last executing test programs: 15m57.469310432s ago: executing program 2 (id=430): getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) socket(0x200000000000011, 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) write$binfmt_aout(r0, 0x0, 0xff2e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x2) syz_pidfd_open(0x0, 0x0) getsockopt$sock_buf(r2, 0x1, 0x1a, &(0x7f00000023c0)=""/4096, &(0x7f00000033c0)=0x1000) mount$fuseblk(&(0x7f0000000140), &(0x7f0000000180)='./cgroup/cgroup.procs\x00', &(0x7f00000001c0), 0x901000, 0x0) 15m54.910874815s ago: executing program 2 (id=441): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/66, 0x0, 0x100000}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/71}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f00000008c0)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000002c0)={0x1, r2}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000f}, 0x94) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) 15m53.25699694s ago: executing program 2 (id=446): socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$cec(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x1c2a, 0x10100, 0x0, 0x0, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) dup(r5) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x9, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3fe, 0x5, 0x3, 0x9, 0x8, 0x45ff, 0x7ffffffc}, 0x0, 0x0) poll(0x0, 0x0, 0xfffeffff) 15m51.867164144s ago: executing program 2 (id=449): mknod$loop(0x0, 0x1, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x2) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x2, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$qrtr(0x2a, 0x2, 0x0) bind$qrtr(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x4058534c, &(0x7f0000000200)={0x3, 0xfffffffa, 0x9, 0x1, 0x2, 0x10000}) r4 = syz_open_dev$loop(&(0x7f0000000000), 0x9, 0x2641) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) dup2(r3, r0) 15m51.551365565s ago: executing program 2 (id=451): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000580)={0x14, 0x0, 0x100, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x8840}, 0x10000010) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x951a, 0x3010, 0x1}, &(0x7f0000000040)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r2, 0x0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000800)=ANY=[], 0xe8}, 0x0, 0x24040092}) io_uring_enter(r3, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) 15m50.409283964s ago: executing program 2 (id=454): r0 = socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) unshare(0x8000000) semtimedop(0x0, &(0x7f0000000280)=[{0x0, 0x1000, 0x1000}], 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ipv6_route\x00') read$FUSE(r3, &(0x7f0000000240)={0x2020}, 0x2020) pread64(r3, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) 15m49.29485988s ago: executing program 32 (id=454): r0 = socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, 0x0, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) unshare(0x8000000) semtimedop(0x0, &(0x7f0000000280)=[{0x0, 0x1000, 0x1000}], 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ipv6_route\x00') read$FUSE(r3, &(0x7f0000000240)={0x2020}, 0x2020) pread64(r3, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) 40.987570583s ago: executing program 3 (id=2476): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r2, &(0x7f0000000380), 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0x11, 0x2, 0x300) r3 = socket$packet(0x11, 0x2, 0x300) socket(0x1000000010, 0x80002, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x1, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x0, 0x4, 0x0, 0x1, 0x14}], &(0x7f00000000c0)='GPL\x00'}, 0x94) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x2) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000480)={0x0, 0x1, 0x6, @local}, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x42000000) 36.896082005s ago: executing program 5 (id=2483): syz_usb_connect$hid(0x6, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000200)={0x8, 0x4, [0x7]}) r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r5, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/229, 0xe5}, {&(0x7f0000000840)=""/127, 0x7f}, {&(0x7f0000001480)=""/127, 0x7f}, {&(0x7f00000000c0)=""/21, 0x15}, {&(0x7f00000004c0)=""/21, 0x15}], 0x11, 0x0, 0xfffffffffffffebc}, 0x4}], 0x2, 0x60, 0x0) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000440)=ANY=[@ANYBLOB="48000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32], 0x48}, 0x1, 0x0, 0x0, 0x45844}, 0x0) sendmmsg$inet(r1, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020200000d0000000000000000000000030006000000000002000000ac1414bb000000000000000002000100000000000000000000000000030005000000000002000000ac1414aa000000000000000001001500000000000100140000000000010016000000000062ad0ca650af8e0cf5dd875e16e7d330cf59fed3455d495c2214d7313cf2c5c7b78efbb5cf0bd1762736cd0a76f2ea7ca230fd5831c59b9397d3c94b9d47c4a387ce5cbfdc74da4b2b21d9dbb786e44b642e960ba1cbe2918594fe96f26f7c1e27dc63937ff0924bc0060a8d6db9ff504a"], 0x68}, 0x1, 0x7}, 0x0) 35.598748662s ago: executing program 3 (id=2487): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x1c, 0x2d, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}, [@typed={0x8, 0xc, 0x0, 0x0, @u32=0x2}]}, 0x1c}}, 0x4000804) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r3 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0xa0042, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4040) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x3d0, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x300, 0xffffffff, 0xffffffff, 0x300, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x32}}, [], [], 'wg1\x00', 'gre0\x00', {0xff}}, 0x0, 0x200, 0x230, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x430) open_by_handle_at(0xffffffffffffff9c, &(0x7f0000000280)=ANY=[@ANYRES64=r3], 0x8e79f035216f6e94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0xffffffffffffff47, 0x0, 0x1, 0x0, 0x0, 0x480c0}, 0x20000800) request_key(0x0, &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0), 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000640)=ANY=[@ANYBLOB="180000002d00010026bdf0007cdbdf250400000004001080"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000180)={0x3, &(0x7f0000000040)=[{0x8, 0x0, 0x0, 0x7ffc0004}, {0x101, 0xb, 0x4, 0x1}, {0xf, 0x8, 0x8, 0x9}]}) 33.011620926s ago: executing program 3 (id=2489): bind$l2tp(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000002140)=ANY=[]) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) add_key(0x0, &(0x7f0000000180), 0x0, 0x0, 0xfffffffffffffffe) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000200)="ea0d00b0000f229464670fc79c8100800000ba6100ecbaf80c66b8ecb1048566efbafc0c66b8106d7dd166eff0867dc5decb66b9800000c00f326635000100000f30ea0000e50066b8010000000f01d9", 0x50}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0, 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280)) unshare(0x8040480) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000040000000800000014100000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000010000000e748d304b1bb44c76943af5d86458dfba058447c71036f86398140b04e7c9609ad402801e5afd1a6688cd51700000000000000003afea44021fc6701450ff73ae0edf74f7227c4a28733a614f31fb843792a00dc"], 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x4, 0x4, 0x7, 0x0, r5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r6, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)=r5}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r7, &(0x7f0000000080), &(0x7f00000002c0)=""/218}, 0x20) unshare(0x2c020400) 32.964497548s ago: executing program 5 (id=2490): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$urandom(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$RNDZAPENTCNT(r2, 0x5204, 0x0) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8800) syz_open_dev$dri(0x0, 0x1ff, 0x0) r3 = getpid() openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x2621c3) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r4, &(0x7f0000004ec0)=[{&(0x7f00000001c0)=""/68, 0x44}], 0x1, 0x800, 0x0) syz_pidfd_open(r3, 0x0) open$dir(0x0, 0x400000, 0x100) socket$inet(0x2b, 0x800, 0x8) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) shutdown(0xffffffffffffffff, 0x1) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x61, 0x0, 0x0) 30.680181569s ago: executing program 3 (id=2494): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000002000), 0x7, 0x0) ioctl$VIDIOC_G_EDID(r2, 0xc0285628, &(0x7f0000002080)={0x0, 0x4, 0x3, '\x00', &(0x7f0000002040)=0x7}) r3 = syz_io_uring_setup(0x10b, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x800}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000540)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185500, 0x12345}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) io_uring_enter(r3, 0x7277, 0x0, 0x0, 0x0, 0x0) syz_open_dev$dri(0x0, 0x7, 0x202000) modify_ldt$write(0x1, &(0x7f0000004180)={0x8, 0x20000000}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0xfd, 0x0, 0x7fff0000}]}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x2, 0x4}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000900)={0x0, 0x0, 0x1, r9, 0x1}) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) 30.378939061s ago: executing program 1 (id=2496): r0 = gettid() prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x11, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) kexec_load(0x9, 0x0, 0x0, 0xa0000) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(r1, 0x0, &(0x7f00000000c0)={{r2, r3+10000000}, {0x0, 0x989680}}, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="2e003300d0000000080211000001080211000000505050505050"], 0x4c}}, 0x0) r9 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r9) r10 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r10, &(0x7f0000000180)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0, @ib={0x1b, 0x2, 0x10, {"8be7683682d0445aa000b6a7ec6ef77f"}, 0x5, 0x2, 0x7}, @in6={0xa, 0x4e22, 0x9, @local, 0x6}}}, 0x118) r11 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r11, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a) sendmsg$nl_route(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@mpls_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}}, 0x1c}}, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c82, r9) sched_rr_get_interval(r0, &(0x7f0000000000)) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) 29.994118256s ago: executing program 5 (id=2497): syz_usb_connect(0x7, 0x9a2, &(0x7f0000000440)=ANY=[@ANYRESDEC], 0x0) timer_create(0x3, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000180), 0x24b0ef85736762d0, 0x0) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x7dca, &(0x7f0000000340)={0x0, 0x0, 0x10100}, 0x0, &(0x7f0000000100)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3ff, 0x8, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) kexec_load(0x18bf, 0x0, 0x0, 0x80000) io_uring_enter(r3, 0x184c, 0x0, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) msgget$private(0x0, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/kexec_crash_loaded', 0x40000, 0x41) read$watch_queue(r4, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback, 0x8000000}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "000001fffbffffff", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', "faffffffffffffff"}, 0x28) sendto$inet6(r0, &(0x7f00000001c0), 0xfffffffffffffede, 0x0, 0x0, 0x3000137) 29.193655177s ago: executing program 1 (id=2498): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000280)={@broadcast, @dev, @void, {@canfd={0xd, {{0x1, 0x1, 0x0, 0x1}, 0x16, 0x0, 0x0, 0x0, "f8b50d307d74af37e4da9707f653e812f340ace5733a33dc5af03aa1939e28153eb8282b1da382161fd80f7757e423f45751fd1dd4586f5d99cbaaf8b332233f"}}}}, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_open_dev$dri(&(0x7f0000000240), 0xd21, 0x4000) r2 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r4 = dup3(r2, r3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050000e22dcbc80b47befa0000000900010073797a30000000002c000000030a01020000000000000000010000030900030073797a30000000000900010073797a3000000000540000001a0a010400000000000000000100000008000b40000000000900010073797a30000000002c0004"], 0xc8}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x19}, [@IFLA_NET_NS_FD={0x8}, @IFLA_TARGET_NETNSID={0x8}]}, 0x30}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000080), 0xfecc) symlinkat(&(0x7f0000000040)='./file0\x00', r4, &(0x7f0000000140)='./file0\x00') mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x12, r8, 0x0) ioctl$MON_IOCG_STATS(r4, 0xc0109207, &(0x7f00000001c0)) 28.956824671s ago: executing program 3 (id=2500): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x1c, 0x2d, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}, [@typed={0x8, 0xc, 0x0, 0x0, @u32=0x2}]}, 0x1c}}, 0x4000804) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r3 = openat$dma_heap(0xffffffffffffff9c, 0x0, 0xa0042, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x4040) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x3d0, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x300, 0xffffffff, 0xffffffff, 0x300, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x1}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x32}}, [], [], 'wg1\x00', 'gre0\x00', {0xff}}, 0x0, 0x200, 0x230, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x430) open_by_handle_at(0xffffffffffffff9c, &(0x7f0000000280)=ANY=[@ANYRES64=r3], 0x8e79f035216f6e94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0xffffffffffffff47, 0x0, 0x1, 0x0, 0x0, 0x480c0}, 0x20000800) request_key(0x0, &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0), 0x0) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000640)=ANY=[@ANYBLOB="180000002d00010026bdf0007cdbdf250400000004001080"], 0x18}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000180)={0x3, &(0x7f0000000040)=[{0x8, 0x0, 0x0, 0x7ffc0004}, {0x101, 0xb, 0x4, 0x1}, {0xf, 0x8, 0x8, 0x9}]}) 26.948424851s ago: executing program 1 (id=2502): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000002000), 0x7, 0x0) ioctl$VIDIOC_G_EDID(r2, 0xc0285628, &(0x7f0000002080)={0x0, 0x4, 0x3, '\x00', &(0x7f0000002040)=0x7}) r3 = syz_io_uring_setup(0x10b, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x800}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000540)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185500, 0x12345}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) io_uring_enter(r3, 0x7277, 0x0, 0x0, 0x0, 0x0) syz_open_dev$dri(0x0, 0x7, 0x202000) modify_ldt$write(0x1, &(0x7f0000004180)={0x8, 0x20000000}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0xfd, 0x0, 0x7fff0000}]}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x2, 0x4}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000900)={0x0, 0x0, 0x1, r9, 0x1}) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) 26.858655906s ago: executing program 3 (id=2503): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140), 0x8) io_setup(0x0, &(0x7f0000000000)) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = io_uring_setup(0x1530, &(0x7f0000000480)={0x0, 0xe739, 0x1, 0x8000002, 0x1d4}) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$nci(r3, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$nci(r3, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r5, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000002d40)={0x48, 0x7, r6, 0x0, 0x10000, 0x0, 0x8, 0x28d662, 0x1096e}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r6, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000280)={0x48, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) close_range(r2, 0xffffffffffffffff, 0x0) 25.383314229s ago: executing program 5 (id=2505): bind$l2tp(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, &(0x7f0000002140)=ANY=[]) read$FUSE(0xffffffffffffffff, 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) add_key(0x0, &(0x7f0000000180), 0x0, 0x0, 0xfffffffffffffffe) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000200)="ea0d00b0000f229464670fc79c8100800000ba6100ecbaf80c66b8ecb1048566efbafc0c66b8106d7dd166eff0867dc5decb66b9800000c00f326635000100000f30ea0000e50066b8010000000f01d9", 0x50}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0, 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280)) unshare(0x8040480) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000040000000800000014100000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000010000000e748d304b1bb44c76943af5d86458dfba058447c71036f86398140b04e7c9609ad402801e5afd1a6688cd51700000000000000003afea44021fc6701450ff73ae0edf74f7227c4a28733a614f31fb843792a00dc"], 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xc, 0x4, 0x4, 0x7, 0x0, r5}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r6, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)=r5}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r7, &(0x7f0000000080), &(0x7f00000002c0)=""/218}, 0x20) unshare(0x2c020400) 25.139054361s ago: executing program 1 (id=2506): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) ioctl$F2FS_IOC_START_VOLATILE_WRITE(0xffffffffffffffff, 0xf503, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r3 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r4, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000500)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0x100}, &(0x7f00000001c0)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_emit_ethernet(0x0, 0x0, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$FBIOBLANK(r5, 0x4611, 0x2) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000340)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r0, &(0x7f0000000540)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x3, @loopback, 0x3}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000240)="dc", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}}], 0x2, 0x3404c891) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000680)={0x0, 0xf7, 0x2, [0x4, 0x3]}, 0xc) 23.865053772s ago: executing program 1 (id=2508): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0xc) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0x64, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0xffff639c}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="3800000002011d04"], 0x38}}, 0x4000) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000080)={0x0, 0x1, 0x0, &(0x7f00000009c0)=""/251, 0x0, 0x4000}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0xfffffffc, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x70, 0x0, 0xf2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x403, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x6d1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe02e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x4, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x413f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x4000000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0xd, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x3f, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x22, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x100000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffc, 0x789], 0x1, 0x400}) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, 0x0, 0xa}, 0x94) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x5, 0x7, 0xe51, 0x1, 0x5479, 0x103d, 0x6, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x5, 0x6a], 0x2000, 0x808d6}) write$rfkill(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x2, 0x0, 0x0, 0x1}, 0x8) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, 0x0, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) 23.728245444s ago: executing program 5 (id=2509): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0x80000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x200000, @empty, 0x1}, 0x1c) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = accept(r2, 0x0, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r5, &(0x7f0000000000)={0xa, 0x4e21, 0xfffffffa, @local, 0x5}, 0x1c) setsockopt$inet6_int(r5, 0x29, 0x11, &(0x7f0000000040)=0x5, 0x4) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r4, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40010}, 0x4000000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000100)={@host}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7cb, &(0x7f0000000140)={&(0x7f0000000540)={{@host, 0x4}, {@host}, 0x400, "4145fdc5fec7663a106cef95c8d86f03d655b82e62dc5204ff06732791d90936bf31f7b4eafad3ed43e8da42de6780edce2e2f941399c9b9002a6a538fc1ebd3e994ce6fa4a67c775c476cdbedebbe34904cbe0d5808cf5892aa1e563f949f38cd2ebaa2c46464183ead798b1af0ba7ad5db77736a5329e7297e674242854f87ef03b0fba724523033529e64be44188740b9e9a0ba6944e9724c4aaa8470ab8d35a1746a1da4dfa2112cb5135d97efae0975e7fa5e421fe7ec12a8bbd7714076b63ddaca822d7c0383ccc4e21b11c8a0443850c05f4bb6716b6ba83016b709b44a9959c44daa717ed76b43f7c235fae47730ff2d435ed29d062451ab74bd9f65d9bf96e1afc645ca2249c89146fc815210d465ca0ede0acbfe1165b15d222ed668b79b14f901178d35e7421637588c887b0f2335ea84a442fc95bbcf0ea3b308ee18d913901cb8f40dd2798e781c4b1c620c23565b5bc18e25c206f772c863c8a8864f460c239033717d41f94fbf13b1d0c7271364bd6d144160e1df33fcb33e5d45a5e7ea4264d089397d7e022c6e1f37a2e464c01b4df6a906d3a46d9432ba1966d73aa0627491e3b3c33bee03ff2138896b64862910f24dbacc3c686e0059ff5915c8b69bce3c4022c5c80d574274d1107c9935898ae444a6c38dbd8319e778e1a86a293094bd98d0ae3ae2c32a4bcb20e0517c03e7b46839f4e3601ff98244ca5485cacbfe53c935cf14038bba908af19834a86b56cf68a7170448a434b55d66c080ea095b02ba4c3f8ba492c9e50111bf1b3085cc0f3938a58609a337e89eba9271ee071a8b9f89b4ad0fc3c92a48cb6bc63ed74877d8425c88eb40d18c6260d2221dc295d1fa1557cfcfe1cb3a1d61b4b1235e28903ae5a4d3d358f6d3e2c87b110e38aab0fd1ca2c047b3ea826d8cd9b980b3fc64fbf38d0d3fed0057b30612880a3d93aa3e16e1c1902cc8c206d7732f426fbb063b020a03d08e3bcd50f32c30c8ea424ea0c746e72c23e8d53576cc801bdf82f8bba865074e5dde3177820c24be87b9bd36e30a81d1d50b5aa0628262d46d19060ae37a33aa8e515fed3f8bfdf65ba5f8e11e4d517a50ce03f82bc5b3c8e9b3eb6572f1a686430170ce64bc1a61246fd99b2d8a3215104478eead7f5ad50cc5a203a37b7d2f67bb0387ae189ee7d5cfc0a421b0f0e6286aaf28a3eadfad1b8c83a26ac0a1d4a3846d93e161c82be100278d94e35fc7b5f1feb833f1b975adb33bec5d777cfbdb2c5fe171e205fd6596b37ba646b9ecb163fabcd89a469f6ad539a80937748105298b0a6364d75c6de3cbcbb96c440d5489f3f47149551e7f53d3a22d837cfb59c3e43f0c95760791ed36ff84ae82a679e4e062461bda5db7c27fb00c3238266734bc7c16d45ce7cd3f0b7e63c309877816048f2400"}, 0x418, 0x6}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r6, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x0) syz_usb_connect(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e74000905"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) 23.018239585s ago: executing program 0 (id=2510): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$video4linux(&(0x7f0000002000), 0x7, 0x0) ioctl$VIDIOC_G_EDID(r2, 0xc0285628, &(0x7f0000002080)={0x0, 0x4, 0x3, '\x00', &(0x7f0000002040)=0x7}) r3 = syz_io_uring_setup(0x10b, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x3, 0x800}, &(0x7f00000003c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000540)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000000)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000040)='./file0/file0\x00', 0x60, 0x185500, 0x12345}) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) io_uring_enter(r3, 0x7277, 0x0, 0x0, 0x0, 0x0) syz_open_dev$dri(0x0, 0x7, 0x202000) modify_ldt$write(0x1, &(0x7f0000004180)={0x8, 0x20000000}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0xfd, 0x0, 0x7fff0000}]}) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x2, 0x4}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000900)={0x0, 0x0, 0x1, r9, 0x1}) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) 22.945932233s ago: executing program 4 (id=2511): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000280)=0x2) socket(0x840000000002, 