last executing test programs: 10.790519728s ago: executing program 1 (id=4699): r0 = syz_usb_connect$cdc_ncm(0x0, 0x8f, &(0x7f0000000440)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109027d0002010080000904000001020d0000052406000105240000000d240f0103000000fd0000000406241aff072908241c0101090000142413099f33760bf14377323063f9c8a04d113905241510000905810300020800040904010000020d00000904010102020d0000090582020002e1ad000905036925"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000000)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x100, 0x70, 0x8, 0x1ff, 0x7, 0x100, 0xfeba, 0x3, 0x8000, 0x0, 0x100, 0x9}}, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$ttys(0xc, 0x2, 0x1) r1 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCMBIS(r1, 0x5416, 0x0) r2 = socket$inet6(0xa, 0x3, 0x1) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) ioctl$LOOP_CONFIGURE(r6, 0x40101288, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x818, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f0000000040)={0xf0f023}) ioctl$VIDIOC_CROPCAP(r7, 0xc02c563a, &(0x7f00000000c0)={0xa, {0x4, 0x3, 0x1, 0x401}, {0x0, 0x2, 0x4, 0x1000}, {0xa47, 0x5}}) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) fcntl$dupfd(r3, 0x0, r3) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=ANY=[@ANYRESOCT=r2, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800b00010062726964676500001800028005002600020000000c002e"], 0x48}, 0x1, 0x0, 0x0, 0xc001}, 0x800) fsopen(&(0x7f00000006c0)='nfsd\x00', 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) 9.806591877s ago: executing program 2 (id=4702): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x3}, {0x0, [0x0]}}, 0x0, 0x1b}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r1 = socket(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000000)="7800000018002507b9409b14ffff00000204be04020506050e0204094300050004000000040010000d0068d0bf46d32345653600648d0a0012000200000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f25232500000", 0x78, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x4000004) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)={@multicast1, @local}, 0xc) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x1, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x2], 0x0, 0x200}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'gretap0\x00', &(0x7f0000000200)={'syztnl0\x00', 0x0, 0x700, 0x700, 0x6, 0x7, {{0x42, 0x4, 0x3, 0x3a, 0x108, 0x65, 0x0, 0x5, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @loopback, {[@timestamp_addr={0x44, 0x3c, 0x4b, 0x1, 0x6, [{@empty, 0x2}, {@local, 0x4dd}, {@private=0xa010101, 0x3fe}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}, {@loopback, 0x101}, {@remote, 0x5}, {@broadcast, 0x10000}]}, @lsrr={0x83, 0xf, 0xd3, [@initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x37}]}, @timestamp_addr={0x44, 0x24, 0x9a, 0x1, 0x6, [{@remote, 0xffffffde}, {@multicast1, 0x6}, {@broadcast, 0x1}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}]}, @cipso={0x86, 0x35, 0x3, [{0x2, 0x12, "dbd2fa3d2ff50eaa32feb638c2661415"}, {0x2, 0x5, "c61c79"}, {0x6, 0xf, "e2e768068a57df2dbeebb50a9f"}, {0x0, 0x9, "d037207d1b27dc"}]}, @noop, @noop, @timestamp_addr={0x44, 0x24, 0x54, 0x1, 0x2, [{@dev={0xac, 0x14, 0x14, 0x36}}, {@broadcast}, {@multicast2, 0x7fff}, {@loopback, 0x5}]}, @generic={0x97, 0xd, "50f0ebd544a4f045f2f213"}, @lsrr={0x83, 0x1b, 0x62, [@rand_addr=0x64010100, @multicast2, @private=0xa010101, @multicast2, @dev={0xac, 0x14, 0x14, 0x2f}, @loopback]}]}}}}}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0xa8) r6 = openat$procfs(0xffffff9c, &(0x7f0000000080)='/proc/cgroups\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7ab100009500"/24], &(0x7f0000000480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xfa1cf1240323e524, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @value=r6}, 0x94) socket$inet(0x2, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000004001000440000000900000001000000", @ANYRES32=0x1, @ANYBLOB="0000000000000000000000010000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r7, &(0x7f00000000c0)="738fc0", 0x3, 0x800, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r8, 0x0, 0x48a, &(0x7f0000000f80)={0xfffffbbf, 0x6, 0x5}, 0xc) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r7, 0x84, 0xf, &(0x7f0000000340)={0x0, @in6={{0xa, 0x4e23, 0x8f, @loopback, 0x1}}, 0x9caa, 0x6, 0x9, 0x3, 0x6}, &(0x7f00000001c0)=0x98) bpf$PROG_LOAD(0x2, &(0x7f0000000580)={0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 9.696381795s ago: executing program 3 (id=4703): socket$xdp(0x2c, 0x3, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="fc00000019000100fdffffff00000000ac1414bb000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000feffffffffff01000000000000000000020000000000000000000000000000000000000000000000fdffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000b06b6e0000000000440008000000000000000000000000000000000000000000320000000000000000000000000000000000ffff2a0101020000000002000400"/176], 0xfc}, 0x1, 0x0, 0x0, 0x8081}, 0x800) symlink(&(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000059c0)='./file0\x00') r1 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x801}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185100}) io_uring_enter(r1, 0x7277, 0x0, 0x28, 0x0, 0x0) r4 = add_key$user(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000240)="f56ed761e9c8219d05f5e35c81", 0xd, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, 0x0, r4}, 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x27c, 0x0, 0x25, 0x148, 0xb8, 0x60, 0x1e8, 0x2a8, 0x2a8, 0x1e8, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x3a}, 0xffffff00, 0xff, 'wg0\x00', 'vxcan1\x00', {}, {}, 0x84, 0x1}, 0x0, 0x70, 0xb8, 0x0, {0x200003ae, 0x7f00}}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x2, 0x0, 'snmp\x00', {0x5}}}}, {{@ip={@empty, @dev={0xac, 0x14, 0x14, 0x1c}, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0xd0, 0x130, 0x0, {}, [@common=@unspec=@limit={{0x3c}, {0x7, 0xfff, 0x1040, 0x2, 0x6, 0x1, 0x4}}, @inet=@rpfilter={{0x24}, {0x5}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x0, 0x0, 0x6, 0x3]}, {0x0, [0x0, 0x0, 0x0, 0x4, 0x4]}}}}], {{'\x00', 0xc8, 0x70, 0x94}, {0x24}}}}, 0x2d8) r5 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) ioctl$EVIOCGKEYCODE_V2(r5, 0x80284504, &(0x7f0000000040)=""/165) 8.666957103s ago: executing program 2 (id=4704): r0 = socket$l2tp(0x2, 0x2, 0x73) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="400000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="a00001000000ebff200012800800010067747000140002800800030055000000080001"], 0x40}}, 0x0) (async) r2 = fsopen(&(0x7f0000000040)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r2, 0x5, &(0x7f0000000240)='name', 0x0, r1) (async) sendto$inet(r0, 0x0, 0x0, 0x24000001, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) (async) fspick(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) (async) syz_emit_ethernet(0xce, &(0x7f00000008c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x9, 0x4, 0x0, 0x0, 0xc0, 0x0, 0x0, 0x0, 0x11, 0x0, @dev, @local, {[@timestamp={0x44, 0xc, 0x8, 0x0, 0x0, [0x0, 0x0]}, @rr={0x7, 0x3, 0xd7}]}}, {0x0, 0x0, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "6fdfa0d2001efbb3e29a4ac275ca11b984ff5def6ed2e4ea9bc0eabdd34c732b", "df23520b57e4c98679c7795a27c7bf3e7d776b600ba8d82d6ba417e219edd86fb708441efcf75fe803412dae374281c2", "5df814aa2e34e4f8a759805b993e2d69a8f476de686861a9850edbe3", {"2cfee9b9d5b0b2b171b51f9174963b0c", "e40ca7e0a7b4bbc4bc9720c876a57954"}}}}}}}, 0x0) (async) bind$l2tp(r0, &(0x7f00000002c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000006c0)={0x14, r5, 0x509, 0x70bd2c, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000001}, 0x80c0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x2a, &(0x7f00000002c0)={@broadcast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2b, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xff}}, @echo={0x8, 0x0, 0x0, 0x6}}}}}, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) splice(r8, &(0x7f0000000180)=0xffffffffffffffff, r7, 0x0, 0x4, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES32=r9], 0x50) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000e11e00820000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) r10 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000340)='/sys/power/pm_test', 0x341a82, 0x0) sendfile(r10, r10, &(0x7f0000000000)=0x1, 0x4) r11 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000240)=@IORING_OP_SYMLINKAT={0x26, 0x1, 0x0, r10, &(0x7f00000001c0)='./cgroup.cpu/cpuset.cpus\x00', &(0x7f0000000200)='.\x00', 0x0, 0x0, 0x1, {0x0, r11}}) (async) r12 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYRES16=r9, @ANYRES16=r12, @ANYBLOB="009000bd7000fcdbdf2501000000080005000600000024000380060007004e2300000800030003000000060004003103000008000130ffffff750dc704006df90000"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x24000100) (async) sendmsg$IPVS_CMD_GET_DEST(r6, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x6c, r12, 0x800, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xff}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x40}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="000000000000000014000000b7030000000600008500000005005949c55cbe913ae520d23ec70000bf0900000000000055090100000000009500000000000000bf03000000000000b5080000000000008500000007000000b7000000000000009500"/108], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 8.160272703s ago: executing program 0 (id=4705): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) r2 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f0000000000)={0xa0000001}) epoll_wait(r5, &(0x7f0000000340)=[{}], 0x1, 0x1000) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x8084) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) epoll_pwait(r5, &(0x7f0000000140)=[{}, {}, {}, {}], 0x4, 0xfe, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r6 = socket$kcm(0x2, 0xa, 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r7) sendmsg$NL80211_CMD_GET_REG(r7, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)={0x14, r8, 0xf09, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8084) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x8, 0x882, 0x8b6, 0x2, 0xffffffffffffffff, 0x46b1a978, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x5}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000200), 0x2, r9}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=""/40, &(0x7f00000001c0), &(0x7f0000000200), 0x1, r9}, 0x38) ioprio_set$pid(0x2, 0x0, 0x0) io_setup(0x4, &(0x7f00000001c0)=0x0) r11 = eventfd2(0x0, 0x0) io_submit(r10, 0x1, &(0x7f0000002200)=[&(0x7f0000000040)={0x40000000, 0x0, 0x30, 0x1, 0x1a5, r11, 0x0, 0x0, 0x1, 0x0, 0x1, r11}]) 7.824712295s ago: executing program 3 (id=4706): ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, 0x0) r0 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r0, 0xc04064aa, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback=0x14}, 0x94) r1 = syz_io_uring_setup(0x10d2, &(0x7f00000003c0)={0x0, 0x7734, 0x80, 0x0, 0x377}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_CONNECT={0x10, 0x54, 0x0, 0xffffffffffffffff, 0x80, &(0x7f0000000440)=@tipc=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x0, 0x2}}, 0x0, 0x0, 0x1}) io_uring_enter(r1, 0x47bc, 0x0, 0x0, 0x0, 0x0) (fail_nth: 30) 7.555403153s ago: executing program 1 (id=4707): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/igmp\x00') r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @sack_perm, @mss, @window, @window], 0x6) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='highspeed\x00', 0xa) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000700), 0x4) r2 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f00000000c0)={'fscrypt:', @desc1}, &(0x7f00000001c0)={0x0, "28d7b07d54891881fe02c1203fe49696b9f26f2da4149683f065714f8a61d1f32c9d064bbd27b2aa57459cff33a3a9831ac46b8829b48fff3d63520d260804d0"}, 0x48, 0xfffffffffffffffd) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) write$UHID_INPUT(r4, &(0x7f0000001040)={0xf, {"a2e3ad21ed0d09f91b3d090987f70e06d038e7ff7fc6e5539b0d650e8b089b3f360068090890e0878f0e1ac6e7049b3341959b759a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07640936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) keyctl$setperm(0x5, r2, 0x0) keyctl$unlink(0x9, r2, 0xfffffffffffffffd) r5 = add_key$fscrypt_provisioning(&(0x7f0000000040), &(0x7f0000000100)={'syz', 0x2}, &(0x7f00000001c0)={0x1, 0x0, @auto=[0x10, 0x38, 0x1d, 0x18]}, 0xc, r2) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) keyctl$negate(0xd, r5, 0x2, r2) pread64(r0, &(0x7f0000000180)=""/15, 0xfffffe9c, 0xb6) 7.062900494s ago: executing program 2 (id=4708): syz_io_uring_setup(0x10d2, 0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x200000a, 0x5d031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_COPY(r0, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000523000/0x14000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x14000, 0x3, 0x2}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, 0x0, 0x4000) recvmmsg(r1, 0x0, 0x0, 0x20, 0x0) listxattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.log\x00', 0x802442, 0x0) r4 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r4, &(0x7f0000000000)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) listen(r4, 0x0) connect$unix(r2, 0x0, 0x0) r5 = syz_open_procfs(0x0, 0x0) getdents64(r5, 0x0, 0x0) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 6.689590605s ago: executing program 4 (id=4709): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x20000881}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x0, 0x0}, 0x8) r1 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000640)=ANY=[@ANYBLOB="12010000090000402505a8a440000102030109021b00010100000009040000020701010009050102"], 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000000)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0xfffffffffffffc4a}}) syz_open_dev$char_usb(0xc, 0xb4, 0x2000000) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo\x00') syz_usb_disconnect(r1) ioctl$SNDCTL_DSP_GETBLKSIZE(r2, 0xc0045004, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r3, 0x5609, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0xd8, 0xffffffff, 0x188, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x3, 0x0, {[{{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0xffffff00, 'veth0_to_hsr\x00', 'macsec0\x00', {0xff}, {}, 0x6, 0x0, 0x20}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x12, 0x3, 0x8, 0x2, 'netbios-ns\x00', 'syz1\x00', {0x3}}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, 0xffffffff, 0xff000000, 'geneve1\x00', 'pimreg1\x00', {}, {}, 0x6, 0x1}, 0x0, 0x70, 0xb0}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x9, 0x14, "02faea85e630c91d8aa58f67263587935c17ee73e3e6000789f0ebec8e9e"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000002c0)=0x0) syz_open_procfs(r4, &(0x7f0000000280)='personality\x00') r5 = syz_open_dev$media(&(0x7f0000000240), 0x11, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r5, 0x80047c05, &(0x7f0000000940)=0xffffffffffffffff) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r6, 0x7c80, 0x0) syz_usb_connect(0x0, 0x4f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005cdd2e106307151088560000000109023d00010000d00009047e0004ffd234000905b74318860809050725018705ee7b09050a000002810bac0905"], 0x0) 6.59123991s ago: executing program 3 (id=4710): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x24, &(0x7f0000000200), 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x2, &(0x7f0000000100)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x6d}, @exit], &(0x7f0000000140)='syzkaller\x00'}, 0x94) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000023c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000005180)={0x2020}, 0x2020) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000000)={0xfffffffb}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB="28000000120001003dbd700000000000070000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00@'], 0x28}, 0x1, 0x0, 0x0, 0x40010}, 0x4004000) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) r4 = socket(0x1, 0x803, 0x0) r5 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000003c0), 0xc0001, 0x0) writev(r5, &(0x7f0000001880)=[{&(0x7f0000000400)='{', 0x1}], 0x1) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r6}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_FLAGS={0x8, 0x8, 0x702}]}, 0x34}}, 0x0) r7 = socket(0x10, 0x803, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) sync_file_range(0xffffffffffffffff, 0x8, 0x0, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295a5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r9}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_ADDRESS={0x14, 0x1, @local}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r10 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x20802, 0x0) ioctl$TIOCSETD(r10, 0x5423, &(0x7f0000000080)=0x2) 5.655058279s ago: executing program 2 (id=4711): socket$xdp(0x2c, 0x3, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYBLOB="fc00000019000100fdffffff00000000ac1414bb000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000feffffffffff01000000000000000000020000000000000000000000000000000000000000000000fdffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000b06b6e0000000000440008000000000000000000000000000000000000000000320000000000000000000000000000000000ffff2a0101020000000002000400"/176], 0xfc}, 0x1, 0x0, 0x0, 0x8081}, 0x800) symlink(&(0x7f0000000680)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000059c0)='./file0\x00') r1 = syz_io_uring_setup(0x10e, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x801}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185100}) io_uring_enter(r1, 0x7277, 0x0, 0x28, 0x0, 0x0) add_key$keyring(&(0x7f00000000c0), 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$dh_compute(0x17, &(0x7f0000000140), 0x0, 0x0, 0x0) syz_usb_connect(0x3, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x27c, 0x0, 0x25, 0x148, 0xb8, 0x60, 0x1e8, 0x2a8, 0x2a8, 0x1e8, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x3a}, 0xffffff00, 0xff, 'wg0\x00', 'vxcan1\x00', {}, {}, 0x84, 0x1}, 0x0, 0x70, 0xb8, 0x0, {0x200003ae, 0x7f00}}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x2, 0x0, 'snmp\x00', {0x5}}}}, {{@ip={@empty, @dev={0xac, 0x14, 0x14, 0x1c}, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0xd0, 0x130, 0x0, {}, [@common=@unspec=@limit={{0x3c}, {0x7, 0xfff, 0x1040, 0x2, 0x6, 0x1, 0x4}}, @inet=@rpfilter={{0x24}, {0x5}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x0, 0x0, 0x6, 0x3]}, {0x0, [0x0, 0x0, 0x0, 0x4, 0x4]}}}}], {{'\x00', 0xc8, 0x70, 0x94}, {0x24}}}}, 0x2d8) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) ioctl$EVIOCGKEYCODE_V2(r4, 0x80284504, &(0x7f0000000040)=""/165) 5.654289074s ago: executing program 1 (id=4721): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0xffe4, &(0x7f0000000440)={&(0x7f0000000480)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r3, {0x8, 0x7}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x4}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) 5.488858981s ago: executing program 0 (id=4712): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)={0x54, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000080)={{0x0, 0x4}, 'syz1\x00', 0x4b}) ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000100)={0x35, {0x9, 0x0, 0x2000000, 0x3, 0xfffffffd, 0xfffffffe}}) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x15) ioctl$UI_DEV_CREATE(r1, 0x5501) 5.131285002s ago: executing program 0 (id=4713): r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) sendfile(r0, r0, 0x0, 0x7ffff000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="54000000020605000000000000000000000000080c000780080012400000ffff0500010006000000050005000a0005b43000000000000900020073797a320000000010000300686173683a69702c6d61630000003bef8bbc5ab8ab27d6bcfba3acebb2c2d78d898e6b1cd5bb93145f3b6121535b8111a4bea31db2c3e580db2539f15086e849bfd8cc5829c15b198e7754bbb8d2899c954c0b7c01d4b4f6652b502bdccb2805982af363321ac7d89b53223c4fae1fe19712f7"], 0x54}, 0x1, 0x0, 0x0, 0x10}, 0x0) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) add_key(&(0x7f0000000280)='rxrpc\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x32, &(0x7f0000000340)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x7, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x33, 0x0, @private, @broadcast, {[@noop, @ra={0x94, 0x4, 0x1}]}}, {0x0, 0xffff, 0x8}}}}}, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000080)={{0x0, 0x4}, 'syz1\x00', 0x4b}) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000100)={0x35, {0x9, 0x0, 0x2000000, 0x3, 0xfffffffd, 0xfffffffe}}) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x3) r3 = openat$sw_sync_info(0xffffff9c, &(0x7f0000000000), 0x400, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x28, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_BSSID={0xa, 0xf5, @random="300061301e25"}]}, 0x28}}, 0x4040000) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000440)={0x1604, r5, 0x8, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xe5, 0x37}}}}, [@NL80211_ATTR_TID_CONFIG={0x380, 0x11d, 0x0, 0x1, [{0x4}, {0x378, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x88}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x8a}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x354, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x14, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x7f}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x5, 0x8, 0x1, 0x1, 0x8, 0x1, 0x800]}}]}, @NL80211_BAND_60GHZ={0x18, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x9, 0xbaf6, 0x599, 0x5, 0xf900, 0x4, 0x9]}}]}, @NL80211_BAND_60GHZ={0x44, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x6000, 0x6, 0x1, 0xd, 0x9, 0x1, 0xfffd]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0xdf, 0x7f, 0x401, 0x5014, 0x3, 0x8, 0x9]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_2GHZ={0xcc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x24, 0x1, [0xc, 0xc, 0x18, 0x2, 0x2, 0x3, 0x3, 0x3, 0x18, 0x12, 0x9, 0x3, 0x4, 0x1b, 0x5, 0x16, 0x6, 0xb, 0x78, 0x12, 0x2, 0x63, 0xc, 0x12, 0x2, 0x18, 0x16, 0xc, 0x24, 0x1, 0x4, 0xc]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x3}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3b51, 0x0, 0x3, 0x47, 0x7, 0x4d78, 0x7ff, 0x8]}}, @NL80211_TXRATE_HT={0x34, 0x2, [{0x2}, {0x0, 0x2}, {0x1, 0x4}, {0x2, 0x7}, {0x5, 0x4}, {0x4, 0xa}, {0x4, 0x9}, {0x1, 0xa}, {0x0, 0x2}, {0x1, 0x5}, {0x2, 0x3}, {0x2, 0x2}, {0x0, 0xa}, {0x2, 0xa}, {0x3, 0x5}, {0x7, 0x9}, {0x2, 0x9}, {0x4, 0x3}, {0x5, 0x9}, {0x7, 0x6}, {0x3, 0x5}, {0x0, 0xa}, {0x2, 0x7}, {0x4, 0x8}, {0x0, 0x3}, {0x3, 0x6}, {0x1, 0x9}, {0x7, 0x9}, {0x7, 0x9}, {0x1, 0x9}, {0x1, 0x8}, {0x5, 0xa}, {0x1, 0x8}, {0x1, 0x4}, {0x7, 0xa}, {0x0, 0x9}, {0x5, 0x1}, {0x5, 0x5}, {0x7}, {0x6, 0xa}, {0x1, 0x9}, {0x5, 0x5}, {0x2, 0x1}, {0x5, 0xa}, {0x5, 0xa}, {0x0, 0x7}, {0x4, 0x2}, {0x7, 0x8}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x9, 0x2, 0x8, 0x401, 0x3, 0xf4, 0x5]}}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x1b, 0xc, 0x4, 0x625bd5ef9b729356, 0x16, 0x16, 0x18, 0xb, 0x24, 0x3, 0x6, 0x16, 0x4, 0x30, 0x6c, 0x18, 0x18, 0x36, 0x24, 0x6c, 0x6c, 0x4, 0x30, 0x4, 0x0, 0x5]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x44, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x24]}, @NL80211_TXRATE_LEGACY={0x18, 0x1, [0x36, 0xb, 0x48, 0x2, 0x12, 0x2, 0x48, 0x60, 0x48, 0x1, 0x18, 0x60, 0x24, 0x48, 0x16, 0x6c, 0x16, 0x1b, 0x12, 0x6c]}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x36, 0x3, 0x2, 0x18, 0x12, 0x1b, 0x5, 0x16, 0x60, 0x18, 0x0, 0x60, 0x1b, 0x48, 0x5, 0x9, 0x12, 0x6c, 0xb, 0x4d, 0x18, 0x1b, 0x35, 0x6c, 0x1b]}]}, @NL80211_BAND_6GHZ={0x50, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x100, 0x0, 0xd6, 0x1, 0x0, 0x8000, 0x7dd]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xf, 0x7, 0x2, 0x4, 0x1, 0xb7da, 0xa2, 0x5]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x40, 0x4, 0x3, 0x4, 0x4, 0x80, 0x7ff]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_60GHZ={0x13c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x9, 0x1, 0x7, 0x0, 0x8, 0x4, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x47, 0x2, [{0x0, 0x9}, {0x5}, {0x4, 0x8}, {0x2, 0xa}, {0x3}, {0x3, 0x7}, {0x4, 0x7}, {0x7, 0x4}, {0x1, 0x1}, {0x4, 0x7}, {0x1, 0x7}, {0x3, 0x1}, {0x6, 0x5}, {0x1, 0x5}, {0x7}, {0x0, 0x2}, {0x3, 0x1}, {0x5, 0x9}, {0x7, 0x7}, {0x6, 0x9}, {0x1, 0x5}, {0x0, 0x4}, {0x3, 0x8}, {0x0, 0x1}, {0x1, 0x3}, {0x3, 0xa}, {0x5, 0x8}, {0x1, 0x2}, {0x6, 0x4}, {0x1, 0x8}, {0x3, 0x5}, {0x4, 0x9}, {0x1, 0x8}, {0x4, 0x8}, {0x0, 0x9}, {0x1, 0x4}, {0x2, 0x4}, {0x0, 0xa}, {0x4, 0x9}, {0x4, 0x1}, {0x1, 0x6}, {0x2, 0x4}, {0x6}, {0x0, 0x6}, {0x4, 0x7}, {0x6, 0xa}, {0x0, 0x5}, {0x6, 0x7}, {0x3, 0x3}, {0x1, 0x2}, {0x4, 0x2}, {0x7, 0x4}, {0x1, 0x8}, {0x7, 0x7}, {0x1, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x3, 0x8}, {0x3, 0x7}, {0x1, 0x9}, {0x0, 0x6}, {0x7, 0x9}, {0x5, 0xa}, {0x6, 0x5}, {0x1}, {0x1, 0xa}, {0x0, 0x7}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0xfffa, 0x7, 0x5, 0x9, 0x2, 0x86a7, 0x1000]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x5, 0x0, 0x36, 0x18, 0x36, 0x36, 0x44, 0x48, 0x48, 0x30, 0x18, 0x1b, 0x3, 0x60, 0x16, 0x2, 0xb, 0x16, 0x6c, 0x5, 0x5, 0x6, 0x36, 0x6, 0x6c, 0x6c, 0x3, 0x3, 0x6]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0xff, 0x4, 0x5, 0x1, 0x2, 0x2, 0x4]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xda65, 0x4, 0xc8c, 0x2, 0x2, 0x40, 0x5, 0x7]}}, @NL80211_TXRATE_HT={0x28, 0x2, [{0x5, 0x4}, {0x1, 0x4}, {0x2, 0x4}, {0x1, 0x6}, {0x3, 0x3}, {0x6, 0x3}, {0x1, 0x3}, {0x7, 0x3}, {0x2, 0x1}, {0x4, 0x3}, {0x0, 0x1}, {0x0, 0x7}, {0x1, 0x9}, {0x2, 0x6}, {0x1, 0x2}, {0x1}, {0x1, 0xa}, {0x4, 0x1}, {0x3}, {0x3}, {0x0, 0x1}, {0x1}, {0x0, 0x1}, {0x6, 0x4}, {0x6, 0x4}, {0x5, 0x7}, {0x1, 0x8}, {0x0, 0x3}, {0x3}, {0x1}, {0x4, 0x2}, {0x2}, {0x6, 0x2}, {0x3, 0x5}, {0x2}, {0x6, 0x9}]}, @NL80211_TXRATE_HT={0x49, 0x2, [{0x3, 0x7}, {0x0, 0x8}, {0x7, 0x1}, {0x0, 0x6}, {0x1, 0x1}, {0x4, 0x1}, {0x3, 0x7}, {0x5, 0x9}, {0x4}, {0x0, 0x9}, {0x2, 0x8}, {0x2, 0x8}, {0x5, 0xa}, {0x3, 0x7}, {0x1, 0x3}, {}, {0x3, 0x4}, {0x0, 0x3}, {0x2, 0x9}, {0x5, 0x1}, {0x0, 0x5}, {0x6, 0x1}, {0x7, 0x5}, {0x6, 0xa}, {0x1}, {0x5, 0x8}, {0x3, 0x1}, {0x3, 0x5}, {0x5, 0x6}, {0x1, 0x4}, {0x1, 0xa}, {0x1, 0x5}, {0x4, 0x5}, {0x5}, {0x6, 0x9}, {0x6, 0x1}, {0x3, 0x9}, {0x1, 0x6}, {0x1, 0x5}, {0x0, 0x3}, {0x1, 0x7}, {0x3, 0x3}, {0x5, 0x1}, {0x1, 0x5}, {0x6, 0x8}, {0x1, 0x4}, {0x3, 0x5}, {0x3, 0x3}, {0x4}, {0x1, 0x8}, {0x5, 0x6}, {0x6, 0x7}, {0x2, 0x7}, {0x3, 0xa}, {0x4, 0x6}, {0x2, 0x1}, {0x4, 0xa}, {0x3, 0x9}, {0x3, 0x2}, {0x5, 0x8}, {0x7, 0x2}, {0x4, 0x8}, {0x1, 0x6}, {0x1, 0x1}, {0x1, 0xa}, {0x0, 0x1}, {0x5}, {0x0, 0x1}, {0x6, 0x1}]}]}, @NL80211_BAND_2GHZ={0x24, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x17, 0x1, [0x60, 0x60, 0x6c, 0xb, 0x36, 0x30, 0x60, 0x60, 0x30, 0x24, 0x24, 0x2, 0x9, 0x6aab9604fe1e49b6, 0x2, 0x48, 0x2, 0x36, 0x2]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x61}]}]}, @NL80211_ATTR_TID_CONFIG={0x180, 0x11d, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x9}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x8b}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x6}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xa7}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}, {0x38, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x6}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x1f}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0xd0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xbd}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x90, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x14, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x1, 0xfff, 0xff81, 0x0, 0x1, 0x0, 0xe]}}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x7, 0x1, [0x4, 0xc, 0x1b]}]}, @NL80211_BAND_60GHZ={0x4c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x23, 0x1, [0x1, 0x1b, 0x6, 0x18, 0x1b, 0x9, 0xc, 0x48, 0x6c, 0x36, 0x3, 0x2, 0x24, 0x5, 0x12, 0x9, 0x30, 0x60, 0x48, 