last executing test programs: 7.868722536s ago: executing program 1 (id=2059): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) syz_usb_connect$uac3(0x5, 0x10b, &(0x7f0000000380)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x499, 0x1001, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf9, 0x3, 0x1, 0x9, 0x0, 0xa, {0x8, 0xb, 0x2, 0x2, 0x1, 0x25, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xa, 0x395262e9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xe526, 0x7, 0x2, 0x7}, @as_header={0x17, 0x24, 0x1, 0xdd, 0x2595, 0x240, 0x5, 0xff, 0x8, 0x8, 0x2}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x8a, 0x5, 0x2, 0x1, 0x4}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xde, 0xfff, 0x2, 0xaa}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x4, 0x4, 0x20, {0xa, 0x25, 0x25, 0x6, 0x80, 0x487}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0x2, 0x7fffffff, 0x5c1f, 0x2, 0x9, 0xd7, 0x7, 0x8}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xae, 0x4, 0x9, 0x81}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x1cae, 0x0, 0xb2, "2c286c813aeb5092"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x6}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x800, 0x285, 0x7, 0x10}, @as_header={0x17, 0x24, 0x1, 0x71, 0x7, 0xffff, 0x1, 0x1, 0x2, 0x4, 0x9}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x81, 0x8, 0x3, {0xa, 0x25, 0x25, 0x6, 0x8, 0x1}}}}}}}}]}}, &(0x7f0000000c80)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x310, 0x4, 0x6, 0x3, 0x40, 0x2}, 0x7a, &(0x7f0000000540)={0x5, 0xf, 0x7a, 0x6, [@ssp_cap={0x20, 0x10, 0xa, 0x7, 0x5, 0xf, 0x0, 0x6e0, [0x3f00, 0xffc0f0, 0xc7, 0xffc000, 0xff003f]}, @ssp_cap={0x14, 0x10, 0xa, 0xb, 0x2, 0x7, 0xf00f, 0x4, [0xff00f0, 0xff00]}, @ss_container_id={0x14, 0x10, 0x4, 0xfc, "f4e0746fe15638484ea33e473a9ff5a2"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0x4, 0x7f, 0x7fff}, @ptm_cap={0x3}, @ssp_cap={0x20, 0x10, 0xa, 0x1, 0x5, 0x1, 0xff00, 0x4, [0xff3f00, 0x6030, 0xff0000, 0xfffff0, 0xcf]}]}, 0xa, [{0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x200a}}, {0xcb, &(0x7f0000000600)=@string={0xcb, 0x3, "405755f3cf74e19486d817eb8fb1e7d53b1da17fd55fe436ec52c2467e83416038c78472967d6c17a03e71e9235e95636e6e12f4063a2891909ec00cfa2c4e96dc0c13a9c01dee62eef2c7d7b99bdece3f69e327a86dc1664e1f35ec2049b013ffa22a57ab6350aeb5982764bd848e5a92b06a96391050bc78127e6b82daf1b07cec4d2aa40e89b9c3cc63d81624a248ec7ff68cd8c51882193b95afe4b080097a83a1b51e5df1fd444da79572d65368a5acd25fa7b6fbfb64bbea0a80979b9f944ed609541a8247d2"}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x408}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x1409}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x1048}}, {0x8c, &(0x7f00000007c0)=@string={0x8c, 0x3, "68dd757374d374fced81e539511e61c3b4add670cbe6312cb7bc06f9f9b8504ee99bc19fc1a21a3e16518f49656fe34d53bcce6d3c5caec3cca7d4d7409f824abdb6990a917b477a5a28f7bb45e8b99612b330b45f80e705fb35ca5d04c842c2c0eb877dc9de8a06367e9db20d5ba268aea8264b3eaa3bde2b642b393921a19a642f4c23e7f5d9c914db"}}, {0x19, &(0x7f0000000880)=@string={0x19, 0x3, "c267617ebe60bf2754327c7bafc8cbbdc10c7900d39f32"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x480a}}, {0xc4, &(0x7f0000000b00)=@string={0xc4, 0x3, "e06436fb622b8ef8f297fe2b7ba3cd123e656c26a4dfddc07992afdf4cc7018a3a1cbad93c8f4aa3f80ccb033110442d3023823e3df421992c135b138eef681ab1d888ba03e4f578e5e48809fb5b9451baade53bf0fc7beaef5f68e058ac54bb0b9dcbfb5f626e3fe15d82d5ccba2fffdbb35353988c15935aa9df7d8738fb7a38b4165180007af2eed2ede6079dc3108f97a371c7be92f9efd4db82129c6481a1ad2cbac25c0a0d38397ba3855c398510c862df6243c423207622b2f797b7a35471"}}, {0x66, &(0x7f0000000c00)=@string={0x66, 0x3, "ed0bbaba548d31014de495790e8528be1f8c9cf2bdabb71f067bcf8b94d018385f784a66977e6541eaf8f11c7f6db953a3c85987c2728cdbaf6f67f29b76eb1f7727db83bd79559f240a2e846ce783753f0cf239298226061ec1f3fe948a61646c1b0c42"}}]}) (async) syz_usb_connect$uac3(0x5, 0x10b, &(0x7f0000000380)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x499, 0x1001, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf9, 0x3, 0x1, 0x9, 0x0, 0xa, {0x8, 0xb, 0x2, 0x2, 0x1, 0x25, 0x30, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xa, 0x395262e9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xe526, 0x7, 0x2, 0x7}, @as_header={0x17, 0x24, 0x1, 0xdd, 0x2595, 0x240, 0x5, 0xff, 0x8, 0x8, 0x2}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x8a, 0x5, 0x2, 0x1, 0x4}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xde, 0xfff, 0x2, 0xaa}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x4, 0x4, 0x20, {0xa, 0x25, 0x25, 0x6, 0x80, 0x487}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {[@as_header={0x17, 0x24, 0x1, 0x2, 0x7fffffff, 0x5c1f, 0x2, 0x9, 0xd7, 0x7, 0x8}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xae, 0x4, 0x9, 0x81}, @format_type_ii_discrete={0x11, 0x24, 0x2, 0x2, 0x1cae, 0x0, 0xb2, "2c286c813aeb5092"}, @format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x2, 0x6}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x800, 0x285, 0x7, 0x10}, @as_header={0x17, 0x24, 0x1, 0x71, 0x7, 0xffff, 0x1, 0x1, 0x2, 0x4, 0x9}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x81, 0x8, 0x3, {0xa, 0x25, 0x25, 0x6, 0x8, 0x1}}}}}}}}]}}, &(0x7f0000000c80)={0xa, &(0x7f0000000500)={0xa, 0x6, 0x310, 0x4, 0x6, 0x3, 0x40, 0x2}, 0x7a, &(0x7f0000000540)={0x5, 0xf, 0x7a, 0x6, [@ssp_cap={0x20, 0x10, 0xa, 0x7, 0x5, 0xf, 0x0, 0x6e0, [0x3f00, 0xffc0f0, 0xc7, 0xffc000, 0xff003f]}, @ssp_cap={0x14, 0x10, 0xa, 0xb, 0x2, 0x7, 0xf00f, 0x4, [0xff00f0, 0xff00]}, @ss_container_id={0x14, 0x10, 0x4, 0xfc, "f4e0746fe15638484ea33e473a9ff5a2"}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x8, 0x4, 0x7f, 0x7fff}, @ptm_cap={0x3}, @ssp_cap={0x20, 0x10, 0xa, 0x1, 0x5, 0x1, 0xff00, 0x4, [0xff3f00, 0x6030, 0xff0000, 0xfffff0, 0xcf]}]}, 0xa, [{0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x200a}}, {0xcb, &(0x7f0000000600)=@string={0xcb, 0x3, "405755f3cf74e19486d817eb8fb1e7d53b1da17fd55fe436ec52c2467e83416038c78472967d6c17a03e71e9235e95636e6e12f4063a2891909ec00cfa2c4e96dc0c13a9c01dee62eef2c7d7b99bdece3f69e327a86dc1664e1f35ec2049b013ffa22a57ab6350aeb5982764bd848e5a92b06a96391050bc78127e6b82daf1b07cec4d2aa40e89b9c3cc63d81624a248ec7ff68cd8c51882193b95afe4b080097a83a1b51e5df1fd444da79572d65368a5acd25fa7b6fbfb64bbea0a80979b9f944ed609541a8247d2"}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0x408}}, {0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x1409}}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x1048}}, {0x8c, &(0x7f00000007c0)=@string={0x8c, 0x3, "68dd757374d374fced81e539511e61c3b4add670cbe6312cb7bc06f9f9b8504ee99bc19fc1a21a3e16518f49656fe34d53bcce6d3c5caec3cca7d4d7409f824abdb6990a917b477a5a28f7bb45e8b99612b330b45f80e705fb35ca5d04c842c2c0eb877dc9de8a06367e9db20d5ba268aea8264b3eaa3bde2b642b393921a19a642f4c23e7f5d9c914db"}}, {0x19, &(0x7f0000000880)=@string={0x19, 0x3, "c267617ebe60bf2754327c7bafc8cbbdc10c7900d39f32"}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x480a}}, {0xc4, &(0x7f0000000b00)=@string={0xc4, 0x3, "e06436fb622b8ef8f297fe2b7ba3cd123e656c26a4dfddc07992afdf4cc7018a3a1cbad93c8f4aa3f80ccb033110442d3023823e3df421992c135b138eef681ab1d888ba03e4f578e5e48809fb5b9451baade53bf0fc7beaef5f68e058ac54bb0b9dcbfb5f626e3fe15d82d5ccba2fffdbb35353988c15935aa9df7d8738fb7a38b4165180007af2eed2ede6079dc3108f97a371c7be92f9efd4db82129c6481a1ad2cbac25c0a0d38397ba3855c398510c862df6243c423207622b2f797b7a35471"}}, {0x66, &(0x7f0000000c00)=@string={0x66, 0x3, "ed0bbaba548d31014de495790e8528be1f8c9cf2bdabb71f067bcf8b94d018385f784a66977e6541eaf8f11c7f6db953a3c85987c2728cdbaf6f67f29b76eb1f7727db83bd79559f240a2e846ce783753f0cf239298226061ec1f3fe948a61646c1b0c42"}}]}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) listns(&(0x7f0000000000)={0x20, 0x0, 0x0, 0x10000000}, 0x0, 0x39, 0x0) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000040)='fuseblk\x00', 0x1000009, 0x0) socket$kcm(0x2, 0xa, 0x2) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r3 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000000879215300000000000001090224000100000000090401130103000100092100000001220b0009058103"], 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, 0x0, 0x40080) syz_usb_control_io$hid(r3, 0x0, 0x0) (async) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000580)={0x24, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="002213"], 0x0}, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) (async) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socket$inet6_sctp(0xa, 0x5, 0x84) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008000200", @ANYRES16=r5], 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000080) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008000200", @ANYRES16=r5], 0x1c}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) syz_open_dev$sg(0x0, 0x6f5e, 0x2) (async) syz_open_dev$sg(0x0, 0x6f5e, 0x2) syz_extract_tcp_res(&(0x7f0000000080)={0x41424344}, 0x9, 0x6) r7 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) ioctl$EVIOCGBITSND(r7, 0x40044591, 0x0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r7, 0xf507, 0x0) (async) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r7, 0xf507, 0x0) write$tun(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="4e0c01730068000004069078ffffffff640101008307b500000000014414ff71ac1e000100000007ffffffff0000000594040000862900000002001135de231e32f71f6b0f375d5e15fc51070dd76138a0667166645e7b3c07054f9917891f8bffffffffac1414aae0000001e0000002ac1414aae00000027f000001890fcf0a0101007f000001ffffffff442c81737f0000010000fffce0000002000008006401010000000c23ac1414aa000000450a01010100000007004e204e241d314bbf75bea4b4db0ac0907268d3b28516dfed3a1bba1e2142205670153329699f5807006b7d8b08794bbcb884e61167a9257cf4", @ANYRES32=r6, @ANYRES32=0x41424344, @ANYBLOB="4080000490780100fe06e2d4c3d91312ac335f3d03bfda7ff2800342e970406e13121eb23cdab6956329a4668c85b659af8501fe06e2d4c3d902040600fe06e2d4c3d900e3ba55ef2c9f7d5d54c3c8f716be3ca779e12ade1ffa7aacba83ca5382601665a82bdede13ba0ab8708576c7de0fa6b240c35e876ddd4616e0d2bed9078b68d150b5fb78e71b47539a80198a00f61129c3af80856d8e07e2177683890743e5b1f01bd0f3831c99bb44069e"], 0x173) 6.745540489s ago: executing program 3 (id=2067): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd70f5fddbdf25450000000e0001006e657464657673696d0000000f000200"], 0x3c}}, 0x48080) epoll_create1(0x0) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_DELCHAIN={0x3c, 0x5, 0xa, 0x801, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x4}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}]}], {0x14}}, 0xc4}}, 0xc000) 6.521223048s ago: executing program 3 (id=2068): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x14082, 0x0) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0xff70) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003900)=ANY=[@ANYBLOB="140000dd3d00010a00000000000000000a000000"], 0x14}}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0x8, 0x9, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000180)={r4}) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='veth0_to_hsr\x00', 0x10) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000000c0)=0x80) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x8) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x14082, 0x0) (async) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0xff70) (async) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {r0}}, './file0\x00'}) (async) socket(0x10, 0x3, 0x0) (async) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003900)=ANY=[@ANYBLOB="140000dd3d00010a00000000000000000a000000"], 0x14}}, 0x0) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0x8, 0x9, 0x4}) (async) ioctl$DRM_IOCTL_MODE_MAP_DUMB(r2, 0xc01064b3, &(0x7f0000000180)={r4}) (async) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='veth0_to_hsr\x00', 0x10) (async) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000000c0)=0x80) (async) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0x8) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)) (async) 6.434874069s ago: executing program 3 (id=2069): r0 = socket(0x6, 0x80000, 0x3) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='bridge0\x00', 0x52c) sendto$unix(r0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=@abs={0x0, 0x7, 0x6a0000e0}, 0x6e) mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = openat$panthor(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DRM_IOCTL_PANTHOR_VM_DESTROY(r2, 0xc0086442, &(0x7f0000000080)) read$FUSE(r1, &(0x7f00000041c0)={0x2020}, 0x2040) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) recvfrom$inet(r0, 0x0, 0x0, 0x10000, &(0x7f00000001c0)={0x2, 0x4e24, @empty}, 0x10) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[r5, r4], 0x2}) ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r3, 0xc01064c7, &(0x7f00000002c0)={0x0, 0x0, 0x0}) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000036571a20cd0c8000fe67010203010902120001000000000904"], 0x0) syz_usb_control_io$printer(r6, 0x0, &(0x7f00000000c0)={0x34, &(0x7f0000000040)=ANY=[@ANYBLOB="00146a"], 0x0, 0x0, 0x0, 0x0, 0x0}) 6.056627211s ago: executing program 1 (id=2070): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a118000200fcffffff00000e1208000f0100810401a80016ea1f0006400303000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad956", 0xfd08}], 0x1, 0x0, 0x0, 0x7400}, 0x4) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg(r1, &(0x7f0000000280)=[{{&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xf277, @loopback, 0x1a, 0xffffffff}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002b40)="f7", 0x1}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="20000000ed"], 0x20}}], 0x2, 0x40408c1) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r2, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) close_range(r2, r2, 0x2) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000080)={r3, 0x7f}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f00000000c0)={r3, 0xffff}, &(0x7f0000000140)=0x8) 5.986147688s ago: executing program 1 (id=2071): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000140)={0x0, 0x2, 0x0, 0x0, 0x0, 0x9}) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000140)={0x0, 0x2, 0x0, 0x0, 0x0, 0x9}) r0 = socket$netlink(0x10, 0x3, 0xb) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000280)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000280)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000580)={0x0, 0x0, r2}) (async) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000580)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r1, 0xc01864b1, &(0x7f0000000140)={r3, 0x2, 0x6, 0x0, &(0x7f0000000080)}) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x141100, 0x0) ioctl$IOMMU_VFIO_CHECK_EXTENSION(r4, 0x3b65, 0x3) close_range(r0, r0, 0x0) syz_open_dev$I2C(&(0x7f0000000d80), 0x0, 0x0) (async) r5 = syz_open_dev$I2C(&(0x7f0000000d80), 0x0, 0x0) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000000)={0x4, 0x9, 0x1, &(0x7f0000000700)={0x9, "fd5a4400000000000000000000000500"}}) (async) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000000)={0x4, 0x9, 0x1, &(0x7f0000000700)={0x9, "fd5a4400000000000000000000000500"}}) r6 = socket$packet(0x11, 0x3, 0x300) r7 = dup(r6) r8 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r8, 0x40000000af01, 0x0) (async) ioctl$int_in(r8, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, 0x0) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f0000000000)={0x1, r7}) ioctl$NBD_SET_TIMEOUT(r7, 0xab09, 0xfffffffffffffff7) r9 = syz_open_dev$swradio(&(0x7f0000000440), 0x0, 0x2) ioctl$VIDIOC_G_FMT(r9, 0xc0d05604, &(0x7f0000000980)={0xb, @pix={0x6, 0x4, 0x41495043, 0x1, 0x1, 0x5, 0x5, 0x8, 0x1, 0x3, 0x1, 0x1}}) (async) ioctl$VIDIOC_G_FMT(r9, 0xc0d05604, &(0x7f0000000980)={0xb, @pix={0x6, 0x4, 0x41495043, 0x1, 0x1, 0x5, 0x5, 0x8, 0x1, 0x3, 0x1, 0x1}}) 5.932478463s ago: executing program 2 (id=2072): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e22, 0x8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x5}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x6}, 0x1c) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000340)=@req3={0x800, 0xfffffff9, 0xfffffffb, 0x37, 0x7ff, 0x2, 0x3}, 0x1c) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r3) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="100029bd7000fcdbdf", @ANYRES32=r5, @ANYBLOB="040005010400050108000c006400000008000c00640000006e027f00bd060802110000006804000000082a0103dde6c4ce78e7cda480f3ad4ee1e2828a705b004b63a8115019452196fbb15c01f80b80d68be1652444021567f69e4e42b585884f21ea16e7d632fe8e88ed7e5c4964bac7952673b0c4ffaaddd319923b18b5fe98118303920ae762e9ea0e5c29e3babf007747dc6186825d4f027dd7339624ac839974b7c8db9d0e1bacde3f0eb09de93cd7ed46e416b8ba0efd137233124da939baa0a8d3f50ec41555a50a4700f304e919541b6bbbfc78dacd02d5361fd9d5f64d4f246fd4fea0d67c6393d65a7a0a61cad7fd8b8720ca9f88d8a8ac1fefc44d3e50"], 0x2ac}, 0x1, 0x0, 0x0, 0x40}, 0x8af0a56d13e39705) ioctl$BLKSECTGET(r1, 0x1267, &(0x7f0000000280)) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000040)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r1) sendmsg$NL80211_CMD_SET_WOWLAN(r3, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="000226bd7000fedbdf254a06000000000100410000000c00990005000000000800758004000100000000"], 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000380)=0x10, 0x1c) r7 = socket$igmp(0x2, 0x3, 0x2) sendto(r7, &(0x7f00000025c0)="32edfe263f189ed90b6a650c78605fe0954b4cd5112f4ed9f3ab95f3b3a04500b2e26c3e6a5dd1eb5af89fabb6de8a7430040422cdbf2a750baffd99a63e0266d1b21ff4160677ebf5696cdc76e2502b266d0f3506f31b52f6f902a0f13eb4c30e7c9d7dfb7bf3b28bf8fe327c31ee7e8a4be07532e462d7bd671414351c36da037509ead6d13bd9efbfbd78fa1c3cbcc3eeb8c1e4210e0415b65363e881b6ed2397ceaef40e914ca681440c913d2304fd228a7098333da2c312ae4bfd70ab1bd1643ae4a1570df17ebefa2965884eb7263674e835bb88938ff37e803a9fcb45388e3c3de15a2083580873e1825ddcbcf1fdcab38f12c1ef1efb4c62cc0cdd5900956ec1c37d157f7783668e8393352f87662be9102fd2dfb89ee26762f893b509213847a5a05e3fca83d78fabe05850f0389736996e772448f9285c13942a0cd1b91af278c668cb836a96399158b17344d651d4c90f4a14ac8efecb53c0a270e2d14bed043d6c59925e4183055d255c07b89981466801030f3942c0f80da718818d2a86e7f9a0caf7a421c35702de2b4874d5404413344d8c41e98ce5f5d9089435152e3efb5811c076c1998900cc991be188dea8ef2d085454b4a5db1eebbeebafc9ac2310125a7dd7b963087b47dafe7bf2fcdc60f792024d2f6bb61b3e9257d88eacfcaad2c9edb61aac627962be13cc6709a5dcdaf1a5f146497b36ba70080994c3f82ad754377ed7f6086e3938c3c5adc0522caadbe0e3c5add8b36adaf744ca5386ada279d23c43234d08846b88c2e5eff615d732469e169a2134b967b91b72f88f8a94b96d75f076a1dbc99549360bc3b1ad21b5259611237ae793e36043fd90ec68e8557e119a762cb2a138bc2fa75c1c53165f052752f4244a5ed73e74f603de17535bfbaee5f99e8281d81c85aff845126eab7af43ec8015a68afde6769ec46bcff2ab6f81e606f3621ff76a36a1b225a4e4f0bc317b3d73ec3da15b95e83599ba1b801538731d7ca9c7609cc25fb9185e8d0c191ebee7f3e554b4f0865c9cd173ae752bfc62a87f3d80280109972cd0bafe7804019022d19678656e17b5b1836288173e9fed8869f3ab89392792df635cc9b66e6cad566b4890b9dfea94f17601e299adb0c2a36276a90106c2c000f0f41316c50bd7ec2184ebdfac5ffc64916982f3bb98098f7fdf0aa6483cf010b517ab3b5b9d8bc837f34c92bb7f7cf41c62c98398b2495b7b0161a4a8c2c0ec0be48a1f46179fc6fbf67aa5af5774cfd7b93e1e3dcb6fdd57c9b4f10d5aa9072553c9c54240af88ec98e5391377827bfaeddf215112dd020b3cdad862f3b32fb91d0acb9b5c4712111a603d1c1916f598fb3e0ad4c471c10fd9aca93ae3aa5eb5b9fb0f24313803e7ee21d0334520df53150df75e35542f05d6a9dc02448aadd0265c6293b4cac1f61fb6d37953fd86e251c705e42daa303f9b28267dec0234a453f7cd5288fd9f6725d26685c3e9c3d098f4a722049d250ae8e888690fa85b00ff22077ca46c34675b9c2699e1828aae1d92ee787fc1ff825d7628a61cea5a324073d218202fbceb26ef8b3f846c72ce2a5b2328cb0e02abcb8f88ed87749fbeca20d7cfe39fd48218a0e5e14dfb3bb62381add3884c605f32bf06c3fe46d61d4aed97ff976d8318ee3546a82ce391b070fa912449aacd3575ed88a9dfb2ad4e06402882734a7b8b4962ef084c0289ae4e74fbe542cf023c24a6233781eaec270eeb808ff416b666ed5d93e8ab218bd3fb69a5ed73db202c057ffa3b32d981f64ddcbd3b4ab569d590d490529118f66dd2d1bbe479cbbe240607111a2b16133bc74283375f5b2e1c6d4c73bc6621abfecfe40cf5d5966a393e867f28d58d02225da51dc5d0ec911a5f9dd90ec59c89deaf745df3df4ceb61f783ad20311e5335ac8596f008a2a385fab2e4305bde7dccba57b271f5a899b096a018a2d253dfdf97d0c98fd611795b4c755f738278faa1a153de888297024b3b29b7a8b14eec3fd93a56b9bb647df54b125b56c062e83f903e99200916ed6223948d83983d98a95bac463ea001d2c08218a90816c3df101799d8eadbceb57cfcee0bb1d9280e7e385dcb137509bb08b6ca457aac41b295551d195bffd16e701bee5afe91a246efadc0bbe69d0cb7c9114e9371bdbec46fc56f3dc0184cb096b069478415b0c203789e6d083b9bdcc89443133a2110af0e69d22747b9106af7c916776766b4d755e9cf084e3dd98e586b1ec9c459b4d0273054f3431a0ff277c43b902d89637ca02b020812be9142fb28cafd012dc7f0b50ca279b49a48d24ebe1120d0429082d1b487ba4b6f851fbf930d35ec9ca63468d43ef2ce2cfb1c5233c4de6f2bdd79e9d3a8d082f4b6fe6de751b3992b4bfd09c2c7a2c68baae6cb6b63b868411a9528b37246b95fb6020441aed411f01b0bc2f47ed5013cb2bdae401b06208cb6829940ff59cc8ab040de2dd2df59bd04ee21ffe631435fe568fdb7cd9e43c1826efd72fd1cb0c972ea5cb5628677e22352b7da4ee4f5915a423da6a9e863246afcdaaffdf1a11a93d7fa099f718396af6f10887483afc74dd7f17ec78aa5150d47adf9fa622b6e6f8758556cff1288f298d2bf9fbc8c196e0583c86559fc9ddbab1df3ed903df883d5935c548e21368fd14f71e6e681de6cc5590239d5181730f3c8078fe9d91fc8653f8b31dd86f1ee9f42b5c18d9fd1d9ce4e3602360b69aec8821de204d3bace157be01cd3940ba5bc295e21acafdfe028f5e18481f4b78e81999f59b7bb692f30d17e5fa40446cee75f8075e43c51e976a8b46a51a665cfea93a3ce0eab22a60dfa13af8e88a9775823fd1f77ec538d0b7bf7d57b8098a934b76c569feca7dddaa40003145ea6a9b20f3c0c1d15d7a6d51df132e62eb58adcbe64108d8507742ac4564fa20f36f37b146488e8dd6fd000c4e815514abb951d976e438808b972468ecbc44236e6c792accb134651fcdcefa336a05b90c4dfd236936b765988d12726c25bd707ab624b708d21bda88ab91a860c93e8a3e2088349edeeff221dbb3559ac25740638c64f6d9a2ed792f97ab02e4602a9344bd9447911ce0fcb696022296d0fc68fb049c5f8d701251ed3bd35e9b7804a6d077845e72b66346b4112eb41b0de85afbca8338e4c091e51f43b6dfef2af2fe6a4c9909bd74ab153c1719909a5ea56fe4c9a38bed2a68c3ba64f0841cef20eaa6623513bdccda27c9341fae2ddab7ea6cc95a3077f1f1d2b979e994607b87b65793bd2757172c57cdbe9bb26bcc544d639b15dd13d4921ca47c5126adf5c702eb5c98cbc03ce45638db0ae3e97b76f0e5f99c71d8daf96e7ee126ffe5c6a0803b955b51599d7c41fd4d7299505bd283db42797ac85886117b3cb1eddc0aacefb72a83cfb6e7ed2c83c52a324257e277f4351190bbe618eb66ff5bcb41126ca890370744957fc4a460270c3059b45252226d4abf408de4a29397ee3fa8eb6fc646b6b57b9e6674f2d92b940823e45b180ecd8b7c7ce11e812d8067bed8b95f6ace0a0703b1e35d22e1a597af920d02621c5341c465d64da932d9fcfcf0bebf5b09d152c46a0d77a46f9bbcaf86ea2861a50224cbf5d897d726cbc47dc776fa026354e3f326136ca764ad8701795abccb224608b62eb65bf175642826f911e7bbaa62454f19f4be4547045cf361a6de519961ded89db8baa98f0893c9604134807a7944133741d9c4eb5c8c6600160c8aebd6b54f111b6fdabc6b9e52ac7fbebedc890e5fbcd030d789bde8f652d62a9f5feedcca174474c32a84d179b3976b8d31460f8875f467a4838a6748878535da140a61d3f5cae5e3712e223f9b5e6d5fa02091b4f6f8f27c30a6095b64665cea7c6b6dbd4eb941fd9d6bd4f4d1626e993997012a5a6cd3405ce1d501802ffac3f63300e1a59f5d8cba8da87c10bca1461fb09bd3e046d3043f35fc92cced26ba5fa531e0357c5f65df42f957278b90f8d829609681581e4be95480e08aafd0f5cde68dc8b3b7f88ceb1b8c762b6c592618bb4fc62ad9cc98098ef4c3849e81cc854dee327a82b778aa378979e2829184b4cf749ca477df84deaeb7c1a4182ca049d5a9bc042813923dd5f0ede287cd641da9fe0d673d723c98571d0a1f01cd2259f16622334fecd553dae496eb1ad816fcf8ba9c06fb9bad9f3467bbf429885186ceb8e7636e62e586aa8a4d0e2706716f705bba71720be331e4c7729b6ee249a2199a590c7d0a6eb8e193e56511551315003a23a53be6c4c3c89e164cb4da63ce4b27bd107357393fb7ac1714ecd78afafd7796616a43bdb4c7bd0131620fc4b46a70db61c4e9669b2d74a57e3cb46d701521cf47a96f3991744b1d3b82a49fc564a6dd779fda4ccc5013589aea1a9fffd4e93eab11dad93182cb1f842ece767a5980b59c7883ff71058be58143fa8b9dd7125840f126271466e610630ae33686d89a6a743b4f054fa22b7e379e1a8ff52dc8cfcf71d07840c4d66a489e53efaa255f2cc4c22fe7a1c07d171c06bc77849f407f16f29433daafce453dc96c7278dad05754c1a52ab632fec8fc28aa02cacbe1ef283c324e4212118a641ab1f14825bf6dd6e04cc84ed03674f2592cbed2b07857293d54932ba1d7e6bc90b1b502f1ca52681afe1149954151aeb7410ba9ddd39db17717dbc4a7ff339d4ac7ec945cd06d60464db4ecd60659609fc2afe4451e67d45341190ca488d90bda2731d8ded26f8988a70ca565681d80aa1cdd36c78e00494be0362da252948794ad10d200b58fde089e9566daffdbdb2575ed27152d61fc6f7cc2346d9757d3a8fe5a30cfb847d5a057056a0ebe0d9bf403bb5fe76f1cc39387385acf82b62e0893e77582f57c87c8fdbc94cc3b02d7a1c46cabfaec8a06905b3975968402b59dd341c573d1ba02ce6a3f6a6328b0c8ce4e2041ed7774cf344584d96ef3a3e028c9f4d77388e5183ccf702332fff312317ece9b463226ab481de41f6cdb5575bf7b85af38d2aca61512a86e0f38c30094a7adadbc8ed14e03c79e45b150367b3608c8d962c4370b145d9d864ff40d5ba3bb375cf01742df6c297f99b349a2c742e864c97f9e2be4dec2f9faa08aeeea61ee3c31130178aa704d6ad4437bb4d15a0deb285e849f74a1841feddaba66815f1ea80d4a9616fa21c6525c24db303eebe9295898f18e25e5d617f0a813169488166f6f529efff144d9e87ab52cfa903f93c91f06c4e6bc9ddf54886d281ca048a793bc5fc1a18d61a12f3e60ecbf30a5173fc62baf88028990cd3e007b0645af287119d7cb12ac28f67fa550738cbbab04d5f9dc57ebb01e3a952604ed2a41fbb8be21a0435857e8b50f34fa9d4892662129f4fa72f6e9db30bea59c83f75c31370025f0b8e99e3b48ec573c55758d6d0720887d14e392f32e7ed044794d5f2538d394bb52ed733e629fb098da58280c95035c1c5ded222b34784fd0283bfcf301bb1442d6c8683872ed9bd287467f9b16f02efb656a92a98196ff15952a6c1366b7c9fcfb36178b7d49c7ed0e57b1484bb304deb7f75d48d6b229637e3ccf009bcd6f76ffc6e267fee2bc79811ef1bbb9ef4d42c1288798517f4de3d3ada4ad1dc990ae060e329cd30cf6db01b0b04e597a9372ef9fa92cf6080a3e3cc7e5a6933f54f38dacf87e4bc43bd6584fae440a5940d11fa1b2042e608d645e0f80bf6764bc68f81a7f38579464a9bb1b33d5e22d41171cca2055a44adc70fc74e956d2cd23e08579874514a6542a9f39952f73", 