last executing test programs: 14m41.081628958s ago: executing program 2 (id=421): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000406c256d0000000200000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000340)={0x2c, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000004c0)={0x14, 0x0, &(0x7f0000000280)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) 14m39.212384193s ago: executing program 2 (id=428): syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d010203010902"], 0x0) r0 = socket$unix(0x1, 0x1, 0x0) close(0x3) r1 = socket$pppl2tp(0x18, 0x1, 0x1) syz_usb_connect$uac1(0x2, 0xdc, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c240206", @ANYRES8=r0, @ANYRES32=r1, @ANYRESDEC], 0x0) 14m36.739853487s ago: executing program 2 (id=435): syz_usb_connect(0x0, 0x35, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xca, 0x9b, 0xd4, 0x10, 0x1199, 0xb000, 0xa898, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x30, 0x2, 0x0, 0x17, 0xb5, 0x1b}}]}}]}}, 0x0) syz_usb_connect$uac1(0x2, 0x71, &(0x7f00000000c0)=ANY=[], 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 14m35.1094922s ago: executing program 2 (id=444): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x202) 14m34.198470259s ago: executing program 2 (id=447): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x403, 0x6030, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x2}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x14, 0x0, 0x0, 0x0, 0x0}, 0x0) 14m33.834510992s ago: executing program 2 (id=448): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x7d, 0x5}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 14m33.153731086s ago: executing program 32 (id=448): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}, @TCA_RATE={0x6, 0x5, {0x7d, 0x5}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 13m27.693768142s ago: executing program 0 (id=736): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)={0x40, 0xc}, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x44, &(0x7f0000000640)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 13m24.229264884s ago: executing program 0 (id=745): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEAUTHENTICATE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="01002cbd7000ffdbdf252700000008000300", @ANYRES32=r2], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x84) 13m23.522706603s ago: executing program 0 (id=757): r0 = socket$inet(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x4048020}, 0x20000) 13m23.405119853s ago: executing program 0 (id=748): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x202) 13m22.624629636s ago: executing program 5 (id=752): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}}, 0x24}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=@newqdisc={0x2c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@TCA_RATE={0x6, 0x5, {0x7d, 0x5}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 13m22.472718052s ago: executing program 0 (id=753): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000407d1ef62c00000400000109022400010000000009040000010300020009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 13m22.416983887s ago: executing program 5 (id=754): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002400)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000006600000008000300", @ANYRES32], 0x34}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000000) 13m22.205302908s ago: executing program 5 (id=759): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000001c0)={0x5b, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x21, 0x9, {0x9, 0x21, 0x5, 0x4, 0x1, {0x22, 0x4bb}}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000580)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x40, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000340)={0x40, 0x16}, 0x0, 0x0, 0x0, 0x0, 0x0}) 13m22.054506912s ago: executing program 0 (id=760): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000001c0)={0x5b, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x21, 0x9, {0x9, 0x21, 0x5, 0x4, 0x1, {0x22, 0x4bb}}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000580)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x40, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 13m21.897700102s ago: executing program 33 (id=760): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000001c0)={0x5b, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000180)={0x24, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x21, 0x9, {0x9, 0x21, 0x5, 0x4, 0x1, {0x22, 0x4bb}}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000580)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x40, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 13m19.189143999s ago: executing program 5 (id=765): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x202) 13m18.129603685s ago: executing program 5 (id=771): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f00000001c0)={0x5b, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000600)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x44, &(0x7f0000000580)={0x0, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000500)={0x34, &(0x7f0000000300)={0x40, 0xb}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000380)={0x34, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 13m17.675649272s ago: executing program 5 (id=773): syz_usb_connect(0x5, 0x27, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203110902120001000000000904"], 0x0) r0 = syz_open_dev$I2C(0x0, 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000780)={&(0x7f0000000700)=[{0x0, 0x800, 0x0, 0x0}], 0x1}) 13m17.005103127s ago: executing program 34 (id=773): syz_usb_connect(0x5, 0x27, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203110902120001000000000904"], 0x0) r0 = syz_open_dev$I2C(0x0, 0x1, 0x402) ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000780)={&(0x7f0000000700)=[{0x0, 0x800, 0x0, 0x0}], 0x1}) 8.555211606s ago: executing program 6 (id=4047): openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "00020000000000000005e0000f00"}}}]}, 0x48}}, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) setsockopt$inet_int(r5, 0x0, 0x1, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x32c180) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', 0x0}) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f0000000200)={@initdev={0xfe, 0x88, '\x00', 0xff, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa, 0x0, 0x6, 0x0, 0x4000000000000009, 0x10200}) sendmsg$kcm(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="6a6f8e5e", 0x4}], 0x2}, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = syz_open_dev$video4linux(&(0x7f0000000240), 0x4, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r9, 0xc0585605, &(0x7f0000000000)={0x1, 0x0, {0x0, 0x6, 0x1013, 0x7}}) 8.333975263s ago: executing program 7 (id=4048): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f00000000c0)={0x14, 0x15, 0x1, 0x0, 0x0, "", [@generic="05"]}, 0x14}], 0x1}, 0x0) socket$inet6(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r3, 0x89b1, &(0x7f0000000040)={'vlan1\x00'}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000280)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x3, 0x5, 0x12, @mcast2, @private0, 0x0, 0x8007, 0x100, 0x5}}) read$FUSE(0xffffffffffffffff, &(0x7f0000002d40)={0x2020}, 0x2020) setns(0xffffffffffffffff, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r4 = openat$ppp(0xffffff9c, &(0x7f00000001c0), 0x40000, 0x0) ioctl$PPPIOCGIDLE32(r4, 0x8008743f, &(0x7f0000000200)) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x2, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x20) read$FUSE(r5, &(0x7f0000006300)={0x2020}, 0x402) r6 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r6, 0xc0045516, &(0x7f0000000000)=0xffb) r7 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r7, 0xc0040d07, &(0x7f0000000040)=0x121) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r6, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x2, 0x0, 0x80, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) 7.418223887s ago: executing program 1 (id=4049): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x8, 0x4010, 0xffffffffffffffff, 0x9ef43000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000c00)=@file={0x1, './file0\x00'}, 0x6e) getsockname$unix(r2, &(0x7f00000001c0)=@abs, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa15, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f00000002c0)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000240)={{@host, 0x804}, @any, 0x0, 0x8000000000, 0x0, 0x5d3, 0xffffffffffff7966, 0x0, 0x1}) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r4, 0x7a4, &(0x7f0000000180)={{@host}, 0xfffffffffffffff8, 0x800000000000002, 0x20007fff}) r5 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000140), 0x21041, 0x0) ioctl$VT_SETMODE(r5, 0x5602, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r3, 0x0, 0x1) fchdir(r6) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000027c00000400fc800c00018006000600894f"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc090) openat$cgroup_ro(r6, &(0x7f0000000000)='devices.list\x00', 0x275a, 0x0) syz_usb_connect(0x6, 0xa98, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fe76b7ffd016d10e4f7a010203010902860a030000000009048706010e01000908240600014f9bab05240001000d240f01b6be0000eb001a0e0f06241a0200150724141400000814241305097d9141d76e6e66ee0426a7ed6ece4607240a0203a12f05240103022624130038886ab42c0bc6231c8ef77b577134f4bccf63ec3845d55710565fbc40d26f81d1eb0905020110008001070904920007ff5d81000905060000040080f22c31f3f2232f83cadc7c25304d33c466a5e0799971e9e99a81f858cf0828849ee9cde26d52a1712efd2c0a737a0e6cd81390bc9db22e4f0563984fb7c595ab65736ee89026a9e41593c4b73a762180b97f06404545ad55708695cb2cccf70b23401553568dcaa1f5332d056901ae850236e83e3ad90eea8412eae7191e478432dc9245b08267cad7e136a6cde95fb4c4e45f4b6953e57148de11cbbcb74a1ca80d6e782841210905040000040597ff6b218ab49fbf0643384ba56c922e0c42993d4ab7258ec7068dbbbed679dc74a4dfa76fdb1fb700b1e3cb531b8825bdaf1081590185917c1a20c96862f3fb0818256f7b9e63e7383fe09dffecbb5f6023f1a6c9703aec72d5462934d9f7dd595472f94dc2f45bb82d501dc20905050200020409068c0f535b65f38ec99a31d0a7adf9b38f876eb654d903dfdb837201b6fc0a76efaa2d3c6b4b9483d55530bc901e41674cc52c7ce84c3614c9e7de957e1876159c866955f33be1f58d960f1c00fb68c8fa94bce0b64400cfe35f378b7754aad560a0ac6e8202779ecbe4d66a0fd7b69371294c8ba8a73a1b5fefa8b91801effdef1fd7aeed3dc4a29911adc73f5b0dd190b9a129598384d6f1a8f61c4f3384fa3e63b0ae8f38d29c38cf787d705321b75c1bb28179330c3838809196971405f48366df561af8858103ade1ff5b2e419c76cb330e2fd95055cb3e283b2c3d399fa38031648fdf0e6b09050a00080012ff0309058010100000070109050a00080040fff85523aca58a414179a19dc2734df9ce0feaf5c6899844116ad68d8f53308ca124777c63c472a83a494abb9cd15fd376f20648758bcc887e56d35cbba7473c020d82663d40d90027010aa02ac6b3c39e37717fef4b170725010006000209058803080009027f07250102051000090432070f5acb30050b24060000aba43c1766f605240080000d240f010300000003000500c5052415090008241c07000306000424020d092103000c01220c0409050e00000409810056108b602bb2ea1565d4716269578e8eb5eed81d6f8ba8216e4c49a3ea6284132797a3bd22ad4d67529d2b6dba581c058a9d4c651f468e275fcbb73ca9d1c629fea13c462ab138570a8b7e8d414c3521cc00ecabf1b30905070c20000988082005cf8a8a6a47bb0db2896ea733aa4acf7ca3480ac0f19c0307105d4d4f01c409050c10200027080a9d06a9242b3a5661c8526e626cd6e9e787a55632133500bbca79fedf38bfb6c5e72a111d1c027726724afa11d0be47a28c2d36cfaa10e9858cdbaa0ca072ac86ebff125c3b81c55165269757feb73ea16b83bf9bf7bd542be6b73cd6cda2177b800e30b8b1d8e437c44a0fdba096f97ca54de28f22e25ecff5d41e7a8f575960214e2aed70497790756cd5286a5ef57f4895abad98886b01c50fe3f3f90725018001040009054a1008009a0208f57fc19e13175172b79cca6b884578b467fb3a38eff1e4aa3b3e1db97ea5a2a5475a25f56422fda3dd0a2f04fff1871f372667131fbb18c023f9632682f2b1031a2e78878c4777e2f9a4dd5686b07590d5828e249f0c4ce204f11b651498b45063a36fdfaf75377412e8a1cbcae314ea8612752f85d5b13024884cceacbc18840a5784e083c1720ab5f7e37252c25883eebd25e2fa8763087bb91585aa9fc521c8c475694fbfd907b06677b5cd916f0d6e2bc4a43bb70030c877fd5d0da35b420fe93dfa1b3d5b79d175297b8ad2a999ccc84c0ed74a9a85b5f8f6a9e67d303c9c35c34c32fe06800e8835398e73d32561037b535a07250100014e0009050e020004010103e82456459558be28edbf2b27a42a3ab6869c50289faee7471f72478f8412798d61ba6a3581bf06b73246c23c8e847633953fd1e58a2c4f27250354be9a95742a28a71daa3053f2e04b43807110714c9bb7f5dfc2bccd9aac8a944c87f2ca7daf1d4734d4a54c5a12ad2a1cd05d6640c289a8edac6116c035e0b52f2f6cd645ca392c9a990837848e8389d785d78eaca07b6ddbdb7fd7d9c1b0de622e5411b8f2db0a6211194d03d9071944ceef95d43d0c7778dc3f23da4f12e2d160d86d34d0cd724257d9e0deade6bd4bd25418b6d27deab0de65454c80496913691fdda8c836e90c0086868cfb0905051b000202407ffb0edb7f993661edc808021cee350cde86314c223c0ce7dd729c88b61f64f2144fce4f23894be6b189825598d86d9eb7bbb9d4ce631c0c5158e84d0d7086eee8c8cb3666b0bdb598bcccebd1999d12b483ae5add9d6a360758ce0873dd055f2e37fed5eecd0a018ae6513e6d47e6554505b1fafbe5d7850f9e8b249d982738d93b28476e5b16b3e2eec320a2a3a5c5c8e841ca413ec78c3a8699661cb0951f9e4e26737657ff7f822ed4220000000065bf1efd502e57317bbd11ef66884dacde1397ca82069256f26145dcfb1a12b9778295e382e4803619d47784e3999f6b5105f93c0226ff13a004de63753256be10595e81e9eebf3df22e98a009050c004000014001af31edb2876fa5da5cfe2caa47a4b4c704429b31701fad47e3696324ce33d2474f13c17526c02641a5cb7352e7b1a676fa30b1158df206edec4d0ede386bb433f00ce4a1399527e83e58d56b8817d5c0a523c79bbcbc7409830cdce71513a066924a3a13df9b2525238cf42f3ff27d04e8dba7a9eaac75e32651f5759ebc5dcc2c37f14cbbb3be7a5e85fc60e0d2f378cadab2f0fbb5673600ffed2be345955876e1419ad29564c8895bf1ca83f59509050e100002ff09a53b070f9e77f0e028b9b38714281fe8c79351b7610194cc0f774daf1227d93be98ccfff41f3c19a0c92840578659b2cf2208f65c38f54112aeb2a0309050400ff03020802072501010905000725018007040009050c0440000706070905030400048d09080725010106070089319f0f6b9055a8922da422ec6059fe109f81b1565cf692dac14370c15d2997d58c9dea2969e1993f2bf30a513260b411257a8e20a5c402bde5c6f27ae73de618c2a9e8dcbea5bb75009b5bf13b70056c9361563454077607ac97bfefe8301075040f9cdd64cc950d85c96e1150f8ee91a067a625367548b77e909a8b2991e73525e02843109d6eb6090500100800fff7102821db795f156321d17decbdd8d236c0c9a7361754c368b88e8c983cb1fb8c95a629b6f4f50f54b4090506101000030603d622c5a663da27401de99fe71d88442679e007e271f2b3d5933eaa83d3ac7b094ccbd70dcee136f07726f418545e07f934bd7c10e81133129a4b093bd5120906a5fa4de7c7eb122567ba04ea5a5a34c7078c4d7ca2aea11d9bb360b43a385f13c08ca8ddb4706a07cf88a58d2514b3a50ba7bc7b7fe6d2f3f2e4108747f3f738aca952ebc668a13ede96055e2efc3e93b8b974f02439ed86e1bd0f1f14bc650a35fd1b02c47cdf7ca2c1285607a92bb63da21cebbdb5fe0eb1ccea09214033f94354610155e1f29995b7b5bf39f6b44c05f22ff36c380725010310ff030905050100000a0101072501010cff010725010057030009050310ff07090702"], 0x0) 7.118286621s ago: executing program 6 (id=4051): r0 = socket$unix(0x1, 0x2, 0x0) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r1, 0xc0045005, &(0x7f0000000640)=0x10) ioctl$SNDCTL_DSP_STEREO(r1, 0xc0045003, &(0x7f0000000000)=0xfffffffc) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100), 0x111}}, 0x20) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000580), 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000b80)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000b40), 0x106}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000900), 0x111, 0x2}}, 0x18) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000a00)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000009c0), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000780), 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000640)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600), 0x13f}}, 0x20) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000080), 0x62}, {&(0x7f0000000100)="06010000246837f73199aee6fdb9291b3091ec1a06000000975ad8ec030f5919f397867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b370d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1efbd46f600dc964231e3257bf358448fddf894c0cdfa9115adbe5b19bc912fcbc8aac7719b649b1ff1267491da", 0x682c}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802522897576ed115fa21b3d23a367844520b33f5b9aedc0245096765f4cb3b2ff4e54f39bd7346c2347875d75a931b17c6c424ddb4767e0e63cc7725a8fc4b1dbe7929b2f909cc5be8b09e63330341e6471dcac0f8b44693d01805a1467b71612260e2a273861b3697440a5f75497796bffcf79d62a4a50a6ed5ef2efe8c83374f2ecd08d8d628aa03b01a11caeb2bdecc0ab2abcecfa15627979d7c3f9dec5389fc6625e957f8075e23e636dd5514596189d568e14d33ae518e6e9978c6a36a74b49fdbd1260095c9abe447e618878039b75e305b1d2c9ddeb9e5cedb11802e0833739d8595d57d749c890c9290cca4aa96e6718747543796a187e54a66c2f71beefddf911a7a74b59c48ba642d5ecd4d415f48dfbde5baac8a4ba063c1b985d9f9f3180e8a1c8b2cf6a25c2ff17688cc858ac8b9c67960f09a1ca5f28f8e877159e00fe7fb10cca73b391508895e7e52c22f9b38d73dabd6ff7c55ebf4e1611daee8d52b4ceee49a6df7daeb81bf9d1c943a74c03d3dda52c5b99f3225c1b87074f5cef6187878bc5b665ec0561adcc9781280dd1c6592555d327afea78b21beeeb66a0af3eab3249245f41cdbca309d3fba5d4b345319dd0a26134c0c896f2c8d32fda28600013f6a4c95b4038faba70d6c480b360c55bdc0595f7ca636e85521ba505d894f9c5f0a90719bc9944f386ad7491422ff12f34a3c048708d51305a8cc5b2a502ac1575a14c75e9fb7219ede2f6d9c1b362230b6189e0d8cd8ccd11fd0325182c6e46c9977bf63aa02f7024aeb4389f989f5733a198b45e4329c4c1a538a009f216ad3ac09cac39547b4fd21a5d7146ea307ad9b9339f39d5161d17b59860a0aed38cd89d1b68c6438346d51a3a283074e34ee01d2eca527b1b3836ccdf7e807007152c79d14324e3d887c9551a9447527db4434810f5b0b73d855f32a0c89aa784e43f4c1657d408dd33f88aeae1e5186bbcc2a348b708e3cec9080e12ee3676beb5ee86a9b5cc4a3496c242b95a248906ed62f984b22373bdfd97515441f34e01006d8d1244aa88403f207cd8820ffe07634fc86d00f871c1e4c9e8fc1a00d295e36d98119599b62379cda10ada85efe7b50c5f38d8d010a2cd53db900939db1ffce14feffb7940d12842f4f2b507e1fa49e526752d1e3d80a0c2a75e870d85f77fd91fc46ac1b1288dd33338cdad154d6b80b5a925431868d62a3fb0036f28fe259a3f555f767526a9ea230c33843efc49ac3182a357845ea122d606ab22c9f937b2b905e02dd1cb07d380e3486be6167f00b6e6d90a3c1d6aee15da439a55542ce177e498998ba8ac69a848e63e4c7564e4dc04aad595fa1ab81275edafa0d352029c304200d2f2c5881cbf5a26b2141bdb117879cc11e7c13bd62f221ae1ac04dca3d8d58a13c130557ecf5f36184c7366d3852d0cbd6ca42f2a971d87c0bb204097af1a3abdab7b95d07fcdbf5f42607695dedcd26e30b8fc5cfd7b333a95f3ee69d5ba7911dadb1394285c437a0f26fc027737ba5ee7d63333f80acb59f1a7faf2ec3031c6533107502bffc92d8726a48ce00cdb5f1258d85ff8eb72bfb162e122022f1f3e8a72b41d2689d5228b1130fbc946384401f3bbe726314bb09d430333ad78de07b3cec5c18a4f4abb69507b6451ca4e610b8fc988c983426e0cc3b9d15393026eb75d3d08634b8a7495cef69aab83d27ea1b5b41f40b996dd10023d81f77d61192930ffc25cae1e149412322fcb0aa47bee3afc44ec3dda96c9294854e2cbaebfea6f9a90f0b3797d5f505824b4de964151569f881f87f9dd9d30a2a2f9ed01059a909cba157902903c77f2f3d056231e7c7483a3f35e04360e084f0d3f94a92c92c77b3f06479fbc417366d7fe87ddfcdfd86274f87a5f817b0f947924cbe2329f16f6b00c8a0ab96164f7b35fed38a388380af05c3600abc37a944c9e75a691728c26896ac3615297766f406aeb0f2fd147d68fad3fb3b032880280ebb4bf89252a36b0d9eb393daae72829b8da870b886676244897d5322b32703fcf138b66eedeb3024666a88fd99d8962f696ab7b34e19ced1bd27488aa2ffe5bfa11f8f9289bd8c052d4e88316cc33b0255ef1bfca4c17067d7f78175c56db481fe8dc6f73b1cbdf9d5823f115c9e03f2dfd07bc1ad88564d48b18cd9a30d83cbd5e6a3eedcb0ee86e5dd47f32820cb74dcf730b2052b31297b529e5e24f042335d13915e4048132fe1a101841e919c7870bb680eddead9a6111394bc12e274fbd88abaf2d254721c42e82abf4d1e319a631794ed6ce319ddd844ac5e9b1fc96dd9aaad42f2e087abe1b85430c4a00631970e3e74a6ed923f49e0df75685e044fae3fcea0af4dbfeebe0a9c2e73e8a89b89603a75f585e3ebba5453ae595da1469ea90ea3c9fb6a22411c56c58dfbf504caa629dbfc73ebbedc91669f2babf8b8215c525edf8feb366f104ffa9eb2bb79232660aece4730ef1ae8585c629ffe1390356a58e900da145b83ad177c7bb2d125e59d7ff4d3a8562efc620b4cf9b33c2305bbf1957e0f8b06f0fbe9c80db73b08fdd0be4a1ea4f91f52af47160040424aed8ac3c10251fb0b5d9be08247edf3dda5d1750d0597d60c8a0d9418a4e0c9325bb90f0886f9e5dda9e88ac1942ec1e53da0cf5ccad66b9cdfc2fdca784dd06a73713ef73785706d024873ddca5ccfcf0b91748a2c1fbd8c241934b5b473007b29d76aec5addf7b945a5f7abd6ddeccc8d0ccb26d69d4793b7224c27ba7bf45aac8a2be56086ab8c65ea69fdd593a01a29e2912378002d824bd98e6ed1c5dd5f33be529e640997f5f1bbde051fb2a669145966db4889bf32aa13777ac6c077c51bb8b2523954cea3adc307cfe53b8cbb00edf0c04c456392aea6613e8078a309dc538a6a24f80fc1b7f9fce3e3291ca6dab8090a634fcdb24e7a9de8aecd595b988f597cd623d148a8841b0a5203953166ea2e85316928f28dd2604d37c9ec80a49c0d91cbfe6d584b9b6a321b97bf99ae1d67985fd441976a828c97456003a7892c7c7f4a51bb49e3d3ea1e95ec29c89a2676", 0x1001}], 0x3) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r6 = socket$unix(0x1, 0x2, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) connect$unix(r7, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r7, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x3ec0) connect$unix(r6, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYRES32=r8], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ppoll(&(0x7f0000000000)=[{r0, 0xd465}, {r8, 0x122}, {r8}], 0x3, 0x0, 0x0, 0x0) recvmmsg$unix(r0, &(0x7f0000003c40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10000, 0x0) 6.784905332s ago: executing program 7 (id=4053): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000200)={0x0, 0x4, 0x2, 0x9, 0x0, 0x0, 0x0, 0xfd, 0x5}, 0xe) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000002300)=[@in={0x2, 0x4e22, @remote}]}, &(0x7f0000000440)=0x10) r1 = socket(0xa, 0x5, 0x0) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000640)={r3}, &(0x7f0000000000)=0x8) 6.230570431s ago: executing program 6 (id=4054): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109021b000100000000090400000101290000090509"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) r2 = syz_io_uring_setup(0x160d, &(0x7f0000000140)={0x0, 0xaa6a, 0x80}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x5c}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x60}}, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r2, 0x47f6, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r2, 0x12, 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(r2, 0x80089418, &(0x7f0000000000)=0x0) ioctl$BTRFS_IOC_RM_DEV_V2(r2, 0x5000943a, &(0x7f0000001200)={{r1}, r5, 0x10, @inherit={0x90, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000000900000000000000ffffffffffffffff00000000004000002000000000000000010000000000000aff7f00000000000004000000000000005938000000000000de3a00000000000000000080000000000800000000000000080000e6000000000300000000000000070000010000000000000003000000000061067000000000000001"]}, @subvolid=0x8}) r6 = socket$kcm(0x11, 0x200000000000002, 0x300) setsockopt$sock_attach_bpf(r6, 0x107, 0x8, &(0x7f0000000000), 0x4) r7 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r7, &(0x7f0000000200)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000002540)=[{&(0x7f0000000540)="b88a000000000000000000008100", 0x5bc}], 0x1}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r4, &(0x7f00000001c0)) recvmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) syz_open_dev$audion(&(0x7f00000011c0), 0x3, 0x8c4201) 5.89946357s ago: executing program 4 (id=4056): r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000000)="67036b8069b5df32466413e364ae3434fb6067ae78aaa28bf00c5482b7d9361c3e22d07c7679ad5a330ebb69747f9218e2bfd7c241997f230828cc20") r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$BTRFS_IOC_DEV_REPLACE(r0, 0xca249435, &(0x7f0000000080)={0x0, 0x0, @status={[0x800, 0x3, 0xffffffffffff6f87, 0x7, 0x7, 0x5]}, [0x3, 0x3, 0x8, 0x4, 0xb1f, 0x80a, 0x2, 0x5, 0x6, 0x0, 0x8000, 0x9fe, 0xf1a, 0x7fffffff, 0x7ff, 0x5, 0x633f, 0x5, 0x7, 0x3, 0x5, 0x96e4, 0xffffffff7fffffff, 0xa, 0x5, 0x5, 0x81, 0x1, 0x3738, 0x7, 0x57, 0x6, 0x1, 0x9, 0x2, 0x5, 0x8000000000000001, 0x6a, 0x7, 0x8, 0x3, 0x81, 0x5, 0x9, 0x80000001, 0x7f, 0x1000, 0x80000001, 0x2e, 0x7f, 0xfffffffffffffffc, 0x6, 0x80000000, 0x6, 0x1000, 0x5, 0x6, 0xc8, 0x7, 0x1566, 0x9, 0x21c, 0x56, 0x4]}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000ac0)=0x5) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000b00), &(0x7f0000000b40)=0x4) ioctl$SNDCTL_DSP_GETCAPS(r1, 0x8004500f, &(0x7f0000000b80)) clock_gettime(0x0, &(0x7f0000000bc0)={0x0, 0x0}) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f0000000c00)={r3, r4/1000+60000}, 0x8) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000c40)=0x6) ioctl$VT_ACTIVATE(r1, 0x5606, 