0x3, 0x100) socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x2400c850}, 0x800) r2 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x0) ioctl$VIDIOC_QUERYCTRL(r2, 0xc0445624, &(0x7f0000001d00)={0x6071d56f, 0x0, "b058b584c75da73d1f7600450b8add59e9665ce1d040fef200"}) mkdir(0x0, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) 21.904593235s ago: executing program 1 (id=2512): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = epoll_create1(0x0) fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0}, 0x18) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000240)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, @multicast, @val={@void, {0x8100, 0x3, 0x0, 0x1}}, {@x25={0x805, {0x0, 0x8, 0xfb, "a2f1ff80114502115efa2edffe20909cab2da7c0ba8cc356fcdb59c3048b9ae94577115ca453482522b4556c46525a96e82073a9b6b5f9dba7f68e1ecd9b71d2615886c26b036bef2c5ce88ea55818abc98ace892033dfe821fa6263b648e2bd1fcc2e0f5a7088bd59ef54b91786f90f4626ddac800b260e2f6292f759b1c6d9"}}}}, &(0x7f0000000180)={0x1, 0x1, [0xf74, 0x8bf, 0xe4b, 0xa20]}) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) dup(r3) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="e50500000000000061109e000000000004000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r5, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0xc, r1, 0x0, 0x0, 0x200000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) 21.228679883s ago: executing program 0 (id=2513): shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000080)=""/43) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000050000140600fc020000000000000000000000000000ff"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-160\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x800) recvmmsg$unix(r3, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r4 = accept4$tipc(r3, &(0x7f0000001a00)=@name, &(0x7f0000001a40)=0x10, 0x0) setsockopt$sock_int(r4, 0x1, 0x22, &(0x7f00000000c0)=0x1, 0x4) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) r6 = semget(0x2, 0x3, 0x200) semctl$SETVAL(r6, 0x4, 0x10, &(0x7f0000001980)=0xa3) writev(r5, &(0x7f0000000780)=[{&(0x7f0000000800)='@', 0x1}, {&(0x7f0000000980)="7cfef50125ceba952e25f56b146723994231180c47e878bf6dabf8f71e4eb409320adc9b631bb63cc96e1c3c5c9fd8839e7569b95c0aa2d176288568142d1df48f3f66801f3c3c0486fdada436b1ffbfcc64922c3aad379b2d5da2fc1340934a8fc29fa09c44d539abbd1b03a46797f98621f58145fbbd3bd3d4816db288a0c522ca0581a5c2018b513076d39992e95577bf8404e0304541a7f340ad33630b3f98fa4893512760f4fcba5a1905d638f372a6792673c275b7181a145ee0d2b93352ca79661e621d83b0df76e07e6884b7c83d7947bd7e34f59b243eed084d42ddf13a756fe51d224e6de69c4825bdf04f45e81a026b8ceddd5082441f0e807f577f5b08fc76eb60b27dfde3eb205a568a4b557597d84c454563511993b604e2353c9345b620792ba9e7619b249b7bd4bc323445b83f4dcd4b609a174de8c3ac75b6a468ddb1739a8da92ca288f05025721fa0718f3c1ceb8244c94efab1e49d3d40541104399c2e39f07ffe51e1af359aea6b7300e9a08d22affdc5433d34f59caf36eaa90181c0b0975189930fb7005a9c2b18414d07ecd2a8a46351945eb8719951d2a26ca3aa9bd4b8382e6ac22c069f08a2f80452487e3184ce576088606be36fbb6830db809d8c8bffecd5ac0ef2575f8b6ac8e8e2c45f3892ffd9fb6857c638cc2921818fde257514d56b045f5e6b0ae5cd6e44001606f7b7d089418a43fd679d15996f013fcb95f743f65d829527dede423e866677e4b1b4bef8ed52dfd902a8c3ccf47a36951780acdc3bfd1c26502ef120cb48d4013cbb5c8c950e42e3ceff381162c411d7a9c167a8e2c4dc1eaf0995866bf0681e92d40694865ba27114a2965df7b11aa839356361d57edf6e596158ecb25c9ce5e9761c9f95b867a5c606d71ca0dd5690cb3a22e316b7931219f047b4a35337d91cba9dc02dab909a02ac377d890c73cf56489902941d84d62c7d0d4fa43fd7f876b54c6ffd0dbbc93fa83e3dd98cf43b4d8873bef782e78dd9f10163ed1754710ef9b175757131bd5ce0312cca7433f5d50b2c92c350df174a3dac5966c237d1652347387744f858b49e36f5cf39fdd06010bca6c234fdea778d11d80e271a59dff4d815af90d560a045fda45c0a17575a9232277da51a1c5349664201e9155bd30588fa1f19ef569bbf130f431ab5bb9d85e0197de5532bfed16bc4ff4015941bc8cfe7283a433727ac8081e71d6e66017ef560eb10a6f7e6ac7be3a23c156bc2cdeb67440bbb73b41081d1175c43fd800d12977452eb9bea7f4624e9ec3ef0a81822e58f8b6e387bf7a1ba4e30fd637ca5abeee6a0ca300b91e854690c503c1e51fa7ea0d15ed8e730b7aa7edd2f56f6c896fca498f7263c3f92dfcafc3bf10191c6a7b393321e7883f282239eaea5faa1096975d00e5cd69d2d39199c1dd858279f8a4a34ea31eaedaa50030196ef0a948d0a657de400fbaca2893d4e6a829fb77045072d186da5dfbded58acb3a659ccc98424a2e734eb0a0de58720694fea5a6c2d8fd56b53e97c6ae7d2df0f8b6fa8708c5a7e84f93c682e58105a20ad726d0e21a4c1e3bac8136bdac63f0bab8b5fbf2d6abe61221669eb06e75e021f1ac076e3b3caeaa8a0aa796f5dd9d22cec6eaa276460310ba2a6304d19ec5d80b8dd9aa8a5b635ba9b2290a9e9fac4e7b10fc105a96caa1e41107e0dabb74f8f38833931498811dfd2a2efdf0584b58a7281b3cffd8040b73a3f1d6a061ac219cd12672cb50b3ebe2d145b33bd208d072c2374dc5f47a64b0ebf3795d65b78cb5f97623714056a11090d1bb7458c6c7421f22a34a8ce0b16aff73c4e8fdbf90da457038b17204623a939ea7b153289b80a127668c7eebbf15ea642aa04ac1dc29f0b413ff6556044151d37d859ba163e5a16ec2f7e6fecb69095d6d1a909b175afb7e1e7d152d73897725efe920d2b80bd2e14d056a2ab5a48d9eb7901e099ea9f63746ebd3f1e0167130e4710feb65cb24de7f388cee73ef206ed7a587334a5317469ca4053b6cdcbb5b57467cfa7fb0599f6188ef9e2338c06e790e9fe8ee0b081f6ea3feda4d1cbc292652b191d510d2de32541f080f88c4e86921c1af077575de9f7dab8f3f4c7bb1135c64a174326dfa9db7fa0a7283d7438451ffb1135204e090468ce7f2143af7a86c6d3bef4710b8548d7df3676a3f16185c395c98bc51b70ca0507a7f24767a2ba2cbe32efd53b53a7240f4783623b19b47850248b49d0ba2afbf90c337450296648b2511863a974b70f04b236e24356507576936e66faa0366468a1d7a33ae6dad23ff9bb093cc14764b553d2e539fc9b4cfc90cb382e731bfe6e0f513905c64325b586f2b769e89911a5730a0b75f895687a4da0b71e7a77c9f421d0ba5dedc05968fea44ea101c349c54df235fa0ec5ce877c196814bb9bd971b3aa47f7e1adcff4a91a3f6fae60a8a110ba3bb6c979c42d393811841097ef2c9820a206bde36bee46dce602844d570cc4959af8082a2124cad021c1884f92b55b424bce1e2240e4e2c344e154b37012ecc131c1bc253d1562f777aa3ccfd1e9bf091992d16709791f3b0c78ea6e4a45bee13264d2a8d5eed7ff023c6808b362cd7597be6fd7d5055850afbead1a71a1451af3abe6ffc1c07eb1afc6e089bd7a15bb43fdfa9bdde1eab461902e49046f7e50cee08975b5cc4d9d120dc8d967abd8fc0cd0b511ced6b59adeaf963b09b95f6ef87cb0caf0437826fef9a8deee71e98827434e52507eb9a7b6a34df9e6b5abb166912e97ca0addae5b3089d21620fde46593f8a0d3fa083a487de5113d84cbfb843271e38d68df487eb4de6c9fc6a278ce49feda787b8aeb85f9789965d76a8b2790801657a09478514fccc4a10ed98f4b4f6c6ffac81fcf6917da164974e9e749325e0720cfc493443bcc94a115e3b884c427e73f5a6670245bd07ebf51e14c579f24ee82f9f07799f56fc5263e3a869c449998f3ec32fedfab18e7a85a8b0bead0038fd2e63a789fb8c215e8f1c388ca6d31add380b5efbc350eb869f4f1b8ada583be31a66cafcfd15a3450ac62c5b8719bb534e8bc22d965b4ede8af2e3b3826852d62f261fe6b98d9913416edd4be21e2f97d415bdbd073b1b8e3a1a7cccc7e93c3c9e3ed1fa257d9b262878c4fec4c6b01d7c3c6e6ea1d77ed8769f2e31e622f459d63c54168bc98e3804dd505014a769799145b97b2664def1213d0aeedc7df6754c51b410a0070418e86a725e81550da7e5644e31953131589ee010f8a5a153bf777e287e324b3b387fd1f30de2be02efbcae90402f39c7435b1cf1e6f4d3dec15789378f435f2bfaa58728452148390ddc9d6d67a1d43c7d2ead4d47fa56fbabcbdbd53c067fbab9c039cd7d908f24373b5a97e59f36b3328d5b3f54a87936fc235772d9af905dfa128fd0a4b7f0d8d3751e17928ba40a5790f8d952a8a1a70a40ce8be5f416e6750b625c6faa7fd5a33ba4211bc19b24b337a31e080a521a4bafcf30ba2b0fc6f33f85cebcac61a70a5b3974eafd0a0de21e1d85b2f76c221cd2461d9f3b3f7df986065ffb4d474fe1c52fea3f0fef7a29de0bbcd81b11566da113b5a915b453c60fc9cf8f23b192fe50d6dd2e458f956f739380eb617ac1ae55b04a013a226293687d367a383fae93600b12a05c936f13853f9a3634f0e6d97db1367b8e05f3c3bd8299e686d27b5679f6418716dcf589715e49914d22ada307241272647e2e5d6ab7a1f24ec156983db8d266b9a7e441f85ebe60a380f12123848eeba26870c480b8d37b9716fd2ca29a69c896a77c531827455a9706e8f8728c97a6f978066e3b3962ad9c3230d5dd70bc86a782816c2dcc10f96fd36cf416d33e2c97f2e9b3cf603fc4eb152f4256febb041b168656325b10a914d854c17116367200904f08b84a790cdcb2bf60989473a3fa8a1df8ec79b9e253902d7f07e51693cca902cb98bb47aef64ab93a836ed0bcd421328de08c8687685ffe313d32d0f29be0a5cde8388255b211883ddac42efbe8b90ae93296bf1c9d3c9984cfb4119e79eacb73e0e58faeed9e6a782f272c5ce06d0724f0c87176548d57b7b83e06f18e1ae5dde3e3accae65ada93075555a7a395d6cd3d7ba057a3a280ce06663714b1f4e05413eb5c911ea660bddfc3c4be1569abdbe182afc84f65d844b5da19ad27c2a221da307c76a2c004b585dfe4398b25f5251b78815d0487edfca1a2acb306523c41a5eb39b188841a985eaec8cd635b25670efeb4d83e121152a9c9d86aa4791098e6130fc8a9edabd9df98b8b2160ae7eff1819d11be73bd002f247a77bad10f195b38d954522933591338f0e83ef15c3a6ea6b341f110865909c418fbcc9b147203bf3922f91f6a496ab21dce0ca9d2b3db6dfb89b1d43e5a83f8536a3b56a290ef92820c63dd1e5eb4a9f3217de404a97f9dcd9ac0340c1b9be4c03201343316eec0479527f77bb89e855c5c71238a596164df1e35a809204351669fda06393f4a63e5e8875235e0c9291693a821086593be219191f58fde6f064f52c4192d595e7b6936aabacc523b0751207a1d4c138023c1c99940731bd9984248a7b9735fdcbd7ac01e5b102bb57419666aeaa424a0545bdd3279b54e1ced9a6b35d42fb62fe26a5bef2b3eb3ed03926f1220cc28c03b6d96df82d61e56774fa23a1c792329543f2953ef499a70ebab21fa3c3d3cd56c324937cf2d4a2c415588db18a51baa9e6b9e672062dd57c4d8340252f156cd24584dfb5dd0eb5fa1242e6e5ba28afe447ac83c7134d6fef79c4de4495f9f0aa974e59c814c1633cb4dbfca70afad64b73cb3e5797e9f7a6c91a46343b213936557bff52628b8eb6f87f83d16e16291f3ca812fcde5e3e4624d5f48e4ef6bc60980731510d6f594eab7807e7394e94b135d0f200c7daf059b533fcfcb3e2e11cfe1cdb3f272848041f8ef3b6ffb30072ceea81463d38a613f4ff5ee7e76b0cb8d051e629f292691fc88cb5b4b4ec81ffcf56a83a3378501e19bafc4d1b00138dfbab9b1c77ff48df6b0ba21b452a6593ca20066d4385bfe4ab0cad83f41849baab143b141dbeb4d2daea184268de3180f2dbacd52577bf8f51eb8e4008fb41a6f66a9b078731ca7202f7cad12ebe769ccfcf22ba727a07418634a29563ba41c9b56293bf97163fb696f471ef352aac7e40dd70ecfea6f4f24a37ca116bb1e5418093dd46bd2785393686e3f77b5c5c2dc8840cf5f6f936b093d84921fdabcd09d7d7c556e1869dc47cc78a5eb75defe5805f440237f8baf980c3564731d047708be2d433c280983d5dd5463f2d21cee696519b53fab1109dc9e7a02b5b95ca4d64b24502d9426dbd7cf2a0c17bdc124b1759c60987fe24fa88020fc63b0d276318e97600381a69b51445fc8f23b0e8ca20655748e29bafbdf173ad77dd7d2ca2af64b50e9e011f4408368845b8f2e32166adf9ed17d916f5684099c385b2e4773ec5034829074598350449d03b6bf9684bb55d4ff2c5020499f319d793bbc22d763cc7501c58e27b3caad66a27955085bc4ba088583e25f969b69835c2028170a2d35963c1a16b094bd8e95563265acbfb6705e47492a3d2bd76ab130de82fa2b2a83ae904acf349f279bd0349ad9015b65a9ed9a3507616895b0b2057a8078633d92859c49a346ed47c6b6142071cbb3cc93a6b1cba276257a30a82616758246295a3fede8967091c4db80f4285b406f676ae2360188892927080efb7383cab5248aad379e14cd0738fe94914cfbf5d33", 0x1000}], 0x2) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f0000000100)={0xa00, 0xa00}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000040)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000240)="d2a7b3", 0x3}, {0x0}, {&(0x7f0000000500)="86e9a0", 0x3}, {&(0x7f00000005c0)="25062456", 0x4}], 0x4}}], 0x1, 0x4000800) preadv2(0xffffffffffffffff, &(0x7f0000001200)=[{&(0x7f0000000000)=""/57, 0x39}, {&(0x7f0000001100)=""/179, 0xb3}, {&(0x7f00000011c0)=""/56, 0x38}], 0x3, 0x10005, 0x9, 0xe) 21.196342524s ago: executing program 4 (id=2514): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) bind$qrtr(r2, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) r3 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r4, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x72, 0x11cfa, 0x8, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x2}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r4, 0x40505330, &(0x7f0000000ec0)={0x800100, 0xfffffffd, 0x22, 0x100, 0x81, 0x5}) close(r4) mq_timedreceive(r3, 0x0, 0x0, 0x200000000004, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x0}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x40004) openat$cgroup_int(r2, &(0x7f00000002c0)='cpu.max.burst\x00', 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000900000000000008000003000000040004001c000180180010"], 0x34}}, 0x84) 20.418016002s ago: executing program 5 (id=2515): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x80) r2 = socket$netlink(0x10, 0x3, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000009880), 0x2000, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)={0x20, 0x0, 0x1, 0x70bd28, 0x0, {0x1e}, [@ETHTOOL_A_PAUSE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x40000) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r5, &(0x7f0000001200)={'#! ', './file0', [{0x20, '\x98\xe1Cvg\x9cO\x16\xc0TC\xe8\xb8\x91W\xb8\x84\xdf\xbe\xbd\x8f\x81!\xf2V[\x03V\xba/\xb9+\xd2\x95\xe0t\x0f<}T\v\x0f\xe8\xae\x89\xfa^\xce\xae[t/\x12\x1f\x02\x85\xbd\xbc\r(\xfd\xf2\xeeB\x12\xdc\x06\x1d\xd8\x86g\xcf\xb6\xde\xeb\xfc\xfc~A\x95\x8a6'}, {0x20, '5\xed\xe9\xe8\f\xcb\x82;\xc5\x98\"\x1c\x8d\xbb,X}\xec\x9f\xe5\xf0\x1f\x02\a\x0e\xe09\x17\xa9\xdbXP\x94}L\x17WT\xc0Rc\xe5\xd3\x9a\xcfGr3\xbaf\x8aS\xc6Q\x16\xf4\x9f\x02u.\xaf\xf3\xb8\x0e\x85a8\x03\x02\xf4\xf1\\b\x1ew\xd4F\xf1\xf9I\xe4\xca\xb1\xa51Sk\xdf\xc7\xd2\x87.b\xb9|+\x9f3@\xdfs\xa0\x01\x8fV/0\x8bo\xccQ\x9c\x9e\xae!b\xa0 \xea\xa4(C\n\x96\xdf\xd2\xd6\x91\x90\x83 \xb2\xb4\xac{\x02\xde,Ff\x98\x84\x16\x1b\x96\xac\x9e\x17\xf0\x13\xfa\xd1+\xcc\x19\x81ZZ\xa0\xde\xeb\xf3`\x0e\x87:` \x1b\xec\xc81\xb7\x91\xfdcL\xdcH/0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$urandom(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$RNDZAPENTCNT(r2, 0x5204, 0x0) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x8800) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x2621c3) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r3, &(0x7f0000004ec0)=[{&(0x7f00000001c0)=""/68, 0x44}], 0x1, 0x800, 0x0) syz_pidfd_open(0x0, 0x0) open$dir(0x0, 0x400000, 0x100) socket$inet(0x2b, 0x800, 0x8) sendto$inet(0xffffffffffffffff, &(0x7f0000000000)="e6", 0x1, 0x20008005, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) shutdown(0xffffffffffffffff, 0x1) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x61, 0x0, 0x0) 19.698741417s ago: executing program 4 (id=2517): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000400000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000000085000000040000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sys_enter\x00', r1}, 0x10) setgid(0xee01) ioctl$FS_IOC_RESVSP(r0, 0x40305839, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.swap.events\x00', 0x26e1, 0x0) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) timerfd_settime(r2, 0x1, &(0x7f0000000400)={{}, {r3, r4+60000000}}, &(0x7f0000000440)) ioctl$PTP_SYS_OFFSET(r0, 0x43403d05, &(0x7f0000000600)={0x2}) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r7, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r5) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, 0x0, 0x4000000) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0100000000000000000002000000140001800500020001"], 0x28}, 0x1, 0x0, 0x0, 0x20044811}, 0x2000c094) 18.798968862s ago: executing program 4 (id=2518): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) sendmmsg(r0, &(0x7f00000030c0)=[{{&(0x7f00000001c0)=@rc={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x8}, 0x80, &(0x7f0000000040)=[{&(0x7f0000000440)="3450c3352abf6040dc6d4e4eb8ce5e29d02478a6b75531afeaeb9d7733e7c495939cfce00ff35a2f81d4f7b0b92f3125564dffc3321a2c04b9d7eb28458354442099b85335023c910ca6b61f887e881f3cabd99dc1d14eead62f3d4b7f89723f4fe2a9ad6717cc1d57914658cfae512fbc6ddefe7d250398b7d711feb6c666d43f82812f572cc7e502467398752decc02f705cd7470bda3fbfd864eea5290a285bfdf7387d42090ff48e7a33a646907eaf038a0a90aef4b74112d39609749674c81030d61a78418d6c8547ee52f0fd338dbd78dd2f5440667e0e5982c6304fc9bf5eb7cd7f", 0xe5}], 0x1, &(0x7f0000000540)=[{0x70, 0x114, 0x2, "97719aedf047fce5bfe1137d01c38aafa26a9d1a1abec2ecb363a710a97e7b59fc45dfd3df211a624a3f6b079f0cee511da46c0c454901e019eb40af8fa962e2d9666d3fe6c84c074fee3731ebd8e66680f1ab2519862d00e82b1843b9b1ee8b"}, {0xf70, 0x107, 0xeb, "bb50933898bfd5c03dcdba12225afc92bcfb5b30b7864ca966194179344d1d3e5a4843ea61eb2041e8fa868042817831e2b54f0b89049a17bccdf9e049acc6c6b3a366d68f0f80b3b88981ac3d3b8bce0bd7937aee919ad6e276745ee0131c053404990d61fcf4a09634e5085481041ab3adf29b8d81370a67f74ad17590237d554fd889946228ee01b1c09dae22a957f7789a43b8113976915b948cce6dbe56aafceee6d2ef07d34f9eaf71de7254b178550191f495a70a3e18fc27456ebd1192105e2dd71b780176145bc1143a9a7afbe0eea47fe82c8ce91dfb75032c1ff8399e9bd5c6e7f10ca9df2e1b9152336131b1c529590f2dc0b51ebe60567dfeb696cba80ac79d6c60e2f7665a0848e094fb2ee90965857f053199a5011efc99bb6a21e90059c2afa8a75d52bfbc3d5c11ccd57be930f16acf447204172f3738ba44b54c58801f786228eda313588a39324cfb91b9c68d430d713067b0007ea20adc645a5aaa3e5a59359a43f4358b05afd10830e5254fb3c3002da680f644c80000728f05198e44c1ba0a62e7ec904ee56908b280993ee0a448fef79f708e44c3ba42b7064b571e28c8ae00009913b7bf37c4e82f96629969b628041db0c43ba0b8c74339c3df6d8e71bf0aa84c5ef5eb127b3c767191cd668ce9031c298fc5c4c586caa1b525550f7abe9537846eeb7f70ed89c647059a93dc0bca4640c1f690b3097628ab0e0146f9aa490018ae3824ed7e1f6f3ea879c8686f086462769d0b6317304915b5c3c363e5cb83374006f90bc15e5eb11689e5285bd7d7d5c7dcc77e27803ae73339ab8f27a37e7d2ef6f16397b682f0a180ee992ac9240eea40f483df332a789c4e80db2b43890afd105f05379411e1f7e7c1727714784152ca60f814f391d045909cbe87aee8016f75abb5507d180ab3a6018fb3eaab94b2570289d0df428f19f2982ec9aa34dbfc5c4f9b4ebca697e52e009e3d0de014b619ebc3d0d14a2b8a022f9e9b31599fb5dfee4eaa63d1bafaead485bb9180386fdc4a3aea04d1d89a80ce184c86b23ed2e7bd3c60c982b2ee9ce66b0e4b64a542c5957b5ed35cb64ed8e9328b7ca8b995736ee6b59b6abd53183f5ff5d18e6ed6bfca354cacf68bb7a9efddc4301d9efcf099eb52bcaf324242ade05f5aceb057394098a6962446a32332c55777682909290d794350da4a14f4eeca4e87f9fb7ce58dbd0ca27d205d0263e5ff85d26def7f3b236ce999aff7a17f1a802d6286a4b87b80ef37edd3909f8f1ec536d0b59d64963673fe23833b15d50ec29edd1f3929ba6102a8fd388316ceee32c74335cde5a3fd1a89a5cfd32763c9957aabb27d0738b4f5a866e4f23e649ae231426b1965ebf4f4b5f79adf4e035d441c279e67b5e060ddb07d60ffbca4dfe8a37d1086554553ec6a9e0fb93ec8cc0fecf7408396a2fff46614dad01665956b0ee5785d02fc5a648d69be4fb88e1237a92d6df4352c362aee5e492be189fe699d1eec63c1d14672c31d88581e36d9e1e05aac64c1b61fb5f371d58751bc6b7697df3d9bd6a92d216cde29e036ff3e8f9eb82a1f99dd17ef6cfce84b5bed98134ea0a733a0d20bdc7be1269a266bd2ee63e7490afae35353b5ff4e73bb0564e50465a28d9dc43cde4ee9045d76c8ebf59c0c989265e2beb6ade657bce6a4fcb2411b0b152b8d521885999fb871b0f9b757d62e75c26883314401421d53028f0d1f85a8c3dc0d6f4806895dccb3b1dbaf5a7295367a5d00e786863d2b7b0c8b0b2d1d9614136b30def6bb3107004b58ca9337306888de15322efab802516d927744c7f39cd231f0bb9afdf909d1b5a2a24b229b9148c6cc2caeb9f4c17f562a439048e24ce284d69afba8583300674590ead68ec8adfbbb4a439cb7082636825f931f2d9421fd17e838a660726dbdcab7da3d2202315107017e232c02ca688bba38574d9d8e8092b25a294f008bbae36aa1bc7667fed61eb7d20698cf8a032f030b02e43aa3e6351003e84190209b64bfb4b4bcdccd356ad302948c288f3c1f625ec615c2a0de260e90f8fb4baab0f283ab3c97f0a2e899f496a5f7a11c56b07e89c4c5aeb1e6d46dcaf4f9e49c6e83bd6fa529613f5dfda736da1afd5cd17612800f0ff9cdb0d1fe0a09c152008acf29e84c57c0ce756dd8dc2e3e47d5ee7e1f0dc905150c86f99fd8fecde0651b020c22f744fbd4862698227ff0386d6c98d3e4b73c017c3dbb8124489842c5dc9b466a2fb0982d436187175ba715d8df4fe80dfa5ce40e01e826e95355f6d0f3466f56d3a2c33620f17dfd137677d70328d89c529a25fe8bb6956b3d72e490dc9f35e8a54c83c9c4aa8010a455318a8a2481898e2038384448e1d55a5fb60663e4105db866a5f0c39c2982d970934d8c11fb9ff14f9285fb57d7b12c75c327ceccbd1b88e6af9fb7ce920b7943563843c44124537038c2aec415d6bc401d0def451466d3cfbf91053a8a6c1967b5e9015487221232c6257b3b4b913b3791c547c7131e18a275dc8b677fe562c6a8f7fc3c1045f362834d208df2727be7aff8cfa6d5f53c3fc87d8fb83da11b1b21e3f5282191cbba210844cf2d22804ca3ea491bf24579edb65f7d2441076173144f50e7c8640143c4035d2157424862a86030a9e3203d62e5c224331721a255a663626a8a364a6f75f526dc8c7bf71d472c79a574fb38e3e2ebcab8644f5ffff13bbb1f307dcbf22f07a05ea52969d75599cf1a0e571757ce34f48f8c7d8c6385ed88c3772f8b4d88a307acd4cfe34bde501744eb38c1f481e48dfcd6fade2e402bb38904156826742f316a29bc5b79ce111cad66fe9bba6e0fe165971c6f8cca203cf250164b0d72a5c7163d73adaa87504dc0083cdfee00fc8f4f3ee01d63c7cde5aa25d934da42540299f877e0ad7059ea80e74ddce4046be7152397691d0306a84e309abaeaf1ae52fc83319bffb78f66b397c7ba2df97e05ec06083d7da975605b9b025573ba67307b2f4bc8b4749e1e79cf15bcc112397036fd8681903896de4fb7ad26526f6cbcc30c16ee82bbc2666f8d817b4544fc1bbffe0c6b2f8ab4c44d892c37396020a64cdcade7a2c4cdd6028a5f2e631f7268287601d17eb034e8b82709b4fb65cf1d1b78dfd383347933f8194bd24e83a99585a9e8455a23e179f0e03dd2e6f20c9a2367136dc2bf1ccbe871aa61ebf039d9b17bcd118c0458359d36f41ed3f3b357c33af27b25922e054c50097df1fe3541f09917e340f714614960fa8c7173fb5467016b56e18b9599a2c5aebfe37af92294a571bb36e6b31d2ca43bbd15a7b230fcebe0d7862af24bbcb403697a7bf7e8dd699d9950e8b9e3eed5a9f9815275ba517d413fce43f03c7479b3a4ca4f46ceb060911171ac70da2ebec3773f0e32c662a8796e3088083db445f3eceed0fe25f96527311065b0ea8800593c9c4d89cb49e27f590f19d3cfb7920319ee99dd44e8533d20fcf115b59f678ba2f2667d94c06bbe6479dfe0deccd8646c9abe8a03353c1b357ae797e4be2e64ba4844aa862101a0058d869d86edeb1921b5d2bdc4ff72c7125ffd7b3cfb663c9c91f391987fdbe4a56625d47243f54e4cec07e742e341c75501131bf17c7cdb56069405e116bf7c63c1910e584d8121ee0d5601f82a61df99960c3f1f9db82ed53413ab634c5000eb89470361832a3ff52c248818c8185a6ca2a767e59cd3ff10db20430d2650164721a03679ec2ab598fa7de2c5f9319aa5079b289b624dae8ee61e51e0c728413f82ca97f1c27b9ba77babf548eafa1296723731566d4e00dddd9d23fba82b0026e99fcc63824fbb86361b5375d1511ffc02847a2f6abae877d455ca5973331cf2949a0f8f84b4234cb52bd7b49247ec4e9c10be309579ffb7db067a4e0f4b2b9df03c4d067140aaa9ff446069852e6ccf90414bea0f19235382d57809a0ac5969d72cd47dc65a94a0bc035bba0e80ac63559b0e8c9a4ca94ab2bc2502bbc3144a8a7a47130ac84f2ad9af298b8bff05d686a20afe398b5408e019f024603dcea159b3d7279047191ac66ded5ddf19628cefe27da097784813e8df7c4b53ba9380ffd0acb435a551f00e116233a63d33573e35027fd9e6b6270bf5d149c664887b309d35ca61110d9109e041e68538e3782635e7c396fd39b14e2edbf133cad298c16583ed0a70b77a59d486006445c4500fa283bb392c483cd9abd5a4f21391ee40f3c1eea81e5eb3c61a247aba05458d9e05743e4d472b635be7f13a5d0bb51dd6a44d72758865ed88da2b74b3377c3b03a126d506cb7d47f7880fa94b04877ce96411027d133311ec601a605ddecd555bece274e451fd860639981c25cce525433679da65ffb843093cbf5a3ed6f88e31215e05426f82976e84364b8c2b05935d2328f8ea52ac09da9edeef9627502e9fd4efd28ecde4ab0d57066c38c3bec9b2c455c195e6c4351bd022608d1a1095931ac1293111fc578514f379f222a0f5e84d8e4f00fbd4c47d0deefbaba6fe1e8870bcd3838fe642a4b4448d3785236dbf29966bedd6f365d5d647a40a8e377540294a1fc00a80939b9ce2ad517b8de5f0451c6fe5eec442b9bb70cfd68db8998a688e243c57ad45d218fbeba2fb45c75735f736bae9eea70e502fdb346fa2275407fbbac07565438babd6d4a0b35e65dacf05a924c151b3624bfde1fa6b018a0064937bbc658a0867b6b98d9479d061f06a7b6628089eb2b2ddee2a63111b813501660e5464b7944a848acfa56974e9ca7f27d045ec1882dbceedbb79f9fb95d5a80e38120da52fdf52a77f9cf091285b7452b62d226da0af691114ede4271364c151ef0d3f3077f240d2de23a1659a0fda2eccf1803bd607af9f7e78f8f92797f24cc8da5403b5de6e314e397a4758d160974d1b9daaacaf921223a79911134f3dca2ee336e9db4552229a5f9e0e3645eddd80c511fb8fa4fdd088ea85d2cb1bf3c4f6569c16d0388b0537335e09e936bf33f03549e8b62613fe802486736bfd3ff88d34f39b3dd6ea4263a60708648cd7f5062b78f0bf1711ab3b1965036e085e8b3fd56dfe2a5f38efeff48c59417dc2523c9a1b1851238c307493da076f6765a9c9ae546bf99aa3184b36192ef2268373dc97ba523f6e76f93d0722a4788bf1542e9bc333100aeb7739bf0175e5fae6ab8b4c451e928ff9b3055e6946ec153de837072aa974da478637e1d20a6a4ade9cb6efc6823ab3b19a11b51c3097bb6de0703b7417a95a3dfa2ca97d8b564bc0eb361a875ede53bc5ec7768aa8e72cc133261aff48b704b5fe4be76562c4d8a5fe5f15a86b05ab67b2b0b46f33a25107170f91c16981a39777c2ab8b7aba19a942c5f12a6193dd2787b1dd327d9159f392b67f1b8b8d6b6ba1360548f3339594aae564275870141d8e4df1dd7d488dd7f6b611ac0b8b5cfabefcb6a64bf4b324cd712e99b0b7e6cf07c67cad25e3a90ce68f934761ea691e77d370d8a25fa45f9c63b39dfc794aca7f4cbbd84083fa223d3451fdfdddea444a99f066877f48909a79efed76965c08cd72"}, {0x48, 0x6, 0x5669, "b7edeb0014c2366b57bcc80c3baf892c82a981887266e7781a230d4469e943ec073a2486965ca2ddfc1cd87cfe87fe689e9c5ae3449f9e"}], 0x1028}}, {{&(0x7f0000000280)=@l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x80, &(0x7f0000000380)=[{&(0x7f00000000c0)="ee957f64fef4d490ddd3cf70e7ed17d5ce4bf7c1", 0x14}, {&(0x7f0000000140)="389ccbfc8309287112", 0x9}], 0x2, &(0x7f00000016c0)=[{0x10, 0x118, 0x87}, {0xd0, 0x11, 