0x1000, 0x85, &(0x7f00000035c0)=@in={0x2, 0x4e22, @broadcast}, 0x80) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000080)={0x0, 0x7ff, 0x2, 0x1, 0x401, 0x7, 0x9, 0x779, r8}, 0x20) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000400)={0x8fc, 0x9, 0x8, 0x1, 0x100, 0x3, 0x2, 0xb70f, r8}, &(0x7f0000000480)=0x20) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', &(0x7f0000000300)={0x40, 0x144, 0x5}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000003640)='./file0/file0\x00', &(0x7f00000004c0), 0x2020, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r9 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0/file1\x00', 0x20400, 0x20) fdatasync(r9) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x56c}, 0x1, 0x0, 0x0, 0x200440d1}, 0x800e885) read$FUSE(r1, &(0x7f0000000580)={0x2020}, 0x2020) syz_genetlink_get_family_id$devlink(&(0x7f00000003c0), r1) 5.824640546s ago: executing program 1 (id=2073): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000001c0)=0xf) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TCFLSH(r1, 0x400455c8, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000100)=0x9) r2 = syz_usb_connect(0x3, 0x3f, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x24b}) ioctl$UFFDIO_CONTINUE(r3, 0xc020aa07, &(0x7f0000000000)={{&(0x7f00005fd000/0x2000)=nil, 0x2000}}) syz_usb_control_io(r2, 0x0, &(0x7f0000000c40)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(r2, 0x0, &(0x7f0000000940)={0x1c, &(0x7f00000002c0)={0x40, 0x15}, 0x0, 0x0}) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000001a80)=0x1, 0x4) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000005040)=0x1, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c0000000206050800000000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) 5.522790144s ago: executing program 2 (id=2074): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = socket(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x3a, 0x1, 0x0, 0xc) ioctl$sock_proto_private(r0, 0x89e5, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={0x2, 0x2, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, [@sadb_sa={0x2, 0x1a, 0x0, 0x0, 0x0, 0x5, 0x0, 0xa0000000}]}, 0x20}, 0x1, 0x7}, 0x0) syz_usb_connect(0x0, 0x35, &(0x7f0000000040)={{0x12, 0x1, 0x201, 0xcb, 0x60, 0xa7, 0x20, 0x5ac, 0x8514, 0x76af, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x23, 0x1, 0x1d, 0x1, 0xa0, 0xc, "", [{{0x9, 0x4, 0xce, 0x5, 0x0, 0xe, 0x1, 0x0, 0x8, [@uac_as={[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x81, 0x5, 0x6, 0x2, 0x10}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x4, 0x3, 0x10, 0xaf}]}]}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f0000000240)={{0x3, 0xe8b5c71a5eb6f040, 0x5, 0xb7a4, 0x1, 0xffff}, 0x341, [0xc, 0x40, 0xcd7, 0x4, 0x6, 0x0, 0x80000000, 0x7, 0x9, 0x7a18fde9, 0x9, 0xf12, 0x4, 0x3, 0x378, 0x9, 0x4, 0x0, 0xfff, 0xffff06bd, 0x0, 0xf, 0x1a, 0xf2, 0xe, 0x9, 0x8, 0x10001, 0x401, 0x80000000, 0x401, 0x3ca5, 0x1, 0x0, 0xff, 0x40000004, 0x4, 0x3, 0x0, 0xaa80, 0x40000000, 0x80000000, 0x7fff, 0x7, 0x5, 0xa, 0x0, 0x10000, 0x405, 0xc, 0xffff, 0x91ba, 0x7, 0xb, 0xa, 0xb6, 0x24, 0xcb, 0x180, 0x7f, 0x200, 0x311, 0x66d1, 0xfffffffc, 0x9, 0xb6eb, 0xc74, 0x77, 0x1, 0xc0000000, 0x5cb5, 0xfffffffd, 0x401, 0xedf4, 0x4, 0x1000, 0x6, 0xfffffffe, 0x8001, 0xc1, 0x1, 0x8, 0x1, 0x32, 0x98, 0x7f, 0xffff, 0x401, 0x2, 0x2, 0x4680, 0x9a7f, 0xe665, 0x3c6e, 0x3, 0x7, 0x80, 0x84b, 0x9, 0x2, 0xb, 0x6, 0x4fa4, 0x80000000, 0x1, 0x8, 0x0, 0xfffffffa, 0x3, 0x8001, 0xfd, 0x101, 0x4, 0x10, 0xa, 0x6b13, 0x202, 0x7ff, 0x9, 0x7fffffff, 0xffff, 0x9, 0x3, 0x6, 0x2, 0xffffff87, 0xe, 0xd, 0x5, 0x8, 0x10, 0x7, 0x3, 0x400, 0x8, 0xff2, 0x6, 0x0, 0x6, 0x0, 0x8, 0x1, 0x3, 0x8, 0x4, 0x9, 0x2, 0x2, 0x1ff, 0xfffffffd, 0xeb6, 0x0, 0x9, 0x10000, 0x1, 0x9, 0x9, 0xff, 0x1, 0x4, 0x7ff, 0xe6, 0x6, 0x10001, 0x5, 0x68, 0x7, 0x201, 0x7, 0x3, 0x9a3f, 0x400000, 0x0, 0x80000067, 0xffffff7e, 0x7, 0x10000000, 0x10001, 0x7, 0x3, 0x12, 0x10a, 0x7, 0x40, 0x18, 0x80, 0xb5f8, 0x5, 0x3, 0x8000103, 0x5, 0xfffffffc, 0x4, 0x18000, 0x10, 0x1000, 0x288c, 0x1ffe, 0x73ee, 0x1, 0x5, 0x9, 0x7fffffff, 0x73, 0x6, 0x8, 0x6, 0x400, 0x40, 0x0, 0x0, 0x0, 0x546c, 0x981, 0x5aa, 0x10, 0x7, 0x2, 0x7, 0xc4c, 0x400045e3, 0x5, 0x7, 0x3, 0x5, 0x3, 0x942, 0x1, 0x2, 0xfdffffff, 0x4, 0x519, 0x6, 0x0, 0x1, 0xa, 0x3, 0x0, 0x9, 0x10000009, 0x37c, 0x10001, 0x8, 0x1, 0x5, 0xfffffffe, 0x6, 0x4, 0x6, 0x1, 0x8, 0x6, 0xfffffffa, 0x5, 0x0, 0x9, 0x5, 0x2, 0x7, 0x3, 0xffffff1b, 0x9, 0x2, 0xd, 0x34ea, 0x10000, 0x0, 0x80001ffe, 0x8, 0x8000, 0x10004, 0x10, 0x1a, 0x8, 0x5, 0x1, 0x6, 0x10001, 0x0, 0x5, 0x10000, 0x4, 0xffff, 0x2, 0x89, 0x2, 0x3, 0x1, 0x73, 0x3, 0x19, 0x4, 0x1, 0xb, 0x1, 0x8, 0x400, 0x81, 0x80000004, 0x9, 0x9, 0x3, 0x4, 0x10000004, 0x0, 0x5, 0xce5fb90f, 0x5, 0x4, 0x10001, 0xf, 0x9, 0x100, 0x44, 0x59b, 0x7, 0x8, 0x9, 0x3, 0x2, 0x4, 0x6, 0x0, 0x8, 0x40, 0xd3, 0x7, 0xffffffff, 0x89aa, 0x8, 0x6, 0xf0ce, 0x2, 0x1, 0x0, 0x2, 0xc6, 0x1008, 0x800001, 0x30c08, 0x10001, 0x6, 0x3, 0xffffffff, 0x5, 0x5, 0x5, 0xffffffff, 0xbe, 0x1, 0x7, 0xe, 0xffffffff, 0x0, 0x3d6, 0x0, 0xae, 0x6, 0x1, 0xfffffeff, 0x4, 0x5, 0x7fff, 0x0, 0x7, 0x6, 0x709, 0x2, 0x40000049, 0x10, 0xfffffff7, 0xfffff772, 0x200, 0x80000000, 0x4000003, 0x4, 0xa9c, 0x9, 0x8, 0x1, 0x2, 0x8d, 0x1000, 0x69f, 0x1ff, 0x9, 0x10, 0x3, 0x10000, 0xfffefffd, 0xf, 0x7ff, 0x3, 0xffffa9b4, 0x1, 0x4, 0x1005, 0x9, 0x4b5f, 0x6, 0x7fffffff, 0xffffffff, 0x0, 0x80000000, 0xc, 0x4, 0x88d, 0x1, 0x7, 0x8, 0x2, 0x2089, 0x6, 0x818a, 0x10, 0x8, 0x10, 0xfffffffc, 0xfffff001, 0xa, 0x8, 0x8000005, 0x4, 0xffd, 0x9, 0x10, 0xfffffffd, 0x4, 0xc2, 0x400, 0x7, 0x0, 0x80000000, 0xd, 0x2, 0x8001, 0x0, 0x20000003, 0xb6, 0x101, 0x401, 0x2, 0x7, 0xc, 0x6623258, 0xf2, 0x741, 0xfffffffc, 0x9, 0xffffa0a6, 0xc, 0x2000011, 0x2, 0x8, 0x9, 0x1, 0x7f, 0x98, 0x9, 0xb, 0x800, 0x4, 0x9, 0x5, 0x7, 0x7, 0x8, 0xfe, 0x7f, 0x9, 0x4, 0x6, 0x20080000, 0x2, 0x8000, 0x0, 0x0, 0x1000, 0xb, 0x0, 0x7, 0x8000000, 0x0, 0xfff, 0x8101, 0x6, 0x3, 0x9, 0xc, 0x5, 0xffe, 0x100, 0xffff, 0x1, 0x401, 0xf0, 0x0, 0xfffff53d, 0x9, 0x0, 0x6, 0x0, 0x1ff, 0x4b15, 0x10000, 0x1, 0x6, 0x9, 0xd, 0x8, 0x4, 0xfffffe01, 0x1, 0x6, 0x20000, 0x2, 0x10001, 0x1, 0x7, 0xe4ce, 0x5, 0x9, 0xffffc487, 0x204, 0x10002, 0x81, 0x7, 0x6, 0x6, 0x8, 0xfffffe00, 0x1, 0x1, 0x8000000, 0xe, 0x2, 0x2, 0x4, 0x0, 0xb66d, 0x3, 0x1000, 0x1eb4bce6, 0xf, 0x8, 0x1, 0x5, 0x1, 0x5, 0x9, 0xffe, 0x8, 0x62f2f805, 0x5, 0x3, 0xffffffff, 0x2, 0x7f, 0x20006, 0xd, 0x40, 0x5, 0x6, 0xa, 0x5, 0x6, 0x80000000, 0xb5, 0x8, 0x7, 0x7, 0x1, 0x5, 0x9, 0x6708, 0x10001, 0x0, 0x80, 0x4, 0x6, 0x0, 0xa95a, 0x2, 0x5, 0x2, 0x2, 0x4, 0xfff9, 0x80000001, 0x5, 0x1, 0x9, 0x0, 0xb7, 0x3, 0x4000ff, 0x9, 0x0, 0x80, 0xfea5, 0x7fff, 0x6f51, 0x7, 0x7, 0x7485, 0x197, 0x8, 0x0, 0x5, 0x10, 0x3, 0xe, 0x8, 0x1000, 0x4, 0x7, 0x382d, 0x45d, 0xcad, 0x9, 0x0, 0x2, 0x119, 0x6, 0x20000a4, 0xe0, 0xfffffffb, 0x5, 0xffffffff, 0x2, 0xc91, 0xa05a, 0x0, 0x7, 0x3, 0x35, 0x8, 0x1, 0x2, 0x30, 0xb, 0x101, 0x2, 0x9, 0x3, 0x7, 0x8, 0x8, 0x1, 0x2, 0x6, 0x15294b70, 0x3, 0x3, 0x2, 0x1, 0xf, 0x9, 0x1, 0x80000000, 0x9, 0x8001, 0x5, 0x800081, 0x1, 0x2, 0x3fd, 0x1df, 0x6, 0x6, 0xfffffffa, 0x81, 0x9, 0x9, 0x9, 0x1, 0x9, 0x7, 0x9, 0x9e95, 0x9, 0xfffffedd, 0x30c8, 0x5, 0x4, 0x7b, 0x0, 0x8, 0x4, 0x6, 0x9, 0x0, 0x8, 0x8, 0x8, 0x1ff, 0x7fff, 0x3, 0x9, 0x8, 0x2b, 0x200006, 0x4, 0x7, 0x2, 0x4, 0xbfb, 0x7, 0x405, 0x6, 0x4, 0x91, 0x9, 0xc, 0x3, 0x6ae574d2, 0x6, 0xfffffe01, 0x1000, 0x5, 0x92, 0xffffffff, 0x7fffffff, 0xd7, 0x8001, 0x905, 0x3, 0x6, 0xfffffb31, 0xa, 0x4, 0x7, 0x8, 0x1, 0x6, 0x1, 0x103, 0x103, 0x7, 0x3, 0x6, 0x80000001, 0x0, 0x100a, 0x7fffffff, 0x7fff, 0x2, 0xfffffff8, 0x2, 0x9b3, 0x10001, 0x8, 0x4, 0x8, 0x6, 0x7742348e, 0x5, 0x4, 0x20, 0x40, 0x0, 0x6, 0xffffffff, 0x7, 0xa, 0x8, 0x17f, 0x6, 0x2, 0x8, 0x6, 0x14827783, 0xb, 0xe, 0x5, 0x1, 0xfe7, 0xfffffffc, 0x8, 0x7ff, 0x3e9, 0x0, 0x3, 0x2000, 0xa, 0x3, 0x9, 0x80000001, 0x81, 0x8, 0x10, 0x8, 0x8, 0x7f, 0xd, 0xf28c, 0x7, 0x6, 0x4, 0x7fffffff, 0xffff, 0x7fffffff, 0xc9, 0x2, 0xfffefffe, 0x924, 0x499, 0x8, 0x1, 0x5, 0xffff351b, 0x7, 0xfffffffb, 0x3, 0x9, 0x2, 0x7, 0x4, 0x4, 0x8, 0x3, 0xee, 0x2, 0x4, 0x8, 0x9f, 0x7, 0x3, 0x9, 0xc9, 0x1, 0x1, 0x1, 0xfffffff7, 0x0, 0x6, 0x5, 0x6, 0x3fc, 0x51, 0x7, 0xefb, 0x200000b8, 0x1, 0x5, 0xfffffff7, 0x7, 0x7, 0x4, 0x6330, 0xff, 0x6, 0xea, 0xbb2d, 0xfff, 0x7, 0x6, 0x0, 0x6, 0xffff, 0xfffffffa, 0x3, 0x0, 0x1, 0x6, 0xfffffc00, 0x5, 0x7, 0x64c822e3, 0x9, 0x6, 0x80, 0x8, 0x4fff, 0x3, 0xa7b, 0x1, 0xfffffff5, 0x7, 0x40, 0xa, 0x9b, 0x3, 0xe, 0xf01, 0x1, 0x3, 0x40, 0x3, 0x4, 0x5, 0x5, 0xa4, 0x5, 0x8, 0x5, 0x3, 0x8, 0x2, 0x80000001, 0x54, 0x80400, 0x1, 0x8, 0xa, 0x7, 0x10000c0, 0x3, 0x72, 0x80, 0x6, 0x7, 0x800, 0x6, 0xd19, 0x3, 0x1, 0x3, 0x20000000, 0x0, 0xe, 0x5, 0x3, 0xfffffffa, 0xa01, 0xf3, 0xffffff00, 0x8, 0xe, 0x3, 0x3ff, 0x5, 0x2, 0x6, 0x5, 0xffff, 0xfffffff9, 0x9, 0x5, 0x62, 0x2, 0x1, 0xfffffffa, 0x2, 0x2, 0x9, 0x7, 0x0, 0x7, 0x8, 0x10000, 0x42, 0xaa1, 0x7, 0x2b, 0x6, 0x10, 0x5, 0x200, 0x9, 0x6, 0x3, 0x8, 0x10, 0x4, 0x6, 0x633, 0xf05, 0x401, 0x101, 0x200, 0x8, 0x7ff, 0x0, 0x40, 0x1, 0x10000, 0x9, 0x40, 0x9, 0xb6f, 0x7f, 0x8, 0x6, 0xe, 0x3, 0x80000001, 0x0, 0x4, 0x8, 0x7, 0xde, 0x6, 0x89, 0x0, 0x100, 0x1, 0x9, 0x6, 0x400, 0x1, 0x0, 0x200, 0xe9ab, 0x3, 0x8000, 0x13, 0x2, 0x2, 0x43, 0x3ff, 0x0, 0x1, 0xc, 0x401, 0x6, 0x7, 0xa, 0xf, 0xf39d, 0x71, 0xfff, 0x7, 0x8]}) r4 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffc, 0x822b01) write$char_usb(r4, &(0x7f0000000040)="e2", 0xff0f) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x84) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x280449c, &(0x7f0000002140)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r5, &(0x7f00000093c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r5, &(0x7f0000004200)={0x50, 0x0, r6, {0x7, 0x1f, 0x0, 0x2022012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x3}}, 0x50) clock_adjtime(0x0, &(0x7f0000000000)={0x3ff, 0xf6d, 0x0, 0xd, 0x7fffffff, 0x0, 0x4, 0x200000000000000, 0x0, 0x100, 0x0, 0x7028, 0x6, 0x3, 0x0, 0xffffbffffffffff9, 0x0, 0x0, 0x1000, 0x2000000000008, 0x9, 0x3, 0x8000000000005a, 0x3}) syz_fuse_handle_req(r5, &(0x7f0000006380)="000000000000000000000000000000000000000000000000000000000000000090c400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000542d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ea8286a2fba5234400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b60dd7710000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e8ffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000633956a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007d6ab715107fa1820000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffffffffffff0000000000000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff00000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000286071480000000000b13bc1e6d970884f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000048636662867d08f50000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f3ffffffffffffff00", 0x2000, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x20, 0x0, 0x80000000000000, {0x0, 0x1d}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x40) ioctl$PTP_EXTTS_REQUEST2(r7, 0x40806685, &(0x7f0000000000)={0x7, 0x9}) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r3, 0x89fb, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={@remote, @broadcast, 0x1e, 0x13}}) socket$nl_generic(0x10, 0x3, 0x10) 4.886700994s ago: executing program 3 (id=2075): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000680)={0x44, &(0x7f0000000480)={0x40, 0x1, 0x2, "8be7"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000000)={0x0, 0x3, 0x0, [0x4, 0x6, 0xffffffffffffffe0, 0x200], [0xffffffffffffffff, 0x8a41, 0x7, 0xff, 0x7, 0x1, 0x6, 0x5, 0x2, 0x7, 0x101, 0x3, 0xfe, 0x17, 0xfffffffffffffff7, 0x71, 0x1, 0x88, 0x3, 0x8, 0xffffffffffffffff, 0x8, 0x2, 0xfffffffffffffe01, 0x0, 0x7fffffff, 0x9, 0x200000d, 0x3, 0x9, 0x0, 0x10003, 0x8, 0x5, 0x101, 0x9, 0x6, 0x5, 0x4, 0x7fffffffffffffff, 0x7c, 0x65f80000, 0xfffffffffffffffe, 0x200, 0x81, 0x1, 0x2, 0x1, 0x1, 0x7, 0x2b, 0x200003, 0x800100000000000, 0x4, 0x3, 0x71, 0x9, 0x3d5, 0x1d7bc000000, 0x5, 0xc, 0x4, 0x7fffffff, 0xdee, 0x38, 0x81, 0x9, 0x4, 0xfffffffffffffffe, 0x7165, 0x0, 0x1, 0x1, 0x3, 0x7, 0x7, 0xfffffffffffffff4, 0x7, 0x5, 0x6, 0x2, 0x3, 0xef76, 0x100000001, 0x410, 0xf1a, 0x4, 0x0, 0x1292000, 0x7, 0x88, 0x0, 0x8000000000000000, 0x2, 0x3, 0x6, 0xff, 0x8000, 0xff, 0x8, 0x0, 0x1, 0xf4, 0x7, 0x200, 0x7, 0x6, 0x0, 0x9, 0x9, 0x0, 0x3, 0x10000000000, 0x100000000000000, 0x9b6a, 0x1e83, 0x600, 0x7, 0x3, 0x45df, 0x8000]}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) ioctl$UI_DEV_DESTROY(r1, 0x5502) write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f454c4600040000000000000000000003003e00e9ffffff940200000200000040000000000000000000200000000000000000002d8f38000300feff0500030001000000030000002dffffffffffffff06000000000000000800000000000000a12f0000000000000700000000000000010000000000000000000060fcffffff0000000053680000e70000000000000000800000000000000500000000000000d9ffffffffffffff000000000000000003"], 0xe8) (async) write$binfmt_elf64(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="7f454c4600040000000000000000000003003e00e9ffffff940200000200000040000000000000000000200000000000000000002d8f38000300feff0500030001000000030000002dffffffffffffff06000000000000000800000000000000a12f0000000000000700000000000000010000000000000000000060fcffffff0000000053680000e70000000000000000800000000000000500000000000000d9ffffffffffffff000000000000000003"], 0xe8) close(r1) (async) close(r1) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) writev(r2, &(0x7f0000000240)=[{&(0x7f0000000140)="54aff20a51896d753478d4afb52c00990122e8e89248650e96f34a5738cb81d870521bcfbc468a3f96ab7df02f21c628cecf51ae5a51b1eeb16e27f51943eac2435703e2ec624f23269bb372719444319f83c7fe2da2d306d228617727e2d85418e2a474fe5911bfdfd1c2fb6e3f7387a2e09d9f", 0x74}, {&(0x7f0000000500)="f49b38d0422a42a91d7d2a4d10eec74e26e1a80cae3934d5478a6e75a20fc0c84e53475faf27931560bdf0d7beb723fc3793d80e4fa74c58a39b9c97636165f26d728c86905565ea469f575a8b21213ddebd7c9faf20fd7ee393", 0x5a}, {&(0x7f0000000900)="cb6da719f1c54fd5d10dd0d164c31187b2501d351ac89f8bccd2bbe2b11c50ecad668513a607a3549884b247fd6f2db727d7dc641b906533adf954393c5eae1cc859fe872e0cad06e58fabe907225652340fdb5732ddb74cbc10913645dc812ce473b1463012de", 0x67}], 0x3) r5 = socket$nl_crypto(0x10, 0x3, 0x15) getsockname(r5, &(0x7f0000000440)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, &(0x7f00000004c0)=0x80) 4.764570542s ago: executing program 2 (id=2076): set_mempolicy(0x1, &(0x7f0000000e80)=0x1ff, 0x7582) syz_clone(0xc1003000, 0x0, 0x0, &(0x7f00000014c0), 0x0, 0x0) r0 = openat$rtc(0xffffff9c, &(0x7f0000000040), 0xc2440, 0x0) prctl$PR_MCE_KILL(0x4e, 0x1, 0x24655ff6d38cd465) setresuid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x1300) 4.276725804s ago: executing program 0 (id=2077): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) sendmsg$inet(0xffffffffffffffff, 0x0, 0x240040c4) socket$vsock_stream(0x28, 0x1, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000380)={0x24, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x415}}, &(0x7f0000000300)={0x0, 0x22, 0xa, {[@local=@item_4={0x3, 0x2, 0x5, "b3ca46ae"}, @main=@item_4={0x3, 0x0, 0x9, "95bd7e21"}]}}, &(0x7f0000000340)={0x0, 0x21, 0x9, {0x9, 0x21, 0x2, 0x1, 0x1, {0x22, 0x9bb}}}}, &(0x7f0000000800)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) (async) munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) (async) ioctl$UFFDIO_MOVE(r1, 0xc028aa05, &(0x7f0000000000)={&(0x7f00003e3000/0x1000)=nil, &(0x7f0000c76000/0x1000)=nil, 0x1000}) openat$kvm(0xffffffffffffff9c, 0x0, 0x208240, 0x0) (async) syz_usb_connect(0x3, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x200, 0xe5, 0x60, 0x69, 0x10, 0x557, 0x2011, 0xd61e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x5, 0x4, 0x0, 0x10, "", [{{0x9, 0x4, 0xfb, 0x80, 0x0, 0xe7, 0x67, 0xce, 0x6}}]}}]}}, 0x0) 2.993629417s ago: executing program 0 (id=2078): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x48080}, 0x20004450) ioctl$HIDIOCGUSAGES(0xffffffffffffffff, 0xd01c4813, &(0x7f0000000240)={{0x3, 0xe8b5c71a5eb6f040, 0x5, 0xb7a4, 0x1, 0xffff}, 0x341, [0xc, 0x40, 0xcd3, 0x4, 0x6, 0x0, 0x80000000, 0x7, 0x9, 0x7a18fde9, 0x9, 0xf12, 0x4, 0x3, 0x378, 0x9, 0x4, 0x0, 0xfff, 0xffff06bd, 0x0, 0xf, 0x1a, 0xf2, 0x10, 0xc, 0x8, 0x10001, 0x401, 0x80000000, 0x401, 0x3ca5, 0x1, 0x0, 0xff, 0x40000004, 0x4, 0x3, 0x0, 0xaa80, 0x40000000, 0x80000000, 0x7fff, 0x7, 0x5, 0xa, 0x0, 0x10000, 0x405, 0x8, 0xffff, 0x91ba, 0x7, 0xb, 0x9, 0xb6, 0x24, 0xcb, 0x180, 0x7f, 0x200, 0x311, 0x66d1, 0xfffffffc, 0x9, 0xb6eb, 0xc74, 0x77, 0x1, 0xc0000000, 0x5cb5, 0xfffffffd, 0x401, 0xedf4, 0x4, 0x1000, 0x6, 0xfffffffe, 0x8001, 0xc1, 0x1, 0x8, 0x1, 0x32, 0x98, 0x7f, 0xffff, 0x401, 0x2, 0x2, 0x4680, 0x9a7f, 0xe665, 0x3c6e, 0x3, 0x7, 0x80, 0x4b, 0x9, 0x2, 0xb, 0x6, 0x4fa4, 0x80000000, 0x1, 0xb, 0x0, 0xfffffffa, 0x3, 0x8001, 0xfd, 0x101, 0x4, 0x10, 0xa, 0x9, 0x202, 0x7ff, 0x9, 0x80000000, 0xffff, 0x9, 0x2, 0x6, 0x2, 0xffffff87, 0xe, 0xd, 0x5, 0x8, 0x10, 0x7, 0x3, 0x400, 0x8, 0xff2, 0x6, 0x0, 0x6, 0x0, 0x8, 0x1, 0x3, 0x664, 0x4, 0x9, 0x2, 0x2, 0x1ff, 0xfffffffd, 0xeb6, 0x0, 0x9, 0x10000, 0x1, 0x9, 0x9, 0xff, 0x1, 0x4, 0x7ff, 0xe6, 0x6, 0x10001, 0x9, 0x68, 0x7, 0x201, 0x5, 0x3, 0x9a3f, 0x400000, 0x0, 0x80000067, 0xffffff7e, 0xa, 0x10000000, 0x10001, 0x7, 0x3, 0x12, 0x10a, 0xa, 0x40, 0x18, 0xedeb, 0xb5f8, 0x8bc, 0x3, 0x8000103, 0x5, 0xfffffffc, 0x4, 0x18000, 0x10, 0x1000, 0x288c, 0x1ffe, 0x73ee, 0x1, 0x5, 0x9, 0x7fffffff, 0x73, 0x6, 0x8, 0x6, 0x400, 0x40, 0x0, 0x0, 0x0, 0x546c, 0x981, 0x5aa, 0x10, 0x7, 0x2, 0x7, 0xc4c, 0x400045e3, 0x5, 0x7, 0x3, 0x5, 0x3, 0x942, 0x1, 0x2, 0xffffffff, 0x4, 0x200000ce, 0x6, 0x0, 0x1, 0xa, 0x3, 0x0, 0x9, 0x9, 0x37c, 0x10001, 0x8, 0x1, 0x5, 0xfffffffe, 0x6, 0x4, 0x6, 0x1, 0x8, 0x5, 0xfffffffa, 0x5, 0x0, 0x9, 0x5, 0x2, 0x7, 0x3, 0xffffff1b, 0x9, 0x2, 0xd, 0x34ea, 0x10000, 0x0, 0x80002001, 0x8, 0x8000, 0x10004, 0x10, 0x8, 0x8, 0x5, 0xfffffffe, 0x6, 0x10001, 0x0, 0x5, 0x10000, 0x4, 0xffff, 0x2, 0x89, 0x2, 0x3, 0x1, 0x73, 0x3, 0x19, 0x4, 0x1, 0xb, 0x1, 0x8, 0x400, 0x81, 0x80000004, 0x9, 0x9, 0x3, 0x4, 0x10000004, 0x0, 0x1, 0xce5fb90f, 0x5, 0x4, 0x10001, 0xf, 0x9, 0x100, 0x44, 0x59b, 0x7, 0x8, 0x9, 0x3, 0x2, 0x4, 0x6, 0x0, 0x8, 0x40, 0xd3, 0x7, 0xffffffff, 0x89aa, 0x8, 0x0, 0xf0ce, 0x2, 0x1, 0x0, 0x2, 0xc6, 0x1000, 0x800001, 0x937, 0xa, 0x6, 0x3, 0xffffffff, 0x5, 0x5, 0x5, 0x6, 0xbe, 0x1, 0x7, 0xe, 0xffffffff, 0x0, 0x3d6, 0x0, 0xae, 0x6, 0x1, 0xfffffeff, 0x4, 0x5, 0x7fff, 0x0, 0x7, 0x6, 0x709, 0x2, 0x40000049, 0x10, 0xfffffff7, 0xfffff772, 0x8, 0x80000000, 0x3, 0x7, 0xa9c, 0x9, 0x8, 0x1, 0x2, 0x8d, 0x1000, 0x69f, 0x1ff, 0x9, 0x12, 0x3, 0x10000, 0xfffefffd, 0xf, 0x1, 0x3, 0xffffa9b4, 0x1, 0x4, 0x5, 0x9, 0x4b5f, 0x6, 0x7fffffff, 0xffffffff, 0x1, 0x80000000, 0xb, 0x4, 0x88d, 0x1, 0x7, 0x8, 0x1, 0x0, 0x6, 0x818a, 0x10, 0x8, 0x10, 0xfffffffc, 0xfffff001, 0xa, 0xfffffff7, 0x8000005, 0x4, 0xffd, 0x9, 0x10, 0xfffffffd, 0x4, 0xc2, 0x400, 0x7, 0x0, 0x80000000, 0xd, 0x2, 0x8001, 0x0, 0x20000003, 0xb6, 0x101, 0x401, 0x2, 0x7, 0xc, 0x6623258, 0xee8e, 0x741, 0xfffffffc, 0x9, 0xffffa0a6, 0xc, 0x11, 0xffffffff, 0x8, 0x9, 0x1, 0x7f, 0x98, 0x9, 0xb, 0x800, 0x4, 0x9, 0x5, 0x7, 0x7, 0x80000008, 0xfe, 0x7f, 0x9, 0x4, 0x6, 0x20080000, 0x2, 0x8000, 0x0, 0x0, 0x1000, 0xb, 0x0, 0x7, 0x8000000, 0x0, 0xfff, 0x8101, 0x6, 0x0, 0x9, 0xc, 0x5, 0xffe, 0x100, 0xffff, 0x1, 0x401, 0xf0, 0x0, 0xfffff53d, 0x9, 0x2, 0x6, 0x0, 0x4, 0x4b15, 0x10000, 0x1, 0x6, 0x9, 0xd, 0x8, 0x4, 0xfffffe01, 0x1, 0x6, 0x20000, 0x2, 0x10001, 0x1, 0x7, 0xe4ce, 0x5, 0x9, 0xffffc487, 0x204, 0x10002, 0x1000, 0x7, 0x6, 0x6, 0x8, 0xfffffe00, 0x1, 0x1, 0x8000000, 0xe, 0x2, 0x2, 0x4, 0x0, 0xb66d, 0x3, 0x1000, 0x1eb4bce6, 0xe, 0x8, 0x1, 0x5, 0x1, 0x5, 0x9, 0x1000, 0x7, 0x62f2f805, 0x5, 0x3, 0xffffffff, 0x2, 0x7f, 0x6, 0xd, 0x40, 0x5, 0x2, 0xa, 0x5, 0x6, 0x80000000, 0x25, 0x8, 0x7, 0x7, 0x1, 0x5, 0x9, 0x6708, 0x10001, 0x0, 0x80, 0x8, 0x6, 0x0, 0xa95a, 0x2, 0x5, 0x2, 0x2, 0x4, 0xfff9, 0x80000001, 0x5, 0x1, 0x9, 0x0, 0xb7, 0x3, 0x4000ff, 0x9, 0x0, 0x80, 0xfea5, 0x7fff, 0x7, 0x7, 0x7, 0x7485, 0x197, 0x8, 0x0, 0x5, 0x10, 0x3, 0xe, 0x8, 0x1000, 0x4, 0x7, 0x382d, 0x459, 0xcad, 0x9, 0x0, 0x2, 0x119, 0x6, 0x20000a4, 0xe0, 0xfffffffb, 0x5, 0xffffffff, 0x2, 0x4007, 0xa05a, 0x0, 0x1, 0x3, 0x35, 0x8, 0x1, 0x2, 0x30, 0xb, 0x101, 0x2, 0x9, 0x3, 0x7, 0x8, 0x8, 0x1, 0x2000002, 0x6, 0x15294b70, 0x3, 0x3, 0x2, 0x1, 0xf, 0x9, 0x1, 0x80000000, 0x9, 0x8001, 0x5, 0x800081, 0x1, 0x2, 0x3fd, 0x1df, 0x6, 0x6, 0xfffffffa, 0x81, 0x9, 0x9, 0x9, 0x1, 0x9, 0x7, 0x2c1, 0x9e95, 0x0, 0xfffffedd, 0x30c8, 0x2, 0x38a0, 0x7b, 0x0, 0x8, 0x4, 0x6, 0x9, 0x0, 0x8, 0x8, 0x8, 0x1ff, 0x7fff, 0x3, 0x9, 0x8, 0x2b, 0x200006, 0x4, 0x7, 0x2, 0x4, 0xbfb, 0x7, 0x405, 0x6, 0x4, 0x91, 0x9, 0x8, 0x3, 0x6ae574d2, 0x6, 0xfffffe00, 0x1000, 0x5, 0x92, 0xffffffff, 0x7fffffff, 0xd7, 0x8001, 0x905, 0x3, 0x6, 0xfffffb31, 0xb, 0x4, 0x7, 0x8, 0x1, 0x6, 0x1, 0x40ff, 0x103, 0x7, 0x3, 0x6, 0x80000001, 0x0, 0x100a, 0x7fffffff, 0x7fff, 0x2, 0xfffffff8, 0x2, 0x9b3, 0x10001, 0x8, 0x4, 0x8, 0x6, 0x7542348d, 0x5, 0x5, 0x20, 0x40, 0x0, 0x6, 0xffffffff, 0x7, 0xa, 0x8, 0x17f, 0x6, 0x2, 0x1, 0x6, 0x14827783, 0xb, 0xe, 0x5, 0x1, 0xfe7, 0xfffffffc, 0x8, 0x7ff, 0x3e9, 0x0, 0x3, 0x2000, 0xa, 0x3, 0x9, 0x80000001, 0x81, 0x8, 0x14, 0x8, 0x4, 0x7f, 0xd, 0xf28c, 0x7, 0x6, 0x4, 0x7fffffff, 0xffff, 0x7fffffff, 0xc9, 0x2, 0xfffffffe, 0x924, 0x499, 0x100, 0x1, 0x5, 0xffff351b, 0x7, 0xfffffffb, 0x3, 0x9, 0x2, 0x7, 0x4, 0x4, 0x8, 0xff, 0xee, 0x2, 0x4, 0x8, 0x9f, 0x7, 0x3, 0x9, 0xc9, 0xffffffff, 0x1, 0x1, 0xfffffff7, 0x0, 0x6, 0x5, 0x6, 0x3fc, 0x51, 0x7, 0xefb, 0x200000b8, 0x1, 0x5, 0xfffffff7, 0x7, 0x7, 0x4, 0x6330, 0xff, 0x6, 0xea, 0xbb2d, 0xfff, 0x7, 0x6, 0x0, 0x6, 0xffff, 0xfffffffa, 0x3, 0x0, 0x1, 0x6, 0xfffffc00, 0x5, 0x7, 0x64c822e3, 0x9, 0x6, 0x80, 0x6, 0xfff, 0x0, 0xa7b, 0x1, 0xfffffff7, 0x7, 0x40, 0xa, 0x9b, 0x3, 0xe, 0xf01, 0x1, 0x3, 0x40, 0x3, 0x4, 0x5, 0x5, 0x7ff, 0x5, 0x8, 0x5, 0x3, 0x8, 0x2, 0x80000001, 0x54, 0x80400, 0x1, 0x8, 0xa, 0x9, 0x10000c0, 0x3, 0x72, 0x80, 0x1000, 0x7, 0x800, 0x6, 0xd19, 0x3, 0x1, 0x6, 0x20000000, 0x0, 0xe, 0x5, 0x3, 0xfffffffa, 0xa01, 0xf3, 0xffffff00, 0x8, 0xe, 0x3, 0x3ff, 0x5, 0x2, 0x6, 0x5, 0xffff, 0xfffffff9, 0x9, 0x5, 0x62, 0x2, 0x1, 0xfffffffa, 0x2, 0x2, 0x9, 0x7, 0x0, 0x7, 0x8, 0x10000, 0x42, 0xaa1, 0x7, 0x2b, 0x6, 0x10, 0x5, 0x200, 0x9, 0x6, 0x3, 0x8, 0x10, 0x4, 0x6, 0x633, 0xf05, 0x401, 0x101, 0x200, 0x8, 0x7ff, 0x0, 0x40, 0x1, 0x10000, 0x9, 0x40, 0x9, 0xb6f, 0x7f, 0x8, 0x6, 0xe, 0x3, 0x80000001, 0x0, 0x8, 0x8, 0x7, 0xde, 0x6, 0x89, 0x0, 0x100, 0x1, 0x9, 0x4, 0x400, 0x1, 0x0, 0x200, 0xe9ab, 0x3, 0x8000, 0x13, 0x2, 0x2, 0x43, 0x3ff, 0x0, 0x1, 0xc, 0x401, 0x6, 0x7, 0xa, 0xf, 0xf39d, 0x71, 0xfff, 0x7, 0x8]}) r2 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x860b01) write$char_usb(r2, &(0x7f0000000040)="e2", 0x2250) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000080)=""/222) ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f0000000040)={0x7d, 0x8e43, 0x7, 0xa, 0x1000, 0x63ea65fdcf63e46d}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0x3) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000000)={0x2, 0x35f5, 0x1000, 0x7, 0x11, "7f7c86eddf661d25"}) ioctl$TCSETSW2(r0, 0x5408, &(0x7f0000000040)={0x2, 0x0, 0x4, 0x1, 0x0, "23f555d9adb42d4408020e90d1beaa82dc1ecf", 0xffffffff}) r3 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_misc(r3, &(0x7f0000000180)="7f843acb8a1df5075eeead7d0470d00e2acc8af341cc7e187a014f93a8f1714dea", 0x21) 2.993227216s ago: executing program 2 (id=2079): ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc0109207, &(0x7f0000000300)={&(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0xb702}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x109f02, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000040)={0x4, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000340)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x86) fchdir(r2) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c1c7a5c6106010800000000000000000000000a0500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4040010}, 