2-1: config 2 interface 169 altsetting 0 endpoint 0x8B has an invalid bInterval 129, changing to 11 [ 632.682283][ T5932] usb 2-1: config 2 interface 169 altsetting 0 endpoint 0x8B has invalid maxpacket 58232, setting to 1024 [ 632.743244][ T5932] usb 2-1: config 2 interface 169 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 632.876904][ T5932] usb 2-1: New USB device found, idVendor=1163, idProduct=0200, bcdDevice=b8.92 [ 632.951179][ T5932] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 633.050186][ T5932] cypress_m8 2-1:2.169: DeLorme Earthmate USB converter detected [ 633.362698][ T5932] usb 2-1: DeLorme Earthmate USB converter now attached to ttyUSB0 [ 633.539320][ T5932] usb 2-1: USB disconnect, device number 110 [ 633.606130][ T5932] earthmate ttyUSB0: DeLorme Earthmate USB converter now disconnected from ttyUSB0 [ 633.630463][ T5932] cypress_m8 2-1:2.169: device disconnected [ 633.870933][T12554] snd_dummy snd_dummy.0: control 0:-3:0:syz0:0 is already present [ 634.737317][ T5961] usb 5-1: USB disconnect, device number 107 [ 635.316952][ T5874] Bluetooth: hci0: command 0x0406 tx timeout [ 635.633213][T12546] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 635.639738][ T5874] Bluetooth: hci1: command 0x0406 tx timeout [ 635.648457][T12546] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 635.662448][T12546] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 635.683168][T12546] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 635.692632][T12546] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 635.950653][ T5932] usb 2-1: new high-speed USB device number 111 using dummy_hcd [ 635.958698][T11553] usb 4-1: new high-speed USB device number 103 using dummy_hcd [ 636.086872][ T5962] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 636.143558][T11553] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 636.154205][ T5932] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 636.190815][T11553] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.218838][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.236984][T11553] usb 4-1: Product: syz [ 636.241249][T11553] usb 4-1: Manufacturer: syz [ 636.248196][ T5932] usb 2-1: Product: syz [ 636.252925][ T5932] usb 2-1: Manufacturer: syz [ 636.257776][T11553] usb 4-1: SerialNumber: syz [ 636.260642][ T5962] usb 5-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 636.262552][ T5932] usb 2-1: SerialNumber: syz [ 636.294144][T11553] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 636.316087][ T5962] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 636.331920][ T5932] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 636.362004][T11243] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 636.362024][ T5962] usb 5-1: Product: syz [ 636.362046][ T5962] usb 5-1: Manufacturer: syz [ 636.389069][ T5990] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 636.457016][ T5962] usb 5-1: SerialNumber: syz [ 636.514115][ T5962] usb 5-1: config 0 descriptor?? [ 636.584806][ T5962] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 636.764826][T11553] usb 2-1: USB disconnect, device number 111 [ 636.822253][ T5969] usb 4-1: USB disconnect, device number 103 [ 636.897035][ T5932] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 637.000160][ T5962] gspca_sq905c: sq905c_read: usb_control_msg failed (-32) [ 637.009032][ T5962] sq905c 5-1:0.0: Reading version command failed [ 637.016941][ T5962] sq905c 5-1:0.0: probe with driver sq905c failed with error -32 [ 637.069942][ T5932] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 637.091757][ T5932] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 637.111222][ T5932] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 637.120728][ T5932] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.142214][ T5932] usb 6-1: config 0 descriptor?? [ 637.363403][ T5932] usb 6-1: USB disconnect, device number 73 [ 637.477244][ T5990] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 637.484283][T11243] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 637.491571][ T5990] ath9k_htc: Failed to initialize the device [ 637.497958][T11243] ath9k_htc: Failed to initialize the device [ 637.504815][T11553] usb 2-1: ath9k_htc: USB layer deinitialized [ 637.511785][ T5969] usb 4-1: ath9k_htc: USB layer deinitialized [ 637.717092][ T5186] Bluetooth: hci4: command 0x0406 tx timeout [ 637.723297][ T5879] Bluetooth: hci3: command 0x0406 tx timeout [ 637.726837][T11125] Bluetooth: hci2: command 0x0406 tx timeout [ 637.729971][ T5874] Bluetooth: hci0: command 0x0406 tx timeout [ 637.836992][ T5969] usb 4-1: new high-speed USB device number 104 using dummy_hcd [ 637.926997][ T5961] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 637.996007][ T5969] usb 4-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 638.022695][ T5969] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.038157][ T5962] usb 2-1: new high-speed USB device number 112 using dummy_hcd [ 638.054908][ T5969] usb 4-1: Product: syz [ 638.060078][ T5969] usb 4-1: Manufacturer: syz [ 638.070093][ T5969] usb 4-1: SerialNumber: syz [ 638.086383][ T5969] usb 4-1: config 0 descriptor?? [ 638.101754][ T5969] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 638.114176][ T5961] usb 3-1: config 0 interface 0 has no altsetting 0 [ 638.124515][ T5961] usb 3-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 638.143764][ T5961] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.168723][ T5961] usb 3-1: config 0 descriptor?? [ 638.233642][ T5962] usb 2-1: config 0 interface 0 has no altsetting 0 [ 638.241238][ T5962] usb 2-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 638.255070][ T5962] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.266543][ T5962] usb 2-1: config 0 descriptor?? [ 638.503728][T11243] usb 4-1: USB disconnect, device number 104 [ 638.565001][T12600] snd_dummy snd_dummy.0: control 0:-3:0:syz0:0 is already present [ 638.903774][T11243] usb 5-1: USB disconnect, device number 108 [ 639.645735][T12620] fuse: Unknown parameter '184467440737095516150x0000000000000004' [ 640.337716][T12611] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1813'. [ 640.651733][T12615] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 640.748328][T11243] usb 3-1: USB disconnect, device number 113 [ 641.061062][T11243] usb 2-1: USB disconnect, device number 112 [ 641.593624][T12648] program syz.2.1820 