0x5, 0x18, 0x24, 0x5, 0x30, 0x16, 0x18, 0x12, 0x36, 0x1b, 0x2, 0xc]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x7, 0xfff2, 0xfff, 0xe, 0x4, 0x5, 0xfffb]}}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x6d}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x18, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x314, 0x11d, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x6}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x44}]}, {0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xa7}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xc5}]}, {0xb0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xf8}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x8c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_6GHZ={0x6c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xde, 0x0, 0x5, 0x7, 0x6, 0x341, 0x7fff, 0x3b6]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0xfff, 0x9de, 0x5, 0x641, 0x7ff, 0x81, 0x2]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x400, 0xca3, 0x7ff, 0x401, 0x7, 0xffff, 0xfff9]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9bd, 0xd2, 0x9, 0x2, 0x2, 0x2, 0x6, 0x7]}}]}, @NL80211_BAND_6GHZ={0x4}]}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}, {0x164, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x27}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0xdc, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x44, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x13, 0x2, [{0x4, 0x3}, {0x7, 0x9}, {0x0, 0x6}, {0x4, 0x6}, {0x7, 0x1}, {0x6, 0x2}, {0x2, 0x7}, {0x3, 0x8}, {0x7, 0x4}, {0x7, 0x4}, {0x7, 0xa}, {0x5, 0xa}, {0x0, 0x6}, {0x0, 0x9}, {0x1, 0xa}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x9, 0x7, 0x9, 0x3, 0x2, 0x7, 0x401]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_60GHZ={0x38, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x16, 0x2, [{0x4}, {0x4, 0x3}, {0x5, 0x3}, {0x6, 0x7}, {0x4, 0x9}, {0x1, 0x2}, {0x1, 0xa}, {0x7, 0x4}, {0x2, 0x7}, {0x7, 0x8}, {0x6}, {0x7, 0x6}, {0x2}, {0x0, 0x3}, {0x2, 0x5}, {0x1, 0x2}, {0x3, 0x2}, {0x1, 0x3}]}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x26, 0x18, 0x9, 0x30, 0xc, 0x6c, 0x6, 0x4, 0xb, 0x12, 0x60, 0x60, 0x6c, 0x1b]}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x101, 0x7, 0x9, 0x0, 0x94, 0x400, 0x1, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2d, 0x1, 0xea, 0xa6, 0x4, 0x8, 0xd, 0x2]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x36, 0x6c, 0x0, 0x36, 0x30, 0x4, 0x24, 0x74f6e3c786f82384, 0x60, 0xb, 0xe5a601947b4e7641, 0x16, 0xb, 0x1b, 0x12, 0x1, 0x60, 0x24, 0x2, 0x24, 0x48, 0x36, 0x3, 0x12, 0x9]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x5]}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x60, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x58, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x8, 0x5, 0x8, 0xfffb, 0x9, 0x5, 0x90]}}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x51, 0xc, 0x30, 0x6c, 0x2, 0xc, 0x36, 0xb, 0x5, 0x5, 0x1, 0x9, 0x20, 0x4, 0x1b, 0x18, 0x16, 0xc, 0x6, 0x6, 0x60, 0x2, 0x4, 0x28, 0xc, 0x30, 0x12, 0xc, 0x4]}, @NL80211_TXRATE_LEGACY={0x4}]}, @NL80211_BAND_2GHZ={0x4}]}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x4d}]}, {0x24, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x28, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x30, 0x11d, 0x0, 0x1, [{0x2c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xe}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x978, 0x11d, 0x0, 0x1, [{0x3ec, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xf6}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x3bc, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x4c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x1b, 0x2, [{0x0, 0x7}, {0x2, 0x9}, {0x4, 0x7}, {0x4, 0x1}, {0x5, 0x8}, {0x1, 0x2}, {0x0, 0x8}, {0x4, 0x6}, {0x0, 0x1}, {0x2, 0x3}, {0x1, 0x7}, {0x1, 0x5}, {0x5, 0x1}, {0x0, 0x2}, {0x0, 0x3}, {0x0, 0xa}, {0x7, 0x8}, {0x2, 0x9}, {0x6, 0x8}, {0x0, 0x4}, {0x3, 0x5}, {0x2, 0x2}, {0x0, 0x3}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x9, 0x7, 0x0, 0x7fff, 0xf, 0xcebb, 0x81]}}]}, @NL80211_BAND_5GHZ={0x6c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x3}, @NL80211_TXRATE_HT={0x7, 0x2, [{0x5, 0x9}, {0x0, 0x9}, {0x1, 0x8}]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x1, 0x5, 0xb, 0x6c, 0xc, 0x30, 0x36]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x1, 0x1000, 0x7, 0xa, 0x2, 0x6, 0x2]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x6c, 0x18, 0x16, 0x9, 0x4, 0xb, 0x16, 0x30, 0x6c, 0x4, 0x6, 0x48, 0x9, 0x1b, 0x2, 0x4e, 0xb]}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_5GHZ={0xbc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0x4a, 0x2, [{0x7, 0x6}, {0x0, 0x6}, {0x0, 0x5}, {0x3, 0x8}, {0x4, 0x1}, {0x5, 0x5}, {0x2, 0x2}, {0x6, 0x6}, {0x1, 0xa}, {0x7, 0xa}, {0x6, 0xa}, {0x3, 0x1}, {0x0, 0x3}, {0x6, 0x2}, {0x3, 0x3}, {0x7, 0x6}, {0x3, 0x1}, {0x5, 0x2}, {0x1, 0x1}, {0x0, 0x6}, {0x3, 0x6}, {0x4, 0x8}, {0x6, 0x1}, {0x1, 0x5}, {0x6, 0xa}, {0x6, 0x2}, {0x1, 0xa}, {0x0, 0x9}, {0x1, 0x2}, {0x6, 0x7}, {0x2, 0x6}, {0x7, 0x2}, {0x1, 0x7}, {0x1, 0x1}, {0x7}, {0x2, 0x4}, {0x0, 0x5}, {0x4, 0x6}, {0x1, 0x4}, {0x4, 0xa}, {0x2, 0x3}, {0x1, 0xa}, {0x5, 0x4}, {0x2, 0x4}, {0x2, 0x3}, {0x7, 0x9}, {0x6, 0xa}, {0x0, 0x9}, {0x3, 0x2}, {0x6, 0x2}, {0x7, 0x7}, {0x7, 0x1}, {0x1, 0x3}, {0x7, 0x7}, {0x0, 0x3}, {0x2, 0x8}, {0x6, 0x7}, {0x5, 0x4}, {0x5, 0x7}, {0x7, 0x4}, {0x5, 0x9}, {0x6, 0xa}, {0x0, 0x2}, {0x6, 0x7}, {0x7}, {0x1, 0x2}, {0x7, 0x4}, {0x3, 0x1}, {0x0, 0xa}, {0x2, 0x9}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x2, 0x8, 0x2, 0xd1f1, 0x2, 0x3ff, 0x1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x0, 0x5, 0x101, 0xfff7, 0x3ff, 0x400, 0x8]}}, @NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x4, 0x9, 0x6, 0xc, 0x1b, 0x60, 0x5b, 0x6c, 0x48, 0x17, 0x24, 0x36, 0x4, 0x37, 0x3, 0x2, 0x5, 0x4, 0x0, 0x48, 0x3, 0x60, 0x1b, 0x5, 0x9, 0x24, 0xc]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x8001, 0x6, 0xf951, 0x80, 0x2, 0x3, 0x10]}}]}, @NL80211_BAND_2GHZ={0xac, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x4, 0x89, 0x8, 0x4d2, 0x877b, 0x3, 0x4000]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x8, 0x4, 0x400, 0xd126, 0x4, 0x4, 0xbbf]}}, @NL80211_TXRATE_HT={0x51, 0x2, [{0x7, 0x9}, {0x4, 0x4}, {0x0, 0xa}, {0x0, 0x5}, {0x5, 0x4}, {0x0, 0x6}, {0x0, 0xa}, {0x0, 0x1}, {0x0, 0x4}, {0x0, 0x9}, {0x7, 0x2}, {0x2, 0xa}, {0x5, 0x1}, {0x4, 0x7}, {0x0, 0x7}, {0x5, 0x3}, {0x1, 0x8}, {0x3, 0x7}, {0x1, 0x6}, {0x1, 0x6}, {0x0, 0x2}, {0x2, 0x2}, {0x1, 0x9}, {0x3, 0x4}, {0x4, 0xa}, {0x6, 0x6}, {0x4, 0x5}, {0x2, 0x4}, {0x6, 0xa}, {0x5, 0x5}, {0x0, 0x5}, {0x5, 0x6}, {0x3, 0x1}, {0x3, 0x4}, {0x5, 0x1}, {0x2, 0x6}, {0x1, 0x5}, {0x1, 0x4}, {0x1, 0x3}, {0x0, 0x7}, {0x1, 0x8}, {0x6}, {0x1}, {0x0, 0x3}, {0x1}, {0x2, 0x4}, {0x3, 0xa}, {0x1}, {0x4, 0x1}, {0x6}, {0x0, 0x5}, {0x5, 0x8}, {0x0, 0x1}, {0x4, 0x1}, {0x1, 0x3}, {0x0, 0x4}, {0x4, 0x1}, {0x1, 0x8}, {0x3, 0x19}, {0x3, 0x4}, {0x5, 0x7}, {0x1, 0x7}, {0x5, 0xa}, {0x1, 0x5}, {0x4, 0x7}, {0x5, 0x3}, {0x7, 0x2}, {0x0, 0x9}, {0x5, 0xa}, {0x2, 0x9}, {0x6, 0x1}, {0x3, 0x7}, {0x4, 0x6}, {0x3, 0x1}, {0x6, 0xa}, {0x0, 0x7}, {0x4, 0x2}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_6GHZ={0xa0, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x34, 0x2, [{0x2, 0x8}, {0x0, 0xa}, {0x3, 0x7}, {0x1, 0x8}, {0x3, 0x6}, {0x3, 0x1}, {0x4, 0x5}, {0x7, 0x3}, {0x0, 0x7}, {0x4, 0x2}, {0x2, 0x7}, {0x6, 0x2}, {0x6, 0x6}, {0x5, 0x3}, {0x1, 0x5}, {0x5, 0x7}, {0x5, 0x9}, {0x7, 0x2}, {0x3, 0x3}, {0x7}, {0x0, 0x8}, {0x0, 0x4}, {0x3, 0x3}, {0x3, 0x9}, {0x6, 0x5}, {0x0, 0x2}, {0x0, 0x6}, {0x5, 0x3}, {0x7, 0x2}, {0x2, 0x2}, {0x0, 0x2}, {0x4, 0xa}, {0x3, 0x6}, {0x2, 0x7}, {0x7, 0x3}, {0x0, 0x7}, {0x5, 0x6}, {0x6, 0x4}, {0x7}, {0x3}, {0x2}, {0x3, 0x6}, {0x7, 0x2}, {}, {0x1, 0x3}, {0x7, 0x5}, {0x5, 0x7}, {0x0, 0x2}]}, @NL80211_TXRATE_HT={0x12, 0x2, [{0x5, 0x3}, {0x3, 0x5}, {0x6, 0xa}, {0x0, 0x8}, {0x1, 0x3}, {0x5, 0x8}, {0x4, 0x7}, {0x3, 0x3}, {0x4, 0x8}, {}, {0x6, 0x5}, {0x6, 0x1}, {0x4, 0x1}, {0x6, 0x4}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HT={0x2b, 0x2, [{0x7, 0x2}, {0x5, 0x6}, {0x2, 0x3}, {0x4, 0x4}, {0x5, 0x8}, {0x2, 0x2}, {0x4, 0x2}, {0x7, 0x8}, {0x4, 0x1}, {0x3, 0x7}, {0x7, 0x7}, {0x1, 0x5}, {0x5}, {0x4, 0xa}, {0x3, 0x2}, {0x4, 0x7}, {0x0, 0x8}, {0x5, 0x6}, {0x6, 0x3}, {0x1}, {0x0, 0x6}, {0x1, 0x4}, {0x6, 0x7}, {0x4, 0x1}, {0x7, 0x5}, {0x0, 0x3}, {0x0, 0x3}, {0x3, 0x6}, {0x2}, {0x3, 0x3}, {0x0, 0x7}, {0x2, 0x4}, {0x3, 0x5}, {0x3, 0x8}, {0x1, 0x6}, {0x6, 0x1}, {0x0, 0x4}, {0x7, 0x8}, {0x5, 0x8}]}, @NL80211_TXRATE_HT={0x18, 0x2, [{0x5, 0x5}, {0x4, 0x7}, {0x6, 0x5}, {0x6, 0x2}, {0x5, 0x3}, {0x0, 0x6}, {0x1}, {0x6, 0x8}, {0x1, 0x5}, {0x3, 0xa}, {0x6}, {0x1, 0xa}, {0x1, 0xa}, {0x0, 0x2}, {0x2, 0xa}, {0x0, 0x3}, {0x4, 0x4}, {0x4, 0x6}, {0x6, 0x8}, {0x7, 0x9}]}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x6, 0x3, 0xb, 0x36, 0x6c, 0x36, 0x60, 0x24, 0x24, 0x9, 0x9, 0x0, 0x9, 0x1, 0x48, 0x2, 0x1b, 0x16, 0x6c, 0x16, 0x48, 0xc, 0x74, 0x1b, 0x5, 0x71]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_2GHZ={0x84, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1c, 0x1, [0xc, 0x16, 0x30, 0x18, 0x3, 0x6, 0x24, 0x48, 0x18, 0x6c, 0x60, 0x1, 0x16, 0xb, 0x4, 0x3, 0x1b, 0x30, 0x2, 0x16, 0x60, 0x18, 0x60, 0x6c]}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x36, 0x9, 0x4, 0x2]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfe01, 0x0, 0x2, 0x97f, 0x9, 0x5, 0x3, 0x5]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x7ff, 0x0, 0x8, 0x8001, 0x0, 0x7a2, 0x3]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x81, 0x8, 0xfff, 0x1, 0x1, 0x9, 0x0, 0x8]}}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x4, 0x9}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_5GHZ={0x34, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xea14, 0x80, 0x80, 0xffff, 0xb, 0x7, 0x5, 0x7]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xffff, 0x5, 0x68c, 0x800, 0x3ff, 0x4, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x2f}]}, {0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xbd}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x9d8f}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xcd}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x7}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0x38, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x1}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x7}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x2692}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x48}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x30, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xcb}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}]}, {0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x81}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x2c}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0x164, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x35}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x24}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x12c, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x4c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x33, 0x2, [{0x6, 0x8}, {0x6, 0x2}, {0x5, 0x3}, {0x3, 0x6}, {0x7, 0x1}, {0x7}, {0x4, 0x6}, {0x2, 0xa}, {0x2, 0xa}, {0x2, 0x2}, {0x5, 0xa}, {0x6, 0x9}, {0x0, 0x9}, {0x0, 0x6}, {0x3, 0x7}, {0x7, 0x5}, {0x2, 0xd}, {0x5, 0x4}, {0x0, 0x8}, {0x0, 0x7}, {0x0, 0x7}, {0x2, 0x9}, {0x6, 0x4}, {0x3, 0x7}, {0x4, 0x2}, {0x1, 0x9}, {0x7, 0x3}, {0x1, 0x2}, {0x0, 0xa}, {0x4}, {0x1, 0x9}, {0x0, 0xa}, {0x3, 0x8}, {0x4, 0x3}, {0x3, 0x5}, {0x2, 0x4}, {0x5, 0x1}, {0x1, 0x2}, {0x3, 0x4}, {0x6, 0x2}, {0x1, 0x9}, {0x5, 0x9}, {0x7, 0xa}, {0x5, 0x7}, {0x4, 0x6}, {0x2, 0x5}, {0x6, 0x1}]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0xa, 0x1, [0x18, 0x24, 0x6c, 0x12, 0x1, 0x48]}]}, @NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x1ff, 0x6, 0xff, 0x4, 0x2, 0xbf, 0x2d3, 0xfff8]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x7f, 0x2, 0x8001, 0x8, 0xfffc, 0x2, 0x7]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_60GHZ={0x7c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0xa012, 0x0, 0x1, 0x5a5, 0x0, 0x3, 0xfffc]}}, @NL80211_TXRATE_LEGACY={0x6, 0x1, [0x3, 0x4]}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x1, 0x3, 0x60, 0x5, 0x48, 0x6c, 0x4, 0x30, 0x36, 0xc, 0x1, 0x30, 0x24, 0x4, 0x48, 0x1b, 0x18, 0x16, 0x9, 0x1b, 0xb]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x2f, 0x2, [{0x3, 0x5}, {0x2, 0x5}, {0x1}, {0x1, 0x7}, {0x6, 0x6}, {0x6}, {0x7, 0x1}, {0x1, 0x2}, {0x4, 0x7}, {0x3, 0x9}, {0x4, 0x1}, {0x5, 0x7}, {0x4, 0x2}, {0x0, 0x9}, {0x4, 0x5}, {0x4, 0x3}, {0x1, 0x8}, {0x6, 0x3}, {0x1, 0x2}, {0x5, 0x9}, {0x0, 0x2}, {0x6, 0x6}, {0x0, 0x2}, {0x4, 0xa}, {0x7, 0x3}, {0x3, 0x4}, {0x5, 0x1}, {0x2, 0x3}, {0x3, 0x7}, {0x3, 0x8}, {0x7, 0x8}, {0x2, 0x6}, {0x7, 0x7}, {0x1, 0x1}, {0x4, 0x4}, {0x4, 0x7}, {0x0, 0xa}, {0x0, 0xa}, {0x6, 0x4}, {0x1, 0x7}, {0x1, 0xa}, {0x1, 0x7}, {0x5, 0x5}]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_6GHZ={0x2c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x13, 0x1, [0x16, 0x6, 0x4, 0x9, 0x16, 0xc, 0x1b, 0x36, 0x4, 0x16, 0x3, 0xc, 0x18, 0x15, 0x9]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8000, 0x0, 0x23cd, 0xa, 0xa, 0x5c3b, 0x3, 0x9]}}]}]}]}, {0x2f0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x2cc, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x58, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x7, 0x3, 0x9, 0xd, 0x4a63, 0x3, 0x401]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x60, 0x1, 0x1b, 0x6a5e65459c27bab2, 0x18, 0x24, 0x48, 0x0, 0x12, 0x12, 0x2, 0x9, 0x18, 0x16, 0x4, 0x9, 0x2b, 0x24, 0x36, 0x16, 0x5, 0x36, 0x2, 0x16, 0x6, 0x16, 0x2]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_60GHZ={0x40, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x3000, 0x2, 0x5, 0x5, 0xfff, 0xa, 0xfff5]}}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0x5, 0x16, 0x48, 0x5]}, @NL80211_TXRATE_HT={0x9, 0x2, [{0x6, 0x4}, {0x0, 0x8}, {0x5, 0x9}, {0x2}, {}]}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x6c, 0x9, 0x1, 0x48, 0x2, 0x0, 0x24, 0x56, 0x9, 0x1, 0x1, 0x16, 0x1]}]}, @NL80211_BAND_2GHZ={0x68, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0xa, 0x2, [{0x6, 0xa}, {0x2, 0x7}, {0x7}, {0x5, 0x5}, {0x6, 0x5}, {0x6, 0x2}]}, @NL80211_TXRATE_LEGACY={0x22, 0x1, [0x60, 0xb, 0x6, 0xb, 0x3, 0x12, 0x1b, 0x9, 0xc, 0x8, 0x48, 0x24, 0x3, 0x18, 0x48, 0x6, 0x5, 0x4, 0xb, 0x6, 0xb, 0x6, 0x16, 0x5, 0x30, 0xc, 0x24, 0x16, 0xd0c27a9ea03b79e0, 0x60]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0xa, 0x2, [{0x5, 0x5}, {0x7, 0x3}, {0x0, 0x7}, {0x0, 0x8}, {0x7, 0x9}, {0x6, 0x3}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0x114, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4c, 0x2, [{0x6, 0x1}, {0x3, 0x9}, {0x0, 0xa}, {0x1, 0x5}, {0x6, 0x3}, {0x2, 0x2}, {0x1, 0x7}, {0x4, 0x2}, {0x7, 0x1}, {0x0, 0xa}, {0x4, 0x3}, {0x1, 0x7}, {0x0, 0x6}, {0x5, 0x7}, {0x5, 0x2}, {0x0, 0x9}, {0x5, 0x6}, {0x3, 0x3}, {0x6, 0x8}, {0x0, 0x5}, {0x7, 0x1}, {0x1, 0x8}, {0x5, 0x3}, {0x6, 0x4}, {0x4, 0x6}, {0x6, 0x8}, {0x6}, {0x4, 0xa}, {0x3, 0x1e}, {0x0, 0x7}, {0x2, 0x1}, {0x4, 0x9}, {0x2, 0x4}, {0x2, 0x2}, {0x1, 0x9}, {0x6, 0x6}, {0x3, 0x9}, {0x0, 0x1}, {0x1, 0x5}, {0x4}, {0x2, 0x6}, {0x3, 0x3}, {0x0, 0x6}, {0x6, 0x7}, {0x0, 0x8}, {0x7, 0xa}, {0x5}, {0x5, 0x6}, {0x5, 0x2}, {0x6, 0x2}, {0x5, 0x8}, {0x3, 0x1}, {0x2, 0x5}, {0x7, 0xa}, {0x3, 0x7}, {0x2, 0x6}, {0x3, 0x1}, {0x7, 0x2}, {0x6, 0x2}, {0x4, 0x5}, {0x0, 0x1}, {0x7, 0x1}, {0x3, 0x9}, {0x6, 0x5}, {0x7, 0x4}, {0x0, 0x7}, {0x2, 0x8}, {0x1, 0x1}, {0x2, 0xa}, {0x2, 0x3}, {0x1, 0x2}, {0x1, 0x2}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x6, 0x1800, 0x1, 0xffff, 0x3, 0x1fae, 0x2]}}, @NL80211_TXRATE_HT={0x4c, 0x2, [{0x4}, {0x6, 0x3}, {0x3, 0x5}, {}, {0x1, 0x9}, {0x5, 0x8}, {0x1, 0x5}, {0x1, 0x4}, {0x2, 0x7}, {0x0, 0x4}, {0x6, 0x9}, {0x6, 0x9}, {0x1, 0x5}, {0x0, 0x5}, {0x7, 0x3}, {0x1, 0x1}, {0x0, 0x8}, {0x0, 0x2}, {0x5, 0x2}, {0x6, 0x4}, {0x1, 0x5}, {0x1, 0x6}, {0x6, 0x6}, {0x2, 0x2}, {0x0, 0x1}, {0x1, 0x3}, {0x2, 0xa}, {0x3, 0x3}, {0x1, 0xa}, {0x1, 0xa}, {0x1, 0x2}, {0x6, 0x1}, {0x2}, {0x0, 0x5}, {0x3, 0x7}, {0x7, 0x7}, {0x6, 0x6}, {0x1}, {0x4, 0x2}, {0x0, 0x8}, {0x1}, {0x1, 0x7}, {0x7, 0x4}, {0x0, 0x9}, {0x6, 0x5}, {0x4, 0x4}, {0x5, 0x5}, {0x7, 0xa}, {0x7, 0x8}, {0x3, 0x7}, {0x7, 0x7}, {0x7, 0x1}, {0x5, 0x6}, {0x6, 0x3}, {0x3, 0x8}, {0x3, 0x4}, {0x0, 0x8}, {0x0, 0x3}, {0x1, 0x2}, {0x1, 0x1}, {0x4}, {0x3, 0x2}, {0x0, 0x9}, {0x7, 0x1}, {0x7, 0x5}, {0x3}, {0x5, 0x5}, {0x2, 0x6}, {0x6, 0x1}, {0x2, 0x1}, {0x4}, {0x5, 0x9}]}, @NL80211_TXRATE_HT={0x33, 0x2, [{0x0, 0x4}, {0x5, 0x4}, {0x3, 0x3}, {0x5, 0x9}, {0x6, 0x3}, {0x3, 0x1}, {0x6, 0x7}, {0x1, 0xa}, {0x1, 0x8}, {0x7, 0x3}, {0x1, 0x7}, {0x1, 0x2}, {0x2, 0x5}, {0x1, 0x1}, {0x0, 0x8}, {0x0, 0x9}, {0x5, 0x2}, {0x0, 0x4}, {0x0, 0x7}, {0x2, 0x1}, {0x4, 0x3}, {0x7, 0x6}, {0x7, 0x9}, {0x0, 0x4}, {0x0, 0x8}, {0x2, 0x4}, {0x1, 0x2}, {0x4, 0xa}, {0x4, 0x6}, {0x3, 0xa}, {0x7, 0x4}, {0x7, 0x6}, {0x5, 0x1}, {0x0, 0x8}, {0x5, 0xa}, {0x7, 0x7}, {0x3, 0x2}, {0x5, 0x7}, {0x4, 0x6}, {0x6, 0x9}, {0x0, 0x5}, {0x0, 0x6}, {0x7, 0x7}, {0x2, 0xa}, {0x6, 0x6}, {0x6, 0x5}, {0x0, 0x8}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x6, 0x6, 0x0, 0x1265, 0xb96e, 0x2, 0xe65e]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x8000, 0x7f, 0x4faa, 0xb, 0x9b, 0x7fff, 0x5]}}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x100, 0x8, 0x8, 0x0, 0x2, 0x59e, 0x9865, 0x8]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x3, 0x2, 0xffc0, 0x1, 0xa, 0xfffa, 0x1]}}]}, @NL80211_BAND_2GHZ={0x18, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x7313, 0x6, 0x8, 0xb0c, 0x3, 0x1, 0x6, 0x6]}}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x5}, @NL80211_TXRATE_LEGACY={0xc, 0x1, [0x26, 0x5, 0x2, 0x3, 0xc, 0x4, 0x4, 0x1d]}]}, @NL80211_BAND_5GHZ={0x50, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x5, 0xfffc, 0x6, 0x5, 0x1000, 0xd, 0x6]}}, @NL80211_TXRATE_HT={0xd, 0x2, [{0x2, 0x9}, {0x5, 0x7}, {0x3, 0x8}, {0x0, 0xa}, {0x4, 0x9}, {0x3, 0x4}, {0x7, 0x6}, {0x2}, {0x1, 0x8}]}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x4, 0x60, 0x4, 0x3, 0x4, 0x1b, 0x9]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x4, 0xffff, 0x9c52, 0xc, 0x200, 0x4, 0xfffc]}}, @NL80211_TXRATE_GI={0x5}]}]}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x3b8, 0x11d, 0x0, 0x1, [{0xec, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0xd8, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x14, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_5GHZ={0xb4, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x401, 0x5f, 0x9, 0xbae4, 0x100, 0x6, 0x4]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9083, 0x9, 0x4, 0xa, 0x3, 0x9, 0x2000, 0x5]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x24, 0x1, [0x18, 0x60, 0x18, 0x0, 0x5, 0x2, 0x18, 0x5, 0x60, 0x18, 0x2, 0x0, 0x48, 0x36, 0x60, 0x48, 0x18, 0x2, 0x30, 0x1b, 0x1, 0x6, 0x1, 0x6c, 0x18, 0x36, 0xb, 0x24, 0x3, 0xc, 0x12, 0x30]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HT={0x3a, 0x2, [{0x1, 0x1}, {0x5, 0x1}, {0x6, 0x5}, {0x1, 0x9}, {0x1, 0xa}, {0x1, 0x3}, {0x3, 0xa}, {0x7, 0x5}, {0x4, 0x7}, {0x7, 0x6}, {0x0, 0x4}, {0x6, 0x9}, {0x2, 0x4}, {0x0, 0x6}, {0x4, 0x6}, {0x5, 0x2}, {0x6, 0xa}, {0x2, 0x6}, {0x7, 0x4}, {0x2, 0x6}, {0x0, 0x5}, {0x7, 0x3}, {0x6}, {0x4, 0x1}, {0x5, 0x8}, {0x6, 0x7}, {0x3, 0x2}, {0x0, 0x3}, {0x1, 0x3}, {0x2, 0x5}, {0x7, 0x2}, {0x2, 0x9}, {0x7, 0x6}, {0x7, 0x8}, {0x7, 0x5}, {0x3, 0x7}, {0x0, 0x3}, {0x2, 0x9}, {0x6, 0x9}, {0x3}, {0x1, 0x4}, {0x0, 0x3}, {0x7, 0x8}, {0x0, 0x1}, {0x1, 0x7}, {0x3, 0x5}, {0x7, 0x8}, {0x3, 0x9}, {0x2, 0x4}, {0x5, 0xa}, {0x3, 0x4}, {0x5, 0x8}, {0x1, 0x2}, {0x2, 0x2}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5}]}]}]}, {0x12c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x5a}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0xc0, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x44, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x760d, 0x6, 0xe, 0x7, 0xe, 0x5, 0x9]}}, @NL80211_TXRATE_HT={0x23, 0x2, [{0x5, 0x1}, {}, {0x1, 0x3}, {0x0, 0x1}, {0x7, 0x8}, {0x0, 0x3}, {0x7}, {0x2, 0x3}, {0x7, 0x7}, {0x1, 0x1}, {0x7, 0x7}, {0x5, 0x4}, {}, {0x4, 0x4}, {0x1, 0x2}, {0x2}, {0x0, 0xa}, {0x1, 0x6}, {0x0, 0x2}, {0x6, 0x1}, {0x3, 0x9}, {0x2, 0x7}, {0x1, 0x7}, {0x6, 0x4}, {0x4, 0x1}, {0x3, 0x4}, {0x2, 0x7}, {0x5, 0x3}, {0x3, 0x2}, {0x1, 0x5}, {0x6, 0x2}]}]}, @NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x100, 0x4, 0x7f, 0x2, 0x1, 0x0, 0x5c, 0x1ff]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xa0a, 0x2, 0xff80, 0x0, 0x3, 0x4, 0x2, 0x7]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x8000, 0x9, 0x0, 0x4, 0x0, 0x6, 0x2, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0xc116, 0x2000, 0xa, 0x9, 0x8, 0x6, 0x20]}}, @NL80211_TXRATE_HE_LTF={0x5}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x48, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x44, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x6, 0x3, 0xffff, 0x8, 0x2, 0x81]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x18, 0x1, [0x6c, 0x1, 0x6c, 0x30, 0x2, 0x6, 0x24, 0x7, 0x5, 0x30, 0x16, 0x48, 0x1, 0x4, 0x5, 0x30, 0x48, 0x6, 0xc, 0xb]}, @NL80211_TXRATE_LEGACY={0xa, 0x1, [0x16, 0x4, 0x48, 0xc, 0x2, 0x18]}]}]}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xce}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x1d}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x3e}]}, {0x120, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x6c}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0xd4, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x84, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x6, 0x1, [0x6c, 0x9]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x2, 0x2, 0x5, 0x3, 0x5773, 0x0, 0x2041]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0xffff, 0x0, 0x6, 0x0, 0x2, 0xa, 0xd]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x0, 0x8, 0x8, 0x0, 0x0, 0x100, 0x9]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8, 0x7, 0x4b, 0x7, 0x5, 0xfffd, 0x100, 0x2]}}]}, @NL80211_BAND_2GHZ={0x40, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x71, 0xe, 0x6, 0x5b, 0xd54, 0x10, 0xf220]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0xc, 0x0, 0x53d, 0x3, 0x3ff, 0x5, 0x5]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x1ff, 0x8001, 0x4, 0x9, 0x1, 0x400, 0xb8]}}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xb9}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x91}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x27}]}, {0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x1}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x6}]}]}, @NL80211_ATTR_TID_CONFIG={0x70, 0x11d, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x9}]}, {0x4c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x2d}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x6f}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe2}]}]}]}, 0x1604}, 0x1, 0x0, 0x0, 0x4000}, 0x44000) ioctl$UI_SET_EVBIT(r2, 0x40045564, 0x15) ioctl$UI_DEV_CREATE(r2, 0x5501) 4.938771963s ago: executing program 1 (id=4714): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_open_dev$vbi(0x0, 0x0, 0x2) r1 = socket$pppoe(0x18, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x18}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$cgroup_pid(r3, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x401c5820, 0x0) r4 = fsopen(&(0x7f0000000000)='sysfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) renameat2(r5, &(0x7f0000000340)='./bus\x00', r5, &(0x7f0000002200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0x4008af12, 0x0) socket$nl_generic(0x10, 0x3, 0x10) connect$pppoe(r1, &(0x7f0000000400)={0x18, 0x0, {0x2, @broadcast, 'veth0\x00'}}, 0x1e) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="80010000100013070000000000000000ffffffff0000f5ffa01e9fa453dc0727dca211fa3400000000000000000000fe80000000f4000000000000000000bbe750d2bb216762cb0000000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ac14140000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000004800020063626328616573290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d6163286165732900"/312], 0x180}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000000080)={0x18, 0x0, {0xd, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 'veth1\x00'}}, 0x1e) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x40a40, 0x0) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000040)=0x2) ioctl$PPPIOCATTCHAN(r8, 0x40047438, &(0x7f0000000380)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56743, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0x10}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048004}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newtfilter={0x9c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, r11, {0x0, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x6c, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x54, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0x4c, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x23}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xc5}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x2}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x4}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0xfffffffb}, @TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x101}]}, @TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0x4}, @TCA_FLOWER_KEY_TCP_FLAGS_MASK={0x6, 0x48, 0x2f62}, @TCA_FLOWER_KEY_IP_TTL={0x5, 0x4b, 0xff}]}}]}, 0x9c}, 0x1, 0x0, 0x0, 0x80}, 0x800) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x8580) 4.770917378s ago: executing program 3 (id=4715): r0 = syz_open_dev$sndctrl(&(0x7f0000000040), 0xe26, 0x101400) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = getpgid(0x0) sched_setattr(r2, &(0x7f0000000240)={0x38, 0x6, 0x10, 0x8001, 0x62, 0x7, 0x891b, 0xffffffffffffffff, 0x7a, 0x8001}, 0x0) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r5 = openat$dir(0xffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x60) utimensat(r5, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)={{0x0, 0x2710}}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r6 = accept4(r1, 0x0, 0x0, 0x80000) sendmsg$alg(r6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x28000054) sendmsg$nl_route_sched_retired(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) r7 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000000)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$setperm(0x5, r7, 0x52b242d) statfs(&(0x7f0000000380)='./file0/file0\x00', &(0x7f00000006c0)=""/90) keyctl$invalidate(0x15, r7) keyctl$read(0xb, r7, &(0x7f0000000040)=""/117, 0x75) keyctl$link(0x8, 0x0, r7) recvmmsg(r6, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000400)=""/199, 0xc7}, {&(0x7f0000000500)=""/250, 0xfa}, {&(0x7f0000000600)=""/191, 0xbf}, {0x0}, {&(0x7f0000000340)=""/30, 0x1e}], 0x5}, 0x4}], 0x2, 0x60, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000003c000701fcffffff00000000017c0000100036800c00020008000000007000000c000180060206"], 0x30}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000140)=""/106) 4.357201946s ago: executing program 1 (id=4716): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000b00)={0x18, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c369197d09647"], 0x0, 0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x8, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000efff0000"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4) r1 = syz_usb_connect(0x1, 0x60a, &(0x7f0000000b40)={{0x12, 0x1, 0x201, 0x6d, 0x22, 0xb0, 0xff, 0x1410, 0xa002, 0x2c6e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f8, 0x2, 0x5, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x67, 0xbf, 0x6, 0x53, 0xf6, 0x8d, 0xf0, [@generic={0x81, 0x2, "c895bba24e5b3d3bba89cc31fb9bae4dc3ac370733f53900e13c30a30bc465ffd3d247933bf232c3c0408da9064741620b2bf925d7580f2034e61d2ff59631401c424e12c0ef3320a6083ccf73ac3cc00f12a72995d3dd8c5fa5a420b01f24f6c95ec13446e025e4439e776b87c253acae1fcc6f27f230268d65e7af330538"}], [{{0x9, 0x5, 0x1, 0x1, 0x0, 0x3, 0x5, 0x7, [@generic={0x5b, 