0x20000000) ioctl$KVM_SET_DEVICE_ATTR(r0, 0x4018aee1, 0x0) r3 = syz_usb_connect$uac1(0x1, 0xd1, &(0x7f0000000180)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x763, 0x2080, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xbf, 0x3, 0x1, 0x10, 0x0, 0x3, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3ff, 0x2b}, [@input_terminal={0xc, 0x24, 0x2, 0x4, 0x100, 0x1, 0x8, 0x4, 0x10, 0xd2}, @extension_unit={0x7, 0x24, 0x8, 0x2, 0x3ff, 0x7}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x101, 0x3, 0x4, 0x5}, @selector_unit={0x5, 0x24, 0x5, 0x6, 0x5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x5b, 0x5, 0x7, 0x3, 0x9}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x3, 0x3, 0x8, {0x7, 0x25, 0x1, 0x8, 0x0, 0x10}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x80, 0x1, 0x2, 0xff, "160d"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x2, 0x81, 0xc3, 0x5, 0x1}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x1, 0x4, 0x5, 0x81, "4f570fe0bd02"}, @format_type_ii_discrete={0xb, 0x24, 0x2, 0x2, 0x286, 0xfb, 0x8, "a741"}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x2, 0x0, 0x63, 0x9, 0x6}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x40, 0xb, 0xfe, {0x7, 0x25, 0x1, 0xc, 0x4, 0x9061}}}}}}}}]}}, &(0x7f0000000480)={0xa, &(0x7f0000000280)={0xa, 0x6, 0x201, 0xe, 0xd, 0xa, 0x20, 0x3}, 0xa9, &(0x7f0000000380)={0x5, 0xf, 0xa9, 0x4, [@ext_cap={0x7, 0x10, 0x2, 0x8, 0x6, 0xf, 0xfffb}, @ssp_cap={0x20, 0x10, 0xa, 0x10, 0x5, 0x8, 0xf00, 0xfff, [0xffff00, 0xff0000, 0x0, 0xff0000, 0xff0008]}, @ssp_cap={0x10, 0x10, 0xa, 0x0, 0x1, 0x6, 0xf, 0xe9f, [0xffcf]}, @generic={0x6d, 0x10, 0x2, "27a630b1f7a5ea2deed0aac74af17aab083f0ad27248e1369cc21f8e07d57b33fe150eae87430b447d6b1ac55b458d6b8aa23a7d20794552dbef3081b811d6c45d1c34080c7e3f5e8a28cab3cded03972696e63a76e7a25bae0d33bc25e5918e773db394c0eced87ed44"}]}, 0x1, [{0x2c, &(0x7f0000000440)=@string={0x2c, 0x3, "5d4bb5deb0563a487b1e9d892f8199002fe06c9ed3864d771b837215abd07f7168b524269b37e9e188ee"}}]}) syz_usb_control_io(r3, &(0x7f00000006c0)={0x2c, &(0x7f00000004c0)={0x20, 0x4, 0xe7, {0xe7, 0x24, "ddb1136c874f94892f3827e901e7e3fc39c47b81103488bac8e319ceaae35c8c293472aba1297d5d4fe222599a6d8c70c3402e5f64f6780512c96691806c36a5184aaf649274f7eb08b359304ea28b234331945dd888e6ba5f7eb8d74c0ce4ac6d9a5579751b2cd45a3eedd8912a9911706f6e97699f118d9b308daba3dd907bc0d5788cae20cf1e00ccf41f9dfa89cfb9f54ca94a7ccb57da48fb68a46bda5dcfa48f62acffc107d3d29830b6afcecafdc60f1c43c723c18c397bc1c1b5c6275d19ed67ee9e4ff4447ce328e1d1da9fac56844af16a9868daa4e67a0d43fe35c146ffccb2"}}, &(0x7f00000005c0)={0x0, 0x3, 0x20, @string={0x20, 0x3, "7d75f03e93ae09ae687d0f74b636d4bd311c5c1854a6df2fa6b9d568cc30"}}, &(0x7f0000000600)={0x0, 0xf, 0x19, {0x5, 0xf, 0x19, 0x3, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x1e, 0xe, 0x5, 0xfffa}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x4, 0x9, 0x5f, 0x45c}]}}, &(0x7f0000000640)={0x20, 0x29, 0xf, {0xf, 0x29, 0x4, 0x80, 0x9, 0x6, "43c8267d", "bbffe514"}}, &(0x7f0000000680)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x4, 0x3, 0x0, 0x0, 0x57, 0x8, 0x7f}}}, &(0x7f0000000b40)={0x84, &(0x7f0000000700)={0x20, 0x15, 0x59, "96d6680c1805369659532ae2fdcb60e1816df74bc013a3a5ac35c2a242f800a1487506051aeeb51004f729fc9a4fc88a425b5b2efc1576e15b38c1e7fded3c17680b37f9bfc812e4ddbab59316fbc555d4fa1e6333d5be16dd"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0xff}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000800)={0x20, 0x0, 0x4, {0x0, 0x2}}, &(0x7f0000000840)={0x20, 0x0, 0x4, {0x1, 0x10}}, &(0x7f0000000880)={0x40, 0x7, 0x2, 0x7}, &(0x7f00000008c0)={0x40, 0x9, 0x1, 0xda}, &(0x7f0000000900)={0x40, 0xb, 0x2, "0350"}, &(0x7f0000000940)={0x40, 0xf, 0x2, 0x6}, &(0x7f0000000980)={0x40, 0x13, 0x6, @link_local}, &(0x7f00000009c0)={0x40, 0x17, 0x6, @random="ae11f6d6059f"}, &(0x7f0000000a00)={0x40, 0x19, 0x2, "61b4"}, &(0x7f0000000a40)={0x40, 0x1a, 0x2, 0xb82}, &(0x7f0000000a80)={0x40, 0x1c, 0x1, 0x8}, &(0x7f0000000ac0)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000b00)={0x40, 0x21, 0x1, 0x4}}) 2.373920782s ago: executing program 1 (id=2080): r0 = socket$nl_rdma(0x10, 0x3, 0x14) r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000003c0)={0x1, @pix_mp={0x8e0, 0xffff8000, 0x36315247, 0x9, 0x3, [{0x2, 0x6}, {0xc00}, {0x3, 0x5de3}, {0x14, 0x5}, {0x9, 0x4000069a}, {0x4, 0x3}, {0x81, 0x5}, {0x4, 0x17}], 0x7b, 0x2, 0x8, 0x1}}) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x60, 0x1403, 0x20, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'nicvf0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}]}, 0x60}, 0x1, 0x0, 0x0, 0x20008015}, 0x8001) (async, rerun: 32) r2 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x18b1, 0x37, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x90, 0x27, "", [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xc1, 0xfe, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x400, 0x9, 0xc0, 0x4}}}}}]}}]}}, 0x0) (rerun: 32) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000240), 0x18a500, 0x0) ioctl$FBIOPUT_VSCREENINFO(r3, 0x4601, &(0x7f0000000040)={0x80, 0x258, 0x0, 0x140, 0x6, 0x0, 0x0, 0x0, {0x10, 0x8}, {0x8, 0x8}, {0xfffffffe, 0x8, 0x1}, {0xe, 0x8000b, 0xfffffffd}, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb, 0xc1, 0x6, 0x0, 0x17, 0x200, 0x3, 0x6}) (async, rerun: 32) syz_usb_control_io$hid(r2, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io(r2, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x20, 0x22, 0x84, {0xa1, 0x9, "c263138526792c3cbdeace918d0fb74237cc6e446c4e88e78881ce2a52973661d67a0c5544389eaeadcfe4a3f0c6541259c42632d7bf4e71b154dbca000400001368cc117a7346d97565724b97bdfa0c8e8b582ddcfe3c032c80d9da46c680be685627e4513ddfcaf9ba3c0168c18e4eb1ef8c2ca0b6c2ef3fc71095a4d9a1ba27822fa5a849d8acb967c3fd80a90a38f7946f6cae37c3499b922a58e39739"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xb0, 0x1405, 0x1, 0x70bd2c, 0x25dfdbfe, "", [{{0x8}, {0x8, 0x3, 0x8}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x2}}, {{0x8}, {0x8}}, {{0x8}, {0x8, 0x3, 0x1}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x2}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}, {{0x8}, {0x8, 0x3, 0x4}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x1}}, {{0x8}, {0x8}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x6050}, 0x0) syz_usb_connect$uac3(0x2, 0x80, &(0x7f0000000000)=ANY=[@ANYBLOB="12015002000000206307120600000002030109026e000301094004080b0101010030c50904000000010130000a2401030a008100000009554ba7960fbc6e8009040101010102300009050102bfe86a393bc03cf97f17090004030a080a25257f0000000402000904020000010230000904020101020000000000000008008108010a252509000000cd0600a82f38a01bf59c2d08efe0f87cd8b898623169e356f4d5daa15ef5ae76d595f83cccba35"], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0}) 2.362507953s ago: executing program 0 (id=2081): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d0) semop(0x0, &(0x7f0000000100)=[{0x2, 0x200, 0x800}, {0x2, 0xfffd, 0x1000}], 0x1f4) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0/file0\x00', 0x111002, 0x151) getdents(r0, &(0x7f0000000140)=""/177, 0xb1) 2.139479136s ago: executing program 0 (id=2082): r0 = socket$netlink(0x10, 0x3, 0x400000000000004) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r2 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x4, 0x0) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r2, 0xc0305616, &(0x7f0000000080)={0x0, {0x2, 0x3ce}}) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = openat$userfaultfd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$USERFAULTFD_IOC_NEW(r4, 0xaa00) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000240)) socket$inet(0x2, 0x1, 0x100) close(0x3) r6 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r6, 0x800442d2, 0x0) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000001080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x3}) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x1, 0x0, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x0, 0x20, 0x3, 0x0, 0x106c, 0x80000001, 0x8000000000000, 0x80000004000080, 0x0, 0x8, 0x0, 0x4, 0x9, 0x8001], 0xfec00000, 0x3c4210}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x5fffffff}]}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x90}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000100001000000000000000000001f5dad8b"], 0x3c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.692847153s ago: executing program 2 (id=2083): mremap(&(0x7f000046b000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000769000/0x1000)=nil) rmdir(&(0x7f0000000100)='./control\x00') mremap(&(0x7f000040b000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f00004b3000/0x4000)=nil) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) r4 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x4fc, 0x5d8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0xff, 0x50, 0xc9, "", [{{0x9, 0x4, 0x0, 0xd, 0x1, 0x3, 0x1, 0x2, 0xb, {0x9, 0x21, 0xff7f, 0x77, 0x1, {0x22, 0xfb1}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x5, 0x44}}}}}]}}]}}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000240)={0x24, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000300)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x0, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0x4, 0x0, 0x80000000], 0x10000, 0x202}) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000000040)={0x2000, 0x101, 0x0, 'queue0\x00'}) write$sndseq(r5, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x221c0, 0xac) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x201, 0x1036, r6, 0x0) close(r6) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f00000002c0)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f0000000040)={0x28, 0x0, r8, r1, 0x0, 0x0, 0xdead, 0x4}) r9 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r9, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r9, &(0x7f00000000c0)={0x1d, r10}, 0x10) sendmsg$can_bcm(r9, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="01000000400800000008000000000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x80}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 1.487970109s ago: executing program 3 (id=2084): r0 = socket$phonet_pipe(0x23, 0x5, 0x2) recvfrom$phonet(r0, 0x0, 0xfffffffffffffee6, 0x40018127, 0x0, 0x0) r1 = syz_open_dev$video(&(0x7f0000000000), 0x8, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000005d80)={&(0x7f0000000100)=@proc={0x1d, 0x0, 0x25dfdbfc, 0x20000000}, 0xc, 0x0, 0x0, 0x0, 0x0, 0x4c0d1}, 0x40830) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0x7d4165c9) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x7d4165c9) listen(r4, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r6, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000780)={@in6={{0xa, 0x4e24, 0x2, @empty, 0xc}}, 0x0, 0x0, 0x20, 0x0, "9c0fe2154aa786d10084ecfbe8e86f7d312fcc8fde38d5823d22fbbb55a7837e5f2329f4d662f2185f18fae43e09d661d12a01669d6eef2e4733c2c29a3c3d16ef45c7c1c8ecfcc76b47d9ab9a573f11"}, 0xd8) listen(r7, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r7, 0x6, 0xe, &(0x7f0000000680)={@in6={{0xa, 0x4e21, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x81}}, 0x0, 0x0, 0x40, 0x0, "2b20a1a47cddc63b223be606d7303a4d4d11e10450d766feb63b382d54bab577021cad5de4fe7630a33b6deca160b1267ff02123bc27830000000000ffff40000000000000b5b29049cb65f00300"}, 0xd8) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000540)=[{&(0x7f0000000180)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f00000000c0)={0x4, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x9c, '\x00', @p_u8=&(0x7f0000000100)=0x6}}) r9 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) r13 = getpid() sched_setscheduler(r13, 0x1, &(0x7f0000000240)=0x7) syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@new_dev={0x84, 0xa26, 0x0, 0x0, 0x1000, 0xffffffff, r13, 0x0, 0x30}}}, &(0x7f0000000480)=0x0) r17 = socket$inet6_tcp(0xa, 0x1, 0x0) r18 = getpgrp(r13) syz_ublk_add_dev(r9, r10, r11, r12, &(0x7f0000000780)={0x2e, 0x2, 0x0, r14, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, r15, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x1, 0x929, 0x0, 0x0, 0x1000, 0xffffffff, r18, 0x0, 0x10a}}}, &(0x7f0000000800)) r19 = dup(r17) syz_ublk_setup_queues(r19, r16, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x801, 0x256, 0x0, r19}, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x4, 0x2000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7c, 0x0, 0x0, 0x1eb}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9137, 0x800, 0x1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x1000, 0x1, 0x369}}], 0x1, &(0x7f00000003c0)={0x2e, 0x44, 0x0, r19, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfffd, 0xe45, 0x0, 0x0}}, 0x0) 1.177487685s ago: executing program 0 (id=2085): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7f, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000003c0)={0x1, @pix_mp={0x0, 0x2, 0x3136564e, 0x0, 0x7, [{0x0, 0xa}, {0x5}, {}, {0xe}, {}, {0x400}, {}, {0x40000000}], 0x8}}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, 0x0, 0x0, 0x10000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x58, 0x2, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x3}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000800}, 0x40f0) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000140)={'lo\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x1, 0x0, 0x4, 0x5, 0x2, 0x1, 0x20}}) 848.664998ms ago: executing program 1 (id=2086): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b06, 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0) ioctl$SOUND_PCM_READ_CHANNELS(r2, 0x80045006, &(0x7f0000000140)) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES16=r1, @ANYBLOB='\a'], 0x0) 425.462368ms ago: executing program 0 (id=2087): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x2040, 0x0) fcntl$getflags(r1, 0x401) fsopen(0x0, 0xcce192ff6ee38041) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000002fc0), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000003100)={0x0, 0x0, &(0x7f00000030c0)={&(0x7f0000000000)={0x28, r4, 0x611, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_CONFIG={0xc, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_CONNECTED_TO_GATE={0x5, 0x1d, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40488c5}, 0x20000084) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x6c, r4, 0x2, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x7, 0x52}}}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_FRAME={0x34, 0x33, @disassoc={{{0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1}, {0x9}, @device_a, @broadcast, @random="bf836fc08a7b", {0x7}, @value=@ver_80211n={0x0, 0xa, 0x2, 0x3, 0x0, 0x1, 0x0, 0x0, 0x1}}, 0x28, @val={0x8c, 0x10, {0xb6b, "a5eeba0d39e2", @short="9e0d3663a8cafa89"}}}}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190040000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 234.082984ms ago: executing program 2 (id=2088): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) r1 = socket$unix(0x1, 0x2, 0x0) (async) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0x1) ioctl$TCSETS(r3, 0x8924, 0x0) (async) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) (async) close(r1) (async) listen(r2, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) (async) r5 = userfaultfd(0x801) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) (async) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) (async, rerun: 64) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) (async, rerun: 64) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) (async) recvmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x21, 0x0) (async) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000100)=ANY=[@ANYBLOB="f8000000000203000000000000000000070000106c000a80500002800c000280050001003a0000000c000280050001001100000006000340000200002c00018014000300ff01000000000000000000000000000114000400fc01000000000000000000000000000108000140000000010800014000000000080001400000000078000a80100002800c0002800500010000000000180002801400018008000100e0000002080055f1c32200000000028006000340000000002c00018014000300fc00000000000000000000000000000014000400fc0200000000000000000000000000001400018008000100ac1e010108000200ac1414bb"], 0xf8}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) (async) ioctl$SIOCX25GSUBSCRIP(0xffffffffffffffff, 0x89e0, &(0x7f0000000300)={'team0\x00', 0x0, 0x2}) (async, rerun: 64) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) r8 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r8, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x18, 0x140d, 0x2, 0x70bd2d, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x3}]}, 0x18}, 0x1, 0x0, 0x0, 0x2000800}, 0x4000040) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r7, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x3, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x2}, [@CTA_NAT_DST={0x18, 0xd, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @empty}]}]}, 0x2c}}, 0x810) (async, rerun: 32) r9 = socket(0x10, 0x803, 0x0) (rerun: 32) sendto(r9, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) (async) recvmmsg(r9, &(0x7f00000037c0), 0x46, 0x2000, &(0x7f0000003700)={0x0, 0x989680}) 0s ago: executing program 3 (id=2089): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_TX_TS(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x20, 0x70bd2a, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x9}, @NL80211_ATTR_TSID={0x5, 0xd2, 0xa}]}, 0x38}, 0x1, 0x0, 0x0, 0x30000040}, 0x2000000) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0xd0, r1, 0x100, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x2, 0xa58}}}}, [@NL80211_ATTR_DURATION={0x8, 0x57, 0xf}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x6}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x5}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98a}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x66700}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x304}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x7}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x1d}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}], @NL80211_ATTR_DURATION={0x8, 0x57, 0x7d1}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40000}, 0x20040005) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000340), 0x701000) sendmsg$RDMA_NLDEV_CMD_RES_GET(r3, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x40, 0x1409, 0x10, 0x70bd2b, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x40}, 0x40054) connect$inet6(r3, &(0x7f0000000480)={0xa, 0x4e24, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x2}, 0x1c) ioctl$SIOCX25SFACILITIES(r3, 0x89e3, &(0x7f00000004c0)={0x46, 0xfffffffb, 0xc, 0xb, 0x9}) r4 = socket$inet6(0xa, 0x3, 0x1) sendmsg$NL80211_CMD_NOTIFY_RADAR(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x64, r1, 0x2, 0x70bd29, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xb6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3}]}, 0x64}, 0x1, 0x0, 0x0, 0x200400c1}, 0x40005) getsockopt$inet6_int(r4, 0x29, 0xce, &(0x7f0000000640), &(0x7f0000000680)=0x4) ioctl$FE_DISEQC_RESET_OVERLOAD(r3, 0x6f3e, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$NET_DM_CMD_STOP(r5, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x14, r6, 0x1, 0x70bd2d, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x4) setsockopt$MRT6_DEL_MFC_PROXY(r4, 0x29, 0xd3, &(0x7f0000000840)={{0xa, 0x4e21, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8e51}, {0xa, 0x4e20, 0x1, @private2, 0x9}, 0x0, {[0x4bf0, 0x4, 0xfffffff9, 0x7, 0x0, 0xffffffff, 0x832d, 0xfffff7b2]}}, 0x5c) setsockopt$inet6_MCAST_LEAVE_GROUP(r4, 0x29, 0x2d, &(0x7f00000008c0)={0x7, {{0xa, 0x4e22, 0x81, @private2={0xfc, 0x2, '\x00', 0x1}, 0x66d6}}}, 0x88) getsockopt$nfc_llcp(r3, 0x118, 0x4, &(0x7f0000000980), 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a00), r3) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000a40)={@local, 0x0}, &(0x7f0000000a80)=0x14) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000b40)={'ip_vti0\x00', &(0x7f0000000ac0)={'syztnl2\x00', 0x0, 0x7, 0x10, 0xfffffffd, 0x62ac, {{0x15, 0x4, 0x2, 0x20, 0x54, 0x66, 0x0, 0x5, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, {[@cipso={0x86, 0x30, 0xfffffffffffffffc, [{0x7, 0x4, "c30b"}, {0x0, 0x12, "1824fd05b376c63e5c46abdda7f19a14"}, {0x5, 0xb, "4de33e2af7ddb8404e"}, {0x6, 0x9, "69e1364a6662d4"}]}, @timestamp={0x44, 0x10, 0xb6, 0x0, 0xb, [0x507, 0x2, 0x430f4a4e]}]}}}}}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000c80)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000c40)={&(0x7f0000000b80)={0x9c, r7, 0x300, 0x70bd29, 0x25dfdbfe, {}, [@ETHTOOL_A_DEBUG_HEADER={0x88, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x1}, 0x20000010) syz_genetlink_get_family_id$mptcp(&(0x7f0000000cc0), r0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000d40), r0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000d80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000001040)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000001000)={&(0x7f0000000dc0)={0x220, r10, 0x4, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_TX_RATES={0x114, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xa8, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HT={0x19, 0x2, [{0x0, 0x3}, {0x5, 0x6}, {0x0, 0x7}, {0x4}, {0x2}, {}, {0x0, 0x3}, {}, {0x1, 0x7}, {0x4, 0x4}, {0x0, 0x9}, {0x0, 0x7}, {}, {0x6, 0x3}, {0x0, 0x3}, {0x3, 0x1}, {0x5}, {0x5, 0xa}, {0x7}, {0x2}, {0x2, 0x3}]}, @NL80211_TXRATE_HT={0x1a, 0x2, [{0x5, 0x7}, {0x1}, {0x4, 0x2}, {0x2, 0x2}, {0x0, 0x4}, {0x0, 0x1}, {0x1, 0x5}, {0x3, 0x1}, {0x0, 0x6}, {0x3, 0xa}, {0x1, 0x6}, {0x6, 0x8}, {0x1, 0x5}, {0x0, 0x8}, {0x1, 0x4}, {0x2, 0x6}, {0x0, 0x3}, {}, {0x5, 0x4}, {0x5, 0x3}, {0x0, 0x5}, {0x4}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x1e, 0x2, [{0x5, 0x9}, {0x4, 0x3}, {0x6, 0x9}, {0x2, 0x4}, {0x2, 0x4}, {0x0, 0x5}, {0x4, 0x5}, {0x1, 0x2}, {0x5, 0x3}, {0x2, 0x9}, {0x6, 0xa}, {0x0, 0x6}, {0x6, 0x7}, {0x6, 0x6}, {0x4, 0x3}, {0x5}, {0x4, 0x4}, {0x1, 0x6}, {0x7}, {0x2}, {0x1, 0xa}, {0x1, 0x4}, {0x4, 0x5}, {0x7, 0x5}, {0x2}, {0x2, 0x2}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xd, 0x2, 0x134b, 0x7f, 0x0, 0xadee, 0x5, 0x2]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xd, 0x84, 0x0, 0x6, 0x8, 0x1, 0x7, 0x2]}}, @NL80211_TXRATE_LEGACY={0xa, 0x1, [0x3, 0x18, 0x12, 0x30, 0x9, 0xb]}]}, @NL80211_BAND_2GHZ={0x68, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3f, 0x2, [{0x1, 0x8}, {0x1, 0xa}, {0x1}, {0x4, 0xa}, {0x7, 0x2}, {0x2, 0x6}, {}, {0x1}, {0x4, 0x3}, {0x0, 0x4}, {0x7, 0x1}, {0x2, 0x2}, {0x0, 0xa}, {0x7, 0x3}, {0x2, 0x9}, {0x4, 0x8}, {0x1, 0x3}, {0x3, 0x1}, {0x6, 0x2}, {0x1, 0x7}, {0x2, 0x3}, {0x2, 0xa}, {0x3, 0x5}, {0x7}, {0x1, 0x8}, {0x3}, {0x6}, {0x4, 0x8}, {0x7, 0x1}, {0x3, 0xa}, {0x3, 0x7}, {0x6, 0x9}, {0x0, 0x6}, {0x5, 0x4}, {0x2, 0x8}, {0x6, 0x3}, {0x3, 0xa}, {0x1, 0x9}, {0x4, 0x7}, {0x1, 0x6}, {0x4, 0x6}, {0x7, 0x7}, {0x5, 0x5}, {0x1}, {0x4, 0x1}, {0x1, 0x2}, {0x5}, {0x3, 0x1}, {0x3, 0x4}, {0x5, 0x6}, {0x7, 0x6}, {0x6, 0x4}, {0x3, 0x8}, {0x6, 0x9}, {0x2, 0x8}, {0x3, 0x6}, {0x5, 0x3}, {0x4, 0xa}, {0x5}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0xf, 0x5, 0x2, 0x3, 0x1, 0x3, 0xe66]}}, @NL80211_TXRATE_HE_GI={0x5}]}]}, @NL80211_ATTR_TX_RATES={0xc0, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x60, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x3, 0x0, 0x7b76, 0x7, 0x0, 0x4, 0x6]}}, @NL80211_TXRATE_HT={0x17, 0x2, [{0x6, 0x9}, {0x0, 0x3}, {0x3, 0x4}, {0x7, 0x9}, {0x5}, {0x5, 0x6}, {0x4, 0x2}, {0x1, 0x1}, {0x6, 0x8}, {0x4, 0xa}, {0x0, 0x9}, {0x7, 0x9}, {0x2, 0xa}, {0x1, 0x7}, {0x4, 0x1}, {0x6, 0x2}, {0x7, 0xa}, {0x4, 0x5}, {0x1, 0x7}]}, @NL80211_TXRATE_HT={0xa, 0x2, [{0x0, 0x9}, {0x3, 0x4}, {0x3, 0x5}, {0x4, 0x3}, {0x0, 0x5}, {0x1, 0xa}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x1ff, 0xe, 0x5, 0x6, 0x1, 0x7, 0x2a93]}}, @NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_60GHZ={0x5c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2a, 0x2, [{0x5, 0x5}, {0x2, 0x6}, {0x6}, {0x6, 0x8}, {0x6, 0x6}, {0x3, 0xa}, {0x3, 0x8}, {0x2, 0x8}, {0x1, 0xa}, {0x1, 0xa}, {0x5, 0x7}, {0x1}, {0x5, 0x4}, {0x3, 0x7}, {0x2, 0x4}, {0x0, 0x5}, {0x5, 0x8}, {0x4, 0x1}, {0x3, 0x8}, {0x1, 0x6}, {0x4, 0xa}, {0x7, 0x4}, {0x2, 0x9}, {0x3, 0x1}, {0x7, 0x8}, {0x4, 0x9}, {0x7, 0x1}, {}, {0x3, 0xa}, {0x1, 0x2}, {0x4, 0x1}, {0x1, 0x7}, {0x5}, {0x6, 0x2}, {0x4, 0x3}, {}, {0x7, 0xa}, {0x7, 0x7}]}, @NL80211_TXRATE_LEGACY={0x23, 0x1, [0x77, 0x29, 0x1b, 0xb, 0x4, 0x6, 0x1, 0x60, 0x6c, 0x1, 0x9, 0x4, 0xc, 0x0, 0x48, 0x60, 0x30, 0x18, 0x9, 0xb, 0x1, 0x1b, 0x2, 0x6c, 0x2, 0x30, 0x9, 0x1, 0x5, 0x36, 0xb]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x30, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0xc, 0x4, 0xdd08, 0xb0, 0xda30, 0x5, 0x1d91]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0xb113, 