0x80000001) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000c80)={'batadv0\x00', 0x0}) connect$packet(r1, &(0x7f0000000cc0)={0x11, 0x4, r6, 0x1, 0x3, 0x6, @random="5176bde1522c"}, 0x14) openat$cgroup_int(r1, &(0x7f0000000d00)='cpuset.cpu_exclusive\x00', 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000d80), r1) ioctl$KVM_GET_XSAVE(r1, 0x9000aea4, &(0x7f0000000e80)) ioctl$SOUND_PCM_READ_BITS(r1, 0x80045005, &(0x7f0000001e80)) r7 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x5) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000001f00)={0x0, 0x183c49f5, {}, {0xffffffffffffffff}, 0x6a, 0x8}) statx(r1, &(0x7f0000001f40)='./file0\x00', 0x2000, 0x400, &(0x7f0000001f80)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r1, &(0x7f0000002080)='./file0\x00', 0x4000, 0x400, &(0x7f00000020c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = getgid() fstat(r5, &(0x7f00000021c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r1, &(0x7f0000002240)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) fsetxattr$system_posix_acl(r0, &(0x7f0000001ec0)='system.posix_acl_access\x00', &(0x7f0000004280)={{}, {0x1, 0x4}, [{0x2, 0x0, r8}, {0x2, 0x6, r9}], {0x4, 0x4}, [{0x8, 0x6, r10}, {0x8, 0x7, r11}, {0x8, 0x1, r12}, {0x8, 0x0, r13}], {0x10, 0x3}, {0x20, 0x5}}, 0x54, 0x2) rt_tgsigqueueinfo(r14, 0x0, 0x36, &(0x7f0000004340)={0x4, 0x4, 0x6}) 5.83172361s ago: executing program 4 (id=4057): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000002080)='pagemap\x00') fcntl$lock(r2, 0x5, &(0x7f0000003980)={0x0, 0x1, 0x5, 0xfffffffffff00000}) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f00000001c0)={0x1, 0x8, 0x2, 0xfff, @vifc_lcl_addr=@multicast2, @remote}, 0x10) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000040)={0x0, 0x73, 0x0, 0x5, 0x0, "5ee691000200000017e0054200", 0x1000, 0x4}) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r3, 0x0, r4, 0x0, 0xa, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r6, 0x3a9, 0x3, 0x0, {{}, {@val={0x8, 0x140}, @void}}}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r7, 0x0, 0xc8, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x42, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa8aa8aaaaaabb08004600003400000020fc029006907800fa00094570fff60065b2d30100000000006eebce5a0369dde900"/66], 0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r8, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) 5.449725286s ago: executing program 7 (id=4058): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="4c000000100039042abd70000000000000000000", @ANYRES32=r1, @ANYBLOB="01180200031100002c0012800e00010069703665727370616e0000001800028008001500a8bc0d00040012"], 0x4c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=@newlink={0x64, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, r1, 0x0, 0xc05}, [@IFLA_LINKINFO={0x44, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x30, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x2}, @IFLA_GRE_ERSPAN_HWID={0x6, 0x18, 0x3}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_LINK={0x8, 0x1, r1}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x4}]}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x12) 5.270250384s ago: executing program 3 (id=4059): mlockall(0x2) r0 = shmget$private(0x0, 0x400000, 0x8, &(0x7f000000e000/0x400000)=nil) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f00000000c0)=[{&(0x7f00000021c0)="3d4077aef9", 0x5}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r3, 0x40045532, &(0x7f0000000000)=0x9) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a78000000060a010400000000000000000a0000010900010073797a31000000004c000480480001800a000100696e6e657200000038000280080004400000050e0800034000000001080002400000008f0800014000000000140005800c0001007061796c6f616400040002800900020073797a32"], 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) shmat(r0, &(0x7f00000ac000/0x1000)=nil, 0x5000) shmat(r0, &(0x7f0000368000/0x3000)=nil, 0x7000) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)={0xbc, r4, 0x400, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1, 0x25}}}}, [@NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x4}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}], @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0xd4f}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x98a}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16ee}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}], @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @chandef_params, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xf}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x21}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16e9}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x14}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x9}]]}, 0xbc}, 0x1, 0x0, 0x0, 0x40095}, 0x11) 4.886613243s ago: executing program 4 (id=4060): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_GETVERSION(r0, 0x80047601, &(0x7f0000000040)) syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fe76181004160780a6af011703010902120001000000000904", @ANYRES8], 0x0) syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100}, &(0x7f0000000180), 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = openat$nullb(0xffffff9c, &(0x7f0000000080), 0x200000, 0x0) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000100)) r3 = syz_open_dev$sndctrl(&(0x7f0000000380), 0x3, 0xbc01) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r3, 0x80dc5521, &(0x7f0000000180)=""/135) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a98000000180a010800000000000000000d00000608000740000000030900010073797a310000000068000380080002400000000418000380140001006e6963766630000000000000000000002c5da04293e9548f74247326940003801400010070696d7265673000000000000000000014000100776730000000000000000000000000000800014000000000080002400000000108000140000000000800074000000001a4000000160a01000000000000000000010000000900010073797a31000000000900020073797a3000000000780003805400038014000100766c616e3100000000000000000000001400010070696d72656700000000000000000000140001007465616d5f736c6176655f3100000000140001007866726d3000000000000000000000000800024000000000180003801400010067656e6576653000000000000000000048000000180a0101000b0000000000000a0000080900020073797a32000000000900010073797a30000000001c000380180003801400010067656e657665300000000000000000001400000010000100"], 0x1ac}}, 0x0) 4.869264268s ago: executing program 7 (id=4061): openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xf, "00020000000000000005e0000f00"}}}]}, 0x48}}, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) setsockopt$inet_int(r5, 0x0, 0x1, 0x0, 0x0) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x32c180) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', 0x0}) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f0000000200)={@initdev={0xfe, 0x88, '\x00', 0xff, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xa, 0x0, 0x6, 0x0, 0x4000000000000009, 0x10200}) sendmsg$kcm(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a00100000000280", 0x2a}, {&(0x7f0000000400)="6a6f8e5e", 0x4}], 0x2}, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602240000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = syz_open_dev$video4linux(&(0x7f0000000240), 0x4, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r9, 0xc0585605, &(0x7f0000000000)={0x1, 0x0, {0x0, 0x6, 0x1013, 0x7}}) 4.696865762s ago: executing program 3 (id=4062): sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040000}, 0x8080) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) shmget(0x2, 0x3000, 0x1000, &(0x7f000049b000/0x3000)=nil) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 4.46272214s ago: executing program 3 (id=4063): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa1a080045000028006500000206907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="0400000400070000"], 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) syz_emit_ethernet(0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c2000000080045000028000040000006907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r3, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x24, 0xf, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6}]}, 0x24}}, 0x4008010) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket(0x11, 0x800000002, 0x0) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_GET_STATS_FD_cpu(r6, 0xaece) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000540)={'wlan0\x00', {0x2, 0x0, @private=0xf30a4001}}) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r4, 0x100, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x40e3907f}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x45) socket$key(0xf, 0x3, 0x2) 4.170384037s ago: executing program 6 (id=4064): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000040)={0xa1, 0x0, 0x0, 0xf3d8, 0x0, 0x0, 0x0}) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f0000000980)="9f", 0x1) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000100)=0x6, 0x4) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs2/custom1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x0, 0xb}) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f00000000c0)=@abs={0x1}, 0x6e) bind$unix(r3, &(0x7f00000003c0)=@abs={0x1}, 0x2) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$l2tp(0x2, 0x2, 0x73) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) syz_usb_connect(0x0, 0x24, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x8, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001400)=ANY=[@ANYBLOB="3c00000010003b15000800"/20, @ANYRES32=0x0, @ANYBLOB="340e000000b401001400128009000100626f6e64000000000400028008000a00", @ANYRES32], 0x3c}}, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)="2e00000011008b88040f80ee59acbc04130800480f0000005e2900421803001825800000000000000280000c0012", 0x2e}], 0x1}, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r5, r2, 0x0) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) read$FUSE(r7, &(0x7f0000000480)={0x2020}, 0x2020) 3.903651042s ago: executing program 1 (id=4065): syz_usb_connect$uac1(0x0, 0xa6, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x94, 0x3, 0x1, 0x10, 0x10, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8001}, [@extension_unit={0x7, 0x24, 0x8, 0x4, 0x1, 0x5}, @processing_unit={0xc, 0x24, 0x7, 0x3, 0x0, 0x0, "d885700585"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x2, 0x3, 0x3, 0x1, 'b', 'Qq\t'}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x14, 0x4, 0xcc, {0x7, 0x25, 0x1, 0x1, 0x7f, 0x4}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x1, 0x5, 0x1002}, @format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0x6896, 0x2, 0x0, "78f4cd9535ca"}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x7, 0x4, 0x3, {0x7, 0x25, 0x1, 0x2, 0xf4}}}}}}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0}) r0 = syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000090000102505a1a4400000000101090244000101000000090400001202060000052406000005240000000d240f010000000000000000000905810340000000000905820260000000000905030208"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000012c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB="0c0000000100fb4eaa24e58c92c1000001090000920000000a425e0358371128c90b155a649fc888c93a1814e58098f500172ba73d6dcef311adc43b8723a23667ac17daff00000000000000ee3e8a3d51e64799d127bd5bac5e76c4eebacf8dbffa013d6afa72d2f9dae299bc184e74dbd96417c605a71d0f91b5adcc6ddb3e219d65163215943bb7006dd7b7f50a5f9c7d5c978d2c818b94c2c4ee4dfb9fb1a1889fbff2b7908d58c6c0063bd1c15df9934c03f1d70ee98095180d5568babe6734052aae74a2d6b1ae9da6c905c3120c7c710a165ed992d080d6de5ffb97197f51287e7bc911c380c411dc38cc6537bf48a760ae44130e94b287b8281af7dabdfdef8209c8cb892534cef0b42e95fd386bd144c2a88ec075c908a7049b3a06c68965c1c72ed5a285e0eb7388fff6199dde24760eb601cc1af5906957d34d60fc698eaae66a3532364914"], 0x18, 0x8044}}], 0x1, 0x8800) syz_usb_connect$cdc_ecm(0x5, 0x17f, &(0x7f0000000180)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x16d, 0x1, 0x1, 0x81, 0xa0, 0xe, [{{0x9, 0x4, 0x0, 0x40, 0x3, 0x2, 0x6, 0x0, 0x9, {{0x7, 0x24, 0x6, 0x0, 0x0, "a495"}, {0x5, 0x24, 0x0, 0xffff}, {0xd, 0x24, 0xf, 0x1, 0x10001, 0xe, 0x6, 0x6}, [@network_terminal={0x7, 0x24, 0xa, 0x10, 0x9, 0x7, 0x9}, @dmm={0x7, 0x24, 0x14, 0xfffa, 0x4}, @mdlm={0x15, 0x24, 0x12, 0xbc74}, @mdlm_detail={0x104, 0x24, 0x13, 0x3, "ae8f0b7b064042b103abce5ecbd3c0cd491f97e1b7241163692dce1dcca6baeb21679e9e73b61baae40af627c4a9d0c562e68f913e3b379a0fbfbee07093f95833f2c53e153bcc0c0ec4289b5da2c0e0efe3e93f5b183e74dc4987e5b8e3375bcd96004a78c4134234b5a326bbc4118f92ad74f6ea95f459749a32c9605850d528d8f9849c96d03a4e7ffd14bf9423a585951ffe23e9ea9ba59f82cfffd556eafc5c600a9570ff0d3faa43607a9b320259d305015339006663474b93a46fb6885aa3e8bfd6b80d76deb62afeb02cffe0780643420dbd784c8a8746547886e35d5ef28f4ea91f3d7dcbec7c5ae579e90a3dbd43ad2b33234daadadda16756e01d"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x8, 0x10, 0x4, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x6f, 0xe8, 0xf}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x3, 0x3, 0x7}}}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x200, 0xd, 0x5, 0x81, 0xff, 0xf8}, 0x2f, &(0x7f0000000040)={0x5, 0xf, 0x2f, 0x4, [@wireless={0xb, 0x10, 0x1, 0x8, 0x20, 0x5, 0x0, 0x9, 0xcd}, @wireless={0xb, 0x10, 0x1, 0xc, 0x4, 0xff, 0x4, 0x401, 0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x3, 0x9, 0x12, 0x100}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x3, 0x4, 0xfff}]}, 0x3, [{0x1e, &(0x7f0000000080)=@string={0x1e, 0x3, "6a342a1a627baecafbab9105921d3d923f6ae37c2c14b32d731bc157"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0xc09}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x458}}]}) syz_usb_connect(0x0, 0x5c4, &(0x7f00000004c0)={{0x12, 0x1, 0x300, 0xae, 0xd2, 0xce, 0x8, 0x11d9, 0x1003, 0x788f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5b2, 0x2, 0x9, 0x6, 0x0, 0x10, [{{0x9, 0x4, 0xc, 0x4, 0x4, 0xbd, 0x8d, 0xbb, 0x1, [], [{{0x9, 0x5, 0x7, 0x3, 0x20, 0x2, 0x7, 0x3, [@generic={0x22, 0xe, "7786144ddf00000d470813a6e57cbfaa33cf281d9f9d16846a751b0ab9e7d8d7"}, @generic={0x7f, 0x23, "88be23b954abbaabce4598e7726881aa951efa34cca302def64208762edd3721c23aa6d3863ff627b7a677690e20caeb42d9ad731ac58253fdd1a199c77c3a7b9d12531946ff133fefad5c9b98fd347e82e342d81b655b20ed3a8faabf0cae91ecb6b90bc0a6cd7b76ae07eb6553564f79c568d54b091e200d7bdd41b3"}]}}, {{0x9, 0x5, 0x3, 0x8, 0x0, 0xd7, 0x9, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x42, 0xa, 0x6}]}}, {{0x9, 0x5, 0x4, 0x1, 0x3ff, 0x7, 0x6, 0x7, [@generic={0x52, 0xd, "9c766598eae5a3f2da3efd9a09a9d2f8a9555d8bd40c2e59aea02328f2e0ce80a32bf9ccfbf80a784e4d67a57c52bb2a2765edd6a672e35a5f039ccea852dd19bf3424622d9a5143155695aef52de888"}]}}, {{0x9, 0x5, 0x82520a72a96d2b90, 0x10, 0x40, 0x86, 0xa, 0x39, [@generic={0x95, 0xd, "4fac930801f39ca3a644b8776d9f57dd4f335af24d2a489e8d4e2caa91876c528d789bab60560ff40a1f08dc021220b4f6988c005234f58aed775a893e27de6a65ddef1d3ddcdf3563254471bb449f2448cbc66bdba6c392e0235ae9dd5cce08b33c894e7deb1cdb5ccc8445be53da5125d0a2297086f6028a28932c2ac2af786aa8ef9a78f9f35b6f2781c2019669aac9d8e0"}, @generic={0xeb, 0x21, "e36e4b957d56b7933398629109c6d5dabb32b88d43f9ee31b4b6679669963f49da1eea4c17f6fcba4ef8f540c995fea3fe116cbb3b07f8fb6ebb1ac5b9e12fa69ce942e730441564dcb608d3cd05441de8b5075fec5863252f770d1b807015058e63852d11ed0e5da37767f77d36b15515b9b8dc59d2d0572826fc276846a922aeba751586bb86551c2df3fdcfde8375e35109f17b725863de850dca2aba8c7306aea3abe83030132a12a54e3c8a01b749369ac37668995b71007fb4fa9bbf4532ac4aee5e31f65db22194b28439ad9ed097e447335b098c0213e6c167e47bed92c19c948e5f12f2a7"}]}}]}}, {{0x9, 0x4, 0x8d, 0x8, 0x7, 0x14, 0xb3, 0xa1, 0xa, [], [{{0x9, 0x5, 0xa, 0x0, 0x400, 0x80, 0xc, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xe}, @generic={0xee, 0x1, "1a408bd03799ae919fcabf43e8bedb8a1b635e9b044b623047c791818c34c16f41b06d8589017d2362cff2f4e4600d8d7b8b180f458dbfab6ae100866efe7b5e54b3d9f532921ee32488fb879d133b5c6e9e007b0415e79d6b0c50490bb82bdc50344b49157b8241926954259ec53d1c385a55ef4c960858cf31314abf7a88884be957683b3045e6d075d83d1d041223fba25d649d235a3f5336b3d103283d928be9aadd6a333fd2655830570437d4abf7b5ec5923dacb86ed57efa5e1508b26ec1244dcb922f2454bc0481da7eb554835cc76403d8ba5c73b7788fc7441d1414fea295c3176fb0ab60c93b7"}]}}, {{0x9, 0x5, 0xb, 0x1, 0x400, 0x6a, 0x10, 0xed, [@generic={0x70, 0x5, "c49308d51361cb56ad9388b46b86f5049330a09eaa2b36dd170a8b79027449d01692c752fd1d02aa822859fbbf30417fa5af24fff54500ead385f57719a3accf36fb271c8623996843d81a3458dd5a1b40bdf6164408f592303cfd40412deb541de380c65f7a1f5b848b1da14167"}, @generic={0xfa, 0xd, "95b777d06896e6ee60bf5fb967f63be62f901976d6e27a23c9598c066a046102f128e789e3c4e8a8169dda3911c34849a939487faa2c0fd53afa244d9558f9f3059351c980bc3a1625ea2af6acf3fd94f6e3e11d53efa4a7cdf6f43826640d6d23d2ead272c79f020cbe0eb5b0a9a886a477ff050fc0ef0101050f95a157adc196c3014b08a3076fb94d820f0a90986b703618cbe6893875130fc6668a0ea3cb36e7df231c070221f4d91f7a8cc454062ee2e13e7f2a1b64862a4f0a3d57ba17005815c54d2641b57c594e0b909e8a5bf6285a2aa710b8a574e468e58dc6e7466781261e623697b6785e66a2ed3dded58a82c7f2ab3ef1ae"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x10, 0x4, 0x5, 0x2}}, {{0x9, 0x5, 0x6, 0x0, 0x40, 0x1, 0x7, 0x2}}, {{0x9, 0x5, 0x8, 0x3, 0x3ff, 0xff, 0xf2, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x9, 0x1000}]}}, {{0x9, 0x5, 0x5, 0x0, 0x10, 0xd, 0x7, 0x4, [@generic={0x54, 0x21, "0775dc5b24e0db1b8eae9d6678138c72f4b54b4b736f74555550e08817216d131c55aeb5509b6b2dc5862bc7aa28b0656cf22b7d26501a8443d0e7be009697a17e183bb2b4e72cca6c2ce083bd01a6d9141c"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x20, 0x6, 0x1, 0xa}}]}}]}}]}}, &(0x7f0000000bc0)={0xa, &(0x7f00000003c0)={0xa, 0x6, 0x310, 0x3, 0x9, 0x4, 0x40, 0x8}, 0x20, &(0x7f0000000400)={0x5, 0xf, 0x20, 0x2, [@ext_cap={0x7, 0x10, 0x2, 0x12, 0x3, 0x9, 0x7}, @ss_container_id={0x14, 0x10, 0x4, 0x5, "06447b39de53a861e3870f0f9a23da1e"}]}, 0x2, [{0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x2c09}}, {0x100, &(0x7f0000000ac0)=@string={0x100, 0x3, "974a02c220e2b595777038ba0651de1a816618639866ec8bbed6bc725a5a98718454d97d8be827b1dfec4da6c8e7baaf0311d05fab1226285900bfddafd6807175331582b430b7419448ac0bdb36766a1c6852ea47c46a35755cb8c322a5aa89c2cf3a33aafeb27d9b78046efee98bdc00c42cc9755fbd05a657917f1941c1498884772dc3a485080a49e183d645b4cf7d393170b6769c22b0bf622dd881f09e027f5d6c5e9a7b3731b6d5efb166da861ccb959e97f694df0d7c86123a65cfd44474a71b01f111b6793bce8d46c8282757b354c8ac27a2e331bb23eed5dcf7ff1c3e82691699c6cf07f421e29a3afd8179a368bd68880c6ee41d45561458"}}]}) 3.663107949s ago: executing program 3 (id=4066): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000002080)='pagemap\x00') fcntl$lock(r2, 0x5, &(0x7f0000003980)={0x0, 0x1, 0x5, 0xfffffffffff00000}) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f00000001c0)={0x1, 0x8, 0x2, 0xfff, @vifc_lcl_addr=@multicast2, @remote}, 0x10) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000040)={0x0, 0x73, 0x0, 0x5, 0x0, "5ee691000200000017e0054200", 0x1000, 0x4}) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r3, 0x0, r4, 0x0, 0xa, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r6, 0x3a9, 0x3, 0x0, {{}, {@val={0x8, 0x140}, @void}}}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r7, 0x0, 0xc8, &(0x7f0000003d40), 0x4) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, 0x0, 0x0) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x42, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa8aa8aaaaaabb08004600003400000020fc029006907800fa00094570fff60065b2d30100000000006eebce5a0369dde900"/66], 0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r8, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) 3.337853045s ago: executing program 4 (id=4067): r0 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000000)="67036b8069b5df32466413e364ae3434fb6067ae78aaa28bf00c5482b7d9361c3e22d07c7679ad5a330ebb69747f9218e2bfd7c241997f230828cc20") r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$BTRFS_IOC_DEV_REPLACE(r0, 0xca249435, &(0x7f0000000080)={0x0, 0x0, @status={[0x800, 0x3, 0xffffffffffff6f87, 0x7, 0x7, 0x5]}, [0x3, 0x3, 0x8, 0x4, 0xb1f, 0x80a, 0x2, 0x5, 0x6, 0x0, 0x8000, 0x9fe, 0xf1a, 0x7fffffff, 0x7ff, 0x5, 0x633f, 0x5, 0x7, 0x3, 0x5, 0x96e4, 0xffffffff7fffffff, 0xa, 0x5, 0x5, 0x81, 0x1, 0x3738, 0x7, 0x57, 0x6, 0x1, 0x9, 0x2, 0x5, 0x8000000000000001, 0x6a, 0x7, 0x8, 0x3, 0x81, 0x5, 0x9, 0x80000001, 0x7f, 0x1000, 0x80000001, 0x2e, 0x7f, 0xfffffffffffffffc, 0x6, 0x80000000, 0x6, 0x1000, 0x5, 0x6, 0xc8, 0x7, 0x1566, 0x9, 0x21c, 0x56, 0x4]}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000ac0)=0x5) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000b00), &(0x7f0000000b40)=0x4) ioctl$SNDCTL_DSP_GETCAPS(r1, 0x8004500f, &(0x7f0000000b80)) clock_gettime(0x0, &(0x7f0000000bc0)={0x0, 0x0}) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT_OLD(r1, 0x28, 0x6, &(0x7f0000000c00)={r3, r4/1000+60000}, 0x8) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000c40)=0x6) ioctl$VT_ACTIVATE(r1, 0x5606, 0x80000001) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000c80)={'batadv0\x00', 0x0}) connect$packet(r1, &(0x7f0000000cc0)={0x11, 0x4, r6, 0x1, 0x3, 0x6, @random="5176bde1522c"}, 0x14) openat$cgroup_int(r1, &(0x7f0000000d00)='cpuset.cpu_exclusive\x00', 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000d80), r1) ioctl$KVM_GET_XSAVE(r1, 0x9000aea4, &(0x7f0000000e80)) ioctl$SOUND_PCM_READ_BITS(r1, 0x80045005, &(0x7f0000001e80)) r7 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x5) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000001f00)={0x0, 0x183c49f5, {}, {0xffffffffffffffff}, 0x6a, 0x8}) statx(r1, &(0x7f0000001f40)='./file0\x00', 0x2000, 0x400, &(0x7f0000001f80)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(r1, &(0x7f0000002080)='./file0\x00', 0x4000, 0x400, &(0x7f00000020c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = getgid() fstat(r5, &(0x7f00000021c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r1, &(0x7f0000002240)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) fsetxattr$system_posix_acl(r0, &(0x7f0000001ec0)='system.posix_acl_access\x00', &(0x7f0000004280)={{}, {0x1, 0x4}, [{0x2, 0x0, r8}, {0x2, 0x6, r9}], {0x4, 0x4}, [{0x8, 0x6, r10}, {0x8, 0x7, r11}, {0x8, 0x1, r12}, {0x8, 0x0, r13}], {0x10, 0x3}, {0x20, 0x5}}, 0x54, 0x2) rt_tgsigqueueinfo(r14, 0x0, 0x36, &(0x7f0000004340)={0x4, 0x4, 0x6}) 3.04276371s ago: executing program 7 (id=4068): fchdir(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$unix(0x1, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) recvmmsg$unix(0xffffffffffffffff, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000240)=""/74, 0x4a}, {&(0x7f00000002c0)=""/100, 0x64}, {&(0x7f0000000340)=""/92, 0x5c}, {}, {&(0x7f0000000140)=""/27, 0x1b}, {&(0x7f00000003c0)=""/4, 0x4}, {&(0x7f0000000f80)=""/4096, 0x1000}, {&(0x7f0000000440)=""/33, 0x21}, {&(0x7f0000000000)=""/6, 0x6}, {&(0x7f0000000500)=""/66, 0x42}], 0xa, &(0x7f0000000640)=[@cred={{0x18}}, @rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}], 0x68}}], 0x1, 0x0, &(0x7f0000000f40)={0x77359400}) r0 = socket$kcm(0x10, 0x3, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x79, 0x8d, &(0x7f00000000c0)) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000140)}, 0x0) syz_80211_join_ibss(&(0x7f0000000100)='wlan1\x00', &(0x7f0000000180)=@default_ibss_ssid, 0x6, 0x2) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) add_key(&(0x7f0000000400)='id_legacy\x00', 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x28, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000200)) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x3f) r4 = socket$can_bcm(0x1d, 0x2, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x6}, 0x50) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r6 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80", @ANYRES16=r6, @ANYRES32=r6], 0x44}}, 0x2000800) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) 2.923855188s ago: executing program 4 (id=4069): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast1, @dev={0xac, 0x14, 0x14, 0xf}, @multicast1}, 0xc) setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x2, @multicast2=0xe0000001}}, {{0x2, 0x100, @broadcast}}}, 0x104) r1 = syz_usb_connect$cdc_ncm(0x2, 