last executing test programs: 2m12.6659316s ago: executing program 3 (id=1220): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, 0x0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f00000001c0)={&(0x7f0000000000)="c945b941eb6a3f6d", 0x8}) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) sendmmsg(r1, &(0x7f0000002b40)=[{{&(0x7f0000000000)=@tipc=@name={0x1e, 0x2, 0x2, {{0x43, 0x3}, 0x1}}, 0x80, 0x0}}], 0x1, 0x8000) recvmmsg$unix(r1, &(0x7f00000002c0)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)=""/211, 0xd3}], 0x1}}], 0x1, 0x40000100, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003c0100003c01f70004000000000000001600000d000000000d000000020000000800000003000000080000000106000000050000000d0000000300000034000000080000853a00000006000000050000000008000010000000000000000002000006000000040000009e9100000600000002000000010001000400000001000000070000000c0000000300000003000000050100000300000003000000060000000200000005050000090000000000001202000000070000000000000202000000090000000000000802000000000000000200000d000000000a000000010000000d000000020000000600000006000005fbffffff0700000002000000010000000300000000000000040000000400000005000000080000000600000000000000010400000300000004000000d6a4bdfa0a000000030000000100010000613000ab5fa40bc8c8"], &(0x7f0000000200)=""/29, 0x158, 0x1d, 0x1, 0x8001}, 0x28) epoll_create1(0x80000) (async) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000380)={0x90000005}) (async) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000380)={0x90000005}) recvmsg$kcm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000440)=""/181, 0xb5}, {&(0x7f00000003c0)=""/24, 0x18}, {&(0x7f0000000500)=""/98, 0x62}], 0x3, &(0x7f00000005c0)=""/65, 0x41}, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x2) (async) prctl$PR_MCE_KILL(0x21, 0x0, 0x2) 2m12.375304057s ago: executing program 3 (id=1222): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x197d1b, 0x0, &(0x7f0000000400)={0x2, &(0x7f00000002c0)=[{0x5c, 0x0, 0x0, 0x7fffffff}, {0x6, 0x5, 0x5, 0x3ff}]}) 2m12.116418979s ago: executing program 3 (id=1223): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESDEC], 0x0) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000140), &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x48, 0x0, @fd, 0x3, {}, 0xa6, 0x3}) io_uring_enter(r1, 0x47f9, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r4, &(0x7f0000000300)=[{0x0, 0x700}, {&(0x7f0000000280)="d7", 0x1}], 0x2) syz_usb_disconnect(r0) 2m9.791419818s ago: executing program 3 (id=1235): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)={0x14, r1, 0x1, 0x0, 0xffffffff, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0x30}}, 0x40804) 2m9.487850507s ago: executing program 3 (id=1236): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x19f1cea6c3934239, 0x0) read$dsp(r0, 0x0, 0x4c) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f00000002c0)=0x1) 2m9.335797391s ago: executing program 3 (id=1237): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_DROP_PRIVILEGES(r5, 0x4004551e, &(0x7f0000000000)) ioctl$USBDEVFS_ALLOC_STREAMS(r5, 0x8008551c, &(0x7f0000000340)=ANY=[@ANYBLOB="6cf70000010000008115b8209e1d53fd46f535346a991024230023162a6fcb65e0483b32815bf902032c3999d089c71b9ff714884f2e21a9fd9266549a88366077de087eac0d8408b641a8888a59f6fa0ee23080e1751667283730ba94b078c26ac9253edd199b56d876ae7f85ed2b0c6cfde25988dc226cbc5af011e40c7de06fb96db5fbd1a10ce5b83ecf4451a618fea421992e481e8fb3d9992803c8ab53cc4174dedcee40c1d32aeffe9ef84e2bf18b678d4c9ca1776fe5813159e27500b822e07f6b7fa15a7b4ead6d803b09105effdf05a38e247d2b04316ee55dda657ec87de704000000383533a2c7425ca02fffad457c1240692f9d4b45e8029655d04f92"]) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f0000000040)=@id={0x1e, 0x3, 0x2, {0x4e22}}, 0x10) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xc000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffffff, &(0x7f0000000140)='./file1/file2\x00', 0x1000, 0x0) r7 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file1/file2\x00', 0x2) r8 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_RMFB(r8, 0xc00464af, &(0x7f0000000040)) r9 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r9, &(0x7f00000000c0)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x804}, 0x4) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x1008, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000203010a1fbdd1af29a2b7b101000006080005400089"], 0x1c}, 0x1, 0x0, 0x0, 0xc1}, 0x40d0) r13 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r13, 0x4138ae84, &(0x7f0000000100)={{0x0, 0xdddd1000, 0x10, 0x0, 0x8, 0x2, 0x0, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4}, {0x4, 0x0, 0x0, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x10, 0x2, 0x0, 0x2, 0xff, 0x0, 0x0, 0x0, 0x4, 0x3}, {0xeeee0000, 0x3000, 0x9, 0x0, 0xff, 0x4, 0x0, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, 0x0, 0x10, 0x80}, {0xdddd1000, 0x2000, 0xa, 0x6, 0x0, 0x0, 0x2}, {0x8080000, 0x3000, 0x4, 0x0, 0x0, 0x1, 0x10, 0xa, 0x26}, {0x80ac000}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x0, 0xf0, 0xd, 0x0, 0x0, [0xe, 0x0, 0x1]}) 1m54.170096407s ago: executing program 32 (id=1237): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_DROP_PRIVILEGES(r5, 0x4004551e, &(0x7f0000000000)) ioctl$USBDEVFS_ALLOC_STREAMS(r5, 0x8008551c, &(0x7f0000000340)=ANY=[@ANYBLOB="6cf70000010000008115b8209e1d53fd46f535346a991024230023162a6fcb65e0483b32815bf902032c3999d089c71b9ff714884f2e21a9fd9266549a88366077de087eac0d8408b641a8888a59f6fa0ee23080e1751667283730ba94b078c26ac9253edd199b56d876ae7f85ed2b0c6cfde25988dc226cbc5af011e40c7de06fb96db5fbd1a10ce5b83ecf4451a618fea421992e481e8fb3d9992803c8ab53cc4174dedcee40c1d32aeffe9ef84e2bf18b678d4c9ca1776fe5813159e27500b822e07f6b7fa15a7b4ead6d803b09105effdf05a38e247d2b04316ee55dda657ec87de704000000383533a2c7425ca02fffad457c1240692f9d4b45e8029655d04f92"]) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f0000000040)=@id={0x1e, 0x3, 0x2, {0x4e22}}, 0x10) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xc000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffffff, &(0x7f0000000140)='./file1/file2\x00', 0x1000, 0x0) r7 = landlock_create_ruleset(&(0x7f00000002c0)={0x2001}, 0x18, 0x0) landlock_restrict_self(r7, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file1/file2\x00', 0x2) r8 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_RMFB(r8, 0xc00464af, &(0x7f0000000040)) r9 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r9, &(0x7f00000000c0)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x804}, 0x4) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x1008, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000203010a1fbdd1af29a2b7b101000006080005400089"], 0x1c}, 0x1, 0x0, 0x0, 0xc1}, 0x40d0) r13 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r13, 0x4138ae84, &(0x7f0000000100)={{0x0, 0xdddd1000, 0x10, 0x0, 0x8, 0x2, 0x0, 0x2, 0x0, 0x8, 0x9, 0x10}, {0xffff1000, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4}, {0x4, 0x0, 0x0, 0x0, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xd000, 0x10, 0x2, 0x0, 0x2, 0xff, 0x0, 0x0, 0x0, 0x4, 0x3}, {0xeeee0000, 0x3000, 0x9, 0x0, 0xff, 0x4, 0x0, 0xe, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, 0x0, 0x10, 0x80}, {0xdddd1000, 0x2000, 0xa, 0x6, 0x0, 0x0, 0x2}, {0x8080000, 0x3000, 0x4, 0x0, 0x0, 0x1, 0x10, 0xa, 0x26}, {0x80ac000}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x0, 0xf0, 0xd, 0x0, 0x0, [0xe, 0x0, 0x1]}) 20.352144943s ago: executing program 2 (id=1708): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, &(0x7f0000000940)=ANY=[@ANYBLOB="400f01"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) syz_usb_control_io$printer(r0, &(0x7f0000000200)={0xc, &(0x7f0000000040)={0x20, 0x22, 0xb4, {0xb4, 0xf, "0d730a354ec98af00a1e9a53062aac231cb352b8d841920155805c9d0cf96395af2dd8b92be1283024ca20b3614c42c74589d5941a7200bb00a83be698f5c88d5fada06014e5a21c60e84fc1187755bf6223796ff81d46160076f63229f6fccb2e485dd5f543b7d01c3125299c9e1c65086fbbd144ede156d565a01049dab21f948b394c7b18902d3a5eac87357d0bfc371952c35af85e379a1162fec761ebd32678630cbcba89db3109561b124986aa4e41"}}, &(0x7f0000000100)={0x0, 0x3, 0xc7, @string={0xc7, 0x3, "675079b80a3e1b3fc257781d360f6bf77a7c41cc5527407b4fc036446031a601c0cfd2a0a27dd523ec61713a2e9870d6364641ac85ac7f2a60967884a917ee0c3c4ab154c25006320f0c397ced2aa1b3c572a640047f45f38db907b0684712181e467be759c0e023b7509b97f7a6fd16cc54fc43f6ee0083a5245b879c44e9cfc3d86492aaaedf21e0643420febf50919e28d164d83936948cef3ac09c7b6d5594bc14d6c78416f3ae3e5cda4cd6f7503f83819e718e5a4721afabf3562ae4849671792f40"}}}, &(0x7f0000000500)={0x1c, &(0x7f00000002c0)={0x0, 0x15, 0x80, "13c661b7c74bb71c3b0d4fac9c6437108541f2fed85965b1c820f05907832da6f044ae8eee58bfe57bb83c9d911c5aee8358059b204299021c2b36075ba34bdc22f0027a673381e5c0a3af43c8be46cecc4e8c92f41e59beab6411b41c48b3ed40c3a83a9bd004903ca9438020741dcae7ee639e4c1d060d4e83d93546f98bde"}, &(0x7f0000000380)={0x0, 0xa, 0x1}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000440)={0x20, 0x0, 0xa, {0x8, "f6c4c24d552f13fc"}}, &(0x7f0000000480)={0x20, 0x1, 0x1, 0x40}, &(0x7f00000004c0)={0x20, 0x0, 0x1, 0x5}}) geteuid() syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000240)={0x2c, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000003c0)={0x1c, &(0x7f0000000280)={0x0, 0x6}, 0x0, 0x0}) 15.392885999s ago: executing program 2 (id=1722): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0x2c}, 0x1, 0x0, 0x0, 0x24044000}, 0x4044014) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x14) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000480)={{0x7, 0x0, 0xfffc, 0x805}, 'syz0\x00', 0x40}) ioctl$UI_DEV_CREATE(r0, 0x5501) syz_usb_connect(0x0, 0x2d, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000005aea7204e08011099bf0002030109021b00010000000009040000014466790009050db7"], 0x0) write$input_event(r0, &(0x7f0000000000)={{0x77359400}, 0x15}, 0xfe4f) r1 = openat$sequencer(0xffffff9c, &(0x7f0000000000), 0x20800, 0x0) ioctl$SNDCTL_SEQ_THRESHOLD(r1, 0x4004510d, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r3 = memfd_create(&(0x7f0000000640)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\'5\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\x05\x00\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x0, &(0x7f0000000040)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r6 = syz_open_dev$vim2m(&(0x7f0000000100), 0x5, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x2695, 0x1, 0x1, 0x0, 0x6}) ioctl$vim2m_VIDIOC_STREAMOFF(r6, 0x40045612, &(0x7f0000000000)=0x1) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b00)=ANY=[@ANYBLOB="240000001a00010000050000000000001c000000000000000000000008000100000001"], 0x24}}, 0x0) 12.728523589s ago: executing program 5 (id=1738): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1b96, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(0xffffffffffffffff, 0xc0709411, &(0x7f00000002c0)={{0x0, 0xff, 0x7, 0x7f, 0xc98f, 0x6, 0x5, 0xceb6, 0x6, 0x2, 0xd, 0x7, 0xc0, 0x40, 0x49ce}, 0x8, [0x0]}) lsetxattr$security_ima(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), &(0x7f0000000240)=@v1={0x2, "bf8c"}, 0x3, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$kcm(0x2, 0xa, 0x2) write$tun(r3, &(0x7f00000005c0)=ANY=[], 0x4e) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000380)={{0x3, 0x81}, 'port0\x00', 0x41, 0x20010, 0x2, 0x1ff, 0x8000, 0xfffffffe, 0x8, 0x0, 0x4, 0xf4}) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x3a, 0x301, 0x70bd25, 0xfffffffc, {0x7}}, 0x14}}, 0x0) r5 = openat$nvme_fabrics(0xffffff9c, &(0x7f0000000000), 0x80081, 0x0) write$uinput_user_dev(r5, &(0x7f0000000840)={'syz0\x00', {0x1, 0x8000, 0x9, 0x2}, 0x40, [0x10, 0x8000, 0x7, 0x7, 0xffcf, 0x7, 0x8, 0x1ff, 0xe95ab6b, 0x1, 0x4cc59373, 0x0, 0x8001, 0x1, 0x6, 0x8000, 0x4, 0x1, 0x2, 0x6, 0x3, 0x4, 0x10000, 0x0, 0x4e3, 0x1, 0x7fff, 0x5, 0x0, 0x2, 0x1, 0xe, 0x8000, 0x1, 0x9d, 0x80, 0x7, 0x3, 0xbc49, 0x696, 0x8000, 0x1, 0xb, 0x7, 0x7, 0x7, 0x2, 0x3, 0x3, 0xff, 0x1, 0x4, 0x5, 0xffffffff, 0x0, 0x8, 0x7ff, 0x4, 0x8, 0xffffffff, 0x3, 0x100, 0x5, 0xb], [0x7, 0x9d2, 0x80000001, 0x800, 0x7, 0x9, 0x7, 0x8, 0x5, 0x80000001, 0x80008, 0x40, 0x9, 0x8, 0x80000001, 0x4, 0x0, 0xd, 0xfffffff7, 0x3, 0x0, 0x2, 0x2, 0x3, 0xb, 0x66fe, 0x6, 0x5, 0xe03, 0x3ff, 0x10004, 0xfffffc00, 0x1, 0x4, 0x3ff, 0x3, 0x7f, 0x3, 0xd08, 0x1, 0x1, 0x22, 0xfc000000, 0x0, 0x1, 0x4, 0xe37, 0x3, 0x0, 0x1, 0xe8, 0xffff8000, 0x2, 0xb, 0xd7a8, 0x6, 0xbdc, 0x3e6, 0x2, 0x9, 0x0, 0x8, 0x7fffffff, 0x6], [0x1, 0x9, 0x7, 0x590, 0x10000000, 0xb0, 0x8, 0x5, 0x2, 0x4, 0x6, 0x7, 0x3, 0x3, 0x4, 0xe, 0x8001, 0x1, 0x0, 0x9, 0x200, 0xbf1c, 0x79fc, 0x1, 0xf9, 0xffffff26, 0x0, 0xfffffff7, 0x9, 0x1, 0x7, 0x2, 0x8000, 0x10, 0x5, 0x3, 0x1, 0x10, 0xb8, 0x6, 0xec5f, 0x8001, 0x7fffffff, 0x1b9, 0x8a7, 0x1, 0x8, 0x3, 0x1, 0x1, 0x4, 0x3, 0x74da, 0xec9, 0x140, 0x6, 0x3, 0x6, 0xace, 0x7fff, 0xa, 0x86c, 0x7, 0x1], [0x0, 0x20f, 0x80000001, 0x200, 0x0, 0x3, 0xb, 0x2, 0xffff, 0x4, 0x9, 0x80000000, 0xffff, 0xb7, 0x3a1, 0xfffffff1, 0xffff, 0xc, 0x8000, 0xfffffffe, 0x9, 0x3ff, 0x1, 0xdf76, 0x63, 0xa, 0x7f, 0x100, 0x40, 0x3, 0x2, 0x8, 0x8, 0x7, 0x4, 0x2170, 0x0, 0x2, 0x6b2, 0x9, 0xcd5e, 0x59, 0x9, 0x6, 0x6, 0x6, 0x5, 0x1, 0x0, 0x4, 0x9, 0x6, 0x1, 0x6, 0x2, 0x3, 0x9, 0xfff, 0x5, 0x3, 0x8, 0x1, 0x5, 0x6]}, 0x45c) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_emit_ethernet(0x6a, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x48814) bpf$MAP_CREATE(0x0, 0x0, 0x50) r6 = openat$procfs(0xffffff9c, &(0x7f0000000040)='/proc/sysvipc/shm\x00', 0x0, 0x0) preadv(r6, &(0x7f0000003240)=[{0x0}, {&(0x7f0000002100)=""/4096, 0x1000}], 0x2, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) close(r7) execveat$binfmt(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000000100)={[&(0x7f00000000c0)='=\x8d5\x10\xe4\x00\bj\xfb', &(0x7f0000000080)='=\x8d5\x10\xe4\x00\bj\xfb']}) 12.608747214s ago: executing program 2 (id=1739): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x4, 0xa, 0x0, 0x0, 0x2f}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x7fffffffffffffff, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) socket$nl_xfrm(0x10, 0x3, 0x6) unshare(0x22020600) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r1, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x231, &(0x7f0000000080)={0x0, 0xe654, 0x10, 0x1, 0x80400}, 0x0, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @hyper}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x1f, &(0x7f0000000000)=[r1], 0x1) 12.447753056s ago: executing program 2 (id=1741): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmsg$unix(r1, &(0x7f0000000480)={&(0x7f00000005c0), 0x6e, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000240)=""/22, 0x16}, {&(0x7f00000002c0)=""/40, 0x28}], 0x3, &(0x7f00000004c0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0xc}}], 0xb8}, 0x10000) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x7fff, 0x0, 0x3, 0x0, 0x8001, 0xfa11, 0x9}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="0122094900005200", @ANYRES16=r3, @ANYBLOB="01002bbd7000fedbdf2506000000140008007866726d30000000"], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x800) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket(0x400000000010, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) r6 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000300)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x41100, 0x41}, 0x94) io_uring_enter(r6, 0x48e9, 0x0, 0x2, 0x0, 0x0) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) 11.521147902s ago: executing program 2 (id=1743): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x6, 0xa, 0x0, 0x9}) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r0, 0x40043311, 0x0) ioctl$SNAPSHOT_CREATE_IMAGE(r0, 0x40043311, &(0x7f0000000000)) ioctl$SNAPSHOT_UNFREEZE(r0, 0x3302) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x6, 0xa, 0x0, 0x9}) (async) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) (async) ioctl$SNAPSHOT_CREATE_IMAGE(r0, 0x40043311, 0x0) (async) ioctl$SNAPSHOT_CREATE_IMAGE(r0, 0x40043311, &(0x7f0000000000)) (async) ioctl$SNAPSHOT_UNFREEZE(r0, 0x3302) (async) 8.993206907s ago: executing program 0 (id=1750): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x804525, 0x1000, 0x2, 0x12d}, &(0x7f0000000440)=0x0, &(0x7f0000000640)=0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x22d0, 0x20, 0x7000000, 0x0, 0x0) 7.875339422s ago: executing program 0 (id=1754): socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1802"], 0x0, 0x4, 0x0, 0x0, 0x41100}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000480)='memory.numa_stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000300)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000003000008000000180001801400020073797a5f74756e00000000000000000010000280040001000808038004000180f46fb32b045848b70c51070e122727ae8a6fd329ebaa3166e4232909e91a8804439be77c98a015cf33e1b35a0dfd250ff2982fcd4f23ceada823866ee3aec91182ae27d877031c22c238885d058264c15af66878a89d571abb600d31c3c9b6c4f3390597a0bc711189cbf49ab50b90e1eb340004ae63b46b"], 0x3c}}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r3 = shmget$private(0x0, 0x3000, 0x0, &(0x7f0000001000/0x3000)=nil) shmctl$IPC_INFO(r3, 0x3, &(0x7f0000000140)=""/243) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x60600) syz_clone(0x1940380, 0x0, 0x0, 0x0, 0x0, 0x0) unshare(0x68040200) 7.568459755s ago: executing program 5 (id=1756): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x2040400) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000180)=ANY=[], 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000140), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) r4 = syz_io_uring_setup(0x118d, &(0x7f00000000c0)={0x0, 0xd00d, 0x0, 0xffffffff, 0x25e}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) epoll_create1(0x80000) openat(0xffffffffffffff9c, &(0x7f0000000400)='./bus\x00', 0x1c5042, 0x12) syz_open_procfs(0x0, &(0x7f0000000000)='mountinfo\x00') syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x80000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x5, r3, 0x0, 0x0, 0x0, 0x80000}) io_uring_enter(r4, 0x47f5, 0x1000000, 0x0, 0x0, 0x0) 7.388291611s ago: executing program 0 (id=1757): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x20040010) bind$alg(0xffffffffffffffff, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2c0c2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xe) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, r0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) readlinkat(r4, &(0x7f0000000140)='./mnt\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x4}, [@FRA_FLOW={0x8, 0xb, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40480d4}, 0x20) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB='(\x00\x00\x00'], 0x28}}, 0x0) 5.884305392s ago: executing program 0 (id=1760): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r0, 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$int_in(r1, 0x5452, &(0x7f00000000c0)=0x3) sendto$inet6(r1, 0x0, 0x0, 0x24040014, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) syz_usb_control_io$uac1(r2, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000700)={0x40, 0x38, 0x1, "8e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x8000) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) ioctl$I2C_SMBUS(r3, 0x720, &(0x7f0000000180)={0x1, 0x9, 0x7, 0x0}) 4.764428108s ago: executing program 4 (id=1761): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(0x0, r3) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0) writev(0xffffffffffffffff, &(0x7f00000012c0)=[{0x0}], 0x1) r5 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x89f0, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_SET(r3, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a1", 0xa}], 0x1}, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0xf000) arch_prctl$ARCH_GET_XCOMP_PERM(0x1022, 0x0) 4.630431592s ago: executing program 4 (id=1762): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0xff, 0x0, 0x0, 0x0, @time={0x5, 0x2}, {0x2, 0xfc}, {0x0, 0x3}, @time=@time={0x5, 0x3}}, {0xc3, 0x0, 0x80, 0x3, @time={0x4, 0xffff}, {0x0, 0x32}, {}, @connect={{0x4, 0x8}, {0x2, 0x3}}}], 0x38) readv(r1, &(0x7f0000000000)=[{&(0x7f0000001140)=""/136, 0x88}], 0x1) r2 = io_uring_setup(0x2f00, &(0x7f000000c480)={0x0, 0xe8e2, 0x400, 0x20001, 0x2d6}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000040)=[{0x0}, {0x0}], 0x2) r3 = io_uring_setup(0x7625, 0x0) r4 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) r5 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCSWINSZ(r5, 0x5414, &(0x7f0000000000)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0xa, &(0x7f0000000140)=0x7, 0x54) setsockopt$inet6_tcp_int(r6, 0x6, 0xa, &(0x7f0000000000)=0x2, 0x4) write$6lowpan_control(r4, &(0x7f00000000c0)='connect aa:aa:aa:aa:aa:11 1', 0xa) io_uring_register$IORING_REGISTER_FILES(r3, 0x1e, &(0x7f0000000000)=[r2], 0x1) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = syz_clone(0x100000, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f0000001040)={&(0x7f0000000040), 0xc, &(0x7f0000000e00)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="102000001d0002002cbd701ffcdbdf25"], 0x10}], 0x1, &(0x7f0000001000)=[@cred={{0x18, 0x1, 0x2, {r8}}}], 0x18}, 0x4000000) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r10, &(0x7f00000002c0)="9e", 0x1, 0x841, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback, 0xe}, 0xfe41) bind$inet6(r7, &(0x7f00000000c0)={0xa, 0x4e22, 0x3, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) listen(r7, 0x0) shmget$private(0x0, 0x4000, 0x54000000, &(0x7f000052f000/0x4000)=nil) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x3, {0x7, 0x29, 0x3c, 0x2100039, 0x0, 0x0, 0x1, 0x57, 0x0, 0x0, 0x80}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_SETFSLABEL(r6, 0x41009432, &(0x7f0000000300)="6a2cc744b05a1e7177c43bd2271a33f7afb41a03aaf0a3955e1bb1ee1e8d87e0b41053ec13a3811e3510b518775b07272dde266125893bc237c8a3abf23a326c6e1f2e0aa0d6f7dfb6cc384389f0385302a777ee250130af40e8b97086b248a2531edf84d35f446715d89263c77df75ffa6a586591442e16fc8d760e56f069a8251cb8c210501b16c870e806a088a357d7e0bbc22ed3384a2ede70dc76e0d23fdb2ca7cd05ddf9b9f0c9a870cfdf3687b940773659c001217f2c535482c46dd1bdeaf9a156a9478f559b2cea50fbac4ecfd341e097568a4074a5ae5f879fad875e46e215b07d529bb577683fada2a4e9ad4cc199a1df8259b409de0446486a90") syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') 4.563099566s ago: executing program 4 (id=1763): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x21800, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) read$FUSE(r4, 0x0, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-256\x00'}, 0x58) accept4(r5, 0x0, 0x0, 0x800) socket$nl_route(0x10, 0x3, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(0xffffffffffffffff, 0x110, 0x5, 0x0, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x11}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x7, 0x8) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000040)={0xa, 0x8b}, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc00000500000100cc43d4eed3d20207452a2c000000000000000020010000000000000000000000000000ac1414aa0000000000000000000000000000021a00", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a0000000000000000000000804000000000000000000800000000000000000000000044000500ac1414aa000000000000000000000000000000003c00000000000000ffffffff00000000000000000000000000000000000300"/176], 0xfc}}, 0x0) 4.444138669s ago: executing program 5 (id=1764): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x97297e0da74c80ce) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x0, 0x240480c1) semget$private(0x0, 0x6, 0x3b1) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_int(r3, 0x0, 0x2, &(0x7f0000000140)=0x3, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0xfffffffe, 0x0, 0xd, 0x400009, 0x8, 0xa}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f000000b640), 0x0, 0x40) r4 = socket$can_raw(0x1d, 0x3, 0x1) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000340)=@o_path={&(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x4000, r1}, 0x18) r5 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00c000c6bec75811687913a1288705acf7da1231eb8425b5976fbd7798fa075fbed62bfc2da50440a2", @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x10a000, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_TID_CONFIG(r6, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r4, &(0x7f0000000000)={0x1d, r7}, 0x10) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f00000000c0), 0xf00) bind$can_raw(r4, &(0x7f0000000080), 0x10) 4.347801085s ago: executing program 0 (id=1765): fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0100000001000000040000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000010000000000000000c339b22d06472c89d5d4487f677c05f8a0db0f2511c2d865bde7016fb7b706a59151cb4003710fae610b1344e2094727c2019ef8e3da507853dbe4465f886f3e8c6ed9b0eeaf64bb5043a76c687cdad13a51f83cabe819fce220ebc983ee648aaeb1de1baa75ba0c61ef3c7b465f712ef0c80c3a3b7153c871ea637215"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000006b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fchdir(0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000980)=ANY=[@ANYBLOB="1c0000001a00010028bd7000fedbf90f8180800000928109ab000100"], 0x1c}, 0x1, 0x0, 0x0, 0x44}, 0xc8c4) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000080)) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa07, &(0x7f0000000280)={{&(0x7f0000ffc000/0x1000)=nil, 0x1000}}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) unshare(0x4a050180) r5 = syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x101121) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000180), &(0x7f0000000240)=0x4) syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000180)=ANY=[], 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_dev$sndmidi(&(0x7f0000000140), 0x2, 0x141101) r8 = dup(r7) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0x1) syz_io_uring_setup(0x118d, &(0x7f00000000c0)={0x0, 0xd00d, 0x20, 0xffffffff, 0x25f}, &(0x7f00000003c0)=0x0, &(0x7f0000000200)=0x0) epoll_create1(0x80000) openat(0xffffffffffffff9c, &(0x7f0000000400)='./bus\x00', 0x1c5042, 0x12) syz_open_procfs(0x0, &(0x7f0000000000)='mountinfo\x00') syz_open_dev$sndpcmc(0x0, 0x0, 0x80000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x10c, &(0x7f0000000080)=0xc45, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x5, r8, 0x0, 0x0, 0x0, 0x80000}) 3.974342457s ago: executing program 5 (id=1766): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) recvmsg$unix(r1, &(0x7f0000000480)={&(0x7f00000005c0), 0x6e, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000240)=""/22, 