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 642.757067][T11553] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 642.948805][T11553] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF6, changing to 0x86 [ 642.970933][T11553] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid maxpacket 65535, setting to 1024 [ 642.992409][T11553] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 1024 [ 643.014677][T11553] usb 3-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 643.024264][T11553] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.037381][T11553] usb 3-1: config 0 descriptor?? [ 643.043166][T12658] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 643.054333][T11553] gspca_main: spca561-2.14.0 probing abcd:cdee [ 643.282281][T11553] spca561 3-1:0.0: probe with driver spca561 failed with error -22 [ 643.334717][T11553] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 643.355800][T11553] usb 3-1: MIDIStreaming interface descriptor not found [ 643.616335][T11553] usb 3-1: USB disconnect, device number 114 [ 643.984156][T12684] snd_dummy snd_dummy.0: control 0:-3:0:syz0:0 is already present [ 644.457062][T11553] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 644.638170][T11553] usb 3-1: config 0 interface 0 has no altsetting 0 [ 644.645220][T11553] usb 3-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 644.694837][T11553] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 644.748592][T11553] usb 3-1: config 0 descriptor?? [ 647.007069][ T5962] usb 5-1: new full-speed USB device number 109 using dummy_hcd [ 647.142868][T11243] usb 3-1: USB disconnect, device number 115 [ 647.329111][ T5962] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 647.420887][ T5962] usb 5-1: New USB device found, idVendor=056e, idProduct=4010, bcdDevice=20.1c [ 647.449271][T12707] syzkaller1: entered promiscuous mode [ 647.464792][T12707] syzkaller1: entered allmulticast mode [ 647.500572][ T5962] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.520654][ T5962] usb 5-1: config 0 descriptor?? [ 647.949066][T12720] binder: 12715:12720 unknown command 0 [ 647.954994][T12720] binder: 12715:12720 ioctl c0306201 200000000080 returned -22 [ 650.769727][T11243] usb 5-1: USB disconnect, device number 109 [ 651.399059][T12737] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 651.418632][T12737] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 651.431325][T12737] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 651.447131][T12737] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 651.453878][T12737] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 652.197276][ T5874] Bluetooth: hci1: command 0x0406 tx timeout [ 652.237039][ T5962] usb 2-1: new high-speed USB device number 113 using dummy_hcd [ 652.411202][ T5962] usb 2-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice=f0.ee [ 652.421037][ T5962] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.435048][ T5962] usb 2-1: config 0 descriptor?? [ 652.447121][T11243] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 652.454347][ T5962] usb 2-1: selecting invalid altsetting 1 [ 652.558626][ T5962] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 652.622121][T11243] usb 5-1: config 0 interface 0 has no altsetting 0 [ 652.634812][T11243] usb 5-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 652.653925][T11243] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.679739][T11243] usb 5-1: config 0 descriptor?? [ 653.477048][T11125] Bluetooth: hci4: command 0x0406 tx timeout [ 653.477147][ T5879] Bluetooth: hci2: command 0x0406 tx timeout [ 653.483245][ T5874] Bluetooth: hci0: command 0x0406 tx timeout [ 653.489290][ T5186] Bluetooth: hci3: command 0x0406 tx timeout [ 653.948195][ T43] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 654.144703][ T43] usb 3-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 654.184367][ T43] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 654.307410][ T43] usb 3-1: Product: syz [ 654.315597][ T43] usb 3-1: SerialNumber: syz [ 654.334541][ T43] usb 3-1: config 0 descriptor?? [ 654.564756][ T43] hso 3-1:0.0: Failed to find BULK IN ep [ 654.771503][ T5961] usb 3-1: USB disconnect, device number 116 [ 654.986107][T11243] usb 2-1: USB disconnect, device number 113 [ 655.287459][T12822] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1861'. [ 655.313546][T11243] usb 5-1: USB disconnect, device number 110 [ 655.500314][T12824] loop4: detected capacity change from 0 to 2560 [ 655.609875][ T6121] Buffer I/O error on dev loop4, logical block 0, async page read [ 655.709570][ T6121] Buffer I/O error on dev loop4, logical block 0, async page read [ 655.741156][ T6121] Buffer I/O error on dev loop4, logical block 0, async page read [ 655.768931][ T6121] Buffer I/O error on dev loop4, logical block 0, async page read [ 655.785255][ T6121] Buffer I/O error on dev loop4, logical block 0, async page read [ 655.945074][ T5991] Buffer I/O error on dev loop4, logical block 0, async page read [ 655.962575][ T5991] Buffer I/O error on dev loop4, logical block 0, async page read [ 655.980672][ T5991] Buffer I/O error on dev loop4, logical block 0, async page read [ 656.003930][ T5991] Buffer I/O error on dev loop4, logical block 0, async page read [ 656.060995][ T5991] Buffer I/O error on dev loop4, logical block 0, async page read [ 656.317734][T12844] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1867'. [ 656.353978][T12844] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1867'. [ 656.937423][T12856] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1871'. [ 656.970867][T12856] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1871'. [ 657.596824][ T5961] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 657.778482][ T5961] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 657.789319][ T5961] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 657.812696][ T5961] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 657.823889][ T5961] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 657.832529][ T5961] usb 3-1: SerialNumber: syz [ 658.150874][ T5961] usb 3-1: 0:2 : does not exist [ 658.188224][ T5961] usb 3-1: USB disconnect, device number 117 [ 659.272542][T12893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 659.297106][T11553] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 659.346128][T12893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 