last executing test programs: 14m41.682487948s ago: executing program 4 (id=1617): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x12, 0x0, 0x0) close(0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_GETCRTC(0xffffffffffffffff, 0xc06864a1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) listen(0xffffffffffffffff, 0x7fff) connect$phonet_pipe(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)) syz_io_uring_setup(0x2c1, &(0x7f0000000240)={0x0, 0x4331, 0x1, 0x0, 0x113}, 0x0, &(0x7f0000000200)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, r4, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r5, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002", 0x8a) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2, 0x13, 0x0, 0x0, 0x2}, 0x10}}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000611224000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) 14m40.668491819s ago: executing program 4 (id=1618): r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = socket(0x1e, 0x1, 0x0) sendto$rxrpc(r3, &(0x7f0000000000), 0x0, 0xc0, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e21, @multicast1}}, 0x24) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, 0x0, 0x0, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) io_setup(0x6, 0x0) sendmsg$rds(r1, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0) r6 = fsopen(&(0x7f0000000000)='rpc_pipefs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) close(r6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x39}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) ioprio_set$uid(0x3, 0x0, 0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) write$binfmt_elf64(r7, 0x0, 0x100000530) sendmsg$rds(r1, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24008880}, 0x40) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000001000500050007000000000008000900000000001400200000000000000000000000e1ffe000000108000a0000000000060002000100000014001f"], 0x5c}, 0x1, 0x6c}, 0x0) 14m39.333601439s ago: executing program 4 (id=1622): socket$inet(0x2b, 0x801, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) unshare(0x20000400) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000180)}) process_mrelease(0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00000001c0)={0xa, 0x4e20, 0x6, @loopback, 0xd8}, 0x1c) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000180)=0x80000039f8, 0x4) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYBLOB]) read$FUSE(r4, &(0x7f0000000200)={0x2020}, 0x2020) open(&(0x7f0000002300)='./file0\x00', 0x282580, 0x300) write$FUSE_INIT(r4, &(0x7f0000002280)={0x50, 0xfffffffffffffffe, 0x0, {0x7, 0x9, 0xfffffcf3, 0x4093300c, 0x9, 0x2, 0x9, 0x0, 0x0, 0x0, 0x10, 0x1}}, 0x50) read$FUSE(r4, &(0x7f0000004580)={0x2020}, 0x2020) write$FUSE_NOTIFY_STORE(r4, &(0x7f0000000040)={0x2e, 0x4, 0x0, {0x1, 0xefff, 0x6, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x2e) write$FUSE_INTERRUPT(r4, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) sendto$inet6(r2, &(0x7f0000000000)="8d", 0x1, 0x0, 0x0, 0x0) 14m36.687630527s ago: executing program 4 (id=1626): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1d, 0xd, &(0x7f0000000180)=ANY=[@ANYRES64, @ANYRES32, @ANYRES8, @ANYRESHEX, @ANYRESOCT=r0, @ANYRESOCT=r1], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_open_pts(r3, 0x980) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) 14m34.294795917s ago: executing program 4 (id=1629): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x1) ioctl$TCSETS(r1, 0x8925, &(0x7f00000000c0)={0xfffffdfd, 0x0, 0x0, 0x7ff, 0x0, "5dee000000594000"}) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0) syz_usb_connect(0x4, 0x24, &(0x7f0000000000)=ANY=[], 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000500)='fd/3\x00') r5 = io_uring_setup(0x6d32, &(0x7f0000000000)={0x0, 0x0, 0x2}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r5, 0x13, &(0x7f0000000080)=[0xb85b, 0xf817], 0x2) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r4, 0x541b, 0x0) r6 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f0000000040)=0x10) close(r6) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r7 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x1f, 0x0, 0x0) 14m31.02662459s ago: executing program 4 (id=1636): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000700)={0x84, &(0x7f00000000c0)=ANY=[@ANYBLOB="2011040600"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14m15.232895462s ago: executing program 32 (id=1636): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000780)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000140)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000700)={0x84, &(0x7f00000000c0)=ANY=[@ANYBLOB="2011040600"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 8m14.638083617s ago: executing program 1 (id=2544): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xb, 0xe, &(0x7f00000013c0)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) openat$kvm(0x0, &(0x7f0000000040), 0x8001, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='task\x00') lseek(r0, 0x401, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r2], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7fffffff]}) syz_open_procfs(0x0, &(0x7f0000000140)='smaps_rollup\x00') madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) timer_create(0x2, &(0x7f000049efa0)={0x0, 0x0, 0x1, @thr={&(0x7f0000000300)="3bbd57a260780e8310f7749f4c6971f78cc14d945608a673f6c1a47820e2835e940d71b751969d00a8d3", &(0x7f0000000480)="47bab05f8e67e0dddefbf7a9cc345ebbe1b356df9b56b1f1ee1582e60d564f6f"}}, &(0x7f0000044000)) timer_settime(0x0, 0x1, &(0x7f0000000340)={{}, {0x0, 0x9}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000b5b30a40450c8f6055b5010203010902120001000000000904"], 0x0) write$binfmt_aout(r0, &(0x7f0000000700)=ANY=[@ANYBLOB="cc0002cf0b0100001a030000040000004d000000000000000000000000000000012a18d010b3ba9d19a339f6ad20e47a6a65f5220000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d027232d37141b1c216430cc445c0406b3876b8d26fa01b2b0ea9f6c1168de04ef788aa4bec2ec5545964a41acbc44fee74f2e3ea3f63ec0e65eb6663a917145272051563616d2520190b7fabf2e1c183a48"], 0x234) syz_usb_control_io$printer(r3, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000240)=ANY=[@ANYBLOB="00000003000010"], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) socket$nl_route(0x10, 0x3, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000ec0)=@raw={'raw\x00', 0x8, 0x3, 0x490, 0x0, 0xa, 0x148, 0x0, 0x60, 0x3d8, 0x2a8, 0x2a8, 0x3d8, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0xffffffff, 'veth0_to_bridge\x00', 'rose0\x00'}, 0x0, 0x2f8, 0x364, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_to_team\x00', {0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x8601, 0x6, './file0\x00'}}]}, @unspec=@CT0={0x0, 'CT\x00', 0x0, {0x0, 0xd08b, 0x3, 0xfffffffb}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x94}, {0x24}}}}, 0x50c) 8m12.392049516s ago: executing program 1 (id=2556): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0}, 0x10) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) r3 = dup(r2) write$FUSE_BMAP(r3, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="38010000fe0000", @ANYRES64], 0x138) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000600)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) 8m12.164117225s ago: executing program 1 (id=2557): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000000c0)='\x00', &(0x7f0000000280)='\xfc,\xdc]+\\\x00', 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) write(r5, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000004000000000800040001000000", 0x24) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$tipc(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000e40)=[{0x0, 0x20}, {&(0x7f0000000dc0)="8ad4", 0x2}], 0x2, 0x0, 0x0, 0x24040804}, 0x8804) syz_emit_vhci(&(0x7f0000000f00)=ANY=[@ANYBLOB="040f0400010104"], 0x7) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r7 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r7, 0x1, 0x70bd26, 0x23c, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r8}]}, 0x1c}}, 0x0) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x2, &(0x7f00000005c0)=0x6, 0x4) recvfrom$inet_nvme(r5, &(0x7f0000000300)=""/172, 0xac, 0x40000100, &(0x7f0000000540)=@nfc_llcp={0x27, r8, 0x0, 0x1, 0xc8, 0x9, "26fe24a94a11159737da41130f8bca7bff989fbc273aa7ed33aa05a624fe53132149ec66f1db8eadc3352aa2dff3f335226f516ec141f7f8557db4effcdaa8", 0x1b}, 0x80) 8m8.968631813s ago: executing program 1 (id=2564): r0 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(0x0, r3) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010028bd7000fedbdf250200000008000100", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) 8m8.725099773s ago: executing program 1 (id=2568): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) chdir(&(0x7f00000003c0)='./bus\x00') setpgid(r0, 0x0) setpgid(0x0, r0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_TTL={0x5, 0x4, 0x8}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @remote}]}}}]}, 0x44}}, 0x4000000) 8m8.590816162s ago: executing program 1 (id=2570): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) bind$can_raw(r0, &(0x7f00000005c0), 0x10) read(r0, &(0x7f00000027c0)=""/4073, 0xfe9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendmsg$can_raw(r0, &(0x7f0000000240)={&(0x7f0000000780), 0x10, &(0x7f0000000200)={&(0x7f00000007c0)=@can={{0x2, 0x0, 0x1, 0x1}, 0x1, 0x2, 0x0, 0x0, "f97003b8750e5566"}, 0x10}}, 0x0) 7m53.491279583s ago: executing program 33 (id=2570): r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) bind$can_raw(r0, &(0x7f00000005c0), 0x10) read(r0, &(0x7f00000027c0)=""/4073, 0xfe9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) sendmsg$can_raw(r0, &(0x7f0000000240)={&(0x7f0000000780), 0x10, &(0x7f0000000200)={&(0x7f00000007c0)=@can={{0x2, 0x0, 0x1, 0x1}, 0x1, 0x2, 0x0, 0x0, "f97003b8750e5566"}, 0x10}}, 0x0) 16.915442707s ago: executing program 5 (id=3696): r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x410000, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEAUTHENTICATE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010027bd7000fedbdf252700000008000300", @ANYRESHEX, @ANYBLOB="c6b319abf7c08c970f2eed532458b3d3158c788b17ea2b5cdbe6609583ddaa8d2692dceed267099d0f2e0d605e35b28e75242758ebe31d2500f5a3056d8a7d44e92965499500"/82], 0x1c}, 0x1, 0x0, 0x0, 0x20004841}, 0x40080) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r0, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="fb28704ab9398624d945000800030058e79e99c05545b6326b28382a49eb0ed2b04b3b3b8eabca5963ac85f91347a0a2f46a93ac99d6744d4e5c2041be01072f674a25a525", @ANYRES32=r3, @ANYBLOB="0500ee00050800008a3441c7db0510a81900ef00040000000800ef00080000000500ee00300000000800ef0004db080000000800ef000500000005c7bd00090000000800ef00010000000e3b9a6c806db9220cb9ba1bcd96eb7ecfa186"], 0x64}, 0x1, 0x0, 0x0, 0x801}, 0x8805) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(0x0, 0x5, 0x72afde74acb1cd60) socket(0x23, 0x5, 0x1) prlimit64(0x0, 0xe, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x4) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$AUTOFS_IOC_FAIL(r4, 0x9361, 0x4) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) inotify_add_watch(0xffffffffffffffff, &(0x7f00000002c0)='./file0\x00', 0x500082c) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup\x00', 0x0, 0x0) getdents64(r6, &(0x7f0000001f00)=""/4093, 0xffd) 10.448098422s ago: executing program 2 (id=3718): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000c00)={{{@in6=@mcast1, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x67}, {0x0, 0x4, 0x40000000007, 0x20000a0de, 0x40000000000004, 0x2, 0x200000007, 0x3}, {0x40000000000005, 0xffffffffffffffff, 0x0, 0x6}, 0x4, 0x0, 0x1}, {{@in=@loopback, 0x0, 0x6c}, 0x2, @in6=@local, 0x3502, 0x3, 0x8, 0x0, 0x9075, 0x0, 0x4}}, 0xe8) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x4}}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r3, 0x4) r4 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read$char_usb(r4, 0x0, 0x0) 10.422266086s ago: executing program 5 (id=3719): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='ext4_lazy_itable_init\x00', r0}, 0x18) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={r2, r1, 0x0, 0x81, &(0x7f00000002c0)='\x00\xed\xe4\xf0O\xee|\xcaJ?\f\xb0\x1e{r\xcb\xc8\x83\xbf\x02c\xb1\x1f\xf0c^0x0}, 0x2053) ioctl$SG_BLKTRACESETUP(r6, 0xc0481273, &(0x7f00000000c0)={'\x00', 0xfff9, 0x6, 0x2, 0x5, 0x6, r10}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000080)={0x5c, 0x0, &(0x7f0000000d40)=[@enter_looper, @enter_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}, @acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0}) 8.260425006s ago: executing program 0 (id=3723): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f00"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000340)=ANY=[], 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x54}}, 0x0) 8.248345001s ago: executing program 5 (id=3724): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb0180000000000000000020350c0000000c000000080000000b000000000000060400000000300000cf00"], 0x0, 0x2c, 0x0, 0x6, 0x2, 0x0, @void, @value}, 0x28) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1f}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0x27, 0xc0, 0xde, 0x20, 0x86a, 0x3, 0xf03f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x2, 0x2, 0x2, 0xf3, 0xbf, 0xf5, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r2, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000380)={0x0, 0x3, 0x14, @string={0x14, 0x3, "6d0a412b2cde821824674afe5f8c7e017e90"}}}, 0x0) r3 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x14) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r4, 0x100000000000f7) syz_io_uring_setup(0x3d, &(0x7f0000000180)={0x0, 0x0, 0x10100}, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/disk', 0x129a82, 0x0) sendfile(r5, r5, 0x0, 0x8) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x800000, 0x8000000000000001, 0x0, 0xc3ad, 0x0, 0x3}, 0x0, 0x0) keyctl$revoke(0x3, r3) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(0xffffffffffffffff, 0x40045402, &(0x7f0000000780)=0x1) 7.914309147s ago: executing program 2 (id=3725): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000340)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000006900000000000001000000940000000fad413e850000000700000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) pipe(0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) r4 = add_key$keyring(&(0x7f0000000300), &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f0000000380)='asymmetric\x00', &(0x7f00000002c0)=@keyring={'key_or_keyring:', r3}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000340)=@keyring={'key_or_keyring:', r4}) 7.913596745s ago: executing program 6 (id=3726): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000040)='contention_end\x00', r0}, 0x18) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r1, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r2, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r2, 0x0, &(0x7f0000ff6000/0xa000)=nil, 0xa000}) ioctl$VIDIOC_TRY_ENCODER_CMD(0xffffffffffffffff, 0xc028564e, &(0x7f0000000200)={0x3, 0x1, [0x10, 0x5, 0x2, 0xffffffff, 0x100, 0x8, 0x7]}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r2}) 7.6841136s ago: executing program 6 (id=3727): syz_usb_connect(0x2, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth1_to_bridge\x00'}) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$kcm(0x10, 0x2, 0x0) symlink(0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) fsopen(&(0x7f0000000000)='autofs\x00', 0x1) r2 = fsopen(&(0x7f0000000040)='fuse\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000240)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9fuI?\x18\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\xc9\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k\xdb\xd5\x05\xda\x15,r\x1f!K\x91\x1f+\xbb\xa8\xd0\xcaY+\x91\xa2$W5e\x98\r\x155\x13g\x9c\x18\x8e\x1a\xd4\xc9\x7f\xc7gg\xb4=\f\xe1r[\xef9\xbc\x0e\x89\xb9\xd0\xb3*\x14\xd6\xde\xd0\xa6\x8d\xc8\xaf\xceD\xa2u\x16\xfe\xee\x03\xab,\xd2\xeb\x9e}\xa7\x16\xf2\xe5\xb8X\x88\xd1\xc0\xe0\x12y\x13\x1d\x9c\xf6\xf2&Pq\x16\xc8\xa3\'\xee#t\x9a\xa8\x1a1\xdf\xb3\xee\x05Q\xde\n\x1b\xc9\xcd\xe0\x8av$\xfa.\xd4\xdb\xeb\xe2\xc4\xf3\xda\xa6*\xd3>\x1cH1h\x88\x1e\xa7\xd5\x04\xff\xa9_vv', 0x0) sendto$inet6(r1, &(0x7f0000000080)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c200a0000000d0085a168d0bf46d32345653600648d0a00120002000a0006005ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) mremap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f00007fe000/0x800000)=nil) 6.61142957s ago: executing program 3 (id=3729): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r0, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6}, 0x20) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x2) 6.463670857s ago: executing program 3 (id=3730): sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x31, &(0x7f0000000040)=0x7, 0x4) bind$inet6(r4, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r4, &(0x7f0000000600)=[{{&(0x7f0000000140)=@nfc_llcp, 0x0, &(0x7f0000000780)=[{&(0x7f00000001c0)=""/199}, {&(0x7f0000000340)=""/161}, {&(0x7f0000000400)=""/94}, {&(0x7f0000000480)=""/160}, {&(0x7f0000000640)=""/155}, {&(0x7f0000000700)=""/80}], 0x0, &(0x7f0000000580)=""/80, 0x11}}], 0x4000000000002ff, 0x2, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 5.821573262s ago: executing program 6 (id=3731): syz_init_net_socket$bt_l2cap(0xffffffffffffffff, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0xfffffe28, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a0001e7a2d7587f0000000080"], 0x24}}, 0x8d0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) shutdown(r4, 0x2) getuid() r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r6, &(0x7f0000006200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000380)={0x50, 0x0, r7, {0x7, 0x28, 0x0, 0x40488060, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x24522716a989086f, 0xfffffffc}}, 0x50) syz_fuse_handle_req(r6, 0x0, 0x0, 0x0) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r8}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 4.620411523s ago: executing program 2 (id=3732): syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x402) r0 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000000)={r0, 0x2, 0xfffffffffffff02e, 0x3ff}) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='xfs\x00', 0x8000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)=ANY=[@ANYBLOB="a0000000", @ANYRES16=r2, @ANYBLOB="010000000000000000903b00000008000300", @ANYRES32=r3, @ANYBLOB="8300330080800000ffffffffffff0802110000005050505050500000c800820000000000000000000000000000060202020202020100040600001000002006020600052501cf07134cf06ff7dbf99db8a8a89d556e9c3f3a890edb67f85e26d6f224a5cd6466893b9b2a01"], 0xa0}}, 0x20000000) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000240)='wlan0\x00', &(0x7f0000000300)='wlan0\x00', 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) 4.619894708s ago: executing program 3 (id=3733): r0 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r0, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0xf0}, 0xff}, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002, 0xfffffffd}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback, 0xffffffff}, 0x1c) sendto$inet6(r2, &(0x7f0000000080)='D', 0x1, 0x4014, 0x0, 0x0) shutdown(r2, 0x1) splice(r2, 0x0, r1, 0x0, 0x400000107ffff000, 0x0) 4.079620698s ago: executing program 0 (id=3734): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, 0x0) bind$pptp(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) (fail_nth: 3) 3.941708091s ago: executing program 5 (id=3735): r0 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000100b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) timer_create(0x2, 0x0, &(0x7f0000000540)=0x0) clock_gettime(0x0, &(0x7f0000000580)={0x0, 0x0}) timer_settime(r2, 0x0, &(0x7f00000005c0)={{r3, r4+60000000}, {0x77359400}}, &(0x7f0000000640)) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r5, &(0x7f0000000180)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x4, @private0, 0x3}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x4e23, 0x6a144b89, @private2, 0x5}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000080)="1e", 0x1}], 0x1}}], 0x2, 0x931766f6319eed40) shutdown(r5, 0x1) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0x7d, &(0x7f00000001c0)={0xb, 0x1c, 0x5, 0x8, 0x6, 0x8, 0xff, 0x6, 0x9, 0x5, 0x38, 0x5, 0xff, 0x6}, 0xe) r6 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000040)={@multicast2, @multicast1, 0x0}, &(0x7f00000000c0)=0xc) r8 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x20000, 0xad, 0x2}, 0x18) openat(r8, &(0x7f0000000500)='./file0\x00', 0x2000, 0x2) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000100)={@private0, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x8, 0xa, 0x1, 0x300, 0x5, 0x180000, r7}) r9 = socket$netlink(0x10, 0x3, 0xa) r10 = dup(r9) r11 = open(&(0x7f0000000040)='./file0\x00', 0x1850c2, 0x14c) socket$nl_generic(0x10, 0x3, 0x10) ftruncate(r11, 0x200004) sendfile(r10, r11, 0x0, 0x80001d00c0d1) r12 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_opts(r12, 0x29, 0x37, &(0x7f0000000680)=""/2, &(0x7f00000006c0)=0x2) timer_create(0x0, &(0x7f0000000300)={0x0, 0x5, 