0xff, "76ae33db34e96ebfd8368753af0575e76c5d1fa266ca4d7ae97d318edf4700ef2e35fb438c102a3d0c4e6fd74710ca9de46ca117f05035937c38640a69f2a09fa4e44e17da34488251f7afbfeef0f2da1f04d10dcaa451a63915b7cd180fad92350b49e888b4ab44fd0998a5fea5d511746f24e1ac161f2b5f44e4f391908a4d2df3c5e5429237640eef6224ea417fb7d08044fbe89d0114de81a74bcf0d8e506cefeaa0ea2287e500c75f27c109ab6226790111d39da911d51b91e99b"}, {0x20, 0x109, 0x9, "496f68a695df4303fb154c"}, {0xfc0, 0x10c, 0xfffffffa, "c6e04dba5859940e968f3dc40016bc690ff633f58c1a832cc78a6934bac96de0c87678deba5e1531f090eea43d10d944a19fedea31d3bd8beac618aceb071152e1c8d1a83067ca34ffeca0833e024d809e28f57abe463dbb392e137dd7add4b12d0650e9931d5ef1cfe8e089900febd1d662aa382b73d79d17ae012ff9ec908287cc9248b1f798a297757bf7facf0c26f3a952f70d153ee5c37f5e90b0e58ba0d430af5733c18d0f010ac0fa3edc1dc119ba92b387917dd812f5d1ba1d8f7468e5ac5e9299d20bf6291298cc62d0ff6a1cb8277c528eaadda188b6a77fff7f78ed56cce7f7c1fe98494b2f2901ef006594dddacb1e76dc86052821699bc7ea79d3d59386627acc15ecaaf307b0c1251ec5b022cd7128dad80a7f2c3ed8de9864b4df03c246f8096dccb2acf019bb90cc078a7f2440e0d81642c32d97b6132c6b2d3c2eac18b19decc0361ffd01e12d7aa0310c8239c60fddaee4603394392c7b70dc39869aca6c363701d802012611484b1b40f6882983e098ca41ac1f715d4688dc92e292b969d5757fe389b559d1de1589ae4e53aa7dc09cf8d3f97259ee620c8dd79e42469da648e366fce7ba9ba04292540c48de95761df2fd434296df4c6ff210193f509b74c91cd7629d043574090f94df7c098e4c88b14d90a20170fab89eded05d18aec372e4beb2b5ed45d1e0449b5e3f0b807c49194bfef8543174e77dc787db5571e2078ab234a59fa32de5c5d0c2ac0a8c057a6f8a73106c1eef544e2891737dbd98ea6058f2a999fed621ee4490b59559cce84a6f9ee7e7aa6f02fd978191a10554228c33953d4bf3706f29517b8569b7054e9083d333bd81f35aeeeb64dccdd5a66ceca9604951a23b72a3d1c6a11ef733c0a13692cc6e06dabec4f9fa559e5a7370876f7fbdf9b5fee676c6c4b64f45539c8e2ccf91c6acb3a6e731deb51dde7cad3d7b12fbc0da8c8b010796e57f01d6d55b603daabb6cc8a6927ce72aa7cf645efe7b8d522d68b6af192a3b8d16eeb322cb4bd14e2e86bd409b5845d715ab25c103a84760af2764a40b96ebe59bfe7243d1756f97408e1a018f9ccf1fcc1b818709148adb16154a2e79314f19582d84d8d844cfc41a0889d943586a95b700b517133cec430fd63aa87bcb7a201d5b5e20a007d7f22812ec2cedd53b52b32ea2181774718de84c3e4ddcc8b5f86e270b7c43f5ce5d28c5c64602afb4f6527fa4af4298349559db46a47cbc5d8db6a6df25992a823fe2b5561a766617beaa8bc4e56d91504e5c3b0d643ee83adb2db49c379d1e2693e964e33b1422df75533c0689bb8c2db0be404de4b36a6ba5c5fb8d600d70104b273b4a69c588a26151b639d8ad5e6264bb04b7e4e7890511ae87672f9faa9bfeb073f09242fcbcf5f6ec64320655012a200d9c46efe9abef54d6481e95fc1aa04e1234f17ca9d83282414755a9ce5c2a33e1d0ad559ce4adb4423874844d5621ba62843c3e9370a0b5ccf7a1af3ae2d3fa8e11996d22d5732304896765a4dfeeb40a8fd9864b2893cfe1ce43df53bdc537faf230c84c1447d23077bc64156dc5bf5c33bc1564a30b69502f952e789b6d0055aa8c17c55cbe8257f9133ab5a8a0b3483095cc0e2fda4a4e903f7d8cd41b3eb8d6445e061bad1877740f550b7937f8cc3d0bfbc07adce182d7296b335c72865ad30c8c90a8482d588a960c8ebfea32b29b3cd01746397b6b6879096eba62ee63aeee3a8b29c0588576da0e402ad06a95c27cdee2dfa36b21f7ee9e1f6794b4ae59665906b20c3b4a88f25fd5e6c7d7d3b38378ce9fc9ced083859aa7f8da7adb9d35f8128e58335916a2b6e6781796fb8863293dc78b7c19a137f0129f848970129e677a20878e68efc2ed8089115ab7cfadf1b2faea1e49c68c0fac048e1618af9a6f7231c39241249fb84eeafd5352fb82cd976ce06254b781d1eef183db098aaded647dfc38ee2807dafe3db576892eede5815a14bf386f0d5026f9b876eef0ab60472e4d36a86f3147557efc2e2ae5c41a9a58cfdbbb8f8b83c7996183371a1ad3b1b8e803ecfe1a1e3a9085374da1d6bc4086fac7d108cc2f402319c6795618f82da4fcdf5b9001a48cad9c17457d2554524ad34c1c6ae46b5f8e870c78fa016418bd0d580859950dc4b251f898e96e88387b064942d3437e8d86a50825b866ede37464c45b3190f6aaf31f16c54462be9a73e00e6c31c401184a341b4ee06fed2e4e7513e44841e28b1050f87903549a24701774f29bf517eeaba91ef6fdbe969da24ec067675c892a4d53a04a0a2b4447a4b405da96cd6e15781dde24ff511eb24521239bc83cce280fabe66046c9405e0432c8308fd842bdd2374487229c10baf57e18489fd4b12f15adc306c777f788dbfd2e04eb4e84041ab6f6205aad102fe12b005278f3a1f08d58bdb7f32f7e77bc223832822d93baa891dae1d9b89b18ff0952c1e54282d7e0d762f60e23262808ef4b709b0e8d78a7eb54ee89dc2b6f00624ac02cc0efe49686544a83f5c2dff49f8f2f31c4c86a3738abcca576fe3081a95fd3d9e0d23e78b857a461887e331cefcf2cd43bfeb00ce182c5b37fede75bcc65854640042ce9b5c9decabe51ccd1ba970ad2e760491fc5ff51df5d5a4d31ac61fce5facafeb5837dd27a758d3666701f44ed01038105c82e3e80023ed3a0d70d1c7d4cb4e62d0f196687288fe63dc13bc4d2b84e6eac991cf8fead4460e6939bb7f27c58ccce2cef1334144e0aa514c7ded5ae81b6bd2bc672a037e9294c6e3e53a4a49d6f026d08f2a327457d10447fb7d349e2927468614864e093fc73f511613a5d2cd0701e1b09cfbe39f62cbe41c2cf35697b9057c652a26f6a55753e97bba2e2630c75d5153ab2a477843fdb1dda4baf8788461abd6e6457a67bc8f88b8d4a50fe59ef6e854da261b7852b497a67a00821f6573e31aebc59b62330fc4a602e79c7ac4d242600ea07d238bba7e9d069b29f92b3f52dc3e02fd60fd92ac3f1a0e0ac129b175de9c06796d6537aee3440638751a4bea835396759019b2bcb51d4e3acf7a11c8d73a03e9db2b3af443fe07e65ff1b495df9d57456de5b51a68405b4435fbea4121f4d99d1b4785a8536ad0a6a0476ed23ecd2cbb1f159667b2f3a5fd9cf095e75d09ee47f8edd5148d52012ba168de1910744c1d98a9f33df48f3a271f23d5bc8a712a53e982f3b25a0397d1afe08b4a53ea6e0792f754507e09780657e29535d8eca99f84652a443830927e77ec26cf670e7c3d359af3f2e95ceeca014e103d2b19de3ce639e012b0dbbdd0ba6eaca505f053e79b78e7d0a60aa23e002ceba3440d1e381be127c6de56fbcf16f97a212b0dd1677d29a0667159059973619073fb1b9a30ecbae6859f4b5684ae34a47e4035fbf98177fb34ec71513a2ff09fc6209beb79b76f06b57a08dd393b9d923e141f28e25f87e18358b7fe4aa4eb4e42827b727412898f35b786b66fe6324bdf6f27ca7e60261d9576a3178092087f3bf9d625f02186179aa68313ee0de97379df6d2dcb71f66eb6dc522d5f9e725a748192fd4a7174cdaf8b10042101e8b5a54c7555606252bcaf3181d9249e92bf7c8da52f5ea1f433c23dc8f183623aaefc5fec5b4c344b491f8e828a796eaebca5f99982d41e39d2ff702dfb07e157d434c369131df4159af62666ae7ae7cc405d4201e3f35a676d040d995149f705a950cd7af3c38f7fdaa370fc8d3c86745addcc555549bb7adb8e0b3c518e2dd50d776a409601ed6c339f6a345b4c23a52d09486641744c460f91befd0370afa3e3baa1f6374dbcc723bcb8619557fe0de0023cc48c4c6e09f67e89e3e1e775e44e2a808568e361a525ce4fc591878997b82a6b659127d3a7c500e97ceb8c9adde2f28f805bb609d432dca7e4bdd3682fa24ab3e34708e6acfaa2a4d4387d4143082a01e8e86b20369f25efe6644a1cfc39e79a160260b7e7fb101a0228796bfd64fe49aa504e64485be6c5e3b69e8408120c063e34442a095fd6719fae2bd24cb7dd1a45b72b8e0177c77eaa451a2bc7045eb5edcd0c90f7d7e509be385e6b7316a437a00976eaaeb7db1d75afa93c8c3b823d771a7828b9c412e4136af518ad33b1ec48828ad4bf6dc4eaea0652dc3e122881387d7c3bdd7ef47b281515bad04a32f99c4deced3416b59c512b039d8b4737b7c02e533ed49e0213b420bc41682f0b100e2c09761e6077c78f8d5549065849462ac655ae483ac519a65a4fcc3e15f860676f22afceeca1823ab70b8d3aa4039e7b0a13151089bcd5851df970fa5dc669dcc5a680d830436a932eed689f958aa5845cfaf4bf6c56bca6465a7c68cb990f64847286c57d61b32182ca71eb296ed46faa81d47bd2f279d9d1c477f781e1692409a64a98b03c289eef4c9e2cb13970178038a04ba0f2e782cb46f2d16c40c40b5e2f5f5da71976d2e2c6e12aef944966febb7b1e70f5a41f0911d3db789b6e88b34ec371d942957e8cd993d5432d5b7f1c90c4b7aedde2d5e1f7aaa062e591a4567191d6c3a55b29a30cd20b3d8c34dd8f98544a48244efdab120936dc14a2bb83bdc309881efe90e0a720ac45fb506557d774419c7bb4291dab3a568dc289dc2ca3c1e1e794f964e27de4e9475e5ea1ebbb68af609b9e85ab56bf70e54609c5b8b6da48dd421e7add1c0750fc9a8ae62933a08756ba374c8a94c1a6ba26101e77bea02a7dbc1c4e2dcfe22493370e909c682a4bd666eeaebe2da864edb8ef2015a45607487ae737bd39e42a4235d4a03cf053354b6500611c208fa656c3225882b07f3f7190d95bdce8333cc90656d66c16075a6db12baf5c5ec45619393ea9b552f3c70536d96aad8d19f5d78ed992dced4813484ad2439a6f165bb26d63129a9aa23c7f2d8827e01dbebf0f18c35ea0e77979bbcd5383780e7fe8af753c3e547a470c255599fea6d79e44b9198bbd33bc67972c7c226995f944645e3233e2e03c86e2068755ba7be9d95c7f0efb0758687130d652bd1e7aad5e3f1c30faac9ed8ef8f650cfcc98948e1f6a8ad162828e79b684ae0f63f371e74366c0ca8b6ff9f5210ff2e49b4a1d3ab29e00040d6641606daef8752668dea0e082cf3ae7dc33c3706fd5891a5ba3b584c687c23f9333ac4efc42df005212e2441e0ac029a46bdd88388a5f83f4e74c02530fc477f53877fdb862e372fa659410ed5c87aeb48e2db84cc20d2be69de39edc4ed98d92b89cec6c98f00ab2f1574abe730b2e3492776084f60d9b180388bc7952284f34b4ae6433f66a0537ee2ff2affd314217e0045109332a0465a69296f7cf8dc2ae9cf98b7f1c96493008aa316e027924efbf72e30d9b1eabf3339de9791b9a15083b4e435cff95d47a2269a3c3210a35188fa3f44d6317c501b5ca88bcb511e8a44e32327a3a3fa97eb927fbe0b4b6899e5fbf113774971e6e667baca21bc61f09e73e0fe8cb347575fec2a28ec79dc6d8a3607ee7fe8fc34d472d345567b958a293beb97929bde4cfc69ac4d927241eca01d839231e2a8dd11388f10ec7b923bddf7352f4dbff282d4101b8a4b411acf3e03b1ed87927c54ff988dd445e4690753633eb1ebaadf80dc023327a6a40dbe8d81811741a0b6cde5133fc6d1bbe0efd39c6cb16d5fd1e5e21feed28ab78b17a"}], 0x10c0}}, {{0x0, 0x0, &(0x7f0000002ac0)=[{&(0x7f0000002980)="4f46e8b3557f0f79f72f48bef488d4da2a16f89e738c797089c465d832d8fa9b307e03acc18fc65af522d2555f775e26db3312938a937e78134d60b66de413d0776d232b1ff864128246318bb40949f656795de6054faa8aa6ad43b75ce833811dfeb956eeb2d852291cb3018344d876494567f3a0b8a8c278ee534de9174da090a4efd90aac7e4522c438a7a3c0a8d5089cc244eaba3da9d40f95", 0x9b}, {&(0x7f0000002a40)="541b5e7ec09652062e456379dbc2fe567659f205ab2351fded236eeaf139600760b3868d67cc0f570ac41f263131a26d3a47d3bcacf0c84203194ce0b4ca4502cff86532794c677bb48ad03a6a24c69d7557d95b", 0x54}, {&(0x7f00000003c0)="ab399f81786d17", 0x7}], 0x3, &(0x7f0000002b00)=[{0x90, 0x104, 0x6, "ab240dd1279428d43e111e1e0a32c1290c75069e60493648e6cef7a68f641bed25dd2adb63307115b15e0d33a0fe9cb656ab9db390a2f05404d1fbd9d12c38abe7d40a4cb7d0786406ef49f27410a159c6ba053328056d55efd17f51f0847a66f80a78f85c105bc2ea4f784deb4707098268566f9a1b4ed235e8a711eed7d1"}], 0x90}}, {{&(0x7f0000002bc0)=@ethernet={0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}}, 0x80, &(0x7f0000002dc0)=[{&(0x7f0000002c40)="5b74d5e7cf49337fe1ec7107b2a41ac0510343ed2db6d9559e86330763c8050f99164e251012da2e2602801545106d9d9b39565a1c4f5c1a335494dfdf6a3383de0225f9c63e600e3bd6b76676ba833ac3870a00363b9c9b94b5fa5ac8cabd23eb1abd1f1294d399c80d742500ccd3c15e95e72bf30d4c5ffbf052e1cda837df35e9056d93b22cc35f400ddbc8d36811ae91248bddb1a18e4ff874fc74fd752aee99158f874be6df2109f70cf64ba60293f720c92f06286c4a1fbae08d2af74d027c008f6decdbca73096caf14e6402a8ff88dde9f2eea6db0cff3303cf5", 0xde}, {&(0x7f0000002d40)="1b2e66ba3a49755481fddb929c00e069bcfbd2bcb648b81f7f1102f11c9384e81e194138fb6ac2d40602b53dd6c79b8509b88d44b77cb59de0a5c7f5647d6ce96eb74471718f509fe3ed27a81b71c887886a9b0f28607abecbf2591ff18fb3c05f", 0x61}], 0x2}}, {{0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000002e00)="927b6cba974db87ce8c99e3d62ccff8db1f58d9a611eabc6b7", 0x19}, {&(0x7f0000002e40)="f6801af586205675403558d7", 0xc}], 0x2, &(0x7f0000002ec0)=[{0xa8, 0x1, 0x66, "bc8aecde8bd92fd6c46d2591fc15ebe05619209ac89e8c431818477c16521eb4313e3ab3700cac50d68db2218a4cb7bceac527e03bb9967d4828445d37e5a75b7cf7dcfbc48b760d7d1537cea5215b0bc0ffdd76c9f9c9792fc0eadd3be7ebf7a91072e062a2d63cd1f7d07268969d16899157679b76e3631eca5a85d6f2089ef6db7804512dd46795429a7367dec149f2d23c3acce2"}, {0xd8, 0x3a, 0x7, "e6b0d551f7dffa1d095a481c89a06bba51a3f572d037dfe3682b7c7be7c7977caedd938a535010630e13a3bdfbe0f72f14c57f4c7aebe93284ed16bbae62059cdfcc42222f688619c2f42db42d0d4b100d9d0f71cd5995330f4501dd41c022c6e2c2916eb27b043786fa426a39e281936a249c9b6fb0640d8765fc748a70115fdecc430e33dd2d148efef869860d5f15ffd741ceab91d5dc56fffafd41442c45e7e212295c3b48046a23f2b866a394bc41bc226bf45169153b6882e89e995297017f644b"}], 0x180}}], 0x5, 0x10) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x7ffd, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x0, 0x3ff, 0x8, 0x8000000000000000, 0xcc, 0x6, 0x9, 0x1}, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0), 0x400, 0x0) ioctl$mixer_OSS_GETVERSION(r2, 0x80044d76, &(0x7f0000000140)) io_setup(0x8, &(0x7f0000000000)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r3, 0x0, 0x482, &(0x7f0000003400)=""/225, &(0x7f0000003500)=0xe1) r4 = syz_clone(0x2000080, &(0x7f0000003200)="a74575be76fd0d09bb191f12f737540da6b7ae703f25a983279c021229823368e74ae058785dd9627b094669d407e87bfa8babe056b6d24234dcbf605d9f4cffa0611656baec78eb9c1f7ea18e1078932eb0acfd8e1e89ddb8e8c036e2a4560f80b06297add4f73c5f0633b77b4e0aa24d8068e434f0f69472639457d93595de03ccd68e13bd844f4bb7cd091f6bfcf33cc3d8f3177e836bf9b588ae5e631f5d86207e15e1ef743a0b4fa87a1e918e954e2962120fb237eb92cf7e384f683d3a7db8f81fab87c001101682751cc65e313a50472e9bad4523", 0xd8, &(0x7f0000003300), &(0x7f0000003340), &(0x7f0000003380)="8361f97ffd8979a8b121192cea1e3a789cfbf44c917dedf4bccf5d60e84aae4b20a53b3a3ba93684535afd51fa1c") sched_setparam(r4, &(0x7f00000033c0)=0x9) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_ACTIVATE(r5, 0x4b44, 0x10000000000004) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffb}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x1003, 0x0, @dev={0xfe, 0x80, '\x00', 0x36}}}}, &(0x7f0000000040)=0x84) listen(r3, 0x6) 18.442166022s ago: executing program 0 (id=2519): socket(0x10, 0x803, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) syz_usb_connect(0x5, 0x255, 0x0, 0x0) r1 = syz_io_uring_setup(0x1108, &(0x7f0000000880)={0x0, 0x2, 0x80, 0x2, 0x21e}, &(0x7f00000003c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000380)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x7, 0x0, 0x0, 0x200, 0x0, 0x1}) io_uring_enter(r1, 0x471b, 0xfffffffe, 0x20, 0x0, 0xffffffffffffff68) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r4, 0x0, &(0x7f00000002c0)={0x0, 0xfe96, 0x0}, 0x0, 0x20042, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0xc0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x3}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2001, 0x0) socket$tipc(0x1e, 0x5, 0x0) r7 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_S_SELECTION(r7, 0xc040565f, &(0x7f0000000080)={0x9, 0x100, 0x7, {0x400e802, 0x8001, 0x400, 0x4}}) sched_setattr(0x0, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 17.490015248s ago: executing program 4 (id=2520): socket$inet_mptcp(0x2, 0x1, 0x106) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000300)=[{0x0}], 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r2, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f00000006c0)=@mangle={'mangle\x00', 0x1d, 0x6, 0x558, 0x0, 0x280, 0x368, 0x1b0, 0x0, 0x488, 0x488, 0x488, 0x488, 0x488, 0x6, 0x0, {[{{@ipv6={@mcast2, @private1, [], [], 'macvlan1\x00', 'erspan0\x00'}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff}, {0xffffffffffffffff}, {}, 0x203}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast2}, @remote, [], [], '\x00', 'bond_slave_0\x00'}, 0x0, 0xa8, 0xd0, 0x48000000}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5b8) ioprio_set$uid(0x3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r2) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/netlink\x00') preadv(r4, &(0x7f0000000580)=[{&(0x7f0000000100)=""/212, 0xd4}], 0x1, 0x1fe, 0x12) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)={0x2c, 0x3e, 0x107, 0x70bd2d, 0x25dfdbfc, {0x4, 0x7c}, [@typed={0x4}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x8, 0x15, 0x0, 0x0, @u32=0x7fffffff}]}]}, 0x2c}}, 0x0) 17.122271034s ago: executing program 0 (id=2521): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$urandom(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$RNDZAPENTCNT(r2, 0x5204, 0x0) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) r3 = getpid() openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x2621c3) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/seq/clients\x00', 0x0, 0x0) preadv(r4, &(0x7f0000004ec0)=[{&(0x7f00000001c0)=""/68, 0x44}], 0x1, 0x800, 0x0) syz_pidfd_open(r3, 0x0) open$dir(0x0, 0x400000, 0x100) socket$inet(0x2b, 0x800, 0x8) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) shutdown(0xffffffffffffffff, 0x1) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x61, 0x0, 0x0) 16.012996989s ago: executing program 4 (id=2522): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x71) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x81c0, 0x0) execve(&(0x7f0000000140)='./file2\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201010200000010f3"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r3, 0xc0884123, 0x0) 15.88475644s ago: executing program 0 (id=2523): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000080)={0x0, 0x1, 0x0, &(0x7f00000009c0)=""/251, 0x0, 0x4000}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x70, 0x0, 0xf2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x6d1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe02e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x4, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x413f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x4000000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0xd, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x22, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x789], 0x1, 0x400}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) write$rfkill(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x2, 0x0, 0x0, 0x1}, 0x8) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000013c0)={0xffffffffffffffff, 0xa, {0x0, 0x0, 0x0, 0x5, 0x8000, 0x0, 0x4, 0x1f, 0x10, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "143939c787a16c1ca43f80026d1a8554fe581b59dee430e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d200", "24431a1e77a68e17000000040008000000000000000000e5e900", [0x83]}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 11.553052664s ago: executing program 33 (id=2503): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) socket$nl_audit(0x10, 0x3, 0x9) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000140), 0x8) io_setup(0x0, &(0x7f0000000000)) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = io_uring_setup(0x1530, &(0x7f0000000480)={0x0, 0xe739, 0x1, 0x8000002, 0x1d4}) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$nci(r3, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$nci(r3, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r5, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000002d40)={0x48, 0x7, r6, 0x0, 0x10000, 0x0, 0x8, 0x28d662, 0x1096e}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r6, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000280)={0x48, 0x5, r5, 0x0, 0xffffffffffffffff, 0x1}) close_range(r2, 0xffffffffffffffff, 0x0) 6.542896393s ago: executing program 34 (id=2512): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) r2 = epoll_create1(0x0) fcntl$dupfd(r2, 0x2, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0}, 0x18) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000240)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, @multicast, @val={@void, {0x8100, 0x3, 0x0, 0x1}}, {@x25={0x805, {0x0, 0x8, 0xfb, "a2f1ff80114502115efa2edffe20909cab2da7c0ba8cc356fcdb59c3048b9ae94577115ca453482522b4556c46525a96e82073a9b6b5f9dba7f68e1ecd9b71d2615886c26b036bef2c5ce88ea55818abc98ace892033dfe821fa6263b648e2bd1fcc2e0f5a7088bd59ef54b91786f90f4626ddac800b260e2f6292f759b1c6d9"}}}}, &(0x7f0000000180)={0x1, 0x1, [0xf74, 0x8bf, 0xe4b, 0xa20]}) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) dup(r3) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="e50500000000000061109e000000000004000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r5, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0xc, r1, 0x0, 0x0, 0x200000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000000)={0x28, 0x6, r1, 0x0, &(0x7f0000ffb000/0x4000)=nil, 0x4000}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) 5.036327973s ago: executing program 35 (id=2515): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x80) r2 = socket$netlink(0x10, 0x3, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000009880), 0x2000, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000000)=0x2, 0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)={0x20, 0x0, 0x1, 0x70bd28, 0x0, {0x1e}, [@ETHTOOL_A_PAUSE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}}, 0x40000) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r5, &(0x7f0000001200)={'#! ', './file0', [{0x20, '\x98\xe1Cvg\x9cO\x16\xc0TC\xe8\xb8\x91W\xb8\x84\xdf\xbe\xbd\x8f\x81!\xf2V[\x03V\xba/\xb9+\xd2\x95\xe0t\x0f<}T\v\x0f\xe8\xae\x89\xfa^\xce\xae[t/\x12\x1f\x02\x85\xbd\xbc\r(\xfd\xf2\xeeB\x12\xdc\x06\x1d\xd8\x86g\xcf\xb6\xde\xeb\xfc\xfc~A\x95\x8a6'}, {0x20, '5\xed\xe9\xe8\f\xcb\x82;\xc5\x98\"\x1c\x8d\xbb,X}\xec\x9f\xe5\xf0\x1f\x02\a\x0e\xe09\x17\xa9\xdbXP\x94}L\x17WT\xc0Rc\xe5\xd3\x9a\xcfGr3\xbaf\x8aS\xc6Q\x16\xf4\x9f\x02u.\xaf\xf3\xb8\x0e\x85a8\x03\x02\xf4\xf1\\b\x1ew\xd4F\xf1\xf9I\xe4\xca\xb1\xa51Sk\xdf\xc7\xd2\x87.b\xb9|+\x9f3@\xdfs\xa0\x01\x8fV/0\x8bo\xccQ\x9c\x9e\xae!b\xa0 \xea\xa4(C\n\x96\xdf\xd2\xd6\x91\x90\x83 \xb2\xb4\xac{\x02\xde,Ff\x98\x84\x16\x1b\x96\xac\x9e\x17\xf0\x13\xfa\xd1+\xcc\x19\x81ZZ\xa0\xde\xeb\xf3`\x0e\x87:` \x1b\xec\xc81\xb7\x91\xfdcL\xdcH/0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000080)={0x0, 0x1, 0x0, &(0x7f00000009c0)=""/251, 0x0, 0x4000}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x70, 0x0, 0xf2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x6d1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe02e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x4, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x413f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x4000000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0xd, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x22, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x789], 0x1, 0x400}) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) write$rfkill(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x2, 0x0, 0x0, 0x1}, 0x8) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000013c0)={0xffffffffffffffff, 0xa, {0x0, 0x0, 0x0, 0x5, 0x8000, 0x0, 0x4, 0x1f, 0x10, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "143939c787a16c1ca43f80026d1a8554fe581b59dee430e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d200", "24431a1e77a68e17000000040008000000000000000000e5e900", [0x83]}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 0s ago: executing program 37 (id=2522): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x71) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x81c0, 0x0) execve(&(0x7f0000000140)='./file2\x00', 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201010200000010f3"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r3, 0xc0884123, 0x0) kernel console output (not intermixed with test programs): config 0 descriptor?? [ 706.689216][ T6347] msi2500 2-1:0.246: Registered as swradio24 [ 706.704319][ T6347] msi2500 2-1:0.246: SDR API is still slightly experimental and functionality changes may follow [ 708.621033][ T6347] usb 2-1: USB disconnect, device number 37 [ 709.544675][T14175] capability: warning: `syz.4.1540' uses 32-bit capabilities (legacy support in use) [ 711.191767][ T10] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 711.505176][ T10] usb 4-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 711.517719][ T10] usb 4-1: config 27 has 0 interfaces, different from the descriptor's value: 1 [ 711.574006][ T10] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 711.638622][ T10] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 713.361147][T14210] cifs: Unknown parameter 'f,' [ 714.707955][ T10] usb 4-1: USB disconnect, device number 32 [ 714.874674][T14229] fuse: Bad value for 'fd' [ 717.951910][ T10] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 718.253082][T14247] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1558'. [ 718.475362][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 718.504790][ T10] usb 6-1: config 0 has an invalid interface number: 31 but max is 0 [ 718.514018][ T10] usb 6-1: config 0 has no interface number 0 [ 718.608770][ T10] usb 6-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=be.68 [ 718.652160][ T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 718.666091][ T10] usb 6-1: Product: syz [ 718.674209][ T10] usb 6-1: Manufacturer: syz [ 718.683493][ T10] usb 6-1: SerialNumber: syz [ 718.704305][ T10] usb 6-1: config 0 descriptor?? [ 718.737323][ T10] redrat3 6-1:0.31: Couldn't find all endpoints [ 719.843563][T14271] ptrace attach of "./syz-executor exec"[5888] was attempted