659.487877][ T5932] usb 2-1: new high-speed USB device number 114 using dummy_hcd [ 659.502352][T11553] usb 6-1: config 0 interface 0 altsetting 251 has an invalid descriptor for endpoint zero, skipping [ 659.545473][T11553] usb 6-1: config 0 interface 0 has no altsetting 0 [ 659.586631][T11553] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 659.636225][T11553] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 659.653557][T11553] usb 6-1: Product: syz [ 659.658025][T11553] usb 6-1: Manufacturer: syz [ 659.668877][T11553] usb 6-1: SerialNumber: syz [ 659.687899][ T5932] usb 2-1: too many configurations: 17, using maximum allowed: 8 [ 659.706087][T11553] usb 6-1: config 0 descriptor?? [ 659.736595][ T5932] usb 2-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 659.754449][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.812683][T11553] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 659.832844][ T5932] usb 2-1: Product: syz [ 659.838164][ T5932] usb 2-1: Manufacturer: syz [ 659.863450][ T5932] usb 2-1: SerialNumber: syz [ 659.901663][ T5932] usb 2-1: config 0 descriptor?? [ 659.931651][ T5932] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 659.979584][ T5991] udevd[5991]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 660.011619][ T5932] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 660.051440][ T5932] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 660.089230][ T5932] usb 2-1: media controller created [ 660.104498][ T43] usb 6-1: USB disconnect, device number 74 [ 660.122962][T12893] digitv: more than 2 i2c messages at a time is not handled yet. TODO. [ 660.237462][T12894] digitv: more than 2 i2c messages at a time is not handled yet. TODO. [ 660.332565][ T5932] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 660.714926][ T5932] DVB: Unable to find symbol mt352_attach() [ 660.924107][ T5932] DVB: Unable to find symbol nxt6000_attach() [ 661.003164][ T5932] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 661.084906][ T5932] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input41 [ 661.204449][ T5932] dvb-usb: schedule remote query interval to 1000 msecs. [ 661.343314][ T5932] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 661.394037][ T5932] dvb-usb: bulk message failed: -22 (7/0) [ 661.407074][T12891] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 661.427187][T12891] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 661.433492][ T5932] dvb-usb: bulk message failed: -22 (7/0) [ 661.446606][T12891] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 661.455231][T12891] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 661.521993][T12891] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 661.547958][T12893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 661.601380][T12893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 661.672065][ T5961] usb 2-1: USB disconnect, device number 114 [ 661.936144][ T5961] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 661.958310][ T5879] Bluetooth: hci1: command 0x0406 tx timeout [ 662.096841][ T5932] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 662.305195][ T5932] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 662.322737][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 662.345574][ T5932] usb 3-1: Product: syz [ 662.355773][ T5932] usb 3-1: Manufacturer: syz [ 662.366456][ T5932] usb 3-1: SerialNumber: syz [ 662.400481][T12925] FAULT_INJECTION: forcing a failure. [ 662.400481][T12925] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 662.404774][ T5932] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 662.415501][T12925] CPU: 1 UID: 0 PID: 12925 Comm: syz.3.1894 Not tainted syzkaller #0 PREEMPT(full) [ 662.415536][T12925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 662.415554][T12925] Call Trace: [ 662.415564][T12925] [ 662.415575][T12925] dump_stack_lvl+0x189/0x250 [ 662.415615][T12925] ? __pfx____ratelimit+0x10/0x10 [ 662.415643][T12925] ? __pfx_dump_stack_lvl+0x10/0x10 [ 662.415674][T12925] ? __pfx__printk+0x10/0x10 [ 662.415723][T12925] should_fail_ex+0x414/0x560 [ 662.415769][T12925] _copy_to_user+0x31/0xb0 [ 662.415807][T12925] simple_read_from_buffer+0xe1/0x170 [ 662.415852][T12925] proc_fail_nth_read+0x1b3/0x220 [ 662.415884][T12925] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 662.415918][T12925] ? rw_verify_area+0x2a6/0x4d0 [ 662.415948][T12925] ? __lock_acquire+0xab9/0xd20 [ 662.415984][T12925] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 662.416016][T12925] vfs_read+0x200/0xa30 [ 662.416047][T12925] ? fdget_pos+0x247/0x320 [ 662.416085][T12925] ? __pfx___mutex_lock+0x10/0x10 [ 662.416114][T12925] ? __pfx_vfs_read+0x10/0x10 [ 662.416150][T12925] ? __fget_files+0x2a/0x420 [ 662.416178][T12925] ? __fget_files+0x3a0/0x420 [ 662.416200][T12925] ? __fget_files+0x2a/0x420 [ 662.416234][T12925] ksys_read+0x145/0x250 [ 662.416270][T12925] ? __pfx_ksys_read+0x10/0x10 [ 662.416300][T12925] ? rcu_is_watching+0x15/0xb0 [ 662.416332][T12925] ? do_syscall_64+0xbe/0x3b0 [ 662.416366][T12925] do_syscall_64+0xfa/0x3b0 [ 662.416393][T12925] ? lockdep_hardirqs_on+0x9c/0x150 [ 662.416419][T12925] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.416444][T12925] ? clear_bhb_loop+0x60/0xb0 [ 662.416475][T12925] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 662.416500][T12925] RIP: 0033:0x7fa1c4d8d8dc [ 662.416525][T12925] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 662.416548][T12925] RSP: 002b:00007fa1c5bf3030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 662.416575][T12925] RAX: ffffffffffffffda RBX: 00007fa1c4fe5fa0 RCX: 00007fa1c4d8d8dc [ 662.416596][T12925] RDX: 000000000000000f RSI: 00007fa1c5bf30a0 RDI: 0000000000000003 [ 662.416625][T12925] RBP: 00007fa1c5bf3090 R08: 0000000000000000 R09: 0000000000000000 [ 662.416640][T12925] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000001 [ 662.416656][T12925] R13: 00007fa1c4fe6038 R14: 00007fa1c4fe5fa0 R15: 00007fa1c510fa28 [ 662.416698][T12925] [ 662.979563][T11243] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 663.331291][T12943] fuse: Unknown parameter '.Pãb}­7³ëfMZ.