0x1, @thr={&(0x7f0000001280)="e6236d35950cdb0f8393a1dae0ea11fe62718aa61582270fae117d537002e3471b03697f1e6433d5a63081162dd838b5bceffb1132e413c5861e48080596206539816e3c36c8c2993a5ca1dc16cfe6d0c66772ce61e15f9351dbf8d573e345edc75d57d90f558cfab2605c4694783e7f38ff61e97c40ee4fd59ec9487b6f0e0a91c9f41171bff8887ff8a0632a3ecf292a2571d63545186cffa7ebb9ffe78b765e78d301a7ff8bcd527ee95282aaadf40533711ac7e86ef719defb19305798e6e4d05063d2d8e6407d2917c63e4d5e146a8c6100279219fef9adda007fd01569f222511dbc37077ce65c5717e4161848293081011bf5b816d5a226b5af1b8547bbe20a3bccdf5d03c7fba3d21eee93898b94cc058059814deaedde29470af1b3cdb7f64f393aca68887635c1e4c22c9925aaccb9848ebb8c1bd53118ab7b3234575f78ed386e1c369f13403a9e04fd29aa319c2b679804386c91db33aa7b41544ed8c39a6f938ae0f6ee70c47aeebd892b32d7328ed63d7bf0c4770d5918e5b6cb55430d01e843720fe57981f352b46e14d5ae03806611953c22e326362850c2d1c724794a5101fca7462aaf1683613778279e1b4492cbeb0f8cbbfb6ff8bef19166f7ce21ad4a625a31e69fd80f8983768c2e47ff29c3501817b48b28121b0e272f3280751eaabba8fcd65ee4a038f6b68f3d2a604cd557650f5a28c01f46012a46385f68d1a9f829fb3f10a64d510fecbe0458d6dcee61888b9e803fb9581607361a4c413edac00bbe04d52fd14f9825d2cba0eda0cea23863d597cadacbff58726b7b73c78cba3c9c285568a517a40d517f6abf21cc52af22435a154d2be34c1766313742a888cb0e6cbb1ebb7aa3c5d97fd81c96a238f17342e0c75d36d98d95b2f596c1abe3ab71dba4e591cea2a6c76675f115adc99057ee7e1814b8edef8311e4cc42004cf1ddfefaf51df816294395855aa9e553d79f1c9d925c712995d001ad70d18c7e4b6cd24f73ad77f7f1f250740f10fc1f01237a620fe6191b4c6a9e9f07f7b14248b87bdfcaf83b4533980568c68d8baa6393b6d5456f16966e8a91e42aeb1a27d64e61dcd36e144c349b60ff47d7c8c3d625146f673f3336df3c22d730bc1d6c8a9f51dcce9ecec3a3693741de5b3cd46ee6bf83a5453a41ba77f087d8f51cb5ff8f7abaaee323f430d97387712cdd615c6351d770edecd386178c4b4a1d24944e52f46249a9d7b678181ce68ab9909276aa37b3c60f6e475bbb29b813e7ff2baf273526a3f4f65b83594f3784524ec7b9dd89871f18c526011eb59ee30e4b4ddcd1918c83153d621f8bae787dd17b6dddcd11a876367147efecde0418e58adc414864968c50e69d5c6c029083ae4c7c42c3792b685864424c3400525c52820b057aa56db4c3552ef0fa6d1e06188cee652bdfb2071aba0c0c571150b9c88a33f08d43cd59a6a78fbe0ca6d676f5d62ab4914ad1d5915fa6b22c6a82ac923a22f5bcc4ed7ff1c2a9c20e832100f30c35843f2b7aefeaacf5f2d5eaac608917e4d04444a323dd3bf1d0f8a150d4ad4c81c459b83bdaf4e44e3b6939dc581b24075d9c73f824c2fdd8918b6f6328397fad1fecd3341ba2c0dfed92655e24647a9b517a7f678515a8941a265c1759e28a388f84be00016ef44ecdefd5c3fe110d8a63e232f22c37bcd378808974c0b061fa6f1f2ba7d9aef9897a85bce6bb2559467b49882f64f0da36206fc5fa9bbb1d7b5084292bf3c22973320e6299512f92f8ee1d675fbd36fb0a0ab2a9f2670a1b1362f3f9bd826db144b102df396106647ecb6326d4cf0031e350a2dd6cfa9f1b61d30c2bd529cacf3c5fbfba17a70373229687e1be7f4c88509903a07a92a9b23b466f1ed3d4990d0f1360ae8a18b23655ee001ef5722a2fe08df83db03aec347a78871a89133a74aa7b61dccb3cefd422d026368ba9ee4019ea9c6880b320dffa2c710bdb3858f8dd14b362a01f45a50a4d71c9a2d2e965634824d443ba6138e88110fe25acbf57630b0aae340c759789c70a3f6de425632428407646efdc736aeeb5b9a3e0180a42ea04ccd492e544af4d64827550b16571a2966c47a04bb8cff1b2fd4f3fd23736f24927d9e29ae7cca386aacc20ea1dadcd8245e6eca0f64bd578a48777835cfc29bf518d00b357f7e4f4807cd3bfcfd0cf607a5c0adc73424bdc0c9c0b404720d02ea7f651847b5daa37a3b72610672ba961503dc5f380b5e510b24a16e38fd4849955fccc15b5b8b5ecddd39729c7fe09817fb4a3a5a09b81cdb226102d373c389e48f779c41f2508bb54732fbbc933b6223753c1121989b31bf80b1d0995f345541f1513ed43d4b7f15e8bccfb01bbeb98d462932c7a2a4978ebb88c7fde573832d135cdd145092dc6b42103e8b1275bad5a82e158f75ce380461962c8739f8d611dce6213e3d00661adde65ddf19bcd5a68f40d1192639c21989d171090520307f591ac1ae7094a701a8265e767525c4e6081bb6cd276506286ac3b1438eb9ca24543f8f92b592d086ad1bf3356d57db334113d61aec717109b592bcc494a558c4636826423ee8bd40c708ce6776790952942b16e00cbe1d363967a4f839a3a0bfba16c57ec6ed34d6f708111ee99872d8bbc06e82917abaea95f41486d7900e9bbe0bb07236cfea7a28126421187df160b43969426f23233917e3efff829f37139df563435af1095d97758a6592ef7e5ceb2bec5288a43d6c53224da0a151c9923ed15ca82692a686e5ee3bc5f6c5076e30b21024cbd90474fc85c77922d8938789672b67ac8831a0bf007a3e15d3bf6e2d0ef410e0f42123ce5365ebb064f2ffa883ab31cdfd566c46b877c73d876d74baff2e502691a4896c742bc4b725c0b826cf753f69a8090cf6ad19e39612c13e9341f6b64190ee7ab4ae9c97540d94987c6f68111fb2b9985eb0b903debe0c2d3e6813a3314a188234b43c41c69b1b76e0bdd983ba3518ca0838197fd511c7ff2e74263a3c2e678d5e7f3de0e1859d9bb8c6f5ee00d0c2c2b7c1f10183dd97a45c6bc2e496e490b44adc26d63e1b6860c5cc712f2d029d5ebb78ea62ba18b43aefed3d6ea1bbfc3dff05ae87adec84ce29bc7737ede7621aa5c5cecd814979b4ec692b5650436dd8e7f8b1bf9980b996e5cd040275479e5bb7f8326aa484fc18b3aa98b3f2ee37b2528f99d9626b25a0cf5be3215c500a19e09e03819a69e24928db4b5de6558c01e50ea66d4ac0b470c198138ee2f2fce6a99aff3e3a71fb78e63c5eeb0da1bc6a93133453dc7c349e14c47023c6b7bbcc61128db65439a423e95d889e5ad1dc4379cfc9be241f3d654800169447d85bc0b8833aa1679b712382a78af0e8c05d838dc98ba839af462c2eae16ebcd1ca5049941a49b38ccb8debf8ee1d25f71ea8855649685b6ec920b1c72ae01dd542557bd19339d5f377dfc8bdcbc8ded3a48d6c6507124165ac86e51b56bf45be682f3361024982020c5409e883f08b2a8c2081eba4c966d8fd527c09ceb52264acd95fb4c19ca2d8ae16dc04f1f63359870a64fa7f7b4f9dba88a0e26edf3b4fc4bdf27ece53cb8e0b810ccbbbe7bd599cc5d4c2e3eb4d3540c211a758371e08cdc71f020d4ad22422ee532d1bcdf67f777e97c61041206ddf984e001940b733f426b7b1d414a379bea519d18d56127e7db7a2fc6fe3e1b47295ca7848f568ba13e130bf19707359183e85466503d25ec61b834d457f1d73843a7f2f7d6f4a8f1cd4430a7ad21bafadde96e2564587cbb8769b335d908a8dd65354e27aff195191a39490e686543b319d0733025df4bf5e66a0bf95b0a287abe5eba656066b2f604511edfd04635ee49f6d277ef9812b373d16273f1061dbdcc7e1794663fe9856b89da0fcbd0640534318393818236b6ff0862122257d585fba73a417e3c75d2e73c2f2a0aa1cdae0688773b959fafb13a4ad4d66493294dbee1cd43e39c5337a462230afbbffe5d18e88a35dbd3b55e65c46aa1d06e3debd904b236e42216f6532fe1becbb8a702e6bd2f78b596e9baf1a4fb04e6b3a55d3ca9bd804a31c131f1bc1833589897fd804237f2e265ac17b32321b25ed1c7fa12557077f5433022d30b4334028263c2a129d451e2e496556c505764fb899def88f2adee593b002877e87c30ec2d325cf14e82d6b5fad3715c940902cc9c74712851d099c46db797c69efd469ac295a99e3106356649271089821aaa7809e58c0a78a4f953bca4b7c80d13171f29d2d68c7bfcf976c5b1d40db0ee608572cd060040b421956ee66c0ebc11a5af718f43828783f6cf5b76bea9bd8c905e210c960c684dd33fe18632a4705af96e84c3ee9e4d6a0c5ca635254fb32c7f91593fd374d9757597f22e72e45110847c0df92f49a953c19a19ca97ac92c7d963c5944f8cf4e41d7c7a93258a2981e041af946d7e09556bfc1fcb8d8f3dea56e83beca41eaac7bb64c2f28889a343f65f8123f6ef45373d475d3aa81c4f7c574619606d57813b785d6623d8c0d76d98af33157841260b734f7112eba297bf7a6ef7746ba998d3022d41ac01946885a01a022e08697cc820c6fa4a19500b63453871fae9419138ed3a0f4ae454ba29c7cc32f4c36578ae0941d0683c117b42fc2fb7f7380bda93aceb1bdedc0d46cf56d5d935d6e68370da00d164ccd61ab57cbfd7ec3da23cece45d82517b0fb88d5ce6940f468ceed03d6b42a4fa0416e44c0f8c42806ca5d1d04c463b90af19b2f840056e7404f86d06f7deb92d7b566332dc5193e4c683ead20e0fecb1c3cbccd28b3163aad7f43079bd1c2bcd705effe6836aed434f3b4d48f85f577fffa248e606e689058ca8d0a38f1a11585cf45524649d6d0d0b918c2b5f5e539dd7fdfe381fed1c571a8709f10f3711157dbbec444c54905221fea645b500a31497badb080306f504bdd19bb577d9596f34b61ae481e1fc306de9f4bd64071d2d24a33f75d79c349c0325e32bc1c064b734bc1f25416a127db61356f7444208e0149dbc3f295214f8768ea14997be8d3b6016499bf35a4a5e28b71d3537c8792b5bc361403f45718a7eb862433d8492db0d2a62f566dc1019cf21d833ea100a6d07272df365d252defc699f58a60e1a39519d7a486b0d1b6eb4b92a0265de3ac7e99d0c12b45b95166c4a7aba2d74ce966f406c1b0387d7700315d7606b334ed03dcb586e7b47497b80b937a9ff3d8497231c21da4f46b9fddf022e78a5bd9d05b96d88c1225dbcb6a66f63163519f5f020afd7620da43ca94c0e94766b926cab3f0fac2df3e0c20e6b776aa265709e32528201b343ffab13af759cf0887a51e30288bc7a65a5d8db8595173c1aaebf296c90fa759f38099c2d4eae3091e5a9259ea254ce6866e263a3c196a668673dab87d4182b269dcdce815990de8b43c01193f5c6639e1152b3daf0e7e43f81d1c926cf0899b23a2ec32bb7959c427868e78526e22f285b9f85926d3b2a04524c2be84a234dbb6d0a5ea980067a6474da277020f44011a0e3f1f225832ae3caab00d29f19bbeaa0994743493ec83c7eefde5eecad52af12de545ee35332a3002d52e7120757eacdd7a", &(0x7f0000000280)="a174bb71b7bd56652ec1b222ba27ba02d1f18a7e4a2f4d7aeda48458a51c09dcfbe5bfb4ca"}}, &(0x7f0000000400)=0x0) timer_settime(r13, 0x0, &(0x7f0000000600)={{0x77359400}}, &(0x7f00000002c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001240)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r1}, 0x4b) r14 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r14}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0xffffffffffffffff, 0x1, &(0x7f0000000080)=0x7) getpid() 3.920784047s ago: executing program 6 (id=3736): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$UHID_CREATE2(r1, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x9) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000c00)={{{@in6=@mcast1, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x67}, {0x0, 0x4, 0x40000000007, 0x20000a0de, 0x40000000000004, 0x2, 0x200000007, 0x3}, {0x40000000000005, 0xffffffffffffffff, 0x0, 0x6}, 0x4, 0x0, 0x1}, {{@in=@loopback, 0x0, 0x6c}, 0x2, @in6=@local, 0x3502, 0x3, 0x8, 0x0, 0x9075, 0x0, 0x4}}, 0xe8) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x4}}}, 0x1c) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r3, 0x4) r4 = syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read$char_usb(r4, 0x0, 0x0) 3.8436116s ago: executing program 3 (id=3737): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, &(0x7f0000000000)=0x9, 0x8, 0x0) get_mempolicy(0x0, 0x0, 0xfffffffffffffffd, &(0x7f0000365000/0x3000)=nil, 0x3) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x19, 0x18, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, @void, @value}, 0x94) r4 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r5 = syz_io_uring_setup(0x4a9, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0xfffffffc}, &(0x7f0000000000), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_NAPI(r5, 0x1b, &(0x7f0000000100)={0x0, 0x4}, 0x1) 3.101807611s ago: executing program 0 (id=3738): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000040)='contention_end\x00', r0}, 0x18) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r1, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r2, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000140)={0x28, 0x6, r2, 0x0, &(0x7f0000ff6000/0xa000)=nil, 0xa000}) ioctl$VIDIOC_TRY_ENCODER_CMD(0xffffffffffffffff, 0xc028564e, &(0x7f0000000200)={0x3, 0x1, [0x10, 0x5, 0x2, 0xffffffff, 0x100, 0x8, 0x7]}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r2}) 2.77640639s ago: executing program 0 (id=3739): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) syz_emit_ethernet(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = epoll_create(0x49) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYRES64=r2, @ANYRES32=0x0, @ANYBLOB="00000100000000002c0012800b00010067726574617000001c00028006000e000200000006000f000700000008000700ac14142808000a00", @ANYRES32=r6, @ANYBLOB="65bc8e72737af987bdf369408bf59828cbdafee26f0fc18050dcdee25f94f84912833750bef642a94463ad1f61bfa4f7807cd1b884aeff5ca0eb7a04d0ce44f3703cfa6c87433623ed9094"], 0x54}, 0x1, 0x0, 0x0, 0x40}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB="580000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="46060900000000002800128009000100766c616e00000000180002800c0002001f0000001f000000060001000100000008000500", @ANYRES16=r3, @ANYBLOB="bd4eebd5928e03455b08800a00", @ANYRES32=r9, @ANYRES32=r7], 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r10, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r11, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r12, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r13 = socket$inet6(0xa, 0x1, 0x2000) connect$inet6(r13, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x7}, 0x1c) socket$nl_xfrm(0x10, 0x3, 0x6) sendmmsg$inet6(r13, &(0x7f0000003cc0), 0x0, 0x4001c00) 2.671771961s ago: executing program 3 (id=3740): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f00000000c0)='\x00', &(0x7f0000000280)='\xfc,\xdc]+\\\x00', 0x0) sendmmsg$unix(r4, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) write(r6, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000004000000000800040001000000", 0x24) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$tipc(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000e40)=[{0x0, 0x20}, {&(0x7f0000000dc0)="8ad4", 0x2}], 0x2, 0x0, 0x0, 0x24040804}, 0x8804) syz_emit_vhci(&(0x7f0000000f00)=ANY=[@ANYBLOB="040f0400010104"], 0x7) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r8 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x1c, r8, 0x1, 0x70bd26, 0x23c, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r9}]}, 0x1c}}, 0x0) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x2, &(0x7f00000005c0)=0x6, 0x4) recvfrom$inet_nvme(r6, &(0x7f0000000300)=""/172, 0xac, 0x40000100, &(0x7f0000000540)=@nfc_llcp={0x27, r9, 0x0, 0x1, 0xc8, 0x9, "26fe24a94a11159737da41130f8bca7bff989fbc273aa7ed33aa05a624fe53132149ec66f1db8eadc3352aa2dff3f335226f516ec141f7f8557db4effcdaa8", 0x1b}, 0x80) 2.670313085s ago: executing program 5 (id=3741): syz_init_net_socket$bt_l2cap(0xffffffffffffffff, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0xfffffe28, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a0001e7a2d7587f0000000080"], 0x24}}, 0x8d0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}]}, &(0x7f00000002c0)=0x10) shutdown(r4, 0x2) getuid() r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) read$FUSE(r6, &(0x7f0000006200)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000380)={0x50, 0x0, r7, {0x7, 0x28, 0x0, 0x40488060, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x24522716a989086f, 0xfffffffc}}, 0x50) syz_fuse_handle_req(r6, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 2.359613876s ago: executing program 2 (id=3742): gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @thr={&(0x7f00000000c0), &(0x7f0000000400)="162fae189be4088ff0eaef40630ab9223851fe48c60280b2fa1645c0650b74d8e8753b854f5d6d538e689b16e3fb883715f819e407d252d3305b1878cead46fcbfe3b27940ec39d7af80112f13deb47327eff326539b753630ee2b3d51af62d1fe87b7"}}, &(0x7f0000bbdffc)=0x0) socket$rxrpc(0x21, 0x2, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x10, 0x3, 0x0) write(r4, 0x0, 0x0) timer_settime(r0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f00000003c0), 0x101a02, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f0000000080)=r7, 0x4) sendmsg$NFT_BATCH(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0904000000000000000002000000400004803c0001800e000100696d6d656469617465000000280002801c0002801800028008000180fffffffd0900020073797a320000000008000140000000000900010073797a30000000000900020073797a320000000014000000180a020800000000000000000200000014"], 0xa8}}, 0x0) 1.641413723s ago: executing program 0 (id=3743): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 1.29733957s ago: executing program 5 (id=3744): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f00"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000340)=ANY=[], 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x54}}, 0x0) 402.651617ms ago: executing program 0 (id=3745): syz_usb_connect(0x6, 0x24, &(0x7f0000000780)={{0x12, 0x1, 0x110, 0x57, 0x55, 0xf0, 0x8, 0x2345, 0x29cb, 0xcb8b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7, 0x0, 0xf0, 0x9, [{{0x9, 0x4, 0x13, 0x7, 0x0, 0xff, 0x5d, 0x81, 0x3}}]}}]}}, 0x0) 304.899212ms ago: executing program 3 (id=3746): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="9feb0180000000000000000020350c0000000c000000080000000b000000000000060400000000300000cf00"], 0x0, 0x2c, 0x0, 0x6, 0x2, 0x0, @void, @value}, 0x28) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x4008032, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1f}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)={{0x12, 0x1, 0x141, 0x27, 0xc0, 0xde, 0x20, 0x86a, 0x3, 0xf03f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x2, 0x2, 0x2, 0xf3, 0xbf, 0xf5, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0x2, 0x0, 0xa}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r2, &(0x7f0000000200)={0x14, 0x0, &(0x7f0000000380)={0x0, 0x3, 0x14, @string={0x14, 0x3, "6d0a412b2cde821824674afe5f8c7e017e90"}}}, 0x0) r3 = add_key$user(&(0x7f0000000040), &(0x7f0000000180)={'syz', 0x0}, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x14) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r4, 0x100000000000f7) syz_io_uring_setup(0x3d, &(0x7f0000000180)={0x0, 0x0, 0x10100}, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/disk', 0x129a82, 0x0) sendfile(r5, r5, 0x0, 0x8) pselect6(0x40, &(0x7f0000000600)={0x11, 0xfffffffffffffffc, 0x2, 0x0, 0xfffffffffffffffe, 0x0, 0x4, 0x8}, 0x0, &(0x7f0000000680)={0x7fc, 0x2, 0x800000, 0x8000000000000001, 0x0, 0xc3ad, 0x0, 0x3}, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(0xffffffffffffffff, 0x40045402, &(0x7f0000000780)=0x1) 231.469239ms ago: executing program 6 (id=3747): r0 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r0, &(0x7f0000000080)={0x1d, 0x0, 0x0, {0x0, 0xf0}, 0xff}, 0x18) socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002, 0xfffffffd}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback, 0xffffffff}, 0x1c) sendto$inet6(r2, &(0x7f0000000080)='D', 0x1, 0x4014, 0x0, 0x0) shutdown(r2, 0x1) splice(r2, 0x0, r1, 0x0, 0x400000107ffff000, 0x0) 196.814553ms ago: executing program 2 (id=3748): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) sched_setscheduler(0x0, 0x6, &(0x7f0000000500)=0x2) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@cgroup=r1, r2, 0x2, 0x2, 0x0, @void, @value}, 0x10) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280), 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40800) syz_io_uring_setup(0x110, 0x0, &(0x7f0000000440)=0x0, 0x0) syz_io_uring_submit(r4, 0x0, 0x0) syz_io_uring_setup(0x10a, &(0x7f0000000140)={0x0, 0x5883, 0x8, 0x0, 0xfffffdfc}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(r4, r6, &(0x7f0000000140)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x6, 0x0, r3, 0x0, &(0x7f0000000380)="0aa4253aa2e150b83625ba636fc5560619a63f311be2b569c014091d66ac88be001ec2b934a5bde17101f7263477890598774f5d678449003bdf60a845a7cc201630c71a44443ee5e11b20d173f99b93a1464cd676411c5f1c49b31da424f695bbc628d3a0546cb5c2b63c183f62022a1865c2ea37b18ef53c359ae86b79813bf4ad7731219b9b37bf727b5b0f7abcd36034edf714830d5431b05944de2ae57814b796dfacf92a25d535868b37", 0xad, 0x41, 0x1, {0x0, r7}}) r8 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) r9 = fcntl$dupfd(r8, 0x0, r8) write$binfmt_script(r9, &(0x7f0000000100), 0xfffffd9d) write$FUSE_INIT(r9, &(0x7f0000000180)={0x50, 0xffffffffffffffda, 0x0, {0x7, 0x28, 0x0, 0x70201841, 0x1, 0x5, 0x4003ff, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}}, 0xe000) r10 = socket(0x2a, 0x2, 0x0) getsockname$packet(r10, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x1}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=@newtfilter={0x48, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {0x0, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0x4, 0x10}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f0000000e40)=@newchain={0x16b0, 0x64, 0x0, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r11, {0x0, 0x2}, {0x8, 0xd}, {0x9, 0x4}}, [@TCA_RATE={0x6, 0x5, {0xfe, 0x7}}, @TCA_CHAIN={0x8, 0xb, 0x7}, @filter_kind_options=@f_bpf={{0x8}, {0x166c, 0x2, [@TCA_BPF_POLICE={0x10, 0x2, [@TCA_POLICE_RATE64={0xc, 0x8, 0x6}]}, @TCA_BPF_CLASSID={0x8, 0x3, {0xfffd, 0x2}}, @TCA_BPF_FD={0x8, 0x6, r2}, @TCA_BPF_FLAGS={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x162c, 0x1, [@m_vlan={0xdc, 0xd, 0x0, 0x0, {{0x9}, {0x34, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PRIORITY={0x5, 0x6, 0x7}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0xea4}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x702}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x88a}]}, {0x7e, 0x6, "28d7f825fd28ae51d4ee375f1cdb57e4b57a5d5ab34ace496897f24ce18b42816c8dc9fe4179e95a04df4c46f1bb8967cf0ef75ef3748b0fe8b03604f1d057e55c364f7a6baf1b63892a92194388ba977fbafe05bb66ae12290dc721c45eb575357b0b0d8da2b2a1dada6fed0cbd53192916f38664104d86316d"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_police={0x154c, 0x20, 0x0, 0x0, {{0xb}, {0x14b4, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE64={0xc, 0x8, 0x3}, @TCA_POLICE_RESULT={0x8, 0x5, 0x8000}, @TCA_POLICE_RESULT={0x8, 0x5, 0x1}, @TCA_POLICE_RATE64={0xc, 0x8, 0x7}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0xa, 0x9, 0x2, 0x401, 0x10001, 0xffffff7f, 0x2, 0x7ff, 0x5, 0xfff, 0x10000, 0x4, 0x2, 0x3ff, 0x7, 0x0, 0x2ff3, 0x4, 0x4, 0x9, 0x4, 0x6, 0x9, 0x0, 0x6, 0x6, 0x8, 0x4, 0x8, 0x36e, 0x3, 0x7, 0x5ac, 0x1, 0xf81, 0x8, 0x10001, 0x9, 0x2c, 0x0, 0x10, 0x0, 0xffff, 0x5, 0xffff, 0x2, 0x1, 0x8, 0x1, 0xfffffbff, 0x8, 0x10000, 0x2, 0x6, 0x5, 0x22, 0x3, 0x9, 0x2, 0x0, 0x0, 0x1f4, 0x80, 0x3, 0x3, 0x10000, 0x3, 0x1b, 0x9, 0x1, 0xffff0001, 0xffffffff, 0x40, 0x23fd, 0xffffff01, 0x9, 0x401, 0x5, 0xc6bd, 0x6, 0xffffffff, 0x0, 0x8, 0x3, 0x9a, 0x6, 0x200, 0xfffffffc, 0x2, 0xb80, 0x0, 0xc, 0x5, 0x3, 0xa, 0x1, 0x7, 0x1, 0x0, 0x1, 0x8000, 0x3, 0x20000000, 0xa27, 0x2, 0x3ff, 0x4, 0x40, 0x4, 0x5, 0x4, 0x1ff, 0x213, 0x0, 0x8, 0x9, 0x9e7a, 0x7, 0x0, 0x6, 0x2, 0x4, 0x6, 0x7, 0xfffffffe, 0x40, 0x3ff, 0x22a, 0xff, 0x400, 0x80000000, 0x3e, 0xa, 0x9, 0x3, 0x3, 0xf7, 0x5, 0x2, 0x9d8d, 0x530, 0xffff, 0x542, 0x0, 0xfff, 0x1, 0x4, 0x7, 0x3ff, 0x3, 0xffff, 0x6, 0xe, 0x81, 0x4, 0x3, 0x5, 0x8a55, 0xfffff801, 0x4, 0x8, 0x1, 0x80, 0x4, 0x7d, 0xb, 0xfffffff8, 0x4, 0x2, 0x1, 0x0, 0x0, 0x4, 0xc4, 0x4, 0x4, 0x0, 0x0, 0x8, 0x0, 0x3, 0x7, 0x8001, 0x0, 0x80000000, 0x4, 0x2, 0x4f0, 0x2, 0xd898, 0x1cdc, 0x5, 0x1, 0xffff, 0x4, 0xfb03, 0xf11, 0x800, 0x9, 0xbcf, 0x800, 0x6, 0x9430, 0x40, 0x6, 0x5, 0xfffff4ea, 0x3, 0x643f, 0xffffffff, 0x5, 0x6, 0x0, 0x8, 0x40, 0x3, 0x3877, 0x1, 0x932, 0x7f, 0xebb, 0x5d, 0x3, 0x37d6, 0x9, 0xffff, 0x5, 0x0, 0x4, 0x2, 0x3, 0x2, 0x10, 0x3, 0x4, 0x200, 0x9, 0x3ff, 0x25, 0x5, 0xf, 0x5, 0x7, 0x9, 0xa, 0x9, 0x9336, 0x9, 0x101, 0x1, 0x5, 0x3, 0x4, 0xd, 0x7fffffff, 0x1]}], [@TCA_POLICE_RESULT={0x8, 0x5, 0x29}, @TCA_POLICE_RESULT={0x8, 0x5, 0x3}, @TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x4455, 0x2, 0x7, 0x8000, 0x5, 0x0, 0x4, 0x9ad, 0x81, 0x80000000, 0x6d80, 0x6, 0x3, 0xffffff5c, 0x4, 0x61, 0x9, 0x2, 0x8001, 0x0, 0xeff, 0xffffff7f, 0x4, 0x6, 0x6, 0xb, 0x10000, 0x1, 0x22c7, 0x8, 0xb4, 0x3, 0x81, 0x8, 0x10000, 0x18e8d9e4, 0x7, 0x3, 0x0, 0xea4, 0x1a00, 0x3dd, 0x1a, 0x5, 0x80, 0xd, 0x2, 0x1, 0xffffdd9a, 0x1983, 0x1000, 0x8, 0x3, 0x1, 0x2, 0x3, 0x8000, 0x2, 0xffffff7f, 0x8001, 0xc11a, 0x5, 0x1, 0x0, 0x9, 0x0, 0x1, 0x9, 0xfffffc00, 0x6, 0x5, 0x7ff, 0x2, 0xf, 0x2f8, 0x9, 0x10001, 0x7, 0x14, 0x7fff, 0xe, 0x8, 0x6, 0x80000001, 0x7, 0x5, 0xa, 0xf, 0x8, 0x80000000, 0xec2, 0x2, 0xffffff0b, 0xba2, 0x4, 0x8001, 0x4f8, 0x3, 0x7fffffff, 0x33, 0x43, 0x5, 0x9, 0x80000001, 0x1000, 0x6, 0x8, 0x4, 0x4, 0xfffffff8, 0x7, 0x400, 0x8000, 0x7, 0x9, 0xecc7, 0x8001, 0x2, 0x4, 0x6, 0x4, 0x6, 0x4, 0x4, 0xff, 0x7, 0x0, 0x0, 0x800, 0xf8c, 0x5f, 0x645e, 0x9, 0xffffffff, 0x2, 0x5, 0x4, 0x0, 0x0, 0xfffffff8, 0x3ed5, 0x18000, 0x3, 0x6, 0xffffffff, 0x1, 0x8001, 0x9, 0x3, 0x1000, 0x2040, 0x8000, 0xfff, 0xa75, 0x5, 0x5, 0x5, 0x4, 0x7, 0x10, 0x5c0, 0x8, 0xeb56, 0x1, 0x8001, 0x0, 0x8, 0xf, 0x58ca, 0x6, 0x5, 0x101, 0x2, 0x7, 0x5, 0x7, 0x4, 0x8, 0x3, 0x4, 0x4, 0x7fffffff, 0x7f5, 0x75e7, 0x9, 0x1, 0x7fffffff, 0x1, 0xe, 0x4, 0xd, 0x1, 0x7fffffff, 0x7, 0x9, 0x68d, 0xc583, 0x8, 0x200, 0xffffff7f, 0x5, 0x3, 0x93d, 0x9, 0x0, 0x4, 0x9, 0x3da, 0x2, 0x2, 0x7, 0x3, 0x2, 0x5, 0x600000, 0x1, 0x41ca, 0x8, 0x1, 0x4, 