by "./syz-executor exec"[14271] [ 720.348931][ T5959] usb 6-1: USB disconnect, device number 14 [ 721.212040][ T5959] usb 5-1: new high-speed USB device number 38 using dummy_hcd [ 721.662656][ T5959] usb 5-1: Using ep0 maxpacket: 8 [ 721.680190][T14292] ptrace attach of "./syz-executor exec"[5882] was attempted by "./syz-executor exec"[14292] [ 721.730522][ T5959] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 721.801181][ T5959] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 721.953413][ T5959] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 721.990352][ T5959] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 722.055352][ T5959] usb 5-1: Product: syz [ 722.114602][ T5959] usb 5-1: Manufacturer: syz [ 722.195340][ T5959] usb 5-1: SerialNumber: syz [ 722.717423][T14283] Invalid logical block size (4) [ 723.132949][ T5959] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 723.345512][ T5959] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 723.355368][ T5959] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 723.368230][ T5959] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 723.385708][ T5959] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 723.422589][ T5959] usb 2-1: Manufacturer: syz [ 723.469493][ T5959] usb 2-1: config 0 descriptor?? [ 723.608143][ T5959] rc_core: IR keymap rc-hauppauge not found [ 723.616810][ T5959] Registered IR keymap rc-empty [ 723.624513][ T5959] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 723.856671][ T5959] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input31 [ 724.124578][T14309] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 724.241684][T14309] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 724.341026][ C0] igorplugusb 2-1:0.0: Error: urb status = -32 [ 724.444932][ T6345] usb 2-1: USB disconnect, device number 38 [ 724.555463][ T5957] usb 5-1: USB disconnect, device number 38 [ 724.792104][ T5959] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 724.962757][ T5959] usb 1-1: Using ep0 maxpacket: 32 [ 724.987694][ T5959] usb 1-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 724.998088][ T5959] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 725.041754][ T5959] usb 1-1: config 0 descriptor?? [ 725.439925][ T5959] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 725.458993][ T5959] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 725.471617][ T5959] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 725.571382][ T5959] usb 1-1: media controller created [ 725.609936][ T5959] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 727.752457][ T5959] az6027: usb out operation failed. (-110) [ 727.771746][ T5959] az6027: usb out operation failed. (-32) [ 727.798083][ T5959] stb0899_attach: Driver disabled by Kconfig [ 727.827150][ T5959] az6027: no front-end attached [ 727.827150][ T5959] [ 727.864729][ T5959] az6027: usb out operation failed. (-32) [ 727.875752][ T5959] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 727.892705][ T5959] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input32 [ 727.966632][ T5959] dvb-usb: schedule remote query interval to 400 msecs. [ 727.986639][ T5959] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 728.057221][ T6345] usb 1-1: USB disconnect, device number 29 [ 728.174395][ T6345] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 730.007163][T14368] netlink: 'syz.5.1582': attribute type 4 has an invalid length. [ 730.205276][T14368] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1582'. [ 730.419046][T14368] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1582'. [ 730.525325][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 730.533225][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 730.541149][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no tx connection found [ 730.549095][ C0] vcan0 (unregistering): j1939_xtp_rx_dat: no rx connection found [ 730.566895][T14377] IPv6: Can't replace route, no match found [ 731.277490][T14385] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1585'. [ 731.533396][T14388] xfrm0: entered promiscuous mode [ 731.538643][T14388] xfrm0: entered allmulticast mode [ 733.757965][ T30] audit: type=1326 audit(1756836862.318:251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14401 comm="syz.0.1589" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f121038ebe9 code=0x0 [ 735.620295][T14436] No buffer was provided with the request [ 735.635951][T14436] trusted_key: encrypted_key: insufficient parameters specified [ 747.276461][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.285505][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 749.150133][T14562] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1621'. [ 749.358122][T14567] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1621'. [ 749.899431][T14577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1623'. [ 752.450694][T14586] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 753.748435][T14617] vhci_hcd vhci_hcd.0: pdev(5) rhport(0) sockfd(3) [ 753.754988][T14617] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 753.767040][T14617] vhci_hcd vhci_hcd.0: Device attached [ 753.892105][T14627] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1636'. [ 754.281877][ T5959] vhci_hcd: vhci_device speed not set [ 754.316832][T14628] netlink: 'syz.3.1635': attribute type 1 has an invalid length. [ 754.363358][ T5959] usb 43-1: new full-speed USB device number 2 using vhci_hcd [ 754.715350][T14620] vhci_hcd: connection reset by peer [ 754.784721][ T3567] vhci_hcd: stop threads [ 754.790394][ T3567] vhci_hcd: release socket [ 754.803900][ T3567] vhci_hcd: disconnect device [ 755.832538][T14640] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1637'. [ 756.472413][ T5957] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 756.827553][ T5957] usb 6-1: Using ep0 maxpacket: 16 [ 756.846563][ T5957] usb 6-1: config 0 has no interfaces? [ 756.862018][ T5957] usb 6-1: New USB device found, idVendor=1b1c, idProduct=1b02, bcdDevice= 0.00 [ 756.892079][ T5957] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 756.912195][ T5957] usb 6-1: config 0 descriptor?? [ 757.492188][ T5957] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 758.052103][ T5957] usb 2-1: Using ep0 maxpacket: 16 [ 758.364283][ T5957] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 758.436819][ T5957] usb 2-1: config 0 has no interfaces? [ 758.543485][ T5957] usb 2-1: New USB device found, idVendor=046d, idProduct=c29c, bcdDevice= 0.00 [ 758.576510][ T5957] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.605048][ T5957] usb 2-1: config 0 descriptor?? [ 759.502121][ T5959] vhci_hcd: vhci_device speed not set [ 759.731204][T14671] usb 6-1: USB disconnect, device number 15 [ 760.600865][T14695] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1650'. [ 760.687411][T14671] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 761.051421][T14671] usb 1-1: Using ep0 maxpacket: 8 [ 761.185289][T14671] usb 1-1: config 0 has an invalid interface number: 31 but max is 0 [ 761.217538][T14671] usb 1-1: config 0 has no interface number 0 [ 761.349518][T14671] usb 1-1: New USB device found, idVendor=112a, idProduct=0005, bcdDevice=be.68 [ 761.430831][T14671] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.461317][T14671] usb 1-1: Product: syz [ 761.475088][T14671] usb 1-1: Manufacturer: syz [ 761.480129][T14671] usb 1-1: SerialNumber: syz [ 761.492099][ T5957] usb 2-1: USB disconnect, device number 39 [ 761.725947][T14671] usb 1-1: config 0 descriptor?? [ 761.846618][T14671] redrat3 1-1:0.31: Couldn't find all endpoints [ 762.550480][ T6347] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 762.822177][ T6347] usb 6-1: Using ep0 maxpacket: 16 [ 762.830028][ T6347] usb 6-1: config 0 has an invalid interface number: 64 but max is 0 [ 762.839139][ T6347] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 762.853801][ T6347] usb 6-1: config 0 has no interface number 0 [ 763.023941][ T6347] usb 6-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 763.037008][ T6347] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 763.050825][ T6347] usb 6-1: config 0 descriptor?? [ 763.058745][ T6347] usb 6-1: Found UVC 0.00 device (0bd3:05f4) [ 763.068903][ T6347] usb 6-1: No valid video chain found. [ 763.142411][T14671] usb 5-1: new high-speed USB device number 39 using dummy_hcd [ 763.211643][ T6345] usb 1-1: USB disconnect, device number 30 [ 763.326460][T14671] usb 5-1: Using ep0 maxpacket: 32 [ 763.401988][T14671] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 763.428137][T14671] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 763.763164][T14737] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 763.816677][T14671] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 763.913300][ T6345] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 763.944723][T14671] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 763.971388][T14671] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 764.007689][T14671] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 764.050788][T14671] usb 5-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 764.083606][T14671] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.130665][T14671] usb 5-1: Product: syz [ 764.144570][T14671] usb 5-1: Manufacturer: syz [ 764.169770][T14671] usb 5-1: SerialNumber: syz [ 764.187309][ T6345] usb 1-1: config 0 has no interfaces? [ 764.189336][T14671] usb 5-1: config 0 descriptor?? [ 764.212275][ T6345] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 764.362137][ T6345] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 764.473000][ T6345] usb 1-1: Product: syz [ 764.546628][ T6345] usb 1-1: Manufacturer: syz [ 764.582029][ T6345] usb 1-1: SerialNumber: syz [ 764.625473][ T6345] usb 1-1: config 0 descriptor?? [ 765.138844][T14734] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 765.149555][T14734] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 766.035159][ T6345] usb 6-1: USB disconnect, device number 16 [ 766.106404][ T24] usb 5-1: USB disconnect, device number 39 [ 767.423661][ T6345] usb 1-1: USB disconnect, device number 31 [ 767.851195][T14775] vti0: entered promiscuous mode [ 767.858857][T14775] vti0: entered allmulticast mode [ 768.057114][T14778] netlink: 120 bytes leftover after parsing attributes in process `syz.0.1669'. [ 769.242054][ T6347] usb 5-1: new full-speed USB device number 40 using dummy_hcd [ 769.403569][ T6347] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 769.422225][ T6347] usb 5-1: config 0 has no interfaces? [ 769.438109][ T6347] usb 5-1: New USB device found, idVendor=5543, idProduct=3031, bcdDevice= 0.00 [ 769.502066][ T6347] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 769.571716][ T6347] usb 5-1: config 0 descriptor?? [ 769.687293][T14790] ptrace attach of "./syz-executor exec"[7843] was attempted by "./syz-executor exec"[14790] [ 770.532066][T14671] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 771.023726][T14671] usb 1-1: config 0 has no interfaces? [ 771.059085][T14671] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 771.213851][T14671] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.232733][T14671] usb 1-1: Product: syz [ 771.257208][T14671] usb 1-1: Manufacturer: syz [ 771.275708][T14671] usb 1-1: SerialNumber: syz [ 771.294855][T14671] usb 1-1: config 0 descriptor?? [ 771.859889][T14671] usb 5-1: USB disconnect, device number 40 [ 773.300024][ T6347] usb 1-1: USB disconnect, device number 32 [ 773.461048][ T5959] usb 4-1: new high-speed USB device number 33 using dummy_hcd [ 773.682620][ T5959] usb 4-1: Using ep0 maxpacket: 32 [ 773.711786][ T5959] usb 4-1: New USB device found, idVendor=093a, idProduct=050f, bcdDevice=56.a5 [ 773.760668][ T5959] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.787213][ T5959] usb 4-1: Product: syz [ 773.800038][ T5959] usb 4-1: Manufacturer: syz [ 773.817140][ T5959] usb 4-1: SerialNumber: syz [ 773.841833][ T5959] usb 4-1: config 0 descriptor?? [ 773.859367][ T5959] gspca_main: mars-2.14.0 probing 093a:050f [ 773.892422][T14671] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 774.064626][T14671] usb 1-1: New USB device found, idVendor=0545, idProduct=800d, bcdDevice= 3.0a [ 774.102467][T14671] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.173445][T14671] usb 1-1: config 0 descriptor?? [ 774.310069][T14671] gspca_main: xirlink-cit-2.14.0 probing 0545:800d [ 774.394335][T14671] input: xirlink-cit as /devices/platform/dummy_hcd.0/usb1/1-1/input/input33 [ 774.631806][T14671] videodev: could not get a free minor [ 774.637023][ T24] usb 4-1: USB disconnect, device number 33 [ 774.766197][T14671] gspca_main: video_register_device err -23 [ 775.037353][T14671] xirlink-cit 1-1:0.0: probe with driver xirlink-cit failed with error -23 [ 776.867180][T14865] ptrace attach of "./syz-executor exec"[7843] was attempted by "./syz-executor exec"[14865] [ 777.130050][T14671] usb 1-1: USB disconnect, device number 33 [ 778.555115][T14876] ptrace attach of "./syz-executor exec"[5883] was attempted by "./syz-executor exec"[14876] [ 779.887811][T14892] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 779.907494][T14892] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 781.302121][ T6345] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 781.804390][ T6345] usb 6-1: config 0 has no interfaces? [ 781.813377][ T6345] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 781.822702][ T6345] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 781.830679][ T6345] usb 6-1: Product: syz [ 781.876173][ T6345] usb 6-1: Manufacturer: syz [ 781.880795][ T6345] usb 6-1: SerialNumber: syz [ 781.939295][ T6345] usb 6-1: config 0 descriptor?? [ 782.227635][T14910] usb usb9: Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK. [ 782.236771][T14910] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 782.245972][T14910] trusted_key: syz.1.1699 sent an empty control message without MSG_MORE. [ 782.261593][T14912] tipc: Enabling of bearer rejected, already enabled [ 782.412060][T14671] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 783.380132][T14671] usb 1-1: Using ep0 maxpacket: 8 [ 783.398826][T14671] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 783.447911][T14671] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 783.482087][T14671] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 783.681646][T14671] usb 1-1: config 0 descriptor?? [ 784.698541][ T6339] usb 6-1: USB disconnect, device number 17 [ 784.985415][T14930] could not allocate digest TFM handle poly1305-simd [ 785.710900][T14940] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1705'. [ 785.957340][T14942] vlan2: entered allmulticast mode [ 785.970064][T14942] bond2: entered allmulticast mode [ 786.628881][T14671] usb 1-1: USB disconnect, device number 34 [ 789.072017][T14671] usb 2-1: new low-speed USB device number 40 using dummy_hcd [ 789.375622][T14671] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 789.394194][T14671] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 789.454685][T14671] usb 2-1: New USB device found, idVendor=258a, idProduct=0036, bcdDevice= 0.00 [ 789.491991][T14671] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 789.513005][T14671] usb 2-1: config 0 descriptor?? [ 789.740583][T14972] syzkaller0: entered promiscuous mode [ 789.753318][T14972] syzkaller0: entered allmulticast mode [ 790.094409][T14671] glorious 0003:258A:0036.000B: item fetching failed at offset 0/2 [ 790.103306][T14671] glorious 0003:258A:0036.000B: probe with driver glorious failed with error -22 [ 790.146241][T14982] netlink: 'syz.4.1712': attribute type 2 has an invalid length. [ 790.170351][T14982] : entered promiscuous mode [ 790.175614][ T6345] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 790.402042][ T6345] usb 1-1: Using ep0 maxpacket: 32 [ 790.808758][ T6345] usb 1-1: config 0 has an invalid interface number: 149 but max is 0 [ 790.817098][ T6345] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 790.902078][ T6345] usb 1-1: config 0 has no interface number 0 [ 790.932161][ T6345] usb 1-1: config 0 interface 149 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 791.218375][ T6345] usb 1-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=44.19 [ 791.262071][ T6345] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 791.365565][ T6345] usb 1-1: Product: syz [ 791.412736][T14987] gretap0: entered promiscuous mode [ 791.419165][ T6345] usb 1-1: Manufacturer: syz [ 791.420403][T14987] gretap0: left promiscuous mode [ 791.430829][ T6345] usb 1-1: SerialNumber: syz [ 791.735682][ T6345] usb 1-1: config 0 descriptor?? [ 792.798400][T14963] syz.1.1708 (14963): drop_caches: 2 [ 793.025292][ T24] usb 2-1: USB disconnect, device number 40 [ 793.288292][T15004] trusted_key: encrypted_key: key user:syz not found [ 793.904631][ T6345] peak_usb 1-1:0.149 can0: unable to request usb[type=0 value=1] err=-71 [ 793.936654][ T6345] peak_usb 1-1:0.149: unable to read PCAN-Chip USB firmware info (err -71) [ 794.800058][T15012] netlink: 'syz.5.1720': attribute type 1 has an invalid length. [ 796.547157][T15031] ptrace attach of "./syz-executor exec"[5879] was attempted by "./syz-executor exec"[15031] [ 799.207901][T15012] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 799.326964][ T6345] peak_usb 1-1:0.149: probe with driver peak_usb failed with error -71 [ 799.466118][ T6345] usb 1-1: USB disconnect, device number 35 [ 800.082934][T15050] QAT: failed to copy from user. [ 800.153467][T15067] fuse: Bad value for 'fd' [ 801.788003][T15076] loop2: detected capacity change from 0 to 7 [ 802.313391][T15083] PKCS7: Unknown OID: [5] (bad) [ 802.318378][T15083] PKCS7: Only support pkcs7_signedData type [ 804.942246][T14671] usb 4-1: new high-speed USB device number 34 using dummy_hcd [ 805.113936][T14671] usb 4-1: Using ep0 maxpacket: 16 [ 805.130135][T14671] usb 4-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 805.174881][T14671] usb 4-1: config 0 interface 0 has no altsetting 0 [ 805.181545][T14671] usb 4-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 805.210865][T14671] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 805.243258][T14671] usb 4-1: config 0 descriptor?? [ 805.280096][T14671] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 805.592118][T15124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 805.601399][T15124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 805.616006][T15124] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 805.625551][T15124] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 807.547854][T15140] wireguard0: entered promiscuous mode [ 807.557747][T15140] wireguard0: entered allmulticast mode [ 807.581858][ T6345] usb 4-1: USB disconnect, device number 34 [ 808.716638][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.726742][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 811.304137][T15178] hsr0: entered promiscuous mode [ 811.313100][T15178] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1756'. [ 811.407794][T15178] hsr_slave_0: left promiscuous mode [ 811.417668][T15178] hsr_slave_1: left promiscuous mode [ 811.448635][T15178] hsr0 (unregistering): left promiscuous mode [ 812.780731][T15198] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1754'. [ 814.773095][T15225] usb usb8: usbfs: process 15225 (syz.0.1767) did not claim interface 0 before use [ 816.252061][ T5958] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 816.413982][ T5958] usb 5-1: config 0 has no interfaces? [ 816.428510][ T5958] usb 5-1: New USB device found, idVendor=0499, idProduct=5ae2, bcdDevice= 9.0f [ 816.552143][ T5958] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=7 [ 816.560987][ T5958] usb 5-1: Product: syz [ 816.611467][ T5958] usb 5-1: Manufacturer: syz [ 816.651499][ T5958] usb 5-1: SerialNumber: syz [ 816.703352][ T5958] usb 5-1: config 0 descriptor?? [ 817.294457][T15230] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 817.323739][T15230] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 817.524164][T15230] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1768'. [ 817.606436][T15246] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1772'. [ 817.621230][T15250] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1768'. [ 817.750284][T15230] macvtap3: entered promiscuous mode [ 817.801546][T15230] batadv0: entered promiscuous mode [ 817.812557][T15230] macvtap3: entered allmulticast mode [ 817.818103][T15230] batadv0: entered allmulticast mode [ 817.832074][T15230] 8021q: adding VLAN 0 to HW filter on device macvtap3 [ 817.862700][T15250] batadv0: left allmulticast mode [ 817.867801][T15250] batadv0: left promiscuous mode [ 818.041994][ T6339] usb 5-1: USB disconnect, device number 41 [ 819.443118][T15273] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1775'. [ 819.455075][T15272] input: syz1 as /devices/virtual/input/input36 [ 819.516210][T15273] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1775'. [ 819.529956][T15272] program syz.0.1777 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 822.322109][ T5958] delete_channel: no stack [ 823.524260][T15317] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 826.418582][ T30] audit: type=1326 audit(1756836954.908:252): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15342 comm="syz.1.1791" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1da498ebe9 code=0x0 [ 827.042074][ T5959] usb 4-1: new high-speed USB device number 35 using dummy_hcd [ 827.062036][ T5958] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 827.275259][ T5958] usb 6-1: Using ep0 maxpacket: 32 [ 827.329705][ T5958] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 827.337434][ T5958] usb 6-1: can't read configurations, error -61 [ 827.410677][ T5959] usb 4-1: config index 0 descriptor too short (expected 65297, got 77) [ 827.429032][ T5959] usb 4-1: config 0 has too many interfaces: 252, using maximum allowed: 32 [ 827.448710][ T5959] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 827.501783][ T5959] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 252 [ 827.540966][ T5959] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 827.551618][ T5959] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 827.588346][ T5959] usb 4-1: Product: syz [ 827.612398][ T5959] usb 4-1: Manufacturer: syz [ 827.622256][ T5959] usb 4-1: SerialNumber: syz [ 827.654518][ T5958] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 827.680218][ T5959] usb 4-1: config 0 descriptor?? [ 827.822647][ T5958] usb 6-1: Using ep0 maxpacket: 32 [ 827.845414][ T5958] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 827.856467][ T5958] usb 6-1: can't read configurations, error -61 [ 827.935377][T15355] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1793'. [ 827.944759][ T30] audit: type=1400 audit(1756836956.508:253): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=15346 comm="syz.3.1793" [ 827.964279][T15355] netlink: 48 bytes leftover after parsing attributes in process `syz.3.1793'. [ 827.978773][ T5958] usb usb6-port1: attempt power cycle [ 828.443329][ T5958] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 828.521674][ T5958] usb 6-1: Using ep0 maxpacket: 32 [ 828.667387][T15370] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 829.634996][ T6347] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 829.944423][T15382] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 830.274045][ T5958] usb 6-1: device descriptor read/all, error -71 [ 830.412053][ T6347] usb 5-1: Using ep0 maxpacket: 16 [ 830.433826][ T6347] usb 5-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 830.456576][ T6347] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 830.484154][ T6347] usb 5-1: config 0 descriptor?? [ 830.674639][ T6347] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 830.688975][T14671] usb 4-1: USB