º÷ÿ' [ 663.477205][ T5879] Bluetooth: hci4: command 0x0406 tx timeout [ 663.483777][ T5874] Bluetooth: hci3: command 0x0406 tx timeout [ 663.489930][ T5874] Bluetooth: hci2: command 0x0406 tx timeout [ 663.566922][ T5879] Bluetooth: hci0: command 0x0406 tx timeout [ 663.615393][ T5932] usb 3-1: USB disconnect, device number 118 [ 664.048712][T11243] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 664.091385][T11243] ath9k_htc: Failed to initialize the device [ 664.118374][ T5932] usb 3-1: ath9k_htc: USB layer deinitialized [ 664.357181][T11553] usb 4-1: new full-speed USB device number 105 using dummy_hcd [ 664.430404][T12970] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 664.549217][T11553] usb 4-1: config 236 has too many interfaces: 114, using maximum allowed: 32 [ 664.593194][T11553] usb 4-1: config 236 has an invalid descriptor of length 0, skipping remainder of the config [ 664.651064][T11553] usb 4-1: config 236 has 0 interfaces, different from the descriptor's value: 114 [ 664.702642][T11553] usb 4-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=10.98 [ 664.715635][T12975] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1909'. [ 664.770687][T11553] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.820933][T11553] usb 4-1: Product: syz [ 664.825168][T11553] usb 4-1: Manufacturer: syz [ 664.861254][T11553] usb 4-1: SerialNumber: syz [ 665.394657][ T43] usb 4-1: USB disconnect, device number 105 [ 665.677000][ T5961] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 665.860831][ T5961] usb 6-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7 [ 665.910939][ T5961] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 665.960376][ T5961] usb 6-1: Product: syz [ 665.988690][ T5961] usb 6-1: Manufacturer: syz [ 666.005543][ T5961] usb 6-1: SerialNumber: syz [ 666.034180][ T5961] usb 6-1: config 0 descriptor?? [ 666.346971][T12989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 666.391144][T12989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 666.517013][ T5932] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 666.627024][T12989] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 666.688216][T12989] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 666.798717][T11553] usb 4-1: new high-speed USB device number 106 using dummy_hcd [ 666.877200][ T5961] usb 6-1: f81604_write: reg: 105 data: 8a failed: -EPROTO [ 666.905096][ T5961] f81604 6-1:0.0: Setting termination of CH#0 failed: -EPROTO [ 666.925526][ T5961] f81604 6-1:0.0: probe with driver f81604 failed with error -71 [ 666.961332][ T5961] usb 6-1: USB disconnect, device number 75 [ 666.976996][T11553] usb 4-1: device descriptor read/64, error -71 [ 666.983910][ T5932] usb 3-1: Using ep0 maxpacket: 16 [ 667.111454][ T5932] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 667.202517][ T5932] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 667.237216][ T5932] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 667.247527][T11553] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 667.298316][ T5932] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 667.335794][ T5932] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 667.392663][ T5932] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 667.402879][ T5932] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 667.436805][T11553] usb 4-1: device descriptor read/64, error -71 [ 667.558946][ T5932] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 667.576190][T11553] usb usb4-port1: attempt power cycle [ 667.705746][ T5932] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 667.723604][ T5932] usb 3-1: SerialNumber: syz [ 667.760831][ T5932] cdc_acm 3-1:1.0: Control and data interfaces are not separated! [ 667.864002][ T5932] cdc_acm 3-1:1.0: probe with driver cdc_acm failed with error -12 [ 668.066849][T11553] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 668.172053][T11553] usb 4-1: device descriptor read/8, error -71 [ 668.456878][ T5961] usb 2-1: new high-speed USB device number 115 using dummy_hcd [ 668.549931][T11553] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 668.590525][T11553] usb 4-1: device descriptor read/8, error -71 [ 668.642045][ T5961] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 668.666560][ T5961] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.689747][ T5961] usb 2-1: Product: syz [ 668.713760][ T5961] usb 2-1: Manufacturer: syz [ 668.726972][ T5961] usb 2-1: SerialNumber: syz [ 668.738787][T11553] usb usb4-port1: unable to enumerate USB device [ 669.494740][T13038] FAULT_INJECTION: forcing a failure. [ 669.494740][T13038] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 669.509713][T13038] CPU: 1 UID: 0 PID: 13038 Comm: syz.3.1930 Not tainted syzkaller #0 PREEMPT(full) [ 669.509748][T13038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 669.509763][T13038] Call Trace: [ 669.509772][T13038] [ 669.509782][T13038] dump_stack_lvl+0x189/0x250 [ 669.509817][T13038] ? __pfx____ratelimit+0x10/0x10 [ 669.509842][T13038] ? __pfx_dump_stack_lvl+0x10/0x10 [ 669.509869][T13038] ? __pfx__printk+0x10/0x10 [ 669.509914][T13038] should_fail_ex+0x414/0x560 [ 669.509972][T13038] _copy_to_user+0x31/0xb0 [ 669.510004][T13038] simple_read_from_buffer+0xe1/0x170 [ 669.510042][T13038] proc_fail_nth_read+0x1b3/0x220 [ 669.510072][T13038] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 669.510101][T13038] ? rw_verify_area+0x2a6/0x4d0 [ 669.510128][T13038] ? __lock_acquire+0xab9/0xd20 [ 669.510159][T13038] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 669.510186][T13038] vfs_read+0x200/0xa30 [ 669.510214][T13038] ? fdget_pos+0x247/0x320 [ 669.510239][T13038] ? __pfx___mutex_lock+0x10/0x10 [ 669.510264][T13038] ? __pfx_vfs_read+0x10/0x10 [ 669.510295][T13038] ? __fget_files+0x2a/0x420 [ 669.510326][T13038] ? __fget_files+0x3a0/0x420 [ 669.510344][T13038] ? __fget_files+0x2a/0x420 [ 669.510374][T13038] ksys_read+0x145/0x250 [ 669.510406][T13038] ? __pfx_ksys_read+0x10/0x10 [ 669.510442][T13038] ? do_syscall_64+0xbe/0x3b0 [ 669.510472][T13038] do_syscall_64+0xfa/0x3b0 [ 669.510496][T13038] ? lockdep_hardirqs_on+0x9c/0x150 [ 669.510519][T13038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 669.510541][T13038] ? clear_bhb_loop+0x60/0xb0 [ 669.510568][T13038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 669.510590][T13038] RIP: 0033:0x7fa1c4d8d8dc [ 669.510610][T13038] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 669.510630][T13038] RSP: 002b:00007fa1c5bf3030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 669.510655][T13038] RAX: ffffffffffffffda RBX: 00007fa1c4fe5fa0 RCX: 00007fa1c4d8d8dc [ 669.510671][T13038] RDX: 000000000000000f RSI: 