0x5, 0x9787, 0xf, 0x7, 0x2, 0x0, 0x84, 0x9, 0x3ff, 0xb9d8, 0x4, 0x0, 0xfffffffa, 0x7, 0x8001, 0x2, 0x7, 0xfffffff9, 0x6, 0x8, 0xfffffd2f, 0x6, 0xfff, 0x6, 0x1, 0x3, 0x5, 0x0, 0x4, 0x6c, 0x6a, 0x9, 0x5, 0xe9, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x9, 0x20000000, 0x7d8, 0x6, 0x6, {0x2, 0x1, 0x2, 0xd, 0x7, 0x100}, {0xf3, 0x0, 0x0, 0x800}, 0x3, 0x9, 0xb}}, @TCA_POLICE_RATE={0x404, 0x2, [0x6, 0x81, 0xc86, 0x3f7, 0x768, 0x40, 0x6, 0x1, 0x3, 0x400, 0x6, 0x4184, 0x4, 0x4, 0xff3, 0x6, 0x5, 0x1, 0x7f, 0x8, 0x2, 0x0, 0x9, 0x4, 0x3, 0xfffffff8, 0x7, 0x2, 0xff, 0x2, 0x5, 0x3, 0x1, 0x9, 0xfffffffb, 0x2, 0x6, 0x8, 0x20, 0x8, 0x4, 0x5, 0xc0000, 0x9, 0xe, 0x6, 0xf, 0x6, 0x6, 0x7, 0x64f, 0x401, 0x6, 0x71ec, 0x9, 0xa, 0x8, 0x5dbc, 0x7fff, 0x364, 0x3, 0x7, 0x8502, 0x8, 0x100, 0x0, 0x2, 0x3, 0x8001, 0x91, 0x0, 0x3, 0xccd, 0xb, 0x5, 0x5, 0x0, 0x0, 0xfffffff6, 0x94e, 0x80000000, 0xf3, 0xd, 0xc000000, 0x6, 0xffffffff, 0x762, 0x9f81, 0x6a, 0x8, 0x2, 0x0, 0x9c, 0x2, 0x4, 0x6, 0xc, 0xe2, 0x80000000, 0x1, 0xc5b, 0x6, 0x5, 0xa, 0x0, 0x0, 0x8, 0x3a9e, 0x2, 0x1, 0xa, 0x5, 0x7, 0xd, 0xd, 0xa, 0x9, 0xfffffffc, 0x227d, 0x3b1e699d, 0x7fffffff, 0x2, 0x8, 0x1, 0x3, 0x5, 0xfffffffb, 0x40, 0xb, 0xfffffff8, 0x31, 0x8, 0x2, 0x1, 0x5, 0x9, 0xd202, 0xefa2, 0x5, 0x1, 0xc, 0x6, 0x1, 0x81, 0x3ff, 0x3, 0x5, 0x5, 0x7fffffff, 0xa, 0x7, 0x7, 0xfffffff9, 0x2, 0x4683, 0x5, 0x3, 0xfffffff9, 0x2, 0x4000000, 0x4, 0x6, 0xffffffff, 0x4, 0x5, 0x7, 0x7222, 0x2, 0x7, 0x7, 0x132, 0x6, 0xfffffffc, 0x9f2, 0x1, 0x6, 0x1, 0x6, 0x0, 0x10, 0x3, 0x7ff, 0x4, 0xfffffffb, 0x4, 0x3, 0x81, 0x9, 0x9, 0x4b800000, 0x7, 0x95, 0x7, 0x1d7, 0xfff, 0xffffffff, 0x8001, 0x9, 0x3, 0x400, 0xc, 0x9, 0xe, 0xffff, 0xa9, 0x9, 0x4, 0xffffffff, 0x4, 0x800, 0x0, 0x400, 0x200040, 0xa, 0x9, 0xfffffff8, 0x9, 0x6, 0xf5c, 0x3a, 0x6, 0xffffff84, 0x0, 0x8e2c, 0x1, 0x7ff, 0x0, 0x3, 0x240c, 0xfffffffb, 0x80000001, 0x1, 0x2, 0x3, 0x9, 0x1ff, 0x2, 0x7, 0x1, 0x3, 0x800, 0x100, 0x4, 0x0, 0x2, 0x9fc, 0x1fe, 0xd9bd, 0x1, 0x3, 0x2, 0x5, 0x7, 0x8, 0x3320, 0xead]}], [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x4}, @TCA_POLICE_RESULT={0x8, 0x5, 0x6}, @TCA_POLICE_RATE={0x404, 0x2, [0x31, 0xfffffffc, 0x4, 0x1000, 0x3, 0x100, 0x8, 0x3, 0x7, 0x780000, 0xfffffffb, 0x78, 0xe77, 0x455, 0x5, 0x1, 0xbe7, 0x1, 0x5, 0x3, 0xca1b, 0xf, 0x71, 0xdb, 0x8, 0xff, 0x8, 0x10, 0x1, 0x4, 0x3, 0x5, 0xa4, 0x7, 0x83b, 0x8, 0x3677, 0xfffffffc, 0x87, 0x3, 0x4, 0x6, 0x9, 0x7, 0x0, 0x400, 0x100, 0x8f, 0x4, 0xc640, 0xffff02ba, 0x7, 0xfd0c, 0xa, 0x6, 0x7f, 0x22, 0x0, 0x2, 0x80, 0x62, 0xfc, 0x606e, 0x10001, 0x101, 0xb, 0x3, 0x8001, 0x8, 0x0, 0x8, 0x200, 0x7, 0x7f, 0x2, 0x7, 0x3, 0x1cd, 0x1, 0x7c6, 0xfffffe00, 0x6, 0x0, 0x6, 0x1, 0x10001, 0xb, 0x6, 0x2, 0xfffeffff, 0x5, 0x2, 0x4, 0x8, 0x2, 0x5, 0x81, 0x1a2c, 0xb37, 0x8000, 0x5, 0x5, 0x97c, 0x9, 0x4, 0x4, 0xc6e4, 0x1, 0x10e3, 0x3c4, 0x1b, 0x12000, 0x1, 0x2, 0xd, 0x7, 0x1800, 0x9, 0x1, 0x1, 0x35b, 0x8, 0x8, 0x0, 0x10000, 0x8, 0x7ff, 0x10000, 0x5, 0x0, 0x1, 0x4, 0xc, 0xfffffff7, 0x3, 0x1ff, 0x0, 0x4, 0x4, 0x48, 0x10001, 0xffffffff, 0xc, 0x4, 0xa, 0xe, 0x326, 0x1ff, 0x9, 0x526de142, 0x8, 0xf6, 0x6, 0x8, 0x6a, 0x40, 0x4, 0xda40, 0x9, 0x6, 0x0, 0x1, 0x30d, 0x1000, 0x7, 0x1, 0x3, 0x6, 0x8, 0xd8a3, 0x3, 0xfffffffe, 0x7c3, 0x5, 0xff, 0x7, 0xfffffff8, 0x8, 0x0, 0x5, 0x7, 0x3, 0x1ff, 0xffff26ea, 0x8d4, 0x7e6, 0x2, 0x7, 0x1, 0x3, 0x6, 0x7ff, 0x8, 0x4, 0xffff7acb, 0x1d5cc00, 0x9, 0x9, 0x7, 0x8, 0xfffff463, 0x6, 0x6, 0x7832bb6c, 0x1ff, 0x0, 0x100, 0x80000001, 0x6, 0x6, 0xffffff43, 0x9, 0x8, 0xa8, 0x1, 0x8000, 0xfffff663, 0x7, 0xe, 0x8001, 0x2, 0x4, 0x6, 0x5, 0xffff8000, 0x6, 0x6f, 0x80000001, 0x0, 0x3ff, 0x1, 0x2a2, 0xfffffff9, 0x5, 0x80, 0xd659, 0x3, 0x4, 0x1000, 0x80000000, 0x65ccd43, 0x9, 0x5, 0x9, 0x3, 0x0, 0x9, 0x1, 0x3, 0x6, 0x9, 0x7, 0x3, 0x8, 0x3c95, 0x3ff]}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x4}, @TCA_POLICE_AVRATE={0x8}, @TCA_POLICE_RATE={0x404, 0x2, [0xbd29, 0x5, 0x5, 0x6, 0xfff, 0x3, 0x1, 0x1, 0x4, 0xf, 0x100, 0x6, 0x5, 0xfffffffd, 0xfffffffd, 0x661, 0x200, 0x0, 0x7, 0x4, 0x10, 0x9e, 0xc, 0x4, 0x3, 0x5, 0x0, 0x9, 0xe8f, 0x29f0, 0xfffffffd, 0x2, 0x8, 0x6c0c, 0xaeaa, 0xf0, 0xffff, 0x0, 0x8b000, 0x3, 0x73, 0x8, 0x7, 0x3, 0x24a, 0x3, 0x2, 0x1, 0x0, 0x7, 0x200, 0x2, 0x0, 0x5, 0x1, 0x7fffffff, 0x0, 0x200000, 0x4, 0x1, 0xbbb5, 0x7, 0x3d8, 0x9, 0x7, 0xc87, 0x5, 0x7, 0xffff, 0x8, 0x88, 0x7, 0x5, 0x1, 0x8, 0x4, 0x0, 0x8, 0x270, 0xd, 0x2, 0xd, 0x1, 0x2, 0x7, 0x4, 0x76014c54, 0x6, 0xc, 0x4, 0x9fdb, 0x219, 0x0, 0x33ca, 0x2, 0x6, 0xf, 0x2, 0x549, 0xffff28e5, 0x9, 0x6, 0x7, 0x1, 0x6, 0x2, 0xfffffff9, 0xffffffff, 0x3, 0x10001, 0xffff, 0x10, 0x3, 0x5, 0x7f, 0xfff, 0xc8e, 0x1, 0x9, 0xffffc5c6, 0x4, 0x2, 0x1, 0x9, 0x56, 0x40, 0x4, 0x2, 0x7ff, 0x6, 0x8, 0x28, 0x5, 0xf5eb, 0x7fffffff, 0xc2f, 0x9, 0x5, 0x5, 0x2, 0x81, 0x2, 0x8001, 0xd529, 0x26e9, 0x0, 0x5, 0x0, 0x7, 0x9, 0x8, 0xfffff949, 0x6, 0x9, 0xd, 0x7e00, 0x97, 0x4, 0x10, 0xf, 0x9803, 0x9, 0x2, 0x0, 0x0, 0x3, 0x10001, 0xf, 0x6, 0x5, 0x9, 0xf4ca, 0x20000, 0x10000, 0x1, 0x10, 0x3, 0x7ff, 0x4, 0x8, 0x7d5, 0x2, 0x0, 0x4, 0x9, 0x7, 0xa000000, 0xa, 0xcf, 0x4eae, 0xa0, 0x4, 0x6, 0x4, 0x7fffffff, 0x3ff, 0x8, 0x1, 0x9650, 0x0, 0x100, 0x7fff, 0x80000000, 0x4, 0x741, 0x91, 0x6, 0x27, 0x10, 0x80, 0x0, 0x4, 0x9, 0x8, 0x3db, 0x7, 0xbe, 0x1, 0x0, 0xfffff801, 0x0, 0x5, 0x5, 0x9, 0xffffd0f9, 0x5, 0x3, 0xffffffff, 0x8, 0x100, 0x7fff, 0x6, 0x8, 0x6, 0x70, 0x6, 0x9, 0x7, 0x4, 0x0, 0x3ff, 0x9, 0x6, 0x800, 0x3, 0x4, 0x4, 0x7, 0x2, 0x59f5, 0x4, 0x3, 0x7, 0xb, 0x2, 0xb]}]]}, {0x70, 0x6, "d7b20a94ec93138b7dd968abe829f9d851a4a506b44a85cd72c81afc2a83039e436dd0811f7d958fd38d97d772185d17d6ce7e214f71da6d4c0e5eb2ef456745be3560ec9d4052f9c45d39335410a8275456bdcda5e55e2c02aa2293aaeb0095ec0098d6aa6838aff416f749"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}, @TCA_BPF_FD={0x8, 0x6, r0}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x65}}]}, 0x16b0}, 0x1, 0x0, 0x0, 0x8010}, 0x8010) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900020073727a3100000000080041007369770014003300626f6e6430"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) 161.655379ms ago: executing program 6 (id=3749): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000b5b30a40450c8f6055b5010203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000440)={0x34, &(0x7f0000000240)=ANY=[@ANYBLOB="000000030000"], 0x0, 0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 2 (id=3750): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, &(0x7f0000000000)=0x9, 0x8, 0x0) get_mempolicy(0x0, 0x0, 0xfffffffffffffffd, &(0x7f0000365000/0x3000)=nil, 0x3) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x19, 0x18, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, @void, @value}, 0x94) r4 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000380)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_register$IORING_REGISTER_NAPI(0xffffffffffffffff, 0x1b, &(0x7f0000000100)={0x0, 0x4}, 0x1) kernel console output (not intermixed with test programs): p0 maxpacket: 32 [ 1358.924780][ T10] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1358.945845][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1358.985206][ T10] usb 3-1: config 0 descriptor?? [ 1359.000969][ T10] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1359.195089][ T5966] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1359.344993][ T5966] usb 1-1: Using ep0 maxpacket: 32 [ 1359.352145][ T5966] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1359.361522][ T5966] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1359.372026][ T5966] usb 1-1: config 0 descriptor?? [ 1359.380174][ T5966] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1359.406920][ T10] gspca_nw80x: reg_r err -32 [ 1359.413568][ T10] nw80x 3-1:0.0: probe with driver nw80x failed with error -32 [ 1359.426562][ T10] usb 3-1: USB disconnect, device number 5 [ 1359.592877][ T9654] usb 6-1: USB disconnect, device number 81 [ 1359.854368][ T10] usb 4-1: USB disconnect, device number 5 [ 1359.937290][T17418] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1360.638423][ T10] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 1360.810388][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1360.813481][ T5966] gspca_vc032x: reg_w err -71 [ 1360.821957][ T10] usb 4-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1360.825227][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.838353][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.843886][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1360.847354][ T10] usb 4-1: config 0 descriptor?? [ 1360.853496][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1360.864443][ T10] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1360.865831][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.075070][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.080707][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.086181][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.091772][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.097405][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.103003][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.108491][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.114135][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.121261][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.126979][ T5884] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 1361.136148][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.141680][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.155850][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.161429][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.167093][ T5966] gspca_vc032x: I2c Bus Busy Wait 00 [ 1361.172670][ T5966] gspca_vc032x: Unknown sensor... [ 1361.182250][ T5966] vc032x 1-1:0.0: probe with driver vc032x failed with error -22 [ 1361.198592][ T5966] usb 1-1: USB disconnect, device number 7 [ 1361.296822][ T5884] usb 6-1: config 0 has an invalid interface number: 32 but max is 0 [ 1361.305046][ T5884] usb 6-1: config 0 has no interface number 0 [ 1361.316261][ T5884] usb 6-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1361.328520][ T5884] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.336777][ T5884] usb 6-1: Product: syz [ 1361.341116][ T5884] usb 6-1: Manufacturer: syz [ 1361.348064][ T5884] usb 6-1: SerialNumber: syz [ 1361.357270][ T5884] usb 6-1: config 0 descriptor?? [ 1361.365637][ T5884] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1361.559935][T17436] netlink: 'syz.2.3261': attribute type 1 has an invalid length. [ 1361.569642][T17436] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3261'. [ 1361.611839][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.783768][ T5884] input: sonixb as /devices/platform/dummy_hcd.5/usb6/6-1/input/input179 [ 1361.835144][T12300] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1362.017289][ T5887] usb 6-1: USB disconnect, device number 82 [ 1362.035062][ T9654] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1362.038668][T12300] usb 1-1: config 0 has an invalid interface number: 84 but max is 0 [ 1362.052419][T12300] usb 1-1: config 0 has an invalid interface number: 66 but max is 0 [ 1362.063147][T12300] usb 1-1: config 0 has 2 interfaces, different from the descriptor's value: 1 [ 1362.074668][T12300] usb 1-1: config 0 has no interface number 0 [ 1362.081906][T12300] usb 1-1: config 0 has no interface number 1 [ 1362.090198][T12300] usb 1-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 1560, setting to 64 [ 1362.102718][T12300] usb 1-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1362.161144][T12300] usb 1-1: too many endpoints for config 0 interface 66 altsetting 153: 216, using maximum allowed: 30 [ 1362.174368][T12300] usb 1-1: config 0 interface 66 altsetting 153 bulk endpoint 0x5 has invalid maxpacket 32 [ 1362.185937][T12300] usb 1-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0x12, changing to 0x2 [ 1362.200345][T12300] usb 1-1: config 0 interface 66 altsetting 153 has an endpoint descriptor with address 0xE6, changing to 0x86 [ 1362.213446][T12300] usb 1-1: config 0 interface 66 altsetting 153 bulk endpoint 0x86 has invalid maxpacket 53 [ 1362.224901][T12300] usb 1-1: config 0 interface 66 altsetting 153 has 3 endpoint descriptors, different from the interface descriptor's value: 216 [ 1362.242605][T12300] usb 1-1: config 0 interface 66 has no altsetting 0 [ 1362.302270][T12300] usb 1-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 1362.319846][ T10] gspca_vc032x: reg_w err -71 [ 1362.325557][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.331199][T12300] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.340097][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.345637][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.351565][T12300] usb 1-1: Product: syz [ 1362.356340][T12300] usb 1-1: Manufacturer: syz [ 1362.361045][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.367097][T12300] usb 1-1: SerialNumber: syz [ 1362.371902][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.388471][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.396960][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.403332][T12300] usb 1-1: config 0 descriptor?? [ 1362.408979][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.417080][T12300] ljca 1-1:0.84: bulk endpoints not found [ 1362.425156][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.430466][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.439142][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.444456][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.450174][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.455590][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.461013][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.466390][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.471796][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.477296][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 1362.483581][ T10] gspca_vc032x: Unknown sensor... [ 1362.485060][ T9654] usb 3-1: Using ep0 maxpacket: 32 [ 1362.488722][ T10] vc032x 4-1:0.0: probe with driver vc032x failed with error -22 [ 1362.499814][ T9654] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1362.504784][ T10] usb 4-1: USB disconnect, device number 6 [ 1362.511218][ T9654] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1362.528418][ T9654] usb 3-1: config 0 descriptor?? [ 1362.536947][ T9654] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1362.635182][T12300] ljca 1-1:0.66: probe with driver ljca failed with error -71 [ 1362.649618][T12300] usb 1-1: USB disconnect, device number 8 [ 1362.972160][ T9654] gspca_nw80x: reg_r err -32 [ 1363.017496][ T9654] nw80x 3-1:0.0: probe with driver nw80x failed with error -32 [ 1363.535494][ T10] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 1363.610475][T17459] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1363.715565][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 1363.725476][ T9968] Bluetooth: hci5: command 0x0405 tx timeout [ 1363.744600][ T10] usb 7-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1363.790420][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1363.943603][ T10] usb 7-1: config 0 descriptor?? [ 1364.054470][ T10] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1365.066067][ T10] gspca_nw80x: reg_w err -110 [ 1365.070855][ T10] nw80x 7-1:0.0: probe with driver nw80x failed with error -110 [ 1365.125424][ T10] usb 3-1: USB disconnect, device number 6 [ 1365.299393][T17471] netlink: 'syz.2.3273': attribute type 1 has an invalid length. [ 1365.307375][T17471] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3273'. [ 1365.785055][ T9654] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 1365.955024][ T9654] usb 3-1: Using ep0 maxpacket: 32 [ 1365.963037][ T9654] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1365.974346][ T9654] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1365.984663][ T9654] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1365.993896][ T9654] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1366.052565][T12300] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 1366.056312][ T9654] usb 3-1: config 0 descriptor?? [ 1366.072833][ T9654] hub 3-1:0.0: USB hub found [ 1366.274854][ T9654] hub 3-1:0.0: 1 port detected [ 1366.330938][ T5884] usb 7-1: USB disconnect, device number 37 [ 1366.425309][T12300] usb 6-1: Using ep0 maxpacket: 16 [ 1366.432442][T12300] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1366.442475][T12300] usb 6-1: config 0 interface 0 altsetting 1 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 1366.453579][T12300] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1366.466388][T12300] usb 6-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 1366.480901][T12300] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1366.505057][T12300] usb 6-1: Product: syz [ 1366.509258][T12300] usb 6-1: Manufacturer: syz [ 1366.533859][T12300] usb 6-1: SerialNumber: syz [ 1366.546463][T12300] usb 6-1: config 0 descriptor?? [ 1366.925229][ T5929] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 1367.747717][T12300] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input180 [ 1367.856001][ T5884] hub 3-1:0.0: activate --> -90 [ 1367.917311][ T5929] usb 1-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1367.933908][ T5929] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1367.986619][ T5929] usb 1-1: Product: syz [ 1367.990843][ T5929] usb 1-1: Manufacturer: syz [ 1368.004815][ T5929] usb 1-1: SerialNumber: syz [ 1368.014884][ T5929] usb 1-1: config 0 descriptor?? [ 1368.029147][ T5929] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1368.198079][ T5966] usb 3-1: USB disconnect, device number 7 [ 1368.204084][ T5884] usb 3-1-port1: cannot disable (err = -71) [ 1368.245245][ T9654] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 1368.357682][T17513] loop4: detected capacity change from 0 to 7 [ 1368.366534][T17513] Dev loop4: unable to read RDB block 7 [ 1368.372164][T17513] loop4: unable to read partition table [ 1368.378161][T17513] loop4: partition table beyond EOD, truncated [ 1368.384327][T17513] loop_reread_partitions: partition scan of loop4 (被x ) failed (rc=-5) [ 1368.396180][ T9654] usb 7-1: Using ep0 maxpacket: 32 [ 1368.404455][ T9654] usb 7-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1368.418987][ T9654] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1368.423889][T17513] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1368.430395][ T9654] usb 7-1: config 0 descriptor?? [ 1368.450828][ T9654] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1368.861773][ T9654] gspca_nw80x: reg_r err -32 [ 1368.866476][ T9654] nw80x 7-1:0.0: probe with driver nw80x failed with error -32 [ 1369.035448][ T5929] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 1369.203866][ T5929] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1369.225258][ T5929] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1369.248104][ T5929] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1369.257322][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1369.274989][ T5929] usb 3-1: Product: syz [ 1369.285620][ T5929] usb 3-1: Manufacturer: syz [ 1369.290350][ T5929] usb 3-1: SerialNumber: syz [ 1369.499284][ T5884] usb 6-1: USB disconnect, device number 83 [ 1369.512059][ T5929] usb 3-1: 0:2 : does not exist [ 1369.538979][ T5929] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 1369.612760][ T5929] usb 3-1: USB disconnect, device number 8 [ 1369.665587][ T10] usb 1-1: USB disconnect, device number 9 [ 1370.523919][T17528] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1371.297221][ T5966] usb 7-1: USB disconnect, device number 38 [ 1373.779874][T17578] netlink: 292 bytes leftover after parsing attributes in process `syz.6.3304'. [ 1374.985113][ T5884] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 1376.075290][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 1376.089401][ T5884] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1376.098912][ T5884] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1376.127136][ T5884] usb 3-1: config 0 descriptor?? [ 1376.168149][ T5884] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1376.233680][T17594] batadv_slave_0: entered promiscuous mode [ 1376.546708][T17594] batadv_slave_0: left promiscuous mode [ 1376.630694][ T5884] gspca_nw80x: reg_r err -32 [ 1376.675774][ T5966] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 1376.683736][ T5884] nw80x 3-1:0.0: probe with driver nw80x failed with error -32 [ 1377.513413][ T5966] usb 1-1: config 0 has an invalid interface number: 106 but max is 0 [ 1377.521815][ T5966] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1377.532492][ T5966] usb 1-1: config 0 has no interface number 0 [ 1377.542111][ T5966] usb 1-1: New USB device found, idVendor=045b, idProduct=024d, bcdDevice=27.16 [ 1377.551366][ T5966] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1377.564970][ T5966] usb 1-1: Product: syz [ 1377.569152][ T5966] usb 1-1: Manufacturer: syz [ 1377.573756][ T5966] usb 1-1: SerialNumber: syz [ 1377.591365][ T5966] usb 1-1: config 0 descriptor?? [ 1378.301758][ T5884] hid (null): unknown global tag 0xe [ 1378.339923][ T5884] hid (null): unknown global tag 0xe [ 1378.395711][ T5884] hid (null): global environment stack underflow [ 1378.443759][ T5884] hid (null): unknown global tag 0x94 [ 1378.536968][ T9654] usb 3-1: USB disconnect, device number 9 [ 1378.587264][ T5884] hid-generic 0005:0007:0004.0027: unknown global tag 0xe [ 1378.640912][ T5884] hid-generic 0005:0007:0004.0027: item 0 2 1 14 parsing failed [ 1378.666111][ T5884] hid-generic 0005:0007:0004.0027: probe with driver hid-generic failed with error -22 [ 1379.442164][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.450614][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.459237][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.477777][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.524777][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.544152][ T5966] usb 1-1: USB disconnect, device number 10 [ 