disconnect, device number 35 [ 831.629472][ T6347] gspca_sonixj: reg_w1 err -71 [ 831.942183][ T6347] sonixj 5-1:0.0: probe with driver sonixj failed with error -71 [ 831.970646][ T6347] usb 5-1: USB disconnect, device number 42 [ 832.082139][ T5958] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 832.315386][ T5958] usb 1-1: Using ep0 maxpacket: 8 [ 832.451400][ T5958] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 832.461684][ T5958] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 832.482094][ T5958] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 832.502083][ T5958] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 832.515340][ T5958] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 832.530525][ T5958] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 833.031227][ T5958] usb 1-1: GET_CAPABILITIES returned 0 [ 833.051467][ T5958] usbtmc 1-1:16.0: can't read capabilities [ 833.192059][ T6345] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 833.472219][ T6345] usb 5-1: Using ep0 maxpacket: 16 [ 833.737691][T15418] netlink: 100 bytes leftover after parsing attributes in process `syz.5.1807'. [ 833.880293][T14671] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 834.337051][ T6347] usb 1-1: USB disconnect, device number 36 [ 835.036724][T14671] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 835.702095][ T5958] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 835.747719][T15427] fido_id[15427]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 835.816988][ T6345] usb 5-1: unable to get BOS descriptor or descriptor too short [ 835.872828][ T6345] usb 5-1: no configurations [ 835.882308][ T6345] usb 5-1: can't read configurations, error -22 [ 835.923533][ T5958] usb 1-1: config 0 has an invalid interface number: 58 but max is 0 [ 835.931731][ T5958] usb 1-1: config 0 has no interface number 0 [ 835.945252][ T5958] usb 1-1: New USB device found, idVendor=041e, idProduct=400a, bcdDevice=49.f8 [ 836.312215][ T5958] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 836.580915][ T5958] usb 1-1: config 0 descriptor?? [ 836.654587][ T5958] gspca_main: spca500-2.14.0 probing 041e:400a [ 838.679481][ T6345] usb 1-1: USB disconnect, device number 37 [ 838.743858][ T5958] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 838.933400][ T5958] usb 2-1: config 0 has no interfaces? [ 838.955970][ T5958] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 838.982944][ T5958] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 838.991008][ T5958] usb 2-1: Product: syz [ 839.086802][ T5958] usb 2-1: Manufacturer: syz [ 839.099316][ T5958] usb 2-1: SerialNumber: syz [ 839.133606][ T5958] usb 2-1: config 0 descriptor?? [ 839.745136][T15474] random: crng reseeded on system resumption [ 841.792472][ T6347] usb 2-1: USB disconnect, device number 41 [ 844.363590][T15525] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 844.529586][T15525] bond0: (slave lo): Error: Device can not be enslaved while up [ 846.186673][T15537] netlink: 'syz.4.1833': attribute type 7 has an invalid length. [ 846.195515][T15537] netlink: 'syz.4.1833': attribute type 8 has an invalid length. [ 848.414821][ T5958] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 848.709562][ T5958] usb 5-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad [ 848.724372][ T5958] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 848.754749][ T5958] usb 5-1: config 0 descriptor?? [ 848.770381][ T5958] gspca_main: spca508-2.14.0 probing 8086:0110 [ 848.964080][ T5958] gspca_spca508: reg_read err -32 [ 849.338666][ T5958] gspca_spca508: reg_read err -71 [ 849.357434][ T5958] gspca_spca508: reg_read err -71 [ 849.376955][ T5958] gspca_spca508: reg_read err -71 [ 849.394790][ T5958] gspca_spca508: reg write: error -71 [ 849.407588][ T5958] spca508 5-1:0.0: probe with driver spca508 failed with error -71 [ 849.435281][ T5958] usb 5-1: USB disconnect, device number 45 [ 853.155120][T15613] block nbd0: Attempted send on invalid socket [ 853.162084][T15613] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 2 [ 854.576371][T15628] netlink: 'syz.3.1854': attribute type 12 has an invalid length. [ 855.391652][T15635] ptrace attach of "./syz-executor exec"[5883] was attempted by "./syz-executor exec"[15635] [ 857.549860][ T6345] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 858.392468][ T6345] usb 2-1: config 0 has no interfaces? [ 858.600371][ T6345] usb 2-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 858.672065][ T6345] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 858.741752][ T6345] usb 2-1: Product: syz [ 858.753794][ T6345] usb 2-1: Manufacturer: syz [ 858.848519][ T6345] usb 2-1: SerialNumber: syz [ 858.891653][ T6345] usb 2-1: config 0 descriptor?? [ 859.219970][T15659] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 859.230369][T15659] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 859.342328][T14671] usb 4-1: new high-speed USB device number 36 using dummy_hcd [ 859.522412][ T5958] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 859.582109][T14671] usb 4-1: Using ep0 maxpacket: 16 [ 859.601834][T15677] ptrace attach of "./syz-executor exec"[5879] was attempted by "\x09   Àÿ Àÿ Ðÿ àÿ ðÿ °ÿ Àÿ ÿÿÿÿ\x22°h \x07  8  þÿÿÿÿÿÿÿ ÿÿÿÿ wlan1"[15677] [ 859.992208][ T5958] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 860.268769][ T5958] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 860.289643][ T5958] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 860.419035][ T5958] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 860.642407][ T5958] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 860.796551][T15680] delete_channel: no stack [ 860.880032][ T5958] usb 5-1: USB disconnect, device number 46 [ 862.770010][ T6339] usb 2-1: USB disconnect, device number 42 [ 862.798785][T15688] delete_channel: no stack [ 863.105646][T15704] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1871'. [ 863.227867][T14671] usb 4-1: unable to get BOS descriptor or descriptor too short [ 863.237487][T14671] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 863.319233][T15704] : entered promiscuous mode [ 863.369708][T14671] usb 4-1: can't read configurations, error -71 [ 863.596972][ T30] audit: type=1326 audit(1756836992.158:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1da498ebe9 code=0x7ffc0000 [ 863.742173][ T30] audit: type=1326 audit(1756836992.158:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1da498ebe9 code=0x7ffc0000 [ 863.920438][ T30] audit: type=1326 audit(1756836992.158:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f1da498ebe9 code=0x7ffc0000 [ 864.067982][T15717] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1873'. [ 864.399045][ T30] audit: type=1326 audit(1756836992.158:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1da498ebe9 code=0x7ffc0000 [ 864.486414][ T30] audit: type=1326 audit(1756836992.158:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1da498ebe9 code=0x7ffc0000 [ 864.667445][ T30] audit: type=1326 audit(1756836992.158:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1da498d550 code=0x7ffc0000 [ 864.710507][ T30] audit: type=1326 audit(1756836992.158:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1da498ebe9 code=0x7ffc0000 [ 864.828714][ T30] audit: type=1326 audit(1756836992.158:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1da498d550 code=0x7ffc0000 [ 864.909854][ T30] audit: type=1326 audit(1756836992.158:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1da498ebe9 code=0x7ffc0000 [ 865.016864][ T30] audit: type=1326 audit(1756836992.158:263): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15705 comm="syz.1.1872" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1da498d550 code=0x7ffc0000 [ 869.309840][T15779] netlink: 'syz.5.1885': attribute type 2 has an invalid length. [ 869.329230][T15779] : entered promiscuous mode [ 869.799274][T15781] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1886'. [ 870.180756][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.187255][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.832459][ T5958] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 871.212079][ T5958] usb 1-1: Using ep0 maxpacket: 16 [ 871.226308][ T5958] usb 1-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 871.265340][ T5958] usb 1-1: config 0 interface 0 has no altsetting 0 [ 871.292250][ T5958] usb 1-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 871.325423][ T5958] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 871.576699][ T5958] usb 1-1: config 0 descriptor?? [ 871.602537][ T5958] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 871.642048][ T5959] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 871.850660][ T5959] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 871.878748][ T5959] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 871.888129][ T5959] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 871.908710][ T5959] usb 2-1: Product: syz [ 871.941303][T15797] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 871.951460][T15797] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 871.981996][ T5959] usb 2-1: Manufacturer: syz [ 872.182222][ T5959] usb 2-1: SerialNumber: syz [ 872.404321][ T5959] usb 2-1: config 0 descriptor?? [ 874.821467][ T5958] usb 1-1: USB disconnect, device number 38 [ 875.307786][T15826] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1895'. [ 875.469679][ T5959] usb 2-1: USB disconnect, device number 43 [ 875.797949][T15832] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1896'. [ 878.107156][T15857] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1901'. [ 878.982061][ T6339] usb 4-1: new high-speed USB device number 38 using dummy_hcd [ 879.135151][ T6339] usb 4-1: Using ep0 maxpacket: 16 [ 879.263345][ T6339] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 879.452229][ T6339] usb 4-1: config 0 has no interfaces? [ 879.522063][ T6339] usb 4-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 879.828657][ T6339] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 879.859618][ T6339] usb 4-1: config 0 descriptor?? [ 880.407091][ T5958] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 880.564534][ T5958] usb 1-1: config 0 has no interfaces? [ 880.574102][ T5958] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 880.587255][ T5958] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 880.643260][ T5958] usb 1-1: Product: syz [ 880.717219][ T5958] usb 1-1: Manufacturer: syz [ 880.718530][T15896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 880.731337][T15896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 880.740870][ T5958] usb 1-1: SerialNumber: syz [ 880.827494][ T5958] usb 1-1: config 0 descriptor?? [ 881.192257][T15884] loop6: detected capacity change from 0 to 32768 [ 881.612171][T15886] support for the xor transformation has been removed. [ 882.519265][ T5959] usb 4-1: USB disconnect, device number 38 [ 882.882161][T15908] binder: 15900:15908 ioctl c0306201 200000000080 returned -14 [ 884.017721][ T5959] usb 1-1: USB disconnect, device number 39 [ 884.972065][ T5958] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 885.163943][ T5958] usb 5-1: config 0 has no interfaces? [ 885.174695][ T5958] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 885.185302][ T5958] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 885.203852][ T5958] usb 5-1: Product: syz [ 885.213633][ T5958] usb 5-1: Manufacturer: syz [ 885.231358][ T5958] usb 5-1: SerialNumber: syz [ 885.283933][ T5958] usb 5-1: config 0 descriptor?? [ 885.716272][T15929] loop6: detected capacity change from 0 to 32768 [ 885.781044][T15941] netlink: 'syz.3.1921': attribute type 1 has an invalid length. [ 885.807904][T15941] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1921'. [ 886.114081][T15929] support for the xor transformation has been removed. [ 886.822147][ T6339] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 887.029676][ T6339] usb 6-1: config 0 has no interfaces? [ 887.181669][ T6339] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 887.309571][ T6339] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 887.360355][ T6339] usb 6-1: Product: syz [ 887.404270][ T6339] usb 6-1: Manufacturer: syz [ 887.423157][ T6339] usb 6-1: SerialNumber: syz [ 887.493773][T15962] batadv_slave_0: entered promiscuous mode [ 887.567498][ T6339] usb 6-1: config 0 descriptor?? [ 888.142088][ T5958] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 888.281664][T15947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 888.301603][T15947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 888.389811][T14671] usb 5-1: USB disconnect, device number 47 [ 888.443381][ T5958] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 888.479870][ T5958] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 888.632983][ T5958] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 888.679040][ T5958] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 888.703242][T15966] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 888.714338][ T5958] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 889.152205][T14671] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 889.408359][T14671] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 889.425236][T14671] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 889.469903][T14671] usb 1-1: New USB device found, idVendor=1038, idProduct=12b6, bcdDevice= 0.00 [ 889.566142][T14671] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 889.705338][T14671] usb 1-1: config 0 descriptor?? [ 890.388757][T14671] usbhid 1-1:0.0: can't add hid device: -71 [ 890.411903][T14671] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 890.447838][ T6347] usb 6-1: USB disconnect, device number 22 [ 890.471026][T14671] usb 1-1: USB disconnect, device number 40 [ 891.471544][T15998] tipc: Failed to remove unknown binding: 66,1,1/134418688:1688166779/1688166781 [ 891.482334][T15998] tipc: Failed to remove unknown binding: 66,1,1/134418688:1688166779/1688166781 [ 891.508014][T15994] overlayfs: missing 'lowerdir' [ 891.545747][ T5958] usb 4-1: USB disconnect, device number 39 [ 894.328655][T16030] netlink: 'syz.4.1938': attribute type 12 has an invalid length. [ 895.640542][T16042] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1940'. [ 898.212081][ T6339] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 898.522161][ T6339] usb 4-1: Using ep0 maxpacket: 8 [ 898.543538][ T6339] usb 4-1: config 252 has 0 interfaces, different from the descriptor's value: 1 [ 898.555069][ T6339] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 898.662261][ T6339] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 898.908325][ T24] usb 4-1: USB disconnect, device number 40 [ 900.544640][ T30] kauditd_printk_skb: 29 callbacks suppressed [ 900.544660][ T30] audit: type=1326 audit(1756837029.088:293): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 900.917761][ T30] audit: type=1326 audit(1756837029.088:294): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 900.976871][ T30] audit: type=1326 audit(1756837029.088:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 901.038290][ T30] audit: type=1326 audit(1756837029.088:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 901.115753][ T30] audit: type=1326 audit(1756837029.088:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 901.177749][ T30] audit: type=1326 audit(1756837029.088:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 901.305160][ T30] audit: type=1326 audit(1756837029.088:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 901.516767][ T30] audit: type=1326 audit(1756837029.088:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 901.560419][T16090] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 901.586402][ T30] audit: type=1326 audit(1756837029.088:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 901.829857][ T30] audit: type=1326 audit(1756837029.088:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16104 comm="syz.0.1959" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f121038ebe9 code=0x7ffc0000 [ 902.575659][T16124] netlink: 'syz.0.1961': attribute type 12 has an invalid length. [ 902.822065][ T5958] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 903.332048][ T5958] usb 4-1: Using ep0 maxpacket: 8 [ 903.632254][ T5958] usb 4-1: config 0 has an invalid interface number: 246 but max is 0 [ 903.662204][ T5958] usb 4-1: config 0 has no interface number 0 [ 903.668674][ T5958] usb 4-1: config 0 interface 246 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 903.718107][ T5958] usb 4-1: New USB device found, idVendor=2040, idProduct=d300, bcdDevice=16.b3 [ 903.733065][ T5958] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 903.741299][ T5958] usb 4-1: Product: syz [ 903.745558][ T5958] usb 4-1: Manufacturer: syz [ 903.751506][ T5958] usb 4-1: SerialNumber: syz [ 903.812818][ T5958] usb 4-1: config 0 descriptor?? [ 904.042111][ T6339] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 904.203059][ T6339] usb 2-1: Using ep0 maxpacket: 16 [ 904.407316][ T5958] msi2500 4-1:0.246: Registered as swradio24 [ 904.419220][ T5958] msi2500 4-1:0.246: SDR API is still slightly experimental and functionality changes may follow [ 904.435146][ T6339] usb 2-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 904.480285][ T6339] usb 2-1: config 0 interface 0 has no altsetting 0 [ 904.550255][ T6339] usb 2-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 904.592341][ T6339] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 904.648572][ T6339] usb 2-1: config 0 descriptor?? [ 904.713818][ T6339] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 905.211079][T16153] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 905.221865][T16153] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 905.254006][T16153] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 905.265663][T16153] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 905.544069][T16155] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1969'. [ 905.821474][T16156] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1969'. [ 906.521892][ T5958] usb 4-1: USB disconnect, device number 41 [ 907.850644][ T6339] usb 2-1: USB disconnect, device number 44 [ 908.582200][ T6339] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 908.882048][ T6339] usb 2-1: Using ep0 maxpacket: 16 [ 910.152154][ T6347] usb 1-1: new full-speed USB device number 41 using dummy_hcd [ 910.325153][ T6347] usb 1-1: config 0 has no interfaces? [ 910.338582][ T6347] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 910.368508][ T6347] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 910.386207][ T6347] usb 1-1: config 0 descriptor?? [ 911.230247][ T5958] usb 1-1: USB disconnect, device number 41 [ 912.030072][ T6339] usb 2-1: unable to get BOS descriptor or descriptor too short [ 912.038008][ T6339] usb 2-1: no configurations [ 912.048296][ T6339] usb 2-1: can't read configurations, error -22 [ 912.122073][T14671] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 912.142186][ T5958] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 912.285296][T16207] netlink: 'syz.1.1980': attribute type 2 has an invalid length. [ 912.302679][T14671] usb 6-1: Using ep0 maxpacket: 16 [ 912.303353][ T5958] usb 5-1: Using ep0 maxpacket: 16 [ 912.318756][T14671] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 912.329093][ T5958] usb 5-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 912.344007][ T5958] usb 5-1: config 0 interface 0 has no altsetting 0 [ 912.350645][ T5958] usb 5-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 912.370071][ T5958] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 912.410547][T14671] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 912.425662][ T5958] usb 5-1: config 0 descriptor?? [ 912.429460][T14671] usb 6-1: Product: syz [ 912.438431][T14671] usb 6-1: Manufacturer: syz [ 912.445435][T14671] usb 6-1: SerialNumber: syz [ 912.445558][ T5958] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 912.472799][T14671] r8152-cfgselector 6-1: Unknown version 0x0000 [ 912.498559][T14671] r8152-cfgselector 6-1: config 0 descriptor?? [ 912.839016][T16215] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 912.849479][T16215] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 915.576851][T16235] netlink: 'syz.1.1984': attribute type 12 has an invalid length. [ 915.771841][T14671] r8152-cfgselector 6-1: USB disconnect, device number 23 [ 916.506617][ T5958] usb 5-1: USB disconnect, device number 48 [ 917.645486][T16264] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 919.867612][T16286] netlink: 'syz.3.1993': attribute type 4 has an invalid length. [ 919.894035][T16286] netlink: 'syz.3.1993': attribute type 4 has an invalid length. [ 919.934094][T16286] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 921.846764][ T6339] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 922.022056][ T6339] usb 2-1: Using ep0 maxpacket: 16 [ 924.826157][ T6339] usb 2-1: unable to get BOS descriptor or descriptor too short [ 924.843659][ T6339] usb 2-1: no configurations [ 924.848283][ T6339] usb 2-1: can't read configurations, error -22 [ 926.877431][T16360] geneve3: entered promiscuous mode [ 926.894969][T16360] geneve3: entered allmulticast mode [ 927.499765][T16371] ptrace attach of "./syz-executor exec"[5888] was attempted by "./syz-executor exec"[16371] [ 927.633211][ T6339] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 927.902658][ T6339] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 927.913181][ T6339] usb 4-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 927.923996][ T6339] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 927.936937][ T6339] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 927.947093][ T6339] usb 4-1: SerialNumber: syz [ 928.286899][T16375] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2011'. [ 930.417688][ T6339] usb 4-1: USB disconnect, device number 42 [ 931.222119][ T6339] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 931.398768][ T6339] usb 4-1: Using ep0 maxpacket: 16 [ 931.621596][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.628203][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.879366][ T5959] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 932.046531][T16411] binder: 16405:16411 ioctl c0306201 200000000080 returned -14 [ 932.110638][ T5959] usb 2-1: Using ep0 maxpacket: 8 [ 932.312630][ T5959] usb 2-1: unable to get BOS descriptor or descriptor too short [ 932.332995][ T5959] usb 2-1: config 8 has an invalid interface number: 101 but max is 0 [ 932.341218][ T5959] usb 2-1: config 8 has no interface number 0 [ 932.351271][ T5959] usb 2-1: too many endpoints for config 8 interface 101 altsetting 54: 98, using maximum allowed: 30 [ 932.366396][ T5959] usb 2-1: config 8 interface 101 altsetting 54 has 0 endpoint descriptors, different from the interface descriptor's value: 98 [ 932.414222][ T5959] usb 2-1: config 8 interface 101 has no altsetting 0 [ 932.447978][ T5959] usb 2-1: New USB device found, idVendor=0423, idProduct=000c, bcdDevice=2e.bf [ 932.457180][ T5959] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 932.467776][ T5959] usb 2-1: Product: syz [ 932.480910][ T5959] usb 2-1: Manufacturer: syz [ 932.493645][ T5959] usb 2-1: SerialNumber: syz [ 934.462074][ T24] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 934.772040][ T24] usb 5-1: Using ep0 maxpacket: 8 [ 934.788308][ T24] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 934.919517][ T24] usb 5-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 934.932256][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.949755][ T24] usb 5-1: Product: syz [ 934.958923][ T24] usb 5-1: Manufacturer: syz [ 934.967469][ T24] usb 5-1: SerialNumber: syz [ 935.150692][ T24] usb 5-1: config 0 descriptor?? [ 935.182572][ T6339] usb 4-1: unable