0x16}, {&(0x7f00000002c0)=""/40, 0x28}], 0x3, &(0x7f00000004c0)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x18}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0xc}}], 0xb8}, 0x10000) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x7fff, 0x0, 0x3, 0x0, 0x8001, 0xfa11, 0x9}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="0122094900005200", @ANYRES16=r3, @ANYBLOB="01002bbd7000fedbdf2506000000140008007866726d30000000"], 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x800) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket(0x400000000010, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) r6 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000300)=ANY=[], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x41100, 0x41}, 0x94) io_uring_enter(r6, 0x48e9, 0x0, 0x2, 0x0, 0x0) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) 3.473247598s ago: executing program 1 (id=1767): r0 = socket(0x1e, 0x4, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) unshare(0x20000400) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$rtc(0xffffff9c, &(0x7f00000000c0), 0xc0400, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0xffffffffffffffff}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x68, r2, 0x1, 0x0, 0x25dfdbfe, {}, [@WGDEVICE_A_PEERS={0x40, 0x8, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e23, @loopback}}]}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg1\x00'}]}, 0x68}, 0x1, 0x0, 0x0, 0x4085}, 0x40000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000340)=0x40000000, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c) recvfrom(r4, 0x0, 0x0, 0x6667b9fe4a5fca0, 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a48000000060a0b160000000000000000020000081c00048018000191080001006e617400"], 0x70}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x8, 0x0, 0xffffffff}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) r7 = openat$hwrng(0xffffff9c, &(0x7f00000001c0), 0x800, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) r9 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=r7, @ANYBLOB="0000f90000000000000000000000000098440000", @ANYRES32=r8, @ANYRES32=r9, @ANYBLOB="020000000100"/28], 0x50) sendmsg$TIPC_CMD_SET_NODE_ADDR(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r6, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000080}, 0x8000) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) 3.027748136s ago: executing program 1 (id=1768): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file1\x00'}) pwritev2(r1, &(0x7f0000001580)=[{&(0x7f0000000340)="a4317bacc29a5d8539c5a0581c3887bf195a4f50dc4d3558949e916bec3e91ccb989599267caccf9ca3a53edd2d7f77efce388aa6cdac218d040dbbb9d8752ee809bb7eec65aece77760024cfd169a887f1822170363c1c51f201dbc1a75cdc8a8015033ec6a7312dca55337182de0c9403b757cd66a15658859b33b9618c2fb9632ae41935d74ca56b1ca47ce107168e4ffc0dcd26fdc7467b9e3f1ddc19c0079e0e3bb2fc41802dbc54d4680b833b9702b3501b58a6e6a57daf8ed65b3b85f91b029e3a9d77228e6d8beeccb8fd6424064bda8400b4caf8b018c1e8e860a3f413c2d04bbcb3754fb08300339b6d939e2bf7f7ae544bd8452dd2a8f7e16fb", 0xff}, {&(0x7f0000000440)="28a14d50d89129a5e08dc146fb4a40a50d3a501a33baff7623956f97f091751fb95c90d9e9c96a42535fd8707dd2b063c12817e8b50ba5", 0x37}, {&(0x7f0000000480)="a65e91b165cf293822c73802a44dfc99c9044a3ed04cd419fa1d1f8cd596878dec92e1a737a3b8a5ea6fc2d4c0f93f56b0218647ea6f74bb4bedb44aaedd814fd81882ab9a95df89e5035f788f9c158405ab855e95f681c3b9e51fb1ba4d45404f0c1ed1ea5c1fc88cced5c07e7db6c6f90ffec39df48ae3b9c77ffaf6e7d8743ba643cd7b17977747eccc6732f261837f889d8e682f909406c435e35f7af55075e73505fa549216e8ce2fcac86f07bec105d11c03e29c12ef1b122f251ba19aa3bb4b2d906a324387243722bc78f10726a47daf953d73e7167b93b069609e9797bad3c5f784ea0fde64bbd41ce9ef3e58ab10de160957b6e3f33d4114d8178b7600999348826f0e53a593010dc5f18153b8ef9e50dafa8099a067dce8032dde618003ef704bf997b357a2585176efa3c67452fa0186f495f220c8567351652b9541ee40d04302db8517e67f8402cb5326d0967e8e23404b64a81c2fb86b57b30c579905f94ce5471da6cd9611bc9a4357ea959de90d74222c4d93f4e09c3ad13cc7d7a7c4ed28774e2cd95ca04a1ff1a21b708308f1946ee15d5254c0e52ef89b418433c1177124f17b8e8b952ac1c360e64f1a05ba306485c5439784ac60e57f5d064bfde69dccd6081dedf573622153d675bb59c56ce7cdf68f8efdb46556bade040f5fbf201dbe88a47a89274d69266dfc132ab42c2a1a2b1446d6a9087dc463eb521a430e12811b47384a44db5142503a7b52c7fc54531029e5df385470974e537cd6797c47d071329181c991ef245cca44947e8649b1e711a1cf740b5e3bb605c81abbe3856fdcea3299c6b03d9c13149ea3926c1ac43b238c81048c71b2b782fc4eb85b62129cabc07db50421b757966a52ce65df643d32a32d984a86d53891cc41a2b25e92ee2253ee1ff2ebf2c20ec21739a9736502778839219af70a24c60a19e77a7a7241d5e2f1d66a33a321a0192942da2b09112c48d9da6a11d07eb73a762482bd325a85c2153a725af47e21a43f88ca5793550214d4cee79dc897a4f1d2f13db4d49a5dc1815e38e5df576d6d3ef05327e2f36c04f47e77c2505c73f668bccb15f949f5dcb5dd67c982967fee34b755fd2d934a6d54ecdf7e0d8d7dcbe6840a84798b32e65dd03f7b1515fde9b94a6192c364229cf21f6028a9f822c2c97e8d64ae6dbc2e8bbeb3640a4b951bd17171c678ac1efe0ab152273e35a65c2113a1bfbf573c30517285df2aa256d3d64839f4037a7894c4ab9365a1bb4607b54b661937079583191c3b10fb283393523637a57f5a4596a4534b882de002df0519142e8b4b82fb8b0575c1c8a0a3552d5a33de228e718d4e4889768b3d279a660e89f8d1d7a73d05731dc1fb661ca147ea46ae0ac64f655e500bae21cc26e69267ff18846db2a35ff4bf89b8381aade2665f1e1127ef1ea7b056d427638a2e85b01445a2707f012eb642d8a9a07778b1992050db3ce1798816c2e72789e17cd4d2842c054b8140e0b60e33558248d790536cd77a09192f9ac326fa5a19245ca8da671f1a67dfabc340898796a60b4c77f6a8a88fc2b392d8933b78c7f59eb05fe083f3e1bfe56843e602947779b1f9231e67f4d0e93d1b69a6e31d2e7e1e2c4c53900966360bfa5d559ab8c26c00db853c94170149a964f8257b76c700f14d4f36bba781698cde5d5591e89b427fa6717234d96aaed80300177728794a9cf10e89bc457bce4fee43536941ce22a77968ccedee35047ad4d54ffaf3f98c325e43fa49d99c2d1a3e85513cfe71308e3d1f3bdb641bfbf6ecc5f9ebc9ae7f4334945de0d160e609e0f412e4f9f5c77db3715fdb1d56ceb958dc98c7135760daed9d335653ab60fff7b4fb70b765482d21049f2a1882085f560ec854d6cafa731bc8cd074172d7ca9b8ed3a80651c786634dfc014913876cd32a3b02dae40a9d7408420ca1f2859f696f3f5dbe0e47e4d368b5ddb1872c2c395523641021f544977e2da2e17f03cf9beba921f8332b67d776aee5536e88d2fe1abe7e44b0e52ec95a13a04384be773422ac8a86c25c1cc2bec1fc3354a0679790af7dcf1d429ea0b91232f431a6df297586f7a1cacf1d733a477dc0bff3631399d6b80bfc15295dc4cee525f5cb8893f11160f51c2c2085947ba0c834e1c3bf92d1d969de73109457346a66b09df781f13bbab46a51d5708ec73c035fd17458297d886f361d61e3c2fb58adf5fd0bbecbfa5ac279730122d8e3e26119fbc65d47c0aa92838b2ec08904b7ae8534acbe4ace520d0fe5a7568227ec196861f5724ce5a8cf69dbf60b136141a4ba92899a8a6c14ab7a5b834e0e2993e7ded3ff287f32268447f0c4b9a5ece1e3fc086c0df06356ba936accd4eaea051cea99326a5e12a37c1157880fb2dece00bb4d33963ea34515eabc31a6bf03bb300538504fc85e24527c600c7ca342b4def33909ab7d9343f549ce3bc1be210702dd6ec249d059a3251fe9fb6ac6cb51e3f6cbedc069348f7b77fcf1af9959e6e76e9f3081b96c8827f60d796fbb4f232231c0c0211423b974ab5d1a81068b0dd41588a0f799686334fe0743e3fa4b0db7d2aec0b7ab93be5791de96caafb0e98eb16fd2e10ec5ed534facd1451c21bd7f8f33394bae83be1bc311c94efc6468d3a97b2071b83698008c52193cb463f94d007242e98430df9d97e78f676bee7f977273eb653351806b0c55492082657c3f47ddcab424f0e98ccd7512c958d00463ec5c5f7bd5443a21b5068594a2f22c77f3b535c13e0718f44398bad50bb328e18727215dd2417d291f87303ae8cba5adb6a5a1c08f251c33996033743181f33b0a20725ecee2a365ea8d66b9ef60028605ac09aef2f251d75187c07218ac1fbf6cc9c9077ee7783f60a6c64bc33a9c6ba5e5d3532d43f24a8412d03831b88377c2995850d092f3d7b74afed39439803e7bf4b2167d900a2e031b7a7e2b770bccab35c2598e639ebb6cbb3b5b9895d5df593a03c3f26ebb0a806f3266c1bceaf16153f2cb1d88ed9d8fd3a6208266cb1871a0fd11ad72ea025262c3a804f067581e75ca6c670d9f15bbf8cb5262c49c74957e32b65f8d14f9df0e77210465c7963a0d3b1274ce826c18fc359bcd107e8a98981aaa49275149065c5d07bc8f0c95d9e82781a6e6d782d03aa4cd364d57e27411c2abcae6edf785a2d63f637cb38481b5cd20f2b6a964235d19d9611364f044772d62c1259d36cfb76251a4f47dec20381768c0966e632ed9967250e6acda0c9f6007abc4fc62fb924c854f7e6ba2a3f6359cb151956eaa908e737ae59676b0cb44d5e314873ca5f20cbdf49c3b5dad3d3d836f21b62917ff8641497c5b029898f62b8e1ddf16b85d6ad4b47f7d437e89bbbc2f7b95b117fadfedb6e5de1bb2227407efd6fd99fba955adac8f3be0a11198967910a7e8099645bdf311a73907de2d76ff266431f451c27a024c524de36860407c4de163a6b1549343c1e456ca7459ea9632ea467ee14a310036e42806b80ad2e0e128de9b2098116bb5dc0d071cd2acb185846f6a60a210bcb6e5ca565f76f5fc4a52f94ccec258a4e0bcfa614c69f111dc4277d9352772a96677514ca3f203a6fb46523d544b0444d06c70a155f95570d98bb2fce9afa22679c834022dfd324828ee1cea2ccc3551f42c214745b6c4c1cd842fcfde05c0f46e21a197232912b7877972c90cacfb1ef722410ab7eb3075c1f807b1d8719eed683bc8cb61a07513065d40bd7ea92d0e51ea222852dde80022c519c4e73310a6395ca0b50a72459ae2adb4e4f97deae62cceb7d554281627833faa0484147135fede536fca38bbda9ee1d1ec2fac5b10d72cac88e62b53ae375762d3d81715502db345a9bd40767284d079192501cc98cb4e55c803cab745cbe37a405fc89c01d20dfa82d28839b9509b3f6735b205d4582a7b488916d68310443107c4f0c7be6b77f7089d5fdec094495a730fd1f48328f00fe9674d3b2bf8454cae9a5c079351654559c9d69f3b485c5beda0b7e6ef7e5c3c45c5d8c819352073bfc06b30b10478aed71566a97a6b31a88de9b867d3595f6519c585eb3754bd49292b5d50ef9be342792120acc6e42427e1474bc2859a4348672c694c39106858d20904f8ac79f38e195eee8e3a959170aa535baef63db00d6cf9df5659211f53a6f0b7718622897bf512d79837dead56a98ac65eed910076ec65f6c6d9b9b49a2e570361da8d1aab3543a35bce44e96f5db3c6cdfb2e4965671dc5304c6f1ecb236ed2ad5cd4acf067619a44c8ecb3ed10861cbbaea90b15d9b048875f1e828f902ab0b55227a60ee3a8c992236474eae25c573388a2c1416b6187f511aadac83cbd41d12a6750f6c8f4392e1d53d7e06d47acc7bd705e6d612c758725bfb7c6bc8fb1739cd548b29cbcbad5136b2f6d4282190f116dffdafb41077786bde20bdeb45b61cd4baaac090bc82ce67ea6fa9e7430a2215b0c8598737790865196201090ea713b4dce4675655fb275272d53859f3f56ecd99b3bd3d022b05cbfc4604eb0134f1c17de4730950c97ded394e96052ebd568a8639432e1424c5930e55e2e1b29b4c62959ccd78dda09cc36fa7218d88412b2c5b043fd122ca37e935ead5690c46c0657cffe6fda625f13fa2302c5a058b8da2a8c81448f77c2c80796b87225f752ba8cfd7adf126c222541ef6ebe3d86c08c7ed32ff40ffc78ca7bc647c3f972a7613be86bfeacd7f979e124f3ed3d8ada9d79bc19fa92ac7ff900ce174035e4ad99cb6ae140ea662fd8c0fe1ffc6f9486ccc650913cb2923ee6579c37313249d77b886407775a1fc70bcf18551aafa8df8abd5a94135747f4252bcb5595fa7cc4f386a1664f6e13b2d9e3ad83c1c776daef978a130b4e2e78e8959bec13f0d0f15b658772513a7a9d1b8e6752490617e7a97c7df80cb58044eb9b1dbd15bea3db714cebddb6528e08317e57c7a679ddaf4e0a71c1f941d9131a358fcc7c1dd0318ca654caa1eca167380f030900b23ebaa9b6643bf74f31bc81324ecaf27c12deda64a681941b27afa0765e40433883e5e3bb02e9e0d5d845dcdadb1ec5c29e604ea7290972986acabdb4ea24fa89c76dd6aaa15088c4dc246997ac4862bfebe7ae4a6a237a95d6756badeedf9e5cf19257a5e044918971c54d5b4f8f4aac25e6ad73d4333a0645b6a25b427f938965d2793dcad069ff4f3172e59754135c80d346dab422894d856448fc0c389c41c2393451f40392c4f6387291aa6913733b13af384a27cfc62341e41703dd6e2d00e25e5a3f82b358b1005afd994506a568e53254288603d5e267c29296bb324560c4367dd284502de3145ac79e685790eb18fd1d51e72658f34e3b4788156cbb73bc0a27e2289ac49cfd26fd6f52b914025bd288fe94d104e60f90151cae1cdd527b873ef8d862d76881df86d48d5b6dec4a0e3c88da76badfa57cd64df4f64ad55126ffea271c9f3be85d1b6141b4bff5cec4a5a9112beb23f01f8c9972e8bb78c6113acbaeb3f2579f7c0266600495afab1e541fc056fdac97073dc90ecdd06db16581a2c942367e103169a205780531c70d62a8c87d41f8c91296d985929e361e4d03f3afb535cc7e6516134c6d81ef5c049f3234edf8f4cff871b0a6d9a8f907d9ffca86da62040a98804e350fb7047c6ac362b7ddd31fbcd07253b4f4af84f2a38de83cdd4ac907938de72bb6af0a534bd8e421f363e0bcf7074b602fce6bdbb087305d3554d1dbe4d6339c053daccf22929a33621461b78c8d4fb9", 0x1000}, {&(0x7f0000001480)="abd74f800a4a5248d2abadd3316cc0b8c3c7731baf2bf0e099ff374d7b07381c3b5580fd811b4fcef9db0ca3c912c67b62f87bc98c14be0674f8612462f3f2799f8429e1a1605da7a5226e568ceefb9a532ab7bc60cadba1f815db43a998877b9266213d00952f428872e35c8fd16c31bb588f8b1561ad003bc41c8d9d8e40720771afb2318d5a666261bfdf3c457e85e568b7276e448caa382c53f5b1a95f134701e5e4c3be5fbe412a4801fa53fe8fa77bae33048c2018a765dbffe2be758a7eb93494cbb62c0492a268c767107582cbcd57b0718963af11049fc6846c78e93fa540db76e5e99b534da2705fd36ae21a13faaf00245995b5f3e7b3", 0xfc}], 0x4, 0xa, 0x50d0, 0x0) syz_io_uring_setup(0x2c12, &(0x7f0000000240)={0x0, 0xd7cd, 0x8, 0x2, 0x178, 0x0, r1}, &(0x7f00000002c0), &(0x7f0000000300)) r2 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) syz_usb_disconnect(r2) r3 = socket$inet_tcp(0x2, 0x1, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a300000000088000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d44001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200010800e000100636f6e6e6c696d69740000000c00028008000140000000000800034000000120"], 0xd0}}, 0x20050800) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x1) syz_usb_control_io$cdc_ncm(r2, &(0x7f00000016c0)={0xc, &(0x7f00000015c0)={0x0, 0x5, 0x9f, {0x9f, 0xc, "689f1785d289ceeefbb4ba75d4bf5fbfd852daa6bd57ba43b6a7b59d965e57265e415c840e37ad1ac0de1cb04a85effa31c7f7bd4497203466da609c2b273b92b3fa47580a329b21a53ac06af6c67ff456cecac0b0f4291d77763b0b314a1108e178e8ef3c97e161fd110daff617287bed59054793d0cfc10666a756e2142817ec33055cd5eeded775c96fdab994c4fe484a07cd72bc1ade8189632864"}}, &(0x7f0000001680)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001940)={0x24, &(0x7f0000001700)={0x40, 0x16, 0x47, "abd0e52f08dac705e3b559bde83cb3cfa9344c984c6c1fb48220d0c725bbeacfbdcbfd41adfecf7477cd01a189039d78aaea82e07400274d3155a518240e0678b26848bac2210e"}, &(0x7f0000001780)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000017c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000001800)={0x20, 0x80, 0x1c, {0x8001, 0x6, 0x4, 0x4, 0xffff, 0x5a4a, 0x6c, 0x6, 0x8, 0xeef, 0xffff, 0x9}}, &(0x7f0000001840)={0x20, 0x85, 0x4, 0x6}, &(0x7f0000001880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000018c0)={0x20, 0x87, 0x2, 0x3a9}, &(0x7f0000001900)={0x20, 0x89, 0x2}}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="320000000000000000000002ffffff77cd84ef0000000061"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000200)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file1\x00'}) (async) pwritev2(r1, &(0x7f0000001580)=[{&(0x7f0000000340)="a4317bacc29a5d8539c5a0581c3887bf195a4f50dc4d3558949e916bec3e91ccb989599267caccf9ca3a53edd2d7f77efce388aa6cdac218d040dbbb9d8752ee809bb7eec65aece77760024cfd169a887f1822170363c1c51f201dbc1a75cdc8a8015033ec6a7312dca55337182de0c9403b757cd66a15658859b33b9618c2fb9632ae41935d74ca56b1ca47ce107168e4ffc0dcd26fdc7467b9e3f1ddc19c0079e0e3bb2fc41802dbc54d4680b833b9702b3501b58a6e6a57daf8ed65b3b85f91b029e3a9d77228e6d8beeccb8fd6424064bda8400b4caf8b018c1e8e860a3f413c2d04bbcb3754fb08300339b6d939e2bf7f7ae544bd8452dd2a8f7e16fb", 0xff}, {&(0x7f0000000440)="28a14d50d89129a5e08dc146fb4a40a50d3a501a33baff7623956f97f091751fb95c90d9e9c96a42535fd8707dd2b063c12817e8b50ba5", 0x37}, {&(0x7f0000000480)="a65e91b165cf293822c73802a44dfc99c9044a3ed04cd419fa1d1f8cd596878dec92e1a737a3b8a5ea6fc2d4c0f93f56b0218647ea6f74bb4bedb44aaedd814fd81882ab9a95df89e5035f788f9c158405ab855e95f681c3b9e51fb1ba4d45404f0c1ed1ea5c1fc88cced5c07e7db6c6f90ffec39df48ae3b9c77ffaf6e7d8743ba643cd7b17977747eccc6732f261837f889d8e682f909406c435e35f7af55075e73505fa549216e8ce2fcac86f07bec105d11c03e29c12ef1b122f251ba19aa3bb4b2d906a324387243722bc78f10726a47daf953d73e7167b93b069609e9797bad3c5f784ea0fde64bbd41ce9ef3e58ab10de160957b6e3f33d4114d8178b7600999348826f0e53a593010dc5f18153b8ef9e50dafa8099a067dce8032dde618003ef704bf997b357a2585176efa3c67452fa0186f495f220c8567351652b9541ee40d04302db8517e67f8402cb5326d0967e8e23404b64a81c2fb86b57b30c579905f94ce5471da6cd9611bc9a4357ea959de90d74222c4d93f4e09c3ad13cc7d7a7c4ed28774e2cd95ca04a1ff1a21b708308f1946ee15d5254c0e52ef89b418433c1177124f17b8e8b952ac1c360e64f1a05ba306485c5439784ac60e57f5d064bfde69dccd6081dedf573622153d675bb59c56ce7cdf68f8efdb46556bade040f5fbf201dbe88a47a89274d69266dfc132ab42c2a1a2b1446d6a9087dc463eb521a430e12811b47384a44db5142503a7b52c7fc54531029e5df385470974e537cd6797c47d071329181c991ef245cca44947e8649b1e711a1cf740b5e3bb605c81abbe3856fdcea3299c6b03d9c13149ea3926c1ac43b238c81048c71b2b782fc4eb85b62129cabc07db50421b757966a52ce65df643d32a32d984a86d53891cc41a2b25e92ee2253ee1ff2ebf2c20ec21739a9736502778839219af70a24c60a19e77a7a7241d5e2f1d66a33a321a0192942da2b09112c48d9da6a11d07eb73a762482bd325a85c2153a725af47e21a43f88ca5793550214d4cee79dc897a4f1d2f13db4d49a5dc1815e38e5df576d6d3ef05327e2f36c04f47e77c2505c73f668bccb15f949f5dcb5dd67c982967fee34b755fd2d934a6d54ecdf7e0d8d7dcbe6840a84798b32e65dd03f7b1515fde9b94a6192c364229cf21f6028a9f822c2c97e8d64ae6dbc2e8bbeb3640a4b951bd17171c678ac1efe0ab152273e35a65c2113a1bfbf573c30517285df2aa256d3d64839f4037a7894c4ab9365a1bb4607b54b661937079583191c3b10fb283393523637a57f5a4596a4534b882de002df0519142e8b4b82fb8b0575c1c8a0a3552d5a33de228e718d4e4889768b3d279a660e89f8d1d7a73d05731dc1fb661ca147ea46ae0ac64f655e500bae21cc26e69267ff18846db2a35ff4bf89b8381aade2665f1e1127ef1ea7b056d427638a2e85b01445a2707f012eb642d8a9a07778b1992050db3ce1798816c2e72789e17cd4d2842c054b8140e0b60e33558248d790536cd77a09192f9ac326fa5a19245ca8da671f1a67dfabc340898796a60b4c77f6a8a88fc2b392d8933b78c7f59eb05fe083f3e1bfe56843e602947779b1f9231e67f4d0e93d1b69a6e31d2e7e1e2c4c53900966360bfa5d559ab8c26c00db853c94170149a964f8257b76c700f14d4f36bba781698cde5d5591e89b427fa6717234d96aaed80300177728794a9cf10e89bc457bce4fee43536941ce22a77968ccedee35047ad4d54ffaf3f98c325e43fa49d99c2d1a3e85513cfe71308e3d1f3bdb641bfbf6ecc5f9ebc9ae7f4334945de0d160e609e0f412e4f9f5c77db3715fdb1d56ceb958dc98c7135760daed9d335653ab60fff7b4fb70b765482d21049f2a1882085f560ec854d6cafa731bc8cd074172d7ca9b8ed3a80651c786634dfc014913876cd32a3b02dae40a9d7408420ca1f2859f696f3f5dbe0e47e4d368b5ddb1872c2c395523641021f544977e2da2e17f03cf9beba921f8332b67d776aee5536e88d2fe1abe7e44b0e52ec95a13a04384be773422ac8a86c25c1cc2bec1fc3354a0679790af7dcf1d429ea0b91232f431a6df297586f7a1cacf1d733a477dc0bff3631399d6b80bfc15295dc4cee525f5cb8893f11160f51c2c2085947ba0c834e1c3bf92d1d969de73109457346a66b09df781f13bbab46a51d5708ec73c035fd17458297d886f361d61e3c2fb58adf5fd0bbecbfa5ac279730122d8e3e26119fbc65d47c0aa92838b2ec08904b7ae8534acbe4ace520d0fe5a7568227ec196861f5724ce5a8cf69dbf60b136141a4ba92899a8a6c14ab7a5b834e0e2993e7ded3ff287f32268447f0c4b9a5ece1e3fc086c0df06356ba936accd4eaea051cea99326a5e12a37c1157880fb2dece00bb4d33963ea34515eabc31a6bf03bb300538504fc85e24527c600c7ca342b4def33909ab7d9343f549ce3bc1be210702dd6ec249d059a3251fe9fb6ac6cb51e3f6cbedc069348f7b77fcf1af9959e6e76e9f3081b96c8827f60d796fbb4f232231c0c0211423b974ab5d1a81068b0dd41588a0f799686334fe0743e3fa4b0db7d2aec0b7ab93be5791de96caafb0e98eb16fd2e10ec5ed534facd1451c21bd7f8f33394bae83be1bc311c94efc6468d3a97b2071b83698008c52193cb463f94d007242e98430df9d97e78f676bee7f977273eb653351806b0c55492082657c3f47ddcab424f0e98ccd7512c958d00463ec5c5f7bd5443a21b5068594a2f22c77f3b535c13e0718f44398bad50bb328e18727215dd2417d291f87303ae8cba5adb6a5a1c08f251c33996033743181f33b0a20725ecee2a365ea8d66b9ef60028605ac09aef2f251d75187c07218ac1fbf6cc9c9077ee7783f60a6c64bc33a9c6ba5e5d3532d43f24a8412d03831b88377c2995850d092f3d7b74afed39439803e7bf4b2167d900a2e031b7a7e2b770bccab35c2598e639ebb6cbb3b5b9895d5df593a03c3f26ebb0a806f3266c1bceaf16153f2cb1d88ed9d8fd3a6208266cb1871a0fd11ad72ea025262c3a804f067581e75ca6c670d9f15bbf8cb5262c49c74957e32b65f8d14f9df0e77210465c7963a0d3b1274ce826c18fc359bcd107e8a98981aaa49275149065c5d07bc8f0c95d9e82781a6e6d782d03aa4cd364d57e27411c2abcae6edf785a2d63f637cb38481b5cd20f2b6a964235d19d9611364f044772d62c1259d36cfb76251a4f47dec20381768c0966e632ed9967250e6acda0c9f6007abc4fc62fb924c854f7e6ba2a3f6359cb151956eaa908e737ae59676b0cb44d5e314873ca5f20cbdf49c3b5dad3d3d836f21b62917ff8641497c5b029898f62b8e1ddf16b85d6ad4b47f7d437e89bbbc2f7b95b117fadfedb6e5de1bb2227407efd6fd99fba955adac8f3be0a11198967910a7e8099645bdf311a73907de2d76ff266431f451c27a024c524de36860407c4de163a6b1549343c1e456ca7459ea9632ea467ee14a310036e42806b80ad2e0e128de9b2098116bb5dc0d071cd2acb185846f6a60a210bcb6e5ca565f76f5fc4a52f94ccec258a4e0bcfa614c69f111dc4277d9352772a96677514ca3f203a6fb46523d544b0444d06c70a155f95570d98bb2fce9afa22679c834022dfd324828ee1cea2ccc3551f42c214745b6c4c1cd842fcfde05c0f46e21a197232912b7877972c90cacfb1ef722410ab7eb3075c1f807b1d8719eed683bc8cb61a07513065d40bd7ea92d0e51ea222852dde80022c519c4e73310a6395ca0b50a72459ae2adb4e4f97deae62cceb7d554281627833faa0484147135fede536fca38bbda9ee1d1ec2fac5b10d72cac88e62b53ae375762d3d81715502db345a9bd40767284d079192501cc98cb4e55c803cab745cbe37a405fc89c01d20dfa82d28839b9509b3f6735b205d4582a7b488916d68310443107c4f0c7be6b77f7089d5fdec094495a730fd1f48328f00fe9674d3b2bf8454cae9a5c079351654559c9d69f3b485c5beda0b7e6ef7e5c3c45c5d8c819352073bfc06b30b10478aed71566a97a6b31a88de9b867d3595f6519c585eb3754bd49292b5d50ef9be342792120acc6e42427e1474bc2859a4348672c694c39106858d20904f8ac79f38e195eee8e3a959170aa535baef63db00d6cf9df5659211f53a6f0b7718622897bf512d79837dead56a98ac65eed910076ec65f6c6d9b9b49a2e570361da8d1aab3543a35bce44e96f5db3c6cdfb2e4965671dc5304c6f1ecb236ed2ad5cd4acf067619a44c8ecb3ed10861cbbaea90b15d9b048875f1e828f902ab0b55227a60ee3a8c992236474eae25c573388a2c1416b6187f511aadac83cbd41d12a6750f6c8f4392e1d53d7e06d47acc7bd705e6d612c758725bfb7c6bc8fb1739cd548b29cbcbad5136b2f6d4282190f116dffdafb41077786bde20bdeb45b61cd4baaac090bc82ce67ea6fa9e7430a2215b0c8598737790865196201090ea713b4dce4675655fb275272d53859f3f56ecd99b3bd3d022b05cbfc4604eb0134f1c17de4730950c97ded394e96052ebd568a8639432e1424c5930e55e2e1b29b4c62959ccd78dda09cc36fa7218d88412b2c5b043fd122ca37e935ead5690c46c0657cffe6fda625f13fa2302c5a058b8da2a8c81448f77c2c80796b87225f752ba8cfd7adf126c222541ef6ebe3d86c08c7ed32ff40ffc78ca7bc647c3f972a7613be86bfeacd7f979e124f3ed3d8ada9d79bc19fa92ac7ff900ce174035e4ad99cb6ae140ea662fd8c0fe1ffc6f9486ccc650913cb2923ee6579c37313249d77b886407775a1fc70bcf18551aafa8df8abd5a94135747f4252bcb5595fa7cc4f386a1664f6e13b2d9e3ad83c1c776daef978a130b4e2e78e8959bec13f0d0f15b658772513a7a9d1b8e6752490617e7a97c7df80cb58044eb9b1dbd15bea3db714cebddb6528e08317e57c7a679ddaf4e0a71c1f941d9131a358fcc7c1dd0318ca654caa1eca167380f030900b23ebaa9b6643bf74f31bc81324ecaf27c12deda64a681941b27afa0765e40433883e5e3bb02e9e0d5d845dcdadb1ec5c29e604ea7290972986acabdb4ea24fa89c76dd6aaa15088c4dc246997ac4862bfebe7ae4a6a237a95d6756badeedf9e5cf19257a5e044918971c54d5b4f8f4aac25e6ad73d4333a0645b6a25b427f938965d2793dcad069ff4f3172e59754135c80d346dab422894d856448fc0c389c41c2393451f40392c4f6387291aa6913733b13af384a27cfc62341e41703dd6e2d00e25e5a3f82b358b1005afd994506a568e53254288603d5e267c29296bb324560c4367dd284502de3145ac79e685790eb18fd1d51e72658f34e3b4788156cbb73bc0a27e2289ac49cfd26fd6f52b914025bd288fe94d104e60f90151cae1cdd527b873ef8d862d76881df86d48d5b6dec4a0e3c88da76badfa57cd64df4f64ad55126ffea271c9f3be85d1b6141b4bff5cec4a5a9112beb23f01f8c9972e8bb78c6113acbaeb3f2579f7c0266600495afab1e541fc056fdac97073dc90ecdd06db16581a2c942367e103169a205780531c70d62a8c87d41f8c91296d985929e361e4d03f3afb535cc7e6516134c6d81ef5c049f3234edf8f4cff871b0a6d9a8f907d9ffca86da62040a98804e350fb7047c6ac362b7ddd31fbcd07253b4f4af84f2a38de83cdd4ac907938de72bb6af0a534bd8e421f363e0bcf7074b602fce6bdbb087305d3554d1dbe4d6339c053daccf22929a33621461b78c8d4fb9", 0x1000}, {&(0x7f0000001480)="abd74f800a4a5248d2abadd3316cc0b8c3c7731baf2bf0e099ff374d7b07381c3b5580fd811b4fcef9db0ca3c912c67b62f87bc98c14be0674f8612462f3f2799f8429e1a1605da7a5226e568ceefb9a532ab7bc60cadba1f815db43a998877b9266213d00952f428872e35c8fd16c31bb588f8b1561ad003bc41c8d9d8e40720771afb2318d5a666261bfdf3c457e85e568b7276e448caa382c53f5b1a95f134701e5e4c3be5fbe412a4801fa53fe8fa77bae33048c2018a765dbffe2be758a7eb93494cbb62c0492a268c767107582cbcd57b0718963af11049fc6846c78e93fa540db76e5e99b534da2705fd36ae21a13faaf00245995b5f3e7b3", 0xfc}], 0x4, 0xa, 0x50d0, 0x0) (async) syz_io_uring_setup(0x2c12, &(0x7f0000000240)={0x0, 0xd7cd, 0x8, 0x2, 0x178, 0x0, r1}, &(0x7f00000002c0), &(0x7f0000000300)) (async) syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) (async) syz_usb_disconnect(r2) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) close_range(r3, 0xffffffffffffffff, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a300000000088000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d44001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200010800e000100636f6e6e6c696d69740000000c00028008000140000000000800034000000120"], 0xd0}}, 0x20050800) (async) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) (async) creat(&(0x7f0000000100)='./file0\x00', 0x1) (async) syz_usb_control_io$cdc_ncm(r2, &(0x7f00000016c0)={0xc, &(0x7f00000015c0)={0x0, 0x5, 0x9f, {0x9f, 0xc, "689f1785d289ceeefbb4ba75d4bf5fbfd852daa6bd57ba43b6a7b59d965e57265e415c840e37ad1ac0de1cb04a85effa31c7f7bd4497203466da609c2b273b92b3fa47580a329b21a53ac06af6c67ff456cecac0b0f4291d77763b0b314a1108e178e8ef3c97e161fd110daff617287bed59054793d0cfc10666a756e2142817ec33055cd5eeded775c96fdab994c4fe484a07cd72bc1ade8189632864"}}, &(0x7f0000001680)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001940)={0x24, &(0x7f0000001700)={0x40, 0x16, 0x47, "abd0e52f08dac705e3b559bde83cb3cfa9344c984c6c1fb48220d0c725bbeacfbdcbfd41adfecf7477cd01a189039d78aaea82e07400274d3155a518240e0678b26848bac2210e"}, &(0x7f0000001780)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000017c0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000001800)={0x20, 0x80, 0x1c, {0x8001, 0x6, 0x4, 0x4, 0xffff, 0x5a4a, 0x6c, 0x6, 0x8, 0xeef, 0xffff, 0x9}}, &(0x7f0000001840)={0x20, 0x85, 0x4, 0x6}, &(0x7f0000001880)={0x20, 0x83, 0x2, 0x1}, &(0x7f00000018c0)={0x20, 0x87, 0x2, 0x3a9}, &(0x7f0000001900)={0x20, 0x89, 0x2}}) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="320000000000000000000002ffffff77cd84ef0000000061"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) 2.700553214s ago: executing program 4 (id=1769): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x6778, 0x1000a, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) ioctl$SNDCTL_DSP_SETFMT(r0, 0x5015, &(0x7f0000000000)=0x4000) 2.5488748s ago: executing program 4 (id=1770): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000002c0)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@my=0x1}) syz_emit_ethernet(0x1f, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffce2a000000000000001142"], 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7aa, &(0x7f0000000000)={{@my=0x1}, @local, 0x8}) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014"], 0x44}, 0x1, 0x0, 0x0, 0x10000057}, 0x4000084) 2.391839563s ago: executing program 4 (id=1771): socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x161942, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0xc8080) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0186405, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)=0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket(0x1e, 0x4, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x3fe3aa0262d8c583, 