1379.579134][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.587257][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.594797][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.607642][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.617542][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.635418][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.664427][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.686590][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.694043][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.725002][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.732459][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.748572][ T5884] hid-generic C990:0003:007F.0028: unknown main item tag 0x0 [ 1379.779941][ T5884] hid-generic C990:0003:007F.0028: hidraw0: HID v0.00 Device [syz0] on syz1 [ 1380.978230][ T10] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 1381.547242][ T10] usb 7-1: config 0 has an invalid interface number: 33 but max is 0 [ 1381.634997][ T10] usb 7-1: config 0 has no interface number 0 [ 1381.641164][ T10] usb 7-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.43 [ 1381.805010][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1381.819858][ T10] usb 7-1: config 0 descriptor?? [ 1381.837002][ T10] usb-storage 7-1:0.33: USB Mass Storage device detected [ 1381.936681][ T5884] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 1382.259357][ T5884] usb 4-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1382.272168][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1382.993040][T17663] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1383.076530][ T5884] usb 4-1: Product: syz [ 1383.268283][ T9654] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 1383.285152][ T5884] usb 4-1: Manufacturer: syz [ 1383.289819][ T5884] usb 4-1: SerialNumber: syz [ 1383.298353][ T5884] usb 4-1: config 0 descriptor?? [ 1383.306597][ T5884] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1383.445055][ T9654] usb 3-1: Using ep0 maxpacket: 32 [ 1383.531030][ T9654] usb 3-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1383.603307][ T9654] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1384.016242][ T9654] usb 3-1: config 0 descriptor?? [ 1384.232512][ T9654] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1384.427302][ T5929] usb 4-1: USB disconnect, device number 7 [ 1384.518279][ T9654] gspca_nw80x: reg_r err -32 [ 1384.522996][ T9654] nw80x 3-1:0.0: probe with driver nw80x failed with error -32 [ 1384.625827][ T9654] usb 7-1: USB disconnect, device number 39 [ 1384.775060][T12300] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 1385.075504][ T30] kauditd_printk_skb: 39 callbacks suppressed [ 1385.075532][ T30] audit: type=1326 audit(1749141890.050:872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1385.377415][ T30] audit: type=1326 audit(1749141890.050:873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1385.675377][T17683] Cannot find add_set index 0 as target [ 1386.584066][ T30] audit: type=1326 audit(1749141890.050:874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1386.726684][ T30] audit: type=1326 audit(1749141890.060:875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1386.802362][T12300] usb 1-1: config 0 has an invalid interface number: 32 but max is 0 [ 1386.880748][ T30] audit: type=1326 audit(1749141890.200:876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1386.987705][T12300] usb 1-1: config 0 has no interface number 0 [ 1386.996436][T12300] usb 1-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1386.996463][T12300] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1386.996483][T12300] usb 1-1: Product: syz [ 1386.996497][T12300] usb 1-1: Manufacturer: syz [ 1386.996513][T12300] usb 1-1: SerialNumber: syz [ 1386.999418][T12300] usb 1-1: config 0 descriptor?? [ 1387.000431][ T30] audit: type=1326 audit(1749141890.200:877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1387.000480][ T30] audit: type=1326 audit(1749141890.800:878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=97 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1387.000520][ T30] audit: type=1326 audit(1749141890.800:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1387.000561][ T30] audit: type=1326 audit(1749141890.800:880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1387.000601][ T30] audit: type=1326 audit(1749141890.800:881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=17679 comm="syz.5.3333" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fd19fd8e929 code=0x7ffc0000 [ 1387.002415][T12300] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1387.024041][ T9654] usb 3-1: USB disconnect, device number 10 [ 1387.769742][T12300] input: sonixb as /devices/platform/dummy_hcd.0/usb1/1-1/input/input181 [ 1387.960214][ T5884] usb 1-1: USB disconnect, device number 11 [ 1388.035019][ T5929] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 1388.398291][ T5929] usb 7-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1388.472692][ T5929] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1388.506569][ T5929] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1388.516967][ T5929] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1388.525473][ T5929] usb 7-1: SerialNumber: syz [ 1389.527506][T17711] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1389.748982][T17711] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1391.365190][ T5966] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 1391.524461][ T5929] usb 7-1: 0:2 : does not exist [ 1391.595968][ T5929] usb 7-1: unit 5: unexpected type 0x0b [ 1391.675441][ T5929] usb 7-1: USB disconnect, device number 40 [ 1391.676700][ T5966] usb 4-1: config 0 has an invalid interface number: 33 but max is 0 [ 1392.025118][ T5966] usb 4-1: config 0 has no interface number 0 [ 1392.031294][ T5966] usb 4-1: New USB device found, idVendor=24cf, idProduct=59e4, bcdDevice= 9.43 [ 1392.075948][ T5966] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.086677][ T5966] usb 4-1: config 0 descriptor?? [ 1392.097536][ T5966] usb-storage 4-1:0.33: USB Mass Storage device detected [ 1392.425425][ T5884] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 1392.725208][ T5884] usb 6-1: Using ep0 maxpacket: 32 [ 1393.359338][ T5884] usb 6-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1393.512159][ T5884] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1393.542891][ T5884] usb 6-1: config 0 descriptor?? [ 1393.577741][ T5884] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1394.132215][ T5884] gspca_nw80x: reg_w err -110 [ 1394.148001][ T5884] nw80x 6-1:0.0: probe with driver nw80x failed with error -110 [ 1394.349983][ T5884] usb 4-1: USB disconnect, device number 8 [ 1394.365159][ T5887] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 1394.569780][ T5887] usb 1-1: config 0 has an invalid interface number: 32 but max is 0 [ 1394.579365][ T5887] usb 1-1: config 0 has no interface number 0 [ 1394.607739][ T5887] usb 1-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1394.621335][ T5887] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1394.633359][ T5887] usb 1-1: Product: syz [ 1394.639131][ T5887] usb 1-1: Manufacturer: syz [ 1394.643879][ T5887] usb 1-1: SerialNumber: syz [ 1394.676222][ T5887] usb 1-1: config 0 descriptor?? [ 1394.684593][ T5887] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1395.870671][ T5887] input: sonixb as /devices/platform/dummy_hcd.0/usb1/1-1/input/input182 [ 1395.888704][ T9654] usb 6-1: USB disconnect, device number 84 [ 1396.172269][ T5887] usb 1-1: USB disconnect, device number 12 [ 1397.158919][T17792] FAULT_INJECTION: forcing a failure. [ 1397.158919][T17792] name failslab, interval 1, probability 0, space 0, times 0 [ 1397.171724][T17792] CPU: 1 UID: 0 PID: 17792 Comm: syz.2.3363 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1397.171748][T17792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1397.171759][T17792] Call Trace: [ 1397.171767][T17792] [ 1397.171776][T17792] dump_stack_lvl+0x189/0x250 [ 1397.171805][T17792] ? __pfx____ratelimit+0x10/0x10 [ 1397.171827][T17792] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1397.171851][T17792] ? __pfx__printk+0x10/0x10 [ 1397.171875][T17792] ? __pfx___might_resched+0x10/0x10 [ 1397.171912][T17792] should_fail_ex+0x414/0x560 [ 1397.171938][T17792] should_failslab+0xa8/0x100 [ 1397.171962][T17792] __kmalloc_cache_node_noprof+0x73/0x3d0 [ 1397.171984][T17792] ? __get_vm_area_node+0x13f/0x300 [ 1397.172010][T17792] __get_vm_area_node+0x13f/0x300 [ 1397.172037][T17792] __vmalloc_node_range_noprof+0x301/0x12f0 [ 1397.172058][T17792] ? bpf_prog_alloc_no_stats+0x4a/0x4e0 [ 1397.172082][T17792] ? finish_task_switch+0x266/0x950 [ 1397.172102][T17792] ? lockdep_hardirqs_on+0x9c/0x150 [ 1397.172130][T17792] ? rcu_is_watching+0x15/0xb0 [ 1397.172157][T17792] ? __schedule+0x16c0/0x4cb0 [ 1397.172187][T17792] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1397.172222][T17792] ? bpf_prog_alloc_no_stats+0x4a/0x4e0 [ 1397.172242][T17792] __vmalloc_noprof+0xb1/0xf0 [ 1397.172264][T17792] ? bpf_prog_alloc_no_stats+0x4a/0x4e0 [ 1397.172289][T17792] bpf_prog_alloc_no_stats+0x4a/0x4e0 [ 1397.172316][T17792] bpf_prog_alloc+0x3c/0x1a0 [ 1397.172341][T17792] bpf_prog_load+0x735/0x1930 [ 1397.172376][T17792] ? __pfx_bpf_prog_load+0x10/0x10 [ 1397.172398][T17792] ? irqentry_exit+0x74/0x90 [ 1397.172434][T17792] ? __sys_bpf+0x260/0x860 [ 1397.172454][T17792] ? __sanitizer_cov_trace_switch+0x8f/0x130 [ 1397.172481][T17792] __sys_bpf+0x5f1/0x860 [ 1397.172504][T17792] ? __pfx___sys_bpf+0x10/0x10 [ 1397.172556][T17792] __x64_sys_bpf+0x7c/0x90 [ 1397.172577][T17792] do_syscall_64+0xfa/0x3b0 [ 1397.172599][T17792] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.172616][T17792] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1397.172633][T17792] ? clear_bhb_loop+0x60/0xb0 [ 1397.172655][T17792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.172671][T17792] RIP: 0033:0x7f59c898e929 [ 1397.172687][T17792] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1397.172703][T17792] RSP: 002b:00007f59c974f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1397.172723][T17792] RAX: ffffffffffffffda RBX: 00007f59c8bb6160 RCX: 00007f59c898e929 [ 1397.172736][T17792] RDX: 0000000000000094 RSI: 0000200000002c80 RDI: 0000000000000005 [ 1397.172748][T17792] RBP: 00007f59c974f090 R08: 0000000000000000 R09: 0000000000000000 [ 1397.172759][T17792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1397.172770][T17792] R13: 0000000000000000 R14: 00007f59c8bb6160 R15: 00007ffce5d28ef8 [ 1397.172800][T17792] [ 1397.172830][T17792] syz.2.3363: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1397.473050][T17792] CPU: 0 UID: 0 PID: 17792 Comm: syz.2.3363 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1397.473071][T17792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1397.473078][T17792] Call Trace: [ 1397.473084][T17792] [ 1397.473090][T17792] dump_stack_lvl+0x189/0x250 [ 1397.473111][T17792] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1397.473128][T17792] ? __pfx__printk+0x10/0x10 [ 1397.473139][T17792] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1397.473150][T17792] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1397.473160][T17792] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 1397.473172][T17792] warn_alloc+0x214/0x310 [ 1397.473190][T17792] ? __pfx_warn_alloc+0x10/0x10 [ 1397.473205][T17792] ? __get_vm_area_node+0x13f/0x300 [ 1397.473220][T17792] ? __get_vm_area_node+0x2b5/0x300 [ 1397.473236][T17792] __vmalloc_node_range_noprof+0x326/0x12f0 [ 1397.473250][T17792] ? finish_task_switch+0x266/0x950 [ 1397.473262][T17792] ? lockdep_hardirqs_on+0x9c/0x150 [ 1397.473279][T17792] ? rcu_is_watching+0x15/0xb0 [ 1397.473296][T17792] ? __schedule+0x16c0/0x4cb0 [ 1397.473312][T17792] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1397.473331][T17792] ? bpf_prog_alloc_no_stats+0x4a/0x4e0 [ 1397.473344][T17792] __vmalloc_noprof+0xb1/0xf0 [ 1397.473358][T17792] ? bpf_prog_alloc_no_stats+0x4a/0x4e0 [ 1397.473373][T17792] bpf_prog_alloc_no_stats+0x4a/0x4e0 [ 1397.473389][T17792] bpf_prog_alloc+0x3c/0x1a0 [ 1397.473404][T17792] bpf_prog_load+0x735/0x1930 [ 1397.473424][T17792] ? __pfx_bpf_prog_load+0x10/0x10 [ 1397.473437][T17792] ? irqentry_exit+0x74/0x90 [ 1397.473457][T17792] ? __sys_bpf+0x260/0x860 [ 1397.473469][T17792] ? __sanitizer_cov_trace_switch+0x8f/0x130 [ 1397.473483][T17792] __sys_bpf+0x5f1/0x860 [ 1397.473498][T17792] ? __pfx___sys_bpf+0x10/0x10 [ 1397.473526][T17792] __x64_sys_bpf+0x7c/0x90 [ 1397.473538][T17792] do_syscall_64+0xfa/0x3b0 [ 1397.473553][T17792] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.473562][T17792] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1397.473572][T17792] ? clear_bhb_loop+0x60/0xb0 [ 1397.473584][T17792] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.473594][T17792] RIP: 0033:0x7f59c898e929 [ 1397.473605][T17792] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1397.473613][T17792] RSP: 002b:00007f59c974f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1397.473624][T17792] RAX: ffffffffffffffda RBX: 00007f59c8bb6160 RCX: 00007f59c898e929 [ 1397.473631][T17792] RDX: 0000000000000094 RSI: 0000200000002c80 RDI: 0000000000000005 [ 1397.473638][T17792] RBP: 00007f59c974f090 R08: 0000000000000000 R09: 0000000000000000 [ 1397.473645][T17792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1397.473651][T17792] R13: 0000000000000000 R14: 00007f59c8bb6160 R15: 00007ffce5d28ef8 [ 1397.473666][T17792] [ 1397.473670][T17792] Mem-Info: [ 1397.703502][ C0] vkms_vblank_simulate: vblank timer overrun [ 1397.764888][T17792] active_anon:253 inactive_anon:8157 isolated_anon:0 [ 1397.764888][T17792] active_file:18029 inactive_file:40487 isolated_file:0 [ 1397.764888][T17792] unevictable:768 dirty:400 writeback:0 [ 1397.764888][T17792] slab_reclaimable:10976 slab_unreclaimable:102358 [ 1397.764888][T17792] mapped:33449 shmem:4213 pagetables:1169 [ 1397.764888][T17792] sec_pagetables:0 bounce:0 [ 1397.764888][T17792] kernel_misc_reclaimable:0 [ 1397.764888][T17792] free:1301659 free_pcp:12217 free_cma:0 [ 1397.810431][ C0] vkms_vblank_simulate: vblank timer overrun [ 1397.817693][T17792] Node 0 active_anon:1012kB inactive_anon:32628kB active_file:71880kB inactive_file:161948kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:133760kB dirty:1600kB writeback:0kB shmem:15316kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:4096kB writeback_tmp:0kB kernel_stack:10912kB pagetables:4528kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1397.851826][T17792] Node 1 active_anon:0kB inactive_anon:0kB active_file:236kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:36kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:48kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1397.883597][T17792] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1397.912652][T17792] lowmem_reserve[]: 0 2501 2503 2503 2503 [ 1397.918411][T17792] Node 0 DMA32 free:1279936kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1008kB inactive_anon:32588kB active_file:70104kB inactive_file:161888kB unevictable:1536kB writepending:1608kB present:3129332kB managed:2561544kB mlocked:0kB bounce:0kB free_pcp:44556kB local_pcp:25640kB free_cma:0kB [ 1397.951167][T17792] lowmem_reserve[]: 0 0 1 1 1 [ 1397.955891][T17792] Node 0 Normal free:8kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:40kB active_file:1776kB inactive_file:60kB unevictable:0kB writepending:0kB present:1048580kB managed:1904kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 1397.985633][T17792] lowmem_reserve[]: 0 0 0 0 0 [ 1397.990325][T17792] Node 1 Normal free:3911256kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:236kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:4960kB local_pcp:0kB free_cma:0kB [ 1398.021583][T17792] lowmem_reserve[]: 0 0 0 0 0 [ 1398.026298][T17792] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1398.038900][T17792] Node 0 DMA32: 122*4kB (UME) 181*8kB (UME) 395*16kB (UME) 420*32kB (UME) 254*64kB (UM) 155*128kB (UME) 52*256kB (UM) 49*512kB (UME) 28*1024kB (UME) 6*2048kB (UME) 279*4096kB (M) = 1279936kB [ 1398.057692][T17792] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB [ 1398.069493][T17792] Node 1 Normal: 188*4kB (UE) 55*8kB (UME) 37*16kB (UE) 275*32kB (UE) 114*64kB (UME) 25*128kB (UME) 10*256kB (UME) 3*512kB (UM) 3*1024kB (UME) 2*2048kB (UE) 947*4096kB (M) = 3911256kB [ 1398.104646][T17792] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1398.117026][T17792] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1398.126486][T17792] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1398.136716][T17792] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1398.146172][T17792] 62745 total pagecache pages [ 1398.150926][T17792] 0 pages in swap cache [ 1398.155178][T17792] Free swap = 124996kB [ 1398.159394][T17792] Total swap = 124996kB [ 1398.163610][T17792] 2097051 pages RAM [ 1398.167573][T17792] 0 pages HighMem/MovableOnly [ 1398.172306][T17792] 424558 pages reserved [ 1398.176573][T17792] 0 pages cma reserved [ 1398.374521][T17793] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1399.687714][T17813] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3369'. [ 1400.187313][ T9654] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 1400.485250][ T9654] usb 3-1: Using ep0 maxpacket: 8 [ 1400.509360][ T9654] usb 3-1: config 0 has an invalid interface number: 131 but max is 0 [ 1400.512402][T17820] FAULT_INJECTION: forcing a failure. [ 1400.512402][T17820] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1400.537383][T17820] CPU: 0 UID: 0 PID: 17820 Comm: syz.5.3372 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1400.537409][T17820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1400.537421][T17820] Call Trace: [ 1400.537429][T17820] [ 1400.537438][T17820] dump_stack_lvl+0x189/0x250 [ 1400.537465][T17820] ? __pfx____ratelimit+0x10/0x10 [ 1400.537488][T17820] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1400.537510][T17820] ? __pfx__printk+0x10/0x10 [ 1400.537529][T17820] ? __might_fault+0xb0/0x130 [ 1400.537568][T17820] should_fail_ex+0x414/0x560 [ 1400.537596][T17820] _copy_from_user+0x2d/0xb0 [ 1400.537615][T17820] memdup_user+0x5e/0xd0 [ 1400.537634][T17820] ucma_set_option+0x13e/0xa60 [ 1400.537661][T17820] ? __pfx_ucma_set_option+0x10/0x10 [ 1400.537698][T17820] ? __lock_acquire+0xab9/0xd20 [ 1400.537731][T17820] ? __might_fault+0xb0/0x130 [ 1400.537774][T17820] ucma_write+0x249/0x2e0 [ 1400.537800][T17820] ? __pfx_ucma_write+0x10/0x10 [ 1400.537820][T17820] ? security_file_permission+0x75/0x290 [ 1400.537844][T17820] ? rw_verify_area+0x258/0x650 [ 1400.537864][T17820] ? __pfx_ucma_write+0x10/0x10 [ 1400.537887][T17820] vfs_write+0x27b/0xa90 [ 1400.537916][T17820] ? __pfx_vfs_write+0x10/0x10 [ 1400.537938][T17820] ? __fget_files+0x2a/0x420 [ 1400.537963][T17820] ? __fget_files+0x2a/0x420 [ 1400.537983][T17820] ? __fget_files+0x3a0/0x420 [ 1400.538003][T17820] ? __fget_files+0x2a/0x420 [ 1400.538034][T17820] ksys_write+0x145/0x250 [ 1400.538056][T17820] ? __pfx_ksys_write+0x10/0x10 [ 1400.538074][T17820] ? rcu_is_watching+0x15/0xb0 [ 1400.538102][T17820] ? do_syscall_64+0xbe/0x3b0 [ 1400.538127][T17820] do_syscall_64+0xfa/0x3b0 [ 1400.538146][T17820] ? lockdep_hardirqs_on+0x9c/0x150 [ 1400.538166][T17820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1400.538184][T17820] ? clear_bhb_loop+0x60/0xb0 [ 1400.538205][T17820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1400.538222][T17820] RIP: 0033:0x7fd19fd8e929 [ 1400.538238][T17820] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1400.538252][T17820] RSP: 002b:00007fd1a0b7b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1400.538272][T17820] RAX: ffffffffffffffda RBX: 00007fd19ffb5fa0 RCX: 00007fd19fd8e929 [ 1400.538285][T17820] RDX: 0000000000000020 RSI: 0000200000000380 RDI: 0000000000000003 [ 1400.538298][T17820] RBP: 00007fd1a0b7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1400.538309][T17820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1400.538321][T17820] R13: 0000000000000000 R14: 00007fd19ffb5fa0 R15: 00007fffa8f779b8 [ 1400.538348][T17820] [ 1400.800909][ C0] vkms_vblank_simulate: vblank timer overrun [ 1400.908842][ T9654] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1400.924702][ T9654] usb 3-1: config 0 has no interface number 0 [ 1400.945132][T12300] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 1400.974774][ T9654] usb 3-1: config 0 interface 131 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1401.213431][ T9654] usb 3-1: config 0 interface 131 has no altsetting 0 [ 1401.224667][ T9654] usb 3-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=6c.e1 [ 1401.237102][ T9654] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1401.245509][ T9654] usb 3-1: Product: syz [ 1401.820782][ T9654] usb 3-1: Manufacturer: syz [ 1401.825609][ T9654] usb 3-1: SerialNumber: syz [ 1401.923512][T12300] usb 4-1: Using ep0 maxpacket: 32 [ 1401.935071][T12300] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1401.987145][T12300] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1401.989467][ T9654] usb 3-1: config 0 descriptor?? [ 1402.018939][T12300] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1402.058149][T12300] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1402.089436][T12300] usb 4-1: config 0 descriptor?? [ 1402.171620][T12300] hub 4-1:0.0: USB hub found [ 1402.528552][T12300] hub 4-1:0.0: 1 port detected [ 1402.623323][ T9654] usb 3-1: bad CDC descriptors [ 1402.636940][ T9654] cdc_acm 3-1:0.131: Zero length descriptor references [ 1402.644077][ T9654] cdc_acm 3-1:0.131: probe with driver cdc_acm failed with error -22 [ 1402.678946][ T9654] usb 3-1: USB disconnect, device number 11 [ 1402.875823][T17848] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3379'. [ 1402.884886][T17848] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3379'. [ 1403.005434][ T5887] usb 6-1: new high-speed USB device number 85 using dummy_hcd [ 1403.147913][T17848] vxcan3: entered allmulticast mode [ 1403.355717][T12300] hub 4-1:0.0: activate --> -90 [ 1403.361642][ T5887] usb 6-1: config 0 has an invalid interface number: 32 but max is 0 [ 1403.374467][ T5887] usb 6-1: config 0 has no interface number 0 [ 1403.394724][ T5887] usb 6-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1403.421986][ T5887] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1403.432098][ T5887] usb 6-1: Product: syz [ 1403.442034][ T5887] usb 6-1: Manufacturer: syz [ 1403.449570][ T5887] usb 6-1: SerialNumber: syz [ 