00007fa1c5bf30a0 RDI: 0000000000000004 [ 669.510685][T13038] RBP: 00007fa1c5bf3090 R08: 0000000000000000 R09: 0000000000000000 [ 669.510699][T13038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 669.510713][T13038] R13: 00007fa1c4fe6038 R14: 00007fa1c4fe5fa0 R15: 00007fa1c510fa28 [ 669.510748][T13038] [ 670.984536][ T5961] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000080. ret = -EPROTO [ 670.998453][ T5879] Bluetooth: hci1: command 0x0406 tx timeout [ 671.000887][T13030] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 671.011734][ T5961] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 671.022645][ T5961] lan78xx 2-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 671.033921][ T5961] lan78xx 2-1:1.0: probe with driver lan78xx failed with error -71 [ 671.052486][ T5961] usb 2-1: USB disconnect, device number 115 [ 671.653521][T13052] fuse: Bad value for 'fd' [ 671.846936][T13030] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 671.853233][T13030] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 671.863517][T13030] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 671.871775][T13030] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 671.945784][T11553] usb 3-1: USB disconnect, device number 120 [ 672.127135][ T5975] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 672.306817][ T5975] usb 4-1: Using ep0 maxpacket: 16 [ 672.314169][ T5975] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 672.358000][ T5975] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 672.385918][ T5975] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 672.410421][ T5975] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 672.456830][T11553] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 672.503114][ T5975] usb 4-1: Product: syz [ 672.543243][ T5975] usb 4-1: Manufacturer: syz [ 672.564776][ T5975] usb 4-1: SerialNumber: syz [ 672.595975][ T5975] usb 4-1: config 0 descriptor?? [ 672.633440][ T5975] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 672.653558][T11553] usb 5-1: Using ep0 maxpacket: 8 [ 672.685058][ T5975] em28xx 4-1:0.0: Audio interface 0 found (Vendor Class) [ 672.695135][T11553] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 672.771643][T11553] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 672.827281][T11553] usb 5-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.8b [ 672.836924][ T43] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 672.925004][T11553] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 673.006462][T11553] usb 5-1: config 0 descriptor?? [ 673.016868][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 673.052787][T11553] hso 5-1:0.0: Can't find BULK IN endpoint [ 673.097646][ T5879] Bluetooth: hci2: command 0x0406 tx timeout [ 673.159845][ T43] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2 [ 673.205261][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.237086][ T43] usb 3-1: Product: syz [ 673.244312][ T43] usb 3-1: Manufacturer: syz [ 673.255987][ T43] usb 3-1: SerialNumber: syz [ 673.285479][ T43] usb 3-1: config 0 descriptor?? [ 673.328522][ T5975] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 673.335326][ T5975] em28xx 4-1:0.0: Config register raw data: 0xfffffffb [ 673.636050][ T43] usb 3-1: dvb_usb_v2: found a 'Terratec H7' in warm state [ 673.897229][ T5879] Bluetooth: hci0: command 0x0406 tx timeout [ 673.903457][ T5874] Bluetooth: hci4: command 0x0406 tx timeout [ 673.910056][ T5186] Bluetooth: hci3: command 0x0406 tx timeout [ 673.947923][ T5975] em28xx 4-1:0.0: Unknown AC97 audio processor detected! [ 673.958629][ T5975] em28xx 4-1:0.0: couldn't setup AC97 register 2 [ 673.981481][ T5975] em28xx 4-1:0.0: couldn't setup AC97 register 4 [ 674.002718][ T5975] em28xx 4-1:0.0: couldn't setup AC97 register 6 [ 674.038927][ T43] usb write operation failed. (-71) [ 674.077635][ T43] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 674.116999][ T43] dvbdev: DVB: registering new adapter (Terratec H7) [ 674.124025][ T43] usb 3-1: media controller created [ 674.142060][ T43] usb read operation failed. (-71) [ 674.163680][ T43] usb write operation failed. (-71) [ 674.197144][ T43] dvb_usb_az6007 3-1:0.0: probe with driver dvb_usb_az6007 failed with error -5 [ 674.241765][ T43] usb 3-1: USB disconnect, device number 121 [ 674.898013][ T5975] em28xx 4-1:0.0: couldn't setup AC97 register 56 [ 674.924147][ T5975] usb 4-1: USB disconnect, device number 110 [ 675.362044][T13103] i2c i2c-0: Invalid block write size 255 [ 675.677270][ T5975] usb 5-1: USB disconnect, device number 111 [ 675.810162][T13089] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 675.866255][T13089] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 675.880969][T13089] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 675.919446][T13089] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 675.925909][T13089] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 676.216815][ T43] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 676.217217][ T5975] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 676.339554][ T5969] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 676.416868][ T5975] usb 4-1: Using ep0 maxpacket: 16 [ 676.429490][ T5975] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 676.459297][ T5975] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 676.476860][ T43] usb 3-1: Using ep0 maxpacket: 8 [ 676.517606][ T5975] usb 4-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 676.550261][ T5975] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 676.581838][ T5975] usb 4-1: config 0 descriptor?? [ 676.612202][ T5969] usb 5-1: Using ep0 maxpacket: 16 [ 676.615188][ T5975] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 676.743469][ T43] usb 3-1: config 1 has an invalid descriptor of length 207, skipping remainder of the config [ 676.761848][ T5969] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 676.839631][ T5969] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 676.839832][ T5186] Bluetooth: hci1: command 0x0406 tx timeout [ 676.849936][ T43] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 51264, setting to 1024 [ 676.906859][ T5969] usb 5-1: config 0 has no interface number 0 [ 677.033614][ T5969] usb 5-1: config 0 interface 8 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 677.047571][ T43] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 1024 [ 