0x9, 0xc88, 0x1, 0xfff, 0x8001, 0x9]}}]}]}]}, 0x220}, 0x1, 0x0, 0x0, 0x400a040}, 0x0) socket$key(0xf, 0x3, 0x2) write$P9_RCLUNK(r3, &(0x7f0000001080)={0x7, 0x79, 0x1}, 0x7) kernel console output (not intermixed with test programs): al failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.688444][ T5595] Bluetooth: hci4: failed to register connection device [ 469.688954][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.688975][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.689001][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.689009][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.689021][ T5595] Workqueue: hci4 hci_rx_work [ 469.689051][ T5595] Call Trace: [ 469.689059][ T5595] [ 469.689068][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.689094][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.689118][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.689142][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.689171][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.689203][ T5595] kobject_add+0x163/0x240 [ 469.689225][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.689255][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.689285][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.689311][ T5595] device_add+0x3fa/0xb80 [ 469.689334][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.689366][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.689399][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.689423][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.689443][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.689462][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.689489][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.689514][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.689539][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.689566][ T5595] hci_event_packet+0x67a/0xf10 [ 469.689596][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.689623][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.689651][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.689679][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.689714][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.689742][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.689782][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.689804][ T5595] process_one_work+0xaaf/0x1480 [ 469.689845][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.689864][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.689897][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.689922][ T5595] worker_thread+0xb05/0x10d0 [ 469.689966][ T5595] kthread+0x388/0x470 [ 469.689993][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.690012][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.690040][ T5595] ret_from_fork+0x514/0xb70 [ 469.690069][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.690097][ T5595] ? __switch_to+0xc89/0x1420 [ 469.690122][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.690150][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.690194][ T5595] [ 469.690247][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.690279][ T5595] Bluetooth: hci4: failed to register connection device [ 469.690715][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.690735][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.690762][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.690769][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.690781][ T5595] Workqueue: hci4 hci_rx_work [ 469.690810][ T5595] Call Trace: [ 469.690818][ T5595] [ 469.690826][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.690852][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.690875][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.690900][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.690929][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.690961][ T5595] kobject_add+0x163/0x240 [ 469.690982][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.691013][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.691041][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.691067][ T5595] device_add+0x3fa/0xb80 [ 469.691091][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.691122][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.691153][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.691177][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.691196][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.691215][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.691241][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.691264][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.691288][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.691316][ T5595] hci_event_packet+0x67a/0xf10 [ 469.691345][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.691372][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.691392][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.691421][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.691455][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.691482][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.691519][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.691543][ T5595] process_one_work+0xaaf/0x1480 [ 469.691577][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.691592][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.691621][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.691654][ T5595] worker_thread+0xb05/0x10d0 [ 469.691696][ T5595] kthread+0x388/0x470 [ 469.691723][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.691741][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.691770][ T5595] ret_from_fork+0x514/0xb70 [ 469.691798][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.691822][ T5595] ? __switch_to+0xc89/0x1420 [ 469.691848][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.691874][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.691918][ T5595] [ 469.692103][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.692137][ T5595] Bluetooth: hci4: failed to register connection device [ 469.692644][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.692664][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.692688][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.692695][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.692707][ T5595] Workqueue: hci4 hci_rx_work [ 469.692736][ T5595] Call Trace: [ 469.692742][ T5595] [ 469.692751][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.692776][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.692799][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.692821][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.692848][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.692880][ T5595] kobject_add+0x163/0x240 [ 469.692902][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.692933][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.692963][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.692989][ T5595] device_add+0x3fa/0xb80 [ 469.693011][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.693039][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.693068][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.693087][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.693104][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.693122][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.693145][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.693167][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.693190][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.693213][ T5595] hci_event_packet+0x67a/0xf10 [ 469.693242][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.693269][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.693290][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.693317][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.693347][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.693373][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.693410][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.693431][ T5595] process_one_work+0xaaf/0x1480 [ 469.693472][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.693491][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.693529][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.693554][ T5595] worker_thread+0xb05/0x10d0 [ 469.693599][ T5595] kthread+0x388/0x470 [ 469.693633][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.693653][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.693680][ T5595] ret_from_fork+0x514/0xb70 [ 469.693711][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.693738][ T5595] ? __switch_to+0xc89/0x1420 [ 469.693764][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.693791][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.693835][ T5595] [ 469.693888][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.693922][ T5595] Bluetooth: hci4: failed to register connection device [ 469.694356][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.694376][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.694403][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.694409][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.694422][ T5595] Workqueue: hci4 hci_rx_work [ 469.694451][ T5595] Call Trace: [ 469.694458][ T5595] [ 469.694467][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.694493][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.694516][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.694541][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.694569][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.694601][ T5595] kobject_add+0x163/0x240 [ 469.694622][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.694660][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.694690][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.694715][ T5595] device_add+0x3fa/0xb80 [ 469.694739][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.694770][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.694803][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.694826][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.694844][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.694864][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.694891][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.694915][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.694939][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.694966][ T5595] hci_event_packet+0x67a/0xf10 [ 469.694996][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.695023][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.695043][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.695071][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.695106][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.695133][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.695168][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.695190][ T5595] process_one_work+0xaaf/0x1480 [ 469.695231][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.695249][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.695281][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.695311][ T5595] worker_thread+0xb05/0x10d0 [ 469.695356][ T5595] kthread+0x388/0x470 [ 469.695382][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.695401][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.695427][ T5595] ret_from_fork+0x514/0xb70 [ 469.695458][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.695484][ T5595] ? __switch_to+0xc89/0x1420 [ 469.695510][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.695538][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.695580][ T5595] [ 469.695605][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.695645][ T5595] Bluetooth: hci4: failed to register connection device [ 469.696066][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.696085][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.696111][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.696118][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.696130][ T5595] Workqueue: hci4 hci_rx_work [ 469.696158][ T5595] Call Trace: [ 469.696165][ T5595] [ 469.696173][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.696200][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.696222][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.696248][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.696276][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.696308][ T5595] kobject_add+0x163/0x240 [ 469.696329][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.696359][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.696393][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.696419][ T5595] device_add+0x3fa/0xb80 [ 469.696443][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.696474][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.696507][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.696530][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.696549][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.696568][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.696595][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.696617][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.696646][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.696670][ T5595] hci_event_packet+0x67a/0xf10 [ 469.696699][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.696726][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.696746][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.696778][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.696811][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.696839][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.696879][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.696900][ T5595] process_one_work+0xaaf/0x1480 [ 469.696942][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.696959][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.696992][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.697018][ T5595] worker_thread+0xb05/0x10d0 [ 469.697062][ T5595] kthread+0x388/0x470 [ 469.697088][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.697107][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.697134][ T5595] ret_from_fork+0x514/0xb70 [ 469.697163][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.697190][ T5595] ? __switch_to+0xc89/0x1420 [ 469.697215][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.697243][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.697285][ T5595] [ 469.697313][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.697345][ T5595] Bluetooth: hci4: failed to register connection device [ 469.702196][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.702222][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.702250][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.702258][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.702271][ T5595] Workqueue: hci4 hci_rx_work [ 469.702302][ T5595] Call Trace: [ 469.702310][ T5595] [ 469.702319][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.702347][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.702371][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.702396][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.702426][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.702459][ T5595] kobject_add+0x163/0x240 [ 469.702480][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.702511][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.702540][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.702566][ T5595] device_add+0x3fa/0xb80 [ 469.702590][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.702621][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.702661][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.702683][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.702702][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.702722][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.702745][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.702768][ T5772] usb usb2-port1: attempt power cycle [ 469.702769][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.702793][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.702820][ T5595] hci_event_packet+0x67a/0xf10 [ 469.702848][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.702876][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.702895][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.702923][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.702955][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.702981][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.703016][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.703036][ T5595] process_one_work+0xaaf/0x1480 [ 469.703077][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.703095][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.703133][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.703159][ T5595] worker_thread+0xb05/0x10d0 [ 469.703199][ T5595] kthread+0x388/0x470 [ 469.703228][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.703244][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.703267][ T5595] ret_from_fork+0x514/0xb70 [ 469.703295][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.703320][ T5595] ? __switch_to+0xc89/0x1420 [ 469.703345][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.703372][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.703416][ T5595] [ 469.703468][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.703504][ T5595] Bluetooth: hci4: failed to register connection device [ 469.706050][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.706074][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.706102][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.706110][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.706122][ T5595] Workqueue: hci4 hci_rx_work [ 469.706154][ T5595] Call Trace: [ 469.706162][ T5595] [ 469.706171][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.706199][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.706222][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.706253][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.706283][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.706315][ T5595] kobject_add+0x163/0x240 [ 469.706336][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.706368][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.706397][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.706423][ T5595] device_add+0x3fa/0xb80 [ 469.706446][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.706478][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.706512][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.706535][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.706554][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.706574][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.706600][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.706631][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.706656][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.706683][ T5595] hci_event_packet+0x67a/0xf10 [ 469.706712][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.706737][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.706756][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.706783][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.706815][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.706842][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.706878][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.706900][ T5595] process_one_work+0xaaf/0x1480 [ 469.706940][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.706958][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.706991][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.707020][ T5595] worker_thread+0xb05/0x10d0 [ 469.707064][ T5595] kthread+0x388/0x470 [ 469.707090][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.707110][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.707136][ T5595] ret_from_fork+0x514/0xb70 [ 469.707166][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.707193][ T5595] ? __switch_to+0xc89/0x1420 [ 469.707223][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.707251][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.707294][ T5595] [ 469.707347][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.707382][ T5595] Bluetooth: hci4: failed to register connection device [ 469.707831][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.707851][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.707879][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.707886][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.707899][ T5595] Workqueue: hci4 hci_rx_work [ 469.707930][ T5595] Call Trace: [ 469.707936][ T5595] [ 469.707943][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.707968][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.707990][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.708016][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.708045][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.708078][ T5595] kobject_add+0x163/0x240 [ 469.708100][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.708130][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.708160][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.708186][ T5595] device_add+0x3fa/0xb80 [ 469.708210][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.708241][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.708274][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.708298][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.708318][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.708338][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.708364][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.708388][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.708413][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.708441][ T5595] hci_event_packet+0x67a/0xf10 [ 469.708469][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.708497][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.708516][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.708545][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.708576][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.708602][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.708640][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.708662][ T5595] process_one_work+0xaaf/0x1480 [ 469.708702][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.708721][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.708754][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.708780][ T5595] worker_thread+0xb05/0x10d0 [ 469.708823][ T5595] kthread+0x388/0x470 [ 469.708850][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.708869][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.708896][ T5595] ret_from_fork+0x514/0xb70 [ 469.708926][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.708957][ T5595] ? __switch_to+0xc89/0x1420 [ 469.708983][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.709010][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.709053][ T5595] [ 469.709209][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.709245][ T5595] Bluetooth: hci4: failed to register connection device [ 469.709846][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.709868][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.709894][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.709901][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.709914][ T5595] Workqueue: hci4 hci_rx_work [ 469.709944][ T5595] Call Trace: [ 469.709952][ T5595] [ 469.709960][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.709987][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.710010][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.710036][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.710065][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.710096][ T5595] kobject_add+0x163/0x240 [ 469.710118][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.710149][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.710178][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.710204][ T5595] device_add+0x3fa/0xb80 [ 469.710228][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.710260][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.710292][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.710316][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.710335][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.710354][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.710381][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.710404][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.710429][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.710456][ T5595] hci_event_packet+0x67a/0xf10 [ 469.710485][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.710511][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.710532][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.710561][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.710596][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.710635][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.710672][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.710694][ T5595] process_one_work+0xaaf/0x1480 [ 469.710735][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.710753][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.710787][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.710813][ T5595] worker_thread+0xb05/0x10d0 [ 469.710857][ T5595] kthread+0x388/0x470 [ 469.710884][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.710903][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.710931][ T5595] ret_from_fork+0x514/0xb70 [ 469.710960][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.710987][ T5595] ? __switch_to+0xc89/0x1420 [ 469.711013][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.711040][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.711082][ T5595] [ 469.711130][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.711171][ T5595] Bluetooth: hci4: failed to register connection device [ 469.711600][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.711621][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.711656][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.711663][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.711676][ T5595] Workqueue: hci4 hci_rx_work [ 469.711704][ T5595] Call Trace: [ 469.711711][ T5595] [ 469.711720][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.711747][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.711770][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.711796][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.711825][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.711856][ T5595] kobject_add+0x163/0x240 [ 469.711878][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.711908][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.711938][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.711964][ T5595] device_add+0x3fa/0xb80 [ 469.711988][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.712019][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.712052][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.712075][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.712095][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.712114][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.712140][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.712164][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.712188][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.712216][ T5595] hci_event_packet+0x67a/0xf10 [ 469.712245][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.712272][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.712293][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.712322][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.712356][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.712384][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.712420][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.712441][ T5595] process_one_work+0xaaf/0x1480 [ 469.712482][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.712500][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.712533][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.712558][ T5595] worker_thread+0xb05/0x10d0 [ 469.712602][ T5595] kthread+0x388/0x470 [ 469.712634][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.712654][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.712681][ T5595] ret_from_fork+0x514/0xb70 [ 469.712710][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.712737][ T5595] ? __switch_to+0xc89/0x1420 [ 469.712763][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.712790][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.712832][ T5595] [ 469.712863][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.712894][ T5595] Bluetooth: hci4: failed to register connection device [ 469.713375][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.713394][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.713417][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.713424][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.713433][ T5595] Workqueue: hci4 hci_rx_work [ 469.713459][ T5595] Call Trace: [ 469.713465][ T5595] [ 469.713473][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.713497][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.713519][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.713543][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.713572][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.713604][ T5595] kobject_add+0x163/0x240 [ 469.713635][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.713666][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.713696][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.713721][ T5595] device_add+0x3fa/0xb80 [ 469.713745][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.713776][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.713810][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.713833][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.713852][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.713873][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.713898][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.713922][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.713946][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.713974][ T5595] hci_event_packet+0x67a/0xf10 [ 469.714003][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.714031][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.714051][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.714080][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.714114][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.714142][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.714178][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.714199][ T5595] process_one_work+0xaaf/0x1480 [ 469.714243][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.714261][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.714298][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.714324][ T5595] worker_thread+0xb05/0x10d0 [ 469.714368][ T5595] kthread+0x388/0x470 [ 469.714395][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.714414][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.714441][ T5595] ret_from_fork+0x514/0xb70 [ 469.714471][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.714498][ T5595] ? __switch_to+0xc89/0x1420 [ 469.714524][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.714551][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.714589][ T5595] [ 469.714615][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.714658][ T5595] Bluetooth: hci4: failed to register connection device [ 469.715082][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.715101][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.715127][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.715134][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.715147][ T5595] Workqueue: hci4 hci_rx_work [ 469.715174][ T5595] Call Trace: [ 469.715182][ T5595] [ 469.715189][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.715216][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.715238][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.715264][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.715292][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.715324][ T5595] kobject_add+0x163/0x240 [ 469.715345][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.715375][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.715404][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.715429][ T5595] device_add+0x3fa/0xb80 [ 469.715453][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.715485][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.715516][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.715539][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.715558][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.715578][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.715604][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.715635][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.715659][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.715684][ T5595] hci_event_packet+0x67a/0xf10 [ 469.715711][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.715735][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.715754][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.715782][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.715817][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.715844][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.715881][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.715902][ T5595] process_one_work+0xaaf/0x1480 [ 469.715942][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.715961][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.715994][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.716019][ T5595] worker_thread+0xb05/0x10d0 [ 469.716063][ T5595] kthread+0x388/0x470 [ 469.716089][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.716108][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.716135][ T5595] ret_from_fork+0x514/0xb70 [ 469.716164][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.716190][ T5595] ? __switch_to+0xc89/0x1420 [ 469.716217][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.716242][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.716282][ T5595] [ 469.716308][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.716341][ T5595] Bluetooth: hci4: failed to register connection device [ 469.716810][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.716829][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.716854][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.716861][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.716874][ T5595] Workqueue: hci4 hci_rx_work [ 469.716903][ T5595] Call Trace: [ 469.716910][ T5595] [ 469.716918][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.716944][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.716967][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.716993][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.717021][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.717052][ T5595] kobject_add+0x163/0x240 [ 469.717073][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.717103][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.717133][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.717157][ T5595] device_add+0x3fa/0xb80 [ 469.717181][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.717212][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.717245][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.717268][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.717287][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.717307][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.717333][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.717358][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.717381][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.717408][ T5595] hci_event_packet+0x67a/0xf10 [ 469.717438][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.717465][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.717484][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.717512][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.717547][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.717581][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.717617][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.717648][ T5595] process_one_work+0xaaf/0x1480 [ 469.717689][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.717707][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.717740][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.717766][ T5595] worker_thread+0xb05/0x10d0 [ 469.717810][ T5595] kthread+0x388/0x470 [ 469.717836][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.717855][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.717882][ T5595] ret_from_fork+0x514/0xb70 [ 469.717911][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.717935][ T5595] ? __switch_to+0xc89/0x1420 [ 469.717960][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.717987][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.718027][ T5595] [ 469.719748][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.719786][ T5595] Bluetooth: hci4: failed to register connection device [ 469.720225][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.720246][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.720273][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.720281][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.720294][ T5595] Workqueue: hci4 hci_rx_work [ 469.720325][ T5595] Call Trace: [ 469.720332][ T5595] [ 469.720341][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.720368][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.720391][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.720417][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.720446][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.720477][ T5595] kobject_add+0x163/0x240 [ 469.720498][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.720530][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.720559][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.720584][ T5595] device_add+0x3fa/0xb80 [ 469.720613][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.720657][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.720690][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.720714][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.720734][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.720755][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.720782][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.720805][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.720830][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.720857][ T5595] hci_event_packet+0x67a/0xf10 [ 469.720891][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.720918][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.720938][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.720967][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.721002][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.721029][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.721065][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.721087][ T5595] process_one_work+0xaaf/0x1480 [ 469.721127][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.721145][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.721179][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.721204][ T5595] worker_thread+0xb05/0x10d0 [ 469.721247][ T5595] kthread+0x388/0x470 [ 469.721274][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.721293][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.721320][ T5595] ret_from_fork+0x514/0xb70 [ 469.721351][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.721378][ T5595] ? __switch_to+0xc89/0x1420 [ 469.721404][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.721431][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.721474][ T5595] [ 469.721526][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.721560][ T5595] Bluetooth: hci4: failed to register connection device [ 469.722068][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.722088][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.722114][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.722122][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.722134][ T5595] Workqueue: hci4 hci_rx_work [ 469.722163][ T5595] Call Trace: [ 469.722170][ T5595] [ 469.722179][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.722205][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.722228][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.722254][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.722283][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.722315][ T5595] kobject_add+0x163/0x240 [ 469.722335][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.722365][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.722392][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.722417][ T5595] device_add+0x3fa/0xb80 [ 469.722439][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.722470][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.722504][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.722526][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.722545][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.722565][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.722592][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.722615][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.722648][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.722675][ T5595] hci_event_packet+0x67a/0xf10 [ 469.722705][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.722733][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.722752][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.722781][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.722816][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.722843][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.722879][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.722901][ T5595] process_one_work+0xaaf/0x1480 [ 469.722942][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.722960][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.722993][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.723019][ T5595] worker_thread+0xb05/0x10d0 [ 469.723063][ T5595] kthread+0x388/0x470 [ 469.723088][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.723107][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.723133][ T5595] ret_from_fork+0x514/0xb70 [ 469.723157][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.723179][ T5595] ? __switch_to+0xc89/0x1420 [ 469.723205][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.723231][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.723274][ T5595] [ 469.723302][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.723335][ T5595] Bluetooth: hci4: failed to register connection device [ 469.723809][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.723830][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.723857][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.723864][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.723876][ T5595] Workqueue: hci4 hci_rx_work [ 469.723906][ T5595] Call Trace: [ 469.723913][ T5595] [ 469.723921][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.723948][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.723971][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.723996][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.724024][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.724056][ T5595] kobject_add+0x163/0x240 [ 469.724077][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.724107][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.724136][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.724162][ T5595] device_add+0x3fa/0xb80 [ 469.724185][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.724216][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.724250][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.724273][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.724292][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.724312][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.724338][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.724362][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.724387][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.724415][ T5595] hci_event_packet+0x67a/0xf10 [ 469.724443][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.724470][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.724490][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.724519][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.724553][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.724580][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.724617][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.724646][ T5595] process_one_work+0xaaf/0x1480 [ 469.724686][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.724704][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.724736][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.724762][ T5595] worker_thread+0xb05/0x10d0 [ 469.724807][ T5595] kthread+0x388/0x470 [ 469.724833][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.724853][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.724880][ T5595] ret_from_fork+0x514/0xb70 [ 469.724910][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.724936][ T5595] ? __switch_to+0xc89/0x1420 [ 469.724962][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.724989][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.725031][ T5595] [ 469.725058][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.725090][ T5595] Bluetooth: hci4: failed to register connection device [ 469.725540][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.725560][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.725583][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.725587][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.725594][ T5595] Workqueue: hci4 hci_rx_work [ 469.725619][ T5595] Call Trace: [ 469.725632][ T5595] [ 469.725640][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.725666][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.725689][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.725715][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.725743][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.725773][ T5595] kobject_add+0x163/0x240 [ 469.725793][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.725823][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.725848][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.725870][ T5595] device_add+0x3fa/0xb80 [ 469.725892][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.725922][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.725953][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.725976][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.725995][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.726014][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.726041][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.726064][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.726089][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.726115][ T5595] hci_event_packet+0x67a/0xf10 [ 469.726144][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.726171][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.726192][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.726221][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.726255][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.726283][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.726319][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.726339][ T5595] process_one_work+0xaaf/0x1480 [ 469.726381][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.726399][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.726432][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.726457][ T5595] worker_thread+0xb05/0x10d0 [ 469.726501][ T5595] kthread+0x388/0x470 [ 469.726527][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.726547][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.726573][ T5595] ret_from_fork+0x514/0xb70 [ 469.726603][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.726637][ T5595] ? __switch_to+0xc89/0x1420 [ 469.726662][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.726689][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.726733][ T5595] [ 469.728270][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.728308][ T5595] Bluetooth: hci4: failed to register connection device [ 469.772334][ T5595] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 469.772362][ T5595] CPU: 0 UID: 0 PID: 5595 Comm: kworker/u9:2 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 469.772391][ T5595] Tainted: [L]=SOFTLOCKUP [ 469.772399][ T5595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 469.772412][ T5595] Workqueue: hci4 hci_rx_work [ 469.772445][ T5595] Call Trace: [ 469.772454][ T5595] [ 469.772463][ T5595] dump_stack_lvl+0xe8/0x150 [ 469.772493][ T5595] sysfs_create_dir_ns+0x271/0x2a0 [ 469.772517][ T5595] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 469.772544][ T5595] ? rt_spin_unlock+0x163/0x200 [ 469.772575][ T5595] kobject_add_internal+0x62c/0xce0 [ 469.772608][ T5595] kobject_add+0x163/0x240 [ 469.772630][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.772660][ T5595] ? __pfx_kobject_add+0x10/0x10 [ 469.772685][ T5595] ? get_device_parent+0x370/0x3a0 [ 469.772712][ T5595] device_add+0x3fa/0xb80 [ 469.772734][ T5595] hci_conn_add_sysfs+0xd5/0x210 [ 469.772770][ T5595] le_conn_complete_evt+0xfef/0x1580 [ 469.772803][ T5595] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 469.772827][ T5595] ? lockdep_hardirqs_on+0x7a/0x110 [ 469.772846][ T5595] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 469.772867][ T5595] ? rt_mutex_slowunlock+0x219/0x460 [ 469.772893][ T5595] ? skb_pull_data+0xf0/0x200 [ 469.772918][ T5595] hci_le_enh_conn_complete_evt+0x189/0x490 [ 469.772944][ T5595] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 469.772972][ T5595] hci_event_packet+0x67a/0xf10 [ 469.773001][ T5595] ? reacquire_held_locks+0x117/0x1a0 [ 469.773030][ T5595] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 469.773050][ T5595] ? __pfx_hci_event_packet+0x10/0x10 [ 469.773080][ T5595] ? rt_spin_unlock+0x157/0x200 [ 469.773115][ T5595] ? hci_send_to_monitor+0xe2/0x590 [ 469.773143][ T5595] hci_rx_work+0x3ee/0x1020 [ 469.773189][ T5595] ? process_one_work+0x7fd/0x1480 [ 469.773211][ T5595] process_one_work+0xaaf/0x1480 [ 469.773254][ T5595] ? __pfx_process_one_work+0x10/0x10 [ 469.773274][ T5595] ? do_raw_spin_lock+0x12b/0x2f0 [ 469.773308][ T5595] ? assign_work+0x3cf/0x5d0 [ 469.773334][ T5595] worker_thread+0xb05/0x10d0 [ 469.773380][ T5595] kthread+0x388/0x470 [ 469.773407][ T5595] ? __pfx_worker_thread+0x10/0x10 [ 469.773426][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.773454][ T5595] ret_from_fork+0x514/0xb70 [ 469.773484][ T5595] ? __pfx_ret_from_fork+0x10/0x10 [ 469.773511][ T5595] ? __switch_to+0xc89/0x1420 [ 469.773537][ T5595] ? __pfx_kthread+0x10/0x10 [ 469.773565][ T5595] ret_from_fork_asm+0x1a/0x30 [ 469.773609][ T5595] [ 469.773667][ T5595] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 469.773705][ T5595] Bluetooth: hci4: failed to register connection device [ 469.866947][T12435] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 470.267366][T12440] dvmrp0: entered allmulticast mode [ 470.346482][ T5772] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 470.399362][ T5772] usb 2-1: device descriptor read/8, error -71 [ 470.606706][ T5697] usb 4-1: USB disconnect, device number 17 [ 470.727184][ T5772] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 470.748681][ T5772] usb 2-1: device descriptor read/8, error -71 [ 470.867380][ T5772] usb usb2-port1: unable to enumerate USB device [ 471.357983][T12465] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1902'. [ 471.499282][ T5697] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 471.651185][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 471.704862][ T5697] usb 1-1: Using ep0 maxpacket: 32 [ 471.711571][ T5697] usb 1-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 471.711602][ T5697] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 471.915902][ T5697] usb 1-1: config 0 descriptor?? [ 471.973601][ T5697] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 473.055129][ T5581] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 473.472427][T12479] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.488955][T12479] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.593619][ T5581] usb 2-1: unable to get BOS descriptor or descriptor too short [ 473.597425][ T5581] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 473.597474][ T5581] usb 2-1: can't read configurations, error -71 [ 473.725189][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 474.639493][ T202] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 474.800706][ T202] usb 4-1: Using ep0 maxpacket: 16 [ 474.826325][ T202] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 474.826355][ T202] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.826423][ T202] usb 4-1: Product: syz [ 474.826446][ T202] usb 4-1: Manufacturer: syz [ 474.826460][ T202] usb 4-1: SerialNumber: syz [ 475.122885][ T202] r8152-cfgselector 4-1: Unknown version 0x0000 [ 475.122912][ T202] r8152-cfgselector 4-1: config 0 descriptor?? [ 475.509018][ T5697] gspca_vc032x: reg_r err -71 [ 475.509037][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509048][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509056][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509065][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509079][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509087][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509096][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509105][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509114][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509123][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509132][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509141][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509149][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509158][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509166][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509176][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509184][ T5697] gspca_vc032x: I2c Bus Busy Wait 00 [ 475.509193][ T5697] gspca_vc032x: Unknown sensor... [ 475.509271][ T5697] vc032x 1-1:0.0: probe with driver vc032x failed with error -22 [ 475.541401][ T5697] usb 1-1: USB disconnect, device number 47 [ 475.669119][ T202] r8152-cfgselector 4-1: USB disconnect, device number 18 [ 475.793096][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 476.332489][T12514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.337924][T12514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.689879][T12519] kvm [12518]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc2) = 0x60000000a91 [ 477.011934][ T202] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 477.164916][ T202] usb 2-1: config 0 has an invalid interface number: 127 but max is 1 [ 477.164949][ T202] usb 2-1: config 0 has more interface descriptors, than it declares in bNumInterfaces, ignoring interface number: 0 [ 477.164969][ T202] usb 2-1: config 0 has no interface number 1 [ 477.165020][ T202] usb 2-1: config 0 interface 127 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 477.165058][ T202] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 29 [ 477.200604][ T202] usb 2-1: New USB device found, idVendor=1908, idProduct=1315, bcdDevice= 0.00 [ 477.200634][ T202] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.200653][ T202] usb 2-1: Product: syz [ 477.200667][ T202] usb 2-1: Manufacturer: syz [ 477.200681][ T202] usb 2-1: SerialNumber: syz [ 477.212200][ T202] usb 2-1: config 0 descriptor?? [ 477.220060][ T202] usb-storage 2-1:0.127: USB Mass Storage device detected [ 477.244693][ T202] usb-storage 2-1:0.127: Quirks match for vid 1908 pid 1315: 20000 [ 477.676373][ T202] usb-storage 2-1:0.0: USB Mass Storage device detected [ 477.737280][ T202] usb-storage 2-1:0.0: Quirks match for vid 1908 pid 1315: 20000 [ 477.945455][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 478.025359][ T38] audit: type=1326 audit(1784314587.470:171): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025419][ T38] audit: type=1326 audit(1784314587.480:172): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025459][ T38] audit: type=1326 audit(1784314587.480:173): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025498][ T38] audit: type=1326 audit(1784314587.480:174): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025537][ T38] audit: type=1326 audit(1784314587.480:175): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025576][ T38] audit: type=1326 audit(1784314587.480:176): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025613][ T38] audit: type=1326 audit(1784314587.480:177): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025652][ T38] audit: type=1326 audit(1784314587.480:178): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025691][ T38] audit: type=1326 audit(1784314587.480:179): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.025728][ T38] audit: type=1326 audit(1784314587.480:180): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12534 comm="syz.3.1921" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4d5df8de99 code=0x7ffc0000 [ 478.067952][T12535] netlink: 'syz.3.1921': attribute type 1 has an invalid length. [ 478.067972][T12535] netlink: 'syz.3.1921': attribute type 2 has an invalid length. [ 478.125502][T11877] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 478.293035][T11877] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 478.293066][T11877] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 478.293102][T11877] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 478.293124][T11877] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 478.360189][T11877] usb 1-1: config 0 descriptor?? [ 478.824120][T11877] pyra 0003:1E7D:2CF6.0015: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.0-1/input0 [ 479.008624][T12531] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 479.008654][T12531] overlayfs: missing 'lowerdir' [ 479.517008][T11877] pyra 0003:1E7D:2CF6.0015: couldn't init struct pyra_device [ 479.517060][T11877] pyra 0003:1E7D:2CF6.0015: couldn't install mouse [ 479.663145][T11877] pyra 0003:1E7D:2CF6.0015: probe with driver pyra failed with error -71 [ 479.701790][T11877] usb 1-1: USB disconnect, device number 48 [ 479.888080][ T5697] usb 2-1: USB disconnect, device number 59 [ 479.949572][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 480.016593][T12553] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.022431][T12555] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 480.023122][T12553] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 480.025591][T12555] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 480.602543][T12562] kvm [12561]: vcpu0, guest rIP: 0x208 Unhandled WRMSR(0xc2) = 0x60000000a91 [ 480.605560][ T5697] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 480.761335][ T5595] Bluetooth: hci3: unexpected event for opcode 0x2481 [ 480.889256][T12553] wlan0 speed is unknown, defaulting to 1000 [ 481.034211][ T5697] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 481.034242][ T5697] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.034261][ T5697] usb 2-1: Product: syz [ 481.034276][ T5697] usb 2-1: Manufacturer: syz [ 481.034290][ T5697] usb 2-1: SerialNumber: syz [ 481.448597][ T37] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 481.610206][ T37] usb 4-1: config 0 has an invalid interface number: 69 but max is 0 [ 481.610235][ T37] usb 4-1: config 0 has no interface number 0 [ 481.610277][ T37] usb 4-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 481.610301][ T37] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 481.612503][ T37] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 481.612539][ T37] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.612558][ T37] usb 4-1: Product: syz [ 481.612572][ T37] usb 4-1: Manufacturer: syz [ 481.612586][ T37] usb 4-1: SerialNumber: syz [ 481.848147][ T37] usb 4-1: config 0 descriptor?? [ 481.859605][T12567] raw-gadget.5 gadget.3: fail, usb_ep_enable returned -22 [ 481.877322][ T37] cyberjack 4-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 482.032157][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 482.223125][ C1] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22 [ 482.230821][ T5772] usb 1-1: new full-speed USB device number 49 using dummy_hcd [ 482.274837][ C1] raw-gadget.6 gadget.0: ignoring, device is not running [ 482.407881][ T5772] usb 1-1: device descriptor read/64, error -32 [ 482.717501][ T5772] usb 1-1: new full-speed USB device number 50 using dummy_hcd [ 482.790721][ T37] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 482.794612][ T5697] usb 2-1: config 0 descriptor?? [ 482.831739][ T5697] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 482.851323][ T37] usb 4-1: USB disconnect, device number 19 [ 482.913876][ T5772] usb 1-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 482.913912][ T5772] usb 1-1: config 0 interface 0 has no altsetting 0 [ 482.913943][ T5772] usb 1-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 482.913965][ T5772] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.940770][ T5772] usb 1-1: config 0 descriptor?? [ 482.945617][ T37] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 482.946477][ T37] cyberjack 4-1:0.69: device disconnected [ 483.380140][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380180][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380206][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380233][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380258][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380281][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380306][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380332][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380357][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.380382][ T5772] steelseries 0003:1038:1410.0016: unknown main item tag 0x0 [ 483.381323][ T5772] steelseries 0003:1038:1410.0016: missing HID_OUTPUT_REPORT 0 [ 483.703631][ T5697] gspca_sunplus: reg_w_riv err -71 [ 483.703720][ T5697] sunplus 2-1:0.0: probe with driver sunplus failed with error -71 [ 483.720148][ T5697] usb 2-1: USB disconnect, device number 60 [ 483.882776][ T5582] usb 1-1: USB disconnect, device number 50 [ 484.117147][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 484.240201][ T5772] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 484.436338][ T5772] usb 4-1: Using ep0 maxpacket: 8 [ 484.438341][ T5772] usb 4-1: config 0 has an invalid interface number: 14 but max is 12 [ 484.438369][ T5772] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 484.438390][ T5772] usb 4-1: config 0 has no interface number 0 [ 484.441951][ T5772] usb 4-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 484.441979][ T5772] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.441999][ T5772] usb 4-1: Product: syz [ 484.442013][ T5772] usb 4-1: Manufacturer: syz [ 484.442027][ T5772] usb 4-1: SerialNumber: syz [ 484.447480][ T5772] usb 4-1: config 0 descriptor?? [ 484.716286][ T5772] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 484.999360][T12601] lo speed is unknown, defaulting to 1000 [ 484.999865][T12601] lo speed is unknown, defaulting to 1000 [ 485.059887][T12603] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1936'. [ 485.095117][T12601] lo speed is unknown, defaulting to 1000 [ 485.268062][T12601] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 485.268087][T12601] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 485.268107][T12601] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 485.408839][T12601] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 485.475187][T12601] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 485.667380][T12601] lo speed is unknown, defaulting to 1000 [ 485.773945][T12601] lo speed is unknown, defaulting to 1000 [ 485.778637][T12601] lo speed is unknown, defaulting to 1000 [ 485.879845][T12601] lo speed is unknown, defaulting to 1000 [ 485.943567][T12601] lo speed is unknown, defaulting to 1000 [ 486.037584][T12606] netlink: 'syz.0.1937': attribute type 5 has an invalid length. [ 486.101216][T12607] openvswitch: netlink: Message has 12 unknown bytes. [ 486.152105][T12595] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 486.188221][T12595] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 486.204832][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 486.411459][ T7559] bond0: left allmulticast mode [ 486.411542][ T7559] bond_slave_0: left allmulticast mode [ 486.416854][ T7559] bond_slave_1: left allmulticast mode [ 486.498186][ T7559] bridge0: port 3(bond0) entered disabled state [ 486.535590][ T5772] gspca_zc3xx: reg_w_i err -71 [ 486.637406][ T7559] bridge_slave_1: left allmulticast mode [ 486.637431][ T7559] bridge_slave_1: left promiscuous mode [ 486.643238][ T7559] bridge0: port 2(bridge_slave_1) entered disabled state [ 486.737008][T12611] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1938'. [ 486.795570][ T7559] bridge_slave_0: left allmulticast mode [ 486.795595][ T7559] bridge_slave_0: left promiscuous mode [ 486.795807][ T7559] bridge0: port 1(bridge_slave_0) entered disabled state [ 486.930186][ T7559] batadv0: left allmulticast mode [ 487.159339][ T5772] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 487.159416][ T5772] gspca_zc3xx 4-1:0.14: probe with driver gspca_zc3xx failed with error -71 [ 487.176810][ T5772] usb 4-1: USB disconnect, device number 20 [ 487.234403][ T5582] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 487.384332][ T5582] usb 2-1: Using ep0 maxpacket: 32 [ 487.386263][ T5582] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 487.386289][ T5582] usb 2-1: config 0 has no interface number 0 [ 487.386323][ T5582] usb 2-1: config 0 interface 184 has no altsetting 0 [ 487.388670][ T5582] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 487.388698][ T5582] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.388713][ T5582] usb 2-1: Product: syz [ 487.388721][ T5582] usb 2-1: Manufacturer: syz [ 487.388728][ T5582] usb 2-1: SerialNumber: syz [ 487.391825][ T5582] usb 2-1: config 0 descriptor?? [ 487.571509][ T5772] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 487.749584][ T5772] usb 4-1: config 0 interface 0 has no altsetting 0 [ 487.749626][ T5772] usb 4-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 487.749650][ T5772] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.755030][ T5772] usb 4-1: config 0 descriptor?? [ 487.810623][ T5582] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 487.810656][ T5582] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 487.810675][ T5582] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 487.812585][ T5582] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 487.860191][ T5582] usb 2-1: USB disconnect, device number 61 [ 487.998480][T12611] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.002516][T12611] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.146671][ T5772] usbhid 4-1:0.0: can't add hid device: -71 [ 488.146787][ T5772] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 488.158959][ T5772] usb 4-1: USB disconnect, device number 21 [ 488.277473][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 488.604384][ T7559] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 488.624089][ T7559] bond_slave_0: left promiscuous mode [ 488.664170][ T7559] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 488.683876][ T7559] bond_slave_1: left promiscuous mode [ 488.685630][ T7559] bond0 (unregistering): Released all slaves [ 488.713453][ T5772] usb 2-1: new full-speed USB device number 62 using dummy_hcd [ 488.926110][ T5772] usb 2-1: unable to get BOS descriptor or descriptor too short [ 488.926711][ T5772] usb 2-1: not running at top speed; connect to a high speed hub [ 488.929973][ T5772] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 488.929996][ T5772] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 488.930044][ T5772] usb 2-1: too many endpoints for config 1 interface 1 altsetting 255: 255, using maximum allowed: 30 [ 488.930091][ T5772] usb 2-1: config 1 interface 1 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 488.930117][ T5772] usb 2-1: config 1 interface 1 has no altsetting 0 [ 488.932463][ T5772] usb 2-1: New USB device found, idVendor=1235, idProduct=8215, bcdDevice= 0.40 [ 488.932490][ T5772] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 488.932510][ T5772] usb 2-1: Product: syz [ 488.932523][ T5772] usb 2-1: Manufacturer: syz [ 488.932537][ T5772] usb 2-1: SerialNumber: syz [ 489.063199][ T5697] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 489.226661][ T5697] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 489.226686][ T5697] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 489.227697][ T5697] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 489.227722][ T5697] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 489.227742][ T5697] usb 1-1: SerialNumber: syz [ 489.491295][T12630] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.572877][T12630] bridge0: port 1(bridge_slave_0) entered disabled state [ 489.601471][ T5697] usb 1-1: 0:2 : does not exist [ 489.601848][ T5697] usb 1-1: unit 3 not found! [ 489.685728][T12630] bridge0: entered allmulticast mode [ 489.802161][ T5697] usb 1-1: USB disconnect, device number 51 [ 489.961700][T12632] bridge_slave_1: left allmulticast mode [ 489.975363][T11673] udevd[11673]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 489.993362][T12632] bridge_slave_1: left promiscuous mode [ 490.194806][ T5595] Bluetooth: hci3: unexpected event for opcode 0x1804 [ 490.233723][T12632] bridge0: port 2(bridge_slave_1) entered disabled state [ 490.342488][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 490.401015][T12644] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1946'. [ 490.416058][T12644] sg_write: data in/out 688092/136 bytes for SCSI command 0x0-- guessing data in; [ 490.416058][T12644] program syz.0.1946 not setting count and/or reply_len properly [ 490.839501][T12632] bridge_slave_0: left allmulticast mode [ 490.839536][T12632] bridge_slave_0: left promiscuous mode [ 490.852205][T12632] bridge0: port 1(bridge_slave_0) entered disabled state [ 490.891961][ T5697] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 491.041826][ T5697] usb 1-1: Using ep0 maxpacket: 8 [ 491.044010][ T5697] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 491.044038][ T5697] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 491.044063][ T5697] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 491.044088][ T5697] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 491.044124][ T5697] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 491.044136][ T5697] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 491.253154][ T5697] usb 1-1: GET_CAPABILITIES returned 0 [ 491.253211][ T5697] usbtmc 1-1:16.0: can't read capabilities [ 491.448487][ T5772] usb 2-1: 0:2 : does not exist [ 491.448654][ T5772] usb 2-1: Focusrite Scarlett Gen 3 Mixer Driver enabled (pid=0x8215); report any issues to https://github.com/geoffreybennett/scarlett-gen2/issues [ 491.448749][ T5772] usb 2-1: Error initialising Scarlett Gen 3 Mixer Driver: -22 [ 491.559560][ T32] usb 1-1: USB disconnect, device number 52 [ 491.688044][ T5772] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 491.755785][ T5772] usb 2-1: USB disconnect, device number 62 [ 491.779289][T12238] udevd[12238]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 491.808615][T12657] overlayfs: missing 'workdir' [ 492.424020][T12668] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 492.441001][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 493.280817][T11877] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 493.430816][T11877] usb 1-1: Using ep0 maxpacket: 16 [ 493.710362][ T37] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 493.891422][ T37] usb 2-1: Using ep0 maxpacket: 16 [ 493.893614][ T37] usb 2-1: config 1 has an invalid interface number: 95 but max is 0 [ 493.893640][ T37] usb 2-1: config 1 has no interface number 0 [ 493.893684][ T37] usb 2-1: config 1 interface 95 altsetting 253 has a duplicate endpoint with address 0x9, skipping [ 493.893708][ T37] usb 2-1: config 1 interface 95 has no altsetting 0 [ 493.904207][ T37] usb 2-1: Dual-Role OTG device on HNP port [ 493.904520][ T37] usb 2-1: New USB device found, idVendor=12d1, idProduct=7491, bcdDevice=fd.6f [ 493.904544][ T37] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.904564][ T37] usb 2-1: Product: syz [ 493.904578][ T37] usb 2-1: Manufacturer: syz [ 493.904592][ T37] usb 2-1: SerialNumber: syz [ 494.171581][T12691] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1959'. [ 494.501408][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 495.214114][ T37] option 2-1:1.95: GSM modem (1-port) converter detected [ 495.245315][ T37] usb 2-1: USB disconnect, device number 63 [ 495.272043][ T37] option 2-1:1.95: device disconnected [ 495.828818][ T5581] usb 4-1: new high-speed