0x7a, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902680002010040000904000001020e0000052406000105240000000d370f0100000000000000000006241a0000000c241b4800f3ff00050080050905810300020000000904010000020d00000904010102020d0000090582020004000000090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000001540)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x20, 0x80, 0x1c, {0x1, 0x9, 0x800ed0, 0x1, 0x17, 0x2865, 0x9, 0xe7, 0x56bf, 0x5, 0x3, 0x81}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, 0x0) 2.198887971s ago: executing program 3 (id=4070): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0xf, {[@main=@item_4={0x3, 0x0, 0xb, "606f47e4"}, @local=@item_4={0x3, 0x2, 0xa, "d5e200"}, @global=@item_4={0x3, 0x1, 0x1, "d63123e9"}]}}, 0x0}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x22020600) r2 = openat$procfs(0xffffff9c, &(0x7f0000000000)='/proc/tty/drivers\x00', 0x0, 0x0) inotify_add_watch(r2, 0x0, 0x20) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfb, {{@in6=@private0, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b}, {0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x6}, {0xfffffffffffffffe}, 0x9, 0x0, 0x0, 0x1, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac"], 0xb8}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000000000000000000000a0040"], 0xb8}}, 0x0) 1.971377371s ago: executing program 6 (id=4071): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000002080)='pagemap\x00') fcntl$lock(r2, 0x5, &(0x7f0000003980)={0x0, 0x1, 0x5, 0xfffffffffff00000}) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f00000001c0)={0x1, 0x8, 0x2, 0xfff, @vifc_lcl_addr=@multicast2, @remote}, 0x10) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000040)={0x0, 0x73, 0x0, 0x5, 0x0, "5ee691000200000017e0054200", 0x1000, 0x4}) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r3, 0x0, r4, 0x0, 0xa, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r6, 0x3a9, 0x3, 0x0, {{}, {@val={0x8, 0x140}, @void}}}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r7, 0x0, 0xc8, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x42, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa8aa8aaaaaabb08004600003400000020fc029006907800fa00094570fff60065b2d30100000000006eebce5a0369dde900"/66], 0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r8, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) 1.812030333s ago: executing program 1 (id=4072): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES8=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x58, 0x10, 0xffffff1f, 0x70bd26, 0x1, {}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TOS={0x5, 0x4, 0x1}, @IFLA_GENEVE_REMOTE6={0x14, 0x7, @private2={0xfc, 0x2, '\x00', 0x1}}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.394495732s ago: executing program 1 (id=4073): sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040000}, 0x8080) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) shmget(0x2, 0x3000, 0x1000, &(0x7f000049b000/0x3000)=nil) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 757.364325ms ago: executing program 1 (id=4074): openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) r0 = socket(0x200000000000011, 0x2, 0xd) r1 = socket(0x200000000000011, 0x2, 0xd) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, r3, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, r4, 0x1, 0x0, 0x6, @multicast}, 0x23) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x3, 0x28, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x6071, 0x0, 0xe7}}}}}}, 0x0) (fail_nth: 1) write(0xffffffffffffffff, 0x0, 0x0) 580.154007ms ago: executing program 6 (id=4075): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x8, 0x4010, 0xffffffffffffffff, 0x9ef43000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000c00)=@file={0x1, './file0\x00'}, 0x6e) getsockname$unix(r2, &(0x7f00000001c0)=@abs, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa15, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r3 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r4, 0x7a0, &(0x7f00000002c0)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r4, 0x7a8, &(0x7f0000000240)={{@host, 0x804}, @any, 0x0, 0x8000000000, 0x0, 0x5d3, 0xffffffffffff7966, 0x0, 0x1}) ioctl$IOCTL_VMCI_VERSION2(r4, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r4, 0x7a4, &(0x7f0000000180)={{@host}, 0xfffffffffffffff8, 0x800000000000002, 0x20007fff}) r5 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000140), 0x21041, 0x0) ioctl$VT_SETMODE(r5, 0x5602, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r3, 0x0, 0x1) fchdir(r6) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000027c00000400fc800c00018006000600894f"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc090) openat$cgroup_ro(r6, &(0x7f0000000000)='devices.list\x00', 0x275a, 0x0) syz_usb_connect(0x6, 0xa98, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fe76b7ffd016d10e4f7a010203010902860a030000000009048706010e01000908240600014f9bab05240001000d240f01b6be0000eb001a0e0f06241a0200150724141400000814241305097d9141d76e6e66ee0426a7ed6ece4607240a0203a12f05240103022624130038886ab42c0bc6231c8ef77b577134f4bccf63ec3845d55710565fbc40d26f81d1eb0905020110008001070904920007ff5d81000905060000040080f22c31f3f2232f83cadc7c25304d33c466a5e0799971e9e99a81f858cf0828849ee9cde26d52a1712efd2c0a737a0e6cd81390bc9db22e4f0563984fb7c595ab65736ee89026a9e41593c4b73a762180b97f06404545ad55708695cb2cccf70b23401553568dcaa1f5332d056901ae850236e83e3ad90eea8412eae7191e478432dc9245b08267cad7e136a6cde95fb4c4e45f4b6953e57148de11cbbcb74a1ca80d6e782841210905040000040597ff6b218ab49fbf0643384ba56c922e0c42993d4ab7258ec7068dbbbed679dc74a4dfa76fdb1fb700b1e3cb531b8825bdaf1081590185917c1a20c96862f3fb0818256f7b9e63e7383fe09dffecbb5f6023f1a6c9703aec72d5462934d9f7dd595472f94dc2f45bb82d501dc20905050200020409068c0f535b65f38ec99a31d0a7adf9b38f876eb654d903dfdb837201b6fc0a76efaa2d3c6b4b9483d55530bc901e41674cc52c7ce84c3614c9e7de957e1876159c866955f33be1f58d960f1c00fb68c8fa94bce0b64400cfe35f378b7754aad560a0ac6e8202779ecbe4d66a0fd7b69371294c8ba8a73a1b5fefa8b91801effdef1fd7aeed3dc4a29911adc73f5b0dd190b9a129598384d6f1a8f61c4f3384fa3e63b0ae8f38d29c38cf787d705321b75c1bb28179330c3838809196971405f48366df561af8858103ade1ff5b2e419c76cb330e2fd95055cb3e283b2c3d399fa38031648fdf0e6b09050a00080012ff0309058010100000070109050a00080040fff85523aca58a414179a19dc2734df9ce0feaf5c6899844116ad68d8f53308ca124777c63c472a83a494abb9cd15fd376f20648758bcc887e56d35cbba7473c020d82663d40d90027010aa02ac6b3c39e37717fef4b170725010006000209058803080009027f07250102051000090432070f5acb30050b24060000aba43c1766f605240080000d240f010300000003000500c5052415090008241c07000306000424020d092103000c01220c0409050e00000409810056108b602bb2ea1565d4716269578e8eb5eed81d6f8ba8216e4c49a3ea6284132797a3bd22ad4d67529d2b6dba581c058a9d4c651f468e275fcbb73ca9d1c629fea13c462ab138570a8b7e8d414c3521cc00ecabf1b30905070c20000988082005cf8a8a6a47bb0db2896ea733aa4acf7ca3480ac0f19c0307105d4d4f01c409050c10200027080a9d06a9242b3a5661c8526e626cd6e9e787a55632133500bbca79fedf38bfb6c5e72a111d1c027726724afa11d0be47a28c2d36cfaa10e9858cdbaa0ca072ac86ebff125c3b81c55165269757feb73ea16b83bf9bf7bd542be6b73cd6cda2177b800e30b8b1d8e437c44a0fdba096f97ca54de28f22e25ecff5d41e7a8f575960214e2aed70497790756cd5286a5ef57f4895abad98886b01c50fe3f3f90725018001040009054a1008009a0208f57fc19e13175172b79cca6b884578b467fb3a38eff1e4aa3b3e1db97ea5a2a5475a25f56422fda3dd0a2f04fff1871f372667131fbb18c023f9632682f2b1031a2e78878c4777e2f9a4dd5686b07590d5828e249f0c4ce204f11b651498b45063a36fdfaf75377412e8a1cbcae314ea8612752f85d5b13024884cceacbc18840a5784e083c1720ab5f7e37252c25883eebd25e2fa8763087bb91585aa9fc521c8c475694fbfd907b06677b5cd916f0d6e2bc4a43bb70030c877fd5d0da35b420fe93dfa1b3d5b79d175297b8ad2a999ccc84c0ed74a9a85b5f8f6a9e67d303c9c35c34c32fe06800e8835398e73d32561037b535a07250100014e0009050e020004010103e82456459558be28edbf2b27a42a3ab6869c50289faee7471f72478f8412798d61ba6a3581bf06b73246c23c8e847633953fd1e58a2c4f27250354be9a95742a28a71daa3053f2e04b43807110714c9bb7f5dfc2bccd9aac8a944c87f2ca7daf1d4734d4a54c5a12ad2a1cd05d6640c289a8edac6116c035e0b52f2f6cd645ca392c9a990837848e8389d785d78eaca07b6ddbdb7fd7d9c1b0de622e5411b8f2db0a6211194d03d9071944ceef95d43d0c7778dc3f23da4f12e2d160d86d34d0cd724257d9e0deade6bd4bd25418b6d27deab0de65454c80496913691fdda8c836e90c0086868cfb0905051b000202407ffb0edb7f993661edc808021cee350cde86314c223c0ce7dd729c88b61f64f2144fce4f23894be6b189825598d86d9eb7bbb9d4ce631c0c5158e84d0d7086eee8c8cb3666b0bdb598bcccebd1999d12b483ae5add9d6a360758ce0873dd055f2e37fed5eecd0a018ae6513e6d47e6554505b1fafbe5d7850f9e8b249d982738d93b28476e5b16b3e2eec320a2a3a5c5c8e841ca413ec78c3a8699661cb0951f9e4e26737657ff7f822ed4220000000065bf1efd502e57317bbd11ef66884dacde1397ca82069256f26145dcfb1a12b9778295e382e4803619d47784e3999f6b5105f93c0226ff13a004de63753256be10595e81e9eebf3df22e98a009050c004000014001af31edb2876fa5da5cfe2caa47a4b4c704429b31701fad47e3696324ce33d2474f13c17526c02641a5cb7352e7b1a676fa30b1158df206edec4d0ede386bb433f00ce4a1399527e83e58d56b8817d5c0a523c79bbcbc7409830cdce71513a066924a3a13df9b2525238cf42f3ff27d04e8dba7a9eaac75e32651f5759ebc5dcc2c37f14cbbb3be7a5e85fc60e0d2f378cadab2f0fbb5673600ffed2be345955876e1419ad29564c8895bf1ca83f59509050e100002ff09a53b070f9e77f0e028b9b38714281fe8c79351b7610194cc0f774daf1227d93be98ccfff41f3c19a0c92840578659b2cf2208f65c38f54112aeb2a0309050400ff03020802072501010905000725018007040009050c0440000706070905030400048d09080725010106070089319f0f6b9055a8922da422ec6059fe109f81b1565cf692dac14370c15d2997d58c9dea2969e1993f2bf30a513260b411257a8e20a5c402bde5c6f27ae73de618c2a9e8dcbea5bb75009b5bf13b70056c9361563454077607ac97bfefe8301075040f9cdd64cc950d85c96e1150f8ee91a067a625367548b77e909a8b2991e73525e02843109d6eb6090500100800fff7102821db795f156321d17decbdd8d236c0c9a7361754c368b88e8c983cb1fb8c95a629b6f4f50f54b4090506101000030603d622c5a663da27401de99fe71d88442679e007e271f2b3d5933eaa83d3ac7b094ccbd70dcee136f07726f418545e07f934bd7c10e81133129a4b093bd5120906a5fa4de7c7eb122567ba04ea5a5a34c7078c4d7ca2aea11d9bb360b43a385f13c08ca8ddb4706a07cf88a58d2514b3a50ba7bc7b7fe6d2f3f2e4108747f3f738aca952ebc668a13ede96055e2efc3e93b8b974f02439ed86e1bd0f1f14bc650a35fd1b02c47cdf7ca2c1285607a92bb63da21cebbdb5fe0eb1ccea09214033f94354610155e1f29995b7b5bf39f6b44c05f22ff36c380725010310ff030905050100000a0101072501010cff010725010057030009050310ff07090702"], 0x0) 176.961712ms ago: executing program 4 (id=4076): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000377a4440ba0d00100900010203010902121001000000000904"], 0x0) r3 = socket(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x89fe, &(0x7f0000000340)={'veth0_to_team\x00', 0x0}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x107842, 0xa) r5 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r5, 0x402, 0x8000001f) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) splice(r1, 0x0, r4, 0x0, 0x33fe0, 0x6) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18010000000000000000000000000000850000007a00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000080)=r6, 0x4) sendmmsg$inet6(r0, &(0x7f0000000580)=[{{&(0x7f00000001c0)={0xa, 0x4e21, 0x0, @local, 0x9}, 0x1c, 0x0, 0x0, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695ec1891223a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d841c351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918"], 0x590}}], 0x1, 0x8008801) sendmmsg$inet6(r0, &(0x7f0000001240)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 175.370399ms ago: executing program 1 (id=4086): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000002080)='pagemap\x00') fcntl$lock(r2, 0x5, &(0x7f0000003980)={0x0, 0x1, 0x5, 0xfffffffffff00000}) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f00000001c0)={0x1, 0x8, 0x2, 0xfff, @vifc_lcl_addr=@multicast2, @remote}, 0x10) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000040)={0x0, 0x73, 0x0, 0x5, 0x0, "5ee691000200000017e0054200", 0x1000, 0x4}) pipe2(&(0x7f0000001440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r3, 0x0, r4, 0x0, 0xa, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SURVEY(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r6, 0x3a9, 0x3, 0x0, {{}, {@val={0x8, 0x140}, @void}}}, 0x1c}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)) r7 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r7, 0x0, 0xc8, 0x0, 0x0) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) setsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x42, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa8aa8aaaaaabb08004600003400000020fc029006907800fa00094570fff60065b2d30100000000006eebce5a0369dde900"/66], 0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r8, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c, @empty=0xe0000300, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) 149.719591ms ago: executing program 7 (id=4077): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_GETVERSION(r0, 0x80047601, &(0x7f0000000040)) syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000fe76181004160780a6af011703010902120001000000000904", @ANYRES8], 0x0) syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100}, &(0x7f0000000180), 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r2 = openat$nullb(0xffffff9c, &(0x7f0000000080), 0x200000, 0x0) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000100)) r3 = syz_open_dev$sndctrl(&(0x7f0000000380), 0x3, 0xbc01) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r3, 0x80dc5521, &(0x7f0000000180)=""/135) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a98000000180a010800000000000000000d00000608000740000000030900010073797a310000000068000380080002400000000418000380140001006e6963766630000000000000000000002c5da04293e9548f74247326940003801400010070696d7265673000000000000000000014000100776730000000000000000000000000000800014000000000080002400000000108000140000000000800074000000001a4000000160a01000000000000000000010000000900010073797a31000000000900020073797a3000000000780003805400038014000100766c616e3100000000000000000000001400010070696d72656700000000000000000000140001007465616d5f736c6176655f3100000000140001007866726d3000000000000000000000000800024000000000180003801400010067656e6576653000000000000000000048000000180a0101000b0000000000000a0000080900020073797a32000000000900010073797a30000000001c000380180003801400010067656e657665300000000000000000001400000010000100"], 0x1ac}}, 0x0) 0s ago: executing program 3 (id=4078): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newsa={0x154, 0x10, 0x1, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, @in=@remote}, {@in=@rand_addr=0x64010100, 0x0, 0x32}, @in6=@mcast1, {0xfffffffffffff821, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, {0x0, 0x0, 0x7e}, {}, 0x0, 0x0, 0x2, 0x2, 0x0, 0xcd}, [@algo_crypt={0x48, 0x2, {{'cbc(aes)\x00'}}}, @replay_esn_val={0x1c, 0x17, {0x0, 0x0, 0x0, 0x0, 0x70bd28, 0x10000000}}]}, 0x154}}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010101, 0x4e23, 0x3, 'lc\x00', 0x8, 0xd48, 0x55}, {@remote, 0x4e27, 0x2000, 0x3, 0x12d5c, 0x12d5c}}, 0x44) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x28, 0x140f, 0x1, 0x800000, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xfffffffffffffdb8, 0x45, 'issm\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4004011}, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="600000000206010200000000000000000000000014000780050014000700000008001240000500000900020073797a3200000000050001000700000011000300686173683a6e65742c6e657400000000050005000a000000050004"], 0x60}}, 0x0) gettid() r5 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f0000000040), 0x4) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r6, 0x29, 0xce, 0x0, &(0x7f00000007c0)=0xffffff78) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, "c8444943470da91b", "42f3ac0e0b8a32be8fe91c368e60693800000000d6e5394b00", "e7198360", "f7a5c1777af05eaa"}, 0x38) sendto$inet6(r5, &(0x7f0000000340)="d1", 0x1, 0x8000, 0x0, 0x0) sendto$inet6(r6, &(0x7f00000001c0)="1b2ee5d6969f2387cb4097532f7c0ae32f", 0x11, 0x4, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, &(0x7f0000000dc0)={0x0, 0x0}) inotify_init1(0x0) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): 0000000000 [ 987.304178][T25067] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 987.304189][T25067] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 987.304200][T25067] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 987.304220][T25067] [ 987.316549][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 987.434489][T25048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 987.590025][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 987.597870][T25052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 987.606793][T25048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 987.628459][T25052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 987.808454][ T2983] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 987.830441][T25048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 987.846230][T25050] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3846'. [ 987.859789][ T5915] usb 5-1: USB disconnect, device number 103 [ 987.886478][T25048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 987.895157][T25052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 987.918933][T25052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 987.932221][T25048] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 987.983942][T25052] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 987.996766][T25048] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 988.008199][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 988.015286][ T5898] usb 2-1: found format II with max.bitrate = 26774, frame size=2 [ 988.031563][ T5898] usb 2-1: found format II with max.bitrate = 26774, frame size=2 [ 988.063329][T25075] bridge0: port 3(syz_tun) entered blocking state [ 988.072319][T25075] bridge0: port 3(syz_tun) entered disabled state [ 988.080781][ T5898] usb 2-1: failed to enable PITCH for EP 0x82 [ 988.094876][T25075] syz_tun: entered allmulticast mode [ 988.100966][T25052] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 988.115813][T25075] syz_tun: entered promiscuous mode [ 988.139431][T25075] bridge0: port 3(syz_tun) entered blocking state [ 988.146146][T25075] bridge0: port 3(syz_tun) entered forwarding state [ 988.156421][ T5898] usb 2-1: USB disconnect, device number 68 [ 988.206670][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 988.218933][T24147] udevd[24147]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 988.241725][ T1072] usb 7-1: found format II with max.bitrate = 26774, frame size=2 [ 988.251695][T25075] netlink: 80 bytes leftover after parsing attributes in process `syz.7.3855'. [ 988.260255][ T1072] usb 7-1: found format II with max.bitrate = 26774, frame size=2 [ 988.276475][ T1072] usb 7-1: failed to enable PITCH for EP 0x82 [ 988.485525][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 988.525572][T25075] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 988.561342][ T1072] usb 7-1: USB disconnect, device number 40 [ 988.616104][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 988.714147][T24766] udevd[24766]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 988.766568][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 989.036034][T25093] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3856'. [ 989.120157][ T5898] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 989.129289][T25094] netlink: 'syz.3.3857': attribute type 10 has an invalid length. [ 989.227942][T25094] bond0: (slave netdevsim0): Releasing backup interface [ 989.293411][T25094] team0: Port device netdevsim0 added [ 989.303924][T25099] netlink: 'syz.3.3857': attribute type 10 has an invalid length. [ 989.352908][ T5898] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 989.363245][ T5898] usb 2-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 989.373826][ T5898] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 989.390217][T25099] team0: Port device netdevsim0 removed [ 989.405284][T25099] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 989.460726][ T5898] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 989.496013][ T1072] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 989.656107][ T1072] usb 7-1: Using ep0 maxpacket: 32 [ 989.663794][ T1072] usb 7-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 989.673380][ T1072] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 989.688550][ T1072] usb 7-1: config 0 descriptor?? [ 989.695603][ T5898] usb 2-1: USB disconnect, device number 69 [ 990.113773][ T1072] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 990.309350][T25108] syz_tun: entered allmulticast mode [ 990.578854][ T1072] gspca_nw80x: reg_r err -32 [ 990.583669][ T1072] nw80x 7-1:0.0: probe with driver nw80x failed with error -32 [ 990.771666][T25114] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3866'. [ 990.911439][T25116] FAULT_INJECTION: forcing a failure. [ 990.911439][T25116] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 990.998760][T25105] syz_tun: left allmulticast mode [ 991.006860][T25116] CPU: 1 UID: 0 PID: 25116 Comm: syz.1.3867 Not tainted syzkaller #0 PREEMPT(full) [ 991.006883][T25116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 991.006894][T25116] Call Trace: [ 991.006902][T25116] [ 991.006910][T25116] dump_stack_lvl+0x189/0x250 [ 991.006933][T25116] ? __pfx____ratelimit+0x10/0x10 [ 991.006957][T25116] ? __pfx_dump_stack_lvl+0x10/0x10 [ 991.006977][T25116] ? __pfx__printk+0x10/0x10 [ 991.007008][T25116] should_fail_ex+0x414/0x560 [ 991.007031][T25116] _copy_to_user+0x31/0xb0 [ 991.007056][T25116] simple_read_from_buffer+0xe1/0x170 [ 991.007080][T25116] proc_fail_nth_read+0x1b3/0x220 [ 991.007101][T25116] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 991.007121][T25116] ? rw_verify_area+0x2a6/0x4d0 [ 991.007139][T25116] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 991.007157][T25116] vfs_read+0x200/0xa30 [ 991.007184][T25116] ? __pfx_vfs_read+0x10/0x10 [ 991.007199][T25116] ? count_memcg_event_mm+0x21/0x260 [ 991.007222][T25116] ? __pfx_do_splice+0x10/0x10 [ 991.007241][T25116] ? count_memcg_event_mm+0x21/0x260 [ 991.007257][T25116] ? count_memcg_event_mm+0x21/0x260 [ 991.007285][T25116] ksys_read+0x145/0x250 [ 991.007306][T25116] ? __pfx_ksys_read+0x10/0x10 [ 991.007334][T25116] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 991.007360][T25116] ? lockdep_hardirqs_on+0x9c/0x150 [ 991.007386][T25116] __do_fast_syscall_32+0xb6/0x2b0 [ 991.007410][T25116] ? lockdep_hardirqs_on+0x9c/0x150 [ 991.007436][T25116] do_fast_syscall_32+0x34/0x80 [ 991.007459][T25116] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 991.007478][T25116] RIP: 0023:0xf7fe7539 [ 991.007493][T25116] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 991.007507][T25116] RSP: 002b:00000000f54d6590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 991.007525][T25116] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f54d6620 [ 991.007538][T25116] RDX: 000000000000000f RSI: 00000000f7475ff4 RDI: 0000000000000000 [ 991.007549][T25116] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 991.007559][T25116] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 991.007570][T25116] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 991.007594][T25116] [ 991.756825][ T5898] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 992.160435][ T2940] net_ratelimit: 22 callbacks suppressed [ 992.160457][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 992.166697][ T5898] usb 5-1: Using ep0 maxpacket: 8 [ 992.279832][T25133] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3870'. [ 992.337159][ T5832] usb 7-1: USB disconnect, device number 41 [ 992.388789][ T5898] usb 5-1: config 2 has an invalid interface number: 31 but max is 0 [ 992.397268][ T5898] usb 5-1: config 2 has no interface number 0 [ 992.413847][ T5898] usb 5-1: config 2 interface 31 has no altsetting 0 [ 992.453098][ T5898] usb 5-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 992.468619][ T5898] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 992.678588][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 992.706260][T25135] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3871'. [ 