677.109461][ T43] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 677.134247][ T5969] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 677.159273][ T5969] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 677.179931][ T5969] usb 5-1: Product: syz [ 677.184326][ T43] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice=26.40 [ 677.197258][ T5969] usb 5-1: SerialNumber: syz [ 677.210302][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.229637][ T5969] usb 5-1: config 0 descriptor?? [ 677.235795][ T43] usb 3-1: Product: syz [ 677.264233][ T43] usb 3-1: Manufacturer: syz [ 677.331933][ T43] usb 3-1: SerialNumber: syz [ 677.336867][ T5866] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 677.410675][T13107] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 677.461433][ T43] usbtest 3-1:1.0: couldn't get endpoints, -22 [ 677.483508][ T43] usbtest 3-1:1.0: probe with driver usbtest failed with error -22 [ 677.620488][ T5866] usb 6-1: Using ep0 maxpacket: 16 [ 677.633445][ T5866] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 677.707440][T13127] random: crng reseeded on system resumption [ 677.725822][ T5866] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 677.885545][ T5866] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 677.934786][ T5866] usb 6-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 677.947238][T13127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 677.957482][ T5969] usbhid 5-1:0.8: couldn't find an input interrupt endpoint [ 677.971311][ T5186] Bluetooth: hci0: command 0x0406 tx timeout [ 677.977977][ T5866] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.987324][ T5186] Bluetooth: hci4: command 0x0406 tx timeout [ 677.993881][ T5186] Bluetooth: hci3: command 0x0406 tx timeout [ 677.996498][ T5874] Bluetooth: hci2: command 0x0406 tx timeout [ 678.019257][ T5969] usb 5-1: USB disconnect, device number 112 [ 678.032143][T13127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 678.048977][ T5866] usb 6-1: Product: syz [ 678.069623][ T5866] usb 6-1: Manufacturer: syz [ 678.111938][T13129] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1946'. [ 678.122546][ T5866] usb 6-1: SerialNumber: syz [ 678.160091][ T5866] usb 6-1: config 0 descriptor?? [ 678.177816][T13129] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 678.199036][T13122] raw-gadget.3 gadget.5: fail, usb_ep_enable returned -22 [ 678.252647][ T5866] mcba_usb 6-1:0.0 can0: failed tx_urb -90 [ 678.297865][ T5866] mcba_usb 6-1:0.0 can0: Failed to send cmd (169) [ 678.363863][ T5866] mcba_usb 6-1:0.0 can0: failed tx_urb -90 [ 678.416361][ T5866] mcba_usb 6-1:0.0 can0: Failed to send cmd (169) [ 678.476470][ T5866] mcba_usb 6-1:0.0: Microchip CAN BUS Analyzer connected [ 678.786110][T13131] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 679.552461][T13142] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1957'. [ 679.666017][T13145] @: renamed from syz_tun (while UP) [ 679.726634][T11553] usb 3-1: USB disconnect, device number 122 [ 680.559585][ T5932] usb 6-1: USB disconnect, device number 76 [ 680.569585][ T5932] mcba_usb 6-1:0.0 can0: device disconnected [ 680.603191][ T5969] usb 4-1: USB disconnect, device number 111 [ 680.647324][T11553] usb 5-1: new low-speed USB device number 113 using dummy_hcd [ 680.796873][T11553] usb 5-1: device descriptor read/64, error -71 [ 681.057240][T11553] usb 5-1: new low-speed USB device number 114 using dummy_hcd [ 681.118907][ T5874] Bluetooth: hci0: SCO packet for unknown connection handle 101 [ 681.246817][T11553] usb 5-1: device descriptor read/64, error -71 [ 681.430788][T11553] usb usb5-port1: attempt power cycle [ 681.868044][T11553] usb 5-1: new low-speed USB device number 115 using dummy_hcd [ 681.937538][T11553] usb 5-1: device descriptor read/8, error -71 [ 682.176897][T11553] usb 5-1: new low-speed USB device number 116 using dummy_hcd [ 682.250313][T11553] usb 5-1: device descriptor read/8, error -71 [ 682.447291][T11553] usb usb5-port1: unable to enumerate USB device [ 683.114395][T13172] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 683.121850][T13172] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 683.128700][T13172] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 683.134834][T13172] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 683.145109][T13172] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 683.316888][ T5874] Bluetooth: hci1: command 0x0406 tx timeout [ 683.396922][ T5866] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 683.611833][ T5866] usb 4-1: Using ep0 maxpacket: 16 [ 683.639608][ T5866] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 683.682458][ T5866] usb 4-1: config 0 has no interfaces? [ 683.708321][ T5866] usb 4-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 683.748916][ T5866] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 683.781543][ T5866] usb 4-1: config 0 descriptor?? [ 683.937952][T11553] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 684.010347][T13220] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1974'. [ 684.036604][T13220] netlink: 'syz.2.1974': attribute type 8 has an invalid length. [ 684.086895][ T5975] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 684.097005][T11553] usb 5-1: Using ep0 maxpacket: 16 [ 684.115841][T13222] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 684.126014][T13222] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 684.144311][T11553] usb 5-1: config 0 has an invalid interface number: 143 but max is 0 [ 684.152774][T11553] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 684.163060][T11553] usb 5-1: config 0 has no interface number 0 [ 684.169760][T11553] usb 5-1: config 0 interface 143 has no altsetting 0 [ 684.180029][T11553] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 684.203027][T11553] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 684.213204][T11553] usb 5-1: Product: syz [ 684.227802][T11553] usb 5-1: SerialNumber: syz [ 684.237582][ T5975] usb 6-1: device descriptor read/64, error -71 [ 684.270364][T11553] usb 5-1: config 0 descriptor?? [ 684.293798][T13222] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 684.308179][T13222] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 684.487843][ T5975] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 684.626856][ T5975] usb 6-1: device descriptor read/64, error -71 [ 684.738122][ T5975] usb usb6-port1: attempt power cycle [ 684.764928][T11553] usb 5-1: USB disconnect, device number 117 [ 684.919405][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 684.936410][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 685.047188][T11553] ------------[ cut here ]------------ [ 685.053665][T11553] no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0 [ 685.064927][T11553] WARNING: CPU: 0 PID: 11553 at net/mac80211/rate.c:403 __rate_control_send_low+0x5df/0x820 [ 685.075206][T11553] Modules linked in: [ 685.079990][T11553] CPU: 0 UID: 0 PID: 11553 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 685.089533][T11553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 685.099686][T11553] Workqueue: mld mld_ifc_work [ 685.104437][T11553] RIP: 0010:__rate_control_send_low+0x5df/0x820 [ 685.110776][T11553] Code: 38 0f b6 04 28 84 c0 0f 85 d7 01 00 00 41 8b 0f 48 c7 c7 40 92 b0 8c 48 8b 74 24 18 44 8b 44 24 2c 45 89 e9 e8 d2 63 92 f6 90 <0f> 0b 90 90 e9 73 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c [ 685.130564][T11553] RSP: 0018:ffffc90003cee4d8 EFLAGS: 00010246 [ 685.136725][T11553] RAX: 575fbf0c33f0dd00 RBX: 000000000000000c RCX: ffff888033cd9e00 [ 685.144733][T11553] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 685.152783][T11553] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 685.160818][T11553] R10: dffffc0000000000 R11: fffffbfff1bfa234 R12: ffff88807905c3e8 [ 685.168872][T11553] R13: 0000000000000000 R14: ffff888033348e40 R15: ffff88803334b0d8 [ 685.176907][T11553] FS: 0000000000000000(0000) GS:ffff888125c12000(0000) knlGS:0000000000000000 [ 685.185859][T11553] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 685.192515][T11553] CR2: 0000200000249030 CR3: 00000000788b0000 CR4: 00000000003526f0 [ 685.200577][T11553] Call Trace: [ 685.203887][T11553] [ 685.206909][T11553] rate_control_send_low+0x194/0x7a0 [ 685.212254][T11553] rate_control_get_rate+0x20b/0x5d0 [ 685.217656][T11553] ieee80211_tx_h_rate_ctrl+0xb32/0x1780 [ 685.223356][T11553] ? __lock_acquire+0xab9/0xd20 [ 685.228353][T11553] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 685.234575][T11553] ? seqcount_lockdep_reader_access+0x123/0x1c0 [ 685.240903][T11553] invoke_tx_handlers_late+0xb6/0x1820 [ 685.246378][ T5874] Bluetooth: hci4: command 0x0406 tx timeout [ 685.246448][ T5874] Bluetooth: hci2: command 0x0406 tx timeout [ 685.252445][T11553] ? ieee80211_tx_h_select_key+0xd1b/0x19f0 [ 685.252553][T11553] ieee80211_tx_dequeue+0x308e/0x4360 [ 685.252652][T11553] ? __pfx_ieee80211_tx_dequeue+0x10/0x10 [ 685.275747][T11553] ? __local_bh_enable_ip+0x12d/0x1c0 [ 685.281228][T11553] ieee80211_handle_wake_tx_queue+0x125/0x2a0 [ 685.287361][T11553] ? __pfx_ieee80211_handle_wake_tx_queue+0x10/0x10 [ 685.293958][T11553] ? __local_bh_enable_ip+0x12d/0x1c0 [ 685.299462][T11553] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 685.305188][T11553] ? do_raw_spin_unlock+0x122/0x240 [ 685.310448][T11553] ieee80211_queue_skb+0x1a2e/0x21c0 [ 685.315768][T11553] ieee80211_tx+0x297/0x420 [ 685.320304][T11553] ? __pfx_ieee80211_tx+0x10/0x10 [ 685.325351][T11553] ? ieee80211_xmit+0x315/0x400 [ 685.330234][T11553] __ieee80211_subif_start_xmit+0xccf/0x1610 [ 685.336224][T11553] ? __ieee80211_subif_start_xmit+0x2be/0x1610 [ 685.342437][T11553] ? __pfx___ieee80211_subif_start_xmit+0x10/0x10 [ 685.348897][T11553] ? ieee80211_multicast_to_unicast+0x19c/0x320 [ 685.355154][T11553] ieee80211_subif_start_xmit+0xe0/0x510 [ 685.360838][T11553] ? __pfx_ieee80211_subif_start_xmit+0x10/0x10 [ 685.367120][T11553] ? __pfx_netif_skb_features+0x10/0x10 [ 685.372679][T11553] ? call_rcu+0x6ff/0x9c0 [ 685.377042][T11553] ? __lock_acquire+0xab9/0xd20 [ 685.381918][T11553] dev_hard_start_xmit+0x2d7/0x830 [ 685.387076][T11553] __dev_queue_xmit+0x1b8d/0x3b50 [ 685.392125][T11553] ? register_lock_class+0x51/0x320 [ 685.397388][T11553] ? __dev_queue_xmit+0x27b/0x3b50 [ 685.402527][T11553] ? __pfx___dev_queue_xmit+0x10/0x10 [ 685.407939][T11553] ? read_seqbegin+0x122/0x250 [ 685.412709][T11553] ? neigh_resolve_output+0x438/0x750 [ 685.418251][T11553] ? lockdep_hardirqs_on+0x9c/0x150 [ 685.423568][T11553] ? read_seqbegin+0x1ac/0x250 [ 685.428389][T11553] ? __pfx_read_seqbegin+0x10/0x10 [ 685.433517][T11553] ? __local_bh_enable_ip+0x12d/0x1c0 [ 685.438916][T11553] ? eth_header+0x11b/0x200 [ 685.443426][T11553] ? __asan_memcpy+0x40/0x70 [ 685.448070][T11553] ip6_finish_output2+0x11fe/0x16a0 [ 685.453279][T11553] ? ip6_finish_output2+0x701/0x16a0 [ 685.458616][T11553] ? ip6_mtu+0x7d/0x3f0 [ 685.462789][T11553] ? __pfx_ip6_finish_output2+0x10/0x10 [ 685.468356][T11553] ? ip6_mtu+0x7d/0x3f0 [ 685.472516][T11553] ? ip6_mtu+0x321/0x3f0 [ 685.476799][T11553] ? ip6_finish_output+0x2ef/0x4e0 [ 685.481944][T11553] NF_HOOK+0x9e/0x380 [ 685.485946][T11553] ? NF_HOOK+0x101/0x380 [ 685.490226][T11553] ? __pfx_NF_HOOK+0x10/0x10 [ 685.494874][T11553] ? __pfx_dst_output+0x10/0x10 [ 685.499795][T11553] ? icmp6_dst_alloc+0x3a5/0x420 [ 685.504767][T11553] ? icmp6_dst_alloc+0x3a5/0x420 [ 685.509768][T11553] mld_sendpack+0x800/0xd80 [ 685.514392][T11553] ? mld_sendpack+0x1de/0xd80 [ 685.519105][T11553] ? __pfx_mld_sendpack+0x10/0x10 [ 685.524190][T11553] mld_ifc_work+0x83e/0xd60 [ 685.528740][T11553] ? _raw_spin_unlock_irq+0x23/0x50 [ 685.533945][T11553] ? process_scheduled_works+0x9ef/0x17b0 [ 685.539806][T11553] process_scheduled_works+0xade/0x17b0 [ 685.545574][T11553] ? __pfx_process_scheduled_works+0x10/0x10 [ 685.551613][T11553] worker_thread+0x8a0/0xda0 [ 685.556235][T11553] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 685.562618][T11553] ? __kthread_parkme+0x7b/0x200 [ 685.567609][T11553] kthread+0x711/0x8a0 [ 685.571710][T11553] ? __pfx_worker_thread+0x10/0x10 [ 685.576854][T11553] ? __pfx_kthread+0x10/0x10 [ 685.581467][T11553] ? _raw_spin_unlock_irq+0x23/0x50 [ 685.586730][T11553] ? lockdep_hardirqs_on+0x9c/0x150 [ 685.591961][T11553] ? __pfx_kthread+0x10/0x10 [ 685.596561][T11553] ret_from_fork+0x439/0x7d0 [ 685.601201][T11553] ? __pfx_ret_from_fork+0x10/0x10 [ 685.606373][T11553] ? __switch_to_asm+0x39/0x70 [ 685.611203][T11553] ? __switch_to_asm+0x33/0x70 [ 685.615974][T11553] ? __pfx_kthread+0x10/0x10 [ 685.620632][T11553] ret_from_fork_asm+0x1a/0x30 [ 685.625421][T11553] [ 685.628473][T11553] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 685.635760][T11553] CPU: 0 UID: 0 PID: 11553 Comm: kworker/0:2 Not tainted syzkaller #0 