to get BOS descriptor or descriptor too short [ 935.194608][ T6339] usb 4-1: no configurations [ 935.197022][ T24] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 935.199277][ T6339] usb 4-1: can't read configurations, error -22 [ 935.312841][ T5959] usb 2-1: selecting invalid altsetting 1 [ 935.318827][ T5959] catc 2-1:8.101: Can't set altsetting 1. [ 935.385659][ T5959] catc 2-1:8.101: probe with driver catc failed with error -5 [ 935.486574][ T5959] usb 2-1: USB disconnect, device number 49 [ 935.752458][ T5958] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 935.797033][T16446] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2026'. [ 936.079902][ T5958] usb 6-1: config 0 has no interfaces? [ 936.096824][ T5958] usb 6-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 936.722221][ T5958] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 936.752143][ T5958] usb 6-1: Product: syz [ 936.771690][ T5958] usb 6-1: Manufacturer: syz [ 936.955235][ T5958] usb 6-1: SerialNumber: syz [ 936.993660][ T5958] usb 6-1: config 0 descriptor?? [ 937.319003][T16437] loop6: detected capacity change from 0 to 32768 [ 937.432171][T16437] support for the xor transformation has been removed. [ 937.505986][T16453] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 938.325363][T16465] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 938.570146][ T5958] usb 6-1: USB disconnect, device number 24 [ 938.883252][ T24] gspca_zc3xx: reg_w_i err -71 [ 938.986506][ T24] gspca_zc3xx 5-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 939.052782][ T24] usb 5-1: USB disconnect, device number 49 [ 939.823486][T16478] (unnamed net_device) (uninitialized): option lacp_active: invalid value (40) [ 939.895516][T16478] cifs: Unknown parameter 'f,' [ 941.333118][ T6345] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 941.668094][ T6345] usb 4-1: Using ep0 maxpacket: 16 [ 943.362729][ T24] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 943.524770][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 943.537075][ T24] usb 5-1: config 0 has no interfaces? [ 943.544390][ T24] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 943.704494][ T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 943.880072][ T6345] usb 4-1: unable to get BOS descriptor or descriptor too short [ 943.897262][ T6345] usb 4-1: no configurations [ 943.901899][ T6345] usb 4-1: can't read configurations, error -22 [ 944.022340][ T24] usb 5-1: config 0 descriptor?? [ 944.106997][T16516] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2039'. [ 944.195602][T16518] netlink: 'syz.0.2050': attribute type 2 has an invalid length. [ 945.862118][ T5958] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 946.080514][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 946.080529][ T30] audit: type=1326 audit(1756837074.648:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16522 comm="syz.0.2041" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f121038ebe9 code=0x0 [ 946.112092][ T5958] usb 2-1: Using ep0 maxpacket: 16 [ 946.136735][ T5958] usb 2-1: unable to get BOS descriptor or descriptor too short [ 946.151351][ T5958] usb 2-1: no configurations [ 946.168074][ T5958] usb 2-1: can't read configurations, error -22 [ 946.912314][T16503] delete_channel: no stack [ 946.916872][ T24] usb 5-1: string descriptor 0 read error: -71 [ 946.972519][ T24] usb 5-1: USB disconnect, device number 50 [ 947.220236][T16542] block nbd0: Attempted send on invalid socket [ 947.227767][T16542] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 2 [ 948.216508][ T5959] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 948.494993][ T5959] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 948.953397][ T5959] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 949.206511][ T5959] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 949.248280][ T5959] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 949.302350][T16555] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 949.427943][ T5959] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 949.592056][ T6339] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 950.162515][ T6339] usb 4-1: Using ep0 maxpacket: 16 [ 950.960405][T16577] binder: 16576:16577 ioctl 4018620d 0 returned -22 [ 950.977291][T16577] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 951.785431][T16588] netlink: 'syz.1.2056': attribute type 12 has an invalid length. [ 952.634503][ T5959] usb 6-1: USB disconnect, device number 25 [ 953.668095][ T6339] usb 4-1: unable to get BOS descriptor or descriptor too short [ 953.918640][ T6339] usb 4-1: no configurations [ 953.935635][T16616] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2061'. [ 953.982291][ T6339] usb 4-1: can't read configurations, error -22 [ 956.222608][T16636] veth0: entered promiscuous mode [ 956.228811][T16636] vlan3: entered promiscuous mode [ 956.598347][T16651] geneve3: entered promiscuous mode [ 956.642095][T16651] geneve3: entered allmulticast mode [ 957.741107][T16663] netlink: 'syz.5.2071': attribute type 12 has an invalid length. [ 961.078640][T16697] fuse: Unknown parameter 'mGN‡8o«ad' [ 961.141137][ T6339] IPVS: starting estimator thread 0... [ 961.175172][T16700] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2078'. [ 961.316125][T16698] IPVS: using max 36 ests per chain, 86400 per kthread [ 961.460297][T16705] netlink: 168 bytes leftover after parsing attributes in process `syz.4.2079'. [ 962.062987][T16714] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 962.132822][T16715] trusted_key: encrypted_key: key user:syz not found [ 964.556802][T16732] netlink: 'syz.0.2085': attribute type 12 has an invalid length. [ 972.546976][T16824] netlink: 'syz.5.2101': attribute type 12 has an invalid length. [ 974.689859][T16845] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2107'. [ 977.183538][ T6345] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 977.359552][ T6345] usb 5-1: Using ep0 maxpacket: 16 [ 977.560880][ T5957] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 977.812768][ T5957] usb 4-1: Using ep0 maxpacket: 16 [ 977.821120][ T5957] usb 4-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 977.839340][ T5957] usb 4-1: config 0 interface 0 has no altsetting 0 [ 977.857956][ T5957] usb 4-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 977.912477][ T5957] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 977.949048][ T5957] usb 4-1: config 0 descriptor?? [ 977.964992][ T5957] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 978.284248][T16891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 978.293577][T16891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 978.327140][T16891] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 978.336935][T16891] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 978.574137][ T24] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 978.736135][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 978.753208][ T24] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 978.761332][ T24] usb 1-1: config 0 has no interface number 0 [ 978.792247][ T24] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 978.822123][ T24] usb 1-1: config 0 interface 85 has no altsetting 0 [ 978.866380][ T24] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 978.964651][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 979.123402][ T24] usb 1-1: Product: syz [ 979.166810][ T24] usb 1-1: Manufacturer: syz [ 979.185217][ T24] usb 1-1: SerialNumber: syz [ 979.225726][ T24] usb 1-1: config 0 descriptor?? [ 979.465583][ T24] appletouch 1-1:0.85: Failed to read mode from device. [ 979.569452][ T6345] usb 5-1: unable to get BOS descriptor or descriptor too short [ 979.582259][ T24] appletouch 1-1:0.85: probe with driver appletouch failed with error -5 [ 979.601302][ T6345] usb 5-1: no configurations [ 979.607890][ T6345] usb 5-1: can't read configurations, error -22 [ 979.625936][ T24] usb 1-1: USB disconnect, device number 42 [ 979.778452][T16533] usb 4-1: USB disconnect, device number 49 [ 980.250442][T16909] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2121'. [ 982.452305][T16935] pim6reg: entered allmulticast mode [ 983.782980][T16949] netlink: 'syz.4.2130': attribute type 12 has an invalid length. [ 990.114779][ T30] audit: type=1400 audit(1756837118.648:314): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=17014 comm="syz.0.2143" [ 990.808116][T17021] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2142'. [ 991.239534][ T30] audit: type=1326 audit(1756837119.778:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfed58ebe9 code=0x7ffc0000 [ 991.458719][ T30] audit: type=1326 audit(1756837119.778:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7fbfed58ebe9 code=0x7ffc0000 [ 991.680267][ T30] audit: type=1326 audit(1756837119.788:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfed58ebe9 code=0x7ffc0000 [ 991.784995][ T30] audit: type=1326 audit(1756837119.788:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fbfed58d550 code=0x7ffc0000 [ 991.908945][ T30] audit: type=1326 audit(1756837119.788:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfed58ebe9 code=0x7ffc0000 [ 992.259914][T17043] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2146'. [ 992.291913][T17043] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 992.301651][T17043] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 992.351591][ T30] audit: type=1326 audit(1756837119.788:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fbfed58ebe9 code=0x7ffc0000 [ 992.454573][T17046] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2148'. [ 992.672822][ T30] audit: type=1326 audit(1756837119.788:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfed58ebe9 code=0x7ffc0000 [ 992.802395][T17046] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2148'. [ 993.141908][ T30] audit: type=1326 audit(1756837119.798:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=133 compat=0 ip=0x7fbfed58ebe9 code=0x7ffc0000 [ 993.148814][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.176493][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.345901][T17054] hsr0: entered promiscuous mode [ 993.352146][T17053] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2149'. [ 993.372173][T17053] hsr_slave_0: left promiscuous mode [ 993.406598][ T30] audit: type=1326 audit(1756837119.798:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17018 comm="syz.3.2144" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfed58ebe9 code=0x7ffc0000 [ 993.429364][T17053] hsr_slave_1: left promiscuous mode [ 993.660293][T17053] hsr0 (unregistering): left promiscuous mode [ 996.390984][T17077] loop6: detected capacity change from 0 to 32768 [ 996.475507][T17077] support for the xor transformation has been removed. [ 997.452384][ T5959] usb 2-1: new full-speed USB device number 52 using dummy_hcd [ 997.582118][ T5959] usb 2-1: device descriptor read/64, error -71 [ 997.822199][ T5959] usb 2-1: new full-speed USB device number 53 using dummy_hcd [ 997.952202][ T5959] usb 2-1: device descriptor read/64, error -71 [ 998.073929][ T5959] usb usb2-port1: attempt power cycle [ 998.368093][T17102] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2159'. [ 998.568436][ T5959] usb 2-1: new full-speed USB device number 54 using dummy_hcd [ 998.614525][ T5959] usb 2-1: device descriptor read/8, error -71 [ 998.852090][ T5959] usb 2-1: new full-speed USB device number 55 using dummy_hcd [ 998.873865][ T5959] usb 2-1: device descriptor read/8, error -71 [ 999.008389][ T5959] usb usb2-port1: unable to enumerate USB device [ 1000.706278][T17126] input: syz0 as /devices/virtual/input/input38 [ 1003.292119][ T5957] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 1003.627892][ T5957] usb 5-1: config 0 has no interfaces? [ 1003.724919][ T5957] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1003.887585][ T5957] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1004.084623][ T24] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 1004.145584][T17161] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1004.272099][ T24] usb 4-1: Using ep0 maxpacket: 32 [ 1004.279403][ T24] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1004.291418][ T24] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1004.300851][ T24] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1004.318128][ T24] usb 4-1: Product: syz [ 1004.336482][ T24] usb 4-1: Manufacturer: syz [ 1004.351910][ T5957] usb 5-1: Product: syz [ 1004.352985][ T24] usb 4-1: SerialNumber: syz [ 1004.356196][ T5957] usb 5-1: Manufacturer: syz [ 1004.381839][ T24] usb 4-1: config 0 descriptor?? [ 1004.402611][T17160] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 1004.450971][ T5957] usb 5-1: SerialNumber: syz [ 1004.545425][T17166] tipc: Enabled bearer , priority 0 [ 1004.583046][T17166] syzkaller0: entered promiscuous mode [ 1004.600004][T17166] syzkaller0: entered allmulticast mode [ 1004.617406][ T5957] usb 5-1: config 0 descriptor?? [ 1004.800016][ T24] usb 4-1: USB disconnect, device number 50 [ 1005.017144][T17170] tipc: Resetting bearer [ 1005.058824][T17165] tipc: Resetting bearer [ 1005.483758][T17165] tipc: Disabling bearer [ 1006.150333][T17187] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2175'. [ 1006.857735][ T5959] usb 5-1: USB disconnect, device number 53 [ 1007.620783][T17193] syz.3.2176 (17193): drop_caches: 2 [ 1008.804350][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 1008.804369][ T30] audit: type=1326 audit(1756837137.328:337): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17203 comm="syz.3.2179" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbfed58ebe9 code=0x0 [ 1009.447675][ T30] audit: type=1326 audit(1756837138.018:338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17219 comm="syz.0.2181" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f121038ebe9 code=0x0 [ 1010.725681][T17241] usb usb8: usbfs: process 17241 (syz.4.2184) did not claim interface 0 before use [ 1010.736188][ T30] audit: type=1400 audit(1756837139.288:339): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=3A273A02 pid=17235 comm="syz.4.2184" [ 1011.714322][T17243] kvm: user requested TSC rate below hardware speed [ 1011.900355][T17248] netlink: 'syz.0.2186': attribute type 11 has an invalid length. [ 1012.985923][T17262] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1013.002824][T17260] netlink: 'syz.4.2188': attribute type 12 has an invalid length. [ 1013.064273][T17262] netlink: 'syz.1.2189': attribute type 2 has an invalid length. [ 1015.621539][T17287] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1016.924108][T17305] usb usb8: usbfs: process 17305 (syz.0.2198) did not claim interface 0 before use [ 1018.343569][ T30] audit: type=1326 audit(1756837146.788:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17308 comm="syz.5.2209" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f829a78ebe9 code=0x0 [ 1019.499102][ T5957] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 1019.892024][ T5957] usb 2-1: Using ep0 maxpacket: 16 [ 1020.012123][T17340] netlink: 'syz.0.2202': attribute type 12 has an invalid length. [ 1022.655286][ T5957] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1022.664781][ T5957] usb 2-1: no configurations [ 1022.669873][ T5957] usb 2-1: can't read configurations, error -22 [ 1024.361773][T17380] overlayfs: missing 'lowerdir' [ 1024.732359][T16533] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 1025.286928][T17397] netlink: 'syz.0.2214': attribute type 1 has an invalid length. [ 1025.298939][T16533] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1025.327196][T16533] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1025.336647][T17397] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2214'. [ 1025.356146][T16533] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1025.392019][T16533] usb 5-1: Product: syz [ 1025.439582][T16533] usb 5-1: Manufacturer: syz [ 1025.459876][T16533] usb 5-1: SerialNumber: syz [ 1025.532632][T16533] usb 5-1: config 0 descriptor?? [ 1026.738528][T17404] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2215'. [ 1026.755238][T17404] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2215'. [ 1027.185801][T17416] netlink: 'syz.5.2217': attribute type 12 has an invalid length. [ 1028.428105][ T5959] usb 5-1: USB disconnect, device number 54 [ 1028.982243][T16533] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1029.219280][T16533] usb 5-1: Using ep0 maxpacket: 8 [ 1029.365013][T16533] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1029.428151][T16533] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1029.487562][T16533] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40 [ 1029.502481][T16533] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1029.592154][T16533] usb 5-1: Product: syz [ 1029.601410][T16533] usb 5-1: Manufacturer: syz [ 1029.613185][T16533] usb 5-1: SerialNumber: syz [ 1029.640103][T16533] usbtest 5-1:1.0: couldn't get endpoints, -22 [ 1029.649120][T16533] usbtest 5-1:1.0: probe with driver usbtest failed with error -22 [ 1029.780711][ T24] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 1030.562082][ T24] usb 1-1: config 0 has no interfaces? [ 1030.592881][T16533] usb 5-1: USB disconnect, device number 55 [ 1030.661444][ T24] usb 1-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 1030.793122][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.812179][ T24] usb 1-1: Product: syz [ 1030.841343][ T24] usb 1-1: Manufacturer: syz [ 1030.888756][ T24] usb 1-1: SerialNumber: syz [ 1031.154608][ T24] usb 1-1: config 0 descriptor?? [ 1031.563348][T17435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1031.577324][T17435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1032.755180][ T5957] usb 1-1: USB disconnect, device number 43 [ 1033.492057][ T24] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 1033.558450][T17467] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2228'. [ 1033.845997][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 1036.228280][ T24] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1036.247785][ T24] usb 1-1: no configurations [ 1036.298614][ T24] usb 1-1: can't read configurations, error -22 [ 1036.422279][ T5959] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 1036.758134][ T5959] usb 5-1: Using ep0 maxpacket: 16 [ 1036.942421][ T5959] usb 5-1: config 0 has an invalid interface number: 48 but max is 0 [ 1036.983226][ T5959] usb 5-1: config 0 has no interface number 0 [ 1037.011915][ T5959] usb 5-1: too many endpoints for config 0 interface 48 altsetting 48: 48, using maximum allowed: 30 [ 1037.106107][ T5959] usb 5-1: config 0 interface 48 altsetting 48 has 0 endpoint descriptors, different from the interface descriptor's value: 48 [ 1037.204409][ T5959] usb 5-1: config 0 interface 48 has no altsetting 0 [ 1037.233215][ T5959] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1037.332348][ T5959] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1037.360727][ T5959] usb 5-1: Product: syz [ 1037.390365][ T5959] usb 5-1: Manufacturer: syz [ 1037.415452][ T5959] usb 5-1: SerialNumber: syz [ 1037.445012][ T5959] usb 5-1: config 0 descriptor?? [ 1038.172104][ T5958] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1038.392220][ T5958] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1038.592390][ T5958] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1038.618117][ T5958] usb 6-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1038.652233][ T5958] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1038.672062][ T5958] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1038.748618][ T5958] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1038.942936][ T5958] usb 6-1: invalid MIDI out EP 0 [ 1038.953284][ T6339] usb 4-1: new full-speed USB device number 51 using dummy_hcd [ 1039.002601][T17511] delete_channel: no stack [ 1039.164083][ T6339] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1039.213274][ T6339] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1039.272075][ T6339] usb 4-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 1039.331721][ T6339] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1039.400999][ T5958] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1039.458122][ T6339] usb 4-1: config 0 descriptor?? [ 1039.501121][ T5958] usb 6-1: USB disconnect, device number 26 [ 1040.033563][T17522] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1040.617847][ T5959] usb 5-1: USB disconnect, device number 56 [ 1040.836404][ T6168] udevd[6168]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.48/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1041.236189][ T5959] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 1041.411901][ T5959] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1041.427166][ T5959] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1041.445464][ T5959] usb 5-1: New USB device found, idVendor=10cf, idProduct=8065, bcdDevice=91.79 [ 1041.457368][ T5959] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.467590][ T5959] usb 5-1: Product: syz [ 1041.509902][ T5959] usb 5-1: Manufacturer: syz [ 1041.516699][ T5959] usb 5-1: SerialNumber: syz [ 1041.575103][ T5959] usb 5-1: config 0 descriptor?? [ 1043.170597][ T30] audit: type=1326 audit(1756837171.738:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17544 comm="syz.1.2245" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1da498ebe9 code=0x0 [ 1043.334274][T17553] sit1: entered promiscuous mode [ 1043.339347][T17553] sit1: entered allmulticast mode [ 1043.666711][ T6339] usb 4-1: string descriptor 0 read error: -71 [ 1043.697648][ T5959] usb 5-1: USB disconnect, device number 57 [ 1043.753635][ T6339] usb 4-1: USB disconnect, device number 51 [ 1044.276085][T17565] netlink: 'syz.0.2249': attribute type 15 has an invalid length. [ 1044.285128][T17565] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2249'. [ 1045.162854][T17574] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2250'. [ 1046.462470][ T5957] usb 2-1: new full-speed USB device number 58 using dummy_hcd [ 1046.636329][ T5957] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1046.646292][ T5957] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.679070][ T5957] usb 2-1: Product: syz [ 1046.692110][T14671] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1046.709521][ T5957] usb 2-1: Manufacturer: syz [ 1046.723109][ T5957] usb 2-1: SerialNumber: syz [ 1046.761663][ T5957] usb 2-1: config 0 descriptor?? [ 1046.842765][T14671] usb 6-1: Using ep0 maxpacket: 16 [ 1046.849730][T14671] usb 6-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1046.892234][T14671] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1046.914919][T14671] usb 6-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1046.968574][T14671] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1046.984055][T17593] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 1047.017444][ T5957] usb 2-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1047.068693][T14671] usb 6-1: config 0 descriptor?? [ 1047.124345][T14671] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1047.332167][T16533] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 1047.439136][T17598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1047.449811][T17598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1047.473071][T17598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1047.483280][T17598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1047.543735][T16533] usb 4-1: Using ep0 maxpacket: 16 [ 1047.559935][T16533] usb 4-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1047.598262][T16533] usb 4-1: config 0 interface 0 has no altsetting 0 [ 1047.629966][T16533] usb 4-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1047.660044][T16533] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1047.745454][T16533] usb 