USB device number 22 using dummy_hcd [ 495.977536][ T5581] usb 4-1: Using ep0 maxpacket: 32 [ 495.995559][ T5581] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 495.995584][ T5581] usb 4-1: config 0 has no interface number 0 [ 495.995667][ T5581] usb 4-1: config 0 interface 12 has no altsetting 0 [ 495.999255][ T5581] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 495.999285][ T5581] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.999359][ T5581] usb 4-1: Product: syz [ 495.999374][ T5581] usb 4-1: Manufacturer: syz [ 495.999389][ T5581] usb 4-1: SerialNumber: syz [ 496.003209][T12680] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 496.003248][T12680] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 496.003283][T12680] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 496.094269][ T5581] usb 4-1: config 0 descriptor?? [ 496.205649][ T202] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 496.205935][ C0] raw-gadget.4 gadget.1: ignoring, device is not running [ 496.355838][ T202] usb 2-1: device descriptor read/64, error -32 [ 496.478763][T11877] usb 1-1: unable to get BOS descriptor or descriptor too short [ 496.479977][T11877] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 496.480011][T11877] usb 1-1: can't read configurations, error -71 [ 496.564104][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 496.652047][ T202] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 496.820406][ T202] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 496.833346][ T202] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 496.833394][ T202] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 496.833416][ T202] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.856365][ T5581] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 496.856418][ T5581] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 496.856443][ T5581] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 496.856530][ T5581] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 496.902871][ T202] usb 2-1: config 0 descriptor?? [ 496.935922][T12721] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.936555][T12721] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.962890][ T5581] usb 4-1: USB disconnect, device number 22 [ 497.389723][ T202] hid_parser_main: 30 callbacks suppressed [ 497.389814][ T202] cp2112 0003:10C4:EA90.0017: unknown main item tag 0x0 [ 497.500432][ T202] cp2112 0003:10C4:EA90.0017: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 497.583597][ T202] cp2112 0003:10C4:EA90.0017: Part Number: 0x82 Device Version: 0xFE [ 497.687222][T11877] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 497.851312][T11877] usb 1-1: config 2 has an invalid interface number: 79 but max is 0 [ 497.851341][T11877] usb 1-1: config 2 has no interface number 0 [ 497.855503][T11877] usb 1-1: config 2 interface 79 has no altsetting 0 [ 497.910429][T11877] usb 1-1: New USB device found, idVendor=0ab4, idProduct=0011, bcdDevice=ca.fb [ 497.910448][T11877] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.910458][T11877] usb 1-1: Product: syz [ 497.910508][T11877] usb 1-1: Manufacturer: syz [ 497.910517][T11877] usb 1-1: SerialNumber: syz [ 498.017016][T12710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.017575][T12710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.047868][T12710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.048393][T12710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.070641][T12710] fuse: Bad value for 'fd' [ 498.085332][ T202] cp2112 0003:10C4:EA90.0017: error setting SMBus config [ 498.193167][T11877] usb 1-1: USB disconnect, device number 55 [ 498.321904][ T202] cp2112 0003:10C4:EA90.0017: probe with driver cp2112 failed with error -71 [ 498.347901][ T202] usb 2-1: USB disconnect, device number 65 [ 498.447763][ T7559] hsr_slave_0: left promiscuous mode [ 498.487495][ T7559] hsr_slave_1: left promiscuous mode [ 498.490442][ T7559] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 498.527213][ T7559] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 498.564120][ T7559] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 498.564147][ T7559] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 498.638766][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 498.771253][ T7559] veth1_vlan: left promiscuous mode [ 499.198661][ T37] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 499.505032][T12765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.505556][T12765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 499.524235][T12765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 499.524829][T12765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.191497][T12768] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.192792][T12768] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.373376][ T7559] team0 (unregistering): Port device team_slave_1 removed [ 500.433967][ T7559] team0 (unregistering): Port device team_slave_0 removed [ 500.690439][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 500.693399][T12737] tipc: Enabled bearer , priority 0 [ 501.094248][ T1339] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.498321][T11877] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 501.634805][T11877] usb 1-1: device descriptor read/64, error -71 [ 501.917873][T11877] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 502.059793][T11877] usb 1-1: device descriptor read/64, error -71 [ 502.214216][T11877] usb usb1-port1: attempt power cycle [ 502.625912][T11877] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 502.646775][T11877] usb 1-1: device descriptor read/8, error -71 [ 502.732791][ T7559] IPVS: stop unused estimator thread 0... [ 502.797249][ T60] Bluetooth: hci4: command 0x2016 tx timeout [ 502.946337][T11877] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 502.963925][T11877] usb 1-1: device descriptor read/8, error -71 [ 503.076137][T11877] usb usb1-port1: unable to enumerate USB device [ 503.095427][T12834] overlayfs: workdir and upperdir must reside under the same mount [ 503.385345][T12846] syzkaller1: entered promiscuous mode [ 503.385371][T12846] syzkaller1: entered allmulticast mode [ 503.548974][ T5595] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 503.748975][T12851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.759416][T12851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.174445][ T5697] usb 2-1: new low-speed USB device number 67 using dummy_hcd [ 504.387481][ T5697] usb 2-1: config 0 interface 0 altsetting 31 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 504.387517][ T5697] usb 2-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 504.387543][ T5697] usb 2-1: config 0 interface 0 has no altsetting 0 [ 504.387575][ T5697] usb 2-1: New USB device found, idVendor=22d4, idProduct=1503, bcdDevice= 0.00 [ 504.387602][ T5697] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.395210][ T5697] usb 2-1: config 0 descriptor?? [ 504.740498][T11877] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 504.819576][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 504.863089][ T5697] glorious 0003:22D4:1503.0018: unexpected long global item [ 504.865010][ T5697] glorious 0003:22D4:1503.0018: probe with driver glorious failed with error -22 [ 504.889007][T11877] usb 1-1: Using ep0 maxpacket: 32 [ 504.903670][T11877] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 504.906102][T11877] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 504.906129][T11877] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 504.906149][T11877] usb 1-1: Product: syz [ 504.906163][T11877] usb 1-1: Manufacturer: syz [ 504.906177][T11877] usb 1-1: SerialNumber: syz [ 504.916618][T11877] usb 1-1: config 0 descriptor?? [ 504.922922][T11877] hub 1-1:0.0: bad descriptor, ignoring hub [ 504.922958][T11877] hub 1-1:0.0: probe with driver hub failed with error -5 [ 505.059543][ T5697] usb 2-1: USB disconnect, device number 67 [ 505.134883][T12878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 505.135609][T12878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 505.246910][T11877] usb 1-1: USB disconnect, device number 60 [ 506.845763][T12929] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1992'. [ 506.886823][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 507.282252][ T5697] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 507.393741][T12949] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.394257][T12949] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.431483][ T5697] usb 4-1: Using ep0 maxpacket: 32 [ 507.433289][ T5697] usb 4-1: config 0 has an invalid interface number: 12 but max is 0 [ 507.433305][ T5697] usb 4-1: config 0 has no interface number 0 [ 507.433332][ T5697] usb 4-1: config 0 interface 12 has no altsetting 0 [ 507.435378][ T5697] usb 4-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 507.435394][ T5697] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.435404][ T5697] usb 4-1: Product: syz [ 507.435412][ T5697] usb 4-1: Manufacturer: syz [ 507.435419][ T5697] usb 4-1: SerialNumber: syz [ 507.438375][ T5697] usb 4-1: config 0 descriptor?? [ 507.570222][ T5797] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 507.596138][T12949] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.596744][T12949] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.721714][ T5797] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 507.721762][ T5797] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.726157][ T5797] usb 2-1: config 0 descriptor?? [ 507.766088][ T5797] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 508.069461][T12940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.070417][T12940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.188727][T12961] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.191364][T12961] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.208650][ T5797] gspca_stv06xx: I2C: Read error writing address: -71 [ 508.223428][ T5797] usb 2-1: USB disconnect, device number 68 [ 508.335905][T12963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2000'. [ 508.496028][ T5697] f81534 4-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 508.496083][ T5697] f81534 4-1:0.12: f81534_find_config_idx: read failed: -71 [ 508.496099][ T5697] f81534 4-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 508.496188][ T5697] f81534 4-1:0.12: probe with driver f81534 failed with error -71 [ 508.510795][ T5697] usb 4-1: USB disconnect, device number 23 [ 508.674300][T12968] syzkaller1: entered promiscuous mode [ 508.674316][T12968] syzkaller1: entered allmulticast mode [ 508.788469][ T38] kauditd_printk_skb: 783 callbacks suppressed [ 508.788494][ T38] audit: type=1326 audit(1784314874.382:964): auid=2 uid=0 gid=0 ses=2 pid=12970 comm="syz.2.2003" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fadb36cde99 code=0x0 [ 508.910992][ T202] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 508.950985][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 509.044829][T12979] sg_write: data in/out 410076/64 bytes for SCSI command 0x0-- guessing data in; [ 509.044829][T12979] program syz.3.2006 not setting count and/or reply_len properly [ 509.065351][ T202] usb 1-1: Using ep0 maxpacket: 8 [ 509.075441][ T202] usb 1-1: unable to get BOS descriptor or descriptor too short [ 509.077150][ T202] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 509.077185][ T202] usb 1-1: can't read configurations, error -71 [ 509.566607][T11877] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 509.715617][T11877] usb 2-1: Using ep0 maxpacket: 16 [ 509.717631][T11877] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 509.720019][T11877] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 509.720048][T11877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.720067][T11877] usb 2-1: Product: syz [ 509.720081][T11877] usb 2-1: Manufacturer: syz [ 509.720094][T11877] usb 2-1: SerialNumber: syz [ 509.979327][T12985] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2009'. [ 510.221264][T12990] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2011'. [ 510.285655][T11877] cdc_ncm 2-1:1.0: failed GET_NTB_PARAMETERS [ 510.285707][T11877] cdc_ncm 2-1:1.0: bind() failure [ 510.320044][T11877] cdc_ncm 2-1:1.1: CDC Union missing and no IAD found [ 510.320073][T11877] cdc_ncm 2-1:1.1: bind() failure [ 510.428666][T11877] usb 2-1: USB disconnect, device number 69 [ 510.510409][ T5797] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 510.585234][T13001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.585824][T13001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.693601][ T5797] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 510.693628][ T5797] usb 1-1: config 0 has no interfaces? [ 510.693657][ T5797] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 510.693677][ T5797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 510.705832][ T5772] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 510.742514][ T5797] usb 1-1: config 0 descriptor?? [ 510.768868][T11877] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 510.858317][ T5772] usb 4-1: device descriptor read/64, error -71 [ 510.917653][T11877] usb 2-1: Using ep0 maxpacket: 32 [ 510.929213][T11877] usb 2-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 510.929243][T11877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 510.929263][T11877] usb 2-1: Product: syz [ 510.929275][T11877] usb 2-1: Manufacturer: syz [ 510.929283][T11877] usb 2-1: SerialNumber: syz [ 510.955769][T12990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.956322][T12990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.970329][T12990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.973004][T12990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 511.003073][T11877] usb 2-1: config 0 descriptor?? [ 511.015834][T11877] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 511.016059][T11877] dvb-usb: bulk message failed: -22 (4/0) [ 511.016070][T11877] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 511.016139][T11877] dvb-usb: bulk message failed: -22 (5/0) [ 511.016146][T11877] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 511.017572][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 511.023529][T11877] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 511.024263][T11877] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 511.024319][T11877] usb 2-1: media controller created [ 511.041848][T11877] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 511.082589][ T5582] usb 1-1: USB disconnect, device number 63 [ 511.144578][T11877] usb 2-1: selecting invalid altsetting 3 [ 511.144600][T11877] ttusb2: set interface to alts=3 failed [ 511.150177][ T5772] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 511.189284][T11877] DVB: Unable to find symbol tda10086_attach() [ 511.189300][T11877] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 511.189959][T11877] dvb-usb: bulk message failed: -22 (4/0) [ 511.189972][T11877] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 511.190040][T11877] dvb-usb: bulk message failed: -22 (5/0) [ 511.190048][T11877] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 511.190083][T11877] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 511.304387][T12997] ttusb2: more than 2 i2c messages at a time is not handled yet. TODO. [ 511.304404][T12997] ttusb2: i2c rd len=58 too high [ 511.305250][ T5772] usb 4-1: device descriptor read/64, error -71 [ 511.326371][ T5582] usb 2-1: USB disconnect, device number 70 [ 511.425282][ T5772] usb usb4-port1: attempt power cycle [ 511.438237][ T5582] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 511.541663][T13007] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 511.648389][T13019] dlm: no locking on control device [ 511.782239][ T5772] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 511.816924][ T5772] usb 4-1: device descriptor read/8, error -71 [ 511.909517][T13028] ublk_ctrl_add_dev: dev id not match 4294967295 3 [ 512.026949][T13030] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 512.060120][ T37] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 512.060302][ T5772] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 512.086280][ T5772] usb 4-1: device descriptor read/8, error -71 [ 512.189695][ T5772] usb usb4-port1: unable to enumerate USB device [ 512.219255][ T37] usb 2-1: Using ep0 maxpacket: 8 [ 512.221277][ T37] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 512.221331][ T37] usb 2-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=21.c6 [ 512.221355][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.225173][ T37] usb 2-1: config 0 descriptor?? [ 512.401876][ T5595] Bluetooth: hci3: unexpected event for opcode 0x0c38 [ 512.434588][T13041] fuse: Bad value for 'fd' [ 512.435204][T13042] fuse: Bad value for 'fd' [ 512.452595][T13041] tipc: Started in network mode [ 512.452638][T13041] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 512.453963][T13040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.454551][T13040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.513603][T13041] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 512.554098][T13041] tipc: Enabled bearer , priority 28 [ 512.554226][T13042] tipc: Enabling of bearer rejected, already enabled [ 512.639392][ T5772] usb 2-1: USB disconnect, device number 71 [ 513.059906][ T5595] Bluetooth: hci4: unexpected event for opcode 0x0c7a [ 513.267613][T13051] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 513.268190][T13051] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 513.361902][ T5582] usb 1-1: new high-speed USB device number 64 using dummy_hcd [ 513.513605][ T5582] usb 1-1: config 0 has an invalid interface number: 50 but max is 0 [ 513.513634][ T5582] usb 1-1: config 0 has no interface number 0 [ 513.513679][ T5582] usb 1-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 513.513835][ T5582] usb 1-1: config 0 interface 50 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 513.518010][ T5582] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 513.518039][ T5582] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.518058][ T5582] usb 1-1: Product: syz [ 513.518072][ T5582] usb 1-1: Manufacturer: syz [ 513.518086][ T5582] usb 1-1: SerialNumber: syz [ 513.528394][ T5582] usb 1-1: config 0 descriptor?? [ 513.568221][ T5582] yurex 1-1:0.50: Could not submitting URB [ 513.568406][ T5582] yurex 1-1:0.50: probe with driver yurex failed with error -5 [ 513.630066][ T5772] tipc: Node number set to 1 [ 513.659856][T13065] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2031'. [ 513.803104][ T5772] usb 1-1: USB disconnect, device number 64 [ 513.966785][T13069] bond0: entered promiscuous mode [ 513.966807][T13069] bond_slave_0: entered promiscuous mode [ 513.967022][T13069] bond_slave_1: entered promiscuous mode [ 514.273023][T13085] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.273974][T13085] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.587293][T13089] syzkaller1: entered promiscuous mode [ 514.587318][T13089] syzkaller1: entered allmulticast mode [ 514.892172][T11877] usb 2-1: new full-speed USB device number 72 using dummy_hcd [ 515.043078][T11877] usb 2-1: not running at top speed; connect to a high speed hub [ 515.044324][T11877] usb 2-1: config 1 interface 0 altsetting 15 endpoint 0x3 has invalid maxpacket 1024, setting to 64 [ 515.044357][T11877] usb 2-1: config 1 interface 0 altsetting 15 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 515.044382][T11877] usb 2-1: config 1 interface 0 has no altsetting 0 [ 515.046706][T11877] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 515.046733][T11877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.046753][T11877] usb 2-1: Product: syz [ 515.046767][T11877] usb 2-1: Manufacturer: syz [ 515.046781][T11877] usb 2-1: SerialNumber: syz [ 515.061137][ T5582] usb 4-1: new high-speed USB device number 28 using dummy_hcd [ 515.087778][T13095] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 515.150914][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 515.180428][ T5772] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 515.226484][ T5582] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 515.226503][ T5582] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=128 [ 515.226514][ T5582] usb 4-1: SerialNumber: syz [ 515.258042][ T5582] usb 4-1: config 0 descriptor?? [ 515.277998][ T5582] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 515.329433][ T5772] usb 1-1: Using ep0 maxpacket: 8 [ 515.345980][ T5772] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 515.346006][ T5772] usb 1-1: config 0 has no interfaces? [ 515.349041][ T5772] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 515.349069][ T5772] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 515.349089][ T5772] usb 1-1: Product: syz [ 515.349103][ T5772] usb 1-1: Manufacturer: syz [ 515.349117][ T5772] usb 1-1: SerialNumber: syz [ 515.357474][ T5772] usb 1-1: config 0 descriptor?? [ 515.438492][T13101] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.439309][T13101] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.580227][T11877] cdc_ether 2-1:1.0: probe with driver cdc_ether failed with error -71 [ 515.596726][T11877] usb 2-1: USB disconnect, device number 72 [ 515.616296][T13105] program syz.1.2041 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 515.654418][T13100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.661406][T13100] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.702466][ T202] usb 1-1: USB disconnect, device number 65 [ 515.845488][T13109] tmpfs: Unknown parameter '00000000000000000000003' [ 515.874811][T13097] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.878983][T13097] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.987618][T11877] usb 2-1: new full-speed USB device number 73 using dummy_hcd [ 516.137218][T11877] usb 2-1: config 1 has an invalid descriptor of length 115, skipping remainder of the config [ 516.137283][T11877] usb 2-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0x9D, changing to 0x8D [ 516.137334][T11877] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 0, changing to 10 [ 516.137348][T11877] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8D has invalid maxpacket 512, setting to 64 [ 516.137370][T11877] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 516.137383][T11877] usb 2-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 516.139778][T11877] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 516.139795][T11877] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.139806][T11877] usb 2-1: Product: syz [ 516.139813][T11877] usb 2-1: Manufacturer: syz [ 516.139820][T11877] usb 2-1: SerialNumber: syz [ 516.194859][T13105] raw-gadget.6 gadget.1: fail, usb_ep_enable returned -22 [ 516.304631][ T202] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 516.391501][ T5582] usb 4-1: USB disconnect, device number 28 [ 516.396625][T13105] raw-gadget.6 gadget.1: fail, usb_ep_enable returned -22 [ 516.452612][ T202] usb 1-1: Using ep0 maxpacket: 8 [ 516.454654][ T202] usb 1-1: config 0 has an invalid interface number: 163 but max is 2 [ 516.454681][ T202] usb 1-1: config 0 has an invalid interface number: 233 but max is 2 [ 516.454700][ T202] usb 1-1: config 0 has an invalid interface number: 193 but max is 2 [ 516.454714][ T202] usb 1-1: config 0 has no interface number 0 [ 516.454761][ T202] usb 1-1: config 0 has no interface number 1 [ 516.454770][ T202] usb 1-1: config 0 has no interface number 2 [ 516.454801][ T202] usb 1-1: config 0 interface 163 has no altsetting 0 [ 516.454810][ T202] usb 1-1: config 0 interface 233 has no altsetting 0 [ 516.454820][ T202] usb 1-1: config 0 interface 193 has no altsetting 0 [ 516.457061][ T202] usb 1-1: New USB device found, idVendor=12d1, idProduct=1422, bcdDevice= 0.00 [ 516.457078][ T202] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.457088][ T202] usb 1-1: Product: syz [ 516.457095][ T202] usb 1-1: Manufacturer: syz [ 516.457103][ T202] usb 1-1: SerialNumber: syz [ 516.476575][ T202] usb 1-1: config 0 descriptor?? [ 516.745367][ T202] usb-storage 1-1:0.163: USB Mass Storage device detected [ 516.885440][ T202] usb-storage 1-1:0.233: USB Mass Storage device detected [ 517.006674][T13105] raw-gadget.6 gadget.1: fail, usb_ep_enable returned -22 [ 517.058084][ T202] usb-storage 1-1:0.193: USB Mass Storage device detected [ 517.205602][ T202] option 1-1:0.193: GSM modem (1-port) converter detected [ 517.218353][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 517.221394][ T202] usb 1-1: USB disconnect, device number 66 [ 517.226554][T11877] cdc_ncm 2-1:1.0: bind() failure [ 