PREEMPT(full) [ 685.645215][T11553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 685.655275][T11553] Workqueue: mld mld_ifc_work [ 685.659984][T11553] Call Trace: [ 685.663269][T11553] [ 685.666377][T11553] dump_stack_lvl+0x99/0x250 [ 685.670979][T11553] ? __asan_memcpy+0x40/0x70 [ 685.675574][T11553] ? __pfx_dump_stack_lvl+0x10/0x10 [ 685.680775][T11553] ? __pfx__printk+0x10/0x10 [ 685.685384][T11553] vpanic+0x281/0x750 [ 685.689373][T11553] ? __pfx__printk+0x10/0x10 [ 685.694065][T11553] ? __pfx_vpanic+0x10/0x10 [ 685.698604][T11553] ? is_bpf_text_address+0x292/0x2b0 [ 685.703913][T11553] panic+0xb9/0xc0 [ 685.707709][T11553] ? __pfx_panic+0x10/0x10 [ 685.712151][T11553] __warn+0x31b/0x4b0 [ 685.716134][T11553] ? __rate_control_send_low+0x5df/0x820 [ 685.721771][T11553] ? __rate_control_send_low+0x5df/0x820 [ 685.727495][T11553] report_bug+0x2be/0x4f0 [ 685.731826][T11553] ? __rate_control_send_low+0x5df/0x820 [ 685.737482][T11553] ? __rate_control_send_low+0x5df/0x820 [ 685.743561][T11553] ? __rate_control_send_low+0x5e1/0x820 [ 685.749202][T11553] handle_bug+0x84/0x160 [ 685.753458][T11553] exc_invalid_op+0x1a/0x50 [ 685.757978][T11553] asm_exc_invalid_op+0x1a/0x20 [ 685.762832][T11553] RIP: 0010:__rate_control_send_low+0x5df/0x820 [ 685.769078][T11553] Code: 38 0f b6 04 28 84 c0 0f 85 d7 01 00 00 41 8b 0f 48 c7 c7 40 92 b0 8c 48 8b 74 24 18 44 8b 44 24 2c 45 89 e9 e8 d2 63 92 f6 90 <0f> 0b 90 90 e9 73 fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c [ 685.788711][T11553] RSP: 0018:ffffc90003cee4d8 EFLAGS: 00010246 [ 685.794787][T11553] RAX: 575fbf0c33f0dd00 RBX: 000000000000000c RCX: ffff888033cd9e00 [ 685.802780][T11553] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 685.810758][T11553] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 685.818737][T11553] R10: dffffc0000000000 R11: fffffbfff1bfa234 R12: ffff88807905c3e8 [ 685.826719][T11553] R13: 0000000000000000 R14: ffff888033348e40 R15: ffff88803334b0d8 [ 685.834725][T11553] ? __rate_control_send_low+0x5de/0x820 [ 685.840378][T11553] rate_control_send_low+0x194/0x7a0 [ 685.845680][T11553] rate_control_get_rate+0x20b/0x5d0 [ 685.850973][T11553] ieee80211_tx_h_rate_ctrl+0xb32/0x1780 [ 685.856608][T11553] ? __lock_acquire+0xab9/0xd20 [ 685.861476][T11553] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 685.867573][T11553] ? seqcount_lockdep_reader_access+0x123/0x1c0 [ 685.873842][T11553] invoke_tx_handlers_late+0xb6/0x1820 [ 685.879320][T11553] ? ieee80211_tx_h_select_key+0xd1b/0x19f0 [ 685.885238][T11553] ieee80211_tx_dequeue+0x308e/0x4360 [ 685.890666][T11553] ? __pfx_ieee80211_tx_dequeue+0x10/0x10 [ 685.896393][T11553] ? __local_bh_enable_ip+0x12d/0x1c0 [ 685.901797][T11553] ieee80211_handle_wake_tx_queue+0x125/0x2a0 [ 685.907879][T11553] ? __pfx_ieee80211_handle_wake_tx_queue+0x10/0x10 [ 685.914472][T11553] ? __local_bh_enable_ip+0x12d/0x1c0 [ 685.919842][T11553] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 685.925562][T11553] ? do_raw_spin_unlock+0x122/0x240 [ 685.930768][T11553] ieee80211_queue_skb+0x1a2e/0x21c0 [ 685.936081][T11553] ieee80211_tx+0x297/0x420 [ 685.940605][T11553] ? __pfx_ieee80211_tx+0x10/0x10 [ 685.945664][T11553] ? ieee80211_xmit+0x315/0x400 [ 685.950535][T11553] __ieee80211_subif_start_xmit+0xccf/0x1610 [ 685.956605][T11553] ? __ieee80211_subif_start_xmit+0x2be/0x1610 [ 685.962795][T11553] ? __pfx___ieee80211_subif_start_xmit+0x10/0x10 [ 685.969240][T11553] ? ieee80211_multicast_to_unicast+0x19c/0x320 [ 685.975488][T11553] ieee80211_subif_start_xmit+0xe0/0x510 [ 685.981214][T11553] ? __pfx_ieee80211_subif_start_xmit+0x10/0x10 [ 685.987461][T11553] ? __pfx_netif_skb_features+0x10/0x10 [ 685.993026][T11553] ? call_rcu+0x6ff/0x9c0 [ 685.997363][T11553] ? __lock_acquire+0xab9/0xd20 [ 686.002243][T11553] dev_hard_start_xmit+0x2d7/0x830 [ 686.007407][T11553] __dev_queue_xmit+0x1b8d/0x3b50 [ 686.012455][T11553] ? register_lock_class+0x51/0x320 [ 686.017682][T11553] ? __dev_queue_xmit+0x27b/0x3b50 [ 686.022811][T11553] ? __pfx___dev_queue_xmit+0x10/0x10 [ 686.028186][T11553] ? read_seqbegin+0x122/0x250 [ 686.032960][T11553] ? neigh_resolve_output+0x438/0x750 [ 686.038333][T11553] ? lockdep_hardirqs_on+0x9c/0x150 [ 686.043536][T11553] ? read_seqbegin+0x1ac/0x250 [ 686.048304][T11553] ? __pfx_read_seqbegin+0x10/0x10 [ 686.053422][T11553] ? __local_bh_enable_ip+0x12d/0x1c0 [ 686.058797][T11553] ? eth_header+0x11b/0x200 [ 686.063305][T11553] ? __asan_memcpy+0x40/0x70 [ 686.067923][T11553] ip6_finish_output2+0x11fe/0x16a0 [ 686.073127][T11553] ? ip6_finish_output2+0x701/0x16a0 [ 686.078436][T11553] ? ip6_mtu+0x7d/0x3f0 [ 686.082610][T11553] ? __pfx_ip6_finish_output2+0x10/0x10 [ 686.088151][T11553] ? ip6_mtu+0x7d/0x3f0 [ 686.092337][T11553] ? ip6_mtu+0x321/0x3f0 [ 686.096584][T11553] ? ip6_finish_output+0x2ef/0x4e0 [ 686.101703][T11553] NF_HOOK+0x9e/0x380 [ 686.105687][T11553] ? NF_HOOK+0x101/0x380 [ 686.109926][T11553] ? __pfx_NF_HOOK+0x10/0x10 [ 686.114575][T11553] ? __pfx_dst_output+0x10/0x10 [ 686.119433][T11553] ? icmp6_dst_alloc+0x3a5/0x420 [ 686.124395][T11553] ? icmp6_dst_alloc+0x3a5/0x420 [ 686.129355][T11553] mld_sendpack+0x800/0xd80 [ 686.133870][T11553] ? mld_sendpack+0x1de/0xd80 [ 686.138666][T11553] ? __pfx_mld_sendpack+0x10/0x10 [ 686.143731][T11553] mld_ifc_work+0x83e/0xd60 [ 686.148248][T11553] ? _raw_spin_unlock_irq+0x23/0x50 [ 686.153469][T11553] ? process_scheduled_works+0x9ef/0x17b0 [ 686.159198][T11553] process_scheduled_works+0xade/0x17b0 [ 686.164767][T11553] ? __pfx_process_scheduled_works+0x10/0x10 [ 686.170777][T11553] worker_thread+0x8a0/0xda0 [ 686.175368][T11553] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 686.181700][T11553] ? __kthread_parkme+0x7b/0x200 [ 686.186650][T11553] kthread+0x711/0x8a0 [ 686.190735][T11553] ? __pfx_worker_thread+0x10/0x10 [ 686.195844][T11553] ? __pfx_kthread+0x10/0x10 [ 686.200447][T11553] ? _raw_spin_unlock_irq+0x23/0x50 [ 686.205647][T11553] ? lockdep_hardirqs_on+0x9c/0x150 [ 686.210849][T11553] ? __pfx_kthread+0x10/0x10 [ 686.215540][T11553] ret_from_fork+0x439/0x7d0 [ 686.220140][T11553] ? __pfx_ret_from_fork+0x10/0x10 [ 686.225279][T11553] ? __switch_to_asm+0x39/0x70 [ 686.230046][T11553] ? __switch_to_asm+0x33/0x70 [ 686.234812][T11553] ? __pfx_kthread+0x10/0x10 [ 686.239499][T11553] ret_from_fork_asm+0x1a/0x30 [ 686.244282][T11553] [ 686.247632][T11553] Kernel Offset: disabled [ 686.251964][T11553] Rebooting in 86400 seconds..