4-1: config 0 descriptor?? [ 1047.793476][T16533] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 1048.095429][T17600] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1048.104819][T17600] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1048.119621][T17600] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1048.129091][T17600] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1048.834506][ T5957] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -32 [ 1048.847599][ T5957] usb 2-1: USB disconnect, device number 58 [ 1048.980041][ T5959] usb 6-1: USB disconnect, device number 27 [ 1049.782189][ T5959] usb 6-1: new full-speed USB device number 28 using dummy_hcd [ 1049.850716][T14671] usb 4-1: USB disconnect, device number 52 [ 1049.948050][ T5959] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1049.966540][ T5959] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1050.008886][ T5959] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1050.030707][ T5959] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1050.302469][ T30] audit: type=1326 audit(1756837178.868:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17617 comm="syz.1.2261" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f1da498ebe9 code=0x0 [ 1050.426226][ T5959] usb 6-1: usb_control_msg returned -32 [ 1050.436097][ T5959] usbtmc 6-1:16.0: can't read capabilities [ 1052.018205][T17642] syzkaller1: entered promiscuous mode [ 1052.024083][T17642] syzkaller1: entered allmulticast mode [ 1052.291421][T14671] usb 6-1: USB disconnect, device number 28 [ 1052.609161][T17647] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1053.942963][T16533] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 1054.172282][T16533] usb 2-1: Using ep0 maxpacket: 32 [ 1054.233494][T16533] usb 2-1: config 0 has an invalid interface number: 217 but max is 0 [ 1054.282313][T16533] usb 2-1: config 0 has no interface number 0 [ 1054.355828][T16533] usb 2-1: New USB device found, idVendor=0483, idProduct=3747, bcdDevice= 0.02 [ 1054.402134][T16533] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.444051][T16533] usb 2-1: Product: syz [ 1054.448231][T16533] usb 2-1: Manufacturer: syz [ 1054.479373][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.486608][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.572426][T16533] usb 2-1: SerialNumber: syz [ 1054.620932][T16533] usb 2-1: config 0 descriptor?? [ 1054.657760][T16533] ftdi_sio 2-1:0.217: FTDI USB Serial Device converter detected [ 1054.671331][T16533] usb 2-1: Detected SIO [ 1054.677003][T16533] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1054.692168][ T5958] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 1054.942249][ T5959] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1055.002384][ T5958] usb 4-1: Using ep0 maxpacket: 16 [ 1055.016126][ T5958] usb 4-1: New USB device found, idVendor=0403, idProduct=b8d8, bcdDevice=30.bb [ 1055.392121][ T5959] usb 5-1: Using ep0 maxpacket: 16 [ 1055.417395][ T5959] usb 5-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1055.488052][ T5958] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1055.497643][ T5959] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1055.655795][ T5958] usb 4-1: Product: syz [ 1055.677253][ T5958] usb 4-1: Manufacturer: syz [ 1055.681899][ T5958] usb 4-1: SerialNumber: syz [ 1055.686826][ T5959] usb 5-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1055.722628][ T5959] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1055.785940][ T5959] usb 5-1: config 0 descriptor?? [ 1055.884961][ T5959] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 1055.934156][T17664] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1055.950232][T17664] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1056.252182][T17681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1056.261393][T17681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1056.276292][T17681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1056.304088][T17681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1057.540065][T16533] usb 5-1: USB disconnect, device number 58 [ 1057.608727][ T30] audit: type=1800 audit(1756837186.178:343): pid=17687 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2276" name="SYSV00000000" dev="hugetlbfs" ino=1 res=0 errno=0 [ 1057.879432][ T5959] usb 2-1: USB disconnect, device number 59 [ 1057.918046][ T5959] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1057.976326][ T5959] ftdi_sio 2-1:0.217: device disconnected [ 1058.858991][ T5958] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1058.933068][ T5958] snd-usb-audio 4-1:222.0: probe with driver snd-usb-audio failed with error -71 [ 1058.949559][ T5958] usb 4-1: USB disconnect, device number 53 [ 1059.025860][ T6125] udevd[6125]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:222.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1060.342703][T14671] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 1060.536177][T14671] usb 1-1: Using ep0 maxpacket: 16 [ 1060.640052][T14671] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 1060.640071][T14671] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1060.640082][T14671] usb 1-1: Product: syz [ 1060.640090][T14671] usb 1-1: Manufacturer: syz [ 1060.640097][T14671] usb 1-1: SerialNumber: syz [ 1060.641790][T14671] usb 1-1: config 0 descriptor?? [ 1060.852469][T14671] speedtch 1-1:0.0: speedtch_bind: wrong device class 68 [ 1060.852492][T14671] speedtch 1-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1061.165486][T17725] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1061.191089][T17725] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1061.247879][T17725] ip6tnl1: entered promiscuous mode [ 1061.400102][T17727] ptrace attach of "./syz-executor exec"[5888] was attempted by "./syz-executor exec"[17727] [ 1062.373951][T17738] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1063.092537][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1063.111532][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1063.143775][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1063.170287][ T5958] usb 1-1: USB disconnect, device number 46 [ 1063.598995][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1063.609362][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1063.722068][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1064.612628][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1064.623628][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1064.645414][T17741] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2285'. [ 1066.222370][ T5959] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1066.382375][ T5959] usb 6-1: Using ep0 maxpacket: 16 [ 1066.410887][ T5959] usb 6-1: New USB device found, idVendor=2137, idProduct=0001, bcdDevice=2a.35 [ 1066.421593][ T5959] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1066.471739][ T5959] usb 6-1: Product: syz [ 1066.481846][ T5959] usb 6-1: Manufacturer: syz [ 1066.550184][ T5959] usb 6-1: SerialNumber: syz [ 1066.662875][ T5959] usb 6-1: config 0 descriptor?? [ 1066.892661][ T5959] as10x_usb: device has been detected [ 1066.898554][ T5959] dvbdev: DVB: registering new adapter (Sky IT Digital Key (green led)) [ 1067.150751][ T5959] usb 6-1: DVB: registering adapter 1 frontend 0 (Sky IT Digital Key (green led))... [ 1067.741532][ T5959] as10x_usb: error during firmware upload part1 [ 1067.743084][ T5959] Registered device Sky IT Digital Key (green led) [ 1069.813931][T14671] usb 6-1: USB disconnect, device number 29 [ 1069.914374][T14671] Unregistered device Sky IT Digital Key (green led) [ 1069.931102][T14671] as10x_usb: device has been disconnected [ 1070.412479][T17813] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2298'. [ 1070.428437][T17813] openvswitch: netlink: nsh attribute has 65532 unknown bytes. [ 1070.436335][T17813] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1071.312703][T17823] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1072.496937][T17833] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2302'. [ 1072.734124][T17835] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2302'. [ 1075.642201][T16533] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 1075.826022][T16533] usb 2-1: Using ep0 maxpacket: 16 [ 1079.949262][T17901] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2314'. [ 1080.183045][T16533] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1080.211443][T16533] usb 2-1: no configurations [ 1080.281497][T16533] usb 2-1: can't read configurations, error -22 [ 1080.761105][T17918] netlink: 'syz.5.2317': attribute type 11 has an invalid length. [ 1081.356224][T16533] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 1081.622234][T16533] usb 2-1: Using ep0 maxpacket: 8 [ 1081.640989][T16533] usb 2-1: config 252 has an invalid descriptor of length 0, skipping remainder of the config [ 1081.659908][T16533] usb 2-1: config 252 has 0 interfaces, different from the descriptor's value: 1 [ 1081.892386][T16533] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1081.937648][T16533] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1082.276640][ T6345] usb 2-1: USB disconnect, device number 61 [ 1082.355604][T16533] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1082.792025][T16533] usb 6-1: Using ep0 maxpacket: 16 [ 1082.813812][T16533] usb 6-1: config 0 has an invalid interface number: 214 but max is 0 [ 1082.840228][T16533] usb 6-1: config 0 has no interface number 0 [ 1082.859383][T16533] usb 6-1: config 0 interface 214 altsetting 0 endpoint 0x83 has invalid maxpacket 1023, setting to 64 [ 1082.894222][T16533] usb 6-1: New USB device found, idVendor=0596, idProduct=0001, bcdDevice= 5.f5 [ 1082.903776][T16533] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1082.912581][T16533] usb 6-1: Product: syz [ 1082.927645][T16533] usb 6-1: Manufacturer: syz [ 1083.020381][T16533] usb 6-1: SerialNumber: syz [ 1083.122141][T16533] usb 6-1: config 0 descriptor?? [ 1083.841137][T16533] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.214/input/input39 [ 1084.247350][T16533] usb 6-1: USB disconnect, device number 30 [ 1089.795484][ T5959] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 1089.962904][ T5959] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1089.978663][ T5959] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1090.134163][ T5959] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1090.145796][ T5959] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1090.184741][ T5959] usb 1-1: Product: syz [ 1090.205145][ T5959] usb 1-1: Manufacturer: syz [ 1090.500473][ T5959] usb 1-1: SerialNumber: syz [ 1091.342346][T14671] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 1091.854022][T14671] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 1091.909897][T14671] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1091.969456][T14671] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1092.039471][T14671] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1092.091103][T14671] usb 5-1: Manufacturer: syz [ 1092.123227][T14671] usb 5-1: config 0 descriptor?? [ 1092.322087][T14671] rc_core: IR keymap rc-hauppauge not found [ 1092.329286][T14671] Registered IR keymap rc-empty [ 1092.336849][ T5959] usb 1-1: 0:2 : does not exist [ 1092.346164][T14671] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 1092.367866][ T5959] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 1092.383525][T14671] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input40 [ 1092.469496][ C0] igorplugusb 5-1:0.0: Error: urb status = -32 [ 1092.520253][T14671] usb 5-1: USB disconnect, device number 59 [ 1092.532165][ T5959] usb 1-1: USB disconnect, device number 47 [ 1092.835817][ T6125] udevd[6125]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1095.792809][ T5959] usb 1-1: new full-speed USB device number 48 using dummy_hcd [ 1096.197918][T18074] geneve2: entered promiscuous mode [ 1096.203301][T18074] geneve2: entered allmulticast mode [ 1097.964797][T18087] netlink: 'syz.1.2351': attribute type 4 has an invalid length. [ 1098.608085][T18096] netlink: 'syz.1.2351': attribute type 4 has an invalid length. [ 1098.768765][T18085] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2351'. [ 1099.419230][T18100] netlink: 'syz.1.2353': attribute type 10 has an invalid length. [ 1099.606066][ T5959] usb 1-1: unable to get BOS descriptor or descriptor too short [ 1099.615502][ T5959] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 1099.649534][ T5959] usb 1-1: can't read configurations, error -71 [ 1102.886596][T18144] netlink: 'syz.4.2361': attribute type 12 has an invalid length. [ 1103.155828][T14671] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 1103.360494][T14671] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1103.371834][T14671] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1104.024707][T14671] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1104.078796][T14671] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1104.304368][T18135] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1104.348180][T14671] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 1105.955100][T18172] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2366'. [ 1106.660200][ T6345] usb 4-1: USB disconnect, device number 54 [ 1107.042062][ T5958] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 1107.191859][T18187] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2368'. [ 1107.335778][ T5958] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 1107.346242][ T5958] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1107.796236][ T5958] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1107.812532][ T5958] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1107.820568][ T5958] usb 2-1: Manufacturer: syz [ 1108.175842][ T30] audit: type=1326 audit(1756837236.748:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18192 comm="syz.0.2371" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f121038ebe9 code=0x0 [ 1108.245519][ T5958] usb 2-1: config 0 descriptor?? [ 1108.257987][ T6339] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1108.433185][T18199] netlink: 100 bytes leftover after parsing attributes in process `syz.0.2371'. [ 1108.458827][ T6339] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1108.494029][ T6339] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1108.526260][ T6339] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1108.583203][ T6339] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1108.650232][ T6339] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1108.702079][ T5958] rc_core: IR keymap rc-hauppauge not found [ 1108.708485][ T5958] Registered IR keymap rc-empty [ 1108.725031][ T6339] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1108.769993][ T6339] usb 5-1: invalid MIDI out EP 0 [ 1108.776515][ T5958] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 1108.859483][ T5958] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input41 [ 1109.049477][T18194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1109.061886][T18194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1109.292360][T18207] rc rc0: two consecutive events of type space [ 1109.560322][ T6339] snd-usb-audio 5-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 1109.584305][ T6339] usb 5-1: USB disconnect, device number 60 [ 1111.418260][ T5959] usb 2-1: USB disconnect, device number 62 [ 1111.593590][T18236] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2377'. [ 1112.090063][ T5958] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 1112.442058][ T6345] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1112.619495][ T6345] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1112.637864][ T6345] usb 6-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=69.cf [ 1112.660138][ T6345] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1112.674051][ T5958] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1112.695015][ T5958] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1112.723545][ T6345] usb 6-1: Product: syz [ 1112.742426][ T6345] usb 6-1: Manufacturer: syz [ 1112.747832][ T5958] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1112.770205][ T6345] usb 6-1: SerialNumber: syz [ 1112.805212][ T6345] usb 6-1: config 0 descriptor?? [ 1112.811797][ T5958] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1112.865869][ T5958] usb 5-1: config 0 descriptor?? [ 1112.956208][ T5958] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1113.011452][ T5958] dvb-usb: bulk message failed: -22 (3/0) [ 1113.070733][ T5958] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1113.092572][ T5958] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1113.101917][ T5958] usb 5-1: media controller created [ 1113.111020][ T5958] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1113.147039][ T5958] dvb-usb: bulk message failed: -22 (6/0) [ 1113.161127][ T5958] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1113.181260][ T5958] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input42 [ 1113.224495][ T5958] dvb-usb: schedule remote query interval to 150 msecs. [ 1113.233900][ T5958] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1113.395375][ T5958] dvb-usb: bulk message failed: -22 (1/0) [ 1113.407115][ T5958] dvb-usb: error while querying for an remote control event. [ 1113.632183][ T5958] dvb-usb: bulk message failed: -22 (1/0) [ 1113.638351][ T5958] dvb-usb: error while querying for an remote control event. [ 1113.842189][ T5958] dvb-usb: bulk message failed: -22 (1/0) [ 1113.848099][ T5958] dvb-usb: error while querying for an remote control event. [ 1114.092156][ T5958] dvb-usb: bulk message failed: -22 (1/0) [ 1114.100040][ T5958] dvb-usb: error while querying for an remote control event. [ 1114.262116][ T5958] dvb-usb: bulk message failed: -22 (1/0) [ 1114.289346][ T5959] usb 5-1: USB disconnect, device number 61 [ 1114.295730][ T5958] dvb-usb: error while querying for an remote control event. [ 1114.561390][ T5959] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1115.012576][ T5959] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 1115.182320][ T6339] usb 6-1: USB disconnect, device number 31 [ 1115.203098][ T5959] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1115.252291][ T5959] usb 5-1: New USB device found, idVendor=057e, idProduct=200e, bcdDevice= 0.00 [ 1115.433619][ T5959] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1115.567287][ T5959] usb 5-1: config 0 descriptor?? [ 1116.421330][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.427749][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1117.298213][T14671] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 1117.570632][T14671] usb 1-1: device descriptor read/64, error -71 [ 1117.759094][T18288] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1117.812717][T18288] block device autoloading is deprecated and will be removed. [ 1117.832434][T14671] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1118.058300][T18296] netlink: 'syz.1.2390': attribute type 12 has an invalid length. [ 1118.112130][T14671] usb 1-1: device descriptor read/64, error -71 [ 1118.282618][T14671] usb usb1-port1: attempt power cycle [ 1118.662565][T14671] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 1118.737090][T14671] usb 1-1: device descriptor read/8, error -71 [ 1118.982412][T14671] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1119.314419][T14671] usb 1-1: device descriptor read/8, error -71 [ 1119.372516][ T5959] usbhid 5-1:0.0: can't add hid device: -71 [ 1119.438085][ T5959] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1119.470613][ T5959] usb 5-1: USB disconnect, device number 62 [ 1119.702053][ T6345] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 1119.747189][T14671] usb usb1-port1: unable to enumerate USB device [ 1120.368755][ T6345] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 1120.564795][ T6345] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1120.591138][ T6345] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1120.601082][ T6345] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1120.611426][ T6345] usb 4-1: Manufacturer: syz [ 1120.620451][ T6345] usb 4-1: config 0 descriptor?? [ 1120.692046][ T6345] rc_core: IR keymap rc-hauppauge not found [ 1120.698382][ T6345] Registered IR keymap rc-empty [ 1120.733789][ T6345] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 1120.773699][ T6345] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input43 [ 1120.884536][ C1] igorplugusb 4-1:0.0: Error: urb status = -32 [ 1121.162624][ T5959] usb 4-1: USB disconnect, device number 55 [ 1122.637759][T18347] EXT4-fs: Value of option "test_dummy_encryption" is unrecognized [ 1123.695481][T18353] netlink: 'syz.3.2402': attribute type 12 has an invalid length. [ 1126.497106][T18384] sit1: entered promiscuous mode [ 1126.502296][T18384] sit1: entered allmulticast mode [ 1126.816055][T18390] fuse: Unknown parameter 'fd00000000000000000000' [ 1128.893141][ T30] audit: type=1400 audit(1756837257.358:345): apparmor="DENIED" operation="change_hat" class="file" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=18415 comm="syz.1.2416" [ 1129.214994][T14671] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 1129.531832][T14671] usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1129.542507][T14671] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1129.551579][T14671] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1129.843779][T14671] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1130.036166][T14671] snd-usb-audio 1-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1130.568159][T14671] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 1130.722166][T14671] usb 6-1: Using ep0 maxpacket: 32 [ 1131.023661][T14671] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1131.031770][T14671] usb 6-1: config 0 has no interface number 0 [ 1131.075841][T14671] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1131.096052][T14671] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1131.126876][T14671] usb 6-1: Product: syz [ 1131.158644][T14671] usb 6-1: Manufacturer: syz [ 1131.183637][T14671] usb 6-1: SerialNumber: syz [ 1131.190642][T14671] usb 6-1: config 0 descriptor?? [ 1131.223263][T14671] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1131.242252][T14671] usb 6-1: selecting invalid altsetting 1 [ 1131.254261][T14671] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1131.267299][T14671] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1131.283969][T14671] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1131.297678][T14671] usb 6-1: media controller created [ 1131.336764][T14671] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1132.058647][ T6345] usb 1-1: USB disconnect, device number 54 [ 1132.472922][T14671] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1132.917913][T14671] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1133.038988][T18453] netlink: 'syz.3.2423': attribute type 10 has an invalid length. [ 1133.061799][T18453] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1133.100316][T18453] wg1: entered promiscuous mode [ 1133.106608][T18453] wg1: entered allmulticast mode [ 1133.114961][T18442] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 1133.125326][T18458] binder: 18445:18458 ioctl c0306201 0 returned -14 [ 1133.527649][T14671] usb 6-1: USB disconnect, device number 32 [ 1133.533730][ T5957] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1133.704486][ T5957] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 56, changing to 9 [ 1133.717614][ T5957] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 8703, setting to 1024 [ 1133.744055][T18464] sit1: entered promiscuous mode [ 1133.749163][T18464] sit1: entered allmulticast