0x22, "2b5ba7b3efcc1c0913287049a27988b7f0bef0a2971c89e67bb486288bfa5761e4c2ea1e05e9be9d819208655b4748cf23c9045e51fabe702c57f76a9bb67e829ee2c331ff98747c72267174b9a19d28830726f543c7efb844"}]}}, {{0x9, 0x5, 0x3, 0x10, 0x3ff, 0x7, 0x8a, 0xd, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x81}]}}, {{0x9, 0x5, 0xa, 0x10, 0x400, 0xd6, 0x4, 0x8, [@generic={0xf6, 0x2, "9837e4bcca9de182af930303da285884ecdade3194a951263f2af8196e63c1d51e5f67a9dc3f4bc55e2d5d47941313b25b9c754057db2f353b257c4f116c9b607da5aeb576b32e003dfa21102b8b04dedde176aa2f11e62596e873b15e3af4f14da31400ff2ba6b6080f0bc8f68acc68dbf7207647589bbad08b21400b33154bcc76879a554beb83d1b2d71cd45c98fc3837f4b8bc7d1c6ac688b95fe8e72831be8e054a810f7d361ada1524e13bcfd422de58caf010bad807e6698f86a439b800c0c49d793b01494d6c789ba4197261cbdcc8a5a490a04e18ddba98429d1c53c293184f314bf73fb5c7fabd95dd488de4ac28b6"}, @generic={0x38, 0x3b, "5ae008d3995c708bcdd007ba25bea034e5318076d5e9b6a5cc03e41658fb8fb03fde0467f1e462315cbcd9aef16adb65a1c9b4073970"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x3ff, 0x2, 0x3, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x2, 0x1d}]}}, {{0x9, 0x5, 0x80, 0x0, 0x0, 0x3, 0x3, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xc, 0x30}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x3}]}}, {{0x9, 0x5, 0x7, 0x0, 0x20, 0x40, 0x40, 0x1, [@generic={0xd5, 0x21, "6c9c0505a89f67360cd17169cb679246274272638017752e14b4c38ec77c34b677b5531d35f98fe976da880da7dcd59556dee8356bdb0becc44859eb4f57e1a49fd03a046be3eec6635867a5f7b191e50bde9adcf6e57ca6a280ec7716ed23a75f31eb41b0d763d65fda78a8bc0d86911d952f5ceb43a350b1a0b59539ff310b9317bc59d28b7889f583be42a2b8e7ab0ca50b0bea9914b1d6c8551bfe6d2e9b16c6b5114664907cbab7d1cfbedfb9d200f9e456423b42d545690ecd18112187651232cd69c79ffee2d596d4e1a1aa4a5e8f6c"}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0xf}]}}]}}, {{0x9, 0x4, 0x54, 0x1, 0x6, 0x6, 0xf, 0x2, 0x6, [@hid_hid={0x9, 0x21, 0x3, 0x2, 0x1, {0x22, 0xb87}}, @uac_control={{0xa, 0x24, 0x1, 0x7, 0x9}, [@selector_unit={0x7, 0x24, 0x5, 0x6, 0x0, "bf1f"}]}], [{{0x9, 0x5, 0xd, 0x1, 0x10, 0x6, 0x80, 0x2, [@generic={0x1a, 0x21, "f01cd46b9291fe0059ac14f55ae0a1198771e37f92e0d6b9"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x3ff, 0x5, 0x0, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x6}, @generic={0xa4, 0x22, "2c732ce59f5b80441b425f7688ea6722e28ec2b0b79df9c82ec3e4cc3e4b330207aa1743a221692aab22ac3560a86ed9396a820d7fb9be5177acb6bfe5c77e228e5429f8c26495188b406affc2116ed4bae702daca4b1bb45b5efdc808fed0c9715079e7bae85db0c1bc666d334f0f27b0bd06d2bf16d1489c5361ac7ea6061d9a0cdaf21d8e8612b17e47f88c4f57c8e5509b716f20f2cc80c4e95bab4d6e379e07"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x20, 0x8, 0x4, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x1}, @generic={0x8b, 0x7, "a6c226d8198b645240849914077e78e80fadc92fdf9272074d9b2c40e4b40a4674a69a98940bd33db50f38297a19f669307f71ae127fef911705d6a1387f0a1931de10d366bfd8abc03a10076ef545bcbe85a82c5d407ab4a6dad2f0e6ab64ed495aeea6798044a353debabcf2c603089655c6b0cf6a5f060ce5b5f1f15a95dee826b4704b5a18d7cd"}]}}, {{0x9, 0x5, 0x1, 0x3, 0x3ff, 0x90, 0x3, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x6, 0x7}]}}, {{0x9, 0x5, 0x80, 0x10, 0x20, 0x80, 0x1, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x10, 0x8}]}}, {{0x9, 0x5, 0x0, 0xc, 0x10, 0xf9, 0x7, 0x9, [@generic={0x20, 0x21, "ba17bc5e43e214ac2f32fce044b963ccc22521fce7408df6ce58896a68f3"}, @generic={0xd1, 0x23, "09b85081e7a10fdff0202aad5a4d53dc40a47ef0ebc319cbfc182124a0a3c28f66479592de41fa673ce3a1736f783626eaa1ff4d64b2080f45d901d68e5205839f2d28ac00a8c47dd373c1179e387b805707971584cd79962bd187090bcdc60ff190755a37446c0d4d9100a2a2768939e84450a6ee449cb62aa51c4196c639ffe2614e362ec7dbef94df88738e147ffbd3e5d3e70c29513a4c289a6e796037062735fc9c138522f911ab68ce37890d843706a88a3814ce7a88b05df4bef76d42b4a6e0f8aff0453f5455c42f563da1"}]}}]}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x250, 0xd2, 0x8, 0xf4, 0xff, 0xbc}, 0x8, &(0x7f0000000080)={0x5, 0xf, 0x8, 0x1, [@ptm_cap={0x3}]}, 0x4, [{0xa7, &(0x7f00000000c0)=@string={0xa7, 0x3, "bc1e3f0ebad55adce0d8cdeb2c4066beb38c99de5b573b4e74da6dbe0ea0773b2ef4fec8e7c77bdb1bca9ad517785601e5b4ccb02038a715b85da84de990f2edc44f1f767c28eb998e726addbb38d23e97c9ddf29710e78d004698af1a5a6eb11636eab9e81ba02dcfc93c3695474cda03934ebe274aa3e77962f9f780c13482618f93659c856db2802704a214e883cdb598e81fc954c54f6632ebdfccc21a4394e2068394"}}, {0x43, &(0x7f0000000180)=@string={0x43, 0x3, "400cca7f366c9117258b2ea0d3788aa61a101fe8a20b718e1f2ee18b9d6fa4e5c8287273f5174b8e5d61cb2f9851361ba87919bf695b6d7a9c52ba1ea7a11ec52d"}}, {0xc0, &(0x7f0000000200)=@string={0xc0, 0x3, "685dbfea0f0e4fec4920b0001b79bb9710737dcbe0797e4a6734155b31a0b7a9b1bdd52e6eaaf0637134f0e16daed4f4bb4b764fb9b5c322a204a54fc839b8d04c89b7e90bba262aa98f884bfc96b65b32b9cea8daedac0778340c87b632b85183e8986e44d4e26ee0f552dff4527fca18c25fc177373feaed27327e37837334266bca375a8b5caaab0775645c1b778faf88bea406bd365d708e8979b05da989d1795b636521b8a2080de0a9d3044ad966574076b0875744d51d56fd4770"}}, {0xad, &(0x7f0000000340)=@string={0xad, 0x3, "141cec11505b3dc314d69a430fec43b92218c72da42a0d60cef7c1fe6384593517ab61c4a8c49d520534fe563a4ee4ab2a17d1efdfaf93251bef8f864211a3a795150acb1b56adc853c2c99914db177a0827b946985d718127588b548d8a119823dbbf9f71ec8d1bdbf653e091fde80612995dc4e79223de57a034633b3b633e4ec9f8bfc4c57673e1ada9fdff3de2506317f5bee8f58e7d70b53f18ef43ec5a543872c9fdebfe981d282c"}}]}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f0000000980)={'\x00', 0x2, 0x324, 0x8000, 0x653c, 0xf3, 0xffffffffffffffff}) syz_open_procfs(r2, &(0x7f00000009c0)='fd\x00') syz_usb_control_io$hid(r1, &(0x7f00000006c0)={0x14, &(0x7f0000000540)={0x20, 0x23, 0xc4, {0xc4, 0x3, "d10f3a7393ce91943d8a5427f6de7329ec32c699ed9c7795c87bd9e24aa43b97804b868f3d1c17fe211d6847983fd2d663efac62ca1bf76e7cfed5d42df1890c8d500c308b5bc6464d71d6ef78481286c3c8ef41c09807bac5aa11fd4915771e7909d6133fbd1c9a4413379a44a5fef95807cf5b485d54388a9c989ef9edd90e08608d49cf806d2f9f94555a1910e7179b377873f799fba0b852bc4a3ce09072e40368c7d6a848776374658c5c39c83f86d1baf4cc96a9dedaa084166766e43ca166"}}, &(0x7f0000000400)={0x0, 0x3, 0x4, @lang_id={0x4}}, &(0x7f0000000440)={0x0, 0x22, 0x11, {[@main=@item_012={0x2, 0x0, 0x8, "8c2e"}, @local, @local=@item_012={0x1, 0x2, 0x1, "e3"}, @local=@item_4={0x3, 0x2, 0x7, "1a713ca2"}, @global=@item_012={0x0, 0x1, 0x1}, @global=@item_4={0x3, 0x1, 0x6, "f5167173"}]}}, &(0x7f0000000640)={0x0, 0x21, 0x9, {0x9, 0x21, 0x7, 0xfc, 0x1, {0x22, 0x960}}}}, &(0x7f0000000940)={0x18, &(0x7f0000000700)={0x0, 0xe, 0x6d, "0f040d4fbb502b9a8e76749d065a56df77bf9855a831856604559a732096f187c2a6d78a317fd9f8fe71e96b84bf3ae484eb542f0d4de8d69c00732699cb9111631d2accc99f522358c74c0e21eca6155d10f49a8fde1ac255f7a0777ca1a1a3685476aee9fa36b1eee5a3a49c"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x5c}, &(0x7f0000000800)={0x20, 0x1, 0xe9, "50cf134b1917640fda3295a6e35aa216ba54738f3564453cf05ee42f1557fd05703d3ff3e46ca06c152e37fe6aff4f3d32e3a4caf4b8bea11cb23d9709e0bb85c298da45e5d423dca081fb09472f5ae002571883cc39690086f8c9dcd79f09da788d7fc914c872296ca5608b5bc7d833f9c1d73e332a6c1bfa79d7c352e69534bb20dc98afe175ec2d072fa8dc1304c7feb28be7810cf8f89ced68ae419530ece3222e70606ce4236be869a392e0980a0646e78ca519dd0905a0c90dab5dff5251cf220f3f7c25ebc012c2cec70d14354227dadef70c176edbeaa3a34edc4b3d04a4367b793c32ceb1"}, &(0x7f0000000900)={0x20, 0x3, 0x1, 0x4}}) syz_usb_control_io$hid(r0, &(0x7f0000000680)={0x24, &(0x7f0000000500)=ANY=[@ANYBLOB='\x00\f\r'], 0x0, 0x0, 0x0}, 0x0) 4.035899399s ago: executing program 0 (id=4717): syz_open_dev$vim2m(&(0x7f0000000580), 0x8, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) keyctl$restrict_keyring(0x1d, 0x0, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000240)='asymmetric\x00', 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_io_uring_setup(0x487, &(0x7f0000000480)={0x0, 0x707b, 0x1, 0x4, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000300)=@IORING_OP_RENAMEAT={0x23, 0x14, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r3, 0x195e, 0x0, 0x0, 0x0, 0x0) msgctl$MSG_INFO(0xffffffffffffffff, 0xc, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x141a82, 0x0) write$cgroup_int(r6, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB="2a0000000313ffcf44164bdb0000000000000000000000010000000000000009000000000000002f640000c4b943dc5f823384bb9710d4e8289e955650982e5da24a5b2a50"], 0x7a) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$SNDCTL_DSP_SETTRIGGER(0xffffffffffffffff, 0x40045010, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) unshare(0x20000400) r7 = socket(0x40000000015, 0x5, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) syz_io_uring_setup(0xd6, 0x0, &(0x7f0000000040), 0x0) 3.62422963s ago: executing program 2 (id=4718): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0500000004000000080000000a"], 0x48) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000040)="1400000052004f030e789e7e27286d000a4149f3", 0x14) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0) fsetxattr$security_capability(r4, 0x0, &(0x7f0000000140)=@v2={0x2000000, [{0x3475, 0x7}, {0x81, 0x5}]}, 0x14, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_tcp_buf(r5, 0x6, 0x1, &(0x7f0000000240)=""/201, 0x0) syz_usb_connect$uac1(0x0, 0x0, 0x0, 0x0) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000798fc454a5ad8e00ab794993fcf920d5f5dbc095f62a90946281f2f69089de64ac877ffbcfea6ac9f10379c9dbb641cc33b86ff3854b473979ab05000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x8, 0xd, &(0x7f0000000400)=ANY=[@ANYBLOB="1806000000000000000000000000000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70300000a000000850000000c000000b70700fdffffffffffffff00e98fef2b9ee2a6de152632c19a0130f5039b00feb8e603f3e914e223004c335fd09f0102ea089f5e70528b89e2f6350400dd82f572f7c088fd3756d4937af637cd966504abfd9a0148818559e41d55c50161992bba9125d3c976cfc462a2665aae4137129e1ca5cceb63cf378593b458d8962c49739f5e29943f", @ANYRES32=r7, @ANYBLOB="0000000000000000b7030000000000008500000005000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$inet(0x2, 0x4000000000000001, 0x0) r8 = socket(0xf, 0x1, 0x3) getsockname$packet(r8, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r9 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r9, 0x107, 0x12, &(0x7f00000000c0), 0x8) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="700000001000030400120000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000000000000500012800b00010062726964676500004000028005001900020000000c002300070000000000000006002700080000000c002100ff0100000000"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) recvmmsg(r0, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) 3.116562886s ago: executing program 4 (id=4719): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="85000000080000007e0000000000000027000000000000009500240300000000000000dfc593749c4903d71d0d172c2310ffbf4fde7ff84884ed2e234c4e1060b98733693b4a9d05c0d5d2c5e6e3c83f720322095928d417bbb3f14761f2fed9df3063b83a7de4797ad092c0d6d1045fac2c209c4bacc4a1b68917c6016d8f63b5ac91f69b051deb7d1a12fd55c497bf44e2a5e608d1a17ae672"], &(0x7f00000003c0)='syzkaller\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x8d, '\x00', 0x0, @cgroup_skb}, 0x63) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0', @ANYRESDEC=0x0, @ANYBLOB=',group_id=']) read$FUSE(r3, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r3, &(0x7f0000004380)="4e5350994ebf71ce3049a58c5d050078bf16b0757a4c27b455e2a547739587dd3380b5df8f40a0696c5bd6cdb672cffe4d870c5c90ca92095b9ebf3e92fe31d8cd74275d857d34a74f7eecc7fac15e2f148d4e9d47bb45b858bbf078999970d180f28d7b2cefd92635d45a563d9229c9fd770efdc0848e52fa5efd9ada5c94a1ba94b4b7c7507f8b0819bb20910f9f50a83a010abbe126dd9f6a7b84eab6b0d5ce78d2ade77a5f7e4e997df1d03ffab4b4c945d803e4457909013127a98769c938c237f37263bc509a42bc56ff2dbf80e847e2c407009eef94f18e1e59069d62298fdbadae007ffbdf403c5049a4530ac0abecceb5608da02754c9a575af52c0b7e41226e2d642a814861c4310c935bcbae413516dde2132652b39c7aa0218a6ce65dabb4494965209ce879ba7e7e59039db5c1d36d6a7f86d72dd59954fd6f46124a2506b245a0db11aa89d2feb312a6596ea2fecaa7b6021f37a255f628da7ff6b6c36b514d3b6be34e505f9dac6acfb888198004699fb350ac93431533554658c4957df36703591438d6488bc03dd8290a75ebb367a481a50e79a46b04d005649cabd79e5c6326c066bc2b6fc5febb87ef66d832ef31a16c2a450a0b990fb549a5d810c928d1a81fa1dc795db2607ac7d46cb5716b68acdeb00987e429fe6a394632c83b43336e7b51d9cfdb50e83d8c6ba1784d9f74c16b476e048e65e7ac0af683b347d7377ac1795422e00e5bd8da9b313af83abb3348861116de7a99959169b7dff9f7d9b7a6d107f2e76670a6214a419bf8298f80eb570fa29264ba57a383c5ec5836ce33104ecaf1aec76e311280a1d2c8bd7abff3a5a242e6a637f7db63038ef5d78aca9c680d72b60da4dbeb0e1e683ddc82898647c589a81b8f92db06711d8a0af05560cd77fa7005283db71e8da21713fccd450822062b994d152aaed2cdcf0dec9c60617e15ba4df628da4e71279bf9d1eee5c7f055c27cddfdd45f9225d5d5529ef7119e2e3c9838e7362971e069be487797e949b24297de19c61340d1cd7a2bfa3880b91a71e934720a59e1e0ea992d2a1633a0852ad8addfcab73a291e35745e694a6471f429b124305886c1f79f67c78de3f3ec998c91e7fc59d26766cd446f6f0de603f2c6892e13cdaa37d9e8e118d098b6986ccd991993ec152193e7d77394b05b99e7d310c506707f1be52249438fba9615f6dad2ec7244fedf36e34ec311b7d6bee64271d6491079e161190ded7e28e2ada4307a9b2986c267b1a30d2f720ff23408011f1d589ce9ee77f981c7833656ccf7df5b3a87ec253ff7c7ef1e67ceeb10c93e3fa683cdadad65850ffbc402b7744e94cdecef9db9d264c755c53d36278df23d4c9685fdefa69f7588a33b8a64b35191ee81abcb9765577d175cb06e31c582807ff7243bfef44961fbc0f8a235242f51ee991ea621803d4dcfed90d26f004b299425bf219f6d185fe6e088ae44601b03defada18794feac93787696a5d419f09f769bc590f43d2df6a131f6895da2de120c2644685e57b1d476c6aba5881e954fb2575356452b118b942cb02b4ea0fcf8f1bbb9a23b6e32c9d0accd3dd861452a3ad77b38fe709e216974932deb5397fd8033ff0e073d93ac0b4be762bca0424d69bd57b22ba914133f87671a29498b268c2911e793215463ca2164e38059456107dcb29beedfd6277e2b41a11d1c6f1361b19875c9384f04f9c53c1856d71f360a8fafe05f7aef750ec0cf2bfcfa971c017ad071b69a18fdaf970b384d4c889cfa5a0397dbe89543a5c6302645d6edf959aa60709ce0225fe6c3266c7ef62157ac8e78fddcd8a1f2ca5b58128218d19276885515775326aeeee0226cc810843eb05144bf8e2fe3340cf60b32cafd96d23cd7d0d3adcbdfec9a2a3d88307c362633b1c5637608ea8476d900b3f836a9734b5ecaf5e82983577128d3f74b903b0e3bf64326c1b564ae42aeeb0c07702b63a9ff74a2af6b45e5185a53f36c17bc29dfbc0ea28ca5cca43a15d751e9887ad3e6a87faacb6a278c4c8a8d21b9a77b9776f33102a6e645e99cc5cbc543ed0674282c2b9f8e5d14c2599aa9ac8f81438c77f2b9368bdac82edcdc5366f39adec9e9a3fbd55b79abc16d2ebff26b7d0c88f18b486e5836333575e3fc7808cb423b44781c57965767862922b4ff32d9bae76296843a46f430211c27ef9db168430026a5691623284dfd459dbdd1f1a6ec9bfad666507e6eacb1e2a7866da2e12e6d596d0bbb150500590013d9288af20596447f97bf1744eb9cfb244d8fca269b1fb71e14de664be4e95d83fff1b8abcfebcf3e78c1c66d28f260fb0c19f9fbcd2abbdd7dd7246e49dc25d954bf25f810a2ff6f9069dfdc62e7170fe3b0964b2ac95024256dfa3e7a426be5bb5f707fd82c2b3afec5d5dcf5bbb8fcb6dbc1b59f6c5330966c70d8b016956903a4278817414ba3652a102d7e7e37ecc79400267fc3bf7601c0731f87d479c33f100735e748874155267f708cea49d549e93cf7a398b20373dc90ad9afd56d9c77cd24e2c4a18f7130b366c7fe5b26bc4d11ca1ed1b98fa0b4d7396f82ae6593f4575d19f4d8fd586c991129e5cbe15c8bacc89c3ee15ca471dea966b5c48ede0d3ba2a7e28c75c04e6a4aa49a61f4e391ffe78eb5e40a5ef349f3aa4d15f2291cc86ec7e47ae301bf0b6083dae44b695820a893d46732553ef15ed1c16d28268d52a7e3a7e7c009d0c0708a356d3310c1ebcbcca4d7acf433e34bfc9fc115498142dcc725e7a16879c75e4c2f01c6c98b39619f3248bf530e6ee593467e38cf4026cfdc4db6296565722d587f3c580750b1453ecc141c0461495551297d88ae034acbd4f5e80ce198e6640c4c1e9501529988109cef006eb2090a6fcd974d7f60290b78f1a8ce3051ac2d69636c3219f0a6ad8c254764396a1684b2fd9805b1853525f2e640e513197283cc4d4073ac033e0539a88f08aabe1423cd40b8a7e073437d812b57a5d39a0531dcbe13f4466e89efc66c2a1e4b39a3e0b3073c9d44e6cf9b85f4df5c4e03628d05bc0f94ec04234c9eca4ed17463f190406834b02888728f625371cda75d15ec19efebd59f00ab659eb94eb88bcb2110862a369ad599610c1530fcc118f5b82205bc5215fe3623ac8ec297d8ff4eee75ace20731c5d505e6605c26203b7f754164c9463f0a6eefe3a2880b8e06e7bc66bb2adcc1a3f9b0325f5ec31d12a25f1f73c2aa6bb3a7680d786a082a63b13cce1822fa6a4b085a871ae3409eecbc1fd8661b5d52bb2b8b72f23e24a225075f272ed2ba0c6c5c693811a0ef8db6da7cfe7c966c647f0187ad223eedb1012a5b7af103e98464ac768c79b21ca45b12a52cf261de0d367442cda71c4b8ee39c94ded1b22ba06c13836cb467ebab4efea07bdf1e3de8da56a0ee6d4f848011253cc21fac10700003513d3167b7a73e0d752b861c49814bc5410ebe53a0264f76068c91ee6ec9e2daa343482b2f0f06e605c5aaf81f2a3cd570efc2094b4bc452f9526f1bbe7b22b694fb8109a5a987fabf6250912d6099e67da9cac79e8b6f2cce4702d1f17cbc5d06c38b8a48155ec758369c185ded839fb58cd736fbb74105fe5baf44e7e3ed06843f23601b60a43b1f88fd29e9b3f58479f9b95392a39d5ba1a31ee4441ca2d1fb57c0a8678a07a724b7a65b2ab16d1da197f435bce3ef003fce27fa2f0a67c9dd6c930a4bcf59e79e57b010000006fe34972958c28b56642d14ea89bf4d7d6f7fcbcf4fda8bd08fc9fe424de4359112b11f81fbdc1505658363697713ff6e1f8ca3c4be34a79993a9091f6017cda6c7489ae5c07062555231427c3eb42a049f42d22a060983b044a7d34ab5d2b5386cca79af72396a48aad6b8dcd7855410fc6106e4a165994f26efff1e7ea0aa8f560333b5dfdb2a0d899b0fda955155f90c75effd3c9535d88508e836feb7807d57b2a57cca42d3d08fe7de60d2a33376f49bdacdd3f814bd0927f417f15ad62a10b302f1cb390aaf82b0bc6af46bbf990b6ada45ef83ce13029d167c65134e7b82b59ddfdc367e61c40defd2732ccebb1d4000f6c742df964e1fb390c255d2b1dfc745c6ab34af8096b5b67aa179e3f341854f7a69f7bf47664c832037ec7a78f8e27209e3f20f833fb6e8c0fc4a40920a5ad2b0618982ff72540009d5db82f0f5bcaed2a27f35d1e50eaa0cf8e48c7a2d43c25d0264db750a7f33b44a4bfaae576cf9ee7594ed204513899566564ed8bbc97ed18b1d8868f926a5c70ac06fbac1eade46792186be7bf8ffa3301239edd093449b7d77192782b5111c14169d2b4a1b3443ad62e4abdf11aac6a5b89a5b20ab0ad0abd949b9d64582c67ffce018e7e46de4091fcc77a65b971fc67c8d9cbf0c341ca764b1056ee5014d9865059616a525a1d46ae2fad159afe86dd1df9b8246411827e19535ca0aa9f83050b06e70aa2737f27e93d584a9cef878a642e9361efaa5d20bd8da901fa2e064656f686d3b3ea31d1d850ae9196b7764548f5c6450a32a717e09b6b7e75d43fbbda76e43a24f186d5578933f408bfa28e0435cde525fb91e71d92d704cc5a9b5e3db7aaec46d2b1f8dcb3f921f69bd7397c96a1e132c39c8f1656cea4365c779abf76199cb5b6aada022edec5c901cdafa2e7f3765af9c8b20cb1a6785085fcb0dc901367b89051bdfdc6b68c5215fd04e2b3c7e1c454a4d21132953b25c50995af0f7159a5a8d0a1621f4808f126a5bd40ddc79fed90f49925ee367a57a05c070fbe39fe2c213e7c1724a907ecfa69efe6e021c06a262471a4377f3c9809e9fee4f375e27c31b6afbb2151da86b7cab63c7b4fa4b77fb30172b9d0d78b1c0535ec0639c4910b5eeecbb5b8b5c8aa74c140e7ad347812e36db3097a7ff85c09ab2c0020202307f50efefcdb497b9c060ca68c4be54a9165b4cebc6b2e2e14e5ffb9213142418faedcdf26fd326b7672399e71cfffe3ed712ced5317c254f9199ee10c24c802d102bd8749513d3145201ca4e01bc7c8bbcf430afa541ec5665f86dfb143be648521bb0f2b029018201444787f644f8c88b79e754e6ea9c797babdaec72a9680abadf3a41684cdd57c2b6e833acc0846be5aa927f1b1b36562d2acb9ecfb758455230d050daec6748ba280a5edc86d48e3f8af0f8f4ffb18ae3cd3c19a82d504a4fd52bb62289ae8026572a497fe268f87ef4b4b5886aa07eeb698b7cbf99683f710afc9ed1f8a488883ce0eb8f7fd055b82a9fe21a409caa231c41ba151008e9658919c611e157d7f3926a5e4248532a6860e615b9c86e9fea212128d96ed58c9b84ef22706071eb69f492e4d8321ed9faf6c6a8928f86172bdc930244583ea15be497d9ce4ae79cb3e6293a8512ffaa9e8e358f3c7c7117001fb92891a40b84f9126cc3def5cde67f463bbac9668b9f56c3e4ee72fceebb47e52fc226bab213d8193516e7064459fd1365350a95c5a1c3ac44a73bbba2a4c17ebe49dd781bff1995cd706b77bb533117594ad63566f4c0730beab85ff4c713b7f10b95480fe99a0f676c51ca11116b21e87887b462aa9770e85509e4e60f198148115f0a3ce6028516a946178d1acacf7767f6be7277891369eff67762aa58f928d48b7231e44d899cea8289003349117a53d61bc27b207fdc91c9db61e677d1e1a1bc6a1b6e8564130b335233db4b5de8d62324e6d0ccb2b08c2ff922324eb8c506711142d4b8d7a21223ef0a3d534fdb0de58be95cd827152f71bdd0a82766b62b4c87536f0b7e7df343c4263187da887de6e65d11d0360e2376c1d71c367ae85edeed8f767d24c644b1a9b455ded1dc3cc224f99936a6ee66931c45e5e3db2427719ab2d5cd9c20d9bb0ec004b69bccb00649f3d8e34a3572c257de114b9f027d76bc7db9007175cc03b9e2061b6b3fe7409e009b5371544e56fe438cbd361e5b11efbf2d79d1c250a1e73ca8c601c4f4d1e3761290950421c48c7daa45965e472f5ef3c4b8597444dc5dc01cd25358055b5000617f3e7291da3413e3f0853b1271366612405c35ff1b785b984d921b518425628a533a29ab65d3c11f44c6daa86f8b6457ebb9419274c481aa6f3fa4547641670aff58b9cc62c0993d49a509f02dee755ee5f1fd2710c995c43a91c4f873afa1bbdff19427cba2641052a8f361ecbc72e8a6cf587e83f8bd3110c95fb080edc77a6d43cd58c447b0e02261e4109500c6458dce70acb17aa8f9dc1d15b94a61354164031b5d563c25d0246fc45e6401cefceb501e1468903e5d677759dbe3f24bd48ce55ff8b8f26529fb3b2d669202a1e8a498984b449b4830a0126b18f0e78182c9ce78fe0c448c0e27845b926cfde28fa85e156fa98fefaeb19ed1247c9643b447b4342c94c114d3c4c35eed4d5b49aa70e6aad45bfb557f15e8fdb2d6e3d10d8338a13fe3f187751985b37a5bb10b750f79e36fc2e2ee9bdecc3ed156e202ed7b45a94809d77edaa398042fc6a825a4848c334c557303d24eb3f8e01be06995ceb283c70272b00da61c3381628f0e372fe2fcc779ff7daf7e4b7f2686c39d3fab674b8867b62b0bf9d5cfd0c1d3b270521f55f147de75142ffd7fc9ac7e5dae7ca2fdf26a9222d060823852409dd040cfd1f66f218c6dbdaaacddab34b123af22f97384d64fac64d84fd638c96378c8f9532a11927d48440bc777ff8b8b9be88f930f3b579a713c0bc449dca3a3bd5f2efa98240ccc594299e44451dc60c6c5c9edd0d7b777912b3dc40c57e0ea5f4425cd7047e686c7304f04ba9f7b5de6ad2bd524f1d29f8802a524441fa286015adf4589431710aa4d76de8a956dc1d39c0a13abb7fc309d24222d036e204ab6bb46ef8a7595d9e4512e0b9d5f8fd719a4e3072e1d806967045789c67a1681f2a9f1f4b19f4f5e1afdafc17db7a6d5196161499e62ab4b0ec27648f3eeb1fb2b78f8ecf9b05cf9509a3b9e2a361238deb1c91bdbc8b1d11bbeb939fd9da811cd439069da0ecc00665d72357aac01f259a0325409b201859cc0569e0eba67a7a9ca7e8b78078d9370bd3e37f0571680ede60cb6bbfe69435d6ab5efd80cf051d119a7004fc0b600844d49218d844de8f521524a47ee50229c7da25e42a8639b5db225e7f23967f5d4f8a297aff04a3cbedc2985b6393a5ba0b26b6c7b4ca22d369b35b410799d1ad02825104d34f73408db1948438597931ed1c1c260e78340517bfa2f734537dbdf5ec303518ff4640efe7f7b1c2f46babdb9247ce8eabad9718a8b9ddb7a18d5e87ced554c9d6de78f85d293349590c6c32483534bc968b24a28eb54b9515589d6dd8eb51a5ad0b4d896ce92250397cbc404323fcdf0ee47ed634e0c58213bc5b35a72b21a098e11b79c061430dc817c1e0c79a5b6ed3b002979933f1b83a17f250b1bd5c4958df4d75531ca03efbda89f6a92fe08c23ad9014ff562a7f3dcde578d6825b9847b5df04dbca4f2aa52d8e0f4cf8183ce121e39b50358a9796acde0372a8ff97769874a80ab997cd889145aad4888c06963c2f5b82f53a748a6729fbc79d35c06d84e05c62e44ff78040e56ebfc6efcf0d8b49337d5a17c4041f0d5a8b616244d585a162b69db073accd9071d12df5b326a43b834bbffc2f2a60deafcbddf1c6438a1769d6fb09fbe1990e89da12164ef237f326edb5be64bb64b143a030de8a99b3c5e543c871cb581e2be090a92134aa587701f864907cadd7c1ce20fcf8f5dc7f7ecd06a6c19d89a92ca0ad4393c208b80bba990c7a3702a9c79bddde75d5db244719ac32191b6ceb041ab541fb47680a97dc0422b8a50d91e32cb08cd341b0b099aca5bd12b69d4f89d10b755b351a6489180b786a3bebac926532a4a2d85b07bce6c090d1aaaff079e36d5394a612f1351b90c13a0fa6bf9d188d548dfe6fa51a9026edb52009c03ed45ac51d05c58a957bcc67e05a588985ba00d79f33ae9cdd5f5721d9fdc72ee6e880708be87e8a60c3c035c146f2091d1b9a4c2cfa56f292fe1ba62290d4e56c05669291bbe917f3cac51802a2cc8e9c90dadfe666c233c5a5bb71ee17deec51ce60c73f57bf9ecb84873afcc44815131810c6c1217bea485ef9aa2785e859b25315ef8aa3a274982786e45d622ae831fb76010d69a181b069e4cc55d4436edb10d1119b0c6000c6d5cff7c72f740a59dc0507e7a952b69403c62673f122c9d1264fac6ce2262e86cd8d6a402672f88530fc2d16f31736dd497a4e853253ac8d5aff8d1376895e9f5519b2490cc2a2412ba0c99cec855f668837310035e92fb646486de1b0acffb91ae7516df3eeef381456b55e65baa58e71461c928687e699d2b21814805591382e95e1b970aaa53259917f070281f2336b7d570249d838b3f1a32753c336864e15f4561badf8fee034a29c52ff3fca7456ae140f83e3b2fd5b57c9aef3f20c664200d235f236ec47dd2fc20b14dc6000812237aea992d987e5460679e8c5b76d931ef6d951e6c7087e3106b6ce2db9de6f228fdf3ffc38710c0e8d5000a195a79d1fa2301038f5b27c40b09c34c025e5099d40c2204ea0eae985263c9101cab88d6857a320c9e497f22348a24861a5fb8d734e08cad09f9933748ff01eab22f17756f58688dc1b486a397563ee9ad0784b8833cdb5f7c6bcf76d9c1105f71c3c6aabefd70dc6cd5c66d31caf916145ac5ed7fa070b4277c0448ab1eb78c943be9aeab0587d321a4bcb7754f070881178f8be668b686124899fac252519f4b60ec42db766a908755040463125c26850177402a977246d36d23afac0a11889d54640bd8f6f670d686cfd33f6fc5d90cf6cbd63d9d0fd201dd4c74dbbab899f3c23c0b7e37ea0b2aff421327200d0da58b5893a4186ae3652cc6e11c2c2a0e52184a3872532acce98c94cebf4f31333663a620f0dba0ffd89c3124380075bd28caa6d449a050b3661b8fbaf4747b77c4928b1378fdc8c7a7b38ade1aeec44bdfacc8271d0b132b2029b0f3582f9919f5c8cd543abc9caf6b82b197cd482c3ef61a64743506342bf50a3c1ff544563bb8b2002911ee1fad698f4ac133ffed5bfe81239c918207a03c7a8bd71a0a502aea78d38e970e3ab2abf754b598acb79cf276792aa08724d0ba24f2a694912ab795b3f45f52dec50d9bfbc99ae27e1d2c2216afec6709d6513a64b29ef58255bbe18478c5d4f15f74ea63a1e15487752eec8fd019f1d4a7aa25277664754bd2d7cd3a7a018b92c56d965a1974885363757286da9e055ef7fac17876f0a64c1026a597733b897a9155ecbf420159ae8e5209aa83a3544fff1fb4566f2d54f95e3bbd30dcca5f24397e4bd47ff01292f0d6fe9dd47a810e0c25382fa69b4987d1afd9b69ef125110ad6b240eaa9c85829a2646f9ab7874bc02bfa8346cc9190943e9d46b44880670b1e2aa3a29e83be5472d7418885a353faade6e8b18f4b588607bbb758588d1e2f11a9dfa1c4d61be50249f1ee32e6ff8c0c7722aaec1bc79654a4772efc578bd6a14c79abcc77a4e09c8b6c6ea35cd3ab31e35268fb55db843176f8042f8ce7be0ddd4ead6dbdad0ef9e7cb2323db5cc48119a72b27306b8ff6366c0bc682a85ab9e2cf2238b6d6eb2e38a97d5577e6334cb2aa6e7c86e489e876f9d7053577a5cb57f52812fab7c4bd7b19a34c228ffb67dcac9281612f778b58c580c140542200fd00cb3ad81d93420df93c5af2493f646d8de797102fa0a65247317882fbf171520f00b2c7638623b823ff11444fdde453570f99f9099b60061a908b83383ba8b82bb78edd074dccf9342afdf8d11a6129ba6ea7030f3629056264f1736c2b926171b6dc7e1fa455a473de656390495f3b6ad2f9f46f35eacb075628ff739ef78f28ba683448068c7f18fb63f28ba7dbbb78999100dde0a94e8b8570817c7114c13e139ceb333782b29a84a5b19497fa785915c7680dd7f972cb59ba22161f60886e5cb3c3e808726cbf96bc4da78914eee565c6d9d18e70d22cf8c0244cf3cf488c3550eaa400bc0f26d64e0f1bc8d0301a841d954073a641f3ef883d81f4d5db8e9df708e64e640b38df7295f7fe573863653086bae5507c880ab7fdb7a6c5ce77027ffa7395233d3ce536d77ae6c2e9c8ffb6fee78a3bcb3b5f888bd595caa3a5586948776b950a89cde4db8247ffff27491c882b430afdd60e7a22324f6635a9aa7139f3e624c6d9ece60f7f8153b2080cf0544fbf8e1c436503766e670b902604ab521e11aa5a65cedd64cfaf898ac5f55c08c87693c323517bcb0d99c28f5e072d4f6540c7ead70138d47c1a67fd72bd6ef5613af33a0af311c3d0a631ca2a2dfbe35d1021eb610e40b9be128683235a788b5a4cacf99babee382458d59e8aa1dd7bba7e09dd30c055a3df8ed721a1778b2c6ed587a403566325cd19962edd7831caa44a6b716517bad502130e7cf6a5ce5288dc84c0170f622ae0b1e1166a9c2c0771d91df9f9dd82ae210469602ce38964746c1c1d04321aae7d464eb801dbea7ec39505457e778208774d72673626c998b002c46a9b4b1e390d9344f0ca62212a1b6d41043a2100b35196bce42d40caa0ea9a486bf8526fd1f0f0d362c2cac463ea7377a20b54b9435442ca529fc00da4fd7e27c4eaf14215a06857b54254c26346956fd7fe215a5ce57ec38cedf50a3c759e563a4fd87494f00e7bd9b44f3b7e99c6ef67187056a21d2fe1ac9d24125b1947eb293189fdc448b591af4d9b8eb091d6bbb5e50fae79d000044e282bb2ab6c63cc9562b151c214e45015354e62be63e1881238b907f7bdb791ff44a4e03fa29dbd26db2f49d0f4729b7cd9ba69a65b0b493466d35d09b3f590c67c31660d95e2ab4af2c9f1df91f04ce5a57dde2d75206b42e3423126774d76593c2f713ae279d7092506b513fd5d18f0f52d3fafd7141dfd4a0de1063754dba865faf8dc0f6be9d90ef21ec86a275533f6ad4b4e360dc775413f29eab8b3daac6279b9abfe163ea2f183e09ed91ef67fbb090875109288a182cfdcc46d90678efe5edceda6518335e678438cac4bb47d376f3f0e12aa55301735d7f42653c073d6a4a37b2e17d332dc1be6b50918c007b14886307cc39250e81efecd63d24067a49994572725a9df1760caac13a28f5255556b27ec245e93969b85cdec7cd1c2d2a433d3f9572b93054a7ce8adff81bc1d30884d5fc4791e251bd907e37af5bec74235c3e2f804e4e0450b715289942b7859ad207bafcfec1b586dc15e7911fe6d20aa3d02fcd47e9956780e300d7c53c17dfa15754deb4c20efebc7270bda0fa6b37fc88c6be4250cac38c1b8186b364482026ab52d65d3a691903fccc39772277011bfaa421adba76bed9731077bec885ce88d40f36bbd2a839c67dc4b862c968491b877d4fd13fc90f8da57a29121e12f78e85af765cd66e72ba513593fe1cdf20019985b065d828707d8e509c6834eab188deea5c9ee97955f4b07d37b6fc7beed73be94887d423a349f35bb8782bc670ceaec870d97f061bda02ae73f6d575f81e0b6326eae6c1b3085cc584686120e12dd9ad8ce44036bec8a189f9", 0x2000, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x90, 0x0, 0x4000000000000, {0x0, 0x0, 0x20000000, 0x4, 0x6, 0x0, {0x0, 0x100, 0x0, 0xd, 0x0, 0x100, 0x0, 0x2, 0x0, 0x0, 0xfffffffc, r4, 0x0, 0x7}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r3, 0x0, 0x0) r5 = creat(&(0x7f0000000180)='./file0/file0\x00', 0x0) syz_fuse_handle_req(r3, 0x0, 0x0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000e00)={0xa0, 0x0, 0x2, {{0xffffffffffffffff, 0x0, 0x0, 0x10000000000, 0xfffffffb, 0x0, {0x0, 0x7fff, 0x400006, 0xffff, 0x4, 0x0, 0x0, 0x2, 0x0, 0x8000, 0x0, 0x0, 0xee01, 0xfffffffd}}}}, 