0x2, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x1c, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x4a}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x2}, @TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x10000}]}}]}, 0x4c}}, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x7, 0x1}, 0x1c) recvmmsg$unix(r5, &(0x7f0000004ec0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000000, 0x0) recvmsg(r3, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x6e9c84f3}], 0x1}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = socket(0x18, 0x6, 0x2) bind$inet6(r10, 0x0, 0x0) 1.29616775s ago: executing program 2 (id=1772): rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xfffffeffffffffff]}, 0x0, 0x8) r0 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x12, 0x4, @tid=r0}, &(0x7f0000000380)=0x0) r2 = gettid() timer_create(0x1, &(0x7f0000000100)={0x0, 0x12, 0x4, @tid=r2}, &(0x7f0000000380)=0x0) timer_settime(r3, 0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) timer_settime(r1, 0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0x989680}}, 0x0) r4 = gettid() r5 = socket$inet6_tcp(0xa, 0x1, 0x0) write(r5, 0x0, 0x0) tkill(r4, 0x16) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io$hid(r7, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0xb, "1a3952b5"}]}}, 0x0}, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x3f, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) 1.235799845s ago: executing program 5 (id=1773): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) write$sndseq(r1, &(0x7f0000000180)=[{0xff, 0x0, 0x0, 0x0, @time={0x5, 0x2}, {0x2, 0xfc}, {0x0, 0x3}, @time=@time={0x5, 0x3}}, {0xc3, 0x0, 0x80, 0x3, @time={0x4, 0xffff}, {0x0, 0x32}, {}, @connect={{0x4, 0x8}, {0x2, 0x3}}}], 0x38) readv(r1, &(0x7f0000000000)=[{&(0x7f0000001140)=""/136, 0x88}], 0x1) r2 = io_uring_setup(0x2f00, &(0x7f000000c480)={0x0, 0xe8e2, 0x400, 0x20001, 0x2d6}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000040)=[{0x0}, {0x0}], 0x2) r3 = io_uring_setup(0x7625, 0x0) r4 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) r5 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCSWINSZ(r5, 0x5414, &(0x7f0000000000)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0xa, &(0x7f0000000140)=0x7, 0x54) setsockopt$inet6_tcp_int(r6, 0x6, 0xa, &(0x7f0000000000)=0x2, 0x4) write$6lowpan_control(r4, &(0x7f00000000c0)='connect aa:aa:aa:aa:aa:11 1', 0xa) io_uring_register$IORING_REGISTER_FILES(r3, 0x1e, &(0x7f0000000000)=[r2], 0x1) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = syz_clone(0x100000, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f0000001040)={&(0x7f0000000040), 0xc, &(0x7f0000000e00)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="102000001d0002002cbd701ffcdbdf25"], 0x10}], 0x1, &(0x7f0000001000)=[@cred={{0x18, 0x1, 0x2, {r8}}}], 0x18}, 0x4000000) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r10, &(0x7f00000002c0)="9e", 0x1, 0x841, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback, 0xe}, 0xfe41) bind$inet6(r7, &(0x7f00000000c0)={0xa, 0x4e22, 0x3, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) listen(r7, 0x0) shmget$private(0x0, 0x4000, 0x54000000, &(0x7f000052f000/0x4000)=nil) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000041c0)={&(0x7f00000001c0)={0x50, 0x0, 0x3, {0x7, 0x29, 0x3c, 0x2100039, 0x0, 0x0, 0x1, 0x57, 0x0, 0x0, 0x80}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_SETFSLABEL(r6, 0x41009432, &(0x7f0000000300)="6a2cc744b05a1e7177c43bd2271a33f7afb41a03aaf0a3955e1bb1ee1e8d87e0b41053ec13a3811e3510b518775b07272dde266125893bc237c8a3abf23a326c6e1f2e0aa0d6f7dfb6cc384389f0385302a777ee250130af40e8b97086b248a2531edf84d35f446715d89263c77df75ffa6a586591442e16fc8d760e56f069a8251cb8c210501b16c870e806a088a357d7e0bbc22ed3384a2ede70dc76e0d23fdb2ca7cd05ddf9b9f0c9a870cfdf3687b940773659c001217f2c535482c46dd1bdeaf9a156a9478f559b2cea50fbac4ecfd341e097568a4074a5ae5f879fad875e46e215b07d529bb577683fada2a4e9ad4cc199a1df8259b409de0446486a90") syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00') 1.147629688s ago: executing program 0 (id=1774): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xcf, 0x8b, 0xed, 0x20, 0xfd9, 0x25, 0x2940, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xca, 0xfb, 0x1a}}]}}]}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) r3 = getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, &(0x7f0000000240)) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$sndtimer(0xffffff9c, &(0x7f0000000000), 0x80601) ioctl$SNDRV_TIMER_IOCTL_TREAD64(r4, 0x400454a4, &(0x7f0000000280)) r5 = socket$can_bcm(0x1d, 0x2, 0x2) syz_io_uring_setup(0x835, &(0x7f00000000c0)={0x0, 0x679d, 0x400, 0x2000006, 0x3ce}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x2400c0c7, 0x1}) unshare(0x22020600) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETSTEERINGEBPF(r9, 0x800454e0, &(0x7f0000000140)=r8) r10 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r10, 0xc0046686, 0x0) r11 = memfd_create(&(0x7f0000000480)='[\v\xdbX\xae[5\xa9\x90\xffc\x1f\x1a\xa9\xfd\xfa\xad\xd1md\xe7\xe2\x7f\x9b\xd5R\x10\xf3\xb6\xffT\xbf\xd1\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\x9fc\xda\xa9\x83r\xd8\x98\x00\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9', 0x0) pwrite64(r11, &(0x7f0000000040), 0x0, 0xa) execveat(r11, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) close_range(r1, r10, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000040)={0x24, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0, @ANYRES8], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) pwrite64(r12, 0x0, 0x0, 0x26c) 1.020096712s ago: executing program 1 (id=1775): r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x6778, 0x1000a, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000000)=0x4000) (fail_nth: 4) 623.054209ms ago: executing program 1 (id=1776): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x1e9500, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="100000000500000000000000800000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f0000000040)) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000200)={r1, 0x9, 0x3, r4}) bpf$BPF_PROG_QUERY(0x9, &(0x7f0000000180)={@map=r4, 0x1, 0x4, 0x2c1, 0x0, 0xfffffe63, 0x0, 0x0, 0x0, 0x0}, 0x40) r5 = fsopen(&(0x7f0000000000)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000040)='fd', &(0x7f0000000080)='\x00', 0x0) ioctl$SOUND_MIXER_READ_VOLUME(r4, 0x80044d18, &(0x7f0000000240)) setsockopt$SO_J1939_SEND_PRIO(r4, 0x6b, 0x3, &(0x7f0000000040)=0x7, 0x4) socket$nl_route(0x10, 0x3, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) r8 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) cachestat(r8, &(0x7f0000000080)={0x8080008, 0xffffffffffffff5b}, &(0x7f0000000000), 0x0) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x101800, 0x0) ioctl$FBIOBLANK(r9, 0x4611, 0x3) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, 0x0, 0x0) 598.517957ms ago: executing program 5 (id=1777): socket$inet_sctp(0x2, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) ioctl$RTC_UIE_OFF(0xffffffffffffffff, 0x7004) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x8ab43, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r4, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000640)=[@text16={0x10, &(0x7f00000006c0)="bad104b00067f30f1efc0f225b66b80264cc99919123d80f21f86633c02b105343b00fb00f0fc75800df00dad2baa000b80468ef660f3881be0000660ff8b02600", 0x25}], 0x1, 0x2c, 0x0, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r5, 0x4008ae93, 0x0) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000100)=0x3) ioctl$KVM_SET_LAPIC(r5, 0x4400ae8f, &(0x7f00000001c0)={"c718ae3ddd25e4c2826499cb6a055b56a5a7336f377a556f824db28eb6743cf045afd0e932534b9eb3b847abbcef63c85319991745999ed89ff49783a84d57cf175a89f8733d74a1bdddcb0a6c3f7535e7976e79da1b52de6403f6710d606fafaf685ec19f369b7829b12aa2b8cd2ab52f9c688683979cdb9516cb61f2adb9aefd44fee30bddb81ebefa818f31f60d89a4e390920c7ed0e2512fd59f719e734b0a1d1f3ff7babb54258a1585514aac0b000000733671e0543929c06f72fc598939003ac6777f3497523536fd25ac4f1e265f5038fa7455f2cc6131d4a189a16b0f0b89e6a495e1d95b840c36488adc22cb2d1b8af57f6dce7214152ba1b3c0d3ad0a6db821518e44b24cb36a02d76ea11a1c45879fc77e7bb2af8c345ddddf49f41228df2114f2c27d16499fa36097a5015ad61a6a9484c09e0a2dfb50f7b7ca71135dc32804a80380a6e20e0ae03be775e472cd31d6a31e615937c38e746a5cf6c9d8194242990dd497a2c52ab50300000000000000cebbd983c3f86dbe92c4b751c04693cb09af88521ab305ceabf6d2bab40bb1b219fbe95ace2f6c49fea798e76b4ef336dff5ac0f7ab022b800ac1aa42fd231b52465a410177ed85dcc9c6d794e2aa0b90cdc409541aa85fa16e3cbc3a9d6c83ffd4d01e5ba898555eeffccf0cb28ce5df0ba31cb793675276162de2fdcb486455bca57edf4fb14e1533554eb22527d66a28a960c430f6136927f54e670c46292454fe28485f35405025844fd24fe846f6656c77d9b5f2b4750ac4805897b02c85caba80000bb96f71f468c9e746d860238b3b113ab1eef51e1507f8832d5d69528083d44548e491477cda51d7e083a134097438e9d7ea34eae8a2e6b516327db9310c7478a37f5c562037196131cc7c84fa29c3c2576f2ae7570b5a98aaa49ca7ddfd5a8c046ce82e4a2d06082ad7a3ab0dfbe208630b1410b674781855752c9c57c1c5ab0a74a336ce89b3a9c0d37a3ca4e698a798a85faf7f4f1dc020b7dd5750062c9810c4bc1ad7afe338f2b0f29059e684fe16098eb30da105be01ca11a293635dfc6d25ecc770ba72792fd3c6851d951b770d0f9edafb1cb4241350d85b04ed737a9bfd7e8301c43b65a95dda76d6850860ba3195040b14c8ad1a8b52472785521147182352a1dbd93595cbc26e813ccd75e16f9247fe82ed150c121f0041022522ec76476f0a9cffa3be1d3ffffffffffffffff29358bbfd8b7a12fe94a0355beb9420eee0a5c11220100c782b89e9430de84b220e8c0df4bd40be3400c58f149319f891fe86fba751dab3326bf2deb9e782b37ec9c7adf36025a091a4b3600000000000000000000000000000000000000000000000000000000000000000600"}) ioctl$KVM_SET_GUEST_DEBUG_x86(0xffffffffffffffff, 0x4048ae9b, &(0x7f00000005c0)={0x3, 0x0, {[0x5, 0x6, 0x8, 0x0, 0x6, 0x6, 0xb4, 0x5]}}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r6, 0x40045532, &(0x7f00000000c0)=0x2) r7 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r8 = syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) ioctl$SNDCTL_DSP_GETOSPACE(r7, 0x8010500c, &(0x7f0000000040)) ioctl$SNDRV_PCM_IOCTL_HW_FREE(r8, 0x4112, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB="18000000", @ANYRES16=r10, @ANYRES32=r2, @ANYRES32, @ANYRESHEX=0x0, @ANYRES64=r4], 0x18}}, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) 284.199929ms ago: executing program 1 (id=1778): ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000040)=""/4096, 0x1000}, {&(0x7f0000001040)=""/92, 0x5c}], 0x2) recvmsg$kcm(r0, &(0x7f00000013c0)={&(0x7f0000001100)=@l2tp6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @initdev}}, 0x80, &(0x7f0000001280)=[{&(0x7f0000001180)=""/17, 0x11}, {&(0x7f00000011c0)=""/25, 0x19}, {&(0x7f0000001200)=""/109, 0x6d}], 0x3, &(0x7f00000012c0)=""/217, 0xd9}, 0x40000000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000014c0)={'syztnl0\x00', &(0x7f0000001440)={'syztnl1\x00', 0x0, 0x2f, 0xae, 0x1, 0x100, 0x0, @local, @loopback, 0x8, 0x700, 0x4, 0x7}}) sendmsg$nl_route(r0, &(0x7f0000001580)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001540)={&(0x7f0000001500)=@ipv6_delroute={0x30, 0x19, 0x200, 0x70bd2c, 0x25dfdbfd, {0xa, 0x0, 0x80, 0x5, 0xfd, 0x7, 0xfe, 0x3, 0x2b00}, [@RTA_MULTIPATH={0xc, 0x9, {0x1, 0x3, 0x0, r1}}, @RTA_MARK={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x2000000) r2 = socket$netlink(0x10, 0x3, 0xc) sendmsg$nl_route(r0, &(0x7f0000001680)={&(0x7f00000015c0), 0xc, &(0x7f0000001640)={&(0x7f0000001600)=@ipv6_getnexthop={0x2c, 0x6a, 0x0, 0x70bd26, 0x25dfdbfe, {}, [@NHA_OIF={0x8, 0x5, r1}, @NHA_FDB={0x4}, @NHA_MASTER={0x8, 0xa, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20040000}, 0x4085) r3 = creat(&(0x7f00000016c0)='./file0\x00', 0x108) r4 = openat$binderfs_ctrl(0xffffff9c, &(0x7f0000001700)='./binderfs/binder-control\x00', 0x802, 0x0) preadv(r4, &(0x7f0000002a80)=[{&(0x7f0000001740)=""/222, 0xde}, {&(0x7f0000001840)=""/114, 0x72}, {&(0x7f00000018c0)=""/54, 0x36}, {&(0x7f0000001900)=""/25, 0x19}, {&(0x7f0000001940)=""/31, 0x1f}, {&(0x7f0000001980)=""/119, 0x77}, {&(0x7f0000001a00)=""/110, 0x6e}, {&(0x7f0000001a80)=""/4096, 0x1000}], 0x8, 0x0, 0x7) ioctl$EXT4_IOC_GROUP_ADD(r4, 0x40246608, &(0x7f0000002ac0)={0x800, 0x9, 0x5, 0x2d36, 0xd, 0x101}) r5 = syz_clone(0xc002400, &(0x7f0000002b00)="8e37a9379d247c3b03cdffa7cdb817b11977d3493201298015e4f5497601c4c2b57fc729f698214c3f63c5", 0x2b, &(0x7f0000002b40), &(0x7f0000002b80), &(0x7f0000002bc0)="b41d1028f5db87977059d7737e8e60052f7b229fc75041ba3ae5642f759c2e3c9da0484cbcbb47603190695ab9836c92fe3d4ebe9453fb8c582b0205e18cf9b9267fdf3f864351f2fb77e55f4864a229e973ad976b766dc88c3278534c79732ee7466ad484292a33c2fb279098d63c44fa738fe0886358e3ae98e4ce1ee87d4155e8eb307f6ee0d776e16eeb63c2b6265e421ff0c9c09ecb259c9f83e9dca4b67d54255535e0b6f4ef3f904511c2575e924504dc2564f192b97b789382a562ca122e2bb8f8c647d5af63d08861bc6b2f58a0c9a4094c1443c83b89bfa7abcd36d0") connect$l2tp6(r3, &(0x7f0000002cc0)={0xa, 0x0, 0x80, @private0, 0x401, 0x4}, 0x20) sched_setattr(r5, &(0x7f0000002d00)={0x38, 0x3, 0x10000000, 0x0, 0xcf5, 0xc, 0x9, 0x7, 0xfffff33a}, 0x0) r6 = semget$private(0x0, 0x4, 0x150) semctl$GETVAL(r6, 0x4, 0xc, &(0x7f0000002d40)=""/65) r7 = openat$ttyprintk(0xffffff9c, &(0x7f0000002dc0), 0x101100, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000002e00)=0x16) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) r9 = shmget$private(0x0, 0x2000, 0x78000000, &(0x7f0000ffe000/0x2000)=nil) shmctl$SHM_INFO(r9, 0xe, &(0x7f0000002e40)=""/23) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000002e80)={'bond0\x00'}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f00000051c0)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0xee00}}, './file0\x00'}) r11 = getgid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000005280)={0x0, 0x0}, &(0x7f00000052c0)=0xc) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000005300)={{0x1, 0x1, 0x18, r2, {0x0, 0x0}}, './file0\x00'}) r14 = geteuid() statx(r0, &(0x7f0000005440)='./file0\x00', 0x0, 0x1, &(0x7f0000005480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r8, 0x29, 0x22, &(0x7f0000005780)={{{@in=@multicast2, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@local}}, &(0x7f0000005880)=0xe4) syz_fuse_handle_req(r0, &(0x7f0000002ec0)="1a1d40608ba0392b2f173deff566ef783634aed0c6a554fa30e6d0ac9e362dedef1d1f167bcdefc7c431f4ef4b9ef9eca5ecedd2ed693e4d7709aa56c75aae7e5f202d7bc903a61c50d0be468511eec5fc1bb50edc95e88091c12c442137a1ee72fd4b9c09a9086b7b186db657e8dbf33c6275b64f7c75e5ac87372ac657b6c47e139d4db82344571f78ae1230d08ba182aaaaf086672accd11d73e018b47f1efc37a704ed3980fd633ae31974390d43d72adf41a065d8287455be533a6478adc15c4ef52ba53dfc8f90eaa710bf0a95e717a53d28423f34763b315c32d6ab6c24a7927a40d77e25e7b0c91c39b494cafd31ffd9b19aa26a4ba51ba01f9e164c42503af1233520356643f75eb22bccf85b5b72294bbc20a80b068e1e5ee0c9b22f5c92f0efb66f1599fb0c6c4b21200a91a59b743cd003d07eb821348090afbc44037f33d6c98fa33f09c226cf5bdc53e02a335ba781fc6d64267f22170d72ab312c7455d8819f3595d58967cee0de4dbca9ce13ac3212cea185c975a99cefd7b2f9af3ffdd99ee8990ecfb8446a789eb8c08c833efdabb94d76cf8411cafd02e195cdafd655e44c20668c6f9ab75c51db6296196f34385d674b922428b05ebe9f16a5138484e8de4aba26cc92fd1ec9958f4d4743e9a36a6b3efc4519ea68d38bba8ce3711a8cc537fc7b735dc272dde3ae722c33edf9fdce1bc0d2b3e05d820c9f8918f51fc797f60f75255f48f3e09cfa2c229bcbc924c7e250b087bb182a7719a475e13ce169def05304816563475b35eed2039e30575183bc6cb59cab232224ec61927df1742922b12eb1f697bbfcc197d4cba9d7efeb04d71fd4e038f771218abffce0ad2b85a11674880785a8e0dffc3afb2d7ccf1c6582289efccecd6bdcbf49e19cf9d70096751514a28995c49fcb9ca83b2716f244659712f2e9d7bfe63b5586e51afc890cbd5495008ffa1e96a4aa44bfd6750e4cabada63ca6ce4f26ff9fc377a0b376d502ea0d03a49a2114ccf590fa69946682e4ec2448c19ddd32dc066a8741c2e319512d16a48cea7e36aa134b9be65de2aadc9328dde16f148bb36065b3eb5c38b135350cc02434acebe02a7dcd483becb563af89d7f6b53ceaef57c7d8c858b5b189616f9150ff411d56cdb7217158a4104c85da2dd288eeeeaf2faa81c417071aa0f6204a67a95421fe9efc34e73d1a44c3d1ccc842da0b37b3ba09ebde3e33e3638a4aa1d99452e44ad67b1d89b93213c0745551b9b40472cfecf16a4216ca29d2cd4abf065f730650fc1ae46c779021caf6a5c45ece9844d3a26637de661fb46a34f2ef46c901f342e2d783527e22092ed46208acc02792ec7c2be3f56b4a97b47a8d858962771d3aacd1d54641393f4aab86fddb5694d053cace2fe203a2363a28579ce77a5d69b61a0416408e39b39e62f713a76d804ce581682fe807c46e1a774b842ebcd2aaa422959e1152a8cbd55de56a7ec34b52ff65ae65ac93f61281f6aca8a18b448a3233416b433396b1f7a24bd865dcb9ce01c8e743e6a8551f84aa484d0ab636611ae21da37f9233c8ed53d67ecc7348de39f4bdc3cbde4d8f6a221abfa8ded538594e86d20fa6208494ea4563cc51adf7592b125d8668aa851842dab89914eaf345d38b22c1949a8796876af5e328845f68e27a0c59959a414f7cec3d7f5a902f189e4b3d27ca6bf7d43f152be6b7ea8cb23fc384aed820387eb6dbe8b18c9f24cde7a9a8b311d1ccbf53765b53f43e37671c48caad47d7af545f4d1092a0f6606cfb06f545d54707cd4c1a4074a76099bf3d001e12ca9af6083362860ec60324f62a403ea5f654701cc1b3f1527ee2d24a679a35518728aab5e3618905a0d718478f5f18fa1315daffa53f6d457fbe20909cba822d264de8df0d47d8c2e41264e14c63cea1c85331b3ac8729bd1e41e9c2809608ffb74368fdfa14fab2785f2908b7c105ffb793b03ff3fa1074e5c9c59021274e2bc458aae5037c96620e6e04c4114d83b52a78f70bf26fac4187039923ef544f39c9af3a7db7d2d19f384a83fe6417624a74da5d121c442f178b9143e9218a2a7c5aaece811ee0eebf389c34622d5c4d3ee0ebe0add308959db6fe6f10be52ebbe7e3aa39a0a137dbbc6fb8f338201b5423d68a2a5fa23abde2be4c902d233e55c6589b13cc03b610a769aa27c97c0539c34d3c8cb6a3b0e473559f0a0220e35aaef8e09eaa9463d53ca9b1d7e1b3de1778ac772563be03de09a702ae215be421b9d495002564226e7a3e9753b94b2fa1166daeb4ad621ef454330f8e54a7c4bd665376da9fe31b6e58fc9e60c571ea85aa88319c6e36593befeca5e8eb61d6e99f5ca15a7eb9b9c9bb86ffbf8d28c6a82c1764f4d30dce1721cdc70ccac55332c0a4afda15440796277e91d7c4093d3e26d919d8d54359e44e7168477bc28e240970344802cdced0eecc4ea926ff499d09cde42b9c781ad3f6d2ff560748be2b5e8660323878ca1aa87a944429ce013805805d02b05fff6a640266371ae8e5b4bdd7eb81e9237a3066e5afd684d105bafc75c5df051eb2119f4024ce1401c6e2bbd6d517fa752ec9be65a26d74acac1477bbc4e5d6005993192010339c7e6ea284e3a1cd2a34c73ddd6fadc26e80b031762a4179c1d97b7ce483ca9b23bb3c5c4ac5de21fad5d2fb649672722268821422ad6532f5df08434c861144da78d702f825238fc276d6a33951611edeecf1781aed0c9bbe659e11b5ad90098b254b991cfaa555d95089fc68480bebd307bf6fc7f3cfda9297dfd98a461ab9e1348938b26d58f97a24fe817a4101e3b39c2289ad44843387b3c50d2d8b2540bb9be1f5e2947c346355de4bbae72f407adf8400c2edf71f69233cd28ad21cd3396ec1add2f928388fed69e2ef0c424c88810d8cf263b91d463c24f2f98b2441ff2778cb55e96de7cd13fab5ab529647a3d8d5a4f179e1a24873cefa29a566be52936883f821f575870dec1602d2135853a7c292791f1df16f64f2b9ec29ffcaf5acd6869a114e1d8d87ea12d68ebb940738f50fa9875294c5bbca4650f390849305c3311d034c0fd769a444ed0e5e02f8b8804fbf7f5a874dd654d04a3c0f827ac31ebb5cbfed320fd0d418405cf14954bad66206bbbf42c7e844ee2f67c6608397c515c33ede5fcdbdf638d628a6d02bdbba33b0e3f9b72fc350de6e1029fd559a75b1e64eaef2fd417d80942d3aa26982340e1d57894f42217cf00981e3ea05ce1254a562b80c5370c964511cb9d0dc66ace876fcc20d8bd9c1b8645743be0f16b5170d36bbbbdb050d13cf38344b4138c482993a04fa6fe7e7f1989ab8ad905204342b51ac1a2b128e7774cde9807c63db6e145524b5c58668402869193e31396c806a6490f724e99559af9bf084abfb57d2fc5ff0432c4fa98962fb5cdf95ce1ba0d67e9f4d09f48578bbf36105214f2a3aece1e91210310cbd64fd31ea71675b0533513c84cc0504323fe80e6e133b0494e59e39bf0b7b4db8ac1ae824f481072127e4ddaa28aae3a97491e9f8c915abe7c32871d42ec5f142bef76d8148f2deb268e463cc3df6668a3fcf3f08ea4702809ef2da5d588b63333e2426c5c7b51b50f8b2bd529fdc1dd548057db6f1c53dda58754d5aa4334a53ba6bc69b15659f6f45dfe63c227a5b3bf9663b074a21a0526b816a337fa0122a9ee488efd7333ea717157e68504e23a2e8b7db237d1462c7122271053d67f51949819112ff3e01be573c9da4933f69575c6aa5a1cf4ec65ee41371e73349dc9ed4c3edefac14c6adbc6a47bd5726f544dbf932f0a86b631d1ab820e7b0d8feaf1e12a1b3a889d3225ce257602ffc470f9f8855959243f9d4144152abe9cebef05c3fb2f41af9b19ea623bbb736f59e244757aeef5df980a0a87a79a355e2f1349d05168d0e9c56c8fb1f38593dd30ade410cfa6639c9428e21b37bb19292d6b0b63f51b9dbf8f26f408c24ea3e3ca3a3902f7d7b70ae27220ca805754ae4ba4d4d1e76015eb6daf11926c50b089a6c207c513bf266cf9950534f97160f7358b95c13639091cfd396910a745784fd30b647c986f2621b314c0e9054b099dd4e2d34cca1e0e18f691839da3ec475f6cc4635f3627d89ac2688ab293a198e54e7ddaea028a4b88455c3959fdf5cfc305dabd7091f2f2860976fe7c154b7953f289ddf8496c352bc9f9e6ec6c24bfa4f40637cf7a32e1783f7e78781982ce6984c7f68a8b686defec46438b53877958f185e8c5cb45eff62ccbdfe9666e7f6d07ef11f942744ad699a672f37c773a7db6bad380e0a37cc38c733aad421488a3a807fdb82f76bcd94de75df6e3837b6a6c506a8b4ad64e4d08de7fd7a4b30658be55fce7844720c87cf4f06ea522e202e8e2edf27073f270aaeae299b0af3c0f9dd1b27d9e284f54581f234b70bd51c65fd88888b2c4dd7a45072897b57dce2e8206eea7e9f5ea78d6c3a0ebbf2f48ca7b28632a28393a62f69b18d7724d2f7c04a86a20c9e77d3290b6c5891656c93d990d133e9a762d668d6b154ffd34efd1e6afc805ff8e6526717ae755629b4f5c8e20145baa813e7b573b1b0dfdc0fa3ef6889f51e1aa25c19325f2425362b5c5fefa8da0e4a85c5954da877baac6bc1621dfd226a4c5073b61089184653be0efc154afa5284dfa01086b51f401f785c968a79cfe9b1b2c1af5b241602444144d13a1ff8211889afc778f2b7221a11f6759711366bb8b85ea67f240bb9317225f3a02ca77d57926b9d2867c9808da81111532b23f5a415cb7dc399bd51e438c6cbd82e1812301c4e37c3b3b5a078ae67e326b3b7da34f836da03910ebe659609969bb08e57fa0ffccebf68e214313dd946e4ffa4a8a3e25a812072e852723d6d53f0c6d7edff05476c795ebbefb764dffc82ecf4a77a4932aa0f77cbc957583c2dc4a2c607426b0193b3264eca06b39233e616ddf7ab99a350cdbd8befa4520670359e8d578ba44e72a1dd786e4eb480342d9e48f2b2f30a2b68e348570798ac2f0de506319964c11b15f84a7cfdf8fd2789f4df8115e78c4faee58bd19c19c79d09f7717307c936b996e2a5be2f3ad9914092c8beb7e778742bb1b7ffa9afa11ed4136deabaa82b2b646dca62913852a4f4cfb0deb2050c05f457af810425737cce9b293e3d704e92b16e6deeaa6e63573ba3a11f8e0db12cada311ede82f552cf9cf78653f29d8c4b2011b49eecb11fee66a38d2d9f697cc1dc6533432516c6765c426abe7daecf93f4a1de35643374a7f18a0ba62f44ac96eae15b7b4c3dadd750b6820e551ed832c98f313a64a406c8cbf215565f9f86dcdb1d241be936b44ca28b9519b41b90d125b24b0c29c1250f6d79b2bcf6ecd49eefa7eddcad29e11156187e065896be0ecbdd31b95f4a7071b9e450f27fbdbe8c98b5e7431e3c1df38dfaf77a50d9d00016fb557e140092026ff158c1563e26908bb07ebe98b9ac93a2aa103347d8cc61ca36c545b6b11bf1bf68dba4b3e5e3bb47ca42e20902477ffef1245ae622582cb03a7bf0950cbfdf68e74eae0ff1fa9b6d770b23fef4fad7733d4c9993dd53a2f54c53c0feea4ec4e202b211d9dd047f8bdba4ccc04beb21b9dd790753583c023d746d0ec5362bf8299b9dac1a348a082fcabf22c1d1f0f78973ae0d6b12c1e7d145e8e661cb6f1913ce5ad191c3bf1242b4758a9afe0dc2d1b071b6552c8b7d6bfc6138f97da50446ec16d43e5d2d9800aada6fe2ff01317dec59a2116db46a89ada2632aadf210e0a08f22998337b58a8873a73c2226bb9d1a5877a398f8f0f18555537c427a7f606d75b11485e6abd9d5f69a9e7b03eceb446a12053d684468129469079cfb867731d54064ea8f5a954fa63ed079a2fa42238272f1c5974340ef9a2272dc7be7ccf70283d3aa1c47846e533d8c0fdc5f568018cb427b8a68c6c859fed198080403fe28cb111a1f0ebd7446edba10d790fac1ae5c938c934a5b3205b752eb9b371dc6c8995813b8817c3585b065fc0215abbd7e75b0045fa1ef0eb56609f745ab319a6b8ee97edd9b19f0246bdbb49b0b1099224d6e1e0edf23f652613cb9ec73655edd111fd2ed67e29e40864ebff40247b1aa93820ef12239dedf3ea257a7f3bb899289e7bd039e4be529efa0d88443c762afe44172b50045bbc3d74b43eaf2adb270b8172a75d30e15a13f8a318e1c0af6862acda5560b5d24e1205cc38b71669d0161ffdadc58eb55ee4293e9ad529ef6382ed622f85b38c708068840ea5bde9316012fb0512ff82732b95e90cf09e2c471525da3ab3343d9ec673d1f124c51ae416e09680c16184487f2b87d2babae143270a3de7be94583bafd9fd60197f9d66662417747db159e150fba996a99294220aebbb03f68bbf8251abc25db6bfcf96b8e67aaa0cc18fb31b45a03cfb8e87e34fe6b3c20d3e76cb0225529787d0ec2abfb2a739d9abbc8c313ad28dba551de6531695bd42bdc50ac05bd7ab81d9de45dc5c80c1620edf801a10f924e30666997fd9ca8a4d5e434cb8bbb10f19811223440a70084f7b5ba465dd55905bca31e69c6e4a2a7e1d06f4d9abc3036d40921cac587fb3d56b63893c4205df4085dc04012ceb34466058eb919ef85f98ef32d18d2b10ed882e3ac6e4529affc8875370ab99a27a042b54e7baffbd90f2f76577586d8434f840839738ae3400bfd91bbc147ac72ad7428adae8e8eb304a2dd8454975a32391139ecc18b7641d143bb7b485827d9ba87cab0c188eb368037912bc5f459d8f8c3d70f35b22a998532eb15c5ae0af113669572f9024c6307d2b6114945188b4bde472e5a6b322dba733fbc1e3f87bdbef8cdc07f15ff4860f96c1978bd4422dd516061011202bf8f64da1c590dc928ad062fa35f0a98543e80cbd1f8807b7943bec5089fa73f561b0132336fa35fb6e0a7ee071c8217c2cd6a1a812f8898d20a8a7f10f59c5ab0327d85b3b54cd3791d77359676361bc750b092f04927d0d252904b2f7d5af174c8c0f1a2125a44660e1d3ea783ba8814a1a93be5ef22e310faaf58568d06e08af61a26fc81422b2e4fada8e959cf4d6eb2729b921cc02188ca99ca17f041773c06a29815b22bb9538d71d842f24acb619cafd6d17c77087808b2affc691f18bb3f63fb037e2298040c3b9cc47672d13ce5d6e12d83ce1716082cab1c64b280770eb5e6e981ec2494759061022cf94234c5b349a61e60b6ce98d397e3cf3aae69e2893b8cc8346e848b984a857cbd38de2b8c5e46abc0b869f4c5016057b90d680c27feffd064bd9c4c2b2b762bf5d1b7d42ac3dd2f9916fc519c70b11bc9abf3681e4980b299e46dfde7db2c16b31612ced062e3797d59e99a0b70363785c96af8b71929ede6cf75a736c417ba386ae20cd9e226e3ba5bc85dc3d8850559138dd044c7a4abd4c48bf1cb1ea6f14a36175fff3cf0c2093d688506e53cae792d42770f32dba5eb7466efd0278330dfc670cbfad0b1e8633992d5711d47871bfac7e912e7e18b179ea9bbbe002bab65f828ebb5ba71895766e7881475104e5ab3dd397692a2742f41c48a31d95aaaf3658419ec3a3b80dc1f5da6ae7c238da33b1378802e91fe463971566284586bbb702fa073b50181220d674862a88037a757bd1016a123f4b5b2cbd08a37fb63a31c143bc3384745e8ef097a945a86e25e228b2a13e7e21cb657d4f41f5cf0c61a120becd438c23ef7bbc1be5d48dc3f1973a676a8ecbcf142a506f0c9aecf41d0da07eac38812aa695f12336c3f63bef98e86e33e0c52c942713b704ccbf4081c1ce0f8ebc5f72c43a6cf1671dc14424bfb6994e5b3f13d95825bdfbb9c5b73c9417ef209007c0275bdc6f63affa4dd22538f31bd9ce20b2cca47b01418a101102f9c7124f7d6036f28995813158e318cefef4311b23bb3b486b69431fecedf9cc9654fd409af6396b80c5e5448c99b21306c27b201ec663a2fadcf7ef06f6e5904d7c34f52ab0806be4223055fed788376b0929c773424192719a3e4261ef309e33c94f14425f20bcbbbf87ba79cade41b2bca22adb934697d6599dc97867f2492e83f73b90643d385f0a88c022c2a7584f494286101f6ad7b465a09e3c59977f79e32d4ef987da9ac9accf12906884e38e72ee8c358766706ac3e5fe36b598fb162b0a71c3cece03ec3d7e0fde7beb31085ff426b789011b1a3b6f19ef2c7595ec939f7c82c6f967f1c6750f2d3e13c3339350c33ed62d2eb65fdbb51badd4804606814e47f9d66f5280b88991dfb159e00e138c9a3abc8fa196477b906d868a34fee7f027444f11d0bbc7a6eac480ddf407582b0af9ad7fda7dd85d879a96292fc66f763e9509fcc041fedc6788b6921eee9aa30dec3a6af790024300b5371ac62654d0d008b8a00b02e18f57579a6e61db22794b85533d056ecd1d5518f13683517045d2d9554c6231315002529ba380a696e04b74c7d44dc532ce56de79ba525684929e2230315c3a902891b6cf13508b5d4f7e34d30757d2504ec8daaa56373ab663008416670804198e5c5c97c1bdb76978939f243b533e234d0c302d0befc593704aa6f4cd26f01ffcddd0c3affd57226b3b96f149c6fe6161f33a4bc431efdbd1edd57c2e51ed23c1e10b46ccee89e7566aec20ea26674d77ca13a18f697eba730f6e75198118b418bfb52d3d13834a1703f0ac74dfdc758d5e176898bd14a75feb324589ef4e2dd2ab69bfdf1c4b903d96f161be77c19388ec788bb069213e181344deb40088d15b362974360ef731888c0b5114095e22ce7d412420c35f2bcd6f84f0d402eaa359b7173c07f8fe719f1c368c50295a204856e7e2e92fb59bc190dbe0bbf68e1b21a5df15e4b37c1df7d4efb4b1db8a8d0217c24502dc9faf9f9e9ef18eb6ef9cca09971c5d12d9558206571becb0a5dd81e64ea5b645a4f2f9dcd0c78345ebfe461fb3986c45224ba39fa58eb932c79e4c5675504d932aa61be30631baf6960101ca881dca37107c01695455d6e237db5a8789f65ce7e8fbbb1528e00d27a4772be3a544a9df5d9571fc00798f54e0229345354b19d0a2ffccde0d589e4b44db92bb71daac3c0de7e63608510bd9baf349707fea05d5ad89d8277d60b43f205b2568add26bbe7cbdc852cfc4805a47f461c8cca3b924e6e758ccdb2d31dfc0f50d92fe2f18382b8a26b71cf4db51db383af44d406bce6864b03426335ca2182687c10d89f1c7ca68a9addb36d84c08d12be6dce9dc0b185cee008d9fcfb4bd09e459a230a6de0f18eb24e1dc06ed83fcf1d30acdafbe932f386b6ba38e2df205dfd481f2266cdc853e7e94a5154878ba5524896deac2d9c4e9d5cfe6daf3c2e020032588a0c8e06a2450b61d999d46d4d9dc64de5504ed838c958fbb6deb0bb627a71f4bb40441619f4a4964434b4af1735c00b1247f62ddd028f0dd908f74ed007408e54860f30e2b63cf572f9caca6cecd07361c8c07efd5bbb226b2e8fd8ce444b73cc88fccf3f4b45867972b8c9815391a2d3bda68ffbd26c7e945a90e50b416f609b73c6efdfb59794ffd0e455e53250b96dc3cdf7b65590ca6d4198fade394b41c6ca76e960bb195d4ab2e35a113005cbde322f5e28bfe8c8f37612d6417456b02e8d34c90d8f961a1991dd77b77357dc2f405f9cc787025c5dee190edb4091f02c6ae30224b6ef7bbcce84e3a5cc7c76b21ec089e261a5f409ba363aa50243a7e1156d0c199d98a71b25580c4f7f248286540688008c35244d4792a00ee60f8c1f13e6a7f89d3b17c7c03c89dac765cd58159074b3e6001ccaa2f49910136e47cf656cb166d85a7aa00681db13385c4468863171ee131a58a4db5adae6156ead17d2cf819492a119918eac458046e4b0424b17b78191da4658f3b92a88bca8db40c897fdafbcda0574e35cba195f9620fda5a3c3bdbf8a2079b31e9e809c50fa7d2ea14b5b17dba08809f0cc91e537eb9f20a2146cd89125a13db795b09c0d2c86c5fd0ce355bc31ce98f558f2cd3f91427dfcaa56db41693816a02d51e755495fb2f8020739564f127aa29cbd1f1597ac12f12e0566192445de50ed60b6a41c932ec44b24bf141379ca4748f813d1e168939a3bed227694a366f6f652e9a22ff06645953a4ea9f593258761be3e93e9870845d92eae5873f9a6e1998723e7873325dee45c9d305271512d99eb59a94cf3fd01ba4fc3d6c82add3484db4590e650f68dd3b7fa74f3f17949a778ad6253fd66ab074aed8e57f8424a0fbff13a9ff1876131ab25281e7a0ca3d06049c7bb2236f674003ec9b40d6b312dc15aeeeaa70dd68579fab5fc1a437e8b8a5010b1c23dac9ea7173a46cf17e1be11dd5903739bf0e15fb15e0a97590739e8413fe0e92d54f9de50d4508b5e7e009a622dda05096ddb5fed70403a1c6b8560a1a1c20c2daaaf579704c490aa7480d50861dc6223fc52e91fc364d62838621d6581824ec38ced0a0c8808898ba089bd4fc4006e9c5ca8ca833c8f2680dead69aac6d27050020d1c3dab07e4ac3462a2502fc0536b0a69901d2915417e8a8766049a99a5f4afc04501923a0ca78cd39b2e008b62610a1b57e76bf2ee82ea840300c8173b577f8d5fec1ec13b841a578e873a8266e40da3a58504561834cb25d725be92b581fb1517ac42f2c16ea6b3e4cf9197208ee85c4d5ab96aba8f4745651d9e5671d87ec599935359d8741e65a0f8fd288492be41314830ccd57c5d6105f58d9b4f8b5371733af7b6fe50838ff5911d7fa9812b03b5b9554834e818985f31822a80a8cd2b9bea0ee9f458baec22b09b1ef1ad7905c633388cce817706660df400fc0537682a7b4564a18dbde9fe2b9108484ccf6f42c63e57a17ee49356fce0077d6a47b2830cec74a6c6ae2f95bef3268469520a47738cbd828649f182b7e8dcd3449910d0a9416ff3926bea3d0a202ec76a3fd38059150c0454f085e66d0f681efd9cf73dcd7c0e58e4783c6ea52fb97d80edbadc09e2b1e7c2e5d9962270c28aacbd3c52fdf9fdfcf9ce5349beacf2b8946658b348feb344ee07910c8e1c85942249371f2423e347ef13238af604ef4dfeab35bf0e8745d3221b9613034cfb8e2f9a092ebfa0280e208b1c523f957f23b1bcfe979c5971c3a121e4d9bd4c40b69ff62b427f6d63b36615daf24d1b2937562e462550e7282c73e4453d32625e5c9d4c211c007907a4af4088e3c011689bede7971a8886dcbea8c6a62b3d0b7b359d46aebf1617c9b51f7f7ef583d6e610eb46a79ff44d2691124b0ed1368100532f18aaa24b381d67f6071ffae3934affcf968330930e17972cf58950be8d6ff154584ae009629e97a5ddadd4aa6d7e057ba6677a7a5da28e3792e1e634789f09808e0af78710c65e1b258729c5e2c42d95164e597c123b7b87813457e35752e76855ab5945830b5bd1c2a3bf0d197ee69e3ea11f8b16116531731623530d3f46cc8b0a22ded0c2c9ed79aa1d4d85b3df9cd3408e3215b95cda46624111d24b011fc6d4abd98e1ae0695505b36a556dcf9ffc4386fbe927f2fbab7bf790a48d01b61bc8da78aabf", 