992.716400][ T5898] usb 5-1: Product: syz [ 992.728509][ T5898] usb 5-1: Manufacturer: syz [ 992.738619][ T5898] usb 5-1: SerialNumber: syz [ 992.836048][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 992.929792][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.936351][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.946075][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 992.975199][ T5898] ch9200 5-1:2.31: probe with driver ch9200 failed with error -71 [ 993.010251][ T5898] usb 5-1: USB disconnect, device number 104 [ 993.076147][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 993.196663][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 993.326677][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 993.410579][ T980] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 993.457764][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 993.579447][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 993.580321][ T980] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 993.644263][ T5898] usb 8-1: new high-speed USB device number 56 using dummy_hcd [ 993.652298][ T1072] usb 7-1: new full-speed USB device number 42 using dummy_hcd [ 993.675984][ T980] usb 2-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 993.696937][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 993.714870][ T980] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 993.752479][ T980] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 993.780327][ T980] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 993.813974][ T980] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 993.830403][ T1072] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 993.838853][ T5898] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 993.841301][ T1072] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 993.851372][ T5898] usb 8-1: New USB device found, idVendor=050d, idProduct=011b, bcdDevice=6f.a4 [ 993.869194][ T1072] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 26984, setting to 64 [ 993.935650][T25167] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3881'. [ 994.192158][ T1072] usb 7-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 994.197243][ T5898] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 994.223342][ T1072] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 994.248973][ T980] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 994.252706][T25157] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 994.273592][ T980] usb 2-1: USB disconnect, device number 70 [ 994.282548][ T5898] usb 8-1: config 0 descriptor?? [ 994.295032][ T1072] hub 7-1:1.0: bad descriptor, ignoring hub [ 994.327444][ T1072] hub 7-1:1.0: probe with driver hub failed with error -5 [ 994.353495][ T1072] cdc_wdm 7-1:1.0: skipping garbage [ 994.377993][ T1072] cdc_wdm 7-1:1.0: skipping garbage [ 994.379309][ T5898] rndis_host 8-1:0.0: probe with driver rndis_host failed with error -22 [ 994.453759][ T1072] cdc_wdm 7-1:1.0: cdc-wdm0: USB WDM device [ 994.476940][ C0] wdm_int_callback: 25 callbacks suppressed [ 994.476955][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.489413][ C0] wdm_int_callback: 25 callbacks suppressed [ 994.489426][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.501621][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.508219][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.514458][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.521054][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.527937][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.534546][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.541230][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.547835][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.554114][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.560692][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.567019][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.573619][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.579897][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.586495][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.592723][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.599300][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.605521][ C0] cdc_wdm 7-1:1.0: nonzero urb status received: -71 [ 994.612095][ C0] cdc_wdm 7-1:1.0: wdm_int_callback - 0 bytes [ 994.622050][ T1072] cdc_wdm 7-1:1.0: Unknown control protocol [ 994.756094][ T5898] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 995.496078][T25172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 995.516753][T25172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 995.596047][ T5898] usb 4-1: Using ep0 maxpacket: 32 [ 995.602935][ T5898] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 995.612270][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 995.775643][ T5898] usb 4-1: config 0 descriptor?? [ 995.788668][ T5898] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 996.322777][ T5842] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 996.336134][ T5842] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 996.345943][ T5842] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 996.355364][ T5842] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 996.364749][ T5842] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 996.439343][ T980] usb 7-1: USB disconnect, device number 42 [ 996.604631][ T5898] gspca_nw80x: reg_r err -32 [ 996.611886][ T5898] nw80x 4-1:0.0: probe with driver nw80x failed with error -32 [ 996.686263][T25176] chnl_net:caif_netlink_parms(): no params data found [ 996.851949][T25176] bridge0: port 1(bridge_slave_0) entered blocking state [ 996.872508][T25176] bridge0: port 1(bridge_slave_0) entered disabled state [ 996.881731][T25176] bridge_slave_0: entered allmulticast mode [ 996.891201][T25176] bridge_slave_0: entered promiscuous mode [ 996.911162][T25176] bridge0: port 2(bridge_slave_1) entered blocking state [ 996.918657][T25176] bridge0: port 2(bridge_slave_1) entered disabled state [ 996.926352][T25176] bridge_slave_1: entered allmulticast mode [ 996.933627][T25176] bridge_slave_1: entered promiscuous mode [ 997.190285][ T980] usb 8-1: USB disconnect, device number 56 [ 997.197656][ T1167] net_ratelimit: 18 callbacks suppressed [ 997.197674][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 997.602892][T25200] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3885'. [ 997.647890][ T1072] usb 4-1: USB disconnect, device number 72 [ 998.448766][ T5151] Bluetooth: hci1: command tx timeout [ 998.533860][T25210] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3888'. [ 998.581781][T25176] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 998.629698][T10061] tipc: Disabling bearer [ 998.652893][T10061] tipc: Left network mode [ 998.668146][T25176] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 998.810673][T25215] FAULT_INJECTION: forcing a failure. [ 998.810673][T25215] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 998.886022][T25215] CPU: 0 UID: 0 PID: 25215 Comm: syz.4.3889 Not tainted syzkaller #0 PREEMPT(full) [ 998.886069][T25215] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 998.886093][T25215] Call Trace: [ 998.886109][T25215] [ 998.886126][T25215] dump_stack_lvl+0x189/0x250 [ 998.886172][T25215] ? __pfx____ratelimit+0x10/0x10 [ 998.886223][T25215] ? __pfx_dump_stack_lvl+0x10/0x10 [ 998.886267][T25215] ? __pfx__printk+0x10/0x10 [ 998.886309][T25215] ? __might_fault+0xb0/0x130 [ 998.886359][T25215] should_fail_ex+0x414/0x560 [ 998.886382][T25215] _copy_from_user+0x2d/0xb0 [ 998.886407][T25215] get_compat_msghdr+0xad/0x4a0 [ 998.886434][T25215] ? __pfx_get_compat_msghdr+0x10/0x10 [ 998.886466][T25215] ___sys_sendmsg+0x193/0x2a0 [ 998.886490][T25215] ? __pfx____sys_sendmsg+0x10/0x10 [ 998.886545][T25215] ? __fget_files+0x2a/0x420 [ 998.886566][T25215] ? __fget_files+0x3a0/0x420 [ 998.886604][T25215] __sys_sendmsg+0x164/0x220 [ 998.886627][T25215] ? __pfx___sys_sendmsg+0x10/0x10 [ 998.886656][T25215] ? __pfx_ksys_write+0x10/0x10 [ 998.886679][T25215] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 998.886706][T25215] ? lockdep_hardirqs_on+0x9c/0x150 [ 998.886733][T25215] __do_fast_syscall_32+0xb6/0x2b0 [ 998.886758][T25215] ? lockdep_hardirqs_on+0x9c/0x150 [ 998.886786][T25215] do_fast_syscall_32+0x34/0x80 [ 998.886810][T25215] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 998.886831][T25215] RIP: 0023:0xf7f36539 [ 998.886847][T25215] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 998.886862][T25215] RSP: 002b:00000000f542655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 998.886882][T25215] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000100 [ 998.886894][T25215] RDX: 0000000000000084 RSI: 0000000000000000 RDI: 0000000000000000 [ 998.886906][T25215] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 998.886917][T25215] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 998.886928][T25215] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 998.886956][T25215] [ 999.359625][T25176] team0: Port device team_slave_0 added [ 999.372835][T25176] team0: Port device team_slave_1 added [ 999.519731][T25176] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 999.535180][T25235] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3894'. [ 999.565161][ T5898] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 999.597934][T25176] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 999.721273][T25176] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 999.808677][ T5898] usb 4-1: unable to get BOS descriptor or descriptor too short [ 999.830893][ T5898] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 999.847955][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 999.870140][T25176] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 999.922191][ T5898] usb 4-1: config 1 has no interface number 1 [ 999.940855][ T5898] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 999.958278][T25176] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1000.007308][T25176] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1000.094036][ T5898] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1000.128618][T25176] hsr_slave_0: entered promiscuous mode [ 1000.136279][ T5898] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1000.139987][T25176] hsr_slave_1: entered promiscuous mode [ 1000.153490][T25176] debugfs: 'hsr0' already exists in 'hsr' [ 1000.379795][ T5898] usb 4-1: Product: syz [ 1000.384041][ T5898] usb 4-1: Manufacturer: syz [ 1000.388752][ T5898] usb 4-1: SerialNumber: syz [ 1000.389589][T25176] Cannot create hsr debugfs directory [ 1000.469276][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1000.526621][ T5151] Bluetooth: hci1: command tx timeout [ 1000.610030][T25223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.625707][T25223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.670014][T25223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.687562][T25223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.746149][T10061] hsr_slave_0: left promiscuous mode [ 1000.750298][T25223] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1000.777183][T10061] hsr_slave_1: left promiscuous mode [ 1000.783624][T25223] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1000.790493][T10061] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1000.818301][T10061] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1000.841015][ T5898] usb 4-1: found format II with max.bitrate = 26774, frame size=2 [ 1000.855124][ T5898] usb 4-1: found format II with max.bitrate = 26774, frame size=2 [ 1000.869625][ T5898] usb 4-1: failed to enable PITCH for EP 0x82 [ 1000.952236][ T5898] usb 4-1: USB disconnect, device number 73 [ 1001.888217][T10061] team0 (unregistering): Port device team_slave_1 removed [ 1001.944084][ T5915] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1002.024292][T10061] team0 (unregistering): Port device team_slave_0 removed [ 1002.113011][ T5915] usb 4-1: Using ep0 maxpacket: 32 [ 1002.120874][ T5915] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1002.130354][ T5915] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1002.151826][ T5915] usb 4-1: config 0 descriptor?? [ 1002.175347][ T5915] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1002.606132][ T5151] Bluetooth: hci1: command tx timeout [ 1002.684786][T25260] loop7: detected capacity change from 0 to 16384 [ 1002.750763][T25260] loop7: detected capacity change from 16384 to 16297 [ 1002.947996][T25264] netlink: 80 bytes leftover after parsing attributes in process `syz.7.3900'. [ 1002.999209][ T5915] gspca_nw80x: reg_r err -32 [ 1003.006124][ T5915] nw80x 4-1:0.0: probe with driver nw80x failed with error -32 [ 1003.076531][T25265] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 1003.468635][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1003.605985][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1003.676940][T25277] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3901'. [ 1004.094309][T25269] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3902'. [ 1004.225980][ T5898] usb 5-1: new full-speed USB device number 105 using dummy_hcd [ 1004.233723][ T24] usb 8-1: new high-speed USB device number 57 using dummy_hcd [ 1004.356682][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1004.392521][ T5898] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 1004.401027][ T24] usb 8-1: Using ep0 maxpacket: 16 [ 1004.415257][ T5898] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1004.426976][ T24] usb 8-1: config index 0 descriptor too short (expected 65, got 36) [ 1004.443477][ T24] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1004.465068][ T5898] usb 5-1: config 0 has no interface number 0 [ 1004.481643][ T24] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1004.504955][ T5898] usb 5-1: New USB device found, idVendor=046c, idProduct=14e8, bcdDevice= b.28 [ 1004.526420][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1004.544427][ T5898] usb 5-1: New USB device strings: Mfr=5, Product=2, SerialNumber=3 [ 1004.562899][ T24] usb 8-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 1004.573202][ T5898] usb 5-1: Product: syz [ 1004.577738][ T5898] usb 5-1: Manufacturer: syz [ 1004.582419][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1004.595461][ T5898] usb 5-1: SerialNumber: syz [ 1004.635397][ T24] usb 8-1: config 0 descriptor?? [ 1004.706180][ T5151] Bluetooth: hci1: command tx timeout [ 1004.708525][ T5898] usb 5-1: config 0 descriptor?? [ 1004.834674][ T5915] usb 4-1: USB disconnect, device number 74 [ 1005.012396][ T24] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/input/input38 [ 1005.033464][ T5898] uvcvideo 5-1:0.105: Found UVC 0.00 device syz (046c:14e8) [ 1005.044891][ T5898] uvcvideo 5-1:0.105: Entity type for entity Output 1 was not initialized! [ 1005.055984][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1005.084582][ T5898] uvcvideo 5-1:0.105: Failed to create links for entity 1 [ 1005.115837][ T5898] uvcvideo 5-1:0.105: Failed to register entities (-22). [ 1005.241328][T25292] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3904'. [ 1005.314741][ T5898] usb 5-1: USB disconnect, device number 105 [ 1005.567203][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1005.705530][ T24] usb 8-1: USB disconnect, device number 57 [ 1005.808312][ T2967] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1005.828338][T25299] netlink: 'syz.1.3905': attribute type 10 has an invalid length. [ 1005.896436][T25300] netlink: 'syz.1.3905': attribute type 10 has an invalid length. [ 1006.104189][T25299] bond0: (slave netdevsim0): Releasing backup interface [ 1006.266616][T25299] team0: Port device netdevsim0 added [ 1006.583577][ T5832] usb 8-1: new high-speed USB device number 58 using dummy_hcd [ 1006.739472][T25300] team0: Port device netdevsim0 removed [ 1006.768261][T25300] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1006.819631][ T5832] usb 8-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1006.856007][ T5832] usb 8-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1006.879521][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1006.905930][ T5832] usb 8-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1007.011603][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1007.035945][ T5832] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1007.056326][ T5832] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1007.093101][ T5832] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 1007.108116][T25176] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1007.163170][T25176] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1007.214583][T25176] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1007.258520][ T5832] snd-usb-audio 8-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1007.354138][T25176] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1007.387898][T25321] PKCS7: Unknown OID: [4] 5.25.264.112.81.102.117.87.150326315.2007.15776.1 [ 1007.408548][ T5832] usb 8-1: USB disconnect, device number 58 [ 1007.477299][T25321] PKCS7: Only support pkcs7_signedData type [ 1007.685638][T25176] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1007.778659][T25176] 8021q: adding VLAN 0 to HW filter on device team0 [ 1007.823432][ T1167] bridge0: port 1(bridge_slave_0) entered blocking state [ 1007.830668][ T1167] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1007.917248][ T2967] bridge0: port 2(bridge_slave_1) entered blocking state [ 1007.924417][ T2967] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1008.086429][ T2967] net_ratelimit: 4 callbacks suppressed [ 1008.086449][ T2967] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1008.232371][T25176] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1008.321041][T25347] netlink: 80 bytes leftover after parsing attributes in process `syz.7.3912'. [ 1008.340556][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1008.394204][T25349] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 1008.511517][T25176] veth0_vlan: entered promiscuous mode [ 1008.557349][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1008.793870][T25176] veth1_vlan: entered promiscuous mode [ 1008.913960][T25176] veth0_macvtap: entered promiscuous mode [ 1008.946327][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1008.960667][T25176] veth1_macvtap: entered promiscuous mode [ 1009.026176][ T5915] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 1009.046751][T25176] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1009.074035][T25176] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1009.087617][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1009.106344][ T5832] usb 8-1: new high-speed USB device number 59 using dummy_hcd [ 1009.119762][ T1167] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.129472][ T1167] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.148749][ T1167] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.164794][ T1167] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1009.176767][ T5915] usb 5-1: Using ep0 maxpacket: 32 [ 1009.216708][ T5915] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1009.233587][ T5915] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1009.247934][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1009.257183][ T5915] usb 5-1: config 0 descriptor?? [ 1009.268128][ T5832] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1009.282816][ T5832] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1009.301409][ T5915] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1009.302102][ T5832] usb 8-1: config 1 has no interface number 1 [ 1009.336985][ T5832] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1009.354284][T22032] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1009.372490][T22032] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1009.376064][ T1072] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 1009.382820][ T5832] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1009.405600][ T5832] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1009.436345][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1009.447814][ T5832] usb 8-1: Product: syz [ 1009.465173][ T5832] usb 8-1: Manufacturer: syz [ 1009.481147][ T5832] usb 8-1: SerialNumber: syz [ 1009.500981][T22032] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1009.519090][T22032] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1009.554211][ T1072] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1009.587173][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1009.595678][ T1072] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1009.618038][ T1072] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1009.636825][ T1072] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1009.647559][ T1072] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1009.683476][ T1072] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1009.701890][ T1072] usb 2-1: invalid MIDI out EP 0 [ 1009.726384][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1009.736094][T25356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1009.748053][T25356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1009.773347][T25356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1009.801477][T25356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1009.822382][T25356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1009.834990][T25356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1010.033006][ T1072] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1010.064423][ T5832] usb 8-1: found format II with max.bitrate = 26774, frame size=2 [ 1010.092538][ T1072] usb 2-1: USB disconnect, device number 71 [ 1010.095964][ T5898] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1010.134170][ T5915] gspca_nw80x: reg_r err -32 [ 1010.134894][ T5832] usb 8-1: found format II with max.bitrate = 26774, frame size=2 [ 1010.146607][ T5915] nw80x 5-1:0.0: probe with driver nw80x failed with error -32 [ 1010.159312][ T5832] usb 8-1: failed to enable PITCH for EP 0x82 [ 1010.271098][ T5832] usb 8-1: USB disconnect, device number 59 [ 1010.374633][ T5898] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1010.441445][ T5898] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1010.490912][ T5898] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1010.535593][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1010.552623][ T5898] usb 4-1: SerialNumber: syz [ 1010.564063][T24147] udevd[24147]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1010.892706][ T5898] usb 4-1: 0:2 : does not exist [ 1010.942917][ T5898] usb 4-1: unit 16 not found! [ 1010.999241][ T5898] usb 4-1: USB disconnect, device number 75 [ 1011.501427][T25402] netlink: 44 bytes leftover after parsing attributes in process `syz.6.3919'. [ 1011.535706][T25402] bridge0: port 2(bridge_slave_1) entered disabled state [ 1011.542996][T25402] bridge0: port 1(bridge_slave_0) entered disabled state [ 1011.578899][ T5915] usb 5-1: USB disconnect, device number 106 [ 1011.708962][T25405] loop7: detected capacity change from 0 to 16384 [ 1011.776391][T25405] loop7: detected capacity change from 16384 to 16297 [ 1012.165992][ T5915] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 1012.301602][T25416] FAULT_INJECTION: forcing a failure. [ 1012.301602][T25416] name failslab, interval 1, probability 0, space 0, times 0 [ 1012.333844][ T5915] usb 5-1: too many configurations: 9, using maximum allowed: 8 [ 1012.344723][T25416] CPU: 1 UID: 0 PID: 25416 Comm: syz.3.3923 Not tainted syzkaller #0 PREEMPT(full) [ 1012.344748][T25416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1012.344760][T25416] Call Trace: [ 1012.344768][T25416] [ 1012.344777][T25416] dump_stack_lvl+0x189/0x250 [ 1012.344801][T25416] ? __pfx____ratelimit+0x10/0x10 [ 1012.344826][T25416] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1012.344845][T25416] ? __pfx__printk+0x10/0x10 [ 1012.344871][T25416] ? __pfx___might_resched+0x10/0x10 [ 1012.344899][T25416] should_fail_ex+0x414/0x560 [ 1012.344923][T25416] should_failslab+0xa8/0x100 [ 1012.344948][T25416] __kmalloc_noprof+0xcb/0x7f0 [ 1012.344966][T25416] ? kfree+0x4d/0x6d0 [ 1012.344979][T25416] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1012.345006][T25416] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1012.345028][T25416] ? tomoyo_domain+0xd9/0x130 [ 1012.345054][T25416] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1012.345081][T25416] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1012.345110][T25416] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1012.345152][T25416] ? __lock_acquire+0xab9/0xd20 [ 1012.345194][T25416] ? __fget_files+0x2a/0x420 [ 1012.345221][T25416] ? __fget_files+0x3a0/0x420 [ 1012.345241][T25416] ? __fget_files+0x2a/0x420 [ 1012.345266][T25416] security_file_ioctl_compat+0xcb/0x2d0 [ 1012.345295][T25416] __ia32_compat_sys_ioctl+0x128/0x840 [ 1012.345317][T25416] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1012.345336][T25416] ? __fget_files+0x3a0/0x420 [ 1012.345365][T25416] ? fput+0xa0/0xd0 [ 1012.345396][T25416] ? ksys_write+0x22a/0x250 [ 1012.345414][T25416] ? exc_page_fault+0x82/0x100 [ 1012.345437][T25416] ? __pfx_ksys_write+0x10/0x10 [ 1012.345460][T25416] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1012.345485][T25416] ? lockdep_hardirqs_on+0x9c/0x150 [ 1012.345512][T25416] __do_fast_syscall_32+0xb6/0x2b0 [ 1012.345538][T25416] ? lockdep_hardirqs_on+0x9c/0x150 [ 1012.345565][T25416] do_fast_syscall_32+0x34/0x80 [ 1012.345590][T25416] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1012.345611][T25416] RIP: 0023:0xf703d539 [ 1012.345628][T25416] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1012.345642][T25416] RSP: 002b:00000000f542d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1012.345662][T25416] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000008922 [ 1012.345675][T25416] RDX: 0000000080000740 RSI: 0000000000000000 RDI: 0000000000000000 [ 1012.345686][T25416] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1012.345697][T25416] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1012.345708][T25416] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1012.345737][T25416] [ 1012.345746][T25416] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1012.367382][ T5915] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1012.653265][ T5915] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1012.666998][ T5915] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1012.674942][ T5915] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1012.694995][ T5915] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1012.736150][ T5915] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1012.750465][ T5915] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1012.763736][ T5915] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1012.779424][ T5915] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1012.789637][ T5915] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1012.806247][ T5915] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1012.827660][ T5915] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1012.846862][ T5915] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1012.876026][ T5915] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1012.905957][ T5915] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1013.034325][ T5915] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1013.058794][T25434] netlink: 'syz.3.3927': attribute type 10 has an invalid length. [ 1013.109117][T25436] netlink: 'syz.3.3927': attribute type 10 has an invalid length. [ 1013.126078][ T5915] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1013.139786][T25434] bond0: (slave netdevsim0): Releasing backup interface [ 1013.166179][ T5915] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1013.183325][ T5915] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1013.206522][ T5915] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1013.227558][ T5915] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1013.236445][T25434] team0: Port device netdevsim0 added [ 1013.245984][ T5915] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1013.255024][ T5915] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 1013.317552][T25436] team0: Port device netdevsim0 removed [ 1013.342176][T25436] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1013.352765][ T5915] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1013.366999][ T2940] net_ratelimit: 25 callbacks suppressed [ 1013.367018][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1013.377815][ T5915] usb 5-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1013.396040][ T5915] usb 5-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1013.425959][ T5915] usb 5-1: Product: syz [ 1013.435071][ T5915] usb 5-1: Manufacturer: syz [ 1013.457013][ T5915] usb 5-1: SerialNumber: syz [ 1013.482766][ T5915] usb 5-1: config 0 descriptor?? [ 1013.496565][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1013.506389][ T5898] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 1013.516234][ T5915] yurex 5-1:0.0: USB YUREX device now attached to Yurex #0 [ 1013.616132][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1013.670246][ T5898] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1013.812887][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1013.975214][ T5898] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1013.996079][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1014.021241][ T5898] usb 7-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1014.071672][ T5898] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1014.110856][ T5898] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1014.115979][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1014.142588][T14114] usb 5-1: USB disconnect, device number 107 [ 1014.150223][ T5898] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1014.158439][T14114] yurex 5-1:0.0: USB YUREX #0 now disconnected [ 1014.185134][ T5898] usb 7-1: invalid MIDI out EP 0 [ 1014.256096][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1014.275237][T25444] FAULT_INJECTION: forcing a failure. [ 1014.275237][T25444] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1014.308655][T25444] CPU: 0 UID: 0 PID: 25444 Comm: syz.7.3930 Not tainted syzkaller #0 PREEMPT(full) [ 1014.308680][T25444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1014.308691][T25444] Call Trace: [ 1014.308699][T25444] [ 1014.308707][T25444] dump_stack_lvl+0x189/0x250 [ 1014.308731][T25444] ? __pfx____ratelimit+0x10/0x10 [ 1014.308756][T25444] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1014.308775][T25444] ? __pfx__printk+0x10/0x10 [ 1014.308794][T25444] ? __might_fault+0xb0/0x130 [ 1014.308823][T25444] should_fail_ex+0x414/0x560 [ 1014.308846][T25444] _copy_from_user+0x2d/0xb0 [ 1014.308870][T25444] get_compat_msghdr+0xad/0x4a0 [ 1014.308897][T25444] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1014.308928][T25444] ___sys_sendmsg+0x193/0x2a0 [ 1014.308951][T25444] ? __pfx____sys_sendmsg+0x10/0x10 [ 1014.309003][T25444] ? __fget_files+0x2a/0x420 [ 1014.309024][T25444] ? __fget_files+0x3a0/0x420 [ 1014.309056][T25444] __sys_sendmsg+0x164/0x220 [ 1014.309077][T25444] ? __pfx___sys_sendmsg+0x10/0x10 [ 1014.309106][T25444] ? __pfx_ksys_write+0x10/0x10 [ 1014.309128][T25444] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1014.309153][T25444] ? lockdep_hardirqs_on+0x9c/0x150 [ 1014.309179][T25444] __do_fast_syscall_32+0xb6/0x2b0 [ 1014.309204][T25444] ? lockdep_hardirqs_on+0x9c/0x150 [ 1014.309236][T25444] do_fast_syscall_32+0x34/0x80 [ 1014.309262][T25444] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1014.309282][T25444] RIP: 0023:0xf70cd539 [ 1014.309298][T25444] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1014.309313][T25444] RSP: 002b:00000000f54bd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1014.309332][T25444] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 1014.309342][T25444] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1014.309352][T25444] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1014.309361][T25444] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1014.309371][T25444] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1014.309397][T25444] [ 1014.337831][ T5898] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1014.425561][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1014.579082][ T5898] usb 7-1: USB disconnect, device number 43 [ 1014.616783][ T5907] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1014.669464][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1014.748508][T25450] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3932'. [ 1014.776479][ T5907] usb 4-1: Using ep0 maxpacket: 32 [ 1014.808056][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1014.841867][ T5907] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1014.975697][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1014.991210][ T5907] usb 4-1: config 0 descriptor?? [ 1015.058761][ T5907] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1015.185385][T25459] netlink: 'syz.4.3934': attribute type 10 has an invalid length. [ 1015.207314][T25459] bond0: (slave netdevsim0): Releasing backup interface [ 1015.236025][T25459] team0: Port device netdevsim0 added [ 1015.253262][T25460] netlink: 'syz.4.3934': attribute type 10 has an invalid length. [ 1015.270815][T25460] team0: Port device netdevsim0 removed [ 1015.285688][T25460] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1015.696053][ T5898] usb 7-1: new low-speed USB device number 44 using dummy_hcd [ 1015.913019][ T5907] gspca_nw80x: reg_r err -32 [ 1015.918143][ T5907] nw80x 4-1:0.0: probe with driver nw80x failed with error -32 [ 1015.937995][ T5898] usb 7-1: no configurations [ 1015.942600][ T5898] usb 7-1: can't read configurations, error -22 [ 1016.148267][ T5898] usb 7-1: new low-speed USB device number 45 using dummy_hcd [ 1016.316785][ T5898] usb 7-1: no configurations [ 1016.321655][ T5898] usb 7-1: can't read configurations, error -22 [ 1016.330434][ T5898] usb usb7-port1: attempt power cycle [ 1016.354613][T25475] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3938'. [ 1016.686340][ T5898] usb 7-1: new low-speed USB device number 46 using dummy_hcd [ 1016.707522][ T5898] usb 7-1: no configurations [ 1016.712253][ T5898] usb 7-1: can't read configurations, error -22 [ 1016.751998][ T5907] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 1016.846182][ T5898] usb 7-1: new low-speed USB device number 47 using dummy_hcd [ 1016.878991][ T5898] usb 7-1: no configurations [ 1016.883712][ T5898] usb 7-1: can't read configurations, error -22 [ 1016.890438][ T5898] usb usb7-port1: unable to enumerate USB device [ 1016.918632][ T5907] usb 5-1: Using ep0 maxpacket: 16 [ 1016.937821][ T5907] usb 5-1: config index 0 descriptor too short (expected 65, got 36) [ 1016.947892][ T5907] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1016.959344][ T5907] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1016.992188][ T5907] usb 5-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 1017.019366][ T5907] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.054659][ T5907] usb 5-1: config 0 descriptor?? [ 1017.400002][ T5907] input: PXRC Flight Controller Adapter as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input39 [ 1017.424377][ T24] usb 4-1: USB disconnect, device number 76 [ 1017.623815][T25490] sctp: [Deprecated]: syz.1.3943 (pid 25490) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1017.623815][T25490] Use struct sctp_sack_info instead [ 1017.643056][T25490] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3943'. [ 1017.766019][ T5907] usb 8-1: new high-speed USB device number 60 using dummy_hcd [ 1017.926043][ T24] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 1017.926091][ T5907] usb 8-1: Using ep0 maxpacket: 32 [ 1017.940258][ T5907] usb 8-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1017.943795][ T5832] usb 5-1: USB disconnect, device number 108 [ 1017.962172][ T5907] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1017.979562][T14114] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 1018.004006][ T5907] usb 8-1: config 0 descriptor?? [ 1018.021845][ T5907] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1018.087698][ T24] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1018.100048][ T24] usb 4-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1018.113814][ T24] usb 4-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1018.127293][ T24] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1018.136633][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1018.148110][T14114] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1018.159688][ T24] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1018.172951][T14114] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1018.233967][T14114] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1018.251537][T14114] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1018.274120][T14114] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1018.312024][ T24] snd-usb-audio 4-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1018.312668][T14114] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1018.444017][T14114] usb 2-1: invalid MIDI out EP 0 [ 1018.459646][ T1167] net_ratelimit: 25 callbacks suppressed [ 1018.459664][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1018.497811][ T5832] usb 4-1: USB disconnect, device number 77 [ 1018.596733][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1018.707849][T14114] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1018.728691][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1018.744971][T14114] usb 2-1: USB disconnect, device number 72 [ 1018.846411][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1018.856192][ T24] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 1018.875727][ T5907] gspca_nw80x: reg_r err -32 [ 1018.880513][ T5907] nw80x 8-1:0.0: probe with driver nw80x failed with error -32 [ 1018.980681][ T2967] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1019.036001][ T24] usb 7-1: Using ep0 maxpacket: 16 [ 1019.114438][ T24] usb 7-1: config 0 has an invalid interface number: 255 but max is 0 [ 1019.125999][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1019.136557][ T24] usb 7-1: config 0 has no interface number 0 [ 1019.155303][ T24] usb 7-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1019.175544][ T24] usb 7-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1019.183972][ T24] usb 7-1: Product: syz [ 1019.188255][ T24] usb 7-1: Manufacturer: syz [ 1019.192856][ T24] usb 7-1: SerialNumber: syz [ 1019.203582][ T24] usb 7-1: config 0 descriptor?? [ 1019.236156][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1019.368031][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1019.456716][T25501] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3947'. [ 1019.467885][ T24] usb 7-1: USB disconnect, device number 48 [ 1019.599097][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1019.723569][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1020.614987][ T1072] usb 8-1: USB disconnect, device number 60 [ 1020.648285][T25528] netlink: 'syz.6.3955': attribute type 10 has an invalid length. [ 1020.656776][ T5907] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 1020.885996][ T5907] usb 2-1: Using ep0 maxpacket: 16 [ 1020.892912][ T5907] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1020.901777][ T5907] usb 2-1: config 0 has an invalid interface number: 130 but max is 1 [ 1020.921532][T25529] netlink: 'syz.6.3955': attribute type 10 has an invalid length. [ 1020.954353][ T5907] usb 2-1: config 0 has an invalid interface number: 130 but max is 1 [ 1020.971533][ T5907] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1020.992513][ T5907] usb 2-1: config 0 has no interface number 0 [ 1021.004827][ T5907] usb 2-1: config 0 interface 130 has no altsetting 0 [ 1021.021784][ T5907] usb 2-1: New USB device found, idVendor=369d, idProduct=1a01, bcdDevice=b2.c3 [ 1021.033244][ T5907] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1021.051169][ T5907] usb 2-1: Product: syz [ 1021.061286][ T5907] usb 2-1: Manufacturer: syz [ 1021.072311][ T5907] usb 2-1: SerialNumber: syz [ 1021.166291][T25528] team0: Port device netdevsim0 added [ 1021.247652][T25529] team0: Port device netdevsim0 removed [ 1021.268576][T25529] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1021.293601][ T5907] usb 2-1: config 0 descriptor?? [ 1021.521933][T25534] netlink: 'syz.7.3956': attribute type 10 has an invalid length. [ 1021.576141][T25535] netlink: 'syz.7.3956': attribute type 10 has an invalid length. [ 1021.612230][T25534] bond0: (slave netdevsim0): Releasing backup interface [ 1021.666038][T25534] team0: Port device netdevsim0 added [ 1021.766006][T25535] team0: Port device netdevsim0 removed [ 1021.789730][T25535] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1022.320455][ T5907] usb-storage 2-1:0.130: USB Mass Storage device detected [ 1022.471703][ T5907] usb 2-1: USB disconnect, device number 73 [ 1022.486019][ T24] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 1022.658878][ T24] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1022.671014][T25552] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3959'. [ 1022.699024][ T24] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1022.711809][ T24] usb 5-1: config 1 has no interface number 1 [ 1022.719298][ T24] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1022.743722][ T24] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1022.810528][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1022.944256][ T24] usb 5-1: Product: syz [ 1022.956544][ T24] usb 5-1: Manufacturer: syz [ 1023.189400][ T5907] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1023.383662][ T24] usb 5-1: SerialNumber: syz [ 1023.524098][ T2940] net_ratelimit: 21 callbacks suppressed [ 1023.524121][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1023.640202][ T5907] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1023.726548][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1023.754492][ T5907] usb 2-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1023.765491][T25541] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1023.780334][ T5907] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1023.789942][T25541] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1023.819511][ T5907] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1023.835121][T25541] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1023.858054][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1023.872038][T25541] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1023.922510][ T5907] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1023.969484][T25541] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1023.978815][ T5907] usb 2-1: invalid MIDI out EP 0 [ 1023.980033][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1024.021639][T25541] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1024.126305][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1024.202625][T24141] udevd[24141]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1024.234344][ T5907] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1024.321195][ T24] usb 5-1: found format II with max.bitrate = 26774, frame size=2 [ 1024.346165][ T5907] usb 2-1: USB disconnect, device number 74 [ 1024.393011][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1024.403054][ T24] usb 5-1: found format II with max.bitrate = 26774, frame size=2 [ 1024.528767][ T24] usb 5-1: failed to enable PITCH for EP 0x82 [ 1024.557850][ T24] usb 5-1: USB disconnect, device number 109 [ 1024.592484][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1024.627932][T24147] udevd[24147]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1024.766463][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1024.885192][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1025.007340][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1025.298671][T25579] Option ' ' to dns_resolver key: bad/missing value [ 1025.345995][ T5898] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 1025.596017][ T5898] usb 2-1: Using ep0 maxpacket: 16 [ 1025.605520][ T5898] usb 2-1: config 0 has an invalid interface number: 255 but max is 0 [ 1025.614367][ T5898] usb 2-1: config 0 has no interface number 0 [ 1025.625840][ T5898] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1025.639846][ T5898] usb 2-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1025.651121][ T5898] usb 2-1: Product: syz [ 1025.655437][ T5898] usb 2-1: Manufacturer: syz [ 1025.660525][ T5898] usb 2-1: SerialNumber: syz [ 1025.670284][ T5898] usb 2-1: config 0 descriptor?? [ 1025.902833][T25577] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3965'. [ 1025.913450][T14114] usb 2-1: USB disconnect, device number 75 [ 1026.027039][ T5898] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1026.101212][T25587] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3968'. [ 1026.147063][T25587] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(12) [ 1026.153989][T25587] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1026.168739][T25587] vhci_hcd vhci_hcd.0: Device attached [ 1026.176051][ T5898] usb 4-1: Using ep0 maxpacket: 32 [ 1026.186760][ T5898] usb 4-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1026.196761][T25590] fuse: Unknown parameter '0xffffffffffffffff0x000000000000000f' [ 1026.204553][ T5898] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1026.215004][ T5898] usb 4-1: config 0 descriptor?? [ 1026.268083][ T5898] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1026.356444][ T24] vhci_hcd: vhci_device speed not set [ 1026.426761][ T24] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 1026.647344][T25594] PKCS7: Unknown OID: [4] 5.25.264.112.81.102.117.87.150326315.2007.15776.1 [ 1026.656340][T25594] PKCS7: Only support pkcs7_signedData type [ 1026.890517][T25599] netlink: 168 bytes leftover after parsing attributes in process `syz.6.3972'. [ 1026.940657][T25588] vhci_hcd: connection reset by peer [ 1026.950915][ T2967] vhci_hcd: stop threads [ 1026.971349][ T2967] vhci_hcd: release socket [ 1026.983296][ T2967] vhci_hcd: disconnect device [ 1027.113945][ T5898] gspca_nw80x: reg_r err -32 [ 1027.118753][ T5898] nw80x 4-1:0.0: probe with driver nw80x failed with error -32 [ 1027.142681][T25608] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3974'. [ 1027.436141][T14114] usb 8-1: new high-speed USB device number 61 using dummy_hcd [ 1027.605837][T14114] usb 8-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1027.640954][T25616] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3976'. [ 1027.688867][T14114] usb 8-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1027.702531][T14114] usb 8-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1027.722919][T25618] FAULT_INJECTION: forcing a failure. [ 1027.722919][T25618] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1027.739355][T14114] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1027.748670][T25618] CPU: 1 UID: 0 PID: 25618 Comm: syz.1.3977 Not tainted syzkaller #0 PREEMPT(full) [ 1027.748693][T25618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1027.748704][T25618] Call Trace: [ 1027.748712][T25618] [ 1027.748719][T25618] dump_stack_lvl+0x189/0x250 [ 1027.748744][T25618] ? __pfx____ratelimit+0x10/0x10 [ 1027.748768][T25618] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1027.748788][T25618] ? __pfx__printk+0x10/0x10 [ 1027.748808][T25618] ? __might_fault+0xb0/0x130 [ 1027.748839][T25618] should_fail_ex+0x414/0x560 [ 1027.748863][T25618] _copy_from_user+0x2d/0xb0 [ 1027.748888][T25618] do_sys_poll+0x242/0x1070 [ 1027.748919][T25618] ? __lock_acquire+0xab9/0xd20 [ 1027.748947][T25618] ? __pfx_do_sys_poll+0x10/0x10 [ 1027.748982][T25618] ? __lock_acquire+0xab9/0xd20 [ 1027.749065][T25618] ? seqcount_lockdep_reader_access+0x122/0x1c0 [ 1027.749112][T25618] ? __pfx_timespec64_add_safe+0x10/0x10 [ 