1403.568332][ T5887] usb 6-1: config 0 descriptor?? [ 1403.599650][ T5887] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1403.967204][ T5929] usb 4-1: USB disconnect, device number 9 [ 1403.973251][T12300] usb 4-1-port1: cannot disable (err = -71) [ 1404.002199][ T5887] input: sonixb as /devices/platform/dummy_hcd.5/usb6/6-1/input/input183 [ 1404.009774][T17865] netlink: 'syz.6.3384': attribute type 61 has an invalid length. [ 1404.209624][T16080] usb 6-1: USB disconnect, device number 85 [ 1404.300852][T17868] FAULT_INJECTION: forcing a failure. [ 1404.300852][T17868] name failslab, interval 1, probability 0, space 0, times 0 [ 1404.313641][T17868] CPU: 0 UID: 0 PID: 17868 Comm: syz.0.3385 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1404.313667][T17868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1404.313679][T17868] Call Trace: [ 1404.313689][T17868] [ 1404.313699][T17868] dump_stack_lvl+0x189/0x250 [ 1404.313728][T17868] ? __pfx____ratelimit+0x10/0x10 [ 1404.313750][T17868] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1404.313773][T17868] ? __pfx__printk+0x10/0x10 [ 1404.313794][T17868] ? __pfx___might_resched+0x10/0x10 [ 1404.313818][T17868] ? fs_reclaim_acquire+0x7d/0x100 [ 1404.313845][T17868] should_fail_ex+0x414/0x560 [ 1404.313872][T17868] should_failslab+0xa8/0x100 [ 1404.313896][T17868] __kmalloc_noprof+0xcb/0x4f0 [ 1404.313917][T17868] ? sock_kmalloc+0xd6/0x160 [ 1404.313941][T17868] sock_kmalloc+0xd6/0x160 [ 1404.313963][T17868] ____sys_sendmsg+0x1b5/0x830 [ 1404.313989][T17868] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1404.314017][T17868] ? import_iovec+0x74/0xa0 [ 1404.314039][T17868] ___sys_sendmsg+0x21f/0x2a0 [ 1404.314061][T17868] ? __pfx____sys_sendmsg+0x10/0x10 [ 1404.314116][T17868] ? __fget_files+0x2a/0x420 [ 1404.314138][T17868] ? __fget_files+0x3a0/0x420 [ 1404.314170][T17868] __x64_sys_sendmsg+0x19b/0x260 [ 1404.314191][T17868] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1404.314229][T17868] ? do_syscall_64+0xbe/0x3b0 [ 1404.314255][T17868] do_syscall_64+0xfa/0x3b0 [ 1404.314278][T17868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1404.314294][T17868] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1404.314312][T17868] ? clear_bhb_loop+0x60/0xb0 [ 1404.314333][T17868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1404.314350][T17868] RIP: 0033:0x7f515038e929 [ 1404.314367][T17868] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1404.314382][T17868] RSP: 002b:00007f514e1b4038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1404.314401][T17868] RAX: ffffffffffffffda RBX: 00007f51505b6160 RCX: 00007f515038e929 [ 1404.314415][T17868] RDX: 0000000000000000 RSI: 0000200000001d00 RDI: 0000000000000006 [ 1404.314427][T17868] RBP: 00007f514e1b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1404.314439][T17868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1404.314450][T17868] R13: 0000000000000000 R14: 00007f51505b6160 R15: 00007ffc33c557d8 [ 1404.314486][T17868] [ 1406.628107][T17894] netlink: 276 bytes leftover after parsing attributes in process `syz.6.3394'. [ 1407.154277][T17907] netlink: 'syz.3.3400': attribute type 61 has an invalid length. [ 1408.425158][ T5884] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 1408.577270][ T5884] usb 1-1: config 0 has an invalid interface number: 32 but max is 0 [ 1408.593284][ T5884] usb 1-1: config 0 has no interface number 0 [ 1408.603436][ T5884] usb 1-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1408.612653][ T9654] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 1408.621121][ T5884] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1408.629795][ T5884] usb 1-1: Product: syz [ 1408.634125][ T5884] usb 1-1: Manufacturer: syz [ 1408.638804][ T5884] usb 1-1: SerialNumber: syz [ 1409.207261][ T5884] usb 1-1: config 0 descriptor?? [ 1409.218520][ T5884] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1409.265030][ T9654] usb 7-1: Using ep0 maxpacket: 32 [ 1409.275835][ T9654] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1409.286978][ T9654] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1409.433528][ T9654] usb 7-1: config 0 descriptor?? [ 1409.444058][ T9654] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1409.569699][T17940] IPVS: set_ctl: invalid protocol: 22 127.0.0.1:20000 [ 1409.623515][ T5884] input: sonixb as /devices/platform/dummy_hcd.0/usb1/1-1/input/input184 [ 1409.833255][T12300] usb 1-1: USB disconnect, device number 13 [ 1409.855427][ T5929] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 1410.015380][ T5929] usb 4-1: Using ep0 maxpacket: 8 [ 1410.060927][ T5929] usb 4-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 1410.158447][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1410.205612][ T5929] usb 4-1: Product: syz [ 1410.234737][ T5929] usb 4-1: Manufacturer: syz [ 1410.261677][ T5929] usb 4-1: SerialNumber: syz [ 1410.383343][ T5929] usb 4-1: config 0 descriptor?? [ 1410.401983][ T5929] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 1411.096104][ T9654] gspca_vc032x: reg_w err -110 [ 1411.101034][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.118094][T17948] netlink: 'syz.5.3415': attribute type 61 has an invalid length. [ 1411.131686][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.144997][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.150378][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.161793][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.183343][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.189218][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.195128][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.200519][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.205942][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.214990][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.220755][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.257496][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.269044][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.274640][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.283456][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.297062][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.302597][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1411.308117][ T9654] gspca_vc032x: Unknown sensor... [ 1411.313783][ T9654] vc032x 7-1:0.0: probe with driver vc032x failed with error -22 [ 1411.334321][ T9654] usb 7-1: USB disconnect, device number 41 [ 1413.248941][ T5966] usb 4-1: USB disconnect, device number 10 [ 1413.465142][ T5929] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 1413.768189][T17982] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1414.695111][ T5966] usb 6-1: new high-speed USB device number 86 using dummy_hcd [ 1414.770472][T17989] 9pnet_fd: Insufficient options for proto=fd [ 1414.785096][ T5929] usb 3-1: device descriptor read/64, error -71 [ 1415.370692][T17993] netlink: 'syz.0.3429': attribute type 61 has an invalid length. [ 1415.406565][ T5966] usb 6-1: config 0 has an invalid interface number: 32 but max is 0 [ 1415.415143][ T5966] usb 6-1: config 0 has no interface number 0 [ 1415.427921][ T5966] usb 6-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1415.444357][ T5966] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1415.457420][ T5966] usb 6-1: Product: syz [ 1415.468664][ T5966] usb 6-1: Manufacturer: syz [ 1415.473438][ T5966] usb 6-1: SerialNumber: syz [ 1415.486498][ T5966] usb 6-1: config 0 descriptor?? [ 1415.498615][ T5966] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1415.627348][ T5929] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 1415.827607][ T5929] usb 3-1: device descriptor read/64, error -71 [ 1416.023180][ T5929] usb usb3-port1: attempt power cycle [ 1416.025887][ T5966] input: sonixb as /devices/platform/dummy_hcd.5/usb6/6-1/input/input185 [ 1416.373364][T18006] FAULT_INJECTION: forcing a failure. [ 1416.373364][T18006] name fail_futex, interval 1, probability 0, space 0, times 1 [ 1416.386400][T18006] CPU: 1 UID: 0 PID: 18006 Comm: syz.3.3433 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1416.386424][T18006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1416.386435][T18006] Call Trace: [ 1416.386443][T18006] [ 1416.386451][T18006] dump_stack_lvl+0x189/0x250 [ 1416.386477][T18006] ? __pfx____ratelimit+0x10/0x10 [ 1416.386494][T18006] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1416.386512][T18006] ? __pfx__printk+0x10/0x10 [ 1416.386528][T18006] ? rcu_read_lock_any_held+0x89/0x120 [ 1416.386555][T18006] should_fail_ex+0x414/0x560 [ 1416.386576][T18006] get_futex_key+0x1a6/0x16c0 [ 1416.386599][T18006] ? look_up_lock_class+0x74/0x170 [ 1416.386619][T18006] ? __pfx_get_futex_key+0x10/0x10 [ 1416.386639][T18006] ? __lock_acquire+0xab9/0xd20 [ 1416.386663][T18006] futex_wake+0xf8/0x560 [ 1416.386683][T18006] ? __pfx_futex_wake+0x10/0x10 [ 1416.386701][T18006] ? __lock_acquire+0xab9/0xd20 [ 1416.386726][T18006] do_futex+0x395/0x420 [ 1416.386744][T18006] ? __pfx_do_futex+0x10/0x10 [ 1416.386760][T18006] ? __might_fault+0xb0/0x130 [ 1416.386780][T18006] mm_release+0x188/0x390 [ 1416.386800][T18006] ? __pfx_mm_release+0x10/0x10 [ 1416.386817][T18006] ? lockdep_hardirqs_on+0x9c/0x150 [ 1416.386841][T18006] exit_mm+0xa8/0x2c0 [ 1416.386858][T18006] ? __pfx_exit_mm+0x10/0x10 [ 1416.386874][T18006] ? rcu_is_watching+0x15/0xb0 [ 1416.386895][T18006] do_exit+0x640/0x22e0 [ 1416.386915][T18006] ? do_raw_spin_lock+0x121/0x290 [ 1416.386931][T18006] ? __pfx_do_exit+0x10/0x10 [ 1416.386957][T18006] do_group_exit+0x21c/0x2d0 [ 1416.386972][T18006] ? lockdep_hardirqs_on+0x9c/0x150 [ 1416.386990][T18006] get_signal+0x125e/0x1310 [ 1416.387025][T18006] arch_do_signal_or_restart+0x9a/0x750 [ 1416.387041][T18006] ? __fget_files+0x3a0/0x420 [ 1416.387058][T18006] ? __fget_files+0x2a/0x420 [ 1416.387077][T18006] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1416.387105][T18006] ? exit_to_user_mode_loop+0x40/0x110 [ 1416.387125][T18006] exit_to_user_mode_loop+0x75/0x110 [ 1416.387142][T18006] do_syscall_64+0x2bd/0x3b0 [ 1416.387158][T18006] ? lockdep_hardirqs_on+0x9c/0x150 [ 1416.387173][T18006] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1416.387187][T18006] ? clear_bhb_loop+0x60/0xb0 [ 1416.387203][T18006] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1416.387216][T18006] RIP: 0033:0x7f14c2b8e929 [ 1416.387230][T18006] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1416.387242][T18006] RSP: 002b:00007f14c3a18038 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 1416.387258][T18006] RAX: fffffffffffffe00 RBX: 00007f14c2db6160 RCX: 00007f14c2b8e929 [ 1416.387268][T18006] RDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000008 [ 1416.387277][T18006] RBP: 00007f14c3a18090 R08: 0000000000000000 R09: 0000000000000000 [ 1416.387286][T18006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1416.387295][T18006] R13: 0000000000000000 R14: 00007f14c2db6160 R15: 00007ffec1e3e548 [ 1416.387325][T18006] [ 1416.779672][ T5884] usb 6-1: USB disconnect, device number 86 [ 1417.482615][T18023] random: crng reseeded on system resumption [ 1418.500372][T18040] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3441'. [ 1419.126355][T18048] netlink: 'syz.5.3445': attribute type 61 has an invalid length. [ 1419.495213][ T5929] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 1419.522831][T18065] netlink: 'syz.3.3450': attribute type 1 has an invalid length. [ 1419.530819][T18065] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3450'. [ 1419.545145][ T10] usb 6-1: new high-speed USB device number 87 using dummy_hcd [ 1419.675471][ T5929] usb 3-1: Using ep0 maxpacket: 8 [ 1419.699075][ T5929] usb 3-1: config 0 has an invalid interface number: 131 but max is 0 [ 1419.715965][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1419.741221][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1419.753066][ T5929] usb 3-1: config 0 has no interface number 0 [ 1419.759782][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1419.759826][ T10] usb 6-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 1419.759849][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1419.762095][ T5929] usb 3-1: config 0 interface 131 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1419.777399][T18071] netlink: 'syz.6.3454': attribute type 1 has an invalid length. [ 1419.782028][ T10] usb 6-1: config 0 descriptor?? [ 1419.803669][T18071] netlink: 224 bytes leftover after parsing attributes in process `syz.6.3454'. [ 1419.810093][ T5929] usb 3-1: config 0 interface 131 has no altsetting 0 [ 1419.838413][ T5929] usb 3-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=6c.e1 [ 1419.856299][ T5884] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1419.868896][ T10] em28xx 6-1:0.0: New device @ 480 Mbps (2040:1605, interface 0, class 0) [ 1419.877712][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1419.889889][ T10] em28xx 6-1:0.0: DVB interface 0 found: bulk [ 1419.899154][ T5929] usb 3-1: Product: syz [ 1419.904071][ T5929] usb 3-1: Manufacturer: syz [ 1419.910717][ T5929] usb 3-1: SerialNumber: syz [ 1419.919929][ T5929] usb 3-1: config 0 descriptor?? [ 1420.021669][ T5884] usb 4-1: config 0 has an invalid interface number: 32 but max is 0 [ 1420.030929][ T5884] usb 4-1: config 0 has no interface number 0 [ 1420.044293][ T5884] usb 4-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1420.077152][T18056] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1420.084977][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1420.093542][ T5884] usb 4-1: Product: syz [ 1420.099307][T18056] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1420.137656][T18056] netlink: 'syz.5.3449': attribute type 10 has an invalid length. [ 1420.144976][ T5884] usb 4-1: Manufacturer: syz [ 1420.145587][T18056] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3449'. [ 1420.150057][ T5884] usb 4-1: SerialNumber: syz [ 1420.152756][ T5884] usb 4-1: config 0 descriptor?? [ 1420.173251][ T5929] usb 3-1: bad CDC descriptors [ 1420.183349][ T5929] cdc_acm 3-1:0.131: Zero length descriptor references [ 1420.196837][T18083] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1420.201057][ T5884] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1420.205671][ T5929] cdc_acm 3-1:0.131: probe with driver cdc_acm failed with error -22 [ 1420.221115][T18083] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1420.233577][T18056] team0: Port device geneve0 added [ 1420.235360][ T5929] usb 3-1: USB disconnect, device number 15 [ 1420.251401][T18082] netlink: 'syz.0.3459': attribute type 61 has an invalid length. [ 1420.609324][ T5884] input: sonixb as /devices/platform/dummy_hcd.3/usb4/4-1/input/input186 [ 1420.645636][ T10] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1421.310328][ T5884] usb 4-1: USB disconnect, device number 11 [ 1421.332236][ T10] em28xx 6-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1421.355006][ T10] em28xx 6-1:0.0: board has no eeprom [ 1421.455311][ T10] em28xx 6-1:0.0: Identified as Hauppauge WinTV HVR 930C (card=81) [ 1421.464575][ T10] em28xx 6-1:0.0: dvb set to bulk mode. [ 1421.470388][ T5929] em28xx 6-1:0.0: Binding DVB extension [ 1421.485758][ T10] usb 6-1: USB disconnect, device number 87 [ 1421.494166][ T10] em28xx 6-1:0.0: Disconnecting em28xx [ 1421.747522][ T5929] DVB: Unable to find symbol drxk_attach() [ 1421.782396][ T5929] em28xx 6-1:0.0: Registering input extension [ 1421.809088][ T10] em28xx 6-1:0.0: Closing input extension [ 1421.852483][ T10] em28xx 6-1:0.0: Freeing device [ 1422.284087][ T5966] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 1423.413464][T18128] netlink: 'syz.6.3472': attribute type 61 has an invalid length. [ 1423.426263][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.455115][ T5966] usb 1-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1423.489821][ T5966] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1423.545000][ T5966] usb 1-1: Product: syz [ 1423.577911][ T5966] usb 1-1: Manufacturer: syz [ 1423.605306][ T5966] usb 1-1: SerialNumber: syz [ 1423.624077][ T5966] usb 1-1: config 0 descriptor?? [ 1423.642707][ T5966] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1423.855698][T18140] FAULT_INJECTION: forcing a failure. [ 1423.855698][T18140] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1423.874121][T18140] CPU: 0 UID: 0 PID: 18140 Comm: syz.5.3479 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1423.874146][T18140] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1423.874157][T18140] Call Trace: [ 1423.874165][T18140] [ 1423.874172][T18140] dump_stack_lvl+0x189/0x250 [ 1423.874200][T18140] ? __pfx____ratelimit+0x10/0x10 [ 1423.874222][T18140] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1423.874244][T18140] ? __pfx__printk+0x10/0x10 [ 1423.874263][T18140] ? fs_reclaim_acquire+0x7d/0x100 [ 1423.874292][T18140] should_fail_ex+0x414/0x560 [ 1423.874317][T18140] prepare_alloc_pages+0x213/0x610 [ 1423.874348][T18140] __alloc_frozen_pages_noprof+0x123/0x370 [ 1423.874374][T18140] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1423.874404][T18140] ? policy_nodemask+0x27c/0x720 [ 1423.874422][T18140] ? __lock_acquire+0xab9/0xd20 [ 1423.874449][T18140] alloc_pages_mpol+0x232/0x4a0 [ 1423.874475][T18140] vma_alloc_folio_noprof+0xe4/0x200 [ 1423.874500][T18140] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1423.874532][T18140] folio_prealloc+0x30/0x180 [ 1423.874554][T18140] __handle_mm_fault+0x2c88/0x5620 [ 1423.874600][T18140] ? __pfx___handle_mm_fault+0x10/0x10 [ 1423.874638][T18140] ? find_vma+0xe7/0x160 [ 1423.874656][T18140] ? __pfx_find_vma+0x10/0x10 [ 1423.874671][T18140] ? __up_read+0x280/0x680 [ 1423.874687][T18140] handle_mm_fault+0x2d5/0x7f0 [ 1423.874712][T18140] do_user_addr_fault+0x764/0x1390 [ 1423.874741][T18140] exc_page_fault+0x76/0xf0 [ 1423.874765][T18140] asm_exc_page_fault+0x26/0x30 [ 1423.874779][T18140] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 1423.874794][T18140] Code: f6 03 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 cf f6 03 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 1423.874806][T18140] RSP: 0018:ffffc90005587ac8 EFLAGS: 00050202 [ 1423.874820][T18140] RAX: ffffffff84ba1401 RBX: 000000000000fffc RCX: 000000000000f1bc [ 1423.874830][T18140] RDX: 0000000000000000 RSI: ffff888025780e40 RDI: 0000200000002000 [ 1423.874840][T18140] RBP: ffffc90005587bd8 R08: 0000000000000003 R09: 0000000000000004 [ 1423.874849][T18140] R10: dffffc0000000000 R11: ffffed1004af1fff R12: 00002000000111bc [ 1423.874859][T18140] R13: 00007ffffffff000 R14: ffff888025780000 R15: 00002000000011c0 [ 1423.874876][T18140] ? _copy_to_user+0x41/0xb0 [ 1423.874900][T18140] _copy_to_user+0x8a/0xb0 [ 1423.874920][T18140] snd_pcm_oss_read2+0x316/0x430 [ 1423.874942][T18140] ? __pfx___up_read+0x10/0x10 [ 1423.874962][T18140] ? __pfx_snd_pcm_oss_read2+0x10/0x10 [ 1423.874981][T18140] ? __pfx_snd_pcm_post_prepare+0x10/0x10 [ 1423.875004][T18140] ? snd_pcm_action_nonatomic+0x25c/0x2b0 [ 1423.875030][T18140] snd_pcm_oss_read+0x635/0x8d0 [ 1423.875059][T18140] ? __pfx_snd_pcm_oss_read+0x10/0x10 [ 1423.875077][T18140] vfs_read+0x1fd/0x980 [ 1423.875101][T18140] ? __pfx_vfs_read+0x10/0x10 [ 1423.875118][T18140] ? __fget_files+0x2a/0x420 [ 1423.875137][T18140] ? __fget_files+0x2a/0x420 [ 1423.875153][T18140] ? __fget_files+0x3a0/0x420 [ 1423.875171][T18140] ? __fget_files+0x2a/0x420 [ 1423.875198][T18140] ksys_read+0x145/0x250 [ 1423.875216][T18140] ? __pfx_ksys_read+0x10/0x10 [ 1423.875228][T18140] ? rcu_is_watching+0x15/0xb0 [ 1423.875252][T18140] ? do_syscall_64+0xbe/0x3b0 [ 1423.875272][T18140] do_syscall_64+0xfa/0x3b0 [ 1423.875288][T18140] ? lockdep_hardirqs_on+0x9c/0x150 [ 1423.875305][T18140] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1423.875322][T18140] ? clear_bhb_loop+0x60/0xb0 [ 1423.875339][T18140] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1423.875352][T18140] RIP: 0033:0x7fd19fd8e929 [ 1423.875365][T18140] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1423.875376][T18140] RSP: 002b:00007fd1a0b7b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1423.875390][T18140] RAX: ffffffffffffffda RBX: 00007fd19ffb5fa0 RCX: 00007fd19fd8e929 [ 1423.875401][T18140] RDX: 00000000200021d5 RSI: 00002000000011c0 RDI: 0000000000000003 [ 1423.875410][T18140] RBP: 00007fd1a0b7b090 R08: 0000000000000000 R09: 0000000000000000 [ 1423.875420][T18140] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1423.875428][T18140] R13: 0000000000000000 R14: 00007fd19ffb5fa0 R15: 00007fffa8f779b8 [ 1423.875454][T18140] [ 1424.286806][ T5884] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1424.367790][ T5966] gspca_sunplus: reg_r err -110 [ 1424.372789][ T5966] sunplus 1-1:0.0: probe with driver sunplus failed with error -110 [ 1424.435112][ T9654] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 1424.442851][ T5884] usb 3-1: device descriptor read/64, error -71 [ 1424.605149][ T9654] usb 7-1: Using ep0 maxpacket: 8 [ 1424.612134][ T9654] usb 7-1: config 0 has an invalid interface number: 131 but max is 0 [ 1424.625793][ T9654] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1424.642762][ T9654] usb 7-1: config 0 has no interface number 0 [ 1424.649252][ T9654] usb 7-1: config 0 interface 131 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1424.664014][ T9654] usb 7-1: config 0 interface 131 has no altsetting 0 [ 1424.674440][ T9654] usb 7-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=6c.e1 [ 1424.683876][ T9654] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1424.692054][ T9654] usb 7-1: Product: syz [ 1424.696497][ T5884] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 1424.704256][ T9654] usb 7-1: Manufacturer: syz [ 1424.709741][ T9654] usb 7-1: SerialNumber: syz [ 1424.717368][ T9654] usb 7-1: config 0 descriptor?? [ 1424.769258][ T5842] usb 6-1: new high-speed USB device number 88 using dummy_hcd [ 1424.845195][ T5884] usb 3-1: device descriptor read/64, error -71 [ 1424.926109][ T9654] usb 7-1: bad CDC descriptors [ 1424.932056][ T9654] cdc_acm 7-1:0.131: Zero length descriptor references [ 1424.939190][ T9654] cdc_acm 7-1:0.131: probe with driver cdc_acm failed with error -22 [ 1424.949063][ T5842] usb 6-1: config 0 has an invalid interface number: 32 but max is 0 [ 1424.963974][ T5842] usb 6-1: config 0 has no