0x0, 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r2, 0xc2c45512, &(0x7f0000000340)={{0x2, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0xffffffff, 0xffff, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffc7, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8]}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000006c0)={{{@in=@remote, @in6=@remote, 0x4e24, 0x0, 0x4e20, 0x0, 0x2, 0x0, 0x0, 0x32, 0x0, r4}, {0xffffffff997b8130, 0x46, 0x4, 0x2, 0x100000000, 0x2, 0x4, 0x1000}, {0x12c, 0x2, 0x4828, 0x280a}, 0xfffffffd, 0x0, 0x0, 0x0, 0x2}, {{@in=@multicast2, 0x4d5, 0x32}, 0x2, @in=@broadcast, 0x34ff, 0x1, 0x0, 0xf9, 0x6fa, 0x5, 0x3}}, 0xe4) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x9f) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="02000f07140000002cbd7000fddbdf2505001a00ff010000000000000000000000000001ac1414bb0000000000000000000000000a0008040500190000000002004e23ac1414bb000000000000000002004e230a01010000000000000000000500060000a000000a004e2200000004ff0100000000000000000000000000010400000000000000030007003380000002004e220a0101020000000000000000"], 0xa0}}, 0x4) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010067656e65766500000400028008000a00", @ANYRES32=r6], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newlink={0x2c, 0x10, 0x403, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r6, 0x500}, [@IFLA_ADDRESS={0xa, 0x1, @local}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008004}, 0x8000) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) 2.503230481s ago: executing program 0 (id=4720): socket$kcm(0x10, 0x1abfa4612d5b39c4, 0x0) mknod(&(0x7f0000000080)='./bus\x00', 0x1000, 0x0) r0 = open(&(0x7f0000000100)='./bus\x00', 0x143142, 0x0) fcntl$setpipe(r0, 0x407, 0x6) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x900, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r4, 0xc004ae02, &(0x7f0000000040)=ANY=[@ANYRESHEX]) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r7, 0xc008ae88, &(0x7f0000000040)=ANY=[]) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x9a974000) mremap(&(0x7f0000097000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f0000bff000/0x400000)=nil) mremap(&(0x7f000040b000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f00004b3000/0x4000)=nil) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='clear_refs\x00') writev(r8, &(0x7f0000000780)=[{&(0x7f00000004c0)='5', 0x2b}], 0x1) r9 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) r10 = openat$nvram(0xffffff9c, &(0x7f0000000140), 0x1, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r9, r10, 0xc2) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="b880842a9f4e7bba00"/20, @ANYRES32=0x0, @ANYBLOB="01310100000000002c0012800e00010069703665727370616e0000001800028008001500fca70e00040012000500160001000000"], 0x4c}}, 0x0) vmsplice(r0, &(0x7f0000002800)=[{&(0x7f0000000280)="a4", 0x1}], 0x1, 0x3) vmsplice(r0, &(0x7f0000000580)=[{&(0x7f0000000180)='B', 0x1}], 0x1, 0x2) 2.260806407s ago: executing program 2 (id=4722): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x15, 0x800, 0x200) r1 = syz_open_dev$usbmon(&(0x7f00000005c0), 0x0, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x80010, r1, 0x0) getsockopt(r0, 0x200000000114, 0x8, 0x0, &(0x7f0000000000)) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="00000f00000009003d140f3c36919790"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x14, &(0x7f0000000200)={0x40, 0x5, 0x79, {0x79, 0x24, "d61b774cf4388ae0078e9dff59079b4c691ecf26216734354c203f11eaccd1b38c135ccff7a694cc40b3a19e399f930f0ce953cbaa8e2ae44f8a48dfedd5bd05908f5ad1e40ebcd0346adc7a60071720edda5f6830f53d792705643d06254e42c9ffad3fb46fd787f2ac3d730f853c083b8b9eeb2081a1"}}, &(0x7f0000000280)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41e}}, &(0x7f00000002c0)={0x0, 0x22, 0xa, {[@main=@item_4={0x3, 0x0, 0x8, "d60ba5d6"}, @main=@item_012={0x2, 0x0, 0x8, "71d3"}, @global=@item_012={0x0, 0x1, 0x1}, @global=@item_012={0x0, 0x1, 0x3}]}}, &(0x7f0000000300)={0x0, 0x21, 0x9, {0x9, 0x21, 0x5, 0xfb, 0x1, {0x22, 0xcf6}}}}, &(0x7f0000000540)={0x18, &(0x7f0000000380)={0x40, 0x10, 0x93, "82a26533a90891323fa0a40010ba15d8a4d55124cf9830c4ff5e1283597947ebf8deb02f2bbd6554a175216c51c1cb108efce35be855c394de68e2224e8c1ba8791d0638ad4cb892d9e0e05d489c8d278750a02ee80b7021b11e2a150ce84c5e742b54757569d5e092500e59217cef0a6a4aef9481ed9774ba834228db599b4b777a7ac5b1b4edfb87cfaff2204c6c572e31f6"}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000004c0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000600)={0x20, 0x1, 0xe0, "203023873e6d7395aff3dd15e5f213bc885bb54fe4a5c53d44ae1ab004ea0a7208266c2baad526f636dd315a3d22713649cec402d9dd4b262003a6c229d8db7badd3b1d19efeafc7743eaff99438d09f4bafe7ebc89e669ef7cb73df9a5f30315f1ee212be93c6bb6e5d6574d63fb554a30e80d93f8d8d5065026c3d25ed5f5c59b0766da97c3b9aa0c661c2cf10ab071432b82929eb457367bbe0c81795a4bbf5a30d47932e52341076801fc3dd3bd224b54319d3a7772a92b246bf23862e9f0fde0c53b85d316309854be4ed73db7ece218e73fb02cd1736a9defb18ddaa4e"}, &(0x7f0000000500)={0x20, 0x3, 0x1, 0x2}}) r2 = syz_open_dev$hiddev(&(0x7f0000000100), 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x7c0a906c40728b57}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, 0x1402, 0x2, 0x70bd2c, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5, 0x54, 0x1}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4040801) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x35c, 0xffffffff, 0x1cc, 0x0, 0x1cc, 0xfeffffff, 0xffffffff, 0x294, 0x294, 0x294, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa4, 0xcc}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x5}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @ipv4={'\x00', '\xff\xff', @multicast2}, [0x0, 0xffffff00, 0x1000001ff], [0x0, 0xff000000], 'sit0\x00', 'veth0_to_batadv\x00', {}, {}, 0x3b, 0x0, 0x4, 0x2}, 0x0, 0xdc, 0x100, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x0, 0x51b2, 0x200000}}]}, @REJECT={0x24, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @REJECT={0x24}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x3b8) r4 = syz_usb_connect$uac1(0x2, 0xfb, &(0x7f0000000700)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x0, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe9, 0x3, 0x1, 0x7, 0x0, 0x1, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1, 0x6}, [@selector_unit={0x5, 0x24, 0x5, 0x3, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0x0, 0x2, 0x2, 0x9, "f2d2d59d7bb272"}, @format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x4, 0x1, 0xe, 0x5, "d16cea2a"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x5, 0xf3d0, 0x0, "aa06e717cf92c301d5"}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0xe, 0xdac, 0x6, "4c4cd950"}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x5, 0x8, 0x24, {0x7, 0x25, 0x1, 0x2, 0x3f, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0xe, 0x3, 0x4a, 0x9a, "e34c0e", "f751c8"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0xf, 0x4, 0x0, 0x0, 'N=', '%'}, @as_header={0x7, 0x24, 0x1, 0x1c, 0x2, 0x1}, @format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x4, 0x1, 0x6, 0x1, "55e53330bcbd7af9"}, @format_type_i_discrete={0xc, 0x24, 0x2, 0x1, 0x31, 0x2, 0x81, 0x40, "4955d8a7"}, @format_type_i_discrete={0xf, 0x24, 0x2, 0x1, 0x8, 0x4, 0x8, 0x80, "2cac22af497f0a"}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x0, 0xa0, 0x9, {0x7, 0x25, 0x1, 0x2, 0x1, 0x1}}}}}}}]}}, &(0x7f0000000cc0)={0xa, &(0x7f0000000580)={0xa, 0x6, 0x300, 0xff, 0xff, 0x5, 0x8, 0x7}, 0x9c, &(0x7f0000000800)={0x5, 0xf, 0x9c, 0x6, [@ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0xc68, 0xf, 0x6, [0xc030]}, @wireless={0xb, 0x10, 0x1, 0x8, 0x8, 0x7, 0xfd, 0x8dd, 0x6}, @generic={0x64, 0x10, 0x1, "9ebbb7d5b90f250d68538627687b10b2b132a58e3f168d3848706d990c5fc5ca862a7d071d8f4cd98b1dd0d38cd0c6afa6c9164c141001770a6533e89064e5e454cca563ca84e6af6eeafb0797267243299615b4ba298e87005bc9fb707a64ddeb"}, @wireless={0xb, 0x10, 0x1, 0x8, 0x0, 0x64, 0x3, 0x0, 0x2}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x2, 0x5, 0x7}]}, 0x7, [{0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x2409}}, {0x60, &(0x7f0000000900)=@string={0x60, 0x3, "ecc85a0b99e2b50de15c16dcd0b14ff1b6e602b68f79a100763d252c08d4fd0be0b29612521fe376ad930202b3cb8bb5e9521950ee3e0fff5f3f2d4065b45858405f205d4b58b76545e847ed8917415f1b95fbeef37902bb1a78970477ab"}}, {0x89, &(0x7f0000000980)=@string={0x89, 0x3, "5f9a2d7696582cb6109507af13a5145caa3fa91d8a982bf5f8356e3af4fec06d03a236685645a062d681b030fe349bf191b35cc43b4e967104788c894924fcfd099a51838588307ac9670ae1751f2a6b87b59e39f2e4033bc19e48b8ff0d90764e33685b36680c60a2ff4a658cf7fcc9ca697bb54fa3436ea454009c46429f7932e81b15eb1484"}}, {0x39, &(0x7f0000000a40)=@string={0x39, 0x3, "500fd7ff6f3af8bc8a7d402c185406a4b8e7e25a5d0d6c1f0aba824a505dbf4e3f1b69e0d642276ac58ed7bd2adb218c14af53dd6f19a1"}}, {0x8, &(0x7f0000000a80)=@string={0x8, 0x3, "19b20e0e1b3c"}}, {0x56, &(0x7f0000000b40)=@string={0x56, 0x3, "52ed341136e1cd85e3b1d889ac0ba2d07a90880d011bfd78ab3f76d199b9a48092125e07550948b2294fdb9d95d002867a6fa8dc20ad1d45ab71d67f9a79ab4b1a022014ad9c7a6a3e03b502696772197198aa66"}}, {0xf3, &(0x7f0000000bc0)=@string={0xf3, 0x3, "938421204868c14c4e931831c21d497d1241592323c99177728f9e68fc3f304f0f5f044405199a6f76ad340cbd999219623cf6048031d7ff2496daaca1456b2aa43daffa6a32b31fb665c1a1a3a7d6a56c02c415ecb77504e759b654416d7416fb741aaf430f59eb8d42e9921f51486c08e5b0dca4dc7d623abfdf6bf8673b33af7a79e8e17df80f1836faa70b164b46c0d7242b2b19de641ec7bb518e030ea0be30ae619e096dda6a9653f5a463f277e0b0cda7ec387847d910f42be8768e32277f2d8eca575cea04e0d96a5cd2e00efce8bc95688682fe8b2cf4131536665e8ef9012a8e4cb6043d09e84add97eb4371"}}]}) syz_usb_control_io(r4, &(0x7f0000001400)={0x18, &(0x7f0000000d40)={0x40, 0x21, 0xa0, {0xa0, 0x4, "60d6ba65a265f90df939797988c8e1a99aecd0970806906a9b589b823f5f8d656608a02417b8c854870b0007e264f90aa323cb64e950a2af6aeb0aa9958d823fceb36444cd3b635f1277a3f92ba0b6c1edcd17e64409ac261c32c34a88a907b7431ef1a3d7de788e87fe63d4400d6286dec56f1b50cb11d412c725fccf470417d9f8d150fca3fdd1f83379f672f44643819230101776ee450b3cb12327e3"}}, &(0x7f0000000ac0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40d}}, &(0x7f0000000e00)={0x0, 0xf, 0x52, {0x5, 0xf, 0x52, 0x4, [@generic={0x1f, 0x10, 0x0, "9fc286ac3f0a28db7442d801dd7feba7b340969b726c148ee238cb37"}, @ssp_cap={0x20, 0x10, 0xa, 0x6, 0x5, 0x4, 0xf00, 0x4, [0xff30, 0x0, 0xc030, 0xff0000, 0xc0]}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x6, 0x2, 0x9}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x7, 0x7, 0x2}]}}, &(0x7f0000000e80)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x0, 0xf, 0x33, "c11bed80", "dbff1c96"}}, &(0x7f0000000ec0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x7, 0x8, 0x1, 0x7, 0xd3, 0x8, 0x1}}}, &(0x7f0000001380)={0x44, &(0x7f0000000f40)={0x40, 0xe, 0x72, "ac042235d7e6bce3f00a202968992bca0185eebd7868e86d270f6e0f04fc280fe1ac19cb905295e359f2b5a6b9fc4ee272200293daa7473e5db2b419916834cda050ccf6aa39ede314f27753f2ddae7a8ce0478186f9721f712e7cabbaeb472666f9c1751c2b6e2aa91f34ddabce939b8f23"}, &(0x7f0000000fc0)={0x0, 0xa, 0x1, 0xb2}, &(0x7f0000001000)={0x0, 0x8, 0x1, 0xa}, &(0x7f0000001040)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f0000001080)={0x20, 0x0, 0x8, {0x0, 0x44, [0xf0ff]}}, &(0x7f00000010c0)={0x40, 0x7, 0x2, 0x8}, &(0x7f0000001100)={0x40, 0x9, 0x1, 0x8}, &(0x7f0000001140)={0x40, 0xb, 0x2, "b598"}, &(0x7f0000001180)={0x40, 0xf, 0x2}, &(0x7f00000011c0)={0x40, 0x13, 0x6, @broadcast}, &(0x7f0000000f00)={0x40, 0x17, 0x6, @remote}, &(0x7f0000001240)={0x40, 0x19, 0x2, "9d7b"}, &(0x7f0000001280)={0x40, 0x1a, 0x2, 0x9}, &(0x7f00000012c0)={0x40, 0x1c, 0x1, 0xe1}, &(0x7f0000001300)={0x40, 0x1e, 0xfffffffffffffe2e, 0xb}, &(0x7f0000001340)={0x40, 0x21, 0x1, 0xb5}}) ioctl$HIDIOCSREPORT(r2, 0x400c4808, &(0x7f0000000440)={0x2}) 2.20392583s ago: executing program 4 (id=4723): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$audion(0x0, 0xfffffffd, 0x80200) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x8800) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$BTRFS_IOC_INO_PATHS(r0, 0xc0389423, 0x0) pipe(&(0x7f0000000740)) socket(0x2a, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_io_uring_setup(0x19d0, &(0x7f0000000700)={0x0, 0x3879, 0x10100, 0x8000000, 0x335}, &(0x7f0000000080), &(0x7f0000000140)) io_uring_enter(r2, 0xa3d, 0x0, 0x0, 0x0, 0xff39) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x500, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r3], 0x90}}, 0x0) 2.124278031s ago: executing program 1 (id=4724): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x2, 0x1000, &(0x7f0000006680)) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) socket$inet6(0xa, 0x3, 0x20) syz_io_uring_setup(0x237, &(0x7f0000000380)={0x0, 0x80fd, 0x8000, 0x4, 0x2cf}, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) ptrace(0x10, 0x1) socket$kcm(0xa, 0x2, 0x3a) add_key(&(0x7f0000000000)='dns_resolver\x00', 0x0, &(0x7f0000000040)="00000000f5ff", 0x6, 0xfffffffffffffffd) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000001580)={0x14, 0x25, 0x1, 0x70bd2c, 0x25dfdbff, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x40080c0}, 0x24000100) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f0000000640)=0x4) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x0, 0xb, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) r7 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_FREE_STREAMS(r7, 0x802c550a, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x40, 0x3, 0x4, '\x00', 0x8}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sendmmsg$inet6(r0, &(0x7f0000004ec0)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0xf, @dev={0xfe, 0x80, '\x00', 0x17}, 0x7}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000600)="92", 0x1}], 0x1}}, {{&(0x7f0000000ac0)={0xa, 0x4e24, 0x800, @private0, 0x8001}, 0x1c, &(0x7f0000000e80)=[{&(0x7f0000000b00)}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) 2.100741396s ago: executing program 3 (id=4725): r0 = socket$xdp(0x2c, 0x3, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000c00)=ANY=[@ANYBLOB="1201000005611e40cd061a01cb17010a03010902240001bdf19f55090400000009"], 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x328000, 0x1000}, 0x1c) memfd_create(&(0x7f0000000080)='/\x00', 0x2) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) socket$xdp(0x2c, 0x3, 0x0) (async) syz_usb_connect(0x0, 0x36, &(0x7f0000000c00)=ANY=[@ANYBLOB="1201000005611e40cd061a01cb17010a03010902240001bdf19f55090400000009"], 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={0x0, 0x328000, 0x1000}, 0x1c) (async) memfd_create(&(0x7f0000000080)='/\x00', 0x2) (async) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) (async) 1.674421002s ago: executing program 4 (id=4726): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0xfffffffffffffe90, &(0x7f0000000000)=[{&(0x7f00000000c0)="d8000000150044f9f232603d9d1bd6d6848f32d581054e81f782db44b9040a1d3b020a00000030f500040000a11800020000e9400084150e06400303000803600cfab94dcf5c0461c1d67f6e94007134cf6ee08002a0e408e8d8ef075c0110f63bbd00000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad9561b4a29c8020000002fcf72baa7ea67e0060000000000000080bb9ad809d5e1cace", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x4000) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(0xffffffffffffffff, 0x3b71, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r3, &(0x7f0000000040)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000140)=@caif=@util={0x25, "8a619cb744b432934d5ed246ae038748"}, 0x80, &(0x7f00000008c0)=[{&(0x7f00000000c0)}, {0x0}, {0x0}, {&(0x7f00000007c0)}], 0x4, 0x0, 0x374}, 0x0) r4 = syz_io_uring_setup(0x497, &(0x7f00000004c0)={0x0, 0x4661, 0x400, 0x3, 0x288}, &(0x7f00000001c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_open_procfs(0x0, 0x0) munmap(&(0x7f0000003000/0x3000)=nil, 0x3000) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd=r3, 0x0, 0x0}) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) io_uring_enter(r4, 0x40f9, 0x217, 0xa5, 0x0, 0x0) 882.765447ms ago: executing program 3 (id=4727): bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000400090004"], 0x48) r0 = socket(0xf, 0x80802, 0x7ffffffc) write(0xffffffffffffffff, &(0x7f0000000080), 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="fc00000000010104000000000000000002000000100002800c00028005000100000000000800074000000000d000068008000200ac14141504000380140004002001000000000000000000000000000214000400fc02000000000000000000000000000134000380060001f84d220000060001004e200000060001004e240000060002004e240000060002004e240000060001004e24000014000500fe8000000000000000000000000000aa3c000380060002004e210000060001004e230000060001004e230000060002004e240000060002004e200000060001004e240000060001004e21000014000500fc010000000000000000000000000001"], 0xfc}, 0x1, 0x0, 0x0, 0x4800}, 0x40) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340007003e0007010000000000000000017c00000400fc800c000180060006006558000008000280040011"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1f00000000000000000000000010000000000000", @ANYRES32, @ANYBLOB="0000000400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) mmap(&(0x7f00005e8000/0x4000)=nil, 0x4000, 0x2000003, 0x28011, r4, 0xffff8000) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r5, &(0x7f0000000100)={0xa, 0xfffc, 0x0, @mcast2, 0x7}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)=ANY=[@ANYBLOB="540000005200080025bd7000fedbdf250a0800020000000000080002002a080000080003007d627c5508000600aa00000008000300010400000800050033ee5700080006", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00'], 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x4000815) sendmmsg$inet6(r5, 0x0, 0x0, 0x4400c800) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000500)=ANY=[@ANYBLOB="c8000000190000012bbd700004000000000000000000000000000000000000012001000000000000000000000000000200000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000002000000000000000002000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f4000020000000000200800000000000000000100000010000a002abd70002ebd70000800000017898fcbef96027b79a749bcde7a4ed020fd2565bf95270bc48d173468411c92ef8edbb3b7b6b117e5bee8a9dd8edcd339430e5df57b26e1176a6096"], 0xc8}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x3b40, 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) r7 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r7, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90b, 0x8000, '\x00', @p_u16=&(0x7f00000000c0)=0xfffe}}) r8 = socket(0x40000000015, 0x5, 0x0) connect$inet(r8, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) 492.499997ms ago: executing program 0 (id=4728): r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000180)={0x5, 0x6, 0x4, 0x0, 0x49}) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x94d, 0x100) ioctl$EVIOCSFF(r2, 0x402c4580, &(0x7f0000000040)={0x51, 0x4, 0x80, {0x295f, 0x2}, {0x6a8e, 0x100}, @ramp={0x3, 0x3, {0x7, 0x100, 0x2, 0xf06}}}) syz_usb_connect(0x2, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fba85b08e90f71db3e530102030109021200010400200009049c070000000000f87f06235e0053418dec393b74"], 0x0) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f00000000c0)={0x18, 0x0, {0x4, @multicast, 'bond0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f00000003c0)) (async) ioctl$PPPOEIOCSFWD(r3, 0x4008b100, 0x0) (async) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = syz_clone(0x4382000, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)="80") (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) (async) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f00000001c0)={'veth1_vlan\x00', &(0x7f00000000c0)=@ethtool_stats={0x1d, 0x4, [0x0, 0x8, 0x9, 0x7fffffffffffffff]}}) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(0xffffffffffffffff, 0xc1105518, &(0x7f0000000200)={{0x2, 0x6, 0x5, 0x7, 'syz1\x00', 0xf}, 0x2, 0x10, 0x400, r5, 0x2, 0x6, 'syz0\x00', &(0x7f0000000100)=['{,\x00', '\x00'], 0x4}) (async) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) lseek(r6, 0xfffffffffffffff9, 0x0) (async) ioctl$KVM_XEN_HVM_CONFIG(r6, 0x4038ae7a, &(0x7f0000000000)={0x1, 0xb5b, 0x0, 0x0}) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) (async) r8 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r8, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) (async) sendmmsg$inet(r8, &(0x7f0000005240), 0x4000095, 0x0) (async) getsockopt$IPT_SO_GET_INFO(r8, 0x0, 0x34, &(0x7f00000006c0)={'security\x00', 0x0, [0x1, 0x0, 0xb34, 0x100, 0x50]}, &(0x7f0000000740)=0x54) r9 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r9, 0x89f1, &(0x7f0000000140)={'sit0\x00', 0x0}) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r8, 0x89f6, &(0x7f0000000080)={'syztnl2\x00', &(0x7f0000000000)={'ip_vti0\x00', 0x0, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) (async) r10 = dup(r7) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r10, 0x4068aea3, &(0x7f0000001980)={0xbe, 0x0, 0x80001}) 451.41157ms ago: executing program 4 (id=4729): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c0000001200050926bd7000fddbdf251a0d04064e224e22fbffffffff0000000600030007000000ddffffff050000000120000056ffffff", @ANYBLOB="ece08d45e3cb921bf0efbafeff"], 0x4c}, 0x1, 0x0, 0x0, 0x22004014}, 0x800) 0s ago: executing program 4 (id=4730): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0xfff0, &(0x7f0000000100)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}}, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) kernel console output (not intermixed with test programs): 3333] ? __might_fault+0xb0/0x130 [ 1341.610778][T13333] should_fail_ex+0x414/0x560 [ 1341.610817][T13333] _copy_from_user+0x2d/0xb0 [ 1341.610846][T13333] move_addr_to_kernel+0x7e/0x160 [ 1341.610884][T13333] get_compat_msghdr+0x3bd/0x4a0 [ 1341.610929][T13333] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1341.610973][T13333] ___sys_sendmsg+0x193/0x2a0 [ 1341.611005][T13333] ? __pfx____sys_sendmsg+0x10/0x10 [ 1341.611072][T13333] ? __fget_files+0x2a/0x420 [ 1341.611102][T13333] ? __fget_files+0x3a0/0x420 [ 1341.611144][T13333] __sys_sendmmsg+0x28e/0x430 [ 1341.611180][T13333] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1341.611220][T13333] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1341.611262][T13333] ? ksys_write+0x22a/0x250 [ 1341.611300][T13333] __ia32_compat_sys_sendmmsg+0xa2/0xc0 [ 1341.611334][T13333] __do_fast_syscall_32+0xb6/0x2b0 [ 1341.611358][T13333] ? lockdep_hardirqs_on+0x9c/0x150 [ 1341.611398][T13333] do_fast_syscall_32+0x34/0x80 [ 1341.611421][T13333] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1341.611449][T13333] RIP: 0023:0xf710e539 [ 1341.611467][T13333] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1341.611487][T13333] RSP: 002b:00000000f50fe55c EFLAGS: 00000206 ORIG_RAX: 0000000000000159 [ 1341.611511][T13333] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080005980 [ 1341.611532][T13333] RDX: 0000000000000001 RSI: 00000000200400c0 RDI: 0000000000000000 [ 1341.611545][T13333] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1341.611558][T13333] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1341.611571][T13333] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1341.611601][T13333] [ 1341.831346][ C0] vkms_vblank_simulate: vblank timer overrun [ 1341.850150][T12766] usb 3-1: config 7 has no interface number 0 [ 1341.857251][T12766] usb 3-1: config 7 interface 128 altsetting 2 has an endpoint descriptor with address 0x17, changing to 0x7 [ 1341.869724][T12766] usb 3-1: config 7 interface 128 altsetting 2 bulk endpoint 0x7 has invalid maxpacket 32 [ 1341.880505][T12766] usb 3-1: config 7 interface 128 altsetting 2 endpoint 0x87 has an invalid bInterval 209, changing to 11 [ 1341.892575][T12766] usb 3-1: config 7 interface 128 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 1341.906640][T12766] usb 3-1: config 7 interface 128 has no altsetting 0 [ 1341.988058][T13334] fido_id[13334]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 1342.148098][T13311] xt_CT: No such helper "snmp" [ 1342.215779][T12766] usb 3-1: New USB device found, idVendor=6033, idProduct=4108, bcdDevice=cc.13 [ 1342.217728][ T5932] usb 1-1: USB disconnect, device number 4 [ 1342.225677][T12766] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1342.225706][T12766] usb 3-1: Product: syz [ 1342.225724][T12766] usb 3-1: Manufacturer: syz [ 1342.225740][T12766] usb 3-1: SerialNumber: syz [ 1342.232126][T13325] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1342.391324][T13340] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1342.412622][ T5939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1342.420907][ T5939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1342.557718][T13340] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1342.571545][T13254] usb 2-1: USB disconnect, device number 7 [ 1342.868595][T13344] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4443'. [ 1343.444569][ T5939] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 1343.460788][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1343.659619][ T5939] usb 1-1: config 0 has no interfaces? [ 1343.696011][ T5939] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1343.715374][ T5939] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1343.734379][ T5939] usb 1-1: Product: syz [ 1343.750527][ T5939] usb 1-1: Manufacturer: syz [ 1343.772449][ T1757] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1343.782355][ T5939] usb 1-1: SerialNumber: syz [ 1343.807018][ T5939] usb 1-1: config 0 descriptor?? [ 1343.956020][ T1757] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1343.967170][ T1757] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1343.990150][ T1757] usb 2-1: Product: syz [ 1344.055620][ T1757] usb 2-1: Manufacturer: syz [ 1344.113057][ T1757] usb 2-1: SerialNumber: syz [ 1344.143571][ T1757] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1344.173731][ T5939] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1344.231445][T13363] pimreg: entered allmulticast mode [ 1344.244734][T13363] pimreg: left allmulticast mode [ 1344.330145][ T5932] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 1344.349120][T13364] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4450'. [ 1344.464563][T12766] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1344.472509][T12766] usb 3-1: MIDIStreaming interface descriptor not found [ 1344.493922][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1344.506229][ T5932] usb 5-1: Using ep0 maxpacket: 16 [ 1344.515311][ T5932] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1344.528229][ T5932] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1344.599241][ T5932] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1344.663434][T13367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1344.677773][T12766] usb 3-1: USB disconnect, device number 20 [ 1344.678303][ T5932] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1344.719083][T13367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1344.751127][ T5932] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1344.779106][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1344.800117][T13367] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1344.817865][ T5932] usb 5-1: SerialNumber: syz [ 1344.887240][ T5864] udevd[5864]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:7.128/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1344.917289][ T5932] hub 5-1:1.0: bad descriptor, ignoring hub [ 1344.926695][ T5932] hub 5-1:1.0: probe with driver hub failed with error -5 [ 1345.010620][ T5932] cdc_ether 5-1:1.0: probe with driver cdc_ether failed with error -22 [ 1345.212798][ T5939] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 1345.297466][ T5939] ath9k_htc: Failed to initialize the device [ 1345.324538][T13360] raw-gadget.2 gadget.4: fail, usb_ep_set_wedge returned -11 [ 1345.338890][T13360] tipc: Enabled bearer , priority 0 [ 1345.383784][T13360] tipc: Resetting bearer [ 1345.413207][T12766] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1345.427017][ T5939] usb 2-1: ath9k_htc: USB layer deinitialized [ 1345.449126][T13359] tipc: Disabling bearer [ 1345.503914][ T5932] usb 5-1: USB disconnect, device number 19 [ 