1027.749145][T25618] __se_sys_poll+0x128/0x320 [ 1027.749165][T25618] ? exc_page_fault+0x82/0x100 [ 1027.749190][T25618] ? __pfx___se_sys_poll+0x10/0x10 [ 1027.749214][T25618] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1027.749240][T25618] ? lockdep_hardirqs_on+0x9c/0x150 [ 1027.749266][T25618] __do_fast_syscall_32+0xb6/0x2b0 [ 1027.749293][T25618] ? lockdep_hardirqs_on+0x9c/0x150 [ 1027.749320][T25618] do_fast_syscall_32+0x34/0x80 [ 1027.749345][T25618] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1027.749367][T25618] RIP: 0023:0xf7fe7539 [ 1027.749383][T25618] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1027.749398][T25618] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 00000000000000a8 [ 1027.749417][T25618] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 00000000000000b5 [ 1027.749430][T25618] RDX: 0000000000000009 RSI: 0000000000000000 RDI: 0000000000000000 [ 1027.749444][T25618] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1027.749455][T25618] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1027.749466][T25618] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1027.749495][T25618] [ 1027.756352][T14114] usb 8-1: Quirk or no altset; falling back to MIDI 1.0 [ 1028.053276][T14114] usb 8-1: invalid MIDI out EP 0 [ 1028.387835][T14114] snd-usb-audio 8-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1028.723787][T25626] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3979'. [ 1028.738353][ T1167] net_ratelimit: 27 callbacks suppressed [ 1028.738374][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1028.756609][T14114] usb 8-1: USB disconnect, device number 61 [ 1028.842148][ T1072] usb 4-1: USB disconnect, device number 78 [ 1028.866070][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1029.297798][T14114] usb 8-1: new high-speed USB device number 62 using dummy_hcd [ 1029.366534][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1029.540858][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1030.059744][T14114] usb 8-1: Using ep0 maxpacket: 16 [ 1030.078546][T14114] usb 8-1: config 0 has an invalid interface number: 255 but max is 0 [ 1030.115853][T14114] usb 8-1: config 0 has no interface number 0 [ 1030.133909][T14114] usb 8-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1030.148786][T14114] usb 8-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1030.169694][T25645] PKCS7: Unknown OID: [4] 5.25.264.112.81.102.117.87.150326315.2007.15776.1 [ 1030.180913][T14114] usb 8-1: Product: syz [ 1030.203771][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1030.211604][T25645] PKCS7: Only support pkcs7_signedData type [ 1030.215842][T14114] usb 8-1: Manufacturer: syz [ 1030.303560][T25647] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1030.321354][T14114] usb 8-1: SerialNumber: syz [ 1030.356032][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1030.404589][T14114] usb 8-1: config 0 descriptor?? [ 1030.497071][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1030.607722][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1030.627266][T25631] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3981'. [ 1030.726051][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1030.735349][T14114] usb 8-1: USB disconnect, device number 62 [ 1030.986001][T25652] FAULT_INJECTION: forcing a failure. [ 1030.986001][T25652] name failslab, interval 1, probability 0, space 0, times 0 [ 1031.009590][T25652] CPU: 1 UID: 0 PID: 25652 Comm: syz.3.3986 Not tainted syzkaller #0 PREEMPT(full) [ 1031.009617][T25652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1031.009629][T25652] Call Trace: [ 1031.009638][T25652] [ 1031.009647][T25652] dump_stack_lvl+0x189/0x250 [ 1031.009673][T25652] ? __pfx____ratelimit+0x10/0x10 [ 1031.009697][T25652] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1031.009717][T25652] ? __pfx__printk+0x10/0x10 [ 1031.009743][T25652] ? __pfx___might_resched+0x10/0x10 [ 1031.009772][T25652] should_fail_ex+0x414/0x560 [ 1031.009798][T25652] should_failslab+0xa8/0x100 [ 1031.009823][T25652] __kmalloc_noprof+0xcb/0x7f0 [ 1031.009843][T25652] ? kfree+0x4d/0x6d0 [ 1031.009858][T25652] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1031.009887][T25652] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1031.009912][T25652] ? tomoyo_domain+0xd9/0x130 [ 1031.009938][T25652] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1031.009966][T25652] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1031.009993][T25652] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1031.010033][T25652] ? __lock_acquire+0xab9/0xd20 [ 1031.010076][T25652] ? __fget_files+0x2a/0x420 [ 1031.010103][T25652] ? __fget_files+0x3a0/0x420 [ 1031.010123][T25652] ? __fget_files+0x2a/0x420 [ 1031.010149][T25652] security_file_ioctl_compat+0xcb/0x2d0 [ 1031.010179][T25652] __ia32_compat_sys_ioctl+0x128/0x840 [ 1031.010201][T25652] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1031.010221][T25652] ? __fget_files+0x3a0/0x420 [ 1031.010250][T25652] ? fput+0xa0/0xd0 [ 1031.010275][T25652] ? ksys_write+0x22a/0x250 [ 1031.010297][T25652] ? __pfx_ksys_write+0x10/0x10 [ 1031.010320][T25652] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1031.010347][T25652] ? lockdep_hardirqs_on+0x9c/0x150 [ 1031.010374][T25652] __do_fast_syscall_32+0xb6/0x2b0 [ 1031.010404][T25652] ? lockdep_hardirqs_on+0x9c/0x150 [ 1031.010432][T25652] do_fast_syscall_32+0x34/0x80 [ 1031.010464][T25652] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1031.010485][T25652] RIP: 0023:0xf703d539 [ 1031.010502][T25652] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1031.010517][T25652] RSP: 002b:00000000f542d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1031.010537][T25652] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000008982 [ 1031.010549][T25652] RDX: 00000000800023c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 1031.010560][T25652] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1031.010571][T25652] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1031.010581][T25652] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1031.010610][T25652] [ 1031.010866][T25652] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1031.354511][T25654] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3987'. [ 1031.410268][T25656] FAULT_INJECTION: forcing a failure. [ 1031.410268][T25656] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1031.425364][T25656] CPU: 1 UID: 0 PID: 25656 Comm: syz.3.3988 Not tainted syzkaller #0 PREEMPT(full) [ 1031.425389][T25656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1031.425400][T25656] Call Trace: [ 1031.425408][T25656] [ 1031.425416][T25656] dump_stack_lvl+0x189/0x250 [ 1031.425446][T25656] ? __pfx____ratelimit+0x10/0x10 [ 1031.425470][T25656] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1031.425490][T25656] ? __pfx__printk+0x10/0x10 [ 1031.425510][T25656] ? __might_fault+0xb0/0x130 [ 1031.425540][T25656] should_fail_ex+0x414/0x560 [ 1031.425563][T25656] _copy_from_user+0x2d/0xb0 [ 1031.425587][T25656] get_compat_msghdr+0xad/0x4a0 [ 1031.425613][T25656] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1031.425643][T25656] ___sys_sendmsg+0x193/0x2a0 [ 1031.425666][T25656] ? __pfx____sys_sendmsg+0x10/0x10 [ 1031.425718][T25656] ? __fget_files+0x2a/0x420 [ 1031.425741][T25656] ? __fget_files+0x3a0/0x420 [ 1031.425769][T25656] __sys_sendmsg+0x164/0x220 [ 1031.425789][T25656] ? __pfx___sys_sendmsg+0x10/0x10 [ 1031.425814][T25656] ? __pfx_ksys_write+0x10/0x10 [ 1031.425833][T25656] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1031.425856][T25656] ? lockdep_hardirqs_on+0x9c/0x150 [ 1031.425884][T25656] __do_fast_syscall_32+0xb6/0x2b0 [ 1031.425909][T25656] ? lockdep_hardirqs_on+0x9c/0x150 [ 1031.425934][T25656] do_fast_syscall_32+0x34/0x80 [ 1031.425955][T25656] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1031.425975][T25656] RIP: 0023:0xf703d539 [ 1031.425991][T25656] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1031.426006][T25656] RSP: 002b:00000000f542d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1031.426023][T25656] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000380 [ 1031.426035][T25656] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1031.426045][T25656] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1031.426055][T25656] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1031.426066][T25656] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1031.426094][T25656] [ 1031.658012][T25658] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3989'. [ 1031.706031][ T24] vhci_hcd: vhci_device speed not set [ 1031.989095][ T30] audit: type=1326 audit(1761123194.897:2180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25661 comm="syz.3.3991" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1032.163034][ T30] audit: type=1326 audit(1761123194.907:2181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25661 comm="syz.3.3991" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703d539 code=0x7ffc0000 [ 1032.370246][T25668] FAULT_INJECTION: forcing a failure. [ 1032.370246][T25668] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1032.426051][T25668] CPU: 0 UID: 0 PID: 25668 Comm: syz.4.3992 Not tainted syzkaller #0 PREEMPT(full) [ 1032.426077][T25668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1032.426088][T25668] Call Trace: [ 1032.426096][T25668] [ 1032.426104][T25668] dump_stack_lvl+0x189/0x250 [ 1032.426128][T25668] ? __pfx____ratelimit+0x10/0x10 [ 1032.426151][T25668] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1032.426169][T25668] ? __pfx__printk+0x10/0x10 [ 1032.426199][T25668] should_fail_ex+0x414/0x560 [ 1032.426223][T25668] _copy_to_user+0x31/0xb0 [ 1032.426248][T25668] simple_read_from_buffer+0xe1/0x170 [ 1032.426274][T25668] proc_fail_nth_read+0x1b3/0x220 [ 1032.426295][T25668] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1032.426325][T25668] ? rw_verify_area+0x2a6/0x4d0 [ 1032.426343][T25668] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1032.426362][T25668] vfs_read+0x200/0xa30 [ 1032.426386][T25668] ? __pfx_rxrpc_getsockopt+0x10/0x10 [ 1032.426409][T25668] ? local_clock_noinstr+0xe0/0xe0 [ 1032.426432][T25668] ? __pfx_vfs_read+0x10/0x10 [ 1032.426451][T25668] ? __put_user_nocheck_8+0x10/0x10 [ 1032.426475][T25668] ? rxrpc_getsockopt+0x109/0x160 [ 1032.426497][T25668] ? __pfx_rxrpc_getsockopt+0x10/0x10 [ 1032.426522][T25668] ? do_sock_getsockopt+0x372/0x450 [ 1032.426550][T25668] ksys_read+0x145/0x250 [ 1032.426570][T25668] ? __pfx_ksys_read+0x10/0x10 [ 1032.426591][T25668] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1032.426618][T25668] ? lockdep_hardirqs_on+0x9c/0x150 [ 1032.426645][T25668] __do_fast_syscall_32+0xb6/0x2b0 [ 1032.426669][T25668] ? lockdep_hardirqs_on+0x9c/0x150 [ 1032.426695][T25668] do_fast_syscall_32+0x34/0x80 [ 1032.426718][T25668] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1032.426738][T25668] RIP: 0023:0xf7f36539 [ 1032.426752][T25668] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1032.426763][T25668] RSP: 002b:00000000f5426590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1032.426779][T25668] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f5426620 [ 1032.426791][T25668] RDX: 000000000000000f RSI: 00000000f73c5ff4 RDI: 0000000000000000 [ 1032.426802][T25668] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1032.426812][T25668] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1032.426823][T25668] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1032.426850][T25668] [ 1032.968702][T25672] FAULT_INJECTION: forcing a failure. [ 1032.968702][T25672] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1032.982204][T25672] CPU: 0 UID: 0 PID: 25672 Comm: syz.7.3995 Not tainted syzkaller #0 PREEMPT(full) [ 1032.982220][T25672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1032.982236][T25672] Call Trace: [ 1032.982242][T25672] [ 1032.982246][T25672] dump_stack_lvl+0x189/0x250 [ 1032.982262][T25672] ? __pfx____ratelimit+0x10/0x10 [ 1032.982277][T25672] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1032.982287][T25672] ? __pfx__printk+0x10/0x10 [ 1032.982298][T25672] ? __might_fault+0xb0/0x130 [ 1032.982315][T25672] should_fail_ex+0x414/0x560 [ 1032.982328][T25672] _copy_from_user+0x2d/0xb0 [ 1032.982343][T25672] get_compat_msghdr+0xad/0x4a0 [ 1032.982358][T25672] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1032.982375][T25672] ___sys_sendmsg+0x193/0x2a0 [ 1032.982388][T25672] ? __pfx____sys_sendmsg+0x10/0x10 [ 1032.982417][T25672] ? __fget_files+0x2a/0x420 [ 1032.982429][T25672] ? __fget_files+0x3a0/0x420 [ 1032.982446][T25672] __sys_sendmsg+0x164/0x220 [ 1032.982458][T25672] ? __pfx___sys_sendmsg+0x10/0x10 [ 1032.982473][T25672] ? __pfx_ksys_write+0x10/0x10 [ 1032.982486][T25672] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1032.982501][T25672] ? lockdep_hardirqs_on+0x9c/0x150 [ 1032.982516][T25672] __do_fast_syscall_32+0xb6/0x2b0 [ 1032.982530][T25672] ? lockdep_hardirqs_on+0x9c/0x150 [ 1032.982545][T25672] do_fast_syscall_32+0x34/0x80 [ 1032.982559][T25672] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1032.982571][T25672] RIP: 0023:0xf70cd539 [ 1032.982580][T25672] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1032.982588][T25672] RSP: 002b:00000000f54bd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1032.982600][T25672] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000e00 [ 1032.982607][T25672] RDX: 0000000004008010 RSI: 0000000000000000 RDI: 0000000000000000 [ 1032.982613][T25672] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1032.982619][T25672] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1032.982625][T25672] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1032.982639][T25672] [ 1033.055999][ T980] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 1033.227373][T25674] bond0: option arp_interval: invalid value (18446744073265055750) [ 1033.235433][T25674] bond0: option arp_interval: allowed values 0 - 2147483647 [ 1033.396004][ T980] usb 5-1: Using ep0 maxpacket: 32 [ 1033.402949][ T980] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 1033.413703][ T980] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1033.428294][ T980] usb 5-1: config 0 has no interface number 0 [ 1033.437204][ T980] usb 5-1: config 0 interface 184 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1033.450692][ T980] usb 5-1: config 0 interface 184 has no altsetting 0 [ 1033.563817][T25687] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3993'. [ 1033.588206][ T24] usb 8-1: new high-speed USB device number 63 using dummy_hcd [ 1033.608513][ T980] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1033.617961][ T980] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1033.626487][ T980] usb 5-1: Product: syz [ 1033.630640][ T980] usb 5-1: Manufacturer: syz [ 1033.637019][ T980] usb 5-1: SerialNumber: syz [ 1033.647210][ T980] usb 5-1: config 0 descriptor?? [ 1033.681101][T25686] netlink: 'syz.6.3997': attribute type 10 has an invalid length. [ 1033.707250][ T5898] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1033.731090][T25688] netlink: 'syz.6.3997': attribute type 10 has an invalid length. [ 1033.760460][T25686] bond0: (slave netdevsim0): Releasing backup interface [ 1033.780005][T25686] team0: Port device netdevsim0 added [ 1033.814827][T25688] team0: Port device netdevsim0 removed [ 1033.828008][T25688] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1033.852550][ T24] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1033.856055][ T50] net_ratelimit: 18 callbacks suppressed [ 1033.856073][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1033.925545][ T980] smsc75xx v1.0.0 [ 1033.930758][ T980] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1033.942843][ T5898] usb 4-1: Using ep0 maxpacket: 16 [ 1033.964324][ T5898] usb 4-1: config 0 has an invalid interface number: 255 but max is 0 [ 1034.001863][ T24] usb 8-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1034.011258][ T980] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -22 [ 1034.021511][ T5898] usb 4-1: config 0 has no interface number 0 [ 1034.028205][ T24] usb 8-1: config 1 has no interface number 1 [ 1034.036698][ T24] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1034.058378][ T980] usb 5-1: USB disconnect, device number 110 [ 1034.079119][ T5898] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1034.091971][ T5898] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1034.100679][ T5898] usb 4-1: Product: syz [ 1034.106129][ T5898] usb 4-1: Manufacturer: syz [ 1034.111372][ T5898] usb 4-1: SerialNumber: syz [ 1034.116970][ T24] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1034.129682][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1034.195982][ T24] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.204002][ T24] usb 8-1: Product: syz [ 1034.216018][ T24] usb 8-1: Manufacturer: syz [ 1034.220641][ T24] usb 8-1: SerialNumber: syz [ 1034.277774][ T5898] usb 4-1: config 0 descriptor?? [ 1034.338359][T25699] netlink: 14 bytes leftover after parsing attributes in process `syz.4.4000'. [ 1034.516426][T25697] bond1 (unregistering): Released all slaves [ 1034.527625][T25678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1034.569381][T25678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1034.603055][T25682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3999'. [ 1034.633301][ T5907] usb 4-1: USB disconnect, device number 79 [ 1034.677087][T25678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1034.766229][T25678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1034.827194][T25678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1034.866452][T25678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1034.918065][ T24] usb 8-1: found format II with max.bitrate = 26774, frame size=2 [ 1034.927562][ T24] usb 8-1: found format II with max.bitrate = 26774, frame size=2 [ 1034.946086][ T24] usb 8-1: failed to enable PITCH for EP 0x82 [ 1034.995578][ T24] usb 8-1: USB disconnect, device number 63 [ 1035.006449][T25704] netlink: 14 bytes leftover after parsing attributes in process `syz.1.4001'. [ 1035.086548][T24766] udevd[24766]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1035.121450][T25699] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1035.150712][T25699] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1035.214046][T25699] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 1035.234098][T25699] bond0 (unregistering): Released all slaves [ 1035.293902][T25703] bond2 (unregistering): Released all slaves [ 1035.367993][T25713] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4003'. [ 1035.914403][T25704] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1035.926872][T25704] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1035.942527][T25704] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 1035.987800][T25704] bond0 (unregistering): Released all slaves [ 1036.646250][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1036.767325][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1036.866650][T25736] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4007'. [ 1036.878554][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1036.946003][T14114] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1036.996317][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1037.036001][ T5907] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 1037.109120][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1037.120834][T14114] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1037.130959][T14114] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1037.140278][T14114] usb 4-1: config 1 has no interface number 1 [ 1037.172475][T14114] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1037.220988][ T5907] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1037.238373][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1037.261882][ T5907] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1037.275171][ T5907] usb 7-1: config 1 has no interface number 1 [ 1037.282661][ T5907] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1037.299623][T14114] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1037.316770][ T5907] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1037.328756][T14114] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.337065][ T5907] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.361644][T14114] usb 4-1: Product: syz [ 1037.371988][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1037.379562][ T5907] usb 7-1: Product: syz [ 1037.383858][T14114] usb 4-1: Manufacturer: syz [ 1037.397300][ T5907] usb 7-1: Manufacturer: syz [ 1037.402098][T14114] usb 4-1: SerialNumber: syz [ 1037.408300][ T5907] usb 7-1: SerialNumber: syz [ 1037.529880][ T30] audit: type=1326 audit(1761123200.507:2182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25737 comm="syz.1.4009" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7539 code=0x7ffc0000 [ 1037.552906][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1037.619450][ T30] audit: type=1326 audit(1761123200.507:2183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25737 comm="syz.1.4009" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe7539 code=0x7ffc0000 [ 1037.806428][T25732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1037.821197][T25732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.849080][T25732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1037.857964][T25732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.869122][T25732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1037.884762][T25732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.895651][T25734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1037.904631][T25734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.915625][T14114] usb 4-1: found format II with max.bitrate = 26774, frame size=2 [ 1037.924703][T25734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1037.928746][T14114] usb 4-1: found format II with max.bitrate = 26774, frame size=2 [ 1037.943362][T25734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1037.952455][T14114] usb 4-1: failed to enable PITCH for EP 0x82 [ 1037.978632][ T5907] usb 7-1: found format II with max.bitrate = 26774, frame size=2 [ 1037.994520][T14114] usb 4-1: USB disconnect, device number 80 [ 1038.001732][ T5907] usb 7-1: found format II with max.bitrate = 26774, frame size=2 [ 1038.075804][ T5907] usb 7-1: failed to enable PITCH for EP 0x82 [ 1038.132254][ T5907] usb 7-1: USB disconnect, device number 49 [ 1038.262441][T24147] udevd[24147]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory [ 1038.362244][T25745] FAULT_INJECTION: forcing a failure. [ 1038.362244][T25745] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1038.375810][T25745] CPU: 0 UID: 0 PID: 25745 Comm: syz.1.4011 Not tainted syzkaller #0 PREEMPT(full) [ 1038.375836][T25745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1038.375847][T25745] Call Trace: [ 1038.375855][T25745] [ 1038.375863][T25745] dump_stack_lvl+0x189/0x250 [ 1038.375891][T25745] ? __pfx____ratelimit+0x10/0x10 [ 1038.375913][T25745] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1038.375931][T25745] ? __pfx__printk+0x10/0x10 [ 1038.375949][T25745] ? __might_fault+0xb0/0x130 [ 1038.375978][T25745] should_fail_ex+0x414/0x560 [ 1038.375999][T25745] _copy_from_user+0x2d/0xb0 [ 1038.376027][T25745] get_compat_msghdr+0xad/0x4a0 [ 1038.376042][T25745] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1038.376060][T25745] ___sys_sendmsg+0x193/0x2a0 [ 1038.376073][T25745] ? __pfx____sys_sendmsg+0x10/0x10 [ 1038.376102][T25745] ? __fget_files+0x2a/0x420 [ 1038.376114][T25745] ? __fget_files+0x3a0/0x420 [ 1038.376131][T25745] __sys_sendmsg+0x164/0x220 [ 1038.376143][T25745] ? __pfx___sys_sendmsg+0x10/0x10 [ 1038.376159][T25745] ? __pfx_ksys_write+0x10/0x10 [ 1038.376172][T25745] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1038.376187][T25745] ? lockdep_hardirqs_on+0x9c/0x150 [ 1038.376202][T25745] __do_fast_syscall_32+0xb6/0x2b0 [ 1038.376216][T25745] ? lockdep_hardirqs_on+0x9c/0x150 [ 1038.376231][T25745] do_fast_syscall_32+0x34/0x80 [ 1038.376245][T25745] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1038.376257][T25745] RIP: 0023:0xf7fe7539 [ 1038.376268][T25745] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1038.376277][T25745] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1038.376289][T25745] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080009b40 [ 1038.376296][T25745] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 1038.376303][T25745] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1038.376308][T25745] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1038.376314][T25745] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1038.376329][T25745] [ 1038.929444][T10061] net_ratelimit: 9 callbacks suppressed [ 1038.929462][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1039.004151][T25756] netlink: 'syz.3.4013': attribute type 10 has an invalid length. [ 1039.081865][T25759] netlink: 'syz.3.4013': attribute type 10 has an invalid length. [ 1039.089928][ T5898] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 1039.107885][T25756] bond0: (slave netdevsim0): Releasing backup interface [ 1039.190490][T25756] team0: Port device netdevsim0 added [ 1039.211097][T25759] team0: Port device netdevsim0 removed [ 1039.239486][T25759] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1039.261474][ T5898] usb 7-1: Using ep0 maxpacket: 16 [ 1039.267333][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1039.314251][ T5898] usb 7-1: config 0 has an invalid interface number: 255 but max is 0 [ 1039.330428][ T5898] usb 7-1: config 0 has no interface number 0 [ 1039.346209][ T5898] usb 7-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1039.376327][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1039.384497][ T5898] usb 7-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1039.414425][ T5898] usb 7-1: Product: syz [ 1039.421807][ T5898] usb 7-1: Manufacturer: syz [ 1039.435837][ T5898] usb 7-1: SerialNumber: syz [ 1039.451031][ T5898] usb 7-1: config 0 descriptor?? [ 1039.496136][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1039.688140][T25755] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4014'. [ 1039.691549][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1039.729283][ T5898] usb 7-1: USB disconnect, device number 50 [ 1039.914382][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1040.116309][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1040.247947][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1040.319629][T25768] PKCS7: Unknown OID: [4] 5.25.264.112.81.102.117.87.150326315.2007.15776.1 [ 1040.369818][T25767] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1040.398257][T25768] PKCS7: Only support pkcs7_signedData type [ 1040.406142][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1040.596067][ T5898] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 1040.791093][ T5898] usb 7-1: Using ep0 maxpacket: 16 [ 1040.822423][ T30] audit: type=1326 audit(1761123203.797:2184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25774 comm="syz.7.4020" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 1040.832781][ T5898] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1040.904594][ T5898] usb 7-1: config 0 has an invalid interface number: 130 but max is 1 [ 1040.914930][ T5898] usb 7-1: config 0 has an invalid interface number: 130 but max is 1 [ 1040.931933][ T5898] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1040.941127][ T5898] usb 7-1: config 0 has no interface number 0 [ 1040.947562][ T5898] usb 7-1: config 0 interface 130 has no altsetting 0 [ 1041.520764][ T24] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1041.632498][ T5898] usb 7-1: New USB device found, idVendor=369d, idProduct=1a01, bcdDevice=b2.c3 [ 1041.652462][ T5898] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.666010][ T5898] usb 7-1: Product: syz [ 1041.670195][ T5898] usb 7-1: Manufacturer: syz [ 1041.676685][ T5898] usb 7-1: SerialNumber: syz [ 1041.680857][ T30] audit: type=1326 audit(1761123203.837:2185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25774 comm="syz.7.4020" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 1041.696593][ T5898] usb 7-1: config 0 descriptor?? [ 1041.707464][ C0] vkms_vblank_simulate: vblank timer overrun [ 1041.758591][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1041.767582][ T24] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1041.776695][ T24] usb 4-1: config 1 has no interface number 1 [ 1041.783212][ T24] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1041.848630][ T24] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1041.861085][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.870808][ T24] usb 4-1: Product: syz [ 1041.875018][ T24] usb 4-1: Manufacturer: syz [ 1041.879652][ T24] usb 4-1: SerialNumber: syz [ 1042.101364][T25790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1042.123517][T25790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1042.148868][T25790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1042.162003][T25790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1042.178370][ T5898] usb-storage 7-1:0.130: USB Mass Storage device detected [ 1042.240266][T25790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1042.263425][T25790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1042.267177][ T5898] usb 7-1: USB disconnect, device number 51 [ 1042.286914][T25796] FAULT_INJECTION: forcing a failure. [ 1042.286914][T25796] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1042.301648][ T24] usb 4-1: found format II with max.bitrate = 26774, frame size=2 [ 1042.303037][T25796] CPU: 0 UID: 0 PID: 25796 Comm: syz.1.4025 Not tainted syzkaller #0 PREEMPT(full) [ 1042.303060][T25796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1042.303071][T25796] Call Trace: [ 1042.303079][T25796] [ 1042.303087][T25796] dump_stack_lvl+0x189/0x250 [ 1042.303111][T25796] ? __pfx____ratelimit+0x10/0x10 [ 1042.303135][T25796] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1042.303154][T25796] ? __pfx__printk+0x10/0x10 [ 1042.303172][T25796] ? __might_fault+0xb0/0x130 [ 1042.303203][T25796] should_fail_ex+0x414/0x560 [ 1042.303226][T25796] _copy_from_user+0x2d/0xb0 [ 1042.303250][T25796] get_compat_msghdr+0xad/0x4a0 [ 1042.303276][T25796] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1042.303307][T25796] ___sys_recvmsg+0x17f/0x510 [ 1042.303334][T25796] ? __pfx____sys_recvmsg+0x10/0x10 [ 1042.303397][T25796] ? __fget_files+0x3a0/0x420 [ 1042.303435][T25796] do_recvmmsg+0x36a/0x770 [ 1042.303464][T25796] ? __pfx_do_recvmmsg+0x10/0x10 [ 1042.303484][T25796] ? ksys_write+0x1cb/0x250 [ 1042.303520][T25796] ? __fget_files+0x3a0/0x420 [ 1042.303548][T25796] __sys_recvmmsg+0x19d/0x280 [ 1042.303572][T25796] ? __pfx___sys_recvmmsg+0x10/0x10 [ 1042.303592][T25796] ? __pfx_ksys_write+0x10/0x10 [ 1042.303616][T25796] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 1042.303641][T25796] __do_fast_syscall_32+0xb6/0x2b0 [ 1042.303665][T25796] ? lockdep_hardirqs_on+0x9c/0x150 [ 1042.303692][T25796] do_fast_syscall_32+0x34/0x80 [ 1042.303716][T25796] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1042.303737][T25796] RIP: 0023:0xf7fe7539 [ 1042.303752][T25796] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1042.303767][T25796] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 1042.303786][T25796] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080004080 [ 1042.303799][T25796] RDX: 0000000000000001 RSI: 0000000040000023 RDI: 0000000000000000 [ 1042.303810][T25796] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1042.303820][T25796] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1042.303831][T25796] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1042.303858][T25796] [ 1042.516922][ T5907] usb 8-1: new high-speed USB device number 64 using dummy_hcd [ 1042.527054][ T24] usb 4-1: found format II with max.bitrate = 26774, frame size=2 [ 1042.561461][ T24] usb 4-1: failed to enable PITCH for EP 0x82 [ 1042.619939][T25802] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4027'. [ 1042.635092][ T24] usb 4-1: USB disconnect, device number 81 [ 1042.688547][ T5907] usb 8-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1042.714811][ T5907] usb 8-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1042.727094][ T5907] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1042.756946][ T5907] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1043.075838][T25808] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4029'. [ 1043.135986][ T1072] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1043.296470][ T1072] usb 4-1: Using ep0 maxpacket: 16 [ 1043.305814][ T1072] usb 4-1: config 0 has an invalid interface number: 255 but max is 0 [ 1043.320478][ T1072] usb 4-1: config 0 has no interface number 0 [ 1043.330540][ T1072] usb 4-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1043.344332][ T1072] usb 4-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1043.354491][ T1072] usb 4-1: Product: syz [ 1043.358920][ T1072] usb 4-1: Manufacturer: syz [ 1043.365849][ T1072] usb 4-1: SerialNumber: syz [ 1043.374688][ T1072] usb 4-1: config 0 descriptor?? [ 1043.591762][T25804] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4028'. [ 1043.602441][ T24] usb 4-1: USB disconnect, device number 82 [ 1043.889064][ T5907] stv0680 8-1:4.0: STV(e): camera ping failed!! [ 1043.898327][ T5907] stv0680 8-1:4.0: last error: 159, command = 0x9a [ 1043.920156][T25815] FAULT_INJECTION: forcing a failure. [ 1043.920156][T25815] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1043.937105][T25815] CPU: 0 UID: 0 PID: 25815 Comm: syz.4.4031 Not tainted syzkaller #0 PREEMPT(full) [ 1043.937122][T25815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1043.937129][T25815] Call Trace: [ 1043.937134][T25815] [ 1043.937139][T25815] dump_stack_lvl+0x189/0x250 [ 1043.937156][T25815] ? __pfx____ratelimit+0x10/0x10 [ 1043.937170][T25815] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1043.937181][T25815] ? __pfx__printk+0x10/0x10 [ 1043.937192][T25815] ? __might_fault+0xb0/0x130 [ 1043.937210][T25815] should_fail_ex+0x414/0x560 [ 1043.937224][T25815] _copy_from_user+0x2d/0xb0 [ 1043.937239][T25815] sctp_getsockopt_pr_assocstatus+0xca/0x690 [ 1043.937256][T25815] ? lockdep_hardirqs_on+0x9c/0x150 [ 1043.937270][T25815] ? __pfx_sctp_getsockopt_pr_assocstatus+0x10/0x10 [ 1043.937284][T25815] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1043.937306][T25815] sctp_getsockopt+0xb06/0xb60 [ 1043.937315][T25815] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1043.937331][T25815] do_sock_getsockopt+0x372/0x450 [ 1043.937345][T25815] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1043.937356][T25815] ? local_clock_noinstr+0xe0/0xe0 [ 1043.937368][T25815] ? __fget_files+0x3a0/0x420 [ 1043.937380][T25815] ? __fget_files+0x2a/0x420 [ 1043.937396][T25815] __ia32_sys_getsockopt+0x1a5/0x250 [ 1043.937407][T25815] ? local_clock_noinstr+0xe0/0xe0 [ 1043.937421][T25815] ? local_clock_noinstr+0xe0/0xe0 [ 1043.937436][T25815] __do_fast_syscall_32+0xb6/0x2b0 [ 1043.937451][T25815] ? lockdep_hardirqs_on+0x9c/0x150 [ 1043.937466][T25815] do_fast_syscall_32+0x34/0x80 [ 1043.937480][T25815] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1043.937493][T25815] RIP: 0023:0xf7f36539 [ 1043.937503][T25815] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1043.937511][T25815] RSP: 002b:00000000f542655c EFLAGS: 00000206 ORIG_RAX: 000000000000016d [ 1043.937523][T25815] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000084 [ 1043.937537][T25815] RDX: 0000000000000073 RSI: 0000000080000300 RDI: 0000000080000400 [ 1043.937544][T25815] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1043.937550][T25815] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1043.937556][T25815] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1043.937571][T25815] [ 1043.998866][T22032] net_ratelimit: 26 callbacks suppressed [ 1043.998885][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1044.000218][ C0] vkms_vblank_simulate: vblank timer overrun [ 1044.194019][ C0] vkms_vblank_simulate: vblank timer overrun [ 1044.200012][ C0] hrtimer: interrupt took 254139585 ns [ 1044.272744][T25817] PKCS7: Unknown OID: [4] 5.25.264.112.81.102.117.87.150326315.2007.15776.1 [ 1044.281433][T25817] PKCS7: Only support pkcs7_signedData type [ 1044.293341][T25817] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1044.300771][ C0] vkms_vblank_simulate: vblank timer overrun [ 1044.306072][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1044.320530][ T5907] usb 8-1: USB disconnect, device number 64 [ 1044.436407][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1044.513135][T25824] bridge_slave_0: default FDB implementation only supports local addresses [ 1044.546948][ T1167] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1044.667813][T25827] netlink: 'syz.6.4034': attribute type 10 has an invalid length. [ 1044.688622][T25827] bond0: (slave netdevsim0): Releasing backup interface [ 1044.710880][T25827] team0: Port device netdevsim0 added [ 1044.728095][T25828] netlink: 'syz.6.4034': attribute type 10 has an invalid length. [ 1044.786078][ T24] usb 4-1: new full-speed USB device number 83 using dummy_hcd [ 1044.804580][T25828] team0: Port device netdevsim0 removed [ 1044.832573][T25828] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1044.866099][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1044.932703][ T24] usb 4-1: device descriptor read/64, error -71 [ 1044.977448][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1045.117150][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1045.347426][ T24] usb 4-1: new full-speed USB device number 84 using dummy_hcd [ 1045.361869][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1045.370079][ T30] audit: type=1326 audit(1761123208.317:2186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25830 comm="syz.7.4036" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 1045.392151][ C0] vkms_vblank_simulate: vblank timer overrun [ 1045.485994][ T24] usb 4-1: device descriptor read/64, error -71 [ 1045.540131][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1045.603533][ T30] audit: type=1326 audit(1761123208.317:2187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25830 comm="syz.7.4036" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70cd539 code=0x7ffc0000 [ 1045.606360][ T24] usb usb4-port1: attempt power cycle [ 1045.625693][ C0] vkms_vblank_simulate: vblank timer overrun [ 1045.743428][T25838] FAULT_INJECTION: forcing a failure. [ 1045.743428][T25838] name failslab, interval 1, probability 0, space 0, times 0 [ 1045.761630][T25838] CPU: 1 UID: 0 PID: 25838 Comm: syz.6.4037 Not tainted syzkaller #0 PREEMPT(full) [ 1045.761645][T25838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1045.761652][T25838] Call Trace: [ 1045.761657][T25838] [ 1045.761662][T25838] dump_stack_lvl+0x189/0x250 [ 1045.761678][T25838] ? __pfx____ratelimit+0x10/0x10 [ 1045.761692][T25838] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1045.761703][T25838] ? __pfx__printk+0x10/0x10 [ 1045.761717][T25838] ? __pfx___might_resched+0x10/0x10 [ 1045.761734][T25838] should_fail_ex+0x414/0x560 [ 1045.761748][T25838] should_failslab+0xa8/0x100 [ 1045.761766][T25838] __kmalloc_noprof+0xcb/0x7f0 [ 1045.761777][T25838] ? kfree+0x4d/0x6d0 [ 1045.761785][T25838] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1045.761802][T25838] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1045.761815][T25838] ? tomoyo_domain+0xd9/0x130 [ 1045.761829][T25838] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1045.761845][T25838] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1045.761861][T25838] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1045.761885][T25838] ? __lock_acquire+0xab9/0xd20 [ 1045.761909][T25838] ? __fget_files+0x2a/0x420 [ 1045.761924][T25838] ? __fget_files+0x3a0/0x420 [ 1045.761935][T25838] ? __fget_files+0x2a/0x420 [ 1045.761949][T25838] security_file_ioctl_compat+0xcb/0x2d0 [ 1045.761965][T25838] __ia32_compat_sys_ioctl+0x128/0x840 [ 1045.761977][T25838] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1045.761988][T25838] ? __fget_files+0x3a0/0x420 [ 1045.762004][T25838] ? fput+0xa0/0xd0 [ 1045.762017][T25838] ? ksys_write+0x22a/0x250 [ 1045.762027][T25838] ? exc_page_fault+0x82/0x100 [ 1045.762041][T25838] ? __pfx_ksys_write+0x10/0x10 [ 1045.762054][T25838] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1045.762068][T25838] ? lockdep_hardirqs_on+0x9c/0x150 [ 1045.762083][T25838] __do_fast_syscall_32+0xb6/0x2b0 [ 1045.762103][T25838] ? lockdep_hardirqs_on+0x9c/0x150 [ 1045.762119][T25838] do_fast_syscall_32+0x34/0x80 [ 1045.762133][T25838] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1045.762145][T25838] RIP: 0023:0xf703d539 [ 1045.762154][T25838] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1045.762163][T25838] RSP: 002b:00000000f542d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1045.762174][T25838] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000000890c [ 1045.762181][T25838] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1045.762188][T25838] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1045.762193][T25838] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1045.762199][T25838] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1045.762215][T25838] [ 1045.762275][T25838] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1046.096041][ T24] usb 4-1: new full-speed USB device number 85 using dummy_hcd [ 1046.116685][ T24] usb 4-1: device descriptor read/8, error -71 [ 1046.262675][T25844] syz_tun: entered allmulticast mode [ 1046.387483][ T24] usb 4-1: new full-speed USB device number 86 using dummy_hcd [ 1046.426657][ T24] usb 4-1: device descriptor read/8, error -71 [ 1046.456039][T14114] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 1046.666266][ T24] usb usb4-port1: unable to enumerate USB device [ 1046.733615][T14114] usb 2-1: config index 0 descriptor too short (expected 4114, got 18) [ 1046.735588][T14114] usb 2-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.09 [ 1046.735605][T14114] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.735615][T14114] usb 2-1: Product: syz [ 1046.735623][T14114] usb 2-1: Manufacturer: syz [ 1046.735631][T14114] usb 2-1: SerialNumber: syz [ 1046.737689][T14114] usb 2-1: config 0 descriptor?? [ 1047.160213][T25855] FAULT_INJECTION: forcing a failure. [ 1047.160213][T25855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1047.160261][T25855] CPU: 0 UID: 0 PID: 25855 Comm: syz.6.4042 Not tainted syzkaller #0 PREEMPT(full) [ 1047.160281][T25855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1047.160291][T25855] Call Trace: [ 1047.160299][T25855] [ 1047.160306][T25855] dump_stack_lvl+0x189/0x250 [ 1047.160330][T25855] ? __pfx____ratelimit+0x10/0x10 [ 1047.160354][T25855] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1047.160373][T25855] ? __pfx__printk+0x10/0x10 [ 1047.160405][T25855] should_fail_ex+0x414/0x560 [ 1047.160427][T25855] _copy_to_user+0x31/0xb0 [ 1047.160455][T25855] simple_read_from_buffer+0xe1/0x170 [ 1047.160479][T25855] proc_fail_nth_read+0x1b3/0x220 [ 1047.160500][T25855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1047.160519][T25855] ? rw_verify_area+0x2a6/0x4d0 [ 1047.160541][T25855] ? __lock_acquire+0xab9/0xd20 [ 1047.160559][T25855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1047.160570][T25855] vfs_read+0x200/0xa30 [ 1047.160580][T25855] ? fdget_pos+0x247/0x320 [ 1047.160595][T25855] ? __pfx___mutex_lock+0x10/0x10 [ 1047.160610][T25855] ? __pfx_vfs_read+0x10/0x10 [ 1047.160622][T25855] ? __fget_files+0x2a/0x420 [ 1047.160636][T25855] ? __fget_files+0x3a0/0x420 [ 1047.160647][T25855] ? __fget_files+0x2a/0x420 [ 1047.160664][T25855] ksys_read+0x145/0x250 [ 1047.160674][T25855] ? exc_page_fault+0x82/0x100 [ 1047.160694][T25855] ? __pfx_ksys_read+0x10/0x10 [ 1047.160706][T25855] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1047.160721][T25855] ? lockdep_hardirqs_on+0x9c/0x150 [ 1047.160736][T25855] __do_fast_syscall_32+0xb6/0x2b0 [ 1047.160750][T25855] ? lockdep_hardirqs_on+0x9c/0x150 [ 1047.160766][T25855] do_fast_syscall_32+0x34/0x80 [ 1047.160780][T25855] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1047.160794][T25855] RIP: 0023:0xf703d539 [ 1047.160808][T25855] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1047.160822][T25855] RSP: 002b:00000000f540c590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1047.160841][T25855] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f540c620 [ 1047.160853][T25855] RDX: 000000000000000f RSI: 00000000f73d5ff4 RDI: 0000000000000000 [ 1047.160863][T25855] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1047.160873][T25855] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1047.160884][T25855] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1047.160906][T25855] [ 1047.475699][T25860] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4043'. [ 1048.206047][ T5835] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 1048.385961][ T5835] usb 5-1: Using ep0 maxpacket: 16 [ 1048.397054][ T5835] usb 5-1: config 0 has an invalid interface number: 255 but max is 0 [ 1048.405551][ T5835] usb 5-1: config 0 has no interface number 0 [ 1048.425815][ T5835] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1048.437246][ T5835] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1048.490596][T25878] netlink: 'syz.6.4047': attribute type 10 has an invalid length. [ 1048.519901][ T5835] usb 5-1: Product: syz [ 1048.531484][ T5835] usb 5-1: Manufacturer: syz [ 1048.542630][ T5835] usb 5-1: SerialNumber: syz [ 1048.549907][ T5835] usb 5-1: config 0 descriptor?? [ 1048.581927][T25878] bond0: (slave netdevsim0): Releasing backup interface [ 1048.613154][T25881] netlink: 'syz.6.4047': attribute type 10 has an invalid length. [ 1048.630562][T25875] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1048.640137][T25875] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1048.732405][T25878] team0: Port device netdevsim0 added [ 1048.766406][T25868] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4045'. [ 1048.788146][T25875] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1048.836178][T25875] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1048.903735][ T5835] usb 5-1: USB disconnect, device number 111 [ 1049.004451][T25881] team0: Port device netdevsim0 removed [ 1049.022900][T25875] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1049.029695][T25875] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1049.157037][T25881] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1049.167831][T25875] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1049.174225][T25875] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1049.213118][ T50] net_ratelimit: 22 callbacks suppressed [ 1049.213136][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1049.329078][T25875] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1049.337889][T14114] usb 2-1: USB disconnect, device number 76 [ 1049.398362][T25875] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1049.460780][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1049.489038][T25875] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1049.586240][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1049.706049][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1049.714680][T25894] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4049'. [ 1049.836042][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1049.956293][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1050.411462][T25902] syz_tun: entered allmulticast mode [ 1050.526321][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1050.606075][ T5842] Bluetooth: hci0: command 0x0406 tx timeout [ 1050.636046][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1050.746024][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1050.776405][T14114] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 1050.846051][ T5842] Bluetooth: hci2: command 0x0419 tx timeout [ 1050.866146][ T12] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1050.944679][T14114] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1050.962552][T14114] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1050.972608][T14114] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.980940][T14114] usb 7-1: Product: syz [ 1050.985262][T14114] usb 7-1: Manufacturer: syz [ 1050.990263][T14114] usb 7-1: SerialNumber: syz [ 1050.998676][T14114] usb 7-1: config 0 descriptor?? [ 1051.086128][ T5842] Bluetooth: hci3: command 0x0406 tx timeout [ 1051.246510][ T5842] Bluetooth: hci4: command 0x0406 tx timeout [ 1051.421579][ T5842] Bluetooth: hci1: command 0x0405 tx timeout [ 1051.764037][T25927] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4058'. [ 1051.945097][ T5835] usb 7-1: USB disconnect, device number 52 [ 1052.255986][T14114] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 1052.286456][T25939] netlink: 'syz.7.4061': attribute type 10 has an invalid length. [ 1052.327637][T25939] bond0: (slave netdevsim0): Releasing backup interface [ 1052.366809][T25939] team0: Port device netdevsim0 added [ 1052.466197][T14114] usb 5-1: Using ep0 maxpacket: 16 [ 1052.473215][T14114] usb 5-1: config 0 has an invalid interface number: 255 but max is 0 [ 1052.483513][T14114] usb 5-1: config 0 has no interface number 0 [ 1052.492213][T14114] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1052.503007][T14114] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1052.511443][T14114] usb 5-1: Product: syz [ 1052.516024][T14114] usb 5-1: Manufacturer: syz [ 1052.520754][T14114] usb 5-1: SerialNumber: syz [ 1052.530377][T14114] usb 5-1: config 0 descriptor?? [ 1052.686335][ T5842] Bluetooth: hci0: command 0x0406 tx timeout [ 1052.772229][T25930] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4060'. [ 1052.792012][T25945] bond1 (unregistering): Released all slaves [ 1052.800572][T25947] netlink: 14 bytes leftover after parsing attributes in process `syz.6.4064'. [ 1052.828410][ T1072] usb 5-1: USB disconnect, device number 112 [ 1052.849911][T24243] udevd[24243]: setting owner of /dev/snd/controlC3 to uid=0, gid=29 failed: No such file or directory [ 1052.942743][ T5842] Bluetooth: hci2: command 0x0419 tx timeout [ 1053.166652][ T5842] Bluetooth: hci3: command 0x0406 tx timeout [ 1053.336477][ T5835] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 1053.353176][ T5842] Bluetooth: hci4: command 0x0406 tx timeout [ 1053.486723][ T5842] Bluetooth: hci1: command 0x0405 tx timeout [ 1053.520055][ T5835] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1053.534849][ T5835] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1053.638138][ T5835] usb 2-1: config 1 has no interface number 1 [ 1053.680442][ T5835] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1053.749490][ T5835] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1053.768087][ T5835] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1053.789017][T25947] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1053.800268][ T5835] usb 2-1: Product: syz [ 1053.811343][ T5835] usb 2-1: Manufacturer: syz [ 1053.822239][ T5835] usb 2-1: SerialNumber: syz [ 1053.903342][T25947] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1054.047499][T25947] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 1054.070018][T25950] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1054.116386][T25950] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1054.136121][T25947] bond0 (unregistering): Released all slaves [ 1054.151350][T25950] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1054.177939][T25950] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1054.200193][T25950] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1054.212804][T25950] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1054.256147][ T5835] usb 2-1: found format II with max.bitrate = 26774, frame size=2 [ 1054.287407][ T5835] usb 2-1: found format II with max.bitrate = 26774, frame size=2 [ 1054.306559][T22032] net_ratelimit: 17 callbacks suppressed [ 1054.306577][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1054.310342][ T5835] usb 2-1: failed to enable PITCH for EP 0x82 [ 1054.369665][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.377453][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.416898][ T2940] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1054.447440][ T5835] usb 2-1: USB disconnect, device number 77 [ 1054.476056][ T5898] usb 5-1: new full-speed USB device number 113 using dummy_hcd [ 1054.512691][T24766] udevd[24766]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1054.537334][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1054.646070][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1054.655794][ T5898] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1054.668980][ T5898] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64 [ 1054.681480][ T5898] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 1054.692894][ T5898] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 1054.711046][ T5898] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1054.721405][ T5898] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.731908][ T5898] usb 5-1: Product: syz [ 1054.736401][ T5898] usb 5-1: Manufacturer: syz [ 1054.741025][ T5898] usb 5-1: SerialNumber: syz [ 1054.756037][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1054.773668][T25964] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1054.789983][ T5898] cdc_mbim 5-1:1.0: skipping garbage [ 1054.876014][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1054.886036][ T1072] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1054.993317][T10061] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1054.995286][T25964] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1055.011221][T25964] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1055.053562][ T1072] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1055.071501][ T1072] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1055.096386][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1055.104048][ T1072] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1055.137961][ T1072] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1055.144062][T25975] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4072'. [ 1055.172020][ T1072] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1055.201537][ T1072] usb 4-1: config 0 descriptor?? [ 1055.206175][T22032] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1055.327583][ T50] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1055.566501][ T5842] Bluetooth: hci1: command 0x0405 tx timeout [ 1055.637738][ T1072] plantronics 0003:047F:FFFF.0048: unbalanced delimiter at end of report description [ 1055.666476][T25964] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1055.736169][T25964] raw-gadget.4 gadget.4: fail, usb_ep_enable returned -22 [ 1055.736586][ T1072] plantronics 0003:047F:FFFF.0048: parse failed [ 1055.743676][ T5898] cdc_mbim 5-1:1.0: setting rx_max = 16384 [ 1055.804674][ T1072] plantronics 0003:047F:FFFF.0048: probe with driver plantronics failed with error -22 [ 1055.846527][T25968] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4070'. [ 1055.873081][T25968] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4070'. [ 1056.054107][ T5898] cdc_mbim 5-1:1.0: cdc-wdm0: USB WDM device [ 1056.071801][T25968] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4070'. [ 1056.110835][ T5898] wwan wwan0: port wwan0mbim0 attached [ 1056.164607][ T5898] cdc_mbim 5-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.4-1, CDC MBIM, 1e:a6:b2:ff:bb:8e [ 1056.199533][ T5898] usb 5-1: USB disconnect, device number 113 [ 1056.243325][ T5898] cdc_mbim 5-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.4-1, CDC MBIM [ 1056.369440][ T5898] wwan wwan0: port wwan0mbim0 disconnected [ 1056.442552][T25987] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4075'. [ 1056.756632][ T5898] usb 4-1: USB disconnect, device number 87 [ 1057.046342][ T1072] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 1057.181421][T25998] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4078'. [ 1057.253240][ T1072] usb 5-1: config index 0 descriptor too short (expected 4114, got 18) [ 1057.268576][ T1072] usb 5-1: New USB device found, idVendor=0dba, idProduct=1000, bcdDevice= 0.09 [ 1057.279349][ T1072] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1057.294995][ T1072] usb 5-1: Product: syz [ 1057.304765][ T1072] usb 5-1: Manufacturer: syz [ 1057.319424][ T1072] usb 5-1: SerialNumber: syz [ 1057.973583][ T1072] usb 5-1: config 0 descriptor?? [ 1059.443931][T23394] net_ratelimit: 19 callbacks suppressed [ 1059.443953][T23394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1060.173233][T23394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1061.191891][T23394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1062.219194][T23394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1065.072577][T23394] bond1: (slave ip6gretap1): failed to get link speed/duplex [ 1066.036126][ C0] sched: DL replenish lagged too much [ 1124.102240][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1124.123035][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1163.575907][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1163.582925][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P22744/1:b..l [ 1163.591537][ C1] rcu: (detected by 1, t=10502 jiffies, g=137209, q=313 ncpus=2) [ 1163.599359][ C1] task:syz-executor state:R running task stack:21288 pid:22744 tgid:22744 ppid:22722 task_flags:0x400140 flags:0x10080001 [ 1163.614020][ C1] Call Trace: [ 1163.617318][ C1] [ 1163.620258][ C1] __schedule+0x1798/0x4cc0 [ 1163.624800][ C1] ? __pfx___schedule+0x10/0x10 [ 1163.629660][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 1163.634973][ C1] ? unwind_get_return_address+0x4d/0x90 [ 1163.640626][ C1] ? preempt_schedule_irq+0xaa/0x150 [ 1163.645912][ C1] preempt_schedule_irq+0xb5/0x150 [ 1163.651032][ C1] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 1163.656775][ C1] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 1163.662763][ C1] irqentry_exit+0x6f/0x90 [ 1163.667197][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1163.673188][ C1] RIP: 0010:__asan_memset+0x7/0x50 [ 1163.678318][ C1] Code: 00 00 e9 bc e4 ff ff 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 56 <53> 48 89 d3 89 f5 49 89 fe 48 8b 4c 24 18 48 89 d6 ba 01 00 00 00 [ 1163.697938][ C1] RSP: 0018:ffffc9000da8f200 EFLAGS: 00000246 [ 1163.704027][ C1] RAX: 1ffff92001b51e64 RBX: ffffc9000da8f320 RCX: 1ffff92001b51e01 [ 1163.712013][ C1] RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc9000da8f338 [ 1163.719991][ C1] RBP: dffffc0000000000 R08: 0000000000000001 R09: ffffffff8173cd25 [ 1163.727964][ C1] R10: ffffc9000da8f338 R11: ffffffff81ac6cb0 R12: ffffc9000da8fec0 [ 1163.735940][ C1] R13: ffffc9000da8f338 R14: ffffc9000da8f2e8 R15: ffffc9000da8f330 [ 1163.743918][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1163.750082][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1163.755217][ C1] unwind_next_frame+0xc98/0x2390 [ 1163.760256][ C1] ? unwind_next_frame+0xa5/0x2390 [ 1163.765377][ C1] ? do_unlinkat+0x39f/0x560 [ 1163.769973][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1163.776130][ C1] arch_stack_walk+0x11c/0x150 [ 1163.780894][ C1] ? __ia32_sys_unlink+0x46/0x50 [ 1163.785833][ C1] stack_trace_save+0x9c/0xe0 [ 1163.790513][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1163.795906][ C1] save_stack+0xf5/0x1f0 [ 1163.800157][ C1] ? __pfx_save_stack+0x10/0x10 [ 1163.805035][ C1] ? free_unref_folios+0xdb3/0x14f0 [ 1163.810235][ C1] ? folios_put_refs+0x584/0x670 [ 1163.815179][ C1] ? shmem_undo_range+0x49e/0x14b0 [ 1163.820290][ C1] ? shmem_evict_inode+0x272/0xa70 [ 1163.825405][ C1] ? evict+0x504/0x9c0 [ 1163.829471][ C1] ? do_unlinkat+0x39f/0x560 [ 1163.834051][ C1] ? page_ext_put+0x97/0xc0 [ 1163.838567][ C1] __reset_page_owner+0x71/0x1f0 [ 1163.843515][ C1] free_unref_folios+0xdb3/0x14f0 [ 1163.848554][ C1] ? folio_unqueue_deferred_split+0x93/0x230 [ 1163.854552][ C1] folios_put_refs+0x584/0x670 [ 1163.859339][ C1] ? __pfx_folios_put_refs+0x10/0x10 [ 1163.864637][ C1] ? folio_batch_remove_exceptionals+0x18c/0x1f0 [ 1163.870980][ C1] shmem_undo_range+0x49e/0x14b0 [ 1163.875934][ C1] ? __pfx_shmem_undo_range+0x10/0x10 [ 1163.881326][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 1163.886732][ C1] shmem_evict_inode+0x272/0xa70 [ 1163.891685][ C1] ? inode_wait_for_writeback+0xf9/0x290 [ 1163.897337][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1163.902804][ C1] ? __pfx_inode_wait_for_writeback+0x10/0x10 [ 1163.908889][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 1163.914099][ C1] ? __pfx_shmem_evict_inode+0x10/0x10 [ 1163.919567][ C1] evict+0x504/0x9c0 [ 1163.923474][ C1] ? __pfx_evict+0x10/0x10 [ 1163.927888][ C1] ? do_raw_spin_unlock+0x122/0x240 [ 1163.933086][ C1] ? _raw_spin_unlock+0x28/0x50 [ 1163.937925][ C1] ? iput+0x946/0xc50 [ 1163.941927][ C1] do_unlinkat+0x39f/0x560 [ 1163.946356][ C1] ? __pfx_do_unlinkat+0x10/0x10 [ 1163.951307][ C1] ? getname_flags+0x1e5/0x540 [ 1163.956081][ C1] __ia32_sys_unlink+0x46/0x50 [ 1163.960847][ C1] __do_fast_syscall_32+0xb6/0x2b0 [ 1163.965968][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1163.971177][ C1] do_fast_syscall_32+0x34/0x80 [ 1163.976038][ C1] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1163.982366][ C1] RIP: 0023:0xf70cd539 [ 1163.986422][ C1] RSP: 002b:00000000f75becdc EFLAGS: 00000206 ORIG_RAX: 000000000000000a [ 1163.994833][ C1] RAX: ffffffffffffffda RBX: 00000000f75bed80 RCX: 0000000000008000 [ 1164.002790][ C1] RDX: 00000000f7465ff4 RSI: 0000000000000000 RDI: 00000000f75bfe14 [ 1164.010763][ C1] RBP: 00000000f75bed80 R08: 0000000000000000 R09: 0000000000000000 [ 1164.018735][ C1] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1164.026711][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1164.034691][ C1] [ 1164.037701][ C1] rcu: rcu_preempt kthread starved for 10282 jiffies! g137209 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 1164.048985][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 1164.058961][ C1] rcu: RCU grace-period kthread stack dump: [ 1164.064848][ C1] task:rcu_preempt state:R running task stack:27224 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 1164.078354][ C1] Call Trace: [ 1164.081638][ C1] [ 1164.084561][ C1] __schedule+0x1798/0x4cc0 [ 1164.089085][ C1] ? __lock_acquire+0xab9/0xd20 [ 1164.093949][ C1] ? __pfx___schedule+0x10/0x10 [ 1164.098828][ C1] ? schedule+0x91/0x360 [ 1164.103085][ C1] schedule+0x165/0x360 [ 1164.107252][ C1] schedule_timeout+0x12b/0x270 [ 1164.112109][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 1164.117483][ C1] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1164.123385][ C1] ? __pfx_process_timeout+0x10/0x10 [ 1164.128675][ C1] ? prepare_to_swait_event+0x341/0x380 [ 1164.134225][ C1] rcu_gp_fqs_loop+0x301/0x1540 [ 1164.139080][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1164.144290][ C1] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 1164.150454][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 1164.155744][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1164.160959][ C1] ? finish_swait+0xcd/0x1f0 [ 1164.165574][ C1] rcu_gp_kthread+0x99/0x390 [ 1164.170173][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1164.175382][ C1] ? __kthread_parkme+0x7b/0x200 [ 1164.180341][ C1] ? __kthread_parkme+0x1a1/0x200 [ 1164.185361][ C1] kthread+0x711/0x8a0 [ 1164.189426][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 1164.194643][ C1] ? __pfx_kthread+0x10/0x10 [ 1164.199243][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1164.204453][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1164.209659][ C1] ? __pfx_kthread+0x10/0x10 [ 1164.214255][ C1] ret_from_fork+0x4bc/0x870 [ 1164.218860][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 1164.223984][ C1] ? __switch_to_asm+0x39/0x70 [ 1164.228748][ C1] ? __switch_to_asm+0x33/0x70 [ 1164.233493][ C1] ? __pfx_kthread+0x10/0x10 [ 1164.238070][ C1] ret_from_fork_asm+0x1a/0x30 [ 1164.242857][ C1] [ 1164.245872][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 1164.252197][ C1] Sending NMI from CPU 1 to CPUs 0: [ 1164.257406][ C0] NMI backtrace for cpu 0 [ 1164.257424][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 1164.257462][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1164.257483][ C0] RIP: 0010:is_bpf_text_address+0xb/0x2b0 [ 1164.257515][ C0] Code: 00 00 4c 89 ea e8 b5 50 5c ff 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 55 41 57 41 56 41 55 <41> 54 53 48 83 ec 10 49 89 fe e8 c6 f0 f0 ff e8 11 f4 d7 ff 48 8d [ 1164.257529][ C0] RSP: 0018:ffffc90000006cb0 EFLAGS: 00000246 [ 1164.257551][ C0] RAX: 0000000000000000 RBX: ffffffff9102b1c3 RCX: fb68d71a11007300 [ 1164.257563][ C0] RDX: 0000000000000003 RSI: ffffffff8d9d457d RDI: ffffffff9102b1c3 [ 1164.257574][ C0] RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff81aae47d [ 1164.257585][ C0] R10: ffffc90000006d78 R11: fffff52000000db1 R12: ffffffff8de95200 [ 1164.257598][ C0] R13: 0000000000000000 R14: 0000000000000001 R15: 1ffff92000000dae [ 1164.257610][ C0] FS: 0000000000000000(0000) GS:ffff888125d06000(0000) knlGS:0000000000000000 [ 1164.257624][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1164.257635][ C0] CR2: 00000000f50469f5 CR3: 000000007d324000 CR4: 00000000003526f0 [ 1164.257650][ C0] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 1164.257661][ C0] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1164.257672][ C0] Call Trace: [ 1164.257679][ C0] [ 1164.257687][ C0] kernel_text_address+0xa5/0xe0 [ 1164.257706][ C0] ? x86_64_start_kernel+0x143/0x1c0 [ 1164.257843][ C0] __kernel_text_address+0xd/0x40 [ 1164.257861][ C0] unwind_get_return_address+0x4d/0x90 [ 1164.257883][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1164.257901][ C0] arch_stack_walk+0xfc/0x150 [ 1164.257918][ C0] ? x86_64_start_kernel+0x143/0x1c0 [ 1164.257941][ C0] stack_trace_save+0x9c/0xe0 [ 1164.257957][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1164.257977][ C0] ? __lock_acquire+0xab9/0xd20 [ 1164.257996][ C0] kasan_save_track+0x3e/0x80 [ 1164.258013][ C0] ? kasan_save_track+0x3e/0x80 [ 1164.258029][ C0] ? __kasan_save_free_info+0x46/0x50 [ 1164.258043][ C0] ? __kasan_slab_free+0x5c/0x80 [ 1164.258060][ C0] ? kmem_cache_free+0x19b/0x690 [ 1164.258077][ C0] ? skb_release_data+0x62d/0x7c0 [ 1164.258094][ C0] ? consume_skb+0x9e/0xf0 [ 1164.258109][ C0] ? nft_synproxy_eval_v6+0x376/0x560 [ 1164.258129][ C0] ? nft_synproxy_do_eval+0x3d7/0x570 [ 1164.258147][ C0] ? nft_do_chain+0x40c/0x1920 [ 1164.258165][ C0] ? nft_do_chain_inet+0x25d/0x340 [ 1164.258184][ C0] ? nf_hook_slow+0xc5/0x220 [ 1164.258200][ C0] ? NF_HOOK+0x206/0x3a0 [ 1164.258214][ C0] ? ip6_input+0x16a/0x270 [ 1164.258228][ C0] ? NF_HOOK+0x30c/0x3a0 [ 1164.258242][ C0] ? __netif_receive_skb+0xd3/0x380 [ 1164.258262][ C0] ? process_backlog+0x60e/0x14f0 [ 1164.258276][ C0] ? __napi_poll+0xc7/0x360 [ 1164.258294][ C0] ? net_rx_action+0x5f7/0xdf0 [ 1164.258307][ C0] ? handle_softirqs+0x286/0x870 [ 1164.258327][ C0] ? __irq_exit_rcu+0xca/0x1f0 [ 1164.258345][ C0] ? irq_exit_rcu+0x9/0x30 [ 1164.258364][ C0] ? sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1164.258384][ C0] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1164.258401][ C0] ? pv_native_safe_halt+0x13/0x20 [ 1164.258420][ C0] ? default_idle+0x13/0x20 [ 1164.258433][ C0] ? default_idle_call+0x73/0xb0 [ 1164.258447][ C0] ? do_idle+0x1e7/0x510 [ 1164.258466][ C0] ? cpu_startup_entry+0x44/0x60 [ 1164.258486][ C0] ? rest_init+0x2de/0x300 [ 1164.258500][ C0] ? start_kernel+0x3ae/0x410 [ 1164.258526][ C0] ? x86_64_start_reservations+0x24/0x30 [ 1164.258567][ C0] ? skb_release_data+0x62d/0x7c0 [ 1164.258583][ C0] __kasan_save_free_info+0x46/0x50 [ 1164.258597][ C0] __kasan_slab_free+0x5c/0x80 [ 1164.258615][ C0] kmem_cache_free+0x19b/0x690 [ 1164.258636][ C0] skb_release_data+0x62d/0x7c0 [ 1164.258658][ C0] consume_skb+0x9e/0xf0 [ 1164.258673][ C0] nft_synproxy_eval_v6+0x376/0x560 [ 1164.258697][ C0] ? __pfx_nft_synproxy_eval_v6+0x10/0x10 [ 1164.258718][ C0] ? nf_ip_checksum+0x13c/0x510 [ 1164.258740][ C0] nft_synproxy_do_eval+0x3d7/0x570 [ 1164.258763][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 1164.258784][ C0] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1164.258810][ C0] nft_do_chain+0x40c/0x1920 [ 1164.258830][ C0] ? ip6t_do_table+0x1376/0x1560 [ 1164.258854][ C0] ? nf_nat_inet_fn+0x924/0xba0 [ 1164.258875][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 1164.258892][ C0] ? ipv6_find_hdr+0xc78/0x1050 [ 1164.258921][ C0] ? nf_nat_ipv6_fn+0x21d/0x2d0 [ 1164.258944][ C0] ? __pfx_nf_nat_ipv6_fn+0x10/0x10 [ 1164.258969][ C0] nft_do_chain_inet+0x25d/0x340 [ 1164.258987][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 1164.259005][ C0] ? nf_nat_ipv6_local_in+0x14f/0x650 [ 1164.259030][ C0] ? __pfx_nf_nat_ipv6_local_in+0x10/0x10 [ 1164.259053][ C0] ? NF_HOOK+0x9a/0x3a0 [ 1164.259068][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 1164.259088][ C0] nf_hook_slow+0xc5/0x220 [ 1164.259107][ C0] NF_HOOK+0x206/0x3a0 [ 1164.259122][ C0] ? __pfx_ip6_input_finish+0x10/0x10 [ 1164.259138][ C0] ? NF_HOOK+0x9a/0x3a0 [ 1164.259152][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 1164.259167][ C0] ? __pfx_ip6_input_finish+0x10/0x10 [ 1164.259189][ C0] ip6_input+0x16a/0x270 [ 1164.259203][ C0] ? ip6_input+0x23/0x270 [ 1164.259219][ C0] NF_HOOK+0x30c/0x3a0 [ 1164.259232][ C0] ? skb_orphan+0xaf/0xd0 [ 1164.259248][ C0] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1164.259262][ C0] ? NF_HOOK+0x9a/0x3a0 [ 1164.259276][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 1164.259291][ C0] ? __pfx_ip6_rcv_finish+0x10/0x10 [ 1164.259312][ C0] __netif_receive_skb+0xd3/0x380 [ 1164.259334][ C0] ? process_backlog+0x2d5/0x14f0 [ 1164.259350][ C0] process_backlog+0x60e/0x14f0 [ 1164.259372][ C0] ? __pfx_process_backlog+0x10/0x10 [ 1164.259393][ C0] __napi_poll+0xc7/0x360 [ 1164.259412][ C0] ? skb_defer_free_flush+0x229/0x250 [ 1164.259435][ C0] net_rx_action+0x5f7/0xdf0 [ 1164.259457][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 1164.259473][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 1164.259497][ C0] ? __pfx_sched_clock_cpu+0x10/0x10 [ 1164.259525][ C0] handle_softirqs+0x286/0x870 [ 1164.259552][ C0] ? __irq_exit_rcu+0xca/0x1f0 [ 1164.259575][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 1164.259597][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 1164.259615][ C0] __irq_exit_rcu+0xca/0x1f0 [ 1164.259634][ C0] ? __pfx___irq_exit_rcu+0x10/0x10 [ 1164.259659][ C0] irq_exit_rcu+0x9/0x30 [ 1164.259677][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1164.259697][ C0] [ 1164.259703][ C0] [ 1164.259710][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1164.259726][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1164.259746][ C0] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 71 1a 00 f3 0f 1e fa fb f4 c8 e6 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1164.259760][ C0] RSP: 0018:ffffffff8de07d80 EFLAGS: 000002c6 [ 1164.259773][ C0] RAX: fb68d71a11007300 RBX: ffffffff8196bb87 RCX: fb68d71a11007300 [ 1164.259786][ C0] RDX: 0000000000000001 RSI: ffffffff8d7eb243 RDI: ffffffff8bc07360 [ 1164.259797][ C0] RBP: ffffffff8de07ea8 R08: ffff8880b8632fdb R09: 1ffff110170c65fb [ 1164.259809][ C0] R10: dffffc0000000000 R11: ffffed10170c65fc R12: ffffffff8f9e1570 [ 1164.259822][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1bd2a40 [ 1164.259834][ C0] ? do_idle+0x1e7/0x510 [ 1164.259859][ C0] default_idle+0x13/0x20 [ 1164.259872][ C0] default_idle_call+0x73/0xb0 [ 1164.259887][ C0] do_idle+0x1e7/0x510 [ 1164.259909][ C0] ? __pfx_do_idle+0x10/0x10 [ 1164.259936][ C0] cpu_startup_entry+0x44/0x60 [ 1164.259956][ C0] rest_init+0x2de/0x300 [ 1164.259973][ C0] start_kernel+0x3ae/0x410 [ 1164.259991][ C0] x86_64_start_reservations+0x24/0x30 [ 1164.260012][ C0] x86_64_start_kernel+0x143/0x1c0 [ 1164.260034][ C0] common_startup_64+0x13e/0x147 [ 1164.260058][ C0]