0x2000, &(0x7f0000005a00)={&(0x7f0000004ec0)={0x50, 0xfffffffffffffffe, 0x100000001, {0x7, 0x2d, 0x4, 0x4080000, 0x4, 0x9, 0x8, 0x1, 0x0, 0x0, 0x80}}, &(0x7f0000004f40)={0x18, 0xfffffffffffffffe, 0x4, {0x9}}, &(0x7f0000004f80)={0x18, 0x0, 0x9, {0x9}}, &(0x7f0000004fc0)={0x18, 0x0, 0xffffffffffffffff, {0x9}}, &(0x7f0000005000)={0x18, 0x0, 0x1, {0x800}}, &(0x7f0000005040)={0x28, 0x0, 0x1, {{0x7fff, 0x8, 0x1, r5}}}, &(0x7f0000005080)={0x60, 0x0, 0xe6, {{0x0, 0x7ff, 0x3, 0x7fff, 0x8, 0x7, 0x0, 0x3ff}}}, &(0x7f0000005100)={0x18, 0x0, 0x8, {0x823}}, &(0x7f0000005140)={0x11, 0x0, 0x4, {'\x00'}}, &(0x7f0000005180)={0x20, 0x0, 0x1ab, {0x0, 0x14}}, &(0x7f0000005200)={0x78, 0xfffffffffffffffe, 0xb, {0x2, 0xbeb, 0x0, {0x0, 0x5, 0x9, 0x6, 0x7, 0x286, 0x7977, 0x0, 0x5a95, 0x6000, 0x9, r10, r11, 0x1c, 0x7}}}, &(0x7f0000005340)={0x90, 0xffffffffffffffda, 0x9, {0x2, 0x2, 0xe90, 0xa, 0x9, 0x2c, {0x3, 0x7, 0x4, 0x6, 0x0, 0x0, 0x8, 0x7, 0x401, 0xc000, 0x4, r12, r13, 0x7fffffff, 0x605}}}, &(0x7f0000005400)={0x10, 0x0, 0x5}, &(0x7f0000005580)={0xc8, 0xfffffffffffffffe, 0x5, [{{0x1, 0x3, 0x3, 0x40, 0x8bed, 0x81, {0x6, 0x2, 0x7, 0x0, 0x0, 0x6, 0x101, 0xee78088, 0xfffffffe, 0x4000, 0x5, r14, r15, 0x5, 0x9b0}}, {0x4, 0x0, 0x1c, 0xfffff19c, '))!;((({/}+/\x81%([}^#\\\'z{--\x87\\$'}}]}, &(0x7f0000005680)={0xa0, 0x0, 0x8, {{0x0, 0x0, 0xe, 0xd, 0x3, 0x3, {0x0, 0x8, 0x8, 0xff, 0x7, 0x8, 0x5, 0x5, 0xfffffffb, 0x2000, 0x3, 0xffffffffffffffff, 0xffffffffffffffff, 0x6}}, {0x0, 0x8}}}, &(0x7f0000005740)={0x20, 0x0, 0x1, {0x2, 0x0, 0x9, 0x401}}, &(0x7f00000058c0)={0x130, 0xfffffffffffffffe, 0x90000000000, {0x6, 0x2, 0x0, '\x00', {0x200, 0x0, 0x10000, 0x1, r16, 0xee01, 0x8000, '\x00', 0x4, 0x2, 0x200, 0x9, {0x3, 0x5}, {0x8, 0x8}, {0x8, 0x18000}, {0x4, 0x7fff}, 0x7, 0x0, 0x1, 0x6}}}}) 0s ago: executing program 1 (id=1779): ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000240)={@local, 0x1}) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) (async) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) accept4(r0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0) (async) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io(r1, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r1, 0x0, 0x0) (async) syz_usb_control_io$printer(r1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) syz_usb_control_io$sierra_net(r1, &(0x7f0000000100)={0xc, &(0x7f0000000180)={0x0, 0x3, 0xae, {0xae, 0x23, "5a090a24a5dcf2d11d5d7e3d6faf3328b645e7701bbe994ebb3bc1f926ef9454797b1d442dbb760884eba4b2002d713b6aa0c5fc5002f557d0326d7d72ea6f612e0384c5c83a43ed8cf6ea1270472aec2c77a582889a4cdff1df75bb335898f19337eb7649adc44feb546fc90c7a9b069c5d4a70f7257ad71ba69249830bf50966ab0ea01f74d66bd542b1a8cbcd82f63a60a8fbda64fd10977d09b047a327c97c61486e9ce9dcf25ce9513d"}}, &(0x7f00000002c0)={0x0, 0x3, 0xcd, @string={0xcd, 0x3, "c7cf6d2972ae28b4e5c6285ea69275aab689d5d1941325031f26e32abc81c6a6c9908130cc0afbc72e6cb77bd80bb78f68d7f9641c413d6d985d97737548b23a8054ecad915947c3319249400308e6f4d4a3d3d4577cc2f5c63761bc41dee38f317396a182959e42ba1c32546fa10c2427fc3807284275e17315be9f57295246e65a2c3e970cdce7d88bf4a450e6f82b5f5ba79c14d95d4e94c23df06f4bd4ef2b0b743a376215645f21b0868129c724d975913602708462509a25f308d81131998454806e6f8d159fd23d"}}}, &(0x7f0000000540)={0x10, &(0x7f0000000440)={0x20, 0xe, 0xfa, "f22d8686d157a4b637943652c6d3dd8d3580bad295326358cb26f6cfa44e14f20a91ae5756409228b1892588dad3cf871b797a0924ca8d59b07feb2c5183ae12db21b291234481c5cf7dbd8a6b2762d71d34ace9c8618e79375e5cc2f53657b66a326d460c16d17736c8b1c112a542a3c091c3bdf7d7fa6e609f9263c61aae1caed7e5dd375e3a7db79d04b236fdb0540aaec44456a65afbbc5231a4d80fc813a302fcb6040fc94326e5e248149a284adfeaab85db7035020d5495b9d99101282bb365532c8f68a00dce17b9657122ddc460413e596ea6ddf94fb1502c098072e29c905fbaaae00c0c4a904fd0512bc0244ac115875d528d4ede"}, &(0x7f0000000880)={0xa1, 0x1, 0x400, "f478b952d26ab35881fe95e07f671bccc143946fa070f63386a73afd5c7196b45fd47847f101fc815edbfd4eaf911c843ff367c5c406ef48d3ca1328d3d34d29bf24f7e585f5a52b67eba3217611a7289e54a525a5be872caa2cd36f9c3161d7fca489c6ff796cbe9cee213339c1bf06cdd4bf1b7a106ed59333c0a5649b9d04022bf4fe43a96176acc13ecec90411efcf94e2d7368c70ac09f0078c6f99c65b00d07bedd981c51d4d248b3e83feaed3d7f6805b7dd4c2bb9e321b2049fe8a5107c0a7765e21cd8dabb556fa012712205432bb74f3685b13843d43e1a36f352766e815251c821c3cfdd85190f133e6ca4c3a8e14f00001c6ce08084551b99246339ed5e2ea183fdaa439e77b1d4a1cd35ecc03adf72351ac83e05a3c7c9440791a5606d2600fbcca22b1b2af3794d3ab18bef528ce732ac3a638508e84b201a0e7908e8db9cddf01796d4e67a84142db3e5ff73427a30c03fb4b1a0847ec03b94f91822cab76152be2e2c009c263053f643125439895acd01667151802dd0fd4f9d8666e72d15100fe44bde52d3e6f6d8c1ea56f086873efd05d412afb1a88bf02aab5956959d1f171d86dc416dbc028331e0428d6a1e254968482e7007935058a4129eda289ea9433d4facde15ba4cdf4c8516b3355f8c8fc0c55e95dc842c13d030aa1522ac795913bdb4893d96ce67c7097d96a73297638ba2b8334c943aedeef3d8acbf50fca09f5edeb8e6653ba9012898168c58974dcb18d7d35f6dc1dfb897f690024b3b94c91af71f6e2066256dfb64710ba7d62a81c016400649d531efa5a8688881d0ad0b282e1de55042d610bda4fa3402a328ec84b01779fb83653f8b2c99edbfc8d02902b996f62b8c5fce301229ca1aa9cd31ddf1c7a58176413dc79164495160bab14b5c4a91e624fc7609e2a75621a25ca116d90b87b672e9183042a64ad93dbda747fb83ba3422714a7cf5a53f0867b1d44480af678b2bdcdbce504a143607f42b8b7bca9c07f02da4a5ca3fe105f7dc7f4795e687f60a6f9e9c6951495cca5893bdb1eee6eb711561fdb402dc2d7d08698c74be15a356db6f85e705a3091769bc3f8ae81e39d1aa55e4bba5f8db1adfd241536e918b75a7b3889e7a23653352a33ab8ea447163050b7fe73d25c3837f78f7252e12c0a6c4b6b05d3ca2df77b3bf9acf297e72ee98eac0f4b868a4fec13d9f7d49a709b37cc36edc468e21bce6b7544694c9473160357a6a9edef87806e5dcda82eb0dbd31b02b56231596bcd4d86cc17b14e042f23080548896f59bc43fca33a77abbf49df55ee57f854639392197915d2fb56a68e88b72cce70b18e26f47cc6a43e5c92b896d47ad1691c695dde4e0a6dfbb717eef2ff7e994d1377e657d0b999b99478da40b8ce754f115dc284daa79dd8edecc59e59cffd88849c03cb65d738762eba"}, &(0x7f00000003c0)={0x21, 0x0, 0x3, "9afeb3"}}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_ethernet(0xc2, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, 0x0) r4 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x82002) ioctl$CEC_S_MODE(r4, 0x40046109, &(0x7f0000000140)=0x12) close(r4) (async) close(r4) r5 = syz_open_dev$sg(&(0x7f0000000280), 0x5dc, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f00000002c0)=ANY=[]) sched_setscheduler(0x0, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001080)=@mangle={'mangle\x00', 0x2, 0x6, 0x674, 0x128, 0x3ec, 0x0, 0x61c, 0x128, 0x708, 0x708, 0x708, 0x708, 0x708, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x3b}, @private1, [0x0, 0x0, 0xffffffff, 0xffffff00], [0x0, 0x0, 0xffffff00], 'veth1_to_hsr\x00', 'macvtap0\x00', {}, {}, 0x6, 0x3, 0x0, 0x15}, 0x0, 0xd4, 0x104, 0x0, {0x7a00000010000000}, [@common=@ah={{0x30}, {[0x4d6, 0x4d6], 0x5, 0xf9, 0x2}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0x2}, {0x0, 0x3}, 0xaf3f, 0xdee7}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @dev, [], [0xff], 'caif0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x6, 0x6f}, 0x0, 0x1a8, 0x1dc, 0x0, {}, [@common=@inet=@recent1={{0x104}, {0x0, 0x1, 0x8, 0x1, 'syz1\x00', 0x9, [0xff000000, 0xff, 0xffffffff]}}]}, @common=@inet=@SET3={0x34, 'SET\x00', 0x3, {{0x0, 0xff}, {0x3, 0xff}, {}, 0x300}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0x0, 0xff0000ff, 0xff000000, 0xff000000], [0x0, 0xff000000, 0xff000000], 'dummy0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xa4, 0xe8, 0x48000000}, @DNPT={0x44, 'DNPT\x00', 0x0, {@ipv4=@rand_addr=0x64010102, @ipv4=@empty, 0x3c, 0xd, 0x4a9}}}, {{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @empty, [0xff000000, 0xff000000, 0xff000000, 0xffffff00], [0xffffff00, 0x0, 0xff000000, 0xffffff00], 'ip6_vti0\x00', 'pimreg1\x00', {0xff}, {0xff}, 0x67, 0x6, 0x0, 0x5}, 0x0, 0xd4, 0xf8, 0x0, {}, [@common=@inet=@dccp={{0x30}, {[0x4e23, 0x4e20], [0x4e22, 0x4e21], 0x1, 0x2, 0x5, 0x81}}]}, @unspec=@CHECKSUM={0x24}}, {{@uncond, 0x0, 0xc8, 0xec, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x8}}]}, @inet=@DSCP={0x24, 'DSCP\x00', 0x0, {0xd}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x6d0) (async) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001080)=@mangle={'mangle\x00', 0x2, 0x6, 0x674, 0x128, 0x3ec, 0x0, 0x61c, 0x128, 0x708, 0x708, 0x708, 0x708, 0x708, 0x6, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x3b}, @private1, [0x0, 0x0, 0xffffffff, 0xffffff00], [0x0, 0x0, 0xffffff00], 'veth1_to_hsr\x00', 'macvtap0\x00', {}, {}, 0x6, 0x3, 0x0, 0x15}, 0x0, 0xd4, 0x104, 0x0, {0x7a00000010000000}, [@common=@ah={{0x30}, {[0x4d6, 0x4d6], 0x5, 0xf9, 0x2}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0x2}, {0x0, 0x3}, 0xaf3f, 0xdee7}}}, {{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @dev, [], [0xff], 'caif0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x0, 0x6, 0x6f}, 0x0, 0x1a8, 0x1dc, 0x0, {}, [@common=@inet=@recent1={{0x104}, {0x0, 0x1, 0x8, 0x1, 'syz1\x00', 0x9, [0xff000000, 0xff, 0xffffffff]}}]}, @common=@inet=@SET3={0x34, 'SET\x00', 0x3, {{0x0, 0xff}, {0x3, 0xff}, {}, 0x300}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0x0, 0xff0000ff, 0xff000000, 0xff000000], [0x0, 0xff000000, 0xff000000], 'dummy0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xa4, 0xe8, 0x48000000}, @DNPT={0x44, 'DNPT\x00', 0x0, {@ipv4=@rand_addr=0x64010102, @ipv4=@empty, 0x3c, 0xd, 0x4a9}}}, {{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @empty, [0xff000000, 0xff000000, 0xff000000, 0xffffff00], [0xffffff00, 0x0, 0xff000000, 0xffffff00], 'ip6_vti0\x00', 'pimreg1\x00', {0xff}, {0xff}, 0x67, 0x6, 0x0, 0x5}, 0x0, 0xd4, 0xf8, 0x0, {}, [@common=@inet=@dccp={{0x30}, {[0x4e23, 0x4e20], [0x4e22, 0x4e21], 0x1, 0x2, 0x5, 0x81}}]}, @unspec=@CHECKSUM={0x24}}, {{@uncond, 0x0, 0xc8, 0xec, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x8}}]}, @inet=@DSCP={0x24, 'DSCP\x00', 0x0, {0xd}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x6d0) socket$inet_tcp(0x2, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) kernel console output (not intermixed with test programs): common_setsockopt+0x10/0x10 [ 400.421391][T11420] do_sock_setsockopt+0x17c/0x1b0 [ 400.421405][T11420] __ia32_sys_setsockopt+0x13d/0x1b0 [ 400.421419][T11420] __do_fast_syscall_32+0x1d2/0x540 [ 400.421430][T11420] ? lockdep_hardirqs_on+0x7a/0x110 [ 400.421439][T11420] ? do_fast_syscall_32+0x33/0x70 [ 400.421448][T11420] ? asm_int80_emulation+0x1a/0x20 [ 400.421456][T11420] ? do_int80_emulation+0x20e/0x400 [ 400.421468][T11420] do_fast_syscall_32+0x33/0x70 [ 400.421478][T11420] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 400.421488][T11420] RIP: 0023:0xf743d539 [ 400.421497][T11420] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 400.421505][T11420] RSP: 002b:00000000f546650c EFLAGS: 00000206 ORIG_RAX: 000000000000016e [ 400.421516][T11420] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 400.421522][T11420] RDX: 0000000000000080 RSI: 0000000080000140 RDI: 0000000000000110 [ 400.421528][T11420] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 400.421533][T11420] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 400.421538][T11420] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 400.421551][T11420] [ 400.421565][T11420] Mem-Info: [ 400.730174][T11420] active_anon:6506 inactive_anon:0 isolated_anon:0 [ 400.730174][T11420] active_file:13645 inactive_file:40048 isolated_file:0 [ 400.730174][T11420] unevictable:768 dirty:208 writeback:0 [ 400.730174][T11420] slab_reclaimable:10913 slab_unreclaimable:99847 [ 400.730174][T11420] mapped:37861 shmem:1362 pagetables:1305 [ 400.730174][T11420] sec_pagetables:0 bounce:0 [ 400.730174][T11420] kernel_misc_reclaimable:0 [ 400.730174][T11420] free:1297546 free_pcp:12266 free_cma:0 [ 400.775876][T11420] Node 0 active_anon:26024kB inactive_anon:0kB active_file:54580kB inactive_file:159992kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:151444kB dirty:832kB writeback:0kB shmem:3912kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12792kB pagetables:5096kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 400.816689][T11420] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:124kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 400.855224][T11420] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 400.975126][T11420] lowmem_reserve[]: 0 2494 2495 2495 2495 [ 400.981499][T11420] Node 0 DMA32 free:1297856kB boost:0kB min:34216kB low:42768kB high:51320kB reserved_highatomic:0KB free_highatomic:0KB active_anon:26060kB inactive_anon:0kB active_file:54580kB inactive_file:159992kB unevictable:1536kB writepending:856kB zspages:0kB present:3129332kB managed:2554116kB mlocked:0kB bounce:0kB free_pcp:30272kB local_pcp:19696kB free_cma:0kB [ 401.023932][T11420] lowmem_reserve[]: 0 0 1 1 1 [ 401.076024][T11420] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 401.127933][T11420] lowmem_reserve[]: 0 0 0 0 0 [ 401.132670][T11420] Node 1 Normal free:3876912kB boost:0kB min:55668kB low:69584kB high:83500kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:20064kB local_pcp:8768kB free_cma:0kB [ 401.222586][T11420] lowmem_reserve[]: 0 0 0 0 0 [ 401.228101][T11420] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 401.240845][T11420] Node 0 DMA32: 1272*4kB (UM) 2492*8kB (UME) 1098*16kB (UME) 447*32kB (UME) 306*64kB (UME) 156*128kB (UM) 121*256kB (UM) 54*512kB (UME) 32*1024kB (UM) 8*2048kB (UM) 267*4096kB (UM) = 1297856kB [ 401.306888][T11420] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 401.330206][T11420] Node 1 Normal: 188*4kB (UE) 48*8kB (UME) 34*16kB (UME) 61*32kB (UME) 16*64kB (UME) 8*128kB (UME) 8*256kB (UME) 3*512kB (UM) 3*1024kB (UM) 1*2048kB (E) 943*4096kB (M) = 3876912kB [ 401.361418][T11420] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 401.371311][T11420] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 401.382324][T11420] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 401.410602][T11420] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 401.420990][T11420] 55051 total pagecache pages [ 401.441246][T11420] 0 pages in swap cache [ 401.446171][T11420] Free swap = 124996kB [ 401.450321][T11420] Total swap = 124996kB [ 401.454575][T11420] 2097051 pages RAM [ 401.458483][T11077] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 401.472114][T11420] 0 pages HighMem/MovableOnly [ 401.477742][T11420] 426624 pages reserved [ 401.481907][T11420] 0 pages cma reserved [ 401.552287][T11421] syz.2.1413 (11421): drop_caches: 2 [ 401.616981][T11077] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF4, changing to 0x84 [ 401.630515][T11077] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 1023 [ 401.644993][T11077] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 401.674989][T11077] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 401.694971][T11077] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 0 [ 401.707784][T11077] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 401.716914][T11077] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.724914][T11077] usb 6-1: Product: syz [ 401.740021][T11077] usb 6-1: Manufacturer: syz [ 401.744632][T11077] usb 6-1: SerialNumber: syz [ 401.753283][T11077] usb 6-1: config 0 descriptor?? [ 401.763838][T11431] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 401.774083][T11077] usb 6-1: ucan: probing device on interface #0 [ 401.780833][T11077] usb 6-1: ucan: invalid endpoint configuration [ 401.795971][T11077] usb 6-1: ucan: probe failed; try to update the device firmware [ 402.071908][T11077] usb 6-1: USB disconnect, device number 4 [ 403.191437][T11451] FAULT_INJECTION: forcing a failure. [ 403.191437][T11451] name failslab, interval 1, probability 0, space 0, times 0 [ 403.352732][T11451] CPU: 1 UID: 0 PID: 11451 Comm: syz.2.1425 Tainted: G L syzkaller #0 PREEMPT(full) [ 403.352759][T11451] Tainted: [L]=SOFTLOCKUP [ 403.352764][T11451] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 403.352772][T11451] Call Trace: [ 403.352778][T11451] [ 403.352785][T11451] dump_stack_lvl+0xe8/0x150 [ 403.352809][T11451] should_fail_ex+0x412/0x560 [ 403.352831][T11451] should_failslab+0xa8/0x100 [ 403.352850][T11451] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 403.352874][T11451] ? __alloc_skb+0x1d7/0x390 [ 403.352890][T11451] ? __local_bh_enable_ip+0xd0/0x130 [ 403.352906][T11451] ? __alloc_skb+0x193/0x390 [ 403.352924][T11451] __alloc_skb+0x1d7/0x390 [ 403.352945][T11451] ctrl_getfamily+0x3d0/0x5c0 [ 403.352966][T11451] ? __pfx_ctrl_getfamily+0x10/0x10 [ 403.352985][T11451] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 403.353013][T11451] genl_family_rcv_msg_doit+0x22a/0x330 [ 403.353032][T11451] ? __asan_memcpy+0x40/0x70 [ 403.353055][T11451] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 403.353086][T11451] ? __dev_queue_xmit+0x274/0x3850 [ 403.353114][T11451] genl_rcv_msg+0x61c/0x7a0 [ 403.353139][T11451] ? __pfx_genl_rcv_msg+0x10/0x10 [ 403.353156][T11451] ? __pfx_ctrl_getfamily+0x10/0x10 [ 403.353177][T11451] ? __pfx_ref_tracker_free+0x10/0x10 [ 403.353202][T11451] netlink_rcv_skb+0x232/0x4b0 [ 403.353220][T11451] ? __pfx_genl_rcv_msg+0x10/0x10 [ 403.353240][T11451] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 403.353254][T11451] ? genl_rcv+0x19/0x40 [ 403.353287][T11451] ? down_read+0x272/0x2e0 [ 403.353304][T11451] ? genl_rcv+0xd/0x40 [ 403.353323][T11451] genl_rcv+0x28/0x40 [ 403.353340][T11451] netlink_unicast+0x80f/0x9b0 [ 403.353370][T11451] ? __pfx_netlink_unicast+0x10/0x10 [ 403.353390][T11451] ? __alloc_skb+0x193/0x390 [ 403.353408][T11451] ? netlink_sendmsg+0x650/0xb40 [ 403.353421][T11451] ? skb_put+0x11b/0x210 [ 403.353442][T11451] netlink_sendmsg+0x813/0xb40 [ 403.353466][T11451] ? __pfx_netlink_sendmsg+0x10/0x10 [ 403.353486][T11451] ? aa_sock_msg_perm+0xf1/0x1b0 [ 403.353506][T11451] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 403.353526][T11451] __sys_sendto+0x709/0x7a0 [ 403.353548][T11451] ? __pfx___sys_sendto+0x10/0x10 [ 403.353579][T11451] ? __might_fault+0xaf/0x130 [ 403.353621][T11451] __ia32_compat_sys_socketcall+0x765/0xa10 [ 403.353645][T11451] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 403.353673][T11451] ? ksys_write+0x242/0x270 [ 403.353696][T11451] ? __pfx_ksys_write+0x10/0x10 [ 403.353728][T11451] ? asm_int80_emulation+0x1a/0x20 [ 403.353746][T11451] ? asm_int80_emulation+0x1a/0x20 [ 403.353762][T11451] do_int80_emulation+0x111/0x400 [ 403.353780][T11451] ? clear_bhb_loop+0x60/0xb0 [ 403.353794][T11451] ? clear_bhb_loop+0x60/0xb0 [ 403.353812][T11451] asm_int80_emulation+0x1a/0x20 [ 403.353826][T11451] RIP: 0023:0xf715572b [ 403.353840][T11451] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 403.353853][T11451] RSP: 002b:00000000f541534c EFLAGS: 00000246 ORIG_RAX: 0000000000000066 [ 403.353870][T11451] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f54153f4 [ 403.353881][T11451] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 403.353890][T11451] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 403.353899][T11451] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 403.353908][T11451] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 403.353933][T11451] [ 404.081258][T11466] lo: Caught tx_queue_len zero misconfig [ 404.198362][T11469] pim6reg: entered allmulticast mode [ 404.209480][T11469] pim6reg: left allmulticast mode [ 404.730381][T11484] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 404.766625][T11482] batadv_slave_1: entered promiscuous mode [ 404.991775][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 405.010200][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 405.087631][T11483] batadv_slave_1: left promiscuous mode [ 405.382679][T11500] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1442'. [ 405.465029][T11077] usb 2-1: new full-speed USB device number 31 using dummy_hcd [ 405.632637][T11077] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 405.666733][T11077] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 405.680176][T11077] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 405.690314][T11077] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 405.701107][T11077] usb 2-1: Product: syz [ 405.705419][T11077] usb 2-1: Manufacturer: syz [ 405.710026][T11077] usb 2-1: SerialNumber: syz [ 406.072777][T11077] usb 2-1: 0:2 : does not exist [ 406.114589][T11077] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 406.262634][T11077] usb 2-1: USB disconnect, device number 31 [ 406.535520][ T5893] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 406.697301][ T5893] usb 6-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 406.713092][ T5893] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 406.799849][T11519] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1447'. [ 406.910546][ T5893] usb 6-1: Product: syz [ 406.932028][ T5893] usb 6-1: Manufacturer: syz [ 406.984763][ T5893] usb 6-1: SerialNumber: syz [ 407.111792][T11527] xt_policy: output policy not valid in PREROUTING and INPUT [ 407.431187][ T5893] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 407.451449][ T5893] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 408.508040][T11545] netlink: 'syz.2.1454': attribute type 13 has an invalid length. [ 409.147462][ T5893] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 409.320943][ T5929] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 409.323370][ T5894] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 409.356363][ T5937] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 409.391193][ T5937] dvb_usb_az6027 3-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 409.417305][ T5929] dvb_usb_az6027 1-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 409.444674][ T5894] dvb_usb_az6027 5-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 409.488352][ T5937] usb 3-1: USB disconnect, device number 20 [ 409.488352][ T5929] usb 1-1: USB disconnect, device number 27 [ 409.550599][ T5894] usb 5-1: USB disconnect, device number 14 [ 409.935556][ T5929] usb 1-1: new high-speed USB device number 28 using dummy_hcd [ 410.097332][ T5929] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 410.109935][ T5929] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 410.137194][ T5929] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 410.180476][ T5929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 410.227072][ T5929] usb 1-1: SerialNumber: syz [ 410.425121][ T5929] usb 1-1: 0:2 : does not exist [ 410.505802][ T5937] usb 2-1: new low-speed USB device number 32 using dummy_hcd [ 410.574453][ T5893] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001008. ret = -EPROTO [ 410.574778][ T5929] usb 1-1: USB disconnect, device number 28 [ 410.640069][ T5893] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 410.661508][ T5893] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 410.685796][ T5937] usb 2-1: device descriptor read/64, error -71 [ 410.688007][ T5893] lan78xx 6-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 410.732986][ T5893] lan78xx 6-1:1.0: probe with driver lan78xx failed with error -71 [ 410.741986][T11571] FAULT_INJECTION: forcing a failure. [ 410.741986][T11571] name failslab, interval 1, probability 0, space 0, times 0 [ 410.770476][T11571] CPU: 0 UID: 0 PID: 11571 Comm: syz.2.1465 Tainted: G L syzkaller #0 PREEMPT(full) [ 410.770501][T11571] Tainted: [L]=SOFTLOCKUP [ 410.770506][T11571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 410.770516][T11571] Call Trace: [ 410.770522][T11571] [ 410.770529][T11571] dump_stack_lvl+0xe8/0x150 [ 410.770553][T11571] should_fail_ex+0x412/0x560 [ 410.770577][T11571] should_failslab+0xa8/0x100 [ 410.770596][T11571] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 410.770619][T11571] ? __alloc_skb+0x193/0x390 [ 410.770637][T11571] ? __alloc_skb+0x1d7/0x390 [ 410.770651][T11571] ? __local_bh_enable_ip+0xd0/0x130 [ 410.770668][T11571] ? __alloc_skb+0x193/0x390 [ 410.770686][T11571] __alloc_skb+0x1d7/0x390 [ 410.770706][T11571] netlink_ack+0x146/0xa50 [ 410.770728][T11571] ? __kmalloc_cache_noprof+0x3d1/0x6e0 [ 410.770751][T11571] nfnetlink_rcv+0x2517/0x27b0 [ 410.770801][T11571] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 410.770837][T11571] ? ref_tracker_free+0x693/0x840 [ 410.770879][T11571] ? __netlink_deliver_tap+0x807/0x850 [ 410.770895][T11571] ? netlink_deliver_tap+0x2e/0x1b0 [ 410.770926][T11571] netlink_unicast+0x80f/0x9b0 [ 410.770954][T11571] ? __pfx_netlink_unicast+0x10/0x10 [ 410.770975][T11571] ? __alloc_skb+0x193/0x390 [ 410.770991][T11571] ? netlink_sendmsg+0x650/0xb40 [ 410.771006][T11571] ? skb_put+0x11b/0x210 [ 410.771025][T11571] netlink_sendmsg+0x813/0xb40 [ 410.771049][T11571] ? __pfx_netlink_sendmsg+0x10/0x10 [ 410.771069][T11571] ? aa_sock_msg_perm+0xf1/0x1b0 [ 410.771090][T11571] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 410.771108][T11571] ? __pfx_netlink_sendmsg+0x10/0x10 [ 410.771122][T11571] ____sys_sendmsg+0xa68/0xad0 [ 410.771149][T11571] ? __pfx_____sys_sendmsg+0x10/0x10 [ 410.771171][T11571] ? kstrtoull+0x12f/0x1d0 [ 410.771195][T11571] ___sys_sendmsg+0x2a5/0x360 [ 410.771214][T11571] ? __lock_acquire+0x6b5/0x2cf0 [ 410.771237][T11571] ? __pfx____sys_sendmsg+0x10/0x10 [ 410.771258][T11571] ? get_pid_task+0x20/0x1f0 [ 410.771273][T11571] ? get_pid_task+0x20/0x1f0 [ 410.771287][T11571] ? get_pid_task+0x20/0x1f0 [ 410.771325][T11571] ? __fget_files+0x2a/0x420 [ 410.771340][T11571] ? __fget_files+0x3a0/0x420 [ 410.771361][T11571] __sys_sendmsg+0x183/0x260 [ 410.771382][T11571] ? __pfx___sys_sendmsg+0x10/0x10 [ 410.771418][T11571] ? __pfx_ksys_write+0x10/0x10 [ 410.771444][T11571] __do_fast_syscall_32+0x1d2/0x540 [ 410.771461][T11571] ? lockdep_hardirqs_on+0x7a/0x110 [ 410.771475][T11571] ? do_fast_syscall_32+0x33/0x70 [ 410.771489][T11571] ? asm_int80_emulation+0x1a/0x20 [ 410.771502][T11571] ? do_int80_emulation+0x20e/0x400 [ 410.771521][T11571] do_fast_syscall_32+0x33/0x70 [ 410.771537][T11571] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 410.771552][T11571] RIP: 0023:0xf73ed539 [ 410.771565][T11571] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 410.771576][T11571] RSP: 002b:00000000f541650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 410.771591][T11571] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 410.771599][T11571] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 410.771606][T11571] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 410.771613][T11571] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 410.771620][T11571] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 410.771640][T11571] [ 410.785024][ T5893] usb 6-1: USB disconnect, device number 5 [ 410.931940][T10621] udevd[10621]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 410.999813][T11576] fuse: Bad value for 'fd' [ 411.216270][ T5937] usb 2-1: new low-speed USB device number 33 using dummy_hcd [ 411.288198][ T1157] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 411.363406][ T5937] usb 2-1: device descriptor read/64, error -71 [ 411.385302][ T798] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 411.459491][ T1157] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 411.501651][ T5937] usb usb2-port1: attempt power cycle [ 411.545116][ T798] usb 1-1: Using ep0 maxpacket: 32 [ 411.560540][ T798] usb 1-1: config 0 has an invalid interface number: 8 but max is 0 [ 411.575081][ T798] usb 1-1: config 0 has no interface number 0 [ 411.584614][ T1157] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 411.598517][ T798] usb 1-1: config 0 interface 8 has no altsetting 0 [ 411.608754][ T798] usb 1-1: New USB device found, idVendor=1199, idProduct=901c, bcdDevice=5b.56 [ 411.721761][ T798] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.740448][ T798] usb 1-1: Product: syz [ 411.789516][ T798] usb 1-1: Manufacturer: syz [ 411.797478][ T798] usb 1-1: SerialNumber: syz [ 411.814699][ T798] usb 1-1: config 0 descriptor?? [ 411.845069][ T5937] usb 2-1: new low-speed USB device number 34 using dummy_hcd [ 411.876713][ T5937] usb 2-1: device descriptor read/8, error -71 [ 412.110469][T11584] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 412.119227][T11584] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 412.128024][ T5937] usb 2-1: new low-speed USB device number 35 using dummy_hcd [ 412.327223][ T1157] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 412.340983][ T5937] usb 2-1: device descriptor read/8, error -71 [ 412.637156][ T5937] usb usb2-port1: unable to enumerate USB device [ 412.728295][T11598] ip6tnl0: Caught tx_queue_len zero misconfig [ 412.951301][ T1157] bridge_slave_1: left allmulticast mode [ 412.972435][ T1157] bridge_slave_1: left promiscuous mode [ 412.990296][ T1157] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.995068][ T798] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 413.023169][ T1157] bridge_slave_0: left allmulticast mode [ 413.034990][ T1157] bridge_slave_0: left promiscuous mode [ 413.054578][ T1157] bridge0: port 1(bridge_slave_0) entered disabled state [ 413.157183][ T798] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 413.192469][ T798] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 413.265132][ T798] usb 3-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 413.307503][ T798] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.360772][ T798] usb 3-1: config 0 descriptor?? [ 413.469324][T11620] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1475'. [ 413.665494][ T9] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 413.813208][T11606] cifs: Unknown parameter 'fd' [ 413.822645][T11629] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1477'. [ 413.851543][ T9] usb 2-1: config 0 has no interfaces? [ 413.864410][ T9] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 413.880959][T11606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 413.904537][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.915470][T11606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 413.918562][ T9] usb 2-1: Product: syz [ 413.936138][ T9] usb 2-1: Manufacturer: syz [ 413.943661][ T9] usb 2-1: SerialNumber: syz [ 413.954408][ T798] usbhid 3-1:0.0: can't add hid device: -71 [ 413.956145][T11632] input: syz0 as /devices/virtual/input/input17 [ 413.964804][ T9] usb 2-1: config 0 descriptor?? [ 413.985697][ T798] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 414.050068][ T798] usb 3-1: USB disconnect, device number 21 [ 414.116149][ T5829] usb 1-1: USB disconnect, device number 29 [ 414.135274][T11629] 8021q: adding VLAN 0 to HW filter on device bond1 [ 414.199543][ T1157] tipc: Left network mode [ 414.275251][ T5893] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 414.347731][T11641] tipc: Enabling of bearer rejected, failed to enable media [ 414.373141][T11641] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1481'. [ 414.383676][ T798] usb 2-1: USB disconnect, device number 36 [ 414.384389][T11641] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1481'. [ 414.447113][ T5893] usb 6-1: Using ep0 maxpacket: 8 [ 414.461022][ T5893] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 17 [ 414.497261][ T5893] usb 6-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 414.535744][ T5893] usb 6-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 414.544234][ T5893] usb 6-1: Product: syz [ 414.555040][ T5829] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 414.604413][ T5893] usb 6-1: Manufacturer: syz [ 414.614859][ T5893] usb 6-1: SerialNumber: syz [ 414.620636][ T1157] hsr_slave_0: left promiscuous mode [ 414.635804][ T1157] hsr_slave_1: left promiscuous mode [ 414.640166][ T5893] usb 6-1: config 0 descriptor?? [ 414.653060][ T1157] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 414.671411][ T1157] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 414.694211][ T1157] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 414.709639][ T5829] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 414.721345][ T1157] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 414.728620][ T5829] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 414.739744][ T5829] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 414.861558][ T5829] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 414.905248][ T1157] veth1_macvtap: left promiscuous mode [ 414.933298][T11639] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 414.945256][ T1157] veth0_macvtap: left promiscuous mode [ 415.028594][ T5829] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 415.036535][ T1157] veth1_vlan: left promiscuous mode [ 415.042694][ T1157] veth0_vlan: left promiscuous mode [ 415.188624][T11639] loop9: detected capacity change from 0 to 7 [ 415.199352][T11639] Dev loop9: unable to read RDB block 7 [ 415.216145][T11639] loop9: unable to read partition table [ 415.225754][T11639] loop9: partition table beyond EOD, truncated [ 415.304906][T11639] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 415.322739][ T5829] usb 1-1: USB disconnect, device number 30 [ 416.043299][T11677] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1485'. [ 416.161257][T11677] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1485'. [ 416.486721][T11685] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1487'. [ 416.498180][T11685] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1487'. [ 416.510103][T11685] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1487'. [ 417.185107][ T5937] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 417.355076][ T5937] usb 1-1: Using ep0 maxpacket: 32 [ 417.367791][ T5937] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 417.378247][ T5937] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 417.392742][ T5937] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 417.408054][ T5937] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 417.603270][ T5937] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 417.626495][ T5937] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.647328][ T5937] usb 1-1: Product: syz [ 417.651553][ T5937] usb 1-1: Manufacturer: syz [ 417.677306][ T5937] usb 1-1: SerialNumber: syz [ 417.761210][ C1] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 417.794129][ T5937] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input18 [ 418.035434][ T5937] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 418.045482][ T5937] (id 0x00) [ 418.130643][ T5937] rc_core: IR keymap rc-imon-pad not found [ 418.143060][ T5937] Registered IR keymap rc-empty [ 418.170179][ T5937] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 418.213457][ T5937] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 418.277234][ T5937] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0 [ 418.301477][ T5937] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0/input19 [ 418.357743][ T5937] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:31> initialized [ 418.813424][ T1157] team0 (unregistering): Port device team_slave_1 removed [ 418.923744][ T1157] team0 (unregistering): Port device team_slave_0 removed [ 419.929791][ T5893] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 419.945612][ T5893] gspca_sunplus: reg_w_riv err -32 [ 419.953397][ T5893] sunplus 6-1:0.0: probe with driver sunplus failed with error -32 [ 419.975928][ T873] usb 1-1: USB disconnect, device number 31 [ 420.352291][T11725] netlink: 'syz.1.1499': attribute type 2 has an invalid length. [ 420.378085][T11725] netlink: 'syz.1.1499': attribute type 2 has an invalid length. [ 420.644807][ T798] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 420.814834][ T5929] usb 6-1: USB disconnect, device number 6 [ 420.835470][ T798] usb 5-1: Using ep0 maxpacket: 16 [ 420.843580][ T798] usb 5-1: config 1 has an invalid interface number: 105 but max is 0 [ 420.877290][ T798] usb 5-1: config 1 has no interface number 0 [ 420.883531][ T798] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 420.918662][ T798] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 420.961874][ T798] usb 5-1: config 1 interface 105 has no altsetting 0 [ 421.004527][T11737] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1502'. [ 421.015084][ T798] usb 5-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 421.041300][ T798] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.056915][T11739] FAULT_INJECTION: forcing a failure. [ 421.056915][T11739] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 421.075179][ T798] usb 5-1: Product: syz [ 421.079385][ T798] usb 5-1: Manufacturer: syz [ 421.104468][T11739] CPU: 0 UID: 0 PID: 11739 Comm: syz.5.1503 Tainted: G L syzkaller #0 PREEMPT(full) [ 421.104496][T11739] Tainted: [L]=SOFTLOCKUP [ 421.104502][T11739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 421.104511][T11739] Call Trace: [ 421.104518][T11739] [ 421.104524][T11739] dump_stack_lvl+0xe8/0x150 [ 421.104548][T11739] should_fail_ex+0x412/0x560 [ 421.104579][T11739] _copy_from_user+0x2d/0xb0 [ 421.104593][T11739] get_compat_msghdr+0xb3/0x4c0 [ 421.104613][T11739] ? _parse_integer_limit+0x1ae/0x1f0 [ 421.104630][T11739] ? __pfx_get_compat_msghdr+0x10/0x10 [ 421.104649][T11739] ? kstrtoull+0x12f/0x1d0 [ 421.104670][T11739] ___sys_sendmsg+0x201/0x360 [ 421.104688][T11739] ? __lock_acquire+0x6b5/0x2cf0 [ 421.104711][T11739] ? __pfx____sys_sendmsg+0x10/0x10 [ 421.104732][T11739] ? get_pid_task+0x20/0x1f0 [ 421.104747][T11739] ? get_pid_task+0x20/0x1f0 [ 421.104761][T11739] ? get_pid_task+0x20/0x1f0 [ 421.104798][T11739] ? __fget_files+0x2a/0x420 [ 421.104813][T11739] ? __fget_files+0x3a0/0x420 [ 421.104837][T11739] __sys_sendmsg+0x183/0x260 [ 421.104857][T11739] ? __pfx___sys_sendmsg+0x10/0x10 [ 421.104885][T11739] ? __pfx_ksys_write+0x10/0x10 [ 421.104917][T11739] __do_fast_syscall_32+0x1d2/0x540 [ 421.104932][T11739] ? lockdep_hardirqs_on+0x7a/0x110 [ 421.104945][T11739] ? do_fast_syscall_32+0x33/0x70 [ 421.104959][T11739] ? asm_int80_emulation+0x1a/0x20 [ 421.104973][T11739] ? do_int80_emulation+0x20e/0x400 [ 421.104993][T11739] do_fast_syscall_32+0x33/0x70 [ 421.105010][T11739] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 421.105027][T11739] RIP: 0023:0xf73dd539 [ 421.105041][T11739] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 421.105054][T11739] RSP: 002b:00000000f540650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 421.105071][T11739] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000280 [ 421.105082][T11739] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 421.105091][T11739] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 421.105099][T11739] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 421.105109][T11739] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 421.105131][T11739] [ 421.336246][ T798] usb 5-1: SerialNumber: syz [ 421.365705][T11728] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 421.385687][T11728] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 421.614661][T11728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.625501][ T9] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 421.626324][T11728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.671208][T11728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.726660][T11728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.756933][T11728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.775459][T11728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.802142][T11728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.810904][T11755] gretap0: entered promiscuous mode [ 421.828879][ T9] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 421.837090][T11728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.852517][ T9] usb 2-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 421.863383][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.874766][T11728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.883769][ T5929] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 421.917354][ T9] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 421.923805][T11728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.090057][ T5929] usb 6-1: Using ep0 maxpacket: 32 [ 422.107589][ T5929] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 422.118684][ T5929] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 422.146833][ T5929] usb 6-1: config 0 descriptor?? [ 422.179046][T11727] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 422.203136][T11727] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 422.217661][T11770] loop2: detected capacity change from 0 to 7 [ 422.227131][T11770] Dev loop2: unable to read RDB block 7 [ 422.233195][T11770] loop2: unable to read partition table [ 422.240558][T11770] loop2: partition table beyond EOD, truncated [ 422.255484][T11770] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 422.279745][T11770] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1511'. [ 422.367820][T11775] netlink: 'syz.0.1512': attribute type 13 has an invalid length. [ 422.415872][ T798] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 422.454592][ T798] aqc111 5-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x1) reg index 0x0001: -32 [ 422.500088][ T5929] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 422.529452][ T798] aqc111 5-1:1.105 eth5: register 'aqc111' at usb-dummy_hcd.4-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter, 16:68:cb:22:c1:19 [ 422.543403][ T5929] usb 6-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 422.560476][ T5929] usb 6-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 422.714755][ T5893] usb 5-1: USB disconnect, device number 15 [ 422.722329][ T5893] aqc111 5-1:1.105 eth5: unregister 'aqc111' usb-dummy_hcd.4-1, USB-C 3.1 to 5GBASE-T Ethernet Adapter [ 422.823380][T11793] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.840282][T11793] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.851495][ T5893] aqc111 5-1:1.105 eth5 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 422.864249][ T5893] aqc111 5-1:1.105 eth5 (unregistered): Failed to write(0x1) reg index 0x0002: -19 [ 422.874642][ T5893] aqc111 5-1:1.105 eth5 (unregistered): Failed to write(0x61) reg index 0x0000: -19 [ 423.170107][T11800] netlink: 'syz.2.1513': attribute type 1 has an invalid length. [ 423.217605][T11800] 8021q: adding VLAN 0 to HW filter on device bond2 [ 423.231836][ T9] gspca_stv0680: usb_control_msg error 2, request = 0x6, error = -71 [ 423.232438][T11799] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1513'. [ 423.275782][ T9] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 423.285683][T11799] bond2: entered promiscuous mode [ 423.290723][T11799] bond2: entered allmulticast mode [ 423.307520][T11803] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1514'. [ 423.325480][ T9] stv0680 2-1:4.0: last error: 86, command = 0x78 [ 423.356666][ T9] usb 2-1: USB disconnect, device number 37 [ 423.403153][T11803] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 423.553906][T11811] netlink: 'syz.4.1515': attribute type 13 has an invalid length. [ 423.786626][ T798] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 423.956881][ T798] usb 1-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 423.973413][ T798] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 423.996678][ T798] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 424.008831][ T798] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 424.481175][ T798] usb 1-1: config 0 descriptor?? [ 424.493704][ T798] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 424.726506][T11827] netlink: 'syz.4.1519': attribute type 4 has an invalid length. [ 424.846966][ T5893] usb 1-1: USB disconnect, device number 32 [ 424.868089][T11833] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 425.057889][ T5937] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 425.134240][T11841] netlink: 'syz.1.1524': attribute type 13 has an invalid length. [ 425.235369][ T5937] usb 3-1: Using ep0 maxpacket: 8 [ 425.244345][ T5937] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 425.256690][ T5937] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 425.275292][ T5937] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 425.291306][ T5937] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x7E, changing to 0xE [ 425.303367][ T5937] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 425.313651][ T5937] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 0 [ 425.324027][ T5937] usb 3-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 425.333512][ T5937] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 425.344251][ T5937] usb 3-1: config 0 descriptor?? [ 425.533346][T11849] netdevsim netdevsim0: Firmware load for './file0/../file0/file0' refused, path contains '..' component [ 425.558608][ T798] usb 3-1: USB disconnect, device number 22 [ 426.118274][T11851] batadv0: left promiscuous mode [ 426.443685][T11851] bridge1: left promiscuous mode [ 426.472321][T10114] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.492895][T10114] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.515688][T10114] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.592279][T10114] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.642531][T11867] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1531'. [ 426.658010][T11867] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1531'. [ 427.256806][T11871] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1533'. [ 427.274223][T11871] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1533'. [ 427.296761][T11871] FAULT_INJECTION: forcing a failure. [ 427.296761][T11871] name failslab, interval 1, probability 0, space 0, times 0 [ 427.315093][ T798] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 427.315093][T11871] CPU: 1 UID: 0 PID: 11871 Comm: syz.2.1533 Tainted: G L syzkaller #0 PREEMPT(full) [ 427.315119][T11871] Tainted: [L]=SOFTLOCKUP [ 427.315124][T11871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 427.315133][T11871] Call Trace: [ 427.315139][T11871] [ 427.315145][T11871] dump_stack_lvl+0xe8/0x150 [ 427.315167][T11871] should_fail_ex+0x412/0x560 [ 427.315191][T11871] should_failslab+0xa8/0x100 [ 427.315211][T11871] kmem_cache_alloc_noprof+0x87/0x6e0 [ 427.315233][T11871] ? skb_clone+0x212/0x3a0 [ 427.315258][T11871] skb_clone+0x212/0x3a0 [ 427.315280][T11871] __netlink_deliver_tap+0x404/0x850 [ 427.315308][T11871] ? netlink_deliver_tap+0x2e/0x1b0 [ 427.315325][T11871] netlink_deliver_tap+0x19c/0x1b0 [ 427.315342][T11871] netlink_sendskb+0x68/0x140 [ 427.315365][T11871] netlink_unicast+0x3a3/0x9b0 [ 427.315394][T11871] ? __pfx_netlink_unicast+0x10/0x10 [ 427.315423][T11871] rtnl_unicast+0x4e/0x60 [ 427.315444][T11871] inet_rtm_getroute+0x1da7/0x2930 [ 427.315466][T11871] ? inet_rtm_getroute+0xe67/0x2930 [ 427.315499][T11871] ? __pfx_inet_rtm_getroute+0x10/0x10 [ 427.315544][T11871] ? __local_bh_enable_ip+0xd0/0x130 [ 427.315563][T11871] ? __dev_queue_xmit+0x1e6c/0x3850 [ 427.315582][T11871] ? __sys_sendmsg+0x183/0x260 [ 427.315621][T11871] ? __pfx_inet_rtm_getroute+0x10/0x10 [ 427.315640][T11871] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 427.315661][T11871] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 427.315677][T11871] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 427.315692][T11871] ? ref_tracker_free+0x693/0x840 [ 427.315709][T11871] ? __copy_skb_header+0xa3/0x4a0 [ 427.315730][T11871] ? __pfx_ref_tracker_free+0x10/0x10 [ 427.315757][T11871] netlink_rcv_skb+0x232/0x4b0 [ 427.315774][T11871] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 427.315796][T11871] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 427.315822][T11871] ? netlink_deliver_tap+0x2e/0x1b0 [ 427.315844][T11871] netlink_unicast+0x80f/0x9b0 [ 427.315872][T11871] ? __pfx_netlink_unicast+0x10/0x10 [ 427.315892][T11871] ? __alloc_skb+0x193/0x390 [ 427.315909][T11871] ? netlink_sendmsg+0x650/0xb40 [ 427.315923][T11871] ? skb_put+0x11b/0x210 [ 427.315943][T11871] netlink_sendmsg+0x813/0xb40 [ 427.315967][T11871] ? __pfx_netlink_sendmsg+0x10/0x10 [ 427.315986][T11871] ? aa_sock_msg_perm+0xf1/0x1b0 [ 427.316007][T11871] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 427.316024][T11871] ? __pfx_netlink_sendmsg+0x10/0x10 [ 427.316039][T11871] ____sys_sendmsg+0xa68/0xad0 [ 427.316065][T11871] ? __pfx_____sys_sendmsg+0x10/0x10 [ 427.316117][T11871] ? kstrtoull+0x12f/0x1d0 [ 427.316141][T11871] ___sys_sendmsg+0x2a5/0x360 [ 427.316159][T11871] ? __lock_acquire+0x6b5/0x2cf0 [ 427.316183][T11871] ? __pfx____sys_sendmsg+0x10/0x10 [ 427.316204][T11871] ? get_pid_task+0x20/0x1f0 [ 427.316221][T11871] ? get_pid_task+0x20/0x1f0 [ 427.316235][T11871] ? get_pid_task+0x20/0x1f0 [ 427.316274][T11871] ? __fget_files+0x2a/0x420 [ 427.316290][T11871] ? __fget_files+0x3a0/0x420 [ 427.316315][T11871] __sys_sendmsg+0x183/0x260 [ 427.316336][T11871] ? __pfx___sys_sendmsg+0x10/0x10 [ 427.316365][T11871] ? __pfx_ksys_write+0x10/0x10 [ 427.316393][T11871] __do_fast_syscall_32+0x1d2/0x540 [ 427.316410][T11871] ? lockdep_hardirqs_on+0x7a/0x110 [ 427.316425][T11871] ? do_fast_syscall_32+0x33/0x70 [ 427.316440][T11871] ? asm_int80_emulation+0x1a/0x20 [ 427.316454][T11871] ? do_int80_emulation+0x20e/0x400 [ 427.316473][T11871] do_fast_syscall_32+0x33/0x70 [ 427.316490][T11871] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 427.316507][T11871] RIP: 0023:0xf73ed539 [ 427.316522][T11871] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 427.316535][T11871] RSP: 002b:00000000f541650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 427.316552][T11871] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000800000c0 [ 427.316562][T11871] RDX: 0000000004008000 RSI: 0000000000000000 RDI: 0000000000000000 [ 427.316571][T11871] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 427.316580][T11871] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 427.316588][T11871] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 427.316613][T11871] [ 427.895639][ T798] usb 5-1: Using ep0 maxpacket: 32 [ 427.902731][ T798] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 427.945471][ T798] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.995772][ T798] usb 5-1: config 0 descriptor?? [ 428.388303][ T798] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 428.409115][T11883] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1536'. [ 428.441646][T11883] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1536'. [ 428.524077][T11883] 8021q: VLANs not supported on ip_vti0 [ 428.604500][T11890] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1537'. [ 428.617313][T11883] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1536'. [ 428.837507][ T5880] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 429.018014][ T5880] usb 3-1: config 0 has an invalid interface number: 98 but max is 0 [ 429.037798][ T5880] usb 3-1: config 0 has no interface number 0 [ 429.051396][ T5880] usb 3-1: config 0 interface 98 has no altsetting 0 [ 429.061547][ T5880] usb 3-1: New USB device found, idVendor=103d, idProduct=0100, bcdDevice=74.0b [ 429.093892][ T5880] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 429.110250][ T5880] usb 3-1: Product: syz [ 429.114438][ T5880] usb 3-1: Manufacturer: syz [ 429.119147][ T5880] usb 3-1: SerialNumber: syz [ 429.124268][T11905] netlink: 'syz.5.1540': attribute type 29 has an invalid length. [ 429.132589][T11905] netlink: 'syz.5.1540': attribute type 3 has an invalid length. [ 429.133153][ T5880] usb 3-1: config 0 descriptor?? [ 429.146630][T11905] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1540'. [ 429.160967][T11905] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(6) [ 429.167633][T11905] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 429.179091][T11905] vhci_hcd vhci_hcd.0: Device attached [ 429.189575][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 429.189589][ T30] audit: type=1326 audit(1770655741.857:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11903 comm="syz.5.1540" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf73dd539 code=0x0 [ 429.232004][T11908] netlink: 'syz.1.1539': attribute type 13 has an invalid length. [ 429.365759][ T5880] usb 3-1: unknown interface protocol 0x90, assuming v1 [ 429.373026][ T5880] usb 3-1: cannot find UAC_HEADER [ 429.410705][ T5880] snd-usb-audio 3-1:0.98: probe with driver snd-usb-audio failed with error -22 [ 429.420029][ T9] usb 43-1: new high-speed USB device number 2 using vhci_hcd [ 429.430175][ T5880] usb 3-1: USB disconnect, device number 23 [ 429.450999][T10621] udevd[10621]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.98/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 429.597520][ T30] audit: type=1800 audit(1770655742.267:42): pid=11913 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1541" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 429.966428][T11906] vhci_hcd: connection reset by peer [ 429.975981][T10112] vhci_hcd vhci_hcd.5: stop threads [ 430.014291][T10112] vhci_hcd vhci_hcd.5: release socket [ 430.041821][T10112] vhci_hcd vhci_hcd.5: disconnect device [ 430.086092][T11927] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1545'. [ 430.200024][T11927] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 430.715915][ T873] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 430.833929][T11938] ip6erspan0: entered allmulticast mode [ 430.948644][ T873] usb 2-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 430.960929][ T873] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 430.993253][ T873] usb 2-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 431.010050][ T873] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 431.048793][ T873] usb 2-1: config 0 descriptor?? [ 431.078402][ T873] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 431.155880][T11944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 431.177393][T11944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 431.190970][T11944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 431.204041][T11944] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 431.270063][T11944] vhci_hcd vhci_hcd.0: pdev(0) rhport(4) sockfd(19) [ 431.276696][T11944] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 431.289291][T11944] vhci_hcd vhci_hcd.0: Device attached [ 431.523203][T11949] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 431.545870][ T873] usb 33-5: new high-speed USB device number 2 using vhci_hcd [ 431.727135][ T5937] usb 2-1: USB disconnect, device number 38 [ 431.811210][T11952] FAULT_INJECTION: forcing a failure. [ 431.811210][T11952] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 431.811225][ T5829] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 431.855742][T11952] CPU: 1 UID: 0 PID: 11952 Comm: syz.2.1550 Tainted: G L syzkaller #0 PREEMPT(full) [ 431.855768][T11952] Tainted: [L]=SOFTLOCKUP [ 431.855774][T11952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 431.855784][T11952] Call Trace: [ 431.855791][T11952] [ 431.855799][T11952] dump_stack_lvl+0xe8/0x150 [ 431.855824][T11952] should_fail_ex+0x412/0x560 [ 431.855849][T11952] _copy_from_user+0x2d/0xb0 [ 431.855865][T11952] get_compat_msghdr+0xb3/0x4c0 [ 431.855887][T11952] ? _parse_integer_limit+0x1ae/0x1f0 [ 431.855907][T11952] ? __pfx_get_compat_msghdr+0x10/0x10 [ 431.855926][T11952] ? kstrtoull+0x12f/0x1d0 [ 431.855951][T11952] ___sys_sendmsg+0x201/0x360 [ 431.855971][T11952] ? __lock_acquire+0x6b5/0x2cf0 [ 431.855995][T11952] ? __pfx____sys_sendmsg+0x10/0x10 [ 431.856017][T11952] ? get_pid_task+0x20/0x1f0 [ 431.856034][T11952] ? get_pid_task+0x20/0x1f0 [ 431.856049][T11952] ? get_pid_task+0x20/0x1f0 [ 431.856089][T11952] ? __fget_files+0x2a/0x420 [ 431.856106][T11952] ? __fget_files+0x3a0/0x420 [ 431.856130][T11952] __sys_sendmsg+0x183/0x260 [ 431.856151][T11952] ? __pfx___sys_sendmsg+0x10/0x10 [ 431.856179][T11952] ? __pfx_ksys_write+0x10/0x10 [ 431.856209][T11952] __do_fast_syscall_32+0x1d2/0x540 [ 431.856227][T11952] ? lockdep_hardirqs_on+0x7a/0x110 [ 431.856243][T11952] ? do_fast_syscall_32+0x33/0x70 [ 431.856258][T11952] ? asm_int80_emulation+0x1a/0x20 [ 431.856273][T11952] ? do_int80_emulation+0x20e/0x400 [ 431.856288][T11952] ? rcu_is_watching+0x15/0xb0 [ 431.856307][T11952] do_fast_syscall_32+0x33/0x70 [ 431.856324][T11952] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 431.856342][T11952] RIP: 0023:0xf73ed539 [ 431.856358][T11952] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 431.856371][T11952] RSP: 002b:00000000f541650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 431.856389][T11952] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080005800 [ 431.856400][T11952] RDX: 0000000000009080 RSI: 0000000000000000 RDI: 0000000000000000 [ 431.856410][T11952] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 431.856419][T11952] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 431.856429][T11952] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 431.856461][T11952] [ 432.285039][ T5829] usb 1-1: Using ep0 maxpacket: 32 [ 432.591385][ T5829] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 432.611429][ T5829] usb 1-1: config 0 has no interface number 0 [ 432.632762][ T5829] usb 1-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 432.668447][ T5829] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 432.679018][ T5829] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.763248][T11958] pim6reg: entered allmulticast mode [ 432.782137][T11958] pim6reg: left allmulticast mode [ 432.892746][ T5829] usb 1-1: Product: syz [ 432.966766][ T5829] usb 1-1: Manufacturer: syz [ 432.971391][ T5829] usb 1-1: SerialNumber: syz [ 432.984798][ T5829] usb 1-1: config 0 descriptor?? [ 432.994885][T11944] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 433.145248][T11077] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 433.375676][ T5937] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 433.427737][T11944] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 433.443862][T11077] usb 2-1: Using ep0 maxpacket: 32 [ 433.466333][T11077] usb 2-1: config 0 has an invalid interface number: 37 but max is 1 [ 433.475958][T11077] usb 2-1: config 0 has no interface number 1 [ 433.487281][T11077] usb 2-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=20.a3 [ 433.503515][T11077] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.547492][ T5937] usb 3-1: Using ep0 maxpacket: 32 [ 433.564019][ T5937] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 433.576705][T11077] usb 2-1: Product: syz [ 433.580884][T11077] usb 2-1: Manufacturer: syz [ 433.601484][ T5937] usb 3-1: config 0 has no interface number 0 [ 433.608904][T11077] usb 2-1: SerialNumber: syz [ 433.634892][ T5937] usb 3-1: config 0 interface 184 has no altsetting 0 [ 433.652423][T11077] usb 2-1: config 0 descriptor?? [ 433.670886][T11944] syz.0.1549 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 433.716649][ T5937] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 433.758038][ T5937] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 433.795857][ T5937] usb 3-1: Product: syz [ 433.805857][ T5937] usb 3-1: Manufacturer: syz [ 433.819628][ T5937] usb 3-1: SerialNumber: syz [ 433.853693][ T5937] usb 3-1: config 0 descriptor?? [ 433.889218][ T5937] smsc75xx v1.0.0 [ 433.961277][T11963] __nla_validate_parse: 1 callbacks suppressed [ 433.961297][T11963] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1553'. [ 434.007019][T11979] netlink: 'syz.4.1556': attribute type 13 has an invalid length. [ 434.081314][T11983] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1557'. [ 434.119991][T11077] usb 2-1: Could not set interface, error -71 [ 434.145897][T11077] usb 2-1: USB disconnect, device number 39 [ 434.280129][T11983] bridge_slave_0: left allmulticast mode [ 434.301618][T11983] bridge_slave_0: left promiscuous mode [ 434.313899][T11983] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.364788][T11983] bridge_slave_1: left allmulticast mode [ 434.425986][T11983] bridge_slave_1: left promiscuous mode [ 434.500584][ T5937] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 434.500613][T11983] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.519828][ T5937] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 434.556327][ T9] vhci_hcd vhci_hcd.5: vhci_device speed not set [ 434.573112][ T5937] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 434.591241][ T5937] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -71 [ 434.604600][T11983] bond0: (slave bond_slave_0): Releasing backup interface [ 434.687763][ T5937] usb 3-1: USB disconnect, device number 24 [ 434.752833][T11983] bond0: (slave bond_slave_1): Releasing backup interface [ 434.774621][T11983] team0: Port device team_slave_0 removed [ 434.789142][T11983] team0: Port device team_slave_1 removed [ 434.796423][T11983] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 434.805324][T11983] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 434.872323][T11983] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 434.957784][T11983] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 435.005743][T11983] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 435.126763][T11998] syz_tun: entered allmulticast mode [ 435.139098][T11997] syz_tun: left allmulticast mode [ 435.638059][ T5829] asix 1-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 435.651968][T11945] vhci_hcd: connection reset by peer [ 435.662334][T10114] vhci_hcd vhci_hcd.0: stop threads [ 435.676522][T10114] vhci_hcd vhci_hcd.0: release socket [ 435.692208][ T5829] asix 1-1:0.188: probe with driver asix failed with error -71 [ 435.706444][T10114] vhci_hcd vhci_hcd.0: disconnect device [ 435.741047][ T5829] usb 1-1: USB disconnect, device number 33 [ 435.897340][T12010] syzkaller0: entered promiscuous mode [ 435.902968][T12010] syzkaller0: entered allmulticast mode [ 435.924353][T12013] faux_driver vgem: [drm] Unknown color mode 127; guessing buffer size. [ 436.000343][T12015] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 436.282597][T12023] loop2: detected capacity change from 0 to 7 [ 436.291311][T12023] Dev loop2: unable to read RDB block 7 [ 436.297122][T12023] loop2: unable to read partition table [ 436.303580][T12023] loop2: partition table beyond EOD, truncated [ 436.328709][T12023] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 436.649270][T12023] netlink: 7 bytes leftover after parsing attributes in process `syz.4.1564'. [ 436.705185][ T873] vhci_hcd vhci_hcd.0: vhci_device speed not set [ 436.900422][ T5195] Dev loop2: unable to read RDB block 7 [ 436.939590][ T5195] loop2: unable to read partition table [ 436.958276][T12034] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1567'. [ 436.960775][ T5195] loop2: partition table beyond EOD, [ 436.971683][T12035] fuse: Unknown parameter 'fd0x0000000000000004' [ 436.993362][ T5195] truncated [ 437.153842][T12042] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1571'. [ 437.208362][T12034] tap0: tun_chr_ioctl cmd 1074025677 [ 437.213952][T12034] tap0: linktype set to 270 [ 437.298798][T12047] openvswitch: netlink: IP tunnel TTL not specified. [ 437.349577][T12049] FAULT_INJECTION: forcing a failure. [ 437.349577][T12049] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 437.364843][T12049] CPU: 1 UID: 0 PID: 12049 Comm: syz.4.1573 Tainted: G L syzkaller #0 PREEMPT(full) [ 437.364869][T12049] Tainted: [L]=SOFTLOCKUP [ 437.364875][T12049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 437.364885][T12049] Call Trace: [ 437.364892][T12049] [ 437.364898][T12049] dump_stack_lvl+0xe8/0x150 [ 437.364927][T12049] should_fail_ex+0x412/0x560 [ 437.364950][T12049] _copy_from_iter+0x1d3/0x1670 [ 437.364980][T12049] ? __pfx__copy_from_iter+0x10/0x10 [ 437.364996][T12049] ? sock_alloc_send_pskb+0x896/0x990 [ 437.365021][T12049] ? __pfx__copy_from_iter+0x10/0x10 [ 437.365042][T12049] ? page_copy_sane+0x4e/0x270 [ 437.365063][T12049] copy_page_from_iter+0xdd/0x170 [ 437.365086][T12049] skb_copy_datagram_from_iter+0x306/0x710 [ 437.365118][T12049] tun_get_user+0xc38/0x3dd0 [ 437.365146][T12049] ? aa_file_perm+0x12d/0x1630 [ 437.365170][T12049] ? aa_file_perm+0x440/0x1630 [ 437.365188][T12049] ? __pfx_tun_get_user+0x10/0x10 [ 437.365206][T12049] ? __lock_acquire+0x6b5/0x2cf0 [ 437.365232][T12049] ? kstrtoull+0x12f/0x1d0 [ 437.365252][T12049] ? ref_tracker_alloc+0x363/0x4d0 [ 437.365284][T12049] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 437.365304][T12049] ? tun_get+0x1c/0x2f0 [ 437.365320][T12049] ? tun_get+0x1c/0x2f0 [ 437.365339][T12049] ? tun_get+0x1c/0x2f0 [ 437.365355][T12049] ? tun_get+0x1c/0x2f0 [ 437.365374][T12049] tun_chr_write_iter+0x113/0x200 [ 437.365394][T12049] vfs_write+0x61d/0xb90 [ 437.365424][T12049] ? __pfx_vfs_write+0x10/0x10 [ 437.365453][T12049] ? __fget_files+0x2a/0x420 [ 437.365479][T12049] ksys_write+0x150/0x270 [ 437.365501][T12049] ? __pfx_ksys_write+0x10/0x10 [ 437.365522][T12049] ? __pfx_ksys_write+0x10/0x10 [ 437.365549][T12049] __do_fast_syscall_32+0x1d2/0x540 [ 437.365567][T12049] ? lockdep_hardirqs_on+0x7a/0x110 [ 437.365582][T12049] ? do_fast_syscall_32+0x33/0x70 [ 437.365598][T12049] ? asm_int80_emulation+0x1a/0x20 [ 437.365612][T12049] ? do_int80_emulation+0x20e/0x400 [ 437.365633][T12049] do_fast_syscall_32+0x33/0x70 [ 437.365650][T12049] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 437.365677][T12049] RIP: 0023:0xf73bd539 [ 437.365692][T12049] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 437.365705][T12049] RSP: 002b:00000000f53e650c EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 437.365723][T12049] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 437.365734][T12049] RDX: 0000000000000ffe RSI: 0000000000000000 RDI: 0000000000000000 [ 437.365743][T12049] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 437.365752][T12049] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 437.365761][T12049] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 437.365787][T12049] [ 437.642804][ T9] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 437.953668][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 437.982209][ T9] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 437.993830][ T9] usb 3-1: too many endpoints for config 1 interface 0 altsetting 0: 255, using maximum allowed: 30 [ 438.033974][ T9] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 438.074074][ T9] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 438.084509][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 438.102815][ T9] usb 3-1: SerialNumber: syz [ 438.203314][ T9] cdc_acm 3-1:1.0: skipping garbage [ 438.273013][T12061] netlink: 'syz.0.1574': attribute type 13 has an invalid length. [ 438.407690][T12063] netlink: 'syz.4.1576': attribute type 1 has an invalid length. [ 438.775240][ T30] audit: type=1326 audit(1770655751.427:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12037 comm="syz.2.1568" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf73ed539 code=0x0 [ 439.464742][T12085] netlink: 'syz.1.1578': attribute type 29 has an invalid length. [ 439.473028][T12085] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1578'. [ 439.991021][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.007887][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.290284][T12095] syzkaller0: entered promiscuous mode [ 440.299177][T12095] syzkaller0: entered allmulticast mode [ 440.320158][T12095] FAULT_INJECTION: forcing a failure. [ 440.320158][T12095] name failslab, interval 1, probability 0, space 0, times 0 [ 440.340475][T12095] CPU: 0 UID: 0 PID: 12095 Comm: syz.5.1580 Tainted: G L syzkaller #0 PREEMPT(full) [ 440.340502][T12095] Tainted: [L]=SOFTLOCKUP [ 440.340508][T12095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 440.340517][T12095] Call Trace: [ 440.340524][T12095] [ 440.340532][T12095] dump_stack_lvl+0xe8/0x150 [ 440.340553][T12095] should_fail_ex+0x412/0x560 [ 440.340568][T12095] should_failslab+0xa8/0x100 [ 440.340580][T12095] __kmalloc_noprof+0xde/0x7e0 [ 440.340590][T12095] ? __raw_spin_lock_init+0x45/0x100 [ 440.340601][T12095] ? pfkey_add+0x1500/0x2df0 [ 440.340619][T12095] pfkey_add+0x1500/0x2df0 [ 440.340637][T12095] ? __pfx_pfkey_add+0x10/0x10 [ 440.340645][T12095] ? pfkey_broadcast+0x3c2/0x3e0 [ 440.340659][T12095] pfkey_sendmsg+0xc56/0x1120 [ 440.340676][T12095] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 440.340697][T12095] ? __import_iovec+0x5d4/0x7e0 [ 440.340711][T12095] ? aa_sock_msg_perm+0xf1/0x1b0 [ 440.340724][T12095] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 440.340735][T12095] ? __pfx_pfkey_sendmsg+0x10/0x10 [ 440.340743][T12095] ____sys_sendmsg+0xa68/0xad0 [ 440.340761][T12095] ? __pfx_____sys_sendmsg+0x10/0x10 [ 440.340775][T12095] ? kstrtoull+0x12f/0x1d0 [ 440.340789][T12095] ___sys_sendmsg+0x2a5/0x360 [ 440.340806][T12095] ? __lock_acquire+0x6b5/0x2cf0 [ 440.340820][T12095] ? __pfx____sys_sendmsg+0x10/0x10 [ 440.340833][T12095] ? get_pid_task+0x20/0x1f0 [ 440.340843][T12095] ? get_pid_task+0x20/0x1f0 [ 440.340852][T12095] ? get_pid_task+0x20/0x1f0 [ 440.340874][T12095] ? __fget_files+0x2a/0x420 [ 440.340884][T12095] ? __fget_files+0x3a0/0x420 [ 440.340899][T12095] __sys_sendmsg+0x183/0x260 [ 440.340912][T12095] ? __pfx___sys_sendmsg+0x10/0x10 [ 440.340929][T12095] ? __pfx_ksys_write+0x10/0x10 [ 440.340947][T12095] __do_fast_syscall_32+0x1d2/0x540 [ 440.340958][T12095] ? lockdep_hardirqs_on+0x7a/0x110 [ 440.340966][T12095] ? do_fast_syscall_32+0x33/0x70 [ 440.340976][T12095] ? asm_int80_emulation+0x1a/0x20 [ 440.340985][T12095] ? do_int80_emulation+0x20e/0x400 [ 440.340996][T12095] do_fast_syscall_32+0x33/0x70 [ 440.341009][T12095] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 440.341021][T12095] RIP: 0023:0xf73dd539 [ 440.341030][T12095] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 440.341038][T12095] RSP: 002b:00000000f540650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 440.341051][T12095] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000080000040 [ 440.341058][T12095] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 440.341063][T12095] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 440.341069][T12095] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 440.341074][T12095] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 440.341088][T12095] [ 440.349582][T12101] input: syz0 as /devices/virtual/input/input21 [ 441.310447][ T5893] usb 3-1: USB disconnect, device number 25 [ 441.844219][T12145] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1590'. [ 441.855948][T12145] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1590'. [ 442.121691][T12153] netlink: 'syz.1.1591': attribute type 2 has an invalid length. [ 442.162456][T12153] !: entered promiscuous mode [ 442.232450][T12155] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1593'. [ 442.390934][T12162] netlink: 'syz.5.1596': attribute type 9 has an invalid length. [ 442.438091][T12162] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1596'. [ 442.765113][ T10] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 443.195478][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 443.236939][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 443.247443][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 443.262059][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 443.277838][ T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 443.297190][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 443.324433][ T10] usb 1-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=14.a8 [ 443.335346][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.351310][ T10] usb 1-1: Product: syz [ 443.360351][ T10] usb 1-1: Manufacturer: syz [ 443.369160][ T10] usb 1-1: SerialNumber: syz [ 443.396699][ T10] usb 1-1: config 0 descriptor?? [ 443.415789][ T10] redrat3 1-1:0.0: Couldn't find all endpoints [ 443.628658][T12181] ªªªªªª: renamed from vlan0 (while UP) [ 443.642690][ T10] usb 1-1: USB disconnect, device number 34 [ 443.752842][T12182] kvm: kvm [12180]: vcpu1, guest rIP: 0xfff0 Unhandled WRMSR(0xc0010003) = 0x200000000400 [ 444.045179][ T873] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 444.111696][T12189] xt_CT: You must specify a L4 protocol and not use inversions on it [ 444.275357][ T873] usb 2-1: Using ep0 maxpacket: 32 [ 444.282072][ T873] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 444.295897][ T873] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 444.334535][ T873] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 444.358657][ T873] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 444.398545][ T873] usb 2-1: config 0 descriptor?? [ 444.418983][ T873] hub 2-1:0.0: USB hub found [ 444.602821][T12196] FAULT_INJECTION: forcing a failure. [ 444.602821][T12196] name failslab, interval 1, probability 0, space 0, times 0 [ 444.618282][ T873] hub 2-1:0.0: config failed, can't read hub descriptor (err -22) [ 444.667253][T12196] CPU: 0 UID: 0 PID: 12196 Comm: syz.4.1606 Tainted: G L syzkaller #0 PREEMPT(full) [ 444.667281][T12196] Tainted: [L]=SOFTLOCKUP [ 444.667290][T12196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 444.667299][T12196] Call Trace: [ 444.667305][T12196] [ 444.667311][T12196] dump_stack_lvl+0xe8/0x150 [ 444.667335][T12196] should_fail_ex+0x412/0x560 [ 444.667358][T12196] should_failslab+0xa8/0x100 [ 444.667377][T12196] __kmalloc_noprof+0xde/0x7e0 [ 444.667393][T12196] ? tomoyo_encode+0x28b/0x550 [ 444.667417][T12196] tomoyo_encode+0x28b/0x550 [ 444.667440][T12196] tomoyo_realpath_from_path+0x58d/0x5d0 [ 444.667469][T12196] ? tomoyo_path_number_perm+0x219/0x630 [ 444.667485][T12196] tomoyo_path_number_perm+0x246/0x630 [ 444.667505][T12196] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 444.667521][T12196] ? __lock_acquire+0x6b5/0x2cf0 [ 444.667573][T12196] ? __fget_files+0x2a/0x420 [ 444.667594][T12196] ? __fget_files+0x3a0/0x420 [ 444.667609][T12196] ? __fget_files+0x2a/0x420 [ 444.667627][T12196] security_file_ioctl_compat+0xc3/0x2a0 [ 444.667645][T12196] __ia32_compat_sys_ioctl+0x139/0x950 [ 444.667669][T12196] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 444.667701][T12196] ? __fget_files+0x3a0/0x420 [ 444.667723][T12196] ? fput+0xa0/0xd0 [ 444.667742][T12196] ? ksys_write+0x242/0x270 [ 444.667764][T12196] ? __pfx_ksys_write+0x10/0x10 [ 444.667791][T12196] __do_fast_syscall_32+0x1d2/0x540 [ 444.667817][T12196] ? lockdep_hardirqs_on+0x7a/0x110 [ 444.667832][T12196] ? do_fast_syscall_32+0x33/0x70 [ 444.667848][T12196] ? asm_int80_emulation+0x1a/0x20 [ 444.667862][T12196] ? do_int80_emulation+0x20e/0x400 [ 444.667883][T12196] do_fast_syscall_32+0x33/0x70 [ 444.667901][T12196] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 444.667918][T12196] RIP: 0023:0xf73bd539 [ 444.667932][T12196] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 444.667945][T12196] RSP: 002b:00000000f53e650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 444.667962][T12196] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000400454ca [ 444.667972][T12196] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 444.667982][T12196] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 444.667990][T12196] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 444.667999][T12196] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 444.668024][T12196] [ 444.668762][T12196] ERROR: Out of memory at tomoyo_realpath_from_path. [ 444.954183][ T873] usbhid 2-1:0.0: can't add hid device: -71 [ 445.032132][ T873] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 445.124214][ T873] usb 2-1: USB disconnect, device number 40 [ 445.575033][ T10] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 445.759268][ T10] usb 1-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=36.77 [ 445.790531][ T10] usb 1-1: New USB device strings: Mfr=223, Product=85, SerialNumber=3 [ 445.875127][ T10] usb 1-1: Product: syz [ 445.879341][ T10] usb 1-1: Manufacturer: syz [ 445.894670][ T10] usb 1-1: SerialNumber: syz [ 445.904220][ T10] usb 1-1: config 0 descriptor?? [ 445.913901][ T10] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 445.927788][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 445.937990][ T10] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 445.948277][ T10] usb 1-1: media controller created [ 445.983654][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 446.069079][ T10] DVB: Unable to find symbol mt352_attach() [ 446.116188][T12202] FAULT_INJECTION: forcing a failure. [ 446.116188][T12202] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 446.145547][ T10] DVB: Unable to find symbol nxt6000_attach() [ 446.153293][ T10] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 446.168709][T12202] CPU: 0 UID: 0 PID: 12202 Comm: syz.0.1609 Tainted: G L syzkaller #0 PREEMPT(full) [ 446.168737][T12202] Tainted: [L]=SOFTLOCKUP [ 446.168744][T12202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 446.168753][T12202] Call Trace: [ 446.168759][T12202] [ 446.168766][T12202] dump_stack_lvl+0xe8/0x150 [ 446.168791][T12202] should_fail_ex+0x412/0x560 [ 446.168816][T12202] _copy_from_user+0x2d/0xb0 [ 446.168832][T12202] compat_i2cdev_ioctl+0x391/0x5c0 [ 446.168861][T12202] ? __pfx_compat_i2cdev_ioctl+0x10/0x10 [ 446.168885][T12202] ? __fget_files+0x3a0/0x420 [ 446.168902][T12202] ? __fget_files+0x2a/0x420 [ 446.168921][T12202] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 446.168944][T12202] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 446.168968][T12202] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 446.168993][T12202] ? __fget_files+0x3a0/0x420 [ 446.169015][T12202] ? fput+0xa0/0xd0 [ 446.169033][T12202] ? ksys_write+0x242/0x270 [ 446.169056][T12202] ? __pfx_ksys_write+0x10/0x10 [ 446.169083][T12202] __do_fast_syscall_32+0x1d2/0x540 [ 446.169101][T12202] ? lockdep_hardirqs_on+0x7a/0x110 [ 446.169116][T12202] ? do_fast_syscall_32+0x33/0x70 [ 446.169132][T12202] ? asm_int80_emulation+0x1a/0x20 [ 446.169145][T12202] ? do_int80_emulation+0x20e/0x400 [ 446.169166][T12202] do_fast_syscall_32+0x33/0x70 [ 446.169183][T12202] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 446.169201][T12202] RIP: 0023:0xf746d539 [ 446.169215][T12202] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 446.169229][T12202] RSP: 002b:00000000f549650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 446.169246][T12202] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000000707 [ 446.169257][T12202] RDX: 0000000080000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 446.169267][T12202] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 446.169275][T12202] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 446.169284][T12202] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 446.169316][T12202] [ 446.400039][ T10] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input22 [ 446.413235][ T10] dvb-usb: schedule remote query interval to 1000 msecs. [ 446.420852][ T10] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 446.431003][ T10] dvb-usb: bulk message failed: -22 (7/0) [ 446.436807][ T10] dvb-usb: bulk message failed: -22 (7/0) [ 446.685340][ T10] usb 1-1: USB disconnect, device number 35 [ 446.849324][ T10] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 447.363233][T12220] netdevsim netdevsim5 netdevsim0: entered allmulticast mode [ 447.495012][ T30] audit: type=1326 audit(1770655760.127:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 447.568105][ T30] audit: type=1326 audit(1770655760.127:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 447.603044][T12220] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 447.643168][ T30] audit: type=1326 audit(1770655760.127:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 447.675990][ T30] audit: type=1326 audit(1770655760.127:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 447.961852][ T30] audit: type=1326 audit(1770655760.127:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 447.984888][ T30] audit: type=1326 audit(1770655760.127:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 448.037395][ T30] audit: type=1326 audit(1770655760.127:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 448.060292][ T30] audit: type=1326 audit(1770655760.127:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 448.094252][ T30] audit: type=1326 audit(1770655760.127:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 448.131760][ T30] audit: type=1326 audit(1770655760.127:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12214 comm="syz.0.1613" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf746d539 code=0x7ffc0000 [ 448.155421][T11077] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 448.179053][T12230] netlink: 'syz.1.1617': attribute type 11 has an invalid length. [ 448.187005][T12230] netlink: 'syz.1.1617': attribute type 11 has an invalid length. [ 448.197354][T12230] netlink: 204 bytes leftover after parsing attributes in process `syz.1.1617'. [ 448.263364][T12235] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1618'. [ 448.321342][T11077] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 448.352949][T11077] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 448.380869][T11077] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 448.399069][T11077] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67 [ 448.417164][T11077] usb 1-1: SerialNumber: syz [ 449.335025][ T10] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 449.485381][ T10] usb 2-1: Using ep0 maxpacket: 8 [ 449.494254][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 449.521367][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 449.544482][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 449.569955][ T10] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x7E, changing to 0xE [ 449.598602][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 449.624300][ T10] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 0 [ 449.651930][ T10] usb 2-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 449.676996][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 449.699152][ T10] usb 2-1: config 0 descriptor?? [ 450.132177][T12257] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1627'. [ 450.243523][T11077] usb 1-1: 0:2 : does not exist [ 450.253471][T11077] usb 1-1: unit 5: unexpected type 0x09 [ 450.326084][T11077] usb 1-1: USB disconnect, device number 36 [ 450.406942][T10621] udevd[10621]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 450.660967][T12257] syzkaller0: entered promiscuous mode [ 450.685010][ T9] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 450.855006][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 450.862270][ T9] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 450.876308][ T9] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 450.887023][ T9] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 450.895749][ T9] usb 3-1: Product: syz [ 450.900273][ T9] usb 3-1: Manufacturer: syz [ 450.906106][ T9] usb 3-1: SerialNumber: syz [ 450.913891][ T9] usb 3-1: config 0 descriptor?? [ 450.925763][T12263] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 450.947229][ T9] hub 3-1:0.0: bad descriptor, ignoring hub [ 450.953535][ T9] hub 3-1:0.0: probe with driver hub failed with error -5 [ 451.117685][T12268] sctp: [Deprecated]: syz.4.1630 (pid 12268) Use of struct sctp_assoc_value in delayed_ack socket option. [ 451.117685][T12268] Use struct sctp_sack_info instead [ 451.329851][T12273] netlink: zone id is out of range [ 451.336612][T12273] netlink: zone id is out of range [ 451.341836][T12273] netlink: zone id is out of range [ 451.347486][T12273] netlink: zone id is out of range [ 451.447358][ T10] usb 2-1: USB disconnect, device number 41 [ 451.584160][ T9] usb 3-1: USB disconnect, device number 26 [ 451.735485][ T9] usb 3-1: new full-speed USB device number 27 using dummy_hcd [ 451.915511][ T9] usb 3-1: device descriptor read/64, error -71 [ 452.156619][ T9] usb 3-1: new full-speed USB device number 28 using dummy_hcd [ 452.305323][ T9] usb 3-1: device descriptor read/64, error -71 [ 452.415536][ T9] usb usb3-port1: attempt power cycle [ 452.659273][T12311] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 452.819753][T12315] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1646'. [ 452.835070][ T9] usb 3-1: new full-speed USB device number 29 using dummy_hcd [ 452.855454][ T9] usb 3-1: device descriptor read/8, error -71 [ 453.144269][ T5829] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 453.152677][ T9] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 453.196173][ T9] usb 3-1: device descriptor read/8, error -71 [ 453.305388][ T9] usb usb3-port1: unable to enumerate USB device [ 453.315821][ T5829] usb 1-1: Using ep0 maxpacket: 32 [ 453.323658][ T5829] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 453.332090][ T5829] usb 1-1: config 0 has no interface number 0 [ 453.341597][ T5829] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 453.350791][ T5829] usb 1-1: New USB device strings: Mfr=1, Product=34, SerialNumber=3 [ 453.359650][ T5829] usb 1-1: Product: syz [ 453.363897][ T5829] usb 1-1: Manufacturer: syz [ 453.369038][ T5829] usb 1-1: SerialNumber: syz [ 453.379857][ T5829] usb 1-1: config 0 descriptor?? [ 453.389589][ T5829] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 453.405809][ T5829] usb 1-1: selecting invalid altsetting 1 [ 453.411931][ T5829] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 453.421063][ T5829] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 453.432739][ T5829] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 453.471897][T12330] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1650'. [ 453.531328][ T5829] usb 1-1: media controller created [ 453.538139][T12330] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1650'. [ 453.561977][ T5829] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 453.589143][T12313] usb 1-1: dvb_usb_ce6230: I2C read not implemented [ 453.829784][T12336] binder: 12334:12336 ioctl c0306201 80000140 returned -14 [ 454.709708][ T5829] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 454.722553][ T5829] zl10353_read_register: readreg error (reg=127, ret==-110) [ 454.924542][T12344] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1654'. [ 454.934733][T12344] netlink: 80 bytes leftover after parsing attributes in process `syz.1.1654'. [ 455.153449][T12350] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1653'. [ 455.459616][T12355] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1656'. [ 455.459639][T12355] netlink: 220 bytes leftover after parsing attributes in process `syz.4.1656'. [ 455.822145][ T5829] usb 1-1: USB disconnect, device number 37 [ 455.925290][T12359] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1659'. [ 456.034344][T12366] input: syz1 as /devices/virtual/input/input23 [ 456.084804][T12367] netlink: 'syz.0.1661': attribute type 10 has an invalid length. [ 456.120750][T12367] syz_tun: entered promiscuous mode [ 456.184493][T12367] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 456.330960][T12367] 8021q: adding VLAN 0 to HW filter on device bond1 [ 457.622030][T12366] syz.2.1660 (12366): drop_caches: 2 [ 458.595021][ T5829] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 458.749501][T12401] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1671'. [ 458.765294][ T5829] usb 3-1: Using ep0 maxpacket: 32 [ 458.776131][T12401] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1671'. [ 458.823976][ T5829] usb 3-1: config 0 has an invalid interface number: 12 but max is 0 [ 458.832862][ T5829] usb 3-1: config 0 has no interface number 0 [ 458.881815][ T5829] usb 3-1: config 0 interface 12 has no altsetting 0 [ 459.045679][T12412] FAULT_INJECTION: forcing a failure. [ 459.045679][T12412] name failslab, interval 1, probability 0, space 0, times 0 [ 459.113159][T12412] CPU: 1 UID: 0 PID: 12412 Comm: syz.0.1673 Tainted: G L syzkaller #0 PREEMPT(full) [ 459.113188][T12412] Tainted: [L]=SOFTLOCKUP [ 459.113193][T12412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 459.113203][T12412] Call Trace: [ 459.113210][T12412] [ 459.113216][T12412] dump_stack_lvl+0xe8/0x150 [ 459.113234][T12412] should_fail_ex+0x412/0x560 [ 459.113249][T12412] should_failslab+0xa8/0x100 [ 459.113270][T12412] __kmalloc_cache_noprof+0x83/0x6e0 [ 459.113288][T12412] ? tcf_exts_init_ex+0x10e/0x7c0 [ 459.113312][T12412] tcf_exts_init_ex+0x10e/0x7c0 [ 459.113328][T12412] ? __kmalloc_cache_noprof+0x3d1/0x6e0 [ 459.113350][T12412] mall_change+0x319/0x8a0 [ 459.113366][T12412] ? __pfx_mall_change+0x10/0x10 [ 459.113382][T12412] tc_new_tfilter+0xe1c/0x1630 [ 459.113407][T12412] ? __pfx_tc_new_tfilter+0x10/0x10 [ 459.113434][T12412] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 459.113466][T12412] ? __pfx_tc_new_tfilter+0x10/0x10 [ 459.113484][T12412] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 459.113506][T12412] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 459.113523][T12412] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 459.113539][T12412] ? __lock_acquire+0x6b5/0x2cf0 [ 459.113562][T12412] netlink_rcv_skb+0x232/0x4b0 [ 459.113575][T12412] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 459.113594][T12412] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 459.113621][T12412] ? netlink_deliver_tap+0x2e/0x1b0 [ 459.113645][T12412] netlink_unicast+0x80f/0x9b0 [ 459.113669][T12412] ? __pfx_netlink_unicast+0x10/0x10 [ 459.113681][T12412] ? __alloc_skb+0x193/0x390 [ 459.113692][T12412] ? netlink_sendmsg+0x650/0xb40 [ 459.113701][T12412] ? skb_put+0x11b/0x210 [ 459.113713][T12412] netlink_sendmsg+0x813/0xb40 [ 459.113733][T12412] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.113753][T12412] ? aa_sock_msg_perm+0xf1/0x1b0 [ 459.113774][T12412] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 459.113792][T12412] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.113807][T12412] ____sys_sendmsg+0xa68/0xad0 [ 459.113824][T12412] ? __pfx_____sys_sendmsg+0x10/0x10 [ 459.113838][T12412] ? kstrtoull+0x12f/0x1d0 [ 459.113853][T12412] ___sys_sendmsg+0x2a5/0x360 [ 459.113864][T12412] ? __lock_acquire+0x6b5/0x2cf0 [ 459.113884][T12412] ? __pfx____sys_sendmsg+0x10/0x10 [ 459.113907][T12412] ? get_pid_task+0x20/0x1f0 [ 459.113923][T12412] ? get_pid_task+0x20/0x1f0 [ 459.113938][T12412] ? get_pid_task+0x20/0x1f0 [ 459.113967][T12412] ? __fget_files+0x2a/0x420 [ 459.113977][T12412] ? __fget_files+0x3a0/0x420 [ 459.113991][T12412] __sys_sendmsg+0x183/0x260 [ 459.114004][T12412] ? __pfx___sys_sendmsg+0x10/0x10 [ 459.114028][T12412] ? __pfx_ksys_write+0x10/0x10 [ 459.114059][T12412] __do_fast_syscall_32+0x1d2/0x540 [ 459.114076][T12412] ? lockdep_hardirqs_on+0x7a/0x110 [ 459.114091][T12412] ? do_fast_syscall_32+0x33/0x70 [ 459.114103][T12412] ? asm_int80_emulation+0x1a/0x20 [ 459.114111][T12412] ? do_int80_emulation+0x20e/0x400 [ 459.114126][T12412] do_fast_syscall_32+0x33/0x70 [ 459.114137][T12412] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 459.114147][T12412] RIP: 0023:0xf746d539 [ 459.114160][T12412] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 459.114174][T12412] RSP: 002b:00000000f549650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 459.114191][T12412] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080000580 [ 459.114203][T12412] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 459.114217][T12412] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 459.114226][T12412] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 459.114235][T12412] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 459.114261][T12412] [ 459.686586][ T5829] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 459.700038][ T5829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 459.708347][ T5829] usb 3-1: Product: syz [ 459.712585][ T5829] usb 3-1: Manufacturer: syz [ 459.717413][ T5829] usb 3-1: SerialNumber: syz [ 459.739008][ T5829] usb 3-1: config 0 descriptor?? [ 459.801480][ T5829] f81534 3-1:0.12: required endpoints missing [ 459.905753][ T30] kauditd_printk_skb: 19 callbacks suppressed [ 459.905769][ T30] audit: type=1326 audit(1770655772.577:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 459.949339][ T30] audit: type=1326 audit(1770655772.577:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 459.979194][ T30] audit: type=1326 audit(1770655772.577:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 460.067851][ T30] audit: type=1326 audit(1770655772.577:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 460.140529][ T30] audit: type=1326 audit(1770655772.577:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf712572b code=0x7ffc0000 [ 460.164849][T12420] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1676'. [ 460.206297][ T30] audit: type=1326 audit(1770655772.577:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 460.295798][ T30] audit: type=1326 audit(1770655772.577:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 460.323566][ T30] audit: type=1326 audit(1770655772.607:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=329 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 460.387582][ T30] audit: type=1326 audit(1770655772.607:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 460.411366][ T30] audit: type=1326 audit(1770655772.607:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12415 comm="syz.4.1674" exe="/root/syz-executor" sig=0 arch=40000003 syscall=255 compat=1 ip=0xf73bd539 code=0x7ffc0000 [ 461.377803][ T5880] usb 3-1: USB disconnect, device number 31 [ 461.811380][ T5880] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 462.072840][ T5880] usb 3-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 462.091579][ T5880] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 462.114042][ T5880] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 462.237188][ T5880] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 462.273083][ T5880] usb 3-1: config 0 descriptor?? [ 462.285952][ T5880] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 462.307619][T12441] bond1: option ad_actor_sys_prio: invalid value (0) [ 462.314620][T12441] bond1: option ad_actor_sys_prio: allowed values 1 - 65535 [ 462.461093][T12441] bond1 (unregistering): Released all slaves [ 462.536827][ T873] hid_parser_main: 7 callbacks suppressed [ 462.536846][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.559837][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.591488][ T5880] usb 3-1: USB disconnect, device number 32 [ 462.594995][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.618707][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.633488][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.642654][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.680489][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.706304][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.713740][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.741741][ T873] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 462.769273][ T873] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.03 Device [syz1] on syz1 [ 462.845015][ T10] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 463.016317][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 463.060863][ T10] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 463.098595][ T10] usb 2-1: config 0 has no interface number 0 [ 463.200716][T12457] netlink: 'syz.5.1686': attribute type 13 has an invalid length. [ 463.436452][ T10] usb 2-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 463.459314][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 463.479501][ T10] usb 2-1: Product: syz [ 463.491796][ T10] usb 2-1: Manufacturer: syz [ 463.501723][ T10] usb 2-1: SerialNumber: syz [ 463.667475][ T10] usb 2-1: config 0 descriptor?? [ 463.676258][ T10] usb 2-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 463.698848][ T10] usb 2-1: selecting invalid altsetting 1 [ 463.704642][ T10] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 463.862578][ T10] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 463.930092][ T10] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 463.980244][ T10] usb 2-1: media controller created [ 464.159503][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 464.311725][ T10] usb 2-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 464.335723][ T10] zl10353_read_register: readreg error (reg=127, ret==-71) [ 464.357964][ T10] usb 2-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 464.665303][ T10] usb 2-1: USB disconnect, device number 42 [ 465.180655][T12480] openvswitch: netlink: Message has 4 unknown bytes. [ 465.189440][T12480] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 465.815894][ T10] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 465.977702][ T10] usb 1-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 465.991182][ T10] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 466.031580][ T10] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 466.054487][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.199130][ T10] usb 1-1: config 0 descriptor?? [ 466.206877][ T10] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 466.500539][T11077] usb 1-1: USB disconnect, device number 38 [ 466.594869][ T5835] Bluetooth: hci4: unexpected event 0x10 length: 11 > 1 [ 466.600705][ T5835] Bluetooth: hci4: hardware error 0xff [ 466.656083][ T5893] usb 2-1: new full-speed USB device number 43 using dummy_hcd [ 466.877374][ T5893] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 576, setting to 64 [ 466.888148][ T5893] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 20 [ 466.906565][ T5893] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 466.916712][ T5893] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 466.925993][ T5893] usb 2-1: SerialNumber: syz [ 466.937168][T12506] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 467.154177][T12506] netlink: 'syz.1.1703': attribute type 23 has an invalid length. [ 467.230089][ T5893] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 467.239245][ T5893] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 467.246456][ T5893] cdc_acm 2-1:1.0: probe with driver cdc_acm failed with error -22 [ 467.263988][ T5893] usb 2-1: USB disconnect, device number 43 [ 467.515077][ T10] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 468.354600][ T10] usb 3-1: Using ep0 maxpacket: 16 [ 468.444029][ T10] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 468.470228][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 468.521471][ T10] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 468.538895][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.547346][ T10] usb 3-1: Product: syz [ 468.552911][ T10] usb 3-1: Manufacturer: syz [ 468.561208][ T10] usb 3-1: SerialNumber: syz [ 468.578171][ T10] usb 3-1: config 0 descriptor?? [ 468.613844][ T10] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 468.624034][ T10] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 468.648365][ T5835] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 469.205718][ T10] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 469.243875][ T10] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 469.826678][T12549] netlink: 'syz.4.1715': attribute type 32 has an invalid length. [ 469.946483][T12549] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1715'. [ 469.989660][T12549] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1715'. [ 470.595492][ T10] em28xx 3-1:0.0: AC97 command still being executed: not handled properly! [ 470.624842][ T10] em28xx 3-1:0.0: Unknown AC97 audio processor detected! [ 470.964084][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 2 [ 470.982866][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 4 [ 471.026546][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 6 [ 471.238514][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 54 [ 471.262361][ T10] em28xx 3-1:0.0: couldn't setup AC97 register 56 [ 471.302775][ T10] usb 3-1: USB disconnect, device number 33 [ 471.479742][T12576] netlink: 'syz.0.1720': attribute type 13 has an invalid length. [ 472.247538][T12584] input: syz0 as /devices/virtual/input/input24 [ 472.328526][T12586] FAULT_INJECTION: forcing a failure. [ 472.328526][T12586] name failslab, interval 1, probability 0, space 0, times 0 [ 472.343086][T12586] CPU: 0 UID: 0 PID: 12586 Comm: syz.1.1723 Tainted: G L syzkaller #0 PREEMPT(full) [ 472.343103][T12586] Tainted: [L]=SOFTLOCKUP [ 472.343107][T12586] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 472.343113][T12586] Call Trace: [ 472.343117][T12586] [ 472.343122][T12586] dump_stack_lvl+0xe8/0x150 [ 472.343139][T12586] should_fail_ex+0x412/0x560 [ 472.343154][T12586] should_failslab+0xa8/0x100 [ 472.343165][T12586] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 472.343180][T12586] ? __alloc_skb+0x193/0x390 [ 472.343191][T12586] ? __alloc_skb+0x1d7/0x390 [ 472.343200][T12586] ? __local_bh_enable_ip+0xd0/0x130 [ 472.343209][T12586] ? __alloc_skb+0x193/0x390 [ 472.343219][T12586] __alloc_skb+0x1d7/0x390 [ 472.343239][T12586] netlink_sendmsg+0x5d4/0xb40 [ 472.343255][T12586] ? __pfx_netlink_sendmsg+0x10/0x10 [ 472.343266][T12586] ? aa_sock_msg_perm+0xf1/0x1b0 [ 472.343278][T12586] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 472.343289][T12586] ? __pfx_netlink_sendmsg+0x10/0x10 [ 472.343298][T12586] ____sys_sendmsg+0xa68/0xad0 [ 472.343315][T12586] ? __pfx_____sys_sendmsg+0x10/0x10 [ 472.343328][T12586] ? kstrtoull+0x12f/0x1d0 [ 472.343342][T12586] ___sys_sendmsg+0x2a5/0x360 [ 472.343354][T12586] ? __lock_acquire+0x6b5/0x2cf0 [ 472.343368][T12586] ? __pfx____sys_sendmsg+0x10/0x10 [ 472.343380][T12586] ? get_pid_task+0x20/0x1f0 [ 472.343390][T12586] ? get_pid_task+0x20/0x1f0 [ 472.343398][T12586] ? get_pid_task+0x20/0x1f0 [ 472.343420][T12586] ? __fget_files+0x2a/0x420 [ 472.343429][T12586] ? __fget_files+0x3a0/0x420 [ 472.343444][T12586] __sys_sendmsg+0x183/0x260 [ 472.343456][T12586] ? __pfx___sys_sendmsg+0x10/0x10 [ 472.343473][T12586] ? __pfx_ksys_write+0x10/0x10 [ 472.343490][T12586] __do_fast_syscall_32+0x1d2/0x540 [ 472.343501][T12586] ? lockdep_hardirqs_on+0x7a/0x110 [ 472.343510][T12586] ? do_fast_syscall_32+0x33/0x70 [ 472.343519][T12586] ? asm_int80_emulation+0x1a/0x20 [ 472.343527][T12586] ? do_int80_emulation+0x20e/0x400 [ 472.343539][T12586] do_fast_syscall_32+0x33/0x70 [ 472.343549][T12586] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 472.343560][T12586] RIP: 0023:0xf743d539 [ 472.343569][T12586] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 