517.238467][T11877] cdc_ncm 2-1:1.1: probe with driver cdc_ncm failed with error -71 [ 517.239324][T11877] cdc_mbim 2-1:1.1: probe with driver cdc_mbim failed with error -71 [ 517.240899][T11877] usbtest 2-1:1.1: probe with driver usbtest failed with error -71 [ 517.260928][T11877] usb 2-1: USB disconnect, device number 73 [ 517.308316][T13124] netlink: 'syz.3.2044': attribute type 21 has an invalid length. [ 517.308423][T13124] netlink: 'syz.3.2044': attribute type 1 has an invalid length. [ 517.339945][ T202] option 1-1:0.193: device disconnected [ 517.398940][T13123] (syz.3.2044,13123,1):ocfs2_get_sector:1713 ERROR: status = -5 [ 517.399028][T13123] (syz.3.2044,13123,1):ocfs2_sb_probe:753 ERROR: status = -5 [ 517.399053][T13123] (syz.3.2044,13123,1):ocfs2_fill_super:989 ERROR: superblock probe failed! [ 517.399071][T13123] (syz.3.2044,13123,1):ocfs2_fill_super:1177 ERROR: status = -5 [ 517.551405][T13126] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2045'. [ 517.796443][T13139] netlink: 'syz.3.2048': attribute type 11 has an invalid length. [ 518.035185][ T202] usb 4-1: new high-speed USB device number 29 using dummy_hcd [ 518.035922][ T32] hid-generic 0000:0000:0000.0019: unknown main item tag 0x0 [ 518.107596][ T32] hid-generic 0000:0000:0000.0019: hidraw0: HID v0.00 Device [syz1] on syz0 [ 518.184075][ T202] usb 4-1: Using ep0 maxpacket: 16 [ 518.186899][ T202] usb 4-1: unable to get BOS descriptor or descriptor too short [ 518.189309][ T202] usb 4-1: config 3 has an invalid interface number: 74 but max is 0 [ 518.189335][ T202] usb 4-1: config 3 has no interface number 0 [ 518.189377][ T202] usb 4-1: config 3 interface 74 altsetting 1 endpoint 0x5 has invalid maxpacket 512, setting to 64 [ 518.189403][ T202] usb 4-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xC3, changing to 0x83 [ 518.189427][ T202] usb 4-1: config 3 interface 74 altsetting 1 has a duplicate endpoint with address 0x5, skipping [ 518.189449][ T202] usb 4-1: config 3 interface 74 altsetting 1 bulk endpoint 0xD has invalid maxpacket 8 [ 518.189472][ T202] usb 4-1: config 3 interface 74 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 518.189494][ T202] usb 4-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0xB1, changing to 0x81 [ 518.189519][ T202] usb 4-1: config 3 interface 74 altsetting 1 endpoint 0x81 has invalid maxpacket 9507, setting to 1024 [ 518.189544][ T202] usb 4-1: config 3 interface 74 altsetting 1 bulk endpoint 0x81 has invalid maxpacket 1024 [ 518.189567][ T202] usb 4-1: config 3 interface 74 altsetting 1 has an endpoint descriptor with address 0x49, changing to 0x9 [ 518.189592][ T202] usb 4-1: config 3 interface 74 altsetting 1 endpoint 0x9 has invalid maxpacket 17751, setting to 1024 [ 518.189617][ T202] usb 4-1: config 3 interface 74 altsetting 1 bulk endpoint 0x9 has invalid maxpacket 1024 [ 518.189639][ T202] usb 4-1: config 3 interface 74 altsetting 1 has 9 endpoint descriptors, different from the interface descriptor's value: 7 [ 518.189664][ T202] usb 4-1: config 3 interface 74 has no altsetting 0 [ 518.192402][ T202] usb 4-1: New USB device found, idVendor=045e, idProduct=0468, bcdDevice=b2.9c [ 518.192428][ T202] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.192447][ T202] usb 4-1: Product: syz [ 518.192461][ T202] usb 4-1: Manufacturer: syz [ 518.192474][ T202] usb 4-1: SerialNumber: syz [ 518.207983][T13139] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 518.208893][T13139] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 518.210254][T13139] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 518.498368][T13148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 518.511458][T13148] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 518.523469][ T202] ipaq 4-1:3.74: PocketPC PDA converter detected [ 518.523770][ T202] usb 4-1: active config #3 != 1 ?? [ 518.550825][ T202] usb 4-1: USB disconnect, device number 29 [ 518.683386][T13149] netlink: 'syz.0.2050': attribute type 4 has an invalid length. [ 518.683400][T13149] netlink: 'syz.0.2050': attribute type 5 has an invalid length. [ 518.683407][T13149] netlink: 3657 bytes leftover after parsing attributes in process `syz.0.2050'. [ 519.136672][ T32] usb 1-1: new full-speed USB device number 67 using dummy_hcd [ 519.285698][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 519.307723][ T32] usb 1-1: config 0 interface 0 has no altsetting 0 [ 519.307762][ T32] usb 1-1: New USB device found, idVendor=09da, idProduct=000a, bcdDevice= 0.00 [ 519.307786][ T32] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.318890][ T32] usb 1-1: config 0 descriptor?? [ 519.417322][T13165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 519.422215][T13165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 519.592474][ T32] usbhid 1-1:0.0: can't add hid device: -71 [ 519.592586][ T32] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 519.604505][ T32] usb 1-1: USB disconnect, device number 67 [ 519.643683][ T202] usb 4-1: new full-speed USB device number 30 using dummy_hcd [ 519.828260][ T202] usb 4-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 519.828292][ T202] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 519.828312][ T202] usb 4-1: Product: syz [ 519.828325][ T202] usb 4-1: Manufacturer: syz [ 519.828340][ T202] usb 4-1: SerialNumber: syz [ 519.841939][T13179] veth0: entered promiscuous mode [ 519.898212][ T202] usb 4-1: config 0 descriptor?? [ 519.919155][ T202] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 519.919277][ T202] dvb-usb: bulk message failed: -22 (4/0) [ 519.919301][ T202] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 519.919415][ T202] dvb-usb: bulk message failed: -22 (5/0) [ 519.919428][ T202] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 519.928228][ T5772] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 520.015794][ T202] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 520.019005][T13178] hpfs: Bad magic ... probably not HPFS [ 520.049283][ T202] dvb-usb: Pinnacle 450e DVB-S USB2.0 error while loading driver (-19) [ 520.050761][T13178] veth0: left promiscuous mode [ 520.071130][ T5772] usb 2-1: Using ep0 maxpacket: 32 [ 520.073427][ T5772] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 520.073457][ T5772] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 520.073494][ T5772] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 520.073514][ T5772] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 520.087826][ T5772] usb 2-1: config 0 descriptor?? [ 520.132753][ T37] usb 4-1: USB disconnect, device number 30 [ 520.492544][ T32] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 520.509046][ T5772] ft260 0003:0403:6030.001A: unknown main item tag 0x0 [ 520.509081][ T5772] ft260 0003:0403:6030.001A: unknown main item tag 0x0 [ 520.628045][ T32] usb 1-1: device descriptor read/64, error -71 [ 520.697128][T13169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.697585][T13194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.720336][T13169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.726918][T13194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.789473][T13196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.790188][T13196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.885187][ T32] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 520.925577][T13200] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2067'. [ 521.000553][T13196] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.001141][T13196] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.018288][ T32] usb 1-1: device descriptor read/64, error -71 [ 521.081569][T13196] netlink: 'syz.2.2066': attribute type 1 has an invalid length. [ 521.126120][ T32] usb usb1-port1: attempt power cycle [ 521.357652][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 521.415121][ T5772] ft260 0003:0403:6030.001A: failed to retrieve chip version [ 521.415437][ T5772] ft260 0003:0403:6030.001A: probe with driver ft260 failed with error -71 [ 521.462605][ T5772] usb 2-1: USB disconnect, device number 74 [ 521.473543][ T32] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 521.495389][ T32] usb 1-1: device descriptor read/8, error -71 [ 521.512236][T13211] netlink: 'syz.1.2070': attribute type 2 has an invalid length. [ 521.512250][T13211] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2070'. [ 521.516308][ T202] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 521.663940][ T202] usb 4-1: Using ep0 maxpacket: 32 [ 521.691208][ T202] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=67.fe [ 521.691238][ T202] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 521.691258][ T202] usb 4-1: Product: syz [ 521.691272][ T202] usb 4-1: Manufacturer: syz [ 521.691294][ T202] usb 4-1: SerialNumber: syz [ 521.710576][ T202] usb 4-1: config 0 descriptor?? [ 521.751749][ T32] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 521.784202][ T32] usb 1-1: device descriptor read/8, error -71 [ 521.861746][T13221] Bluetooth: hci1: Frame reassembly failed (-84) [ 521.902233][ T32] usb usb1-port1: unable to enumerate USB device [ 521.974017][ T202] snd-usb-6fire 4-1:0.0: unable to receive device firmware state. [ 521.974109][ T202] snd-usb-6fire 4-1:0.0: probe with driver snd-usb-6fire failed with error -121 [ 521.981425][ T7448] Bluetooth: hci1: Frame reassembly failed (-84) [ 522.055531][T13224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 522.056368][T13224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 522.110078][ T5772] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 522.141958][ T202] usb 4-1: USB disconnect, device number 31 [ 522.259667][ T5772] usb 2-1: Using ep0 maxpacket: 8 [ 522.261535][ T5772] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 522.261583][ T5772] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 522.261598][ T5772] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 522.261611][ T5772] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 522.261622][ T5772] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 522.263791][ T5772] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 522.263818][ T5772] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 522.263837][ T5772] usb 2-1: Product: syz [ 522.263848][ T5772] usb 2-1: Manufacturer: syz [ 522.263856][ T5772] usb 2-1: SerialNumber: syz [ 522.268826][ T5772] usb 2-1: config 0 descriptor?? [ 522.573902][ T5772] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 522.573919][ T5772] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 522.774679][ T5772] radio-si470x 2-1:0.0: software version 0, hardware version 0 [ 522.774697][ T5772] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 522.774711][ T5772] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 522.916171][T13229] wlan0 speed is unknown, defaulting to 1000 [ 522.949744][ T32] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 522.992288][ T5772] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 522.992346][ T5772] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 522.993035][ T5772] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 522.993329][ T5772] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22 [ 523.044331][ T5772] usb 2-1: USB disconnect, device number 75 [ 523.119579][ T32] usb 4-1: Using ep0 maxpacket: 32 [ 523.122743][ T32] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 523.122771][ T32] usb 4-1: config 0 has no interface number 0 [ 523.122816][ T32] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 523.125252][ T32] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 523.125280][ T32] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 523.125300][ T32] usb 4-1: Product: syz [ 523.125314][ T32] usb 4-1: Manufacturer: syz [ 523.125328][ T32] usb 4-1: SerialNumber: syz [ 523.136206][ T32] usb 4-1: config 0 descriptor?? [ 523.153867][ T32] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 523.153928][ T32] em28xx 4-1:0.132: Video interface 132 found: [ 523.435695][ T60] Bluetooth: hci4: command 0x2016 tx timeout [ 523.437903][T13229] lo speed is unknown, defaulting to 1000 [ 523.541080][ T32] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 523.659761][ T5582] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 523.791915][ T32] em28xx 4-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 523.792060][ T32] em28xx 4-1:0.132: board has no eeprom [ 523.831114][ T5582] usb 1-1: Using ep0 maxpacket: 32 [ 523.840355][ T5582] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 523.840388][ T5582] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 523.840426][ T5582] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 523.840449][ T5582] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.869574][ T32] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 523.869603][ T32] em28xx 4-1:0.132: analog set to bulk mode. [ 523.870184][ T5772] em28xx 4-1:0.132: Registering V4L2 extension [ 523.943078][ T5582] usb 1-1: config 0 descriptor?? [ 523.990328][ T5595] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 524.561216][ T5582] savu 0003:1E7D:2D5A.001B: item fetching failed at offset 5/8 [ 524.574691][ T5582] savu 0003:1E7D:2D5A.001B: parse failed [ 524.574765][ T5582] savu 0003:1E7D:2D5A.001B: probe with driver savu failed with error -22 [ 524.609867][ T5582] usb 1-1: USB disconnect, device number 72 [ 524.772633][T13244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 524.776775][T13244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.301590][T13255] overlayfs: missing 'workdir' [ 525.415990][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.416452][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.416969][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.417374][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.417850][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.418348][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.418771][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.419342][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.420080][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.421367][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.421775][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.422194][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.422574][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.422954][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.424524][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.424996][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.425390][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.425829][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.426256][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.426687][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.426880][ T5677] usb 4-1: USB disconnect, device number 32 [ 525.427116][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-5) [ 525.427242][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.427363][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.427485][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.427611][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.427732][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.427853][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.427976][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.428104][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.428226][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.428361][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.428482][ T5772] em28xx 4-1:0.132: failed to trigger write to i2c address 0x4a (error=-19) [ 525.471618][ T37] usb 2-1: new full-speed USB device number 76 using dummy_hcd [ 525.509592][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 525.602383][ T5677] em28xx 4-1:0.132: Disconnecting em28xx [ 525.636231][ T37] usb 2-1: config 0 interface 0 altsetting 254 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 525.636266][ T37] usb 2-1: config 0 interface 0 has no altsetting 0 [ 525.636298][ T37] usb 2-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 525.636320][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.768903][ T37] usb 2-1: config 0 descriptor?? [ 525.770243][T13253] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 525.894069][T13263] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 525.907572][T13263] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 525.989253][T13253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.010980][T13253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.134229][T13253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.162909][T13253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.231730][T13253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.233773][T13253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.247342][T13253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.267955][T13253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.379161][T13263] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 526.404476][T13253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.426207][T13253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.643890][ T37] usbhid 2-1:0.0: can't add hid device: -71 [ 526.643996][ T37] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 526.659142][ T37] usb 2-1: USB disconnect, device number 76 [ 527.052631][ T5772] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 527.052652][ T5772] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 527.052661][ T5772] em28xx 4-1:0.132: No AC97 audio processor [ 527.208614][ T37] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 527.372849][ T37] usb 2-1: Using ep0 maxpacket: 16 [ 527.378478][ T37] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 527.378504][ T37] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 527.382678][ T37] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 527.382706][ T37] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.382726][ T37] usb 2-1: Product: syz [ 527.382739][ T37] usb 2-1: Manufacturer: syz [ 527.382753][ T37] usb 2-1: SerialNumber: syz [ 527.525741][ T5772] usb 4-1: Decoder not found [ 527.525762][ T5772] em28xx 4-1:0.132: failed to create media graph [ 527.552718][ T5772] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 527.568799][T13299] netlink: 'syz.0.2087': attribute type 64 has an invalid length. [ 527.599692][ T5595] Bluetooth: hci4: command 0x2016 tx timeout [ 527.754386][ T37] usb 2-1: 0:2 : does not exist [ 527.821851][ T5772] INFO: trying to register non-static key. [ 527.821860][ T5772] The code is fine but needs lockdep annotation, or maybe [ 527.821865][ T5772] you didn't initialize this object before use? [ 527.821868][ T5772] turning off the locking correctness validator. [ 527.821880][ T5772] CPU: 1 UID: 0 PID: 5772 Comm: kworker/1:6 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 527.821896][ T5772] Tainted: [L]=SOFTLOCKUP [ 527.821900][ T5772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 527.821907][ T5772] Workqueue: events request_module_async [ 527.821926][ T5772] Call Trace: [ 527.821930][ T5772] [ 527.821936][ T5772] dump_stack_lvl+0xe8/0x150 [ 527.821951][ T5772] assign_lock_key+0x133/0x150 [ 527.821963][ T5772] register_lock_class+0xcc/0x2e0 [ 527.821980][ T5772] __lock_acquire+0xaf/0x2e40 [ 527.821989][ T5772] ? ret_from_fork_asm+0x1a/0x30 [ 527.822003][ T5772] ? stack_trace_save+0xa9/0x100 [ 527.822018][ T5772] ? __pfx_stack_trace_save+0x10/0x10 [ 527.822033][ T5772] lock_acquire+0x115/0x350 [ 527.822047][ T5772] ? __wake_up_common_lock+0x2f/0x1f0 [ 527.822063][ T5772] rt_spin_lock+0x83/0x400 [ 527.822076][ T5772] ? __wake_up_common_lock+0x2f/0x1f0 [ 527.822090][ T5772] ? __pfx_rt_spin_lock+0x10/0x10 [ 527.822104][ T5772] __wake_up_common_lock+0x2f/0x1f0 [ 527.822118][ T5772] __vb2_queue_cancel+0x2de/0xdc0 [ 527.822133][ T5772] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 527.822143][ T5772] ? lockdep_hardirqs_on+0x7a/0x110 [ 527.822152][ T5772] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 527.822167][ T5772] vb2_core_queue_release+0x2f/0x150 [ 527.822182][ T5772] vb2_video_unregister_device+0x15b/0x200 [ 527.822199][ T5772] em28xx_v4l2_init+0x1c60/0x3140 [ 527.822217][ T5772] em28xx_init_extension+0x120/0x1d0 [ 527.822245][ T5772] ? process_one_work+0x7fd/0x1480 [ 527.822271][ T5772] process_one_work+0xaaf/0x1480 [ 527.822296][ T5772] ? __pfx_process_one_work+0x10/0x10 [ 527.822309][ T5772] ? do_raw_spin_lock+0x12b/0x2f0 [ 527.822324][ T5772] ? assign_work+0x3cf/0x5d0 [ 527.822334][ T5772] worker_thread+0xb05/0x10d0 [ 527.822347][ T5772] ? __kthread_parkme+0x71/0x1f0 [ 527.822360][ T5772] kthread+0x388/0x470 [ 527.822372][ T5772] ? __pfx_worker_thread+0x10/0x10 [ 527.822382][ T5772] ? __pfx_kthread+0x10/0x10 [ 527.822394][ T5772] ret_from_fork+0x514/0xb70 [ 527.822408][ T5772] ? __pfx_ret_from_fork+0x10/0x10 [ 527.822421][ T5772] ? __switch_to+0xc89/0x1420 [ 527.822433][ T5772] ? __pfx_kthread+0x10/0x10 [ 527.822445][ T5772] ret_from_fork_asm+0x1a/0x30 [ 527.822461][ T5772] [ 527.825888][ T5772] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 527.825910][ T5772] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 527.825934][ T5772] CPU: 1 UID: 0 PID: 5772 Comm: kworker/1:6 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 527.825960][ T5772] Tainted: [L]=SOFTLOCKUP [ 527.825966][ T5772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 527.825974][ T5772] Workqueue: events request_module_async [ 527.825994][ T5772] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 527.826012][ T5772] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 527.826021][ T5772] RSP: 0018:ffffc90005dcf908 EFLAGS: 00010246 [ 527.826030][ T5772] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 527.826036][ T5772] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 527.826044][ T5772] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 527.826050][ T5772] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88806d2edb14 [ 527.826057][ T5772] R13: ffff88806d2edc28 R14: 0000000000000000 R15: 0000000000000000 [ 527.826068][ T5772] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 527.826076][ T5772] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 527.826083][ T5772] CR2: 00007f4d5e217dac CR3: 000000002c5ac000 CR4: 00000000003526f0 [ 527.826093][ T5772] Call Trace: [ 527.826098][ T5772] [ 527.826104][ T5772] __vb2_queue_cancel+0x2de/0xdc0 [ 527.826120][ T5772] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 527.826131][ T5772] ? lockdep_hardirqs_on+0x7a/0x110 [ 527.826141][ T5772] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 527.826156][ T5772] vb2_core_queue_release+0x2f/0x150 [ 527.826171][ T5772] vb2_video_unregister_device+0x15b/0x200 [ 527.826189][ T5772] em28xx_v4l2_init+0x1c60/0x3140 [ 527.826203][ T5772] em28xx_init_extension+0x120/0x1d0 [ 527.826225][ T5772] ? process_one_work+0x7fd/0x1480 [ 527.826235][ T5772] process_one_work+0xaaf/0x1480 [ 527.826248][ T5772] ? __pfx_process_one_work+0x10/0x10 [ 527.826258][ T5772] ? do_raw_spin_lock+0x12b/0x2f0 [ 527.826272][ T5772] ? assign_work+0x3cf/0x5d0 [ 527.826282][ T5772] worker_thread+0xb05/0x10d0 [ 527.826297][ T5772] ? __kthread_parkme+0x71/0x1f0 [ 527.826310][ T5772] kthread+0x388/0x470 [ 527.826323][ T5772] ? __pfx_worker_thread+0x10/0x10 [ 527.826332][ T5772] ? __pfx_kthread+0x10/0x10 [ 527.826345][ T5772] ret_from_fork+0x514/0xb70 [ 527.826359][ T5772] ? __pfx_ret_from_fork+0x10/0x10 [ 527.826379][ T5772] ? __switch_to+0xc89/0x1420 [ 527.826391][ T5772] ? __pfx_kthread+0x10/0x10 [ 527.826403][ T5772] ret_from_fork_asm+0x1a/0x30 [ 527.826420][ T5772] [ 527.826426][ T5772] Modules linked in: [ 527.826451][ T5772] ---[ end trace 0000000000000000 ]--- [ 527.826479][ T5772] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 527.826495][ T5772] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 527.826504][ T5772] RSP: 0018:ffffc90005dcf908 EFLAGS: 00010246 [ 527.826513][ T5772] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 527.826519][ T5772] RDX: dffffc0000000000 RSI: ffffffff8bcbd060 RDI: 00000000ffffffff [ 527.826526][ T5772] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 527.826532][ T5772] R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff88806d2edb14 [ 527.826540][ T5772] R13: ffff88806d2edc28 R14: 0000000000000000 R15: 0000000000000000 [ 527.826546][ T5772] FS: 0000000000000000(0000) GS:ffff888125af2000(0000) knlGS:0000000000000000 [ 527.826555][ T5772] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 527.826562][ T5772] CR2: 00007f4d5e217dac CR3: 000000002c5ac000 CR4: 00000000003526f0 [ 527.826573][ T5772] Kernel panic - not syncing: Fatal exception [ 527.826721][ T5772] Kernel Offset: disabled