1345.721660][T12766] usb 3-1: Using ep0 maxpacket: 16 [ 1345.739469][ T1757] usb 2-1: USB disconnect, device number 8 [ 1345.752180][T12766] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1345.772713][T12766] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1345.791796][T12766] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1345.821092][T12766] usb 3-1: config 0 descriptor?? [ 1346.273581][T12766] usbhid 3-1:0.0: can't add hid device: -71 [ 1346.279808][T12766] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1346.312078][T13381] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4455'. [ 1346.341319][T12766] usb 3-1: USB disconnect, device number 21 [ 1346.366512][T13381] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1346.500301][T13385] tipc: Enabled bearer , priority 10 [ 1346.527595][ T5932] usb 1-1: USB disconnect, device number 5 [ 1346.539881][T13387] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4456'. [ 1346.579047][T12766] net_ratelimit: 81 callbacks suppressed [ 1346.579068][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1346.717390][T13393] netlink: 'syz.0.4458': attribute type 11 has an invalid length. [ 1346.872912][T13254] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1347.043475][T13254] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 1347.062573][T13254] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1347.087832][T13254] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1347.100342][T13254] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1347.116405][T13254] usb 5-1: Manufacturer: syz [ 1347.153196][T13254] usb 5-1: config 0 descriptor?? [ 1347.174755][T13404] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4463'. [ 1347.282239][T13254] rc_core: IR keymap rc-hauppauge not found [ 1347.289574][T13254] Registered IR keymap rc-empty [ 1347.311058][T13254] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 1347.406324][T13254] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input99 [ 1347.612629][ T2155] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1347.628992][T13254] usb 5-1: USB disconnect, device number 20 [ 1347.631430][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1347.707739][T13415] FAULT_INJECTION: forcing a failure. [ 1347.707739][T13415] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1347.769938][T13415] CPU: 0 UID: 0 PID: 13415 Comm: syz.0.4468 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1347.769980][T13415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1347.769993][T13415] Call Trace: [ 1347.770002][T13415] [ 1347.770012][T13415] dump_stack_lvl+0x189/0x250 [ 1347.770044][T13415] ? __pfx____ratelimit+0x10/0x10 [ 1347.770078][T13415] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1347.770104][T13415] ? __pfx__printk+0x10/0x10 [ 1347.770133][T13415] ? __might_fault+0xb0/0x130 [ 1347.770174][T13415] should_fail_ex+0x414/0x560 [ 1347.770211][T13415] _copy_from_user+0x2d/0xb0 [ 1347.770255][T13415] get_compat_msghdr+0xad/0x4a0 [ 1347.770292][T13415] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1347.770335][T13415] ___sys_sendmsg+0x193/0x2a0 [ 1347.770367][T13415] ? __pfx____sys_sendmsg+0x10/0x10 [ 1347.770436][T13415] ? __fget_files+0x2a/0x420 [ 1347.770464][T13415] ? __fget_files+0x3a0/0x420 [ 1347.770505][T13415] __sys_sendmsg+0x164/0x220 [ 1347.770547][T13415] ? __pfx___sys_sendmsg+0x10/0x10 [ 1347.770592][T13415] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1347.770616][T13415] ? lockdep_hardirqs_on+0x9c/0x150 [ 1347.770652][T13415] __do_fast_syscall_32+0xb6/0x2b0 [ 1347.770675][T13415] ? lockdep_hardirqs_on+0x9c/0x150 [ 1347.770709][T13415] do_fast_syscall_32+0x34/0x80 [ 1347.770729][T13415] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1347.770753][T13415] RIP: 0023:0xf703e539 [ 1347.770770][T13415] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1347.770789][T13415] RSP: 002b:00000000f502e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1347.770810][T13415] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 1347.770824][T13415] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1347.770836][T13415] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1347.770847][T13415] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1347.770859][T13415] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1347.770886][T13415] [ 1348.492488][ T5932] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1348.535265][T13412] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4467'. [ 1348.668260][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1348.763376][T13435] FAULT_INJECTION: forcing a failure. [ 1348.763376][T13435] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1348.783250][ T5932] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1348.791422][T13435] CPU: 0 UID: 0 PID: 13435 Comm: syz.3.4474 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1348.791454][T13435] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1348.791468][T13435] Call Trace: [ 1348.791477][T13435] [ 1348.791486][T13435] dump_stack_lvl+0x189/0x250 [ 1348.791519][T13435] ? __pfx____ratelimit+0x10/0x10 [ 1348.791558][T13435] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1348.791586][T13435] ? __pfx__printk+0x10/0x10 [ 1348.791629][T13435] should_fail_ex+0x414/0x560 [ 1348.791676][T13435] _copy_to_user+0x31/0xb0 [ 1348.791705][T13435] simple_read_from_buffer+0xe1/0x170 [ 1348.791738][T13435] proc_fail_nth_read+0x1df/0x250 [ 1348.791774][T13435] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1348.791809][T13435] ? rw_verify_area+0x258/0x650 [ 1348.791833][T13435] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1348.791878][T13435] vfs_read+0x1fd/0x980 [ 1348.791908][T13435] ? __pfx___mutex_lock+0x10/0x10 [ 1348.791931][T13435] ? __pfx_vfs_read+0x10/0x10 [ 1348.791957][T13435] ? __fget_files+0x2a/0x420 [ 1348.791991][T13435] ? __fget_files+0x3a0/0x420 [ 1348.792018][T13435] ? __fget_files+0x2a/0x420 [ 1348.792057][T13435] ksys_read+0x145/0x250 [ 1348.792083][T13435] ? __pfx_ksys_read+0x10/0x10 [ 1348.792110][T13435] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1348.792133][T13435] ? lockdep_hardirqs_on+0x9c/0x150 [ 1348.792168][T13435] __do_fast_syscall_32+0xb6/0x2b0 [ 1348.792192][T13435] ? lockdep_hardirqs_on+0x9c/0x150 [ 1348.792228][T13435] do_fast_syscall_32+0x34/0x80 [ 1348.792251][T13435] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1348.792277][T13435] RIP: 0023:0xf710e539 [ 1348.792295][T13435] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1348.792314][T13435] RSP: 002b:00000000f50fe590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1348.792336][T13435] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f50fe620 [ 1348.792351][T13435] RDX: 000000000000000f RSI: 00000000f7473ff4 RDI: 0000000000000000 [ 1348.792365][T13435] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1348.792377][T13435] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1348.792389][T13435] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1348.792420][T13435] [ 1349.102800][ T5932] usb 5-1: Using ep0 maxpacket: 32 [ 1349.110564][ T5932] usb 5-1: config 0 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1349.124980][ T5932] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1349.137486][ T5932] usb 5-1: New USB device found, idVendor=0403, idProduct=97c1, bcdDevice= 0.00 [ 1349.147181][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1349.183388][ T5932] usb 5-1: config 0 descriptor?? [ 1349.197023][T13442] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4476'. [ 1349.207436][T13442] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1349.232290][T12766] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 1349.388274][T12766] usb 1-1: not running at top speed; connect to a high speed hub [ 1349.397915][T12766] usb 1-1: config 0 has an invalid interface number: 150 but max is 0 [ 1349.412599][T12766] usb 1-1: config 0 has no interface number 0 [ 1349.420632][T12766] usb 1-1: config 0 interface 150 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 1349.439156][T12766] usb 1-1: config 0 interface 150 altsetting 5 endpoint 0x6 has invalid wMaxPacketSize 0 [ 1349.547611][T12766] usb 1-1: config 0 interface 150 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 1349.560056][T12766] usb 1-1: config 0 interface 150 altsetting 5 has an invalid descriptor for endpoint zero, skipping [ 1349.572271][T12766] usb 1-1: config 0 interface 150 altsetting 5 endpoint 0xF has invalid maxpacket 1023, setting to 64 [ 1349.584561][T12766] usb 1-1: config 0 interface 150 altsetting 5 has 8 endpoint descriptors, different from the interface descriptor's value: 7 [ 1349.598828][T12766] usb 1-1: config 0 interface 150 has no altsetting 0 [ 1349.615151][T12766] usb 1-1: New USB device found, idVendor=19d2, idProduct=ffd1, bcdDevice=24.1d [ 1349.636023][T12766] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1349.650693][T12766] usb 1-1: Product: В [ 1349.653975][ T5932] hid-retrode 0003:0403:97C1.0029: hidraw0: USB HID v0.02 Device [HID 0403:97c1] on usb-dummy_hcd.4-1/input0 [ 1349.672394][T12766] usb 1-1: Manufacturer: ࠝ [ 1349.677252][T12766] usb 1-1: SerialNumber: ࠖ [ 1349.696303][ T5939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1349.710150][T12766] usb 1-1: config 0 descriptor?? [ 1349.716859][T13430] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1349.860069][T13430] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1350.129826][T12766] option 1-1:0.150: GSM modem (1-port) converter detected [ 1350.216535][T12766] usb 1-1: USB disconnect, device number 6 [ 1350.283538][T12766] option 1-1:0.150: device disconnected [ 1350.556295][ T30] kauditd_printk_skb: 375 callbacks suppressed [ 1350.556317][ T30] audit: type=1326 audit(1752694884.654:13596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1350.736779][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1350.796578][ T30] audit: type=1326 audit(1752694884.654:13597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1350.852562][T12650] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1350.871429][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1350.880990][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1350.913489][ T30] audit: type=1326 audit(1752694884.664:13598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1351.028000][ T30] audit: type=1326 audit(1752694884.664:13599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1351.096538][ T30] audit: type=1326 audit(1752694884.664:13600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1351.140628][T13456] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4481'. [ 1351.206364][ T30] audit: type=1326 audit(1752694884.664:13601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1351.301270][ T30] audit: type=1326 audit(1752694884.664:13602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1351.329081][ T30] audit: type=1326 audit(1752694884.664:13603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1351.352214][ T30] audit: type=1326 audit(1752694884.664:13604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1351.375471][ T30] audit: type=1326 audit(1752694884.664:13605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13452 comm="syz.1.4480" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1351.500861][ T1757] usb 5-1: USB disconnect, device number 21 [ 1351.802779][ T5932] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1351.937266][ T1757] net_ratelimit: 1 callbacks suppressed [ 1351.937287][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1351.975659][ T5932] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 1351.995951][ T5932] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1352.081377][T13469] netlink: 'syz.3.4484': attribute type 11 has an invalid length. [ 1352.123911][ T5932] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1352.134036][ T5932] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1352.152463][T13468] netlink: 'syz.3.4484': attribute type 11 has an invalid length. [ 1352.211279][ T5932] usb 1-1: Manufacturer: syz [ 1352.227381][ T5932] usb 1-1: config 0 descriptor?? [ 1352.438124][T13483] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4486'. [ 1352.447756][ T2155] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 1352.489661][T13483] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1352.669938][ T2155] usb 5-1: Using ep0 maxpacket: 8 [ 1352.721164][ T2155] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1352.774296][ T5932] rc_core: IR keymap rc-hauppauge not found [ 1352.795757][ T5932] Registered IR keymap rc-empty [ 1352.822303][ T2155] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1352.885608][ T5932] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 1352.902782][ T2155] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 3 [ 1352.924354][ T5932] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input100 [ 1352.972654][ T5939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1352.988738][ T2155] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1353.006492][ T2155] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.040652][ T2155] usb 5-1: Product: syz [ 1353.049079][ T2155] usb 5-1: Manufacturer: syz [ 1353.068990][ T2155] usb 5-1: SerialNumber: syz [ 1353.089125][ T5932] usb 1-1: USB disconnect, device number 7 [ 1353.161373][ T2155] usb 5-1: config 0 descriptor?? [ 1353.181582][T13497] tipc: Started in network mode [ 1353.213753][T13497] tipc: Node identity ac1414aa, cluster identity 4711 [ 1353.249112][T13497] tipc: Enabled bearer , priority 10 [ 1353.503412][ T5939] usb 4-1: new full-speed USB device number 10 using dummy_hcd [ 1353.797875][ T5939] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1353.832894][ T5939] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1353.928672][ T5939] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 1353.960162][ T5939] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1353.986657][ T5939] usb 4-1: SerialNumber: syz [ 1354.017733][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1354.058153][ T5939] usb 4-1: 0:2 : does not exist [ 1354.363125][T13254] tipc: Node number set to 2886997162 [ 1354.392175][ T5932] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1354.414065][T13499] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1354.435870][T13499] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1354.533263][ T24] usb 4-1: USB disconnect, device number 10 [ 1354.585801][ T5985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1354.597361][ T5932] usb 1-1: Using ep0 maxpacket: 16 [ 1354.618484][ T5932] usb 1-1: config 0 has an invalid interface number: 41 but max is 0 [ 1354.646140][ T5932] usb 1-1: config 0 has no interface number 0 [ 1354.674253][ T5932] usb 1-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1354.706976][ T5932] usb 1-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1354.737920][ T5932] usb 1-1: config 0 interface 41 has no altsetting 0 [ 1354.764588][ T5932] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1354.782945][T13254] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1354.800930][ T5932] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1354.869421][ T5932] usb 1-1: Product: syz [ 1354.877449][ T5932] usb 1-1: Manufacturer: syz [ 1354.898928][ T5932] usb 1-1: SerialNumber: syz [ 1354.929035][ T5932] usb 1-1: config 0 descriptor?? [ 1354.958784][T13510] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1354.976188][T13254] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1355.046515][T13510] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1355.094653][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1355.105235][T13254] usb 3-1: config 13 has an invalid interface number: 50 but max is 3 [ 1355.141808][T13522] overlayfs: missing 'lowerdir' [ 1355.197803][T13254] usb 3-1: config 13 has an invalid descriptor of length 0, skipping remainder of the config [ 1355.219683][T13254] usb 3-1: config 13 has 1 interface, different from the descriptor's value: 4 [ 1355.241470][T13254] usb 3-1: config 13 has no interface number 0 [ 1355.279160][T13254] usb 3-1: config 13 interface 50 altsetting 4 has 2 endpoint descriptors, different from the interface descriptor's value: 9 [ 1355.375819][T13254] usb 3-1: config 13 interface 50 has no altsetting 0 [ 1355.411013][T13510] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1355.422697][T13510] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1355.435555][T13254] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=a9.e8 [ 1355.448096][T13254] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1355.511255][T13254] usb 3-1: Product: syz [ 1355.537330][ T1757] usb 5-1: USB disconnect, device number 22 [ 1355.553968][T13254] usb 3-1: Manufacturer: syz [ 1355.580844][T13254] usb 3-1: SerialNumber: syz [ 1355.709548][T13510] tipc: Trying to set illegal importance in message [ 1355.726250][ T5932] CoreChips 1-1:0.41 (unnamed net_device) (uninitialized): set LINK LED failed : -71 [ 1355.763119][ T5932] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -71 [ 1355.858471][ T5932] usb 1-1: USB disconnect, device number 8 [ 1356.172593][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1356.363014][ T24] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 1356.440738][T13531] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4499'. [ 1356.578292][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1356.589932][ T2155] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1356.602643][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1356.646595][ T24] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1356.668518][ T24] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1356.869032][ T24] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1356.887617][ T24] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1356.897867][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1356.996825][ T24] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1357.031043][ T24] usb 5-1: invalid MIDI out EP 0 [ 1357.179287][ T24] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1357.231804][ T5985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1357.478516][T13538] netlink: 'syz.0.4501': attribute type 1 has an invalid length. [ 1357.519681][T13538] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1357.622555][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1357.681249][T13538] bond9: entered promiscuous mode [ 1357.708469][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1357.824736][T13254] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1357.833005][T12650] usb 3-1: Failed to submit usb control message: -71 [ 1357.863761][T13254] usb 3-1: USB disconnect, device number 22 [ 1357.907900][T12650] usb 3-1: unable to send the bmi data to the device: -71 [ 1357.948330][T12650] usb 3-1: unable to get target info from device [ 1357.977386][T12650] usb 3-1: could not get target info (-71) [ 1357.981964][ T24] usb 5-1: USB disconnect, device number 23 [ 1358.003925][T12650] usb 3-1: could not probe fw (-71) [ 1358.207095][T13555] tipc: Can't bind to reserved service type 1 [ 1358.510457][T13563] binder: BINDER_SET_CONTEXT_MGR already set [ 1358.519139][T13563] binder: 13561:13563 ioctl 4018620d 80000040 returned -16 [ 1358.737544][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1359.172637][T13576] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 1359.601363][T13585] FAULT_INJECTION: forcing a failure. [ 1359.601363][T13585] name failslab, interval 1, probability 0, space 0, times 0 [ 1359.671651][T13585] CPU: 1 UID: 0 PID: 13585 Comm: syz.4.4516 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1359.671685][T13585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1359.671700][T13585] Call Trace: [ 1359.671709][T13585] [ 1359.671720][T13585] dump_stack_lvl+0x189/0x250 [ 1359.671754][T13585] ? __pfx____ratelimit+0x10/0x10 [ 1359.671789][T13585] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1359.671816][T13585] ? __pfx__printk+0x10/0x10 [ 1359.671855][T13585] ? ref_tracker_alloc+0x318/0x460 [ 1359.671892][T13585] should_fail_ex+0x414/0x560 [ 1359.671930][T13585] should_failslab+0xa8/0x100 [ 1359.671961][T13585] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1359.671987][T13585] ? skb_clone+0x212/0x3a0 [ 1359.672024][T13585] skb_clone+0x212/0x3a0 [ 1359.672059][T13585] __netlink_deliver_tap+0x404/0x850 [ 1359.672101][T13585] ? netlink_deliver_tap+0x2e/0x1b0 [ 1359.672130][T13585] netlink_deliver_tap+0x19c/0x1b0 [ 1359.672160][T13585] netlink_unicast+0x730/0x8e0 [ 1359.672197][T13585] netlink_sendmsg+0x805/0xb30 [ 1359.672237][T13585] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1359.672268][T13585] ? __import_iovec+0x5d4/0x7f0 [ 1359.672291][T13585] ? aa_sock_msg_perm+0x94/0x160 [ 1359.672327][T13585] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1359.672359][T13585] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1359.672388][T13585] __sock_sendmsg+0x219/0x270 [ 1359.672413][T13585] ____sys_sendmsg+0x505/0x830 [ 1359.672449][T13585] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1359.672504][T13585] ___sys_sendmsg+0x21f/0x2a0 [ 1359.672537][T13585] ? __pfx____sys_sendmsg+0x10/0x10 [ 1359.672606][T13585] ? __fget_files+0x2a/0x420 [ 1359.672638][T13585] ? __fget_files+0x3a0/0x420 [ 1359.672680][T13585] __sys_sendmsg+0x164/0x220 [ 1359.672711][T13585] ? __pfx___sys_sendmsg+0x10/0x10 [ 1359.672757][T13585] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1359.672781][T13585] ? lockdep_hardirqs_on+0x9c/0x150 [ 1359.672818][T13585] __do_fast_syscall_32+0xb6/0x2b0 [ 1359.672851][T13585] do_fast_syscall_32+0x34/0x80 [ 1359.672875][T13585] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1359.672902][T13585] RIP: 0023:0xf707e539 [ 1359.672921][T13585] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1359.672942][T13585] RSP: 002b:00000000f506e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1359.672965][T13585] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080006000 [ 1359.672981][T13585] RDX: 0000000000028000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1359.672995][T13585] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1359.673008][T13585] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1359.673021][T13585] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1359.673053][T13585] [ 1359.957232][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1360.279052][T13254] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 1360.842409][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1360.972681][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1361.038339][T13254] usb 2-1: config 6 has an invalid interface number: 94 but max is 0 [ 1361.047270][T13254] usb 2-1: config 6 has no interface number 0 [ 1361.057971][T13254] usb 2-1: config 6 interface 94 altsetting 7 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1361.131502][T13254] usb 2-1: config 6 interface 94 has no altsetting 0 [ 1361.149946][T13254] usb 2-1: New USB device found, idVendor=148f, idProduct=9021, bcdDevice=32.5e [ 1361.192461][T13254] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.210557][T13254] usb 2-1: Product: syz [ 1361.215848][T13254] usb 2-1: Manufacturer: syz [ 1361.220537][T13254] usb 2-1: SerialNumber: syz [ 1361.240524][T13599] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4520'. [ 1361.315489][T13599] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4520'. [ 1361.367176][T13603] fuse: Bad value for 'user_id' [ 1361.399975][T13603] fuse: Bad value for 'user_id' [ 1361.458194][T13254] usb 2-1: USB disconnect, device number 9 [ 1361.522526][ T5932] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 1361.696549][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.703830][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.715593][ T5932] usb 5-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 1361.725503][ T5932] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 1361.743504][ T5932] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1361.898512][ T5932] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1361.917758][ T5932] usb 5-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 1361.937512][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1361.960627][ T5932] usb 5-1: config 0 descriptor?? [ 1362.015041][ T5939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1362.118584][ T1757] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1362.344441][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1362.390734][ T5939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1362.401196][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1362.476835][ T1757] usb 4-1: config 0 has no interfaces? [ 1362.510188][ T5932] input: HID 28bd:0909 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:28BD:0909.002A/input/input101 [ 1362.605282][ T1757] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1362.630402][ T1757] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.635686][ T5932] uclogic 0003:28BD:0909.002A: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.4-1/input0 [ 1362.661214][ T1757] usb 4-1: Product: syz [ 1362.700176][ T1757] usb 4-1: Manufacturer: syz [ 1362.755944][T13622] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1362.766505][T13622] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1362.825020][ T1757] usb 4-1: SerialNumber: syz [ 1362.946891][ T1757] usb 4-1: config 0 descriptor?? [ 1363.044090][ T1757] usb 5-1: USB disconnect, device number 24 [ 1363.139650][T13623] fido_id[13623]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/5-1/report_descriptor': No such file or directory [ 1363.296965][T13611] xt_NFQUEUE: number of queues (65532) out of range (got 66665) [ 1363.620037][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1363.824566][T13632] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4532'. [ 1363.834740][T13633] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4532'. [ 1363.869584][T13254] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1364.009571][T13637] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 1364.016259][T13637] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1364.073210][T13637] vhci_hcd vhci_hcd.0: Device attached [ 1364.155682][T13637] netdevsim netdevsim0: Direct firmware load for @ failed with error -2 [ 1364.349434][T13643] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1364.362510][T13254] usb 34-1: SetAddress Request (2) to port 0 [ 1364.369148][T13254] usb 34-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1364.520429][T13637] netdevsim netdevsim0: Falling back to sysfs fallback for: @ [ 1364.559650][T13651] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4533'. [ 1364.656539][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1364.711244][T13638] vhci_hcd: connection reset by peer [ 1364.717359][ T13] vhci_hcd: stop threads [ 1364.728525][ T13] vhci_hcd: release socket [ 1364.744160][ T13] vhci_hcd: disconnect device [ 1365.319858][ T1757] usb 4-1: USB disconnect, device number 11 [ 1365.474294][T13658] FAULT_INJECTION: forcing a failure. [ 1365.474294][T13658] name failslab, interval 1, probability 0, space 0, times 0 [ 1365.523063][T13658] CPU: 0 UID: 0 PID: 13658 Comm: syz.3.4537 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1365.523096][T13658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1365.523115][T13658] Call Trace: [ 1365.523125][T13658] [ 1365.523135][T13658] dump_stack_lvl+0x189/0x250 [ 1365.523168][T13658] ? __pfx____ratelimit+0x10/0x10 [ 1365.523204][T13658] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1365.523231][T13658] ? __pfx__printk+0x10/0x10 [ 1365.523284][T13658] should_fail_ex+0x414/0x560 [ 1365.523323][T13658] should_failslab+0xa8/0x100 [ 1365.523354][T13658] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1365.523380][T13658] ? skb_clone+0x212/0x3a0 [ 1365.523416][T13658] skb_clone+0x212/0x3a0 [ 1365.523451][T13658] __netlink_deliver_tap+0x404/0x850 [ 1365.523493][T13658] ? netlink_deliver_tap+0x2e/0x1b0 [ 1365.523522][T13658] netlink_deliver_tap+0x19c/0x1b0 [ 1365.523551][T13658] netlink_sendskb+0x68/0x140 [ 1365.523579][T13658] netlink_rcv_skb+0x28c/0x470 [ 1365.523607][T13658] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1365.523634][T13658] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1365.523676][T13658] ? netlink_deliver_tap+0x2e/0x1b0 [ 1365.523702][T13658] ? netlink_deliver_tap+0x2e/0x1b0 [ 1365.523735][T13658] netlink_unicast+0x75c/0x8e0 [ 1365.523771][T13658] netlink_sendmsg+0x805/0xb30 [ 1365.523810][T13658] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1365.523841][T13658] ? __import_iovec+0x5d4/0x7f0 [ 1365.523865][T13658] ? aa_sock_msg_perm+0x94/0x160 [ 1365.523900][T13658] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1365.523933][T13658] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1365.523963][T13658] __sock_sendmsg+0x219/0x270 [ 1365.523988][T13658] ____sys_sendmsg+0x505/0x830 [ 1365.524022][T13658] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1365.524067][T13658] ___sys_sendmsg+0x21f/0x2a0 [ 1365.524099][T13658] ? __pfx____sys_sendmsg+0x10/0x10 [ 1365.524169][T13658] ? __fget_files+0x2a/0x420 [ 1365.524198][T13658] ? __fget_files+0x3a0/0x420 [ 1365.524238][T13658] __sys_sendmsg+0x164/0x220 [ 1365.524276][T13658] ? __pfx___sys_sendmsg+0x10/0x10 [ 1365.524322][T13658] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1365.524346][T13658] ? lockdep_hardirqs_on+0x9c/0x150 [ 1365.524383][T13658] __do_fast_syscall_32+0xb6/0x2b0 [ 1365.524407][T13658] ? lockdep_hardirqs_on+0x9c/0x150 [ 1365.524445][T13658] do_fast_syscall_32+0x34/0x80 [ 1365.524469][T13658] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1365.524495][T13658] RIP: 0023:0xf710e539 [ 1365.524514][T13658] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1365.524534][T13658] RSP: 002b:00000000f50fe55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1365.524557][T13658] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000300 [ 1365.524573][T13658] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1365.524586][T13658] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1365.524599][T13658] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1365.524613][T13658] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1365.524645][T13658] [ 1365.875361][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1366.434614][T13663] xt_CT: No such helper "snmp" [ 1366.462573][ T24] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1366.536420][ T5932] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 1366.594664][T13672] FAULT_INJECTION: forcing a failure. [ 1366.594664][T13672] name failslab, interval 1, probability 0, space 0, times 0 [ 1366.619872][T13672] CPU: 0 UID: 0 PID: 13672 Comm: syz.4.4540 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1366.619904][T13672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1366.619917][T13672] Call Trace: [ 1366.619926][T13672] [ 1366.619936][T13672] dump_stack_lvl+0x189/0x250 [ 1366.619973][T13672] ? __pfx____ratelimit+0x10/0x10 [ 1366.620006][T13672] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1366.620032][T13672] ? __pfx__printk+0x10/0x10 [ 1366.620068][T13672] ? ref_tracker_alloc+0x318/0x460 [ 1366.620104][T13672] should_fail_ex+0x414/0x560 [ 1366.620150][T13672] should_failslab+0xa8/0x100 [ 1366.620178][T13672] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1366.620200][T13672] ? skb_clone+0x212/0x3a0 [ 1366.620231][T13672] skb_clone+0x212/0x3a0 [ 1366.620262][T13672] __netlink_deliver_tap+0x404/0x850 [ 1366.620297][T13672] ? netlink_deliver_tap+0x2e/0x1b0 [ 1366.620323][T13672] netlink_deliver_tap+0x19c/0x1b0 [ 1366.620348][T13672] netlink_unicast+0x730/0x8e0 [ 1366.620381][T13672] netlink_sendmsg+0x805/0xb30 [ 1366.620416][T13672] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1366.620445][T13672] ? __import_iovec+0x5d4/0x7f0 [ 1366.620467][T13672] ? aa_sock_msg_perm+0x94/0x160 [ 1366.620500][T13672] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1366.620531][T13672] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1366.620557][T13672] __sock_sendmsg+0x219/0x270 [ 1366.620581][T13672] ____sys_sendmsg+0x505/0x830 [ 1366.620613][T13672] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1366.620657][T13672] ___sys_sendmsg+0x21f/0x2a0 [ 1366.620686][T13672] ? __pfx____sys_sendmsg+0x10/0x10 [ 1366.620752][T13672] ? __fget_files+0x2a/0x420 [ 1366.620778][T13672] ? __fget_files+0x3a0/0x420 [ 1366.620814][T13672] __sys_sendmsg+0x164/0x220 [ 1366.620843][T13672] ? __pfx___sys_sendmsg+0x10/0x10 [ 1366.620885][T13672] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1366.620906][T13672] ? lockdep_hardirqs_on+0x9c/0x150 [ 1366.620941][T13672] __do_fast_syscall_32+0xb6/0x2b0 [ 1366.620992][T13672] ? lockdep_hardirqs_on+0x9c/0x150 [ 1366.621030][T13672] do_fast_syscall_32+0x34/0x80 [ 1366.621053][T13672] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1366.621080][T13672] RIP: 0023:0xf707e539 [ 1366.621099][T13672] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1366.621118][T13672] RSP: 002b:00000000f506e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1366.621141][T13672] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000200 [ 1366.621155][T13672] RDX: 00000000000080c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 1366.621169][T13672] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1366.621181][T13672] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1366.621195][T13672] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1366.621225][T13672] [ 1366.908844][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1366.962104][T12766] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1367.105312][T13674] netlink: 'syz.0.4541': attribute type 1 has an invalid length. [ 1367.117559][T13672] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4540'. [ 1367.118214][ T5985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1367.137530][ T2155] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1367.170770][T13674] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1367.181471][T12766] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1367.193382][T12766] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1367.205092][T12766] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1367.207784][T13674] bond10: entered promiscuous mode [ 1367.215752][T12766] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1367.236051][T12766] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1367.246038][ T24] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1367.256852][T12766] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1367.265051][ T5932] usb 3-1: config 0 has an invalid interface number: 20 but max is 0 [ 1367.282054][T12766] usb 4-1: Manufacturer: syz [ 1367.288771][ T5932] usb 3-1: config 0 has no interface number 0 [ 1367.297736][T12766] usb 4-1: config 0 descriptor?? [ 1367.298557][ T24] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1367.319841][ T24] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1367.336567][ T5932] usb 3-1: New USB device found, idVendor=04e6, idProduct=000b, bcdDevice= 1.00 [ 1367.346857][ T5932] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1367.359792][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1367.368829][ T5932] usb 3-1: Product: syz [ 1367.379022][ T5932] usb 3-1: Manufacturer: syz [ 1367.397399][ T5932] usb 3-1: SerialNumber: syz [ 1367.405601][T13664] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1367.417726][ T24] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1367.440493][ T5932] usb 3-1: config 0 descriptor?? [ 1367.477944][ T5932] usb-storage 3-1:0.20: USB Mass Storage device detected [ 1367.525991][ T5932] usb-storage 3-1:0.20: Quirks match for vid 04e6 pid 000b: 4 [ 1367.690174][ T5932] usb 3-1: USB disconnect, device number 23 [ 1367.725377][T12766] appleir 0003:05AC:8243.002B: unknown main item tag 0x0 [ 1367.778867][T12766] appleir 0003:05AC:8243.002B: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 1367.900973][T13689] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4545'. [ 1367.911363][T13689] FAULT_INJECTION: forcing a failure. [ 1367.911363][T13689] name failslab, interval 1, probability 0, space 0, times 0 [ 1367.927432][ T1757] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 1367.946180][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1367.951500][T13689] CPU: 1 UID: 0 PID: 13689 Comm: syz.4.4545 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1367.951541][T13689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1367.951556][T13689] Call Trace: [ 1367.951568][T13689] [ 1367.951579][T13689] dump_stack_lvl+0x189/0x250 [ 1367.951617][T13689] ? __pfx____ratelimit+0x10/0x10 [ 1367.951659][T13689] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1367.951689][T13689] ? __pfx__printk+0x10/0x10 [ 1367.951742][T13689] should_fail_ex+0x414/0x560 [ 1367.951787][T13689] should_failslab+0xa8/0x100 [ 1367.951822][T13689] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1367.951851][T13689] ? skb_clone+0x212/0x3a0 [ 1367.951897][T13689] skb_clone+0x212/0x3a0 [ 1367.951938][T13689] __netlink_deliver_tap+0x404/0x850 [ 1367.951988][T13689] ? netlink_deliver_tap+0x2e/0x1b0 [ 1367.952021][T13689] netlink_deliver_tap+0x19c/0x1b0 [ 1367.952066][T13689] netlink_sendskb+0x68/0x140 [ 1367.952096][T13689] netlink_rcv_skb+0x28c/0x470 [ 1367.952127][T13689] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 1367.952170][T13689] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1367.952215][T13689] ? bpf_lsm_capable+0x9/0x20 [ 1367.952243][T13689] ? security_capable+0x7e/0x2e0 [ 1367.952289][T13689] nfnetlink_rcv+0x26a/0x2520 [ 1367.952334][T13689] ? __dev_queue_xmit+0x1cd7/0x3a70 [ 1367.952374][T13689] ? kmem_cache_alloc_noprof+0x1c1/0x3c0 [ 1367.952408][T13689] ? __dev_queue_xmit+0x27e/0x3a70 [ 1367.952445][T13689] ? do_fast_syscall_32+0x34/0x80 [ 1367.952482][T13689] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1367.952521][T13689] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1367.952574][T13689] ? ref_tracker_free+0x63a/0x7d0 [ 1367.952610][T13689] ? __copy_skb_header+0xa7/0x550 [ 1367.952648][T13689] ? __pfx_ref_tracker_free+0x10/0x10 [ 1367.952686][T13689] ? __skb_clone+0x63/0x7a0 [ 1367.952726][T13689] ? __skb_clone+0x483/0x7a0 [ 1367.952768][T13689] ? skb_clone+0x246/0x3a0 [ 1367.952804][T13689] ? __netlink_deliver_tap+0x807/0x850 [ 1367.952834][T13689] ? netlink_deliver_tap+0x2e/0x1b0 [ 1367.952873][T13689] ? netlink_deliver_tap+0x2e/0x1b0 [ 1367.952902][T13689] ? netlink_deliver_tap+0x2e/0x1b0 [ 1367.952940][T13689] netlink_unicast+0x75c/0x8e0 [ 1367.952981][T13689] netlink_sendmsg+0x805/0xb30 [ 1367.953026][T13689] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1367.953067][T13689] ? __import_iovec+0x5d4/0x7f0 [ 1367.953094][T13689] ? aa_sock_msg_perm+0x94/0x160 [ 1367.953135][T13689] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1367.953172][T13689] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1367.953206][T13689] __sock_sendmsg+0x219/0x270 [ 1367.953234][T13689] ____sys_sendmsg+0x505/0x830 [ 1367.953276][T13689] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1367.953332][T13689] ___sys_sendmsg+0x21f/0x2a0 [ 1367.953368][T13689] ? __pfx____sys_sendmsg+0x10/0x10 [ 1367.953446][T13689] ? __fget_files+0x2a/0x420 [ 1367.953478][T13689] ? __fget_files+0x3a0/0x420 [ 1367.953525][T13689] __sys_sendmsg+0x164/0x220 [ 1367.953560][T13689] ? __pfx___sys_sendmsg+0x10/0x10 [ 1367.953610][T13689] ? syscall_enter_from_user_mode_prepare+0x7f/0xe0 [ 1367.953638][T13689] ? lockdep_hardirqs_on+0x9c/0x150 [ 1367.953681][T13689] __do_fast_syscall_32+0xb6/0x2b0 [ 1367.953708][T13689] ? lockdep_hardirqs_on+0x9c/0x150 [ 1367.953752][T13689] do_fast_syscall_32+0x34/0x80 [ 1367.953779][T13689] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1367.953810][T13689] RIP: 0023:0xf707e539 [ 1367.953830][T13689] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1367.953852][T13689] RSP: 002b:00000000f506e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1367.953879][T13689] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000180 [ 1367.953897][T13689] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1367.953913][T13689] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1367.953927][T13689] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1367.953943][T13689] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1367.953979][T13689] [ 1368.482303][ T1757] usb 1-1: Using ep0 maxpacket: 32 [ 1368.489698][ T1757] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1368.502490][ T1757] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 16 [ 1368.513615][ T1757] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 26 [ 1368.529999][T13692] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4547'. [ 1368.530541][ T1757] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1368.551236][ T1757] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1368.560309][ T1757] usb 1-1: SerialNumber: syz [ 1368.583632][T13685] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 1368.885505][ T24] usb 1-1: USB disconnect, device number 9 [ 1368.952761][ T5939] usb 2-1: USB disconnect, device number 10 [ 1368.977208][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1369.072699][T12766] usb 4-1: reset high-speed USB device number 12 using dummy_hcd [ 1369.123217][ T1757] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1369.293845][T12766] usb 4-1: device descriptor read/64, error -32 [ 1369.378252][ T1757] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1369.390863][ T1757] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1369.409972][ T1757] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1369.420005][ T1757] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1369.445749][T13700] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1369.464551][T13254] usb 34-1: device descriptor read/8, error -110 [ 1369.481268][ T1757] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1369.572436][T12766] usb 4-1: reset high-speed USB device number 12 using dummy_hcd [ 1369.732558][T12766] usb 4-1: device descriptor read/64, error -32 [ 1369.914050][T13254] usb usb34-port1: attempt power cycle [ 1369.992419][T12766] usb 4-1: reset high-speed USB device number 12 using dummy_hcd [ 1370.027733][T12766] usb 4-1: device descriptor read/8, error -32 [ 1370.088001][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1370.172927][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1370.197651][T13726] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4555'. [ 1370.207745][T13726] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1370.504186][T13254] usb usb34-port1: unable to enumerate USB device [ 1370.568176][T13735] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4559'. [ 1370.916091][T13740] xt_cgroup: invalid path, errno=-2 [ 1370.984475][ T2327] usb 4-1: USB disconnect, device number 12 [ 1371.132642][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1371.622807][T13767] Invalid logical block size (34) [ 1372.172822][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1372.417909][ T2327] usb 5-1: USB disconnect, device number 25 [ 1372.503092][T13785] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1373.102728][ T2327] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1373.213261][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1373.221651][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1373.274073][ T2327] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1373.301184][ T2327] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1373.796847][ T2327] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1373.892294][ T2327] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1374.004338][ T2327] usb 5-1: Product: syz [ 1374.008582][ T2327] usb 5-1: Manufacturer: syz [ 1374.166498][ T2327] usb 5-1: SerialNumber: syz [ 1374.193676][ T2327] usb 5-1: config 0 descriptor?? [ 1374.213277][ T2327] usb 5-1: selecting invalid altsetting 0 [ 1374.222437][ T1224] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 1374.260679][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1374.389115][ T1224] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1374.400901][ T1224] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1374.413516][ T1224] usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1374.427375][ T1224] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1374.437385][ T1224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1374.482395][ T5932] usb 2-1: new full-speed USB device number 11 using dummy_hcd [ 1374.496002][ T1224] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1374.513031][ T1224] usb 1-1: invalid MIDI out EP 0 [ 1374.631232][ T5857] udevd[5857]: setting mode of /dev/mixer4 to 020660 failed: No such file or directory [ 1374.667009][ T5857] udevd[5857]: setting owner of /dev/mixer4 to uid=0, gid=29 failed: No such file or directory [ 1374.685881][ T1224] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1374.837617][ T1224] usb 5-1: USB disconnect, device number 26 [ 1374.946026][ T5932] usb 2-1: config 0 has no interfaces? [ 1375.224480][T13254] usb 1-1: USB disconnect, device number 10 [ 1375.312785][ T5932] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1375.352569][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1375.363347][ T5932] usb 2-1: Product: syz [ 1375.374181][ T5932] usb 2-1: Manufacturer: syz [ 1375.384377][ T5932] usb 2-1: SerialNumber: syz [ 1375.394416][ T5932] usb 2-1: config 0 descriptor?? [ 1375.406189][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1375.501391][T13813] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4584'. [ 1375.690729][T13799] program syz.1.4580 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1375.702817][T13799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1375.715758][T13799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1375.839063][T13801] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1375.840799][T13801] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1375.853100][T13254] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1376.010281][T13254] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 1376.029568][T13254] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1376.058594][T13254] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1376.077982][T13254] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1376.116385][T13254] usb 3-1: Manufacturer: syz [ 1376.139700][T13254] usb 3-1: config 0 descriptor?? [ 1376.253886][ T5932] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1376.313437][T13254] rc_core: IR keymap rc-hauppauge not found [ 1376.319864][T13254] Registered IR keymap rc-empty [ 1376.387040][T13254] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1376.423471][ T5932] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1376.431711][ T5932] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1376.495760][T13254] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input103 [ 1376.543781][T13254] usb 3-1: USB disconnect, device number 24 [ 1376.579376][T13828] fuse: Unknown parameter '0x0000000000000006' [ 1376.958789][ T2327] usb 2-1: USB disconnect, device number 11 [ 1377.046759][T13254] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1377.242435][T13254] usb 4-1: Using ep0 maxpacket: 16 [ 1377.249391][T13254] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1377.268670][T13254] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1377.285618][T13254] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1377.343679][T13254] usb 4-1: Product: syz [ 1377.389314][T13254] usb 4-1: Manufacturer: syz [ 1377.429911][T13254] usb 4-1: SerialNumber: syz [ 1377.448716][T13254] usb 4-1: config 0 descriptor?? [ 1377.452940][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1377.472307][ T24] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1377.499184][T13254] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1377.540056][T13254] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 1377.662405][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 1377.669977][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1377.680203][ T24] usb 3-1: config 128 has an invalid interface number: 127 but max is 3 [ 1377.691917][ T24] usb 3-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 1377.722344][ T24] usb 3-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 1377.753487][ T24] usb 3-1: config 128 has no interface number 0 [ 1377.772409][ T24] usb 3-1: config 128 interface 127 altsetting 14 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1377.812589][ T24] usb 3-1: config 128 interface 127 has no altsetting 0 [ 1377.834285][ T24] usb 3-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 1377.844226][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1377.866068][ T24] usb 3-1: Product: syz [ 1377.880649][ T24] usb 3-1: Manufacturer: syz [ 1377.896069][ T24] usb 3-1: SerialNumber: syz [ 1377.913176][T13841] netlink: 'syz.4.4595': attribute type 1 has an invalid length. [ 1377.970617][T13841] 8021q: adding VLAN 0 to HW filter on device bond19 [ 1378.025172][T13841] bond19: entered promiscuous mode [ 1378.093099][T13254] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1378.107045][T13847] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4596'. [ 1378.208667][ T24] usb 3-1: USB disconnect, device number 25 [ 1378.265627][ T5846] udevd[5846]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1378.273602][ T5985] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 1378.447298][ T5985] usb 1-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 1378.476491][ T5985] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 1378.494016][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1378.542403][ T5985] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1378.573387][ T5985] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1378.615990][ T5985] usb 1-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 1378.635158][ T5985] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1378.675736][ T5985] usb 1-1: config 0 descriptor?? [ 1378.788032][T13254] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1378.829680][T13254] em28xx 4-1:0.0: board has no eeprom [ 1378.912305][T13254] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1378.936736][T13254] em28xx 4-1:0.0: dvb set to bulk mode. [ 1378.943538][ T5027] em28xx 4-1:0.0: Binding DVB extension [ 1378.975095][T13254] usb 4-1: USB disconnect, device number 13 [ 1379.047027][T13254] em28xx 4-1:0.0: Disconnecting em28xx [ 1379.061159][ T5027] em28xx 4-1:0.0: Registering input extension [ 1379.126484][T13254] em28xx 4-1:0.0: Closing input extension [ 1379.157688][ T5985] input: HID 28bd:0909 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:28BD:0909.002C/input/input105 [ 1379.211488][T13254] em28xx 4-1:0.0: Freeing device [ 1379.266750][ T5985] uclogic 0003:28BD:0909.002C: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.0-1/input0 [ 1379.293103][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1379.383051][ T5027] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1379.542392][ T5027] usb 5-1: Using ep0 maxpacket: 8 [ 1379.548547][ T2327] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1379.556423][ T5027] usb 5-1: config 0 has an invalid interface number: 31 but max is 0 [ 1379.556454][ T5027] usb 5-1: config 0 has no interface number 0 [ 1379.560194][ T5027] usb 5-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1379.575210][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1379.592357][T13870] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1379.609568][T13870] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1379.665742][ T5027] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1379.685224][ T5027] usb 5-1: Product: syz [ 1379.689581][ T5027] usb 5-1: Manufacturer: syz [ 1379.705458][ T5027] usb 5-1: SerialNumber: syz [ 1379.709324][T13254] usb 1-1: USB disconnect, device number 11 [ 1379.754500][ T5027] usb 5-1: config 0 descriptor?? [ 1379.762355][ T2327] usb 3-1: Using ep0 maxpacket: 32 [ 1379.779752][ T2327] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1379.809046][ T2327] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 16 [ 1379.820601][ T2327] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 26 [ 1379.840207][ T2327] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1379.861016][ T2327] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1379.870327][ T2327] usb 3-1: SerialNumber: syz [ 1379.885764][T13865] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1379.902546][ T30] kauditd_printk_skb: 245 callbacks suppressed [ 1379.902591][ T30] audit: type=1326 audit(1752694914.014:13851): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1379.964610][ T30] audit: type=1326 audit(1752694914.044:13852): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1380.025455][ T30] audit: type=1326 audit(1752694914.044:13853): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1380.064058][ T30] audit: type=1326 audit(1752694914.044:13854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1380.094508][T13861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4598'. [ 1380.120933][ T2327] usb 3-1: USB disconnect, device number 26 [ 1380.290604][ T30] audit: type=1326 audit(1752694914.044:13855): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1380.352551][ T30] audit: type=1326 audit(1752694914.044:13856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1380.410604][ T30] audit: type=1326 audit(1752694914.044:13857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1380.437418][ T30] audit: type=1326 audit(1752694914.044:13858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1380.460574][ T30] audit: type=1326 audit(1752694914.044:13859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1380.483482][ T30] audit: type=1326 audit(1752694914.054:13860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13871 comm="syz.3.4604" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1380.665766][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1381.402463][T13254] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1381.566585][T13254] usb 4-1: config 0 has an invalid interface number: 9 but max is 0 [ 1381.595861][T13254] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1381.692625][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1381.722603][T13254] usb 4-1: config 0 has no interface number 0 [ 1381.728921][T13254] usb 4-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=45.e8 [ 1381.828261][T13254] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1381.837390][ T5027] usb 5-1: Found UVC 0.04 device syz (046d:08c3) [ 1381.862332][ T5027] usb 5-1: No streaming interface found for terminal 6. [ 1381.885898][T13254] usb 4-1: config 0 descriptor?? [ 1381.924788][T13254] rndis_host 4-1:0.9: More than one union descriptor, skipping ... [ 1381.936940][ T5027] usb 5-1: USB disconnect, device number 27 [ 1381.989062][T13254] usb 4-1: bad CDC descriptors [ 1382.026710][T13254] cdc_acm 4-1:0.9: More than one union descriptor, skipping ... [ 1382.129038][T13885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1382.151256][T13885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1382.251852][T13874] Bluetooth: hci0: command 0x0406 tx timeout [ 1382.333270][T13254] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1382.333315][ T2327] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 1382.512449][ T2327] usb 1-1: Using ep0 maxpacket: 16 [ 1382.527811][ T2327] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1382.542411][T13903] can: request_module (can-proto-0) failed. [ 1382.546753][ T2327] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 0 [ 1382.559027][ T2327] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 1023 [ 1382.581501][ T2327] usb 1-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=ce.47 [ 1382.591257][ T2327] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1382.599578][ T2327] usb 1-1: Product: syz [ 1382.600466][T13903] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4613'. [ 1382.605391][ T2327] usb 1-1: Manufacturer: syz [ 1382.615023][T13254] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1382.630228][ T2327] usb 1-1: SerialNumber: syz [ 1382.638521][ T2327] usb 1-1: config 0 descriptor?? [ 1382.645518][T13882] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1382.683133][ T2327] mcba_usb 1-1:0.0 can0: failed tx_urb -90 [ 1382.689314][ T2327] mcba_usb 1-1:0.0 can0: Failed to send cmd (169) [ 1382.698170][ T2327] mcba_usb 1-1:0.0 can0: failed tx_urb -90 [ 1382.705067][ T2327] mcba_usb 1-1:0.0 can0: Failed to send cmd (169) [ 1382.713227][ T2327] mcba_usb 1-1:0.0: Microchip CAN BUS Analyzer connected [ 1382.732733][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1382.762421][T13254] usb 2-1: Using ep0 maxpacket: 8 [ 1382.775752][T13254] usb 2-1: config 0 has an invalid interface number: 31 but max is 0 [ 1382.806047][T13254] usb 2-1: config 0 has no interface number 0 [ 1382.823577][T13254] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1382.835805][T13254] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1382.869264][T13254] usb 2-1: Product: syz [ 1382.886136][T13254] usb 2-1: Manufacturer: syz [ 1382.907078][ T5027] usb 1-1: USB disconnect, device number 12 [ 1382.914613][T13254] usb 2-1: SerialNumber: syz [ 1382.939460][T13254] usb 2-1: config 0 descriptor?? [ 1382.947533][ T5027] mcba_usb 1-1:0.0 can0: device disconnected [ 1382.996336][T13908] netlink: 'syz.2.4614': attribute type 1 has an invalid length. [ 1383.097536][T13908] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1383.187155][T13910] bond8: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 1383.198752][T13898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1383.237385][T13898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1383.327974][T13908] bond8: (slave gretap1): making interface the new active one [ 1383.349488][T13908] gretap1: entered promiscuous mode [ 1383.374298][T13908] bond8: (slave gretap1): Enslaving as an active interface with an up link [ 1383.772654][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1383.918534][T13254] usb 2-1: Found UVC 0.04 device syz (046d:08c3) [ 1383.953478][T13254] uvcvideo 2-1:0.31: Entity type for entity Output 6 was not initialized! [ 1383.999346][T13254] usb 2-1: USB disconnect, device number 12 [ 1384.072118][T13935] FAULT_INJECTION: forcing a failure. [ 1384.072118][T13935] name failslab, interval 1, probability 0, space 0, times 0 [ 1384.159592][T13935] CPU: 0 UID: 0 PID: 13935 Comm: syz.0.4619 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1384.159626][T13935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1384.159640][T13935] Call Trace: [ 1384.159650][T13935] [ 1384.159660][T13935] dump_stack_lvl+0x189/0x250 [ 1384.159694][T13935] ? __pfx____ratelimit+0x10/0x10 [ 1384.159731][T13935] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1384.159766][T13935] ? __pfx__printk+0x10/0x10 [ 1384.159801][T13935] ? trace_fib_table_lookup+0x85/0x200 [ 1384.159842][T13935] should_fail_ex+0x414/0x560 [ 1384.159882][T13935] should_failslab+0xa8/0x100 [ 1384.159914][T13935] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1384.159940][T13935] ? dst_alloc+0x105/0x170 [ 1384.159970][T13935] ? fib_lookup+0x76/0x440 [ 1384.160004][T13935] dst_alloc+0x105/0x170 [ 1384.160041][T13935] ip_route_output_key_hash_rcu+0x1482/0x23a0 [ 1384.160078][T13935] ? ip_route_output_key_hash_rcu+0x1291/0x23a0 [ 1384.160120][T13935] ? ip_route_output_key_hash+0xde/0x2e0 [ 1384.160157][T13935] ip_route_output_key_hash+0x1b9/0x2e0 [ 1384.160195][T13935] ? __pfx_ip_route_output_key_hash+0x10/0x10 [ 1384.160248][T13935] tcp_v4_connect+0x73a/0x19d0 [ 1384.160295][T13935] ? __pfx_tcp_v4_connect+0x10/0x10 [ 1384.160323][T13935] ? tcp_v6_connect+0x635/0x1880 [ 1384.160354][T13935] tcp_v6_connect+0xab7/0x1880 [ 1384.160393][T13935] ? __pfx_tcp_v6_connect+0x10/0x10 [ 1384.160419][T13935] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 1384.160480][T13935] __inet_stream_connect+0x295/0xf10 [ 1384.160517][T13935] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1384.160543][T13935] ? __pfx___inet_stream_connect+0x10/0x10 [ 1384.160573][T13935] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1384.160599][T13935] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1384.160638][T13935] inet_stream_connect+0x66/0xa0 [ 1384.160666][T13935] __sys_connect+0x313/0x440 [ 1384.160691][T13935] ? __fget_files+0x3a0/0x420 [ 1384.160723][T13935] ? __pfx___sys_connect+0x10/0x10 [ 1384.160783][T13935] __ia32_sys_connect+0x7a/0x90 [ 1384.160812][T13935] __do_fast_syscall_32+0xb6/0x2b0 [ 1384.160835][T13935] ? lockdep_hardirqs_on+0x9c/0x150 [ 1384.160875][T13935] do_fast_syscall_32+0x34/0x80 [ 1384.160896][T13935] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1384.160924][T13935] RIP: 0023:0xf703e539 [ 1384.160943][T13935] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1384.160963][T13935] RSP: 002b:00000000f502e55c EFLAGS: 00000206 ORIG_RAX: 000000000000016a [ 1384.160986][T13935] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 1384.161002][T13935] RDX: 000000000000001c RSI: 0000000000000000 RDI: 0000000000000000 [ 1384.161015][T13935] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1384.161026][T13935] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1384.161039][T13935] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1384.161072][T13935] [ 1384.603098][ T24] usb 4-1: USB disconnect, device number 14 [ 1384.701743][T13254] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1384.756324][T13941] netlink: 'syz.0.4621': attribute type 1 has an invalid length. [ 1384.833764][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1384.923737][T13941] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1384.988078][T13254] usb 2-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 1385.000083][T13947] bond11: entered promiscuous mode [ 1385.012693][T13254] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 1385.075530][T13254] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1385.107802][T13254] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1385.179347][T13254] usb 2-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 1385.192689][ T24] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1385.222662][T13254] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1385.291342][T13254] usb 2-1: config 0 descriptor?? [ 1385.362361][ T24] usb 4-1: Using ep0 maxpacket: 16 [ 1385.393082][ T5985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1385.423812][ T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1385.445140][ T24] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1385.462822][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1385.471005][ T24] usb 4-1: Product: syz [ 1385.480790][ T24] usb 4-1: Manufacturer: syz [ 1385.485860][ T24] usb 4-1: SerialNumber: syz [ 1385.506619][ T24] usb 4-1: config 0 descriptor?? [ 1385.572932][ T24] em28xx 4-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1385.622493][ T24] em28xx 4-1:0.0: DVB interface 0 found: bulk [ 1385.904306][T13254] input: HID 28bd:0909 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:28BD:0909.002D/input/input106 [ 1385.964590][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1386.022953][ T5027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1386.069939][T13989] netlink: 'syz.2.4626': attribute type 1 has an invalid length. [ 1386.099541][T13254] uclogic 0003:28BD:0909.002D: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.1-1/input0 [ 1386.345021][T13938] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1386.354950][T13938] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1386.366397][ T24] em28xx 4-1:0.0: unknown em28xx chip ID (0) [ 1386.420770][T13989] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1386.478679][ T2327] usb 2-1: USB disconnect, device number 13 [ 1386.500994][T13992] vlan0: entered allmulticast mode [ 1386.534511][T13992] geneve1: entered allmulticast mode [ 1386.586887][T13992] bond9: (slave vlan0): making interface the new active one [ 1386.627740][T13992] bond9: (slave vlan0): Enslaving as an active interface with an up link [ 1386.649706][T13993] fido_id[13993]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1386.863060][ T24] em28xx 4-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1386.895651][ T24] em28xx 4-1:0.0: board has no eeprom [ 1386.972195][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1387.072428][T13254] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1387.196602][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1387.271373][T13254] usb 5-1: Using ep0 maxpacket: 8 [ 1387.356978][T13254] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 1387.404754][ T5027] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1387.447066][T13254] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1387.660224][T13254] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1387.660343][ T2327] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 1387.710479][T13254] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1387.750307][T13254] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1387.780906][T13254] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1387.799617][ T5027] usb 3-1: config 0 has no interfaces? [ 1387.820714][ T5027] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1387.841113][ T5027] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1387.860508][ T5027] usb 3-1: Product: syz [ 1387.883690][ T5027] usb 3-1: Manufacturer: syz [ 1387.902748][ T2327] usb 1-1: Using ep0 maxpacket: 32 [ 1387.902768][ T5027] usb 3-1: SerialNumber: syz [ 1387.921283][ T2327] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1387.937739][ T5027] usb 3-1: config 0 descriptor?? [ 1387.949080][T13950] em28xx 4-1:0.0: failed to get i2c transfer status from bridge register (error=-5) [ 1388.002068][ T2327] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 16 [ 1388.013320][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1388.022289][ T24] em28xx 4-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1388.026704][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1388.031268][ T24] em28xx 4-1:0.0: dvb set to bulk mode. [ 1388.048360][ T5027] em28xx 4-1:0.0: Binding DVB extension [ 1388.074575][ T2327] usb 1-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 26 [ 1388.102801][ T30] kauditd_printk_skb: 279 callbacks suppressed [ 1388.102823][ T30] audit: type=1326 audit(1752694922.204:14140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1388.131223][ C0] vkms_vblank_simulate: vblank timer overrun [ 1388.159660][T13254] usb 5-1: GET_CAPABILITIES returned 0 [ 1388.230413][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1388.242429][T13254] usbtmc 5-1:16.0: can't read capabilities [ 1388.248901][ T2327] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1388.262996][ T24] usb 4-1: USB disconnect, device number 15 [ 1388.266676][ T2327] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1388.277872][ T30] audit: type=1326 audit(1752694922.204:14141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=65 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1388.310707][ T2327] usb 1-1: SerialNumber: syz [ 1388.311489][ T24] em28xx 4-1:0.0: Disconnecting em28xx [ 1388.325892][T14007] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 1388.364737][ T30] audit: type=1326 audit(1752694922.204:14142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1388.429166][ T5027] em28xx 4-1:0.0: Registering input extension [ 1388.586228][ T2327] usb 1-1: USB disconnect, device number 13 [ 1388.606808][ T30] audit: type=1326 audit(1752694922.204:14143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1388.628932][ C0] vkms_vblank_simulate: vblank timer overrun [ 1388.666482][ T24] em28xx 4-1:0.0: Closing input extension [ 1388.708308][ T5027] usb 5-1: USB disconnect, device number 28 [ 1388.970902][ T24] em28xx 4-1:0.0: Freeing device [ 1388.979471][ T30] audit: type=1326 audit(1752694922.214:14144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1389.076284][ T2327] net_ratelimit: 1 callbacks suppressed [ 1389.076303][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1389.101848][ T30] audit: type=1326 audit(1752694922.214:14145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1389.199703][ T30] audit: type=1326 audit(1752694922.214:14146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1389.298039][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1389.344854][ T30] audit: type=1326 audit(1752694922.264:14147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=267 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1389.345808][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1389.400622][T14025] netlink: 'syz.3.4634': attribute type 1 has an invalid length. [ 1389.462462][ T30] audit: type=1326 audit(1752694922.464:14148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1389.986198][ T30] audit: type=1326 audit(1752694922.474:14149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13999 comm="syz.4.4628" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1390.096004][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1390.100843][T14025] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1390.206899][T14036] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4637'. [ 1390.252805][ T5027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1390.310557][T12766] usb 3-1: USB disconnect, device number 27 [ 1390.334205][T14033] bond8: entered promiscuous mode [ 1390.782318][ T5027] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 1390.852295][ T2327] usb 4-1: new full-speed USB device number 16 using dummy_hcd [ 1390.970647][ T5027] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 1391.015942][ T2327] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1391.029445][ T5027] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1391.101704][ T2327] usb 4-1: New USB device found, idVendor=16c0, idProduct=75e1, bcdDevice= 0.00 [ 1391.114191][T12766] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1391.132580][ T2327] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1391.141315][ T5027] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1391.141371][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1391.157330][ T5027] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1391.162716][ T2327] usb 4-1: config 0 descriptor?? [ 1391.193180][ T5027] usb 1-1: Manufacturer: syz [ 1391.221011][ T5027] usb 1-1: config 0 descriptor?? [ 1391.284663][T12766] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1391.328181][T12766] usb 3-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1391.355593][T12766] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1391.461282][T13254] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1391.470352][T12766] usb 3-1: config 0 descriptor?? [ 1391.482617][ T5027] rc_core: IR keymap rc-hauppauge not found [ 1391.488581][ T5027] Registered IR keymap rc-empty [ 1391.519215][ T2327] usb 4-1: string descriptor 0 read error: -71 [ 1391.573880][ T5027] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 1391.603945][ T2327] usbhid 4-1:0.0: can't add hid device: -71 [ 1391.614453][ T2327] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1391.644927][ T5027] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input108 [ 1391.687516][ T5027] usb 1-1: USB disconnect, device number 14 [ 1391.707923][ T2327] usb 4-1: USB disconnect, device number 16 [ 1391.715676][T12766] usbhid 3-1:0.0: can't add hid device: -71 [ 1391.741182][T12766] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1391.849213][T12766] usb 3-1: USB disconnect, device number 28 [ 1391.880884][T13874] Bluetooth: hci3: SCO packet for unknown connection handle 200 [ 1392.104763][ T2327] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1392.173682][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1392.315187][T12766] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1392.392454][ T2327] usb 4-1: Using ep0 maxpacket: 16 [ 1392.402365][ T2327] usb 4-1: New USB device found, idVendor=0458, idProduct=0153, bcdDevice= 0.00 [ 1392.420380][ T2327] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.449158][ T2327] usb 4-1: config 0 descriptor?? [ 1392.472424][T12766] usb 3-1: device descriptor read/64, error -71 [ 1392.788182][T12766] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1392.922422][T12766] usb 3-1: device descriptor read/64, error -71 [ 1393.035455][T12766] usb usb3-port1: attempt power cycle [ 1393.319557][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1393.372510][ T5027] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 1393.382517][T12766] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 1393.403038][T12766] usb 3-1: device descriptor read/8, error -71 [ 1393.533778][ T5027] usb 1-1: Using ep0 maxpacket: 8 [ 1393.544686][ T5027] usb 1-1: config 0 has an invalid interface number: 176 but max is 2 [ 1393.553773][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.553810][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.553835][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.553860][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.553903][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.553929][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.553967][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.554004][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.554047][ T2327] kye 0003:0458:0153.002E: unknown main item tag 0x0 [ 1393.567434][ T2327] kye 0003:0458:0153.002E: hidraw0: USB HID v0.85 Device [HID 0458:0153] on usb-dummy_hcd.3-1/input0 [ 1393.692484][T12766] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1393.697537][ T5027] usb 1-1: config 0 has an invalid interface number: 49 but max is 2 [ 1393.732596][T12766] usb 3-1: device descriptor read/8, error -71 [ 1393.785564][ T5027] usb 1-1: config 0 has no interface number 1 [ 1393.818238][ T5027] usb 1-1: config 0 has no interface number 2 [ 1393.836322][ T5027] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 1393.851951][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1393.853433][T12766] usb usb3-port1: unable to enumerate USB device [ 1393.894598][ T5027] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1393.947544][ T5027] usb 1-1: config 0 descriptor?? [ 1393.983925][ T5027] qmi_wwan 1-1:0.0: probe with driver qmi_wwan failed with error -22 [ 1394.035118][T14084] netlink: 'syz.4.4650': attribute type 1 has an invalid length. [ 1394.175360][ T5027] qcserial 1-1:0.49: Qualcomm USB modem converter detected [ 1394.206603][T14084] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1394.270704][T14087] bond20: entered promiscuous mode [ 1394.337035][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1394.397001][T14081] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1394.410282][T12766] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1394.420531][T14081] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1394.492412][ T5027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1394.554212][T12766] usb 3-1: device descriptor read/64, error -71 [ 1394.595200][ T2327] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1394.682654][ T1224] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1394.776965][ T2327] usb 2-1: Using ep0 maxpacket: 16 [ 1394.786687][ T2327] usb 2-1: config 0 has an invalid interface number: 41 but max is 0 [ 1394.796187][T12766] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1394.799355][ T5027] usb 4-1: USB disconnect, device number 17 [ 1394.812658][ T2327] usb 2-1: config 0 has no interface number 0 [ 1394.819072][ T2327] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1394.830451][ T2327] usb 2-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 1394.859065][ T2327] usb 2-1: config 0 interface 41 has no altsetting 0 [ 1394.867103][ T1224] usb 5-1: Using ep0 maxpacket: 16 [ 1394.880799][ T1224] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 1394.900712][ T1224] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1394.918983][ T2327] usb 2-1: New USB device found, idVendor=0fe6, idProduct=9700, bcdDevice=d1.9a [ 1394.930319][ T1224] usb 5-1: config 0 has no interface number 0 [ 1394.937713][ T2327] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.947119][ T2327] usb 2-1: Product: syz [ 1394.953034][ T2327] usb 2-1: Manufacturer: syz [ 1394.958529][ T2327] usb 2-1: SerialNumber: syz [ 1394.965448][ T1224] usb 5-1: New USB device found, idVendor=046c, idProduct=14e8, bcdDevice= b.28 [ 1394.978404][ T1224] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.987205][T12766] usb 3-1: device descriptor read/64, error -71 [ 1394.996120][ T2327] usb 2-1: config 0 descriptor?? [ 1395.002362][ T1224] usb 5-1: Product: syz [ 1395.007720][ T1224] usb 5-1: Manufacturer: syz [ 1395.008041][T14092] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 1395.012520][ T1224] usb 5-1: SerialNumber: syz [ 1395.044307][T14096] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4654'. [ 1395.055327][ T1224] usb 5-1: config 0 descriptor?? [ 1395.066471][T14092] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 1395.076765][T14096] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1395.103122][T12766] usb usb3-port1: attempt power cycle [ 1395.296494][T14092] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 1395.306543][T14092] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 1395.334832][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 1395.334851][ T30] audit: type=1400 audit(1752694929.444:14168): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A273A02 pid=14093 comm="syz.4.4653" [ 1395.382536][T14099] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1395.395763][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1395.408426][T14099] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1395.453022][T12766] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1395.473390][T12766] usb 3-1: device descriptor read/8, error -71 [ 1395.490459][ T5027] usb 5-1: USB disconnect, device number 29 [ 1395.612939][T13254] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1395.694009][ T1757] usb 1-1: USB disconnect, device number 15 [ 1395.722742][T12766] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1395.741243][ T1757] qcserial 1-1:0.49: device disconnected [ 1395.755065][T12766] usb 3-1: device descriptor read/8, error -71 [ 1395.897786][T12766] usb usb3-port1: unable to enumerate USB device [ 1395.942965][ T1149] gretap1: left promiscuous mode [ 1396.126941][ T2327] Error reading MAC address [ 1396.161176][ T2327] sr9700 2-1:0.41: probe with driver sr9700 failed with error -71 [ 1396.215428][ T2327] usb 2-1: USB disconnect, device number 14 [ 1396.416068][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1396.473148][T14109] syzkaller1: entered promiscuous mode [ 1396.496201][T14109] syzkaller1: entered allmulticast mode [ 1396.679962][T14113] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4655'. [ 1396.817310][T14118] FAULT_INJECTION: forcing a failure. [ 1396.817310][T14118] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1396.831225][T14118] CPU: 1 UID: 0 PID: 14118 Comm: syz.0.4661 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1396.831253][T14118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1396.831268][T14118] Call Trace: [ 1396.831277][T14118] [ 1396.831287][T14118] dump_stack_lvl+0x189/0x250 [ 1396.831320][T14118] ? __pfx____ratelimit+0x10/0x10 [ 1396.831355][T14118] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1396.831383][T14118] ? __pfx__printk+0x10/0x10 [ 1396.831428][T14118] should_fail_ex+0x414/0x560 [ 1396.831467][T14118] _copy_to_user+0x31/0xb0 [ 1396.831509][T14118] sctp_getsockopt_encap_port+0x3ec/0x5b0 [ 1396.831548][T14118] ? __pfx_sctp_getsockopt_encap_port+0x10/0x10 [ 1396.831592][T14118] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1396.831618][T14118] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1396.831656][T14118] sctp_getsockopt+0xa1b/0xb60 [ 1396.831688][T14118] do_sock_getsockopt+0x35d/0x650 [ 1396.831720][T14118] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1396.831750][T14118] ? __fget_files+0x2a/0x420 [ 1396.831778][T14118] ? __fget_files+0x3a0/0x420 [ 1396.831806][T14118] ? __fget_files+0x2a/0x420 [ 1396.831844][T14118] __ia32_sys_getsockopt+0x1a5/0x250 [ 1396.831883][T14118] __do_fast_syscall_32+0xb6/0x2b0 [ 1396.831907][T14118] ? lockdep_hardirqs_on+0x9c/0x150 [ 1396.831946][T14118] do_fast_syscall_32+0x34/0x80 [ 1396.831968][T14118] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1396.831995][T14118] RIP: 0023:0xf703e539 [ 1396.832014][T14118] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1396.832031][T14118] RSP: 002b:00000000f502e55c EFLAGS: 00000206 ORIG_RAX: 000000000000016d [ 1396.832054][T14118] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000084 [ 1396.832069][T14118] RDX: 0000000000000084 RSI: 0000000080000440 RDI: 0000000080000500 [ 1396.832083][T14118] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1396.832096][T14118] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1396.832109][T14118] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1396.832142][T14118] [ 1397.043592][ C1] vkms_vblank_simulate: vblank timer overrun [ 1397.428785][T14133] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4666'. [ 1397.440433][T14133] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1397.463289][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1397.533460][T13254] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1397.685880][T14141] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4669'. [ 1397.885572][ T24] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1398.032599][T13254] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1398.044496][ T24] usb 1-1: config 1 interface 0 has no altsetting 0 [ 1398.054714][ T24] usb 1-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.40 [ 1398.065484][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1398.179683][ T24] usb 1-1: Product: syz [ 1398.197528][ T24] usb 1-1: Manufacturer: syz [ 1398.213853][T13254] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 1398.233064][ T24] usb 1-1: SerialNumber: syz [ 1398.242195][T13254] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1398.293587][T13254] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1398.315523][T13254] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1398.326301][T13254] usb 2-1: Manufacturer: syz [ 1398.345961][T13254] usb 2-1: config 0 descriptor?? [ 1398.402389][ T30] audit: type=1326 audit(1752694932.494:14169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 1398.492415][T14139] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1398.492657][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1398.526722][ T30] audit: type=1326 audit(1752694932.494:14170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1398.550892][T14139] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1398.599122][T14151] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4672'. [ 1398.602600][ T30] audit: type=1326 audit(1752694932.494:14171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1398.648452][ T24] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input110 [ 1398.708466][ T30] audit: type=1326 audit(1752694932.494:14172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 1398.732156][T13254] rc_core: IR keymap rc-hauppauge not found [ 1398.742560][T13254] Registered IR keymap rc-empty [ 1398.764562][T13254] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 1398.802613][ T24] usb 1-1: USB disconnect, device number 16 [ 1398.805396][ C0] pxrc 1-1:1.0: pxrc_usb_irq - usb_submit_urb failed with result: -19 [ 1398.828906][ T30] audit: type=1326 audit(1752694932.494:14173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1398.877602][ T5202] pxrc 1-1:1.0: pxrc_open - usb_submit_urb failed, error: -19 [ 1398.892932][T13254] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input109 [ 1398.957158][ T30] audit: type=1326 audit(1752694932.494:14174): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1398.980603][ T30] audit: type=1326 audit(1752694932.494:14175): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf707e539 code=0x7ffc0000 [ 1399.032599][ T30] audit: type=1326 audit(1752694932.494:14176): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 1399.062519][ T30] audit: type=1326 audit(1752694932.494:14177): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14146 comm="syz.4.4671" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf707e558 code=0x7ffc0000 [ 1399.126741][T13254] usb 2-1: USB disconnect, device number 15 [ 1399.506601][T14161] netlink: 'syz.3.4676': attribute type 1 has an invalid length. [ 1399.532832][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1399.646873][T14161] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1399.672168][T13254] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 1399.732275][T14165] bond9: entered promiscuous mode [ 1399.873935][T13254] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1399.895700][T13254] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1399.928063][T13254] usb 2-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 1399.941312][T14180] netlink: 'syz.0.4680': attribute type 27 has an invalid length. [ 1399.950176][T13254] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1399.997998][T13254] usb 2-1: config 0 descriptor?? [ 1400.007392][T14180] netlink: 'syz.0.4680': attribute type 3 has an invalid length. [ 1400.055758][T14180] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4680'. [ 1400.573001][T12766] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1400.589341][T13254] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1400.727279][T14198] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4683'. [ 1400.817423][T14198] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4683'. [ 1401.142087][ T1757] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 1401.336657][ T1757] usb 5-1: Using ep0 maxpacket: 16 [ 1401.448674][ T1757] usb 5-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 1401.494325][ T1757] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.496420][T14202] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4685'. [ 1401.655131][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1401.671597][ T1757] usb 5-1: Product: syz [ 1401.778185][ T1757] usb 5-1: Manufacturer: syz [ 1401.798659][ T1757] usb 5-1: SerialNumber: syz [ 1401.824807][ T1757] usb 5-1: config 0 descriptor?? [ 1401.893162][ T5985] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1402.083895][ T1757] speedtch 5-1:0.0: speedtch_bind: data interface not found! [ 1402.113910][ T1757] speedtch 5-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1402.305136][T14198] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4683'. [ 1402.317940][T14198] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4683'. [ 1402.460399][ T5985] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 1402.652628][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1402.760351][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1402.946123][ T5985] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1402.989851][ T5027] usb 2-1: USB disconnect, device number 16 [ 1403.010111][ T5985] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1403.030616][ T5985] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1403.054093][ T5985] usb 1-1: Manufacturer: syz [ 1403.227374][ T5985] usb 1-1: config 0 descriptor?? [ 1403.422368][ T5985] rc_core: IR keymap rc-hauppauge not found [ 1403.437364][ T5985] Registered IR keymap rc-empty [ 1403.622819][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1403.631407][ T5985] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 1403.675095][ T5985] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input112 [ 1403.732655][ T5985] usb 1-1: USB disconnect, device number 17 [ 1403.772811][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1403.852709][ T1757] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 1403.870854][ T5027] usb 5-1: USB disconnect, device number 30 [ 1403.933637][T14218] lo: entered allmulticast mode [ 1403.941165][T14217] lo: left allmulticast mode [ 1403.961994][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1404.015267][ T1757] usb 3-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 1404.127875][ T1757] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 1404.127952][ T1757] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1404.127983][ T1757] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1404.128032][ T1757] usb 3-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 1404.128059][ T1757] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1404.258409][ T1757] usb 3-1: config 0 descriptor?? [ 1404.331174][ T30] kauditd_printk_skb: 144 callbacks suppressed [ 1404.331193][ T30] audit: type=1326 audit(1752694938.444:14322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1404.331283][ T30] audit: type=1326 audit(1752694938.444:14323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1404.331328][ T30] audit: type=1326 audit(1752694938.444:14324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1404.331391][ T30] audit: type=1326 audit(1752694938.444:14325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1404.331437][ T30] audit: type=1326 audit(1752694938.444:14326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1404.331480][ T30] audit: type=1326 audit(1752694938.444:14327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1404.332517][ T30] audit: type=1326 audit(1752694938.444:14328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1404.332570][ T30] audit: type=1326 audit(1752694938.444:14329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1404.332641][ T30] audit: type=1326 audit(1752694938.444:14330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709e539 code=0x7ffc0000 [ 1404.332687][ T30] audit: type=1326 audit(1752694938.444:14331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14211 comm="syz.1.4687" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf709e558 code=0x7ffc0000 [ 1404.587562][T14231] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4693'. [ 1404.731793][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1404.813552][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1404.834405][ T1757] input: HID 28bd:0909 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:28BD:0909.002F/input/input113 [ 1404.930740][ T1757] uclogic 0003:28BD:0909.002F: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.2-1/input0 [ 1405.197784][ T5027] usb 3-1: USB disconnect, device number 37 [ 1405.216438][ T5985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1405.594853][T14235] fido_id[14235]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 1405.852624][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1406.285953][T14244] fuse: Bad value for 'fd' [ 1406.652814][ T5027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1406.893135][ T1224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1406.912571][ T2327] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 1406.922520][ T1757] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 1407.109582][ T1757] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1407.152219][ T2327] usb 5-1: config 0 has no interfaces? [ 1407.187414][ T2327] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1407.207325][ T2327] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1407.220576][ T1757] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1407.295028][ T1757] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1407.333716][ T2327] usb 5-1: Product: syz [ 1407.373324][ T2327] usb 5-1: Manufacturer: syz [ 1407.382563][ T1757] usb 2-1: Product: syz [ 1407.414693][ T2327] usb 5-1: SerialNumber: syz [ 1407.422585][ T1757] usb 2-1: Manufacturer: syz [ 1407.480554][ T1757] usb 2-1: SerialNumber: syz [ 1407.516741][ T2327] usb 5-1: config 0 descriptor?? [ 1407.595857][T14258] netlink: 'syz.2.4702': attribute type 5 has an invalid length. [ 1407.682379][T14258] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4702'. [ 1407.762745][T14261] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4703'. [ 1407.939091][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1408.202757][ T5985] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1408.378957][ T5985] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 1408.460802][ T5985] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1408.489586][ T5985] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1408.520319][ T5985] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1408.545555][ T5985] usb 4-1: Manufacturer: syz [ 1408.587837][ T5985] usb 4-1: config 0 descriptor?? [ 1408.902188][ T5985] rc_core: IR keymap rc-hauppauge not found [ 1408.987049][ T5939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1409.055062][ T5985] Registered IR keymap rc-empty [ 1409.080982][ T5985] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 1409.107130][ T5985] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input114 [ 1409.149684][ T5985] usb 4-1: USB disconnect, device number 18 [ 1409.628915][ T1757] cdc_ncm 2-1:1.0: bind() failure [ 1409.693491][ T5985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1409.698032][ T1757] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 1409.736201][ T1757] cdc_ncm 2-1:1.1: bind() failure [ 1409.762885][ T1757] usb 2-1: USB disconnect, device number 17 [ 1410.045920][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1410.517688][T13254] usb 5-1: USB disconnect, device number 31 [ 1411.022299][T13254] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 1411.055707][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1411.128569][ T30] kauditd_printk_skb: 1046 callbacks suppressed [ 1411.128587][ T30] audit: type=1326 audit(1752694945.234:15378): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1411.159089][T13254] usb 5-1: device descriptor read/64, error -71 [ 1411.202602][ T30] audit: type=1326 audit(1752694945.274:15379): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1411.249625][ T30] audit: type=1326 audit(1752694945.274:15380): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1411.275909][ T30] audit: type=1326 audit(1752694945.284:15381): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1411.351104][ T30] audit: type=1326 audit(1752694945.284:15382): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1411.443050][T13254] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 1411.483491][ T30] audit: type=1326 audit(1752694945.284:15383): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1411.559059][ T30] audit: type=1326 audit(1752694945.284:15384): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1411.591685][T13254] usb 5-1: device descriptor read/64, error -71 [ 1411.638653][ T30] audit: type=1326 audit(1752694945.284:15385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1411.720879][T13254] usb usb5-port1: attempt power cycle [ 1411.757759][ T30] audit: type=1326 audit(1752694945.284:15386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf710e539 code=0x7ffc0000 [ 1411.840344][T14302] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4711'. [ 1411.869283][ T30] audit: type=1326 audit(1752694945.284:15387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14295 comm="syz.3.4710" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf710e558 code=0x7ffc0000 [ 1411.913331][T14305] input: syz1 as /devices/virtual/input/input115 [ 1412.098307][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1412.115004][T13254] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 1412.145822][T13254] usb 5-1: device descriptor read/8, error -71 [ 1412.231620][ T5939] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1412.259297][T14310] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4713'. [ 1412.326961][T14310] input: syz1 as /devices/virtual/input/input116 [ 1412.401626][T13254] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 1412.418507][ T5939] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 1412.431756][ T5939] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1412.433633][T13254] usb 5-1: device descriptor read/8, error -71 [ 1412.479809][ T5939] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1412.500318][ T5939] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1412.504743][T14312] netlink: 148 bytes leftover after parsing attributes in process `syz.1.4714'. [ 1412.527959][ T5939] usb 3-1: Manufacturer: syz [ 1412.549364][ T5939] usb 3-1: config 0 descriptor?? [ 1412.572953][T13254] usb usb5-port1: unable to enumerate USB device [ 1412.663747][ T5939] rc_core: IR keymap rc-hauppauge not found [ 1412.669690][ T5939] Registered IR keymap rc-empty [ 1412.837015][T13254] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1412.861202][ T5939] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 1412.908090][ T5939] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input117 [ 1412.958906][ T5939] usb 3-1: USB disconnect, device number 38 [ 1413.136205][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1413.272357][T13254] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1413.431718][T13254] usb 2-1: Using ep0 maxpacket: 32 [ 1413.439794][T13254] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1413.456198][T13254] usb 2-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1413.470857][T13254] usb 2-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1413.485635][T13254] usb 2-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 1413.507736][T14325] netlink: 'syz.3.4715': attribute type 2 has an invalid length. [ 1413.527659][T14325] : entered promiscuous mode [ 1413.564784][T13254] usb 2-1: Product: syz [ 1413.604721][T13254] usb 2-1: Manufacturer: syz [ 1413.754710][T13254] hub 2-1:4.0: USB hub found [ 1413.997705][T14318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1414.047310][T14318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1414.177812][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1414.362650][T14333] netlink: 'syz.4.4719': attribute type 1 has an invalid length. [ 1414.403988][T14331] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4718'. [ 1414.414594][T14331] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1414.439944][T13254] hub 2-1:4.0: config failed, can't read hub descriptor (err -22) [ 1414.533061][T13254] usb 2-1: USB disconnect, device number 18 [ 1414.746723][T14333] 8021q: adding VLAN 0 to HW filter on device bond21 [ 1414.813779][ T5027] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1414.835844][T14337] bond21: entered promiscuous mode [ 1415.162667][T14343] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 1415.228374][ T5939] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1415.303392][T14347] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4723'. [ 1415.328036][T14347] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4723'. [ 1415.398006][T14347] bond0: entered promiscuous mode [ 1415.405484][T14347] bridge0: entered promiscuous mode [ 1415.411368][T14347] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 1415.419626][T14347] Cannot create hsr debugfs directory [ 1415.425884][T14347] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 1415.436468][ T1757] usb 3-1: new full-speed USB device number 39 using dummy_hcd [ 1415.444581][T14347] hsr1: Slave B (bridge0) is not up; please bring it up to get a fully working HSR network [ 1415.572538][T13254] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1415.582378][ T1757] usb 3-1: device descriptor read/64, error -71 [ 1415.743960][T13254] usb 4-1: config 189 has an invalid descriptor of length 0, skipping remainder of the config [ 1415.765259][T13254] usb 4-1: New USB device found, idVendor=06cd, idProduct=011a, bcdDevice=17.cb [ 1415.789575][T13254] usb 4-1: New USB device strings: Mfr=1, Product=10, SerialNumber=3 [ 1415.820548][T13254] usb 4-1: Product: syz [ 1415.822771][ T1757] usb 3-1: new full-speed USB device number 40 using dummy_hcd [ 1415.847943][T13254] usb 4-1: Manufacturer: syz [ 1415.853345][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1415.879995][T13254] usb 4-1: SerialNumber: syz [ 1415.973438][ T1757] usb 3-1: device descriptor read/64, error -71 [ 1416.102786][ T1757] usb usb3-port1: attempt power cycle [ 1416.257912][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1416.295765][T13254] hub 4-1:189.0: bad descriptor, ignoring hub [ 1416.306822][T13254] hub 4-1:189.0: probe with driver hub failed with error -5 [ 1416.315937][T13254] keyspan 4-1:189.0: Keyspan - (without firmware) converter detected [ 1416.393726][T13254] usb 4-1: USB disconnect, device number 19 [ 1416.450127][T13254] keyspan 4-1:189.0: device disconnected [ 1416.462457][ T1757] usb 3-1: new full-speed USB device number 41 using dummy_hcd [ 1416.517440][ T1757] usb 3-1: device descriptor read/8, error -71 [ 1416.536277][T14361] ptrace attach of "./syz-executor exec"[1755] was attempted by "./syz-executor exec"[14361] [ 1416.624822][T14361] dns_resolver: Unsupported server list version (0) [ 1416.812786][ T1757] usb 3-1: new full-speed USB device number 42 using dummy_hcd [ 1416.903870][ T1757] usb 3-1: device descriptor read/8, error -71 [ 1417.155321][ T1757] usb usb3-port1: unable to enumerate USB device [ 1417.303550][ T1757] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1417.402337][ T31] INFO: task kworker/0:2:1210 blocked for more than 143 seconds. [ 1417.410125][ T31] Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 [ 1417.428856][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1417.462444][ T5939] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 1417.462456][ T31] task:kworker/0:2 state:D stack:19480 pid:1210 tgid:1210 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 1417.483633][ T31] Workqueue: usb_hub_wq hub_event [ 1417.488834][ T31] Call Trace: [ 1417.492929][ T31] [ 1417.496127][ T31] __schedule+0x16f5/0x4d00 [ 1417.502383][ T31] ? schedule+0x165/0x360 [ 1417.510893][ T31] ? __pfx___schedule+0x10/0x10 [ 1417.517110][ T31] ? schedule+0x91/0x360 [ 1417.521472][ T31] schedule+0x165/0x360 [ 1417.528003][ T31] schedule_preempt_disabled+0x13/0x30 [ 1417.534465][ T31] __mutex_lock+0x724/0xe80 [ 1417.540426][ T31] ? __mutex_lock+0x51b/0xe80 [ 1417.546001][ T31] ? hub_event+0x21cb/0x4a00 [ 1417.551063][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1417.557532][ T31] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1417.564737][ T31] hub_event+0x21cb/0x4a00 [ 1417.569337][ T31] ? do_raw_spin_lock+0x121/0x290 [ 1417.575467][ T31] ? __pfx_hub_event+0x10/0x10 [ 1417.580369][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1417.587020][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1417.592992][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1417.602894][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1417.608738][ T31] process_scheduled_works+0xae1/0x17b0 [ 1417.625703][ T5939] usb 1-1: config 4 has an invalid interface number: 156 but max is 0 [ 1417.635478][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1417.652259][ T31] worker_thread+0x8a0/0xda0 [ 1417.652390][ T5939] usb 1-1: config 4 has no interface number 0 [ 1417.662839][ T31] kthread+0x70e/0x8a0 [ 1417.677534][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1417.693798][ T5939] usb 1-1: config 4 interface 156 has no altsetting 0 [ 1417.703037][ T31] ? __pfx_kthread+0x10/0x10 [ 1417.723289][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1417.726497][ T5939] usb 1-1: New USB device found, idVendor=0fe9, idProduct=db71, bcdDevice=53.3e [ 1417.753516][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1417.758803][ T5939] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1417.779112][ T31] ? __pfx_kthread+0x10/0x10 [ 1417.791219][ T31] ret_from_fork+0x3fc/0x770 [ 1417.809231][ T5939] usb 1-1: Product: syz [ 1417.817142][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1417.833396][ T5939] usb 1-1: Manufacturer: syz [ 1417.845122][ T31] ? __switch_to_asm+0x39/0x70 [ 1417.855937][ T5939] usb 1-1: SerialNumber: syz [ 1417.867734][ T31] ? __switch_to_asm+0x33/0x70 [ 1417.882558][ T31] ? __pfx_kthread+0x10/0x10 [ 1417.908244][ T31] ret_from_fork_asm+0x1a/0x30 [ 1417.921183][ T31] [ 1417.933557][ T31] [ 1417.933557][ T31] Showing all locks held in the system: [ 1417.938785][ T5939] dvb-usb: found a 'DViCO FusionHDTV DVB-T NANO2 w/o firmware' in warm state. [ 1417.967897][ T31] 5 locks held by kworker/0:1/10: [ 1418.001347][ T31] #0: ffff888143e89148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1418.040325][ T5939] usb 1-1: setting power ON [ 1418.057068][ T31] #1: ffffc900000f7bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1418.069537][ T5939] dvb-usb: bulk message failed: -22 (2/0) [ 1418.076913][ T5939] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1418.088139][ T31] #2: ffff888146b66198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 1418.139526][ T31] #3: ffff888146b81510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 [ 1418.186564][ T31] #4: ffff888146378668 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 [ 1418.208590][ T5939] dvb-usb: DViCO FusionHDTV DVB-T NANO2 w/o firmware error while loading driver (-19) [ 1418.234422][ T31] 3 locks held by kworker/1:0/24: [ 1418.255008][ T31] #0: ffff88801cec4148 ((wq_completion)pm){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1418.269762][ T31] #1: ffffc900001e7bc0 ((work_completion)(&hcd->wakeup_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1418.286805][ T31] #2: ffff888027e9a220 (&dev->power.lock){-.-.}-{3:3}, at: rpm_idle+0x5e9/0x950 [ 1418.293038][ T5939] dvb_usb_cxusb 1-1:4.156: probe with driver dvb_usb_cxusb failed with error -22 [ 1418.297102][ T31] 1 lock held by khungtaskd/31: [ 1418.315373][ T31] #0: ffffffff8e13f0e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1418.327329][ T31] 5 locks held by kworker/0:2/1210: [ 1418.333485][ T31] #0: ffff888143e89148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1418.346132][ T31] #1: ffffc90003ddfbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1418.348770][ T2327] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1418.359351][ T31] #2: ffff888146b85198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 1418.450122][ T5939] usb 1-1: USB disconnect, device number 18 [ 1418.455975][ T31] #3: ffff888028b28510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 [ 1418.481301][ T31] #4: ffff888146378668 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 [ 1418.491987][ T31] 2 locks held by getty/5609: [ 1418.496719][ T31] #0: ffff88814cc6e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1418.507447][ T31] #1: ffffc900036cb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 1418.518438][ T31] 1 lock held by udevd/5846: [ 1418.523687][ T31] 2 locks held by udevd/5863: [ 1418.528396][ T31] 3 locks held by kworker/0:4/5939: [ 1418.534643][ T31] #0: ffff888143e89148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1418.548014][ T31] #1: ffffc9000ab47bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1418.562130][ T31] #2: ffff888144bd6198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 [ 1418.571176][ T31] 1 lock held by syz.1.4724/14355: [ 1418.577593][ T31] 1 lock held by syz.0.4728/14368: [ 1418.585398][ T31] #0: ffffffff8e144bf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 1418.634752][ T31] [ 1418.637161][ T31] ============================================= [ 1418.637161][ T31] [ 1418.682090][ T31] NMI backtrace for cpu 0 [ 1418.682111][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1418.682137][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1418.682151][ T31] Call Trace: [ 1418.682159][ T31] [ 1418.682168][ T31] dump_stack_lvl+0x189/0x250 [ 1418.682199][ T31] ? __wake_up_klogd+0xd9/0x110 [ 1418.682232][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1418.682258][ T31] ? __pfx__printk+0x10/0x10 [ 1418.682300][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1418.682332][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1418.682358][ T31] ? _printk+0xcf/0x120 [ 1418.682389][ T31] ? __pfx__printk+0x10/0x10 [ 1418.682421][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1418.682444][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1418.682477][ T31] watchdog+0xfee/0x1030 [ 1418.682518][ T31] ? watchdog+0x1de/0x1030 [ 1418.682547][ T31] kthread+0x70e/0x8a0 [ 1418.682582][ T31] ? __pfx_watchdog+0x10/0x10 [ 1418.682601][ T31] ? __pfx_kthread+0x10/0x10 [ 1418.682634][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1418.682665][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1418.682697][ T31] ? __pfx_kthread+0x10/0x10 [ 1418.682729][ T31] ret_from_fork+0x3fc/0x770 [ 1418.682754][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1418.682784][ T31] ? __switch_to_asm+0x39/0x70 [ 1418.682811][ T31] ? __switch_to_asm+0x33/0x70 [ 1418.682839][ T31] ? __pfx_kthread+0x10/0x10 [ 1418.682870][ T31] ret_from_fork_asm+0x1a/0x30 [ 1418.682914][ T31] [ 1418.682923][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1418.855870][ C1] NMI backtrace for cpu 1 [ 1418.855889][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1418.855911][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1418.855924][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1418.855964][ C1] Code: d3 de 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 ed 18 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1418.855981][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c2 [ 1418.855999][ C1] RAX: cb23c92465371800 RBX: ffffffff81976a48 RCX: cb23c92465371800 [ 1418.856014][ C1] RDX: 0000000000000001 RSI: ffffffff8d998d6f RDI: ffffffff8be29d80 [ 1418.856028][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732f5b R09: 1ffff110170e65eb [ 1418.856042][ C1] R10: dffffc0000000000 R11: ffffed10170e65ec R12: ffffffff8fa1f5f0 [ 1418.856056][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff11003a5db40 [ 1418.856069][ C1] FS: 0000000000000000(0000) GS:ffff888125d1b000(0000) knlGS:0000000000000000 [ 1418.856083][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1418.856096][ C1] CR2: 0000000057bd599c CR3: 00000000747ae000 CR4: 00000000003526f0 [ 1418.856112][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000004520 [ 1418.856123][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1418.856135][ C1] Call Trace: [ 1418.856144][ C1] [ 1418.856151][ C1] default_idle+0x13/0x20 [ 1418.856172][ C1] default_idle_call+0x74/0xb0 [ 1418.856193][ C1] do_idle+0x1e8/0x510 [ 1418.856219][ C1] ? __pfx_do_idle+0x10/0x10 [ 1418.856251][ C1] cpu_startup_entry+0x44/0x60 [ 1418.856273][ C1] start_secondary+0x101/0x110 [ 1418.856291][ C1] common_startup_64+0x13e/0x147 [ 1418.856326][ C1] [ 1418.857625][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1419.042553][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) [ 1419.054464][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1419.064535][ T31] Call Trace: [ 1419.067835][ T31] [ 1419.070785][ T31] dump_stack_lvl+0x99/0x250 [ 1419.075406][ T31] ? __asan_memcpy+0x40/0x70 [ 1419.080030][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1419.085247][ T31] ? __pfx__printk+0x10/0x10 [ 1419.089875][ T31] panic+0x2db/0x790 [ 1419.093796][ T31] ? __pfx_panic+0x10/0x10 [ 1419.098234][ T31] ? watchdog+0x101c/0x1030 [ 1419.102755][ T31] watchdog+0x102d/0x1030 [ 1419.107109][ T31] ? watchdog+0x1de/0x1030 [ 1419.111565][ T31] kthread+0x70e/0x8a0 [ 1419.115683][ T31] ? __pfx_watchdog+0x10/0x10 [ 1419.120391][ T31] ? __pfx_kthread+0x10/0x10 [ 1419.125027][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1419.130263][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1419.135496][ T31] ? __pfx_kthread+0x10/0x10 [ 1419.140119][ T31] ret_from_fork+0x3fc/0x770 [ 1419.144735][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1419.149868][ T31] ? __switch_to_asm+0x39/0x70 [ 1419.154658][ T31] ? __switch_to_asm+0x33/0x70 [ 1419.159461][ T31] ? __pfx_kthread+0x10/0x10 [ 1419.164098][ T31] ret_from_fork_asm+0x1a/0x30 [ 1419.168914][ T31] [ 1419.172240][ T31] Kernel Offset: disabled [ 1419.176580][ T31] Rebooting in 86400 seconds..