472.343577][T12586] RSP: 002b:00000000f546650c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 472.343588][T12586] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000040 [ 472.343595][T12586] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 472.343600][T12586] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 472.343605][T12586] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 472.343611][T12586] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 472.343624][T12586] [ 472.755047][ T10] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 472.955994][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 472.982110][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xD has an invalid bInterval 0, changing to 7 [ 473.196634][ T10] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 473.231409][ T10] usb 3-1: New USB device found, idVendor=084e, idProduct=1001, bcdDevice=bf.99 [ 473.242154][ T10] usb 3-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 473.251962][ T10] usb 3-1: Product: syz [ 473.257255][ T10] usb 3-1: SerialNumber: syz [ 473.331361][ T10] usb 3-1: config 0 descriptor?? [ 473.623285][T12584] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 473.655424][T12608] lo: Caught tx_queue_len zero misconfig [ 473.901477][T12611] netlink: 'syz.0.1730': attribute type 4 has an invalid length. [ 474.181564][ T5829] usb 3-1: USB disconnect, device number 34 [ 474.215446][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 474.215461][ T30] audit: type=1400 audit(1770655786.867:93): apparmor="DENIED" operation="change_onexec" class="file" info="label not found" error=-2 profile="unconfined" name=265B5EB82B2525 pid=12605 comm="syz.0.1730" [ 474.611007][T12624] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1736'. [ 474.636866][T12624] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1736'. [ 474.716693][T12624] tipc: Started in network mode [ 474.721588][T12624] tipc: Node identity 4, cluster identity 4711 [ 474.728487][T12624] tipc: Node number set to 4 [ 474.998396][T12633] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1739'. [ 475.385036][T11077] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 475.587276][T12643] netlink: 'syz.2.1741': attribute type 13 has an invalid length. [ 475.785562][T11077] usb 1-1: Using ep0 maxpacket: 8 [ 475.798479][T11077] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 475.812778][T11077] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 475.834821][T11077] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 475.862375][T11077] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 475.886949][T11077] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 475.909076][T11077] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 475.924841][T11077] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 476.076641][T12646] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1742'. [ 476.092676][T12650] random: crng reseeded on system resumption [ 476.142949][T11077] usb 1-1: GET_CAPABILITIES returned 0 [ 476.150281][T11077] usbtmc 1-1:16.0: can't read capabilities [ 476.361954][T12635] usbtmc 1-1:16.0: send_request_dev_dep_msg_in returned -90 [ 476.372044][T11077] usb 1-1: USB disconnect, device number 39 [ 477.444616][T12668] netlink: 'syz.0.1745': attribute type 10 has an invalid length. [ 477.457754][T12668] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 477.471266][T12668] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 478.242145][T12678] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1748'. [ 478.259657][T12677] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1748'. [ 478.275336][T12678] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1748'. [ 478.287362][T12677] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1748'. [ 478.303580][T12679] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 478.705074][ T30] audit: type=1800 audit(1770655791.357:94): pid=12687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1751" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 479.024794][T12694] FAULT_INJECTION: forcing a failure. [ 479.024794][T12694] name failslab, interval 1, probability 0, space 0, times 0 [ 479.040611][T12694] CPU: 1 UID: 0 PID: 12694 Comm: syz.4.1753 Tainted: G L syzkaller #0 PREEMPT(full) [ 479.040636][T12694] Tainted: [L]=SOFTLOCKUP [ 479.040640][T12694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 479.040646][T12694] Call Trace: [ 479.040651][T12694] [ 479.040656][T12694] dump_stack_lvl+0xe8/0x150 [ 479.040674][T12694] should_fail_ex+0x412/0x560 [ 479.040689][T12694] should_failslab+0xa8/0x100 [ 479.040702][T12694] kmem_cache_alloc_noprof+0x87/0x6e0 [ 479.040718][T12694] ? mas_next_node+0xafd/0xd60 [ 479.040730][T12694] ? vm_area_dup+0x2b/0x680 [ 479.040741][T12694] vm_area_dup+0x2b/0x680 [ 479.040753][T12694] __split_vma+0x1d5/0xa50 [ 479.040770][T12694] ? __pfx___split_vma+0x10/0x10 [ 479.040785][T12694] ? mas_find+0xb0e/0xd30 [ 479.040798][T12694] vms_gather_munmap_vmas+0x2f1/0x1320 [ 479.040812][T12694] ? __up_read+0x291/0x6b0 [ 479.040824][T12694] ? __pfx___up_read+0x10/0x10 [ 479.040838][T12694] ? vms_complete_munmap_vmas+0x6df/0x890 [ 479.040856][T12694] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 479.040878][T12694] ? vms_complete_munmap_vmas+0x6df/0x890 [ 479.040908][T12694] do_vmi_align_munmap+0x2b4/0x4b0 [ 479.040945][T12694] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 479.041002][T12694] do_vmi_munmap+0x252/0x2d0 [ 479.041027][T12694] __vm_munmap+0x22c/0x3d0 [ 479.041050][T12694] ? __pfx___vm_munmap+0x10/0x10 [ 479.041068][T12694] ? vm_mmap_pgoff+0x3b1/0x4f0 [ 479.041094][T12694] ? exc_page_fault+0x6a/0xc0 [ 479.041119][T12694] __ia32_sys_munmap+0x5f/0x70 [ 479.041141][T12694] __do_fast_syscall_32+0x1d2/0x540 [ 479.041158][T12694] ? do_fast_syscall_32+0x33/0x70 [ 479.041174][T12694] ? irqentry_exit+0x10e/0x620 [ 479.041196][T12694] do_fast_syscall_32+0x33/0x70 [ 479.041214][T12694] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 479.041234][T12694] RIP: 0023:0xf73bd539 [ 479.041249][T12694] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 479.041263][T12694] RSP: 002b:00000000f53e524c EFLAGS: 00000206 ORIG_RAX: 000000000000005b [ 479.041281][T12694] RAX: ffffffffffffffda RBX: 00000000f5300000 RCX: 00000000000c6000 [ 479.041292][T12694] RDX: 00000000f73afff4 RSI: 0000000000021000 RDI: 0000000000100000 [ 479.041304][T12694] RBP: 00000000f5200000 R08: 0000000000000000 R09: 0000000000000000 [ 479.041314][T12694] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 479.041325][T12694] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 479.041352][T12694] [ 480.407523][T12712] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1757'. [ 481.535005][ T10] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 481.757177][ T10] usb 2-1: config 0 has an invalid interface number: 79 but max is 0 [ 481.765396][ T10] usb 2-1: config 0 has no interface number 0 [ 481.773580][ T10] usb 2-1: config 0 interface 79 has no altsetting 0 [ 481.796997][ T10] usb 2-1: New USB device found, idVendor=14aa, idProduct=0226, bcdDevice=fc.92 [ 481.807578][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.815777][ T10] usb 2-1: Product: syz [ 481.820277][ T10] usb 2-1: Manufacturer: syz [ 481.824984][ T10] usb 2-1: SerialNumber: syz [ 481.832527][ T10] usb 2-1: config 0 descriptor?? [ 481.902367][ T10] dvb-usb: found a 'WideView WT-220U PenType Receiver (Typhoon/Freecom)' in warm state. [ 481.917504][ T10] dvb-usb: bulk message failed: -22 (2/0) [ 481.924556][ T10] dvb-usb: will use the device's hardware PID filter (table count: 15). [ 481.925985][T11077] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 481.935550][ T10] dvbdev: DVB: registering new adapter (WideView WT-220U PenType Receiver (Typhoon/Freecom)) [ 481.953955][ T10] usb 2-1: media controller created [ 481.966267][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 482.036154][ T10] usb 2-1: DVB: registering adapter 1 frontend 0 (WideView USB DVB-T)... [ 482.049977][ T10] dvbdev: dvb_create_media_entity: media entity 'WideView USB DVB-T' registered. [ 482.135266][T11077] usb 1-1: Using ep0 maxpacket: 32 [ 482.147031][T11077] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 482.156747][T11077] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.171048][T11077] usb 1-1: config 0 descriptor?? [ 482.237050][ T10] rc_core: IR keymap rc-dtt200u not found [ 482.243023][ T10] Registered IR keymap rc-empty [ 482.250892][ T10] rc rc0: WideView WT-220U PenType Receiver (Typhoon/Freecom) as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 482.265682][ T10] input: WideView WT-220U PenType Receiver (Typhoon/Freecom) as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input25 [ 482.280437][ T10] dvb-usb: schedule remote query interval to 300 msecs. [ 482.288045][ T10] dvb-usb: WideView WT-220U PenType Receiver (Typhoon/Freecom) successfully initialized and connected. [ 482.379769][T11077] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 482.391769][T11077] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 482.402893][T11077] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 482.410213][T11077] usb 1-1: media controller created [ 482.425675][T11077] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 482.590426][T11077] az6027: usb out operation failed. (-71) [ 482.597079][T11077] az6027: usb out operation failed. (-71) [ 482.597570][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 482.606896][T11077] stb0899_attach: Driver disabled by Kconfig [ 482.613012][ T10] dvb-usb: error -22 while querying for an remote control event. [ 482.616138][T11077] az6027: no front-end attached [ 482.616138][T11077] [ 482.632557][T11077] az6027: usb out operation failed. (-71) [ 482.639810][T11077] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 482.648807][T11077] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input26 [ 482.662794][T11077] dvb-usb: schedule remote query interval to 400 msecs. [ 482.671507][T11077] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 482.684394][T11077] usb 1-1: USB disconnect, device number 40 [ 482.732923][T11077] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 482.935150][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 482.940996][ T10] dvb-usb: error -22 while querying for an remote control event. [ 483.261210][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 483.275365][ T10] dvb-usb: error -22 while querying for an remote control event. [ 483.615275][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 483.624938][ T10] dvb-usb: error -22 while querying for an remote control event. [ 483.955233][ T10] dvb-usb: bulk message failed: -22 (1/0) [ 483.961058][ T10] dvb-usb: error -22 while querying for an remote control event. [ 484.071930][T11077] usb 2-1: USB disconnect, device number 44 [ 484.209803][T11077] dvb-usb: WideView WT-220U PenType Receiver (Typh successfully deinitialized and disconnected. [ 484.236649][T12744] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1767'. [ 484.356404][T12744] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1767'. [ 484.368111][T12747] tipc: Cannot configure node identity twice [ 484.915923][ T10] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 485.063718][T12742] netlink: 'syz.5.1766': attribute type 13 has an invalid length. [ 485.215272][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 485.222415][ T10] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 485.239265][ T10] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 485.254856][ T10] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 485.268825][ T10] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 485.289416][ T10] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 485.300041][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 485.313345][ T10] usb 2-1: Product: syz [ 485.317815][ T10] usb 2-1: Manufacturer: syz [ 485.322473][ T10] usb 2-1: SerialNumber: syz [ 485.335508][ C0] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 485.349440][ T10] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input27 [ 485.625571][ T10] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 485.657376][ T10] (id 0x00) [ 485.990903][ T10] rc_core: IR keymap rc-imon-pad not found [ 485.997379][ T10] Registered IR keymap rc-empty [ 486.010256][ T10] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 486.026641][ T10] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 486.055641][ T10] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0 [ 486.070508][ T5929] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 486.088229][ T798] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -2). You can use /scripts/get_dvb_firmware to get the firmware [ 486.106243][ T10] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc0/input28 [ 486.120450][ T5929] dvb_usb_az6027 6-1:0.0: probe with driver dvb_usb_az6027 failed with error -110 [ 486.146164][ T798] dvb_usb_az6027 5-1:0.0: probe with driver dvb_usb_az6027 failed with error -2 [ 486.159140][ T10] imon 2-1:155.0: iMON device (15c2:ffdc, intf0) on usb<2:45> initialized [ 486.174644][ T5929] usb 6-1: USB disconnect, device number 7 [ 486.189122][ T798] usb 5-1: USB disconnect, device number 16 [ 486.231853][ T5893] usb 2-1: USB disconnect, device number 45 [ 486.571415][T12775] FAULT_INJECTION: forcing a failure. [ 486.571415][T12775] name failslab, interval 1, probability 0, space 0, times 0 [ 486.600581][T12775] CPU: 0 UID: 0 PID: 12775 Comm: syz.1.1775 Tainted: G L syzkaller #0 PREEMPT(full) [ 486.600612][T12775] Tainted: [L]=SOFTLOCKUP [ 486.600619][T12775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 486.600628][T12775] Call Trace: [ 486.600635][T12775] [ 486.600643][T12775] dump_stack_lvl+0xe8/0x150 [ 486.600668][T12775] should_fail_ex+0x412/0x560 [ 486.600692][T12775] should_failslab+0xa8/0x100 [ 486.600712][T12775] __kmalloc_cache_noprof+0x83/0x6e0 [ 486.600730][T12775] ? snd_pcm_oss_change_params_locked+0x1ae/0x3e00 [ 486.600754][T12775] snd_pcm_oss_change_params_locked+0x1ae/0x3e00 [ 486.600773][T12775] ? __pfx___mutex_trylock_common+0x10/0x10 [ 486.600795][T12775] ? rcu_is_watching+0x15/0xb0 [ 486.600815][T12775] ? __mutex_lock+0x319/0x1300 [ 486.600837][T12775] ? do_vfs_ioctl+0x1166/0x1530 [ 486.600865][T12775] ? __pfx_snd_pcm_oss_change_params_locked+0x10/0x10 [ 486.600886][T12775] ? __pfx___mutex_lock+0x10/0x10 [ 486.600916][T12775] ? __might_fault+0xaf/0x130 [ 486.600944][T12775] snd_pcm_oss_get_active_substream+0x1e2/0x280 [ 486.600969][T12775] snd_pcm_oss_get_formats+0x34/0x420 [ 486.600990][T12775] snd_pcm_oss_set_format+0x41/0x500 [ 486.601007][T12775] ? __might_fault+0xaf/0x130 [ 486.601031][T12775] snd_pcm_oss_ioctl+0xbe9/0xdf0 [ 486.601052][T12775] __ia32_compat_sys_ioctl+0x5ea/0x950 [ 486.601084][T12775] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 486.601107][T12775] ? __fget_files+0x3a0/0x420 [ 486.601131][T12775] ? fput+0xa0/0xd0 [ 486.601148][T12775] ? ksys_write+0x242/0x270 [ 486.601172][T12775] ? __pfx_ksys_write+0x10/0x10 [ 486.601200][T12775] __do_fast_syscall_32+0x1d2/0x540 [ 486.601217][T12775] ? lockdep_hardirqs_on+0x7a/0x110 [ 486.601231][T12775] ? do_fast_syscall_32+0x33/0x70 [ 486.601247][T12775] ? asm_int80_emulation+0x1a/0x20 [ 486.601262][T12775] ? do_int80_emulation+0x20e/0x400 [ 486.601284][T12775] do_fast_syscall_32+0x33/0x70 [ 486.601302][T12775] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 486.601320][T12775] RIP: 0023:0xf743d539 [ 486.601335][T12775] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 486.601349][T12775] RSP: 002b:00000000f546650c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 486.601366][T12775] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000c0045005 [ 486.601378][T12775] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 486.601388][T12775] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 486.601396][T12775] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 486.601406][T12775] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 486.601433][T12775] [ 486.766438][T11077] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 486.825484][ T798] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 487.047529][ T798] usb 3-1: Using ep0 maxpacket: 16 [ 487.078843][ T798] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 487.108729][ T798] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 487.133907][ T798] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 487.188780][ T798] usb 3-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 487.207328][ T798] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.235658][T11077] usb 1-1: Using ep0 maxpacket: 32 [ 487.241490][ T798] usb 3-1: config 0 descriptor?? [ 487.264240][T11077] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 487.288787][T11077] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 487.324576][T11077] usb 1-1: config 0 descriptor?? [ 487.354727][T12790] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 487.676212][T12795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 487.720931][T12795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.737326][ T798] input: HID 0955:7214 Haptics as /devices/virtual/input/input29 [ 487.879220][ T798] shield 0003:0955:7214.0008: Registered Thunderstrike controller [ 487.905561][ T10] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 487.921671][ T798] shield 0003:0955:7214.0008: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 487.923768][T11077] dvb-usb: found a 'Elgato EyeTV Sat' in cold state, will try to load a firmware [ 487.935749][T12768] random: crng reseeded on system resumption [ 488.004062][T11077] usb 1-1: Direct firmware load for dvb-usb-az6027-03.fw failed with error -2 [ 488.014264][T11077] usb 1-1: Falling back to sysfs fallback for: dvb-usb-az6027-03.fw [ 488.048549][ T9] shield 0003:0955:7214.0008: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 488.061733][ T5929] usb 3-1: USB disconnect, device number 35 [ 488.076896][ T5929] ------------[ cut here ]------------ [ 488.082365][ T5929] workqueue: work disable count underflowed [ 488.088283][ T5929] WARNING: kernel/workqueue.c:4359 at enable_work+0x1c7/0x230, CPU#0: kworker/0:7/5929 [ 488.097918][ T5929] Modules linked in: [ 488.102090][ T5929] CPU: 0 UID: 0 PID: 5929 Comm: kworker/0:7 Tainted: G L syzkaller #0 PREEMPT(full) [ 488.113020][ T5929] Tainted: [L]=SOFTLOCKUP [ 488.117330][ T5929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 488.127478][ T5929] Workqueue: usb_hub_wq hub_event [ 488.132513][ T5929] RIP: 0010:enable_work+0x1c7/0x230 [ 488.137725][ T5929] Code: 0f d1 37 00 4d 85 f6 75 48 e8 05 d1 37 00 eb 47 e8 fe d0 37 00 90 0f 0b 90 e9 bc fe ff ff e8 f0 d0 37 00 48 8d 3d 99 65 65 0e <67> 48 0f b9 3a e9 d2 fe ff ff e8 da d0 37 00 90 0f 0b 90 e9 1d ff [ 488.157326][ T5929] RSP: 0018:ffffc90004bd70e0 EFLAGS: 00010083 [ 488.163391][ T5929] RAX: ffffffff818ca930 RBX: 0000000000000000 RCX: 0000000000100000 [ 488.171364][ T5929] RDX: ffffc900197d5000 RSI: 00000000000077cd RDI: ffffffff8ff20ed0 [ 488.179322][ T5929] RBP: 0000000000000000 R08: ffff88802037b73f R09: 1ffff1100406f6e7 [ 488.187298][ T5929] R10: dffffc0000000000 R11: ffffed100406f6e8 R12: 1ffff1100406f6e7 [ 488.195267][ T5929] R13: 001fffffffc00001 R14: ffff88802037b738 R15: 0000000000000000 [ 488.203231][ T5929] FS: 0000000000000000(0000) GS:ffff8881256f3000(0000) knlGS:0000000000000000 [ 488.212151][ T5929] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 488.218735][ T5929] CR2: 0000000080128018 CR3: 00000000507dc000 CR4: 00000000003526f0 [ 488.226703][ T5929] Call Trace: [ 488.229990][ T5929] [ 488.232936][ T5929] __cancel_work_sync+0xf7/0x110 [ 488.237868][ T5929] thermal_zone_device_unregister+0x23e/0x3f0 [ 488.243929][ T5929] power_supply_unregister+0xf9/0x140 [ 488.249298][ T5929] ? __pfx_shield_remove+0x10/0x10 [ 488.254406][ T5929] shield_remove+0x72/0x120 [ 488.258915][ T5929] hid_device_remove+0x228/0x370 [ 488.263870][ T5929] ? __pfx_hid_device_remove+0x10/0x10 [ 488.269322][ T5929] device_release_driver_internal+0x46f/0x860 [ 488.275398][ T5929] bus_remove_device+0x34d/0x440 [ 488.280349][ T5929] device_del+0x527/0x8f0 [ 488.284670][ T5929] ? __pfx_device_del+0x10/0x10 [ 488.289508][ T5929] hid_destroy_device+0x6b/0x1b0 [ 488.294436][ T5929] usbhid_disconnect+0x9f/0xc0 [ 488.299183][ T5929] usb_unbind_interface+0x26e/0x910 [ 488.304397][ T5929] ? __pfx_usb_unbind_interface+0x10/0x10 [ 488.310116][ T5929] device_release_driver_internal+0x4d9/0x860 [ 488.316181][ T5929] bus_remove_device+0x34d/0x440 [ 488.321112][ T5929] device_del+0x527/0x8f0 [ 488.325433][ T5929] ? __pfx_device_del+0x10/0x10 [ 488.330271][ T5929] ? kobject_put+0x51d/0x560 [ 488.334852][ T5929] usb_disable_device+0x3d4/0x8d0 [ 488.339880][ T5929] usb_disconnect+0x32f/0x990 [ 488.344553][ T5929] hub_event+0x1cc9/0x4f30 [ 488.349016][ T5929] ? __pfx_hub_event+0x10/0x10 [ 488.353792][ T5929] ? process_scheduled_works+0xa0f/0x17a0 [ 488.359511][ T5929] ? process_scheduled_works+0xa0f/0x17a0 [ 488.365233][ T5929] ? process_scheduled_works+0xa0f/0x17a0 [ 488.370964][ T5929] process_scheduled_works+0xaec/0x17a0 [ 488.376515][ T5929] ? __pfx_process_scheduled_works+0x10/0x10 [ 488.382484][ T5929] ? do_raw_spin_lock+0x12b/0x2f0 [ 488.387503][ T5929] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 488.392866][ T5929] ? schedule+0x90/0x360 [ 488.397121][ T5929] worker_thread+0xda6/0x1360 [ 488.401819][ T5929] ? __kthread_parkme+0x19c/0x1f0 [ 488.406837][ T5929] kthread+0x726/0x8b0 [ 488.410900][ T5929] ? __pfx_worker_thread+0x10/0x10 [ 488.416014][ T5929] ? __pfx_kthread+0x10/0x10 [ 488.420614][ T5929] ? _raw_spin_unlock_irq+0x23/0x50 [ 488.425824][ T5929] ? __pfx_kthread+0x10/0x10 [ 488.430417][ T5929] ret_from_fork+0x51b/0xa40 [ 488.435002][ T5929] ? __pfx_ret_from_fork+0x10/0x10 [ 488.440100][ T5929] ? __switch_to+0xc82/0x1410 [ 488.444771][ T5929] ? __pfx_kthread+0x10/0x10 [ 488.449350][ T5929] ret_from_fork_asm+0x1a/0x30 [ 488.454118][ T5929] [ 488.457129][ T5929] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 488.464399][ T5929] CPU: 0 UID: 0 PID: 5929 Comm: kworker/0:7 Tainted: G L syzkaller #0 PREEMPT(full) [ 488.475323][ T5929] Tainted: [L]=SOFTLOCKUP [ 488.479634][ T5929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 488.489683][ T5929] Workqueue: usb_hub_wq hub_event [ 488.494708][ T5929] Call Trace: [ 488.497974][ T5929] [ 488.500892][ T5929] vpanic+0x1e0/0x670 [ 488.504870][ T5929] panic+0xc5/0xd0 [ 488.508585][ T5929] ? __pfx_panic+0x10/0x10 [ 488.512995][ T5929] ? ret_from_fork_asm+0x1a/0x30 [ 488.517927][ T5929] __warn+0x315/0x4a0 [ 488.521919][ T5929] ? enable_work+0x1c7/0x230 [ 488.526522][ T5929] ? enable_work+0x1c7/0x230 [ 488.531130][ T5929] __report_bug+0x29a/0x540 [ 488.535653][ T5929] ? enable_work+0x1c7/0x230 [ 488.540242][ T5929] ? __pfx___report_bug+0x10/0x10 [ 488.545291][ T5929] ? __flush_work+0xa26/0xc50 [ 488.549988][ T5929] ? __flush_work+0x100/0xc50 [ 488.554672][ T5929] report_bug_entry+0x19a/0x290 [ 488.559520][ T5929] ? enable_work+0x1c7/0x230 [ 488.564102][ T5929] ? enable_work+0x1cc/0x230 [ 488.568682][ T5929] handle_bug+0xca/0x200 [ 488.572916][ T5929] exc_invalid_op+0x1a/0x50 [ 488.577412][ T5929] asm_exc_invalid_op+0x1a/0x20 [ 488.582249][ T5929] RIP: 0010:enable_work+0x1c7/0x230 [ 488.587437][ T5929] Code: 0f d1 37 00 4d 85 f6 75 48 e8 05 d1 37 00 eb 47 e8 fe d0 37 00 90 0f 0b 90 e9 bc fe ff ff e8 f0 d0 37 00 48 8d 3d 99 65 65 0e <67> 48 0f b9 3a e9 d2 fe ff ff e8 da d0 37 00 90 0f 0b 90 e9 1d ff [ 488.607038][ T5929] RSP: 0018:ffffc90004bd70e0 EFLAGS: 00010083 [ 488.613106][ T5929] RAX: ffffffff818ca930 RBX: 0000000000000000 RCX: 0000000000100000 [ 488.621067][ T5929] RDX: ffffc900197d5000 RSI: 00000000000077cd RDI: ffffffff8ff20ed0 [ 488.629028][ T5929] RBP: 0000000000000000 R08: ffff88802037b73f R09: 1ffff1100406f6e7 [ 488.636993][ T5929] R10: dffffc0000000000 R11: ffffed100406f6e8 R12: 1ffff1100406f6e7 [ 488.644959][ T5929] R13: 001fffffffc00001 R14: ffff88802037b738 R15: 0000000000000000 [ 488.652950][ T5929] ? enable_work+0x1c0/0x230 [ 488.657546][ T5929] __cancel_work_sync+0xf7/0x110 [ 488.662476][ T5929] thermal_zone_device_unregister+0x23e/0x3f0 [ 488.668545][ T5929] power_supply_unregister+0xf9/0x140 [ 488.673927][ T5929] ? __pfx_shield_remove+0x10/0x10 [ 488.679046][ T5929] shield_remove+0x72/0x120 [ 488.683552][ T5929] hid_device_remove+0x228/0x370 [ 488.688483][ T5929] ? __pfx_hid_device_remove+0x10/0x10 [ 488.693937][ T5929] device_release_driver_internal+0x46f/0x860 [ 488.700013][ T5929] bus_remove_device+0x34d/0x440 [ 488.704956][ T5929] device_del+0x527/0x8f0 [ 488.709277][ T5929] ? __pfx_device_del+0x10/0x10 [ 488.714115][ T5929] hid_destroy_device+0x6b/0x1b0 [ 488.719046][ T5929] usbhid_disconnect+0x9f/0xc0 [ 488.723796][ T5929] usb_unbind_interface+0x26e/0x910 [ 488.728992][ T5929] ? __pfx_usb_unbind_interface+0x10/0x10 [ 488.734721][ T5929] device_release_driver_internal+0x4d9/0x860 [ 488.740798][ T5929] bus_remove_device+0x34d/0x440 [ 488.745741][ T5929] device_del+0x527/0x8f0 [ 488.750073][ T5929] ? __pfx_device_del+0x10/0x10 [ 488.754921][ T5929] ? kobject_put+0x51d/0x560 [ 488.759520][ T5929] usb_disable_device+0x3d4/0x8d0 [ 488.764550][ T5929] usb_disconnect+0x32f/0x990 [ 488.769230][ T5929] hub_event+0x1cc9/0x4f30 [ 488.773675][ T5929] ? __pfx_hub_event+0x10/0x10 [ 488.778425][ T5929] ? process_scheduled_works+0xa0f/0x17a0 [ 488.784139][ T5929] ? process_scheduled_works+0xa0f/0x17a0 [ 488.789846][ T5929] ? process_scheduled_works+0xa0f/0x17a0 [ 488.795563][ T5929] process_scheduled_works+0xaec/0x17a0 [ 488.801140][ T5929] ? __pfx_process_scheduled_works+0x10/0x10 [ 488.807129][ T5929] ? do_raw_spin_lock+0x12b/0x2f0 [ 488.812166][ T5929] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 488.817529][ T5929] ? schedule+0x90/0x360 [ 488.821770][ T5929] worker_thread+0xda6/0x1360 [ 488.826456][ T5929] ? __kthread_parkme+0x19c/0x1f0 [ 488.831477][ T5929] kthread+0x726/0x8b0 [ 488.835546][ T5929] ? __pfx_worker_thread+0x10/0x10 [ 488.840657][ T5929] ? __pfx_kthread+0x10/0x10 [ 488.845244][ T5929] ? _raw_spin_unlock_irq+0x23/0x50 [ 488.850438][ T5929] ? __pfx_kthread+0x10/0x10 [ 488.855014][ T5929] ret_from_fork+0x51b/0xa40 [ 488.859598][ T5929] ? __pfx_ret_from_fork+0x10/0x10 [ 488.864695][ T5929] ? __switch_to+0xc82/0x1410 [ 488.869362][ T5929] ? __pfx_kthread+0x10/0x10 [ 488.873941][ T5929] ret_from_fork_asm+0x1a/0x30 [ 488.878711][ T5929] [ 488.882149][ T5929] Kernel Offset: disabled [ 488.886463][ T5929] Rebooting in 86400 seconds..