interface number 0 [ 1424.976193][ T9654] usb 7-1: USB disconnect, device number 42 [ 1424.983314][ T5884] usb usb3-port1: attempt power cycle [ 1425.000112][ T5842] usb 6-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1425.518496][ T5842] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1425.585076][ T5842] usb 6-1: Product: syz [ 1425.595722][ T5842] usb 6-1: Manufacturer: syz [ 1425.603299][ T5842] usb 6-1: SerialNumber: syz [ 1425.612767][ T5842] usb 6-1: config 0 descriptor?? [ 1425.622111][T18159] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3485'. [ 1425.629610][ T5842] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1425.673296][T18161] netlink: 'syz.3.3486': attribute type 1 has an invalid length. [ 1425.681447][T18161] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3486'. [ 1425.737948][T18163] netlink: 'syz.3.3487': attribute type 61 has an invalid length. [ 1425.762424][ T9654] usb 1-1: USB disconnect, device number 14 [ 1425.867772][ T5884] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 1425.907085][ T5884] usb 3-1: device descriptor read/8, error -71 [ 1425.914362][T18169] bridge0: port 3(erspan0) entered blocking state [ 1425.924076][T18169] bridge0: port 3(erspan0) entered disabled state [ 1425.931726][T18169] erspan0: entered allmulticast mode [ 1425.942659][T18169] erspan0: entered promiscuous mode [ 1425.957456][T18169] bridge0: port 3(erspan0) entered blocking state [ 1425.964576][T18169] bridge0: port 3(erspan0) entered forwarding state [ 1425.979677][T18170] erspan0: left allmulticast mode [ 1426.182549][ T5884] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1426.347018][ T5842] input: sonixb as /devices/platform/dummy_hcd.5/usb6/6-1/input/input188 [ 1426.364204][T18170] erspan0: left promiscuous mode [ 1426.374785][T18170] bridge0: port 3(erspan0) entered disabled state [ 1426.379628][T18169] openvswitch: netlink: Message has 2 unknown bytes. [ 1426.392647][ T5884] usb 3-1: device descriptor read/8, error -71 [ 1426.433250][ T5842] usb 6-1: USB disconnect, device number 88 [ 1426.440047][T18169] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1426.535421][ T5884] usb usb3-port1: unable to enumerate USB device [ 1484.487927][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1530.555165][ T5929] usb 1-1: new full-speed USB device number 15 using dummy_hcd [ 1530.771883][ T5929] usb 1-1: config 0 has an invalid descriptor of length 56, skipping remainder of the config [ 1530.790775][ T5929] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 1530.800072][ T5929] usb 1-1: config 0 has no interface number 0 [ 1530.806414][ T5929] usb 1-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 1530.829270][ T5929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1530.850714][ T5929] usb 1-1: config 0 descriptor?? [ 1530.985129][ T5884] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1531.157618][ T5884] usb 4-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1531.175288][ T5887] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 1531.176230][ T9654] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 1531.190499][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.198625][ T5884] usb 4-1: Product: syz [ 1531.202799][ T5884] usb 4-1: Manufacturer: syz [ 1531.207702][ T5884] usb 4-1: SerialNumber: syz [ 1531.225882][ T5884] usb 4-1: config 0 descriptor?? [ 1531.234087][ T5884] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1531.325063][ T5887] usb 7-1: Using ep0 maxpacket: 8 [ 1531.332757][ T5887] usb 7-1: config 0 has an invalid interface number: 131 but max is 0 [ 1531.342035][ T5887] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1531.352177][ T5887] usb 7-1: config 0 has no interface number 0 [ 1531.357844][ T9654] usb 3-1: config 0 has an invalid interface number: 32 but max is 0 [ 1531.358307][ T5887] usb 7-1: config 0 interface 131 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1531.370118][ T9654] usb 3-1: config 0 has no interface number 0 [ 1531.380353][ T5887] usb 7-1: config 0 interface 131 has no altsetting 0 [ 1531.396492][ T5887] usb 7-1: New USB device found, idVendor=0421, idProduct=0302, bcdDevice=6c.e1 [ 1531.398461][ T9654] usb 3-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1531.405619][ T5887] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.405641][ T5887] usb 7-1: Product: syz [ 1531.405657][ T5887] usb 7-1: Manufacturer: syz [ 1531.405672][ T5887] usb 7-1: SerialNumber: syz [ 1531.408778][ T5887] usb 7-1: config 0 descriptor?? [ 1531.418938][ T9654] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.449893][ T9654] usb 3-1: Product: syz [ 1531.454043][ T9654] usb 3-1: Manufacturer: syz [ 1531.458911][ T9654] usb 3-1: SerialNumber: syz [ 1531.469743][ T9654] usb 3-1: config 0 descriptor?? [ 1531.477738][ T9654] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1531.515442][T12300] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 1531.588778][ T5929] usb 1-1: string descriptor 0 read error: -71 [ 1531.600302][ T5929] usb 1-1: USB disconnect, device number 15 [ 1531.628786][ T5887] usb 7-1: bad CDC descriptors [ 1531.642051][T18218] netlink: 'syz.0.3504': attribute type 61 has an invalid length. [ 1531.642325][ T5887] cdc_acm 7-1:0.131: Zero length descriptor references [ 1531.661320][T12300] usb 6-1: device descriptor read/64, error -71 [ 1531.667990][ T5887] cdc_acm 7-1:0.131: probe with driver cdc_acm failed with error -22 [ 1531.680539][ T5887] usb 7-1: USB disconnect, device number 43 [ 1531.886602][ T9654] input: sonixb as /devices/platform/dummy_hcd.2/usb3/3-1/input/input189 [ 1531.905533][T12300] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 1532.035126][T12300] usb 6-1: device descriptor read/64, error -71 [ 1532.042515][ T5884] videodev: could not get a free minor [ 1532.048357][ T5884] gspca_main: video_register_device err -23 [ 1532.055091][ T5884] sunplus 4-1:0.0: probe with driver sunplus failed with error -23 [ 1532.098047][ T5884] usb 3-1: USB disconnect, device number 20 [ 1532.146237][T12300] usb usb6-port1: attempt power cycle [ 1532.262371][ T5887] usb 4-1: USB disconnect, device number 12 [ 1532.456208][T18223] FAULT_INJECTION: forcing a failure. [ 1532.456208][T18223] name failslab, interval 1, probability 0, space 0, times 0 [ 1532.469621][T18223] CPU: 1 UID: 0 PID: 18223 Comm: syz.6.3505 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1532.469654][T18223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1532.469667][T18223] Call Trace: [ 1532.469675][T18223] [ 1532.469684][T18223] dump_stack_lvl+0x189/0x250 [ 1532.469714][T18223] ? __pfx____ratelimit+0x10/0x10 [ 1532.469737][T18223] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1532.469760][T18223] ? __pfx__printk+0x10/0x10 [ 1532.469786][T18223] ? __pfx___might_resched+0x10/0x10 [ 1532.469808][T18223] ? fs_reclaim_acquire+0x7d/0x100 [ 1532.469836][T18223] should_fail_ex+0x414/0x560 [ 1532.469863][T18223] should_failslab+0xa8/0x100 [ 1532.469887][T18223] __kmalloc_cache_noprof+0x70/0x3d0 [ 1532.469908][T18223] ? btrfs_get_tree+0x3b6/0x1630 [ 1532.469936][T18223] btrfs_get_tree+0x3b6/0x1630 [ 1532.469962][T18223] ? irqentry_exit+0x74/0x90 [ 1532.469984][T18223] ? __pfx_btrfs_get_tree+0x10/0x10 [ 1532.470015][T18223] ? __pfx_btrfs_get_tree+0x10/0x10 [ 1532.470048][T18223] vfs_get_tree+0x8f/0x2b0 [ 1532.470072][T18223] vfs_cmd_create+0xa2/0x200 [ 1532.470093][T18223] __se_sys_fsconfig+0x78e/0x8d0 [ 1532.470117][T18223] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 1532.470149][T18223] ? do_syscall_64+0xbe/0x3b0 [ 1532.470168][T18223] ? __x64_sys_fsconfig+0x20/0xc0 [ 1532.470188][T18223] do_syscall_64+0xfa/0x3b0 [ 1532.470210][T18223] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1532.470227][T18223] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1532.470244][T18223] ? clear_bhb_loop+0x60/0xb0 [ 1532.470266][T18223] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1532.470282][T18223] RIP: 0033:0x7fd26698e929 [ 1532.470300][T18223] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1532.470315][T18223] RSP: 002b:00007fd2647b4038 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 1532.470334][T18223] RAX: ffffffffffffffda RBX: 00007fd266bb6160 RCX: 00007fd26698e929 [ 1532.470348][T18223] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000007 [ 1532.470359][T18223] RBP: 00007fd2647b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1532.470370][T18223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1532.470380][T18223] R13: 0000000000000000 R14: 00007fd266bb6160 R15: 00007ffc1f4b68d8 [ 1532.470406][T18223] [ 1532.840317][T12300] usb 6-1: new high-speed USB device number 91 using dummy_hcd [ 1532.867547][T12300] usb 6-1: device descriptor read/8, error -71 [ 1534.085024][T12300] usb 6-1: new high-speed USB device number 92 using dummy_hcd [ 1534.135792][T12300] usb 6-1: device descriptor read/8, error -71 [ 1534.421394][T12300] usb usb6-port1: unable to enumerate USB device [ 1534.557996][ T5887] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1534.779077][ T5887] usb 3-1: Using ep0 maxpacket: 32 [ 1534.890285][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1535.039027][ T5887] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1535.196367][ T5887] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1535.230264][ T5887] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1535.245675][ T5887] usb 3-1: config 0 descriptor?? [ 1535.915129][ T5887] hub 3-1:0.0: USB hub found [ 1536.124675][T18254] netlink: 'syz.6.3516': attribute type 61 has an invalid length. [ 1536.164881][ T5887] hub 3-1:0.0: 1 port detected [ 1536.188250][T18256] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1537.090539][ T5929] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1537.615544][ T5929] usb 4-1: Using ep0 maxpacket: 32 [ 1537.631587][ T5887] usb 3-1: USB disconnect, device number 21 [ 1537.663206][ T5929] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1537.690347][T18266] netlink: 20 bytes leftover after parsing attributes in process `syz.5.3518'. [ 1537.725556][ T5929] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1537.859324][ T5929] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1537.949457][ T5929] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1538.427977][T18263] syz.0.3515 (18263) used greatest stack depth: 16176 bytes left [ 1538.492636][ T5929] usb 4-1: config 0 descriptor?? [ 1538.532502][ T5929] usb 4-1: can't set config #0, error -71 [ 1538.553139][ T5929] usb 4-1: USB disconnect, device number 13 [ 1538.627181][T18272] input: syz0 as /devices/virtual/input/input190 [ 1540.341990][ T5929] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1541.385313][ T5929] usb 3-1: Using ep0 maxpacket: 32 [ 1541.406495][ T5929] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1541.421712][T18303] netlink: 'syz.3.3530': attribute type 61 has an invalid length. [ 1541.441049][ T5929] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1541.464999][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1541.492248][ T5929] usb 3-1: Product: syz [ 1541.503967][ T5929] usb 3-1: Manufacturer: syz [ 1541.509104][ T5929] usb 3-1: SerialNumber: syz [ 1541.528125][ T5929] usb 3-1: config 0 descriptor?? [ 1541.543972][T18288] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1541.552236][ T5929] hub 3-1:0.0: bad descriptor, ignoring hub [ 1541.559002][ T5929] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1541.865448][ T9] usb 3-1: USB disconnect, device number 22 [ 1541.975142][ T5929] usb 6-1: new high-speed USB device number 93 using dummy_hcd [ 1542.005148][ T5842] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 1542.175117][ T5842] usb 7-1: Using ep0 maxpacket: 32 [ 1542.175254][ T5929] usb 6-1: Using ep0 maxpacket: 32 [ 1542.187360][ T5842] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1542.188332][ T5929] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1542.208608][ T5929] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1542.212365][ T5842] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1542.219019][ T5929] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1542.236321][ T5842] usb 7-1: config 0 descriptor?? [ 1542.236464][ T5929] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1542.248614][ T5842] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1542.282314][ T5929] usb 6-1: config 0 descriptor?? [ 1542.299553][ T5929] hub 6-1:0.0: USB hub found [ 1542.509515][ T5929] hub 6-1:0.0: 1 port detected [ 1542.527328][T18319] [U] M٭Q& K4 [ 1542.532763][T18319] [U] [)U}ǔJϬ}NSEF* NZF[F_H'W"X~;VA)^`1C':ZFOB *?۟CZS<8ZNѷјEY TT<$CRƖ/VG {Y~Y5\;ƃZDXYA"XIF{`A$í55?SAMOͻ*K [ 1545.138853][ T5842] gspca_vc032x: reg_w err -71 [ 1545.143587][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1545.226618][ T5929] hub 6-1:0.0: hub_ext_port_status failed (err = -32) [ 1545.247672][ T9] usb 6-1: USB disconnect, device number 93 [ 1545.266371][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1545.294187][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1545.314452][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1545.325267][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1545.330720][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1545.420705][T18335] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1545.575297][ T5929] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1545.755019][ T5929] usb 4-1: Using ep0 maxpacket: 8 [ 1545.800381][ T5929] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1545.902226][ T5929] usb 4-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=21.c6 [ 1545.943194][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.967463][ T5929] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1545.980180][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1545.994200][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.000705][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.009579][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.009882][ T5929] usb 4-1: config 0 descriptor?? [ 1546.031675][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.059386][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.072751][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.078247][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.084119][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.090016][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.095832][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.105806][ T5842] gspca_vc032x: I2c Bus Busy Wait 00 [ 1546.111411][ T5842] gspca_vc032x: Unknown sensor... [ 1546.117231][ T5842] vc032x 7-1:0.0: probe with driver vc032x failed with error -22 [ 1546.199894][ T5842] usb 7-1: USB disconnect, device number 44 [ 1546.243605][ T5929] usb 4-1: USB disconnect, device number 14 [ 1546.505027][ T9] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1546.531740][T18350] netlink: 'syz.6.3545': attribute type 61 has an invalid length. [ 1546.645692][ T9] usb 3-1: device descriptor read/64, error -71 [ 1546.715255][ T5842] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1546.865191][ T5842] usb 1-1: Using ep0 maxpacket: 32 [ 1546.874617][ T5842] usb 1-1: config 0 has an invalid interface number: 2 but max is 0 [ 1546.883407][ T5842] usb 1-1: config 0 has no interface number 0 [ 1546.890900][ T5842] usb 1-1: config 0 interface 2 has no altsetting 0 [ 1546.900675][ T5842] usb 1-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 1546.910264][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.915172][ T9] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1546.930958][ T5842] usb 1-1: Product: syz [ 1546.935605][ T5842] usb 1-1: Manufacturer: syz [ 1546.941750][ T5842] usb 1-1: SerialNumber: syz [ 1546.971063][ T5842] usb 1-1: config 0 descriptor?? [ 1547.065120][ T9] usb 3-1: device descriptor read/64, error -71 [ 1547.222733][T18358] FAULT_INJECTION: forcing a failure. [ 1547.222733][T18358] name failslab, interval 1, probability 0, space 0, times 0 [ 1547.235629][T18358] CPU: 1 UID: 0 PID: 18358 Comm: syz.5.3548 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1547.235654][T18358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1547.235666][T18358] Call Trace: [ 1547.235674][T18358] [ 1547.235683][T18358] dump_stack_lvl+0x189/0x250 [ 1547.235711][T18358] ? __pfx____ratelimit+0x10/0x10 [ 1547.235733][T18358] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1547.235756][T18358] ? __pfx__printk+0x10/0x10 [ 1547.235780][T18358] ? __pfx___might_resched+0x10/0x10 [ 1547.235803][T18358] ? fs_reclaim_acquire+0x7d/0x100 [ 1547.235832][T18358] should_fail_ex+0x414/0x560 [ 1547.235860][T18358] should_failslab+0xa8/0x100 [ 1547.235884][T18358] __kmalloc_cache_noprof+0x70/0x3d0 [ 1547.235922][T18358] ? __io_uring_add_tctx_node+0x149/0x4e0 [ 1547.235947][T18358] __io_uring_add_tctx_node+0x149/0x4e0 [ 1547.235970][T18358] ? __pfx___io_uring_add_tctx_node+0x10/0x10 [ 1547.235988][T18358] ? __fget_files+0x2a/0x420 [ 1547.236014][T18358] ? __fget_files+0x2a/0x420 [ 1547.236039][T18358] __io_uring_add_tctx_node_from_submit+0x91/0x120 [ 1547.236062][T18358] __se_sys_io_uring_enter+0x2505/0x2b20 [ 1547.236100][T18358] ? trace_irq_disable+0x37/0x110 [ 1547.236121][T18358] ? preempt_schedule_irq+0xde/0x150 [ 1547.236141][T18358] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 1547.236162][T18358] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1547.236191][T18358] ? irqentry_exit+0x74/0x90 [ 1547.236211][T18358] ? lockdep_hardirqs_on+0x9c/0x150 [ 1547.236245][T18358] ? fput+0xa0/0xd0 [ 1547.236262][T18358] ? ksys_write+0x22a/0x250 [ 1547.236284][T18358] ? __pfx_ksys_write+0x10/0x10 [ 1547.236302][T18358] ? rcu_is_watching+0x15/0xb0 [ 1547.236331][T18358] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1547.236356][T18358] do_syscall_64+0xfa/0x3b0 [ 1547.236378][T18358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1547.236395][T18358] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1547.236411][T18358] ? clear_bhb_loop+0x60/0xb0 [ 1547.236432][T18358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1547.236449][T18358] RIP: 0033:0x7fd19fd8e929 [ 1547.236466][T18358] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1547.236481][T18358] RSP: 002b:00007fd1a0b27038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1547.236499][T18358] RAX: ffffffffffffffda RBX: 00007fd19ffb6080 RCX: 00007fd19fd8e929 [ 1547.236513][T18358] RDX: 0000000000000300 RSI: 0000000000003516 RDI: 0000000000000004 [ 1547.236524][T18358] RBP: 00007fd1a0b27090 R08: 0000000000000000 R09: 0000000000000000 [ 1547.236535][T18358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1547.236546][T18358] R13: 0000000000000001 R14: 00007fd19ffb6080 R15: 00007fffa8f779b8 [ 1547.236575][T18358] [ 1547.239466][ T5842] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1547.737361][ T5929] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1547.901609][ T9] usb usb3-port1: attempt power cycle [ 1548.227993][ T5842] usb 1-1: USB disconnect, device number 16 [ 1548.398529][T18365] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3549'. [ 1548.813588][T18367] FAULT_INJECTION: forcing a failure. [ 1548.813588][T18367] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1548.826788][T18367] CPU: 1 UID: 0 PID: 18367 Comm: syz.5.3550 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1548.826813][T18367] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1548.826824][T18367] Call Trace: [ 1548.826832][T18367] [ 1548.826841][T18367] dump_stack_lvl+0x189/0x250 [ 1548.826869][T18367] ? __pfx____ratelimit+0x10/0x10 [ 1548.826892][T18367] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1548.826915][T18367] ? __pfx__printk+0x10/0x10 [ 1548.826933][T18367] ? __might_fault+0xb0/0x130 [ 1548.826966][T18367] should_fail_ex+0x414/0x560 [ 1548.826999][T18367] _copy_from_user+0x2d/0xb0 [ 1548.827019][T18367] memdup_user+0x5e/0xd0 [ 1548.827037][T18367] strndup_user+0x68/0xd0 [ 1548.827054][T18367] __se_sys_add_key+0x1af/0x400 [ 1548.827078][T18367] ? __pfx___se_sys_add_key+0x10/0x10 [ 1548.827107][T18367] ? do_syscall_64+0xbe/0x3b0 [ 1548.827126][T18367] ? __x64_sys_add_key+0x20/0xc0 [ 1548.827149][T18367] do_syscall_64+0xfa/0x3b0 [ 1548.827168][T18367] ? lockdep_hardirqs_on+0x9c/0x150 [ 1548.827189][T18367] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.827206][T18367] ? clear_bhb_loop+0x60/0xb0 [ 1548.827227][T18367] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.827245][T18367] RIP: 0033:0x7fd19fd8e929 [ 1548.827261][T18367] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1548.827276][T18367] RSP: 002b:00007fd1a0b39038 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 1548.827295][T18367] RAX: ffffffffffffffda RBX: 00007fd19ffb6160 RCX: 00007fd19fd8e929 [ 1548.827309][T18367] RDX: 0000200000000100 RSI: 0000200000000180 RDI: 0000200000000140 [ 1548.827322][T18367] RBP: 00007fd1a0b39090 R08: fffffffffffffffe R09: 0000000000000000 [ 1548.827334][T18367] R10: 00000000000000ca R11: 0000000000000246 R12: 0000000000000001 [ 1548.827346][T18367] R13: 0000000000000000 R14: 00007fd19ffb6160 R15: 00007fffa8f779b8 [ 1548.827375][T18367] [ 1549.164211][T18369] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1549.244231][ T5929] usb 4-1: Using ep0 maxpacket: 32 [ 1549.249465][ T9] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1549.260362][ T5929] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1549.273044][ T5929] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1549.455575][ T9654] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 1549.490482][ T5929] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1549.499464][ T9] usb 3-1: device descriptor read/8, error -71 [ 1549.513642][ T5929] usb 4-1: Product: syz [ 1549.518607][ T5929] usb 4-1: Manufacturer: syz [ 1549.523345][ T5929] usb 4-1: SerialNumber: syz [ 1549.531211][ T5929] usb 4-1: config 0 descriptor?? [ 1549.537891][T18355] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 1549.551686][ T5929] hub 4-1:0.0: bad descriptor, ignoring hub [ 1549.557939][ T5929] hub 4-1:0.0: probe with driver hub failed with error -5 [ 1549.785270][ T9654] usb 7-1: Using ep0 maxpacket: 32 [ 1550.155512][ T9654] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1550.165146][ T9654] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1550.176103][ T9654] usb 7-1: config 0 descriptor?? [ 1550.185196][ T9654] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1550.305724][ T5842] usb 4-1: USB disconnect, device number 15 [ 1551.349903][ T9654] gspca_vc032x: reg_r err -110 [ 1551.395931][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.428576][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.465059][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.481515][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.494756][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.511742][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.527901][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.536459][T18385] 9pnet_fd: Insufficient options for proto=fd [ 1551.702760][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.708184][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.713489][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.720097][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.740851][T18397] netlink: 'syz.2.3558': attribute type 27 has an invalid length. [ 1551.774453][T18397] erspan1: left promiscuous mode [ 1551.796417][T18397] erspan1: left allmulticast mode [ 1551.801557][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.865083][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.887802][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.909466][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.914801][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.939897][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.949139][ T9654] gspca_vc032x: I2c Bus Busy Wait 00 [ 1551.954456][ T9654] gspca_vc032x: Unknown sensor... [ 1551.967896][ T9654] vc032x 7-1:0.0: probe with driver vc032x failed with error -22 [ 1552.122760][T18410] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1553.875109][T12300] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1553.915818][T18430] kAFS: unparsable volume name [ 1553.922684][T18432] tipc: Started in network mode [ 1553.935278][T18432] tipc: Node identity 6a6c54076348, cluster identity 4711 [ 1553.942680][T18432] tipc: Enabled bearer , priority 0 [ 1554.025043][T12300] usb 1-1: Using ep0 maxpacket: 32 [ 1554.032703][T12300] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1554.036133][ T9654] usb 7-1: USB disconnect, device number 45 [ 1554.049161][T18432] syzkaller0: entered promiscuous mode [ 1554.057124][T18432] syzkaller0: entered allmulticast mode [ 1554.067353][T12300] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1554.069392][T18432] tipc: Resetting bearer [ 1554.094672][T12300] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1554.103401][T12300] usb 1-1: Product: syz [ 1554.107862][T12300] usb 1-1: Manufacturer: syz [ 1554.112544][T12300] usb 1-1: SerialNumber: syz [ 1554.117472][T18431] tipc: Resetting bearer [ 1554.131601][T12300] usb 1-1: config 0 descriptor?? [ 1554.139099][T18427] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1554.149471][T12300] hub 1-1:0.0: bad descriptor, ignoring hub [ 1554.160123][T12300] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1555.201485][ T5842] tipc: Node number set to 153375751 [ 1555.207418][ T5884] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1555.596392][T12300] usb 1-1: USB disconnect, device number 17 [ 1556.109254][ T5884] usb 3-1: device descriptor read/64, error -71 [ 1556.248173][T18452] trusted_key: encrypted_key: key user:syz not found [ 1556.385576][ T5884] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1556.777283][ T5884] usb 3-1: device descriptor read/64, error -71 [ 1557.060762][ T5884] usb usb3-port1: attempt power cycle [ 1558.059451][T18471] openvswitch: netlink: IP tunnel dst address not specified [ 1558.335228][ T5842] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1558.510816][ T5842] usb 1-1: Using ep0 maxpacket: 32 [ 1558.533831][ T5842] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 1558.554993][ T5842] usb 1-1: config 0 has no interface number 0 [ 1558.584327][ T5842] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1558.596619][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1558.604640][ T5842] usb 1-1: Product: syz [ 1558.611027][ T5842] usb 1-1: Manufacturer: syz [ 1558.627227][ T5842] usb 1-1: SerialNumber: syz [ 1558.637315][ T5842] usb 1-1: config 0 descriptor?? [ 1558.653145][ T5842] smsc95xx v2.0.0 [ 1558.699078][T12300] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1558.861353][T12300] usb 3-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1558.870911][T12300] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1558.892862][T12300] usb 3-1: Product: syz [ 1558.900388][T12300] usb 3-1: Manufacturer: syz [ 1558.908716][T12300] usb 3-1: SerialNumber: syz [ 1558.917036][T12300] usb 3-1: config 0 descriptor?? [ 1558.929113][T12300] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1559.310100][ T5842] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 1559.321911][ T5842] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1559.331547][ T5842] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1559.343365][ T5842] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 1559.347986][T12300] input: sonixb as /devices/platform/dummy_hcd.2/usb3/3-1/input/input192 [ 1559.354772][ T5842] usb 1-1: USB disconnect, device number 18 [ 1559.564602][ T5842] usb 3-1: USB disconnect, device number 30 [ 1560.182191][ T5842] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1560.385257][ T5842] usb 1-1: Using ep0 maxpacket: 32 [ 1560.426503][ T5842] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1560.507185][ T5842] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1560.539718][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1560.583435][ T5842] usb 1-1: Product: syz [ 1560.605224][ T5842] usb 1-1: Manufacturer: syz [ 1560.617474][T18431] tipc: Disabling bearer [ 1560.634061][ T5842] usb 1-1: SerialNumber: syz [ 1560.719865][ T5842] usb 1-1: config 0 descriptor?? [ 1560.769974][T18485] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1560.894138][ T5842] hub 1-1:0.0: bad descriptor, ignoring hub [ 1560.964328][ T5842] hub 1-1:0.0: probe with driver hub failed with error -5 [ 1561.218794][ T5842] usb 1-1: USB disconnect, device number 19 [ 1562.987981][T18518] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3593'. [ 1562.997204][T18518] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3593'. [ 1563.055388][T12300] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1563.108134][T18519] evm: overlay not supported [ 1563.827121][T18522] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3596'. [ 1563.895715][T12300] usb 1-1: device descriptor read/64, error -71 [ 1563.940692][T18528] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1564.105215][ T5842] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1564.105674][ T5929] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 1564.436294][T12300] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 1564.529092][ T5842] usb 4-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1564.543489][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1564.556214][ T5842] usb 4-1: Product: syz [ 1564.561561][ T5842] usb 4-1: Manufacturer: syz [ 1564.570739][ T5842] usb 4-1: SerialNumber: syz [ 1564.585199][T12300] usb 1-1: device descriptor read/64, error -71 [ 1564.629865][ T5929] usb 3-1: Using ep0 maxpacket: 32 [ 1564.650751][ T5929] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1564.665568][ T5929] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1564.684252][ T5842] usb 4-1: config 0 descriptor?? [ 1564.691535][ T5929] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1564.694851][ T5842] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1564.704110][T12300] usb usb1-port1: attempt power cycle [ 1564.732575][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1564.752429][ T5929] usb 3-1: config 0 descriptor?? [ 1564.779267][ T5929] hub 3-1:0.0: USB hub found [ 1564.983896][ T5929] hub 3-1:0.0: 1 port detected [ 1565.065114][T12300] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1565.086291][T12300] usb 1-1: device descriptor read/8, error -71 [ 1565.100904][ T5842] input: sonixb as /devices/platform/dummy_hcd.3/usb4/4-1/input/input193 [ 1565.321100][ T5887] usb 4-1: USB disconnect, device number 16 [ 1565.328739][T12300] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 1565.368283][T12300] usb 1-1: device descriptor read/8, error -71 [ 1565.386058][T18520] netlink: 'syz.2.3595': attribute type 7 has an invalid length. [ 1565.489452][T12300] usb usb1-port1: unable to enumerate USB device [ 1565.944271][T12300] hub 3-1:0.0: activate --> -90 [ 1567.086684][ T5884] usb 3-1: USB disconnect, device number 31 [ 1567.166494][ T5842] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 1567.605097][ T5842] usb 4-1: Using ep0 maxpacket: 32 [ 1567.623056][ T5842] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1567.788822][T12300] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 1568.277015][ T5842] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1568.287322][ T5842] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1568.298717][ T5842] usb 4-1: Product: syz [ 1568.303019][ T5842] usb 4-1: Manufacturer: syz [ 1568.308142][ T5842] usb 4-1: SerialNumber: syz [ 1568.334581][ T5842] usb 4-1: config 0 descriptor?? [ 1568.379911][T18546] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1568.431851][T12300] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1568.444025][T12300] usb 7-1: config 0 has no interfaces? [ 1568.453080][ T5842] hub 4-1:0.0: bad descriptor, ignoring hub [ 1568.462313][T12300] usb 7-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 1568.482512][ T5842] hub 4-1:0.0: probe with driver hub failed with error -5 [ 1568.491895][T12300] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1568.511747][T18563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3609'. [ 1568.522342][T12300] usb 7-1: config 0 descriptor?? [ 1568.765265][ T5884] usb 4-1: USB disconnect, device number 17 [ 1568.795253][T12300] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1568.828523][ T5842] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 1568.945000][T12300] usb 3-1: Using ep0 maxpacket: 8 [ 1568.953029][T12300] usb 3-1: config index 0 descriptor too short (expected 16411, got 27) [ 1568.962662][T12300] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1568.981771][T12300] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1568.991313][T12300] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1569.001449][T12300] usb 3-1: Product: syz [ 1569.004987][ T5842] usb 1-1: Using ep0 maxpacket: 16 [ 1569.006664][T12300] usb 3-1: Manufacturer: syz [ 1569.017690][T12300] usb 3-1: SerialNumber: syz [ 1569.025497][ T5842] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1569.035438][ T5842] usb 1-1: config 9 has an invalid interface number: 243 but max is 2 [ 1569.037306][T12300] usb 3-1: config 0 descriptor?? [ 1569.049494][ T5842] usb 1-1: config 9 has an invalid interface number: 243 but max is 2 [ 1569.060179][ T5842] usb 1-1: config 9 has an invalid interface number: 35 but max is 2 [ 1569.068466][ T5842] usb 1-1: config 9 has 2 interfaces, different from the descriptor's value: 3 [ 1569.077635][ T5842] usb 1-1: config 9 has no interface number 0 [ 1569.083795][ T5842] usb 1-1: config 9 has no interface number 1 [ 1569.100423][ T5842] usb 1-1: config 9 interface 35 altsetting 7 bulk endpoint 0x6 has invalid maxpacket 64 [ 1569.110591][ T5842] usb 1-1: config 9 interface 243 has no altsetting 0 [ 1569.121407][ T5842] usb 1-1: config 9 interface 243 has no altsetting 1 [ 1569.129707][ T5842] usb 1-1: config 9 interface 35 has no altsetting 0 [ 1569.143094][ T5842] usb 1-1: New USB device found, idVendor=12d1, idProduct=6456, bcdDevice=89.a6 [ 1569.153382][ T5842] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1569.160721][T12300] streamzap 3-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 1569.169792][ T5842] usb 1-1: Product: 쭦撝ᏽ㌨끼赛ϰ㴒﫟ꊺਏ괰ꉛ眎珶╼뤨虇㇣ژ兲虰诔긁욝㡬恁抩霶췄ﰅ糭㑨䜙闼躻ﮇ⿷ᎄ [ 1569.185925][ T5842] usb 1-1: Manufacturer: 猴얫狀Α軫쟵⡦呱듁꫞좋弮焱Ἆ䌹쬇돍䍇ั磬ᧀ쀡铈ཀ௶م趄窊痂명쎎歅ꗴ쟾⧷贎↬俹郏ḓ懹뾉睔ߐ籀桀榖샼螄펂䤥埯僝纓썞䋲঳禃䌗䠗쥷挩磏얐ꮆ愤┱Ὶ௔챼잓ꇸ튶豒ਵ喞끊ớ庩⥠ܠ蕣椇繁꼳裡鼪ዙ烼抩撧㕒პ쮏 [ 1569.222695][ T5842] usb 1-1: SerialNumber: 팾갊鉔綥正褷େ蘱囿樤委䟉㵬ꏷ䭵繋厝씘뼑獟돂ଏ筧榝僱⑜寤鮽絓ஓ锆᳁篣曕犛됓ੴ룸꒱ꄮ삞䕵䎏׭⼻娴䄌쥘ࠑ鑝༦憥㩬垁힣嗜ﯜᨈ櫎঳掰ݧ煃㫡ꪘ漳ᚮ䋉ѱ彀鈡ﵴ䁙퓳옡㹜⬓撸ᯐ莛䮁╶ꪆꜵ鶅ꥉ飉肜⮸鳰쟄塷눇鋡 [ 1569.401844][T12300] usb 3-1: USB disconnect, device number 32 [ 1569.491887][ T5842] option 1-1:9.243: GSM modem (1-port) converter detected [ 1569.524258][ T5842] usb 1-1: USB disconnect, device number 24 [ 1569.559609][ T5842] option 1-1:9.243: device disconnected [ 1570.137666][T18581] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1570.460758][ T5842] usb 1-1: new high-speed USB device number 25 using dummy_hcd [ 1571.067971][ T5842] usb 1-1: device descriptor read/64, error -71 [ 1571.166294][ T5884] usb 7-1: USB disconnect, device number 46 [ 1571.294785][T18593] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3621'. [ 1571.425057][ T5842] usb 1-1: new high-speed USB device number 26 using dummy_hcd [ 1572.969119][T18601] overlayfs: failed to resolve './file0': -2 [ 1573.006692][T18605] netlink: 'syz.6.3622': attribute type 1 has an invalid length. [ 1573.066195][ T5842] usb 1-1: device descriptor read/64, error -71 [ 1573.185392][ T5842] usb usb1-port1: attempt power cycle [ 1573.189095][T18618] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1573.319166][T12300] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 1573.395160][T16080] usb 3-1: new full-speed USB device number 33 using dummy_hcd [ 1574.015509][T12300] usb 4-1: Using ep0 maxpacket: 32 [ 1574.102045][T16080] usb 3-1: config 0 has an invalid interface number: 8 but max is 0 [ 1574.111067][T16080] usb 3-1: config 0 has no interface number 0 [ 1574.126701][T16080] usb 3-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0xF1, changing to 0x81 [ 1574.133640][T12300] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1574.173743][T16080] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x81 has an invalid bInterval 223, changing to 4 [ 1574.179990][T12300] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1574.196385][T12300] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1574.204746][T12300] usb 4-1: Product: syz [ 1574.210531][T12300] usb 4-1: Manufacturer: syz [ 1574.217997][T12300] usb 4-1: SerialNumber: syz [ 1574.220601][T16080] usb 3-1: config 0 interface 8 altsetting 0 endpoint 0x81 has invalid maxpacket 51017, setting to 1023 [ 1574.227665][T12300] usb 4-1: config 0 descriptor?? [ 1574.255042][T16080] usb 3-1: config 0 interface 8 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1574.262312][T18603] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1574.294072][T16080] usb 3-1: New USB device found, idVendor=100d, idProduct=cb01, bcdDevice=27.41 [ 1574.296991][T12300] hub 4-1:0.0: bad descriptor, ignoring hub [ 1574.312744][T12300] hub 4-1:0.0: probe with driver hub failed with error -5 [ 1574.355096][T16080] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1574.368674][T16080] usb 3-1: config 0 descriptor?? [ 1574.405671][T16080] cxacru 3-1:0.8: cxacru_bind: interface has incorrect endpoints [ 1574.416298][T16080] cxacru 3-1:0.8: usbatm_usb_probe: bind failed: -19! [ 1574.447597][T18631] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3633'. [ 1574.462550][T18629] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1574.817746][T16080] usb 4-1: USB disconnect, device number 18 [ 1575.122339][T12300] usb 3-1: USB disconnect, device number 33 [ 1575.275008][T18638] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3634'. [ 1576.014598][T18643] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 1577.100734][T18657] FAULT_INJECTION: forcing a failure. [ 1577.100734][T18657] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1577.100767][T18657] CPU: 1 UID: 0 PID: 18657 Comm: syz.2.3639 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1577.100790][T18657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1577.100801][T18657] Call Trace: [ 1577.100810][T18657] [ 1577.100819][T18657] dump_stack_lvl+0x189/0x250 [ 1577.100847][T18657] ? __pfx____ratelimit+0x10/0x10 [ 1577.100870][T18657] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1577.100893][T18657] ? __pfx__printk+0x10/0x10 [ 1577.100912][T18657] ? __might_fault+0xb0/0x130 [ 1577.100944][T18657] should_fail_ex+0x414/0x560 [ 1577.100971][T18657] _copy_from_user+0x2d/0xb0 [ 1577.101002][T18657] do_handle_open+0x4a0/0x850 [ 1577.101031][T18657] ? __pfx_do_handle_open+0x10/0x10 [ 1577.101053][T18657] ? ksys_write+0x22a/0x250 [ 1577.101076][T18657] ? __pfx_ksys_write+0x10/0x10 [ 1577.101094][T18657] ? rcu_is_watching+0x15/0xb0 [ 1577.101122][T18657] ? do_syscall_64+0xbe/0x3b0 [ 1577.101147][T18657] do_syscall_64+0xfa/0x3b0 [ 1577.101167][T18657] ? lockdep_hardirqs_on+0x9c/0x150 [ 1577.101188][T18657] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.101205][T18657] ? clear_bhb_loop+0x60/0xb0 [ 1577.101227][T18657] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1577.101243][T18657] RIP: 0033:0x7f59c898e929 [ 1577.101259][T18657] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1577.101275][T18657] RSP: 002b:00007f59c974f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000130 [ 1577.101294][T18657] RAX: ffffffffffffffda RBX: 00007f59c8bb6160 RCX: 00007f59c898e929 [ 1577.101307][T18657] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 1577.101319][T18657] RBP: 00007f59c974f090 R08: 0000000000000000 R09: 0000000000000000 [ 1577.101331][T18657] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1577.101342][T18657] R13: 0000000000000000 R14: 00007f59c8bb6160 R15: 00007ffce5d28ef8 [ 1577.101371][T18657] [ 1578.622846][T18671] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3644'. [ 1579.081035][T16080] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 1579.265026][T16080] usb 4-1: device descriptor read/64, error -71 [ 1579.515164][T16080] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 1579.966230][T16080] usb 4-1: device descriptor read/64, error -71 [ 1580.099260][T16080] usb usb4-port1: attempt power cycle [ 1580.609601][T18692] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1580.805288][T16080] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 1580.837595][T16080] usb 4-1: Using ep0 maxpacket: 32 [ 1580.936034][T16080] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1581.213537][T18705] tipc: Enabling of bearer rejected, failed to enable media [ 1581.679088][T16080] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1581.688398][T16080] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1581.696898][T16080] usb 4-1: Product: syz [ 1581.701076][T16080] usb 4-1: Manufacturer: syz [ 1581.713746][T16080] usb 4-1: SerialNumber: syz [ 1581.734228][T16080] usb 4-1: config 0 descriptor?? [ 1581.746508][T18685] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1581.754518][T16080] hub 4-1:0.0: bad descriptor, ignoring hub [ 1581.764288][T16080] hub 4-1:0.0: probe with driver hub failed with error -5 [ 1581.842134][T18696] netlink: 'syz.2.3652': attribute type 3 has an invalid length. [ 1581.850054][T18696] netlink: 'syz.2.3652': attribute type 1 has an invalid length. [ 1582.096998][ T5929] usb 4-1: USB disconnect, device number 21 [ 1582.245459][T16080] usb 6-1: new high-speed USB device number 94 using dummy_hcd [ 1582.405045][T16080] usb 6-1: Using ep0 maxpacket: 32 [ 1582.415712][T16080] usb 6-1: no configurations [ 1582.425600][T16080] usb 6-1: can't read configurations, error -22 [ 1582.565116][T16080] usb 6-1: new high-speed USB device number 95 using dummy_hcd [ 1582.577174][T18725] batadv0: entered allmulticast mode [ 1582.735657][T16080] usb 6-1: Using ep0 maxpacket: 32 [ 1582.747908][T16080] usb 6-1: no configurations [ 1582.758919][T16080] usb 6-1: can't read configurations, error -22 [ 1582.777915][T16080] usb usb6-port1: attempt power cycle [ 1583.315983][T16080] usb 6-1: new high-speed USB device number 96 using dummy_hcd [ 1583.338691][T16080] usb 6-1: Using ep0 maxpacket: 32 [ 1583.339125][T16080] usb 6-1: no configurations [ 1583.339136][T16080] usb 6-1: can't read configurations, error -22 [ 1583.465403][T16080] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 1583.487803][T16080] usb 6-1: Using ep0 maxpacket: 32 [ 1583.498185][T16080] usb 6-1: no configurations [ 1583.502934][T16080] usb 6-1: can't read configurations, error -22 [ 1583.505297][T18735] FAULT_INJECTION: forcing a failure. [ 1583.505297][T18735] name failslab, interval 1, probability 0, space 0, times 0 [ 1583.523497][T18735] CPU: 0 UID: 0 PID: 18735 Comm: syz.6.3662 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1583.523524][T18735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1583.523535][T18735] Call Trace: [ 1583.523543][T18735] [ 1583.523552][T18735] dump_stack_lvl+0x189/0x250 [ 1583.523574][T18735] ? irqentry_exit+0x74/0x90 [ 1583.523588][T18735] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1583.523612][T18735] should_fail_ex+0x414/0x560 [ 1583.523628][T18735] should_failslab+0xa8/0x100 [ 1583.523643][T18735] __kmalloc_cache_noprof+0x70/0x3d0 [ 1583.523655][T18735] ? binder_get_thread+0x1c8/0x6d0 [ 1583.523669][T18735] binder_get_thread+0x1c8/0x6d0 [ 1583.523682][T18735] binder_ioctl+0x273/0x19c0 [ 1583.523692][T18735] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1583.523707][T18735] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1583.523719][T18735] ? tomoyo_path_number_perm+0x4e2/0x5a0 [ 1583.523730][T18735] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1583.523743][T18735] ? __pfx_binder_ioctl+0x10/0x10 [ 1583.523752][T18735] ? smack_log+0xef/0x3f0 [ 1583.523763][T18735] ? __pfx_smack_log+0x10/0x10 [ 1583.523772][T18735] ? smk_access+0x14c/0x4e0 [ 1583.523785][T18735] ? smk_tskacc+0x2fc/0x370 [ 1583.523798][T18735] ? smack_file_ioctl+0x2a9/0x340 [ 1583.523811][T18735] ? __pfx_smack_file_ioctl+0x10/0x10 [ 1583.523827][T18735] ? __fget_files+0x2a/0x420 [ 1583.523841][T18735] ? __fget_files+0x3a0/0x420 [ 1583.523853][T18735] ? __fget_files+0x2a/0x420 [ 1583.523867][T18735] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1583.523882][T18735] ? __pfx_binder_ioctl+0x10/0x10 [ 1583.523892][T18735] __se_sys_ioctl+0xfc/0x170 [ 1583.523905][T18735] do_syscall_64+0xfa/0x3b0 [ 1583.523917][T18735] ? lockdep_hardirqs_on+0x9c/0x150 [ 1583.523929][T18735] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1583.523939][T18735] ? clear_bhb_loop+0x60/0xb0 [ 1583.523951][T18735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1583.523960][T18735] RIP: 0033:0x7fd26698e929 [ 1583.523971][T18735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1583.523980][T18735] RSP: 002b:00007fd2647d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1583.523991][T18735] RAX: ffffffffffffffda RBX: 00007fd266bb6080 RCX: 00007fd26698e929 [ 1583.523999][T18735] RDX: 0000200000000080 RSI: 00000000c0306201 RDI: 0000000000000006 [ 1583.524006][T18735] RBP: 00007fd2647d5090 R08: 0000000000000000 R09: 0000000000000000 [ 1583.524012][T18735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1583.524018][T18735] R13: 0000000000000000 R14: 00007fd266bb6080 R15: 00007ffc1f4b68d8 [ 1583.524033][T18735] [ 1583.524058][T18735] binder: 18733:18735 ioctl c0306201 200000000080 returned -12 [ 1583.849389][T16080] usb usb6-port1: unable to enumerate USB device [ 1583.927123][T18737] binder: 18733:18737 ioctl c0306201 0 returned -14 [ 1584.475024][T18745] bridge0: port 3(team0) entered blocking state [ 1584.481935][T18745] bridge0: port 3(team0) entered disabled state [ 1584.489639][T18745] team0: entered allmulticast mode [ 1584.494867][T18745] team_slave_0: entered allmulticast mode [ 1584.500738][T18745] team_slave_1: entered allmulticast mode [ 1584.516080][T18745] team0: entered promiscuous mode [ 1584.521218][T18745] team_slave_0: entered promiscuous mode [ 1584.528105][T18745] team_slave_1: entered promiscuous mode [ 1585.445224][T16080] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1585.542265][ T5884] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 1585.617639][T16080] usb 3-1: Using ep0 maxpacket: 32 [ 1585.626255][T16080] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 1585.637672][T16080] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1585.655231][ T9654] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 1585.679938][T16080] usb 3-1: config 0 descriptor?? [ 1585.696359][T16080] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 1585.707453][ T5884] usb 4-1: Using ep0 maxpacket: 32 [ 1585.736222][ T5884] usb 4-1: config 0 has an invalid interface number: 2 but max is 0 [ 1585.744612][ T5884] usb 4-1: config 0 has no interface number 0 [ 1585.776067][ T5884] usb 4-1: config 0 interface 2 has no altsetting 0 [ 1585.797183][ T5884] usb 4-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 1585.808988][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1585.825293][ T5884] usb 4-1: Product: syz [ 1585.831781][ T5884] usb 4-1: Manufacturer: syz [ 1585.838731][ T5884] usb 4-1: SerialNumber: syz [ 1585.857948][ T9654] usb 1-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1585.886698][ T5884] usb 4-1: config 0 descriptor?? [ 1585.893560][ T9654] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1585.914873][T16080] gspca_vc032x: reg_r err -32 [ 1585.924169][ T9654] usb 1-1: Product: syz [ 1585.933361][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1585.939956][ T9654] usb 1-1: Manufacturer: syz [ 1585.944709][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1585.950272][ T9654] usb 1-1: SerialNumber: syz [ 1585.955213][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1585.964764][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1585.976544][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1585.982681][ T9654] usb 1-1: config 0 descriptor?? [ 1585.989783][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1585.998947][ T9654] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1586.009590][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.016444][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.022187][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.027752][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.033145][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.039367][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.044761][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.055268][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.065681][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.074823][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.080546][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.086880][T16080] gspca_vc032x: I2c Bus Busy Wait 00 [ 1586.092400][T16080] gspca_vc032x: Unknown sensor... [ 1586.098606][T16080] vc032x 3-1:0.0: probe with driver vc032x failed with error -22 [ 1586.137253][ T5884] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1586.397786][ T5884] usb 4-1: USB disconnect, device number 22 [ 1586.454063][ T9654] usb 1-1: USB disconnect, device number 28 [ 1586.875326][ T5929] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 1586.985788][ T5887] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 1587.050102][ T5929] usb 6-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 1587.059879][ T5929] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1587.068202][ T5929] usb 6-1: Product: syz [ 1587.072488][ T5929] usb 6-1: Manufacturer: syz [ 1587.077235][ T5929] usb 6-1: SerialNumber: syz [ 1587.083675][ T5929] usb 6-1: config 0 descriptor?? [ 1587.090907][ T5929] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 1587.125123][T18746] Bluetooth: hci2: command 0x0405 tx timeout [ 1587.145352][ T5887] usb 7-1: Using ep0 maxpacket: 32 [ 1587.153415][ T5887] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1587.167589][ T5887] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1587.177092][ T5887] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1587.185317][ T5887] usb 7-1: Product: syz [ 1587.189515][ T5887] usb 7-1: Manufacturer: syz [ 1587.194128][ T5887] usb 7-1: SerialNumber: syz [ 1587.200664][ T5887] usb 7-1: config 0 descriptor?? [ 1587.213335][T18765] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1587.222805][ T5887] hub 7-1:0.0: bad descriptor, ignoring hub [ 1587.228970][ T5887] hub 7-1:0.0: probe with driver hub failed with error -5 [ 1587.275143][ T5884] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 1587.426891][ T5884] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 1587.439538][ T5884] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1587.450844][ T5884] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1587.460843][ T5884] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1587.469265][ T5884] usb 1-1: Manufacturer: syz [ 1587.476604][ T5884] usb 1-1: config 0 descriptor?? [ 1587.545052][ T5884] rc_core: IR keymap rc-hauppauge not found [ 1587.551175][ T5884] Registered IR keymap rc-empty [ 1587.556528][ T5887] usb 7-1: USB disconnect, device number 47 [ 1587.561568][ T5884] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 1587.574342][ T5884] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input194 [ 1587.683407][ C1] igorplugusb 1-1:0.0: Error: urb status = -32 [ 1587.691009][ T5887] usb 1-1: USB disconnect, device number 29 [ 1588.065417][ T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1588.101617][ T5929] usb 6-1: USB disconnect, device number 98 [ 1588.226027][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1588.372918][ T10] usb 4-1: no configurations [ 1588.497370][ T10] usb 4-1: can't read configurations, error -22 [ 1588.721439][ T5884] usb 3-1: USB disconnect, device number 34 [ 1588.880829][ T10] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1589.134663][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1589.779546][ T10] usb 4-1: no configurations [ 1589.790994][ T10] usb 4-1: can't read configurations, error -22 [ 1589.805448][ T10] usb usb4-port1: attempt power cycle [ 1590.155069][ T10] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1590.206441][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1590.242403][ T10] usb 4-1: no configurations [ 1590.250028][ T10] usb 4-1: can't read configurations, error -22 [ 1590.315084][T16080] usb 6-1: new high-speed USB device number 99 using dummy_hcd [ 1590.425077][ T10] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1590.455656][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1590.465444][ T10] usb 4-1: no configurations [ 1590.479620][ T10] usb 4-1: can't read configurations, error -22 [ 1590.482688][T16080] usb 6-1: New USB device found, idVendor=0c45, idProduct=608f, bcdDevice=b5.55 [ 1590.493233][ T10] usb usb4-port1: unable to enumerate USB device [ 1590.499304][T16080] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1590.510323][T16080] usb 6-1: Product: syz [ 1590.514816][T16080] usb 6-1: Manufacturer: syz [ 1590.523121][T16080] usb 6-1: SerialNumber: syz [ 1590.543694][T16080] usb 6-1: config 0 descriptor?? [ 1590.555009][ T5884] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1590.564455][T16080] gspca_main: sonixb-2.14.0 probing 0c45:608f [ 1590.715234][ T5884] usb 3-1: Using ep0 maxpacket: 32 [ 1590.723860][ T5884] usb 3-1: config 0 has an invalid interface number: 2 but max is 0 [ 1590.736683][ T5884] usb 3-1: config 0 has no interface number 0 [ 1590.743047][ T5884] usb 3-1: config 0 interface 2 has no altsetting 0 [ 1590.773289][ T5884] usb 3-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 1590.784373][ T5884] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1590.792548][ T5884] usb 3-1: Product: syz [ 1590.797033][ T5884] usb 3-1: Manufacturer: syz [ 1590.801720][ T5884] usb 3-1: SerialNumber: syz [ 1590.822361][ T5884] usb 3-1: config 0 descriptor?? [ 1590.973311][ T10] usb 6-1: USB disconnect, device number 99 [ 1591.043844][ T5884] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1591.364069][ T5884] usb 3-1: USB disconnect, device number 35 [ 1591.454408][T18818] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3686'. [ 1593.453293][T18845] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3693'. [ 1594.678925][T18869] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3702'. [ 1595.725553][T18865] Cannot find add_set index 0 as target [ 1598.502049][ T10] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1598.955210][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 1599.198268][T18902] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1599.238921][ T10] usb 4-1: device descriptor read/all, error -71 [ 1600.162079][ T5842] hid-generic 0000:0000:0000.0029: unknown main item tag 0x0 [ 1600.690435][ T5842] hid-generic 0000:0000:0000.0029: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1600.986266][T18926] openvswitch: netlink: Key 8 has unexpected len 2 expected 40 [ 1601.543335][T18933] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1602.255252][ T10] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 1602.427001][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 1602.438846][T18949] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1602.457540][ T10] usb 1-1: no configurations [ 1602.462186][ T10] usb 1-1: can't read configurations, error -22 [ 1602.545331][ T9654] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 1602.610929][ T10] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 1602.680395][T18955] netlink: 'syz.6.3727': attribute type 5 has an invalid length. [ 1602.716153][ T9654] usb 6-1: Using ep0 maxpacket: 32 [ 1602.778456][ T9654] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1603.061854][ T9654] usb 6-1: config 0 has no interface number 0 [ 1603.088187][ T9654] usb 6-1: config 0 interface 2 has no altsetting 0 [ 1603.088325][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 1603.472703][ T10] usb 1-1: no configurations [ 1603.477633][ T10] usb 1-1: can't read configurations, error -22 [ 1603.484393][ T10] usb usb1-port1: attempt power cycle [ 1603.533137][ T9654] usb 6-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 1603.552714][ T9654] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1603.570155][ T9654] usb 6-1: Product: syz [ 1603.580309][ T9654] usb 6-1: Manufacturer: syz [ 1603.615201][ T9654] usb 6-1: SerialNumber: syz [ 1603.631888][ T9654] usb 6-1: config 0 descriptor?? [ 1603.827420][ T10] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 1603.851541][ T9654] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1604.009843][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 1604.016676][ T10] usb 1-1: no configurations [ 1604.021312][ T10] usb 1-1: can't read configurations, error -22 [ 1604.071890][ T9654] usb 6-1: USB disconnect, device number 100 [ 1604.335480][ T10] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 1604.368970][ T10] usb 1-1: Using ep0 maxpacket: 32 [ 1604.375443][ T10] usb 1-1: no configurations [ 1604.396147][ T10] usb 1-1: can't read configurations, error -22 [ 1604.404492][ T10] usb usb1-port1: unable to enumerate USB device [ 1606.025098][ T5887] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 1606.477675][ T5884] hid-generic 0000:0000:0000.002A: unknown main item tag 0x0 [ 1606.620139][ T5884] hid-generic 0000:0000:0000.002A: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1607.304125][T18991] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1607.455844][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.805436][T18993] netlink: 'syz.0.3739': attribute type 1 has an invalid length. [ 1607.849190][T18993] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1607.861648][T18993] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3739'. [ 1608.673014][T19006] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 1609.885809][ T9] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 1610.075486][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 1610.088436][ T9] usb 6-1: no configurations [ 1610.093388][ T9] usb 6-1: can't read configurations, error -22 [ 1610.111659][T19028] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1610.123509][T19028] infiniband srz1: RDMA CMA: cma_listen_on_dev, error -1 [ 1610.190941][T17378] ------------[ cut here ]------------ [ 1610.196995][T17378] refcount_t: underflow; use-after-free. [ 1610.202851][T17378] WARNING: CPU: 0 PID: 17378 at lib/refcount.c:28 refcount_warn_saturate+0x11a/0x1d0 [ 1610.212599][T17378] Modules linked in: [ 1610.217425][T17378] CPU: 0 UID: 0 PID: 17378 Comm: kbnepd bnep0 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1610.229543][T17378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1610.239635][T17378] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 1610.246369][T17378] Code: 00 65 e1 8b e8 87 ef c9 fc 90 0f 0b 90 90 eb d7 e8 1b 41 06 fd c6 05 f8 cb cf 0a 01 90 48 c7 c7 60 65 e1 8b e8 67 ef c9 fc 90 <0f> 0b 90 90 eb b7 e8 fb 40 06 fd c6 05 d5 cb cf 0a 01 90 48 c7 c7 [ 1610.266205][T17378] RSP: 0018:ffffc9000c8276a0 EFLAGS: 00010246 [ 1610.272267][T17378] RAX: 6caad8d84d128900 RBX: 0000000000000003 RCX: ffff88803105bc00 [ 1610.280250][T17378] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 1610.288421][T17378] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 1610.296528][T17378] R10: dffffc0000000000 R11: fffffbfff1bfaa44 R12: dffffc0000000000 [ 1610.304506][T17378] R13: ffff88805b80d460 R14: ffff88805b80d478 R15: ffffffff85ef1a70 [ 1610.312850][T17378] FS: 0000000000000000(0000) GS:ffff888125c89000(0000) knlGS:0000000000000000 [ 1610.321880][T17378] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1610.328477][T17378] CR2: 00007f59c96e7d60 CR3: 0000000033e86000 CR4: 00000000003526f0 [ 1610.336458][T17378] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1610.344414][T17378] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1610.352393][T17378] Call Trace: [ 1610.355827][T17378] [ 1610.358753][T17378] klist_dec_and_del+0x3c7/0x3d0 [ 1610.363682][T17378] ? __pfx_klist_children_put+0x10/0x10 [ 1610.369246][T17378] klist_del+0xa6/0x110 [ 1610.373387][T17378] device_del+0x280/0x8e0 [ 1610.377727][T17378] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1610.382908][T17378] ? pm_runtime_set_memalloc_noio+0x1f4/0x260 [ 1610.388968][T17378] ? __pfx_device_del+0x10/0x10 [ 1610.394013][T17378] ? netdev_unregister_kobject+0x344/0x450 [ 1610.399952][T17378] unregister_netdevice_many_notify+0x1d52/0x2320 [ 1610.406692][T17378] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 1610.413440][T17378] ? rcu_is_watching+0x15/0xb0 [ 1610.418207][T17378] ? trace_contention_end+0x39/0x120 [ 1610.423473][T17378] ? __mutex_lock+0x330/0xe80 [ 1610.428149][T17378] ? __lock_acquire+0xab9/0xd20 [ 1610.433008][T17378] ? __lock_acquire+0xab9/0xd20 [ 1610.437905][T17378] unregister_netdevice_queue+0x33c/0x380 [ 1610.443620][T17378] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 1610.449874][T17378] ? rtnl_net_dev_lock+0x36/0x2f0 [ 1610.454890][T17378] ? rtnl_net_dev_lock+0x2de/0x2f0 [ 1610.460174][T17378] unregister_netdev+0x1f/0x60 [ 1610.464948][T17378] bnep_session+0x294d/0x2b40 [ 1610.469615][T17378] ? trace_sched_exit_tp+0x38/0x120 [ 1610.474804][T17378] ? __lock_acquire+0xab9/0xd20 [ 1610.479677][T17378] ? __pfx_bnep_session+0x10/0x10 [ 1610.484691][T17378] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1610.490597][T17378] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1610.497123][T17378] ? __pfx_woken_wake_function+0x10/0x10 [ 1610.502740][T17378] ? __kthread_parkme+0x7b/0x200 [ 1610.507970][T17378] ? __kthread_parkme+0x1a1/0x200 [ 1610.512991][T17378] kthread+0x70e/0x8a0 [ 1610.517066][T17378] ? __pfx_bnep_session+0x10/0x10 [ 1610.522074][T17378] ? __pfx_kthread+0x10/0x10 [ 1610.526666][T17378] ? _raw_spin_unlock_irq+0x23/0x50 [ 1610.531861][T17378] ? lockdep_hardirqs_on+0x9c/0x150 [ 1610.537054][T17378] ? __pfx_kthread+0x10/0x10 [ 1610.541623][T17378] ret_from_fork+0x3f9/0x770 [ 1610.546258][T17378] ? __pfx_ret_from_fork+0x10/0x10 [ 1610.551366][T17378] ? __switch_to_asm+0x39/0x70 [ 1610.556335][T17378] ? __switch_to_asm+0x33/0x70 [ 1610.561098][T17378] ? __pfx_kthread+0x10/0x10 [ 1610.565705][T17378] ret_from_fork_asm+0x1a/0x30 [ 1610.570462][T17378] [ 1610.573477][T17378] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1610.580739][T17378] CPU: 0 UID: 0 PID: 17378 Comm: kbnepd bnep0 Not tainted 6.15.0-syzkaller-12058-g64980441d269 #0 PREEMPT(full) [ 1610.592602][T17378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1610.602644][T17378] Call Trace: [ 1610.605902][T17378] [ 1610.608815][T17378] dump_stack_lvl+0x99/0x250 [ 1610.613387][T17378] ? __asan_memcpy+0x40/0x70 [ 1610.617970][T17378] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1610.623153][T17378] ? __pfx__printk+0x10/0x10 [ 1610.627729][T17378] panic+0x2db/0x790 [ 1610.631612][T17378] ? __pfx_panic+0x10/0x10 [ 1610.636008][T17378] ? show_trace_log_lvl+0x4fb/0x550 [ 1610.641195][T17378] ? ret_from_fork_asm+0x1a/0x30 [ 1610.646111][T17378] __warn+0x31b/0x4b0 [ 1610.650081][T17378] ? refcount_warn_saturate+0x11a/0x1d0 [ 1610.655619][T17378] ? refcount_warn_saturate+0x11a/0x1d0 [ 1610.661142][T17378] report_bug+0x2be/0x4f0 [ 1610.665449][T17378] ? refcount_warn_saturate+0x11a/0x1d0 [ 1610.670990][T17378] ? refcount_warn_saturate+0x11a/0x1d0 [ 1610.676549][T17378] ? refcount_warn_saturate+0x11c/0x1d0 [ 1610.682089][T17378] handle_bug+0x84/0x160 [ 1610.686326][T17378] exc_invalid_op+0x1a/0x50 [ 1610.690819][T17378] asm_exc_invalid_op+0x1a/0x20 [ 1610.695647][T17378] RIP: 0010:refcount_warn_saturate+0x11a/0x1d0 [ 1610.701780][T17378] Code: 00 65 e1 8b e8 87 ef c9 fc 90 0f 0b 90 90 eb d7 e8 1b 41 06 fd c6 05 f8 cb cf 0a 01 90 48 c7 c7 60 65 e1 8b e8 67 ef c9 fc 90 <0f> 0b 90 90 eb b7 e8 fb 40 06 fd c6 05 d5 cb cf 0a 01 90 48 c7 c7 [ 1610.721366][T17378] RSP: 0018:ffffc9000c8276a0 EFLAGS: 00010246 [ 1610.727413][T17378] RAX: 6caad8d84d128900 RBX: 0000000000000003 RCX: ffff88803105bc00 [ 1610.735372][T17378] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [ 1610.743325][T17378] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 1610.751276][T17378] R10: dffffc0000000000 R11: fffffbfff1bfaa44 R12: dffffc0000000000 [ 1610.759229][T17378] R13: ffff88805b80d460 R14: ffff88805b80d478 R15: ffffffff85ef1a70 [ 1610.767181][T17378] ? __pfx_klist_children_put+0x10/0x10 [ 1610.772722][T17378] klist_dec_and_del+0x3c7/0x3d0 [ 1610.777646][T17378] ? __pfx_klist_children_put+0x10/0x10 [ 1610.783178][T17378] klist_del+0xa6/0x110 [ 1610.787317][T17378] device_del+0x280/0x8e0 [ 1610.791629][T17378] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1610.796809][T17378] ? pm_runtime_set_memalloc_noio+0x1f4/0x260 [ 1610.802855][T17378] ? __pfx_device_del+0x10/0x10 [ 1610.807683][T17378] ? netdev_unregister_kobject+0x344/0x450 [ 1610.813473][T17378] unregister_netdevice_many_notify+0x1d52/0x2320 [ 1610.819876][T17378] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 1610.826617][T17378] ? rcu_is_watching+0x15/0xb0 [ 1610.831367][T17378] ? trace_contention_end+0x39/0x120 [ 1610.836631][T17378] ? __mutex_lock+0x330/0xe80 [ 1610.841288][T17378] ? __lock_acquire+0xab9/0xd20 [ 1610.846126][T17378] ? __lock_acquire+0xab9/0xd20 [ 1610.850965][T17378] unregister_netdevice_queue+0x33c/0x380 [ 1610.856666][T17378] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 1610.862895][T17378] ? rtnl_net_dev_lock+0x36/0x2f0 [ 1610.867908][T17378] ? rtnl_net_dev_lock+0x2de/0x2f0 [ 1610.873002][T17378] unregister_netdev+0x1f/0x60 [ 1610.877748][T17378] bnep_session+0x294d/0x2b40 [ 1610.882413][T17378] ? trace_sched_exit_tp+0x38/0x120 [ 1610.887598][T17378] ? __lock_acquire+0xab9/0xd20 [ 1610.892444][T17378] ? __pfx_bnep_session+0x10/0x10 [ 1610.897446][T17378] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1610.903319][T17378] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1610.909626][T17378] ? __pfx_woken_wake_function+0x10/0x10 [ 1610.915242][T17378] ? __kthread_parkme+0x7b/0x200 [ 1610.920167][T17378] ? __kthread_parkme+0x1a1/0x200 [ 1610.925184][T17378] kthread+0x70e/0x8a0 [ 1610.929325][T17378] ? __pfx_bnep_session+0x10/0x10 [ 1610.934327][T17378] ? __pfx_kthread+0x10/0x10 [ 1610.938894][T17378] ? _raw_spin_unlock_irq+0x23/0x50 [ 1610.944069][T17378] ? lockdep_hardirqs_on+0x9c/0x150 [ 1610.949245][T17378] ? __pfx_kthread+0x10/0x10 [ 1610.953813][T17378] ret_from_fork+0x3f9/0x770 [ 1610.958386][T17378] ? __pfx_ret_from_fork+0x10/0x10 [ 1610.963479][T17378] ? __switch_to_asm+0x39/0x70 [ 1610.968220][T17378] ? __switch_to_asm+0x33/0x70 [ 1610.972959][T17378] ? __pfx_kthread+0x10/0x10 [ 1610.977529][T17378] ret_from_fork_asm+0x1a/0x30 [ 1610.982281][T17378] [ 1612.053498][T17378] Shutting down cpus with NMI [ 1612.058478][T17378] Kernel Offset: disabled [ 1612.062793][T17378] Rebooting in 86400 seconds..