mode [ 1133.863294][ T5957] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1133.959002][ T5957] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1134.000140][ T5957] usb 5-1: config 0 descriptor?? [ 1135.193439][ T5957] ath6kl: Failed to submit usb control message: -110 [ 1135.200450][ T5957] ath6kl: unable to send the bmi data to the device: -110 [ 1135.213441][ T5957] ath6kl: Unable to send get target info: -110 [ 1135.253459][T14671] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 1135.269784][ T5957] ath6kl: Failed to init ath6kl core: -110 [ 1135.289988][ T5957] ath6kl_usb 5-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1135.449081][T18478] tipc: Resetting bearer [ 1135.455687][T18478] tipc: Resetting bearer [ 1135.782421][T18480] fuse: Unknown parameter '0xffffffffffffffff' [ 1135.813181][T14671] usb 6-1: Using ep0 maxpacket: 16 [ 1136.931654][T17923] usb 5-1: USB disconnect, device number 63 [ 1137.132334][ T6339] usb 2-1: new high-speed USB device number 63 using dummy_hcd [ 1137.332297][ T6339] usb 2-1: Using ep0 maxpacket: 16 [ 1137.478492][ T6339] usb 2-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1137.494061][ T6339] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1137.503295][ T6339] usb 2-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1137.525392][ T6339] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1137.569084][ T6339] usb 2-1: config 0 descriptor?? [ 1137.633967][ T6339] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1137.947794][T18492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1137.957415][T18492] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1137.987674][T18492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1137.997226][T18492] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1138.504044][T14671] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1138.525565][T14671] usb 6-1: no configurations [ 1138.530968][T14671] usb 6-1: can't read configurations, error -22 [ 1139.097909][T18506] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2433'. [ 1139.864432][T14671] usb 2-1: USB disconnect, device number 63 [ 1140.243717][T18518] netlink: 'syz.5.2435': attribute type 12 has an invalid length. [ 1141.987911][T18528] ptrace attach of "./syz-executor exec"[5882] was attempted by "./syz-executor exec"[18528] [ 1142.115093][T18529] delete_channel: no stack [ 1142.572039][T17923] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1142.910857][T17923] usb 6-1: Using ep0 maxpacket: 8 [ 1142.936467][T17923] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1142.969716][T17923] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1143.050713][T17923] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1143.084810][T17923] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1143.112225][T17923] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1143.133209][T17923] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1143.166379][T17923] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1143.415309][T17923] usb 6-1: usb_control_msg returned -32 [ 1143.421312][T17923] usbtmc 6-1:16.0: can't read capabilities [ 1144.117044][T18561] usbtmc 6-1:16.0: stb usb_control_msg returned -32 [ 1144.203939][T14671] usb 2-1: new high-speed USB device number 64 using dummy_hcd [ 1144.477976][T14671] usb 2-1: Using ep0 maxpacket: 16 [ 1145.928682][ T6339] usb 6-1: USB disconnect, device number 35 [ 1146.398967][T18584] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2447'. [ 1148.539616][T18606] netlink: 'syz.4.2450': attribute type 12 has an invalid length. [ 1149.212783][T14671] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1149.263299][T14671] usb 2-1: no configurations [ 1149.412179][T14671] usb 2-1: can't read configurations, error -22 [ 1149.755890][T18623] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2453'. [ 1149.767862][T18623] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2453'. [ 1149.934847][ T49] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1149.972338][ T49] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1150.022236][ T49] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1150.167600][ T49] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1150.532882][ T5957] psmouse serio3: Failed to reset mouse on : -5 [ 1151.392079][T14671] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 1151.565714][T14671] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 56, changing to 9 [ 1151.577477][T14671] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 8703, setting to 1024 [ 1151.682077][T14671] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 1152.045775][T14671] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1152.227746][T14671] usb 2-1: config 0 descriptor?? [ 1152.997355][T18656] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1153.432508][T14671] ath6kl: Failed to submit usb control message: -110 [ 1153.439240][T14671] ath6kl: unable to send the bmi data to the device: -110 [ 1153.448545][T14671] ath6kl: Unable to send get target info: -110 [ 1153.542489][T14671] ath6kl: Failed to init ath6kl core: -110 [ 1153.583497][T14671] ath6kl_usb 2-1:0.0: probe with driver ath6kl_usb failed with error -110 [ 1154.456371][ T6345] usb 2-1: USB disconnect, device number 66 [ 1154.612968][ T5957] misc userio: Buffer overflowed, userio client isn't keeping up [ 1155.804523][ T5957] input: PS/2 Generic Mouse as /devices/serio3/input/input44 [ 1156.152266][ T5959] usb 4-1: new full-speed USB device number 56 using dummy_hcd [ 1156.199903][ T5957] psmouse serio3: Failed to enable mouse on [ 1156.397757][T18688] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1156.415837][T18690] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1156.418997][ T5959] usb 4-1: New USB device found, idVendor=13d8, idProduct=0011, bcdDevice=d0.62 [ 1156.474529][ T5959] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1156.494312][ T5959] usb 4-1: Product: syz [ 1156.503539][ T5959] usb 4-1: Manufacturer: syz [ 1156.511093][ T5959] usb 4-1: SerialNumber: syz [ 1156.672980][ T5959] usb 4-1: config 0 descriptor?? [ 1156.713364][ T5959] comedi comedi5: This driver needs USB 2.0 to operate. Aborting... [ 1156.728258][ T5959] usbduxfast 4-1:0.0: driver 'usbduxfast' failed to auto-configure device. [ 1157.362694][ T5959] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1157.772583][ T5959] usb 1-1: Using ep0 maxpacket: 16 [ 1157.883771][ T5959] usb 1-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1157.896782][ T5959] usb 1-1: config 0 interface 0 has no altsetting 0 [ 1157.904052][ T5959] usb 1-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1158.001358][ T5959] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1158.089356][ T5959] usb 1-1: config 0 descriptor?? [ 1158.188474][ T5959] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1158.780831][T18706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1158.790735][T18706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1158.804709][T18706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1158.814478][T18706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1159.064934][T18704] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1159.262402][T14671] usb 4-1: USB disconnect, device number 56 [ 1160.689484][ T5959] usb 1-1: USB disconnect, device number 55 [ 1161.467925][T17923] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 1161.754031][T18732] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1161.884599][T17923] usb 4-1: Using ep0 maxpacket: 8 [ 1161.952709][ T30] audit: type=1800 audit(1756837290.508:346): pid=18752 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2479" name="nullb0" dev="devtmpfs" ino=3445 res=0 errno=0 [ 1162.075565][T17923] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1162.083700][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1162.238585][T17923] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1162.338290][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1162.351783][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1162.367402][T17923] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1162.375261][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1162.386738][T17923] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1162.399747][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1162.476097][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1162.808735][T17923] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 1162.816728][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 1162.840594][T17923] usb 4-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1162.900357][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1163.005773][T17923] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1163.076439][T17923] usb 4-1: string descriptor 0 read error: -22 [ 1163.089605][T17923] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 1163.109410][T17923] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1163.168138][T17923] adutux 4-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 1165.248378][T18778] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2483'. [ 1165.789439][T18782] netlink: 'syz.0.2484': attribute type 12 has an invalid length. [ 1166.138001][ T5959] usb 4-1: USB disconnect, device number 57 [ 1166.336510][ T6345] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1166.526144][ T6345] usb 5-1: Using ep0 maxpacket: 16 [ 1166.538555][ T6345] usb 5-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1166.657512][ T6345] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1166.719750][ T6345] usb 5-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1166.790583][ T6345] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1166.814941][ T6345] usb 5-1: config 0 descriptor?? [ 1166.825579][ T6345] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 1167.162469][T18803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1167.171897][T18803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1167.187505][T18803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1167.196914][T18803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1168.856041][ T5958] usb 5-1: USB disconnect, device number 64 [ 1170.081914][ T30] audit: type=1326 audit(1756837298.578:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18813 comm="syz.4.2491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa378ebe9 code=0x7ffc0000 [ 1170.104454][ C1] vkms_vblank_simulate: vblank timer overrun [ 1170.282681][T18839] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1170.455118][ T30] audit: type=1326 audit(1756837298.578:348): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18813 comm="syz.4.2491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8fa378ebe9 code=0x7ffc0000 [ 1173.022295][T18864] netlink: 'syz.1.2498': attribute type 4 has an invalid length. [ 1173.278642][T18869] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2499'. [ 1173.289047][T18869] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2499'. [ 1173.722080][ T5957] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1173.954397][ T30] audit: type=1326 audit(1756837302.528:349): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18865 comm="syz.3.2500" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbfed58ebe9 code=0x0 [ 1174.135240][ T5957] usb 5-1: Using ep0 maxpacket: 16 [ 1174.220780][ T5957] usb 5-1: config 0 interface 0 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1174.246277][ T5957] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1174.253034][ T5957] usb 5-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1174.272474][ T5957] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1174.332712][ T5957] usb 5-1: config 0 descriptor?? [ 1174.355679][ T5957] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 1174.741923][T18878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1174.753588][T18878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1174.825793][T18878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1174.841484][T18878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1177.361709][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.368519][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.189999][T18920] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2508'. [ 1178.871104][T16533] usb 5-1: USB disconnect, device number 65 [ 1179.002176][ T5957] usb 6-1: new full-speed USB device number 36 using dummy_hcd [ 1179.233450][ T5957] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1179.245694][ T5957] usb 6-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1179.724175][ T5957] usb 6-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1179.739168][ T5957] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1179.750127][ T5957] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1179.799156][ T5957] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1179.865269][ T5957] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1180.486983][T18941] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1181.255603][T18950] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 1181.379429][T14671] usb 6-1: USB disconnect, device number 36 [ 1182.235524][T18966] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2517'. [ 1182.244702][T18966] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2517'. [ 1183.194756][T18971] IPVS: length: 225 != 8 [ 1184.702824][T18979] netlink: 'syz.4.2520': attribute type 4 has an invalid length. [ 1184.738414][T18979] netlink: 'syz.4.2520': attribute type 4 has an invalid length. [ 1184.782673][T18979] openvswitch: netlink: Unexpected mask (mask=200040, allowed=10048) [ 1238.805245][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.811562][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.234954][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.241302][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1323.912302][ T31] INFO: task kworker/1:5:5958 blocked for more than 143 seconds. [ 1323.920239][ T31] Not tainted syzkaller #0 [ 1323.925402][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1323.934160][ T31] task:kworker/1:5 state:D stack:20008 pid:5958 tgid:5958 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 1323.946323][ T31] Workqueue: events rfkill_global_led_trigger_worker [ 1323.953163][ T31] Call Trace: [ 1323.956446][ T31] [ 1323.959735][ T31] __schedule+0x1798/0x4cc0 [ 1323.964651][ T31] ? __pfx___schedule+0x10/0x10 [ 1323.969545][ T31] ? schedule+0x91/0x360 [ 1323.973848][ T31] schedule+0x165/0x360 [ 1323.978015][ T31] schedule_preempt_disabled+0x13/0x30 [ 1323.983554][ T31] __mutex_lock+0x7e6/0x1350 [ 1323.988150][ T31] ? __mutex_lock+0x5bb/0x1350 [ 1323.992994][ T31] ? rfkill_global_led_trigger_worker+0x27/0xd0 [ 1323.999246][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1324.004340][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1324.010145][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1324.016255][ T31] rfkill_global_led_trigger_worker+0x27/0xd0 [ 1324.022435][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1324.028168][ T31] process_scheduled_works+0xae1/0x17b0 [ 1324.033793][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1324.039788][ T31] worker_thread+0x8a0/0xda0 [ 1324.044440][ T31] kthread+0x70e/0x8a0 [ 1324.048521][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1324.053710][ T31] ? __pfx_kthread+0x10/0x10 [ 1324.058661][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1324.063965][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1324.069177][ T31] ? __pfx_kthread+0x10/0x10 [ 1324.073816][ T31] ret_from_fork+0x3fc/0x770 [ 1324.078416][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1324.083592][ T31] ? __switch_to_asm+0x39/0x70 [ 1324.088361][ T31] ? __switch_to_asm+0x33/0x70 [ 1324.093178][ T31] ? __pfx_kthread+0x10/0x10 [ 1324.097797][ T31] ret_from_fork_asm+0x1a/0x30 [ 1324.102764][ T31] [ 1324.105790][ T31] INFO: task kworker/1:7:6345 blocked for more than 143 seconds. [ 1324.113785][ T31] Not tainted syzkaller #0 [ 1324.118813][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1324.127550][ T31] task:kworker/1:7 state:D stack:20424 pid:6345 tgid:6345 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 1324.139685][ T31] Workqueue: events rfkill_sync_work [ 1324.145106][ T31] Call Trace: [ 1324.148397][ T31] [ 1324.151338][ T31] __schedule+0x1798/0x4cc0 [ 1324.155969][ T31] ? __pfx___schedule+0x10/0x10 [ 1324.160836][ T31] ? schedule+0x91/0x360 [ 1324.165141][ T31] schedule+0x165/0x360 [ 1324.169504][ T31] schedule_preempt_disabled+0x13/0x30 [ 1324.175041][ T31] __mutex_lock+0x7e6/0x1350 [ 1324.179661][ T31] ? __mutex_lock+0x5bb/0x1350 [ 1324.184607][ T31] ? nfc_rfkill_set_block+0x50/0x2e0 [ 1324.189918][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1324.195034][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1324.200264][ T31] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1324.206221][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1324.212621][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 1324.218349][ T31] nfc_rfkill_set_block+0x50/0x2e0 [ 1324.223504][ T31] ? __pfx_nfc_rfkill_set_block+0x10/0x10 [ 1324.229253][ T31] rfkill_set_block+0x1cf/0x440 [ 1324.234243][ T31] rfkill_sync_work+0x114/0x200 [ 1324.239121][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 1324.244906][ T31] process_scheduled_works+0xae1/0x17b0 [ 1324.250486][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1324.256605][ T31] worker_thread+0x8a0/0xda0 [ 1324.261215][ T31] kthread+0x70e/0x8a0 [ 1324.265344][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1324.270474][ T31] ? __pfx_kthread+0x10/0x10 [ 1324.275144][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1324.280371][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1324.285636][ T31] ? __pfx_kthread+0x10/0x10 [ 1324.290232][ T31] ret_from_fork+0x3fc/0x770 [ 1324.294855][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1324.299981][ T31] ? __switch_to_asm+0x39/0x70 [ 1324.304806][ T31] ? __switch_to_asm+0x33/0x70 [ 1324.309590][ T31] ? __pfx_kthread+0x10/0x10 [ 1324.314594][ T31] ret_from_fork_asm+0x1a/0x30 [ 1324.319461][ T31] [ 1324.322677][ T31] INFO: task syz.3.2503:18892 blocked for more than 143 seconds. [ 1324.330478][ T31] Not tainted syzkaller #0 [ 1324.335451][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1324.344144][ T31] task:syz.3.2503 state:D stack:25480 pid:18892 tgid:18881 ppid:5879 task_flags:0x400040 flags:0x00004004 [ 1324.356108][ T31] Call Trace: [ 1324.359398][ T31] [ 1324.362514][ T31] __schedule+0x1798/0x4cc0 [ 1324.367042][ T31] ? __pfx___schedule+0x10/0x10 [ 1324.371890][ T31] ? schedule+0x91/0x360 [ 1324.376213][ T31] schedule+0x165/0x360 [ 1324.380434][ T31] schedule_timeout+0x9a/0x270 [ 1324.385250][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1324.390675][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1324.396248][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1324.401471][ T31] ? wait_for_completion+0x267/0x5d0 [ 1324.406840][ T31] wait_for_completion+0x2bf/0x5d0 [ 1324.413639][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1324.419410][ T31] ? __flush_work+0xd2/0xbc0 [ 1324.424110][ T31] ? __flush_work+0xd2/0xbc0 [ 1324.428717][ T31] __flush_work+0x9b9/0xbc0 [ 1324.433341][ T31] ? __flush_work+0xd2/0xbc0 [ 1324.437936][ T31] ? __pfx___flush_work+0x10/0x10 [ 1324.443171][ T31] ? __pfx_wq_barrier_func+0x10/0x10 [ 1324.448483][ T31] ? __pfx___cancel_work+0x10/0x10 [ 1324.454005][ T31] ? nfc_genl_device_removed+0x23c/0x330 [ 1324.459676][ T31] __cancel_work_sync+0xbe/0x110 [ 1324.464779][ T31] rfkill_unregister+0x92/0x220 [ 1324.469653][ T31] nfc_unregister_device+0x96/0x2a0 [ 1324.479021][ T31] ? __pfx_virtual_ncidev_close+0x10/0x10 [ 1324.485020][ T31] virtual_ncidev_close+0x56/0x90 [ 1324.490056][ T31] __fput+0x44c/0xa70 [ 1324.494235][ T31] task_work_run+0x1d4/0x260 [ 1324.499043][ T31] ? __pfx_task_work_run+0x10/0x10 [ 1324.504352][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 1324.509830][ T31] exit_to_user_mode_loop+0xec/0x110 [ 1324.515244][ T31] do_syscall_64+0x2bd/0x3b0 [ 1324.519862][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1324.525521][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1324.531612][ T31] ? clear_bhb_loop+0x60/0xb0 [ 1324.536802][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1324.543308][ T31] RIP: 0033:0x7fbfed58ebe9 [ 1324.547737][ T31] RSP: 002b:00007fbfeaff2038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 1324.556451][ T31] RAX: 0000000000000000 RBX: 00007fbfed7c6360 RCX: 00007fbfed58ebe9 [ 1324.564615][ T31] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000006 [ 1324.572787][ T31] RBP: 00007fbfed611e19 R08: 0000000000000000 R09: 0000000000000000 [ 1324.580784][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1324.588862][ T31] R13: 00007fbfed7c63f8 R14: 00007fbfed7c6360 R15: 00007fbfed8efa28 [ 1324.596986][ T31] [ 1324.600031][ T31] INFO: task syz.1.2512:18940 blocked for more than 144 seconds. [ 1324.607981][ T31] Not tainted syzkaller #0 [ 1324.613139][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1324.621814][ T31] task:syz.1.2512 state:D stack:22760 pid:18940 tgid:18937 ppid:5883 task_flags:0x400040 flags:0x00004004 [ 1324.634062][ T31] Call Trace: [ 1324.637349][ T31] [ 1324.640275][ T31] __schedule+0x1798/0x4cc0 [ 1324.644991][ T31] ? __pfx___schedule+0x10/0x10 [ 1324.649862][ T31] ? schedule+0x91/0x360 [ 1324.654256][ T31] schedule+0x165/0x360 [ 1324.658429][ T31] schedule_preempt_disabled+0x13/0x30 [ 1324.664005][ T31] __mutex_lock+0x7e6/0x1350 [ 1324.668612][ T31] ? __mutex_lock+0x5bb/0x1350 [ 1324.673472][ T31] ? rfkill_fop_open+0x12d/0x820 [ 1324.678416][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1324.683553][ T31] ? __raw_spin_lock_init+0x45/0x100 [ 1324.688870][ T31] ? __init_waitqueue_head+0xa9/0x150 [ 1324.694372][ T31] rfkill_fop_open+0x12d/0x820 [ 1324.699178][ T31] ? __pfx_rfkill_fop_open+0x10/0x10 [ 1324.704559][ T31] misc_open+0x2bc/0x330 [ 1324.708841][ T31] chrdev_open+0x4c9/0x5e0 [ 1324.713363][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1324.718321][ T31] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1324.724772][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1324.729718][ T31] do_dentry_open+0x950/0x13f0 [ 1324.734764][ T31] vfs_open+0x3b/0x340 [ 1324.738855][ T31] ? path_openat+0x2ecd/0x3830 [ 1324.743901][ T31] path_openat+0x2ee5/0x3830 [ 1324.748511][ T31] ? rcu_is_watching+0x15/0xb0 [ 1324.753777][ T31] ? __pfx_path_openat+0x10/0x10 [ 1324.758765][ T31] ? __pfx___schedule+0x10/0x10 [ 1324.763772][ T31] ? irqentry_exit+0x74/0x90 [ 1324.768386][ T31] do_filp_open+0x1fa/0x410 [ 1324.773020][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 1324.778058][ T31] ? preempt_schedule_common+0x83/0xd0 [ 1324.783648][ T31] ? _raw_spin_unlock+0x3f/0x50 [ 1324.788516][ T31] ? alloc_fd+0x64c/0x6c0 [ 1324.792960][ T31] do_sys_openat2+0x121/0x1c0 [ 1324.797678][ T31] ? __se_sys_futex+0x36f/0x400 [ 1324.802720][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1324.807956][ T31] ? rcu_is_watching+0x15/0xb0 [ 1324.812886][ T31] __x64_sys_openat+0x138/0x170 [ 1324.817765][ T31] do_syscall_64+0xfa/0x3b0 [ 1324.822395][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1324.828474][ T31] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 1324.834293][ T31] ? clear_bhb_loop+0x60/0xb0 [ 1324.839074][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1324.845201][ T31] RIP: 0033:0x7f1da498ebe9 [ 1324.849629][ T31] RSP: 002b:00007f1da5813038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1324.858431][ T31] RAX: ffffffffffffffda RBX: 00007f1da4bc6180 RCX: 00007f1da498ebe9 [ 1324.866792][ T31] RDX: 0000000000000801 RSI: 0000200000000040 RDI: ffffffffffffff9c [ 1324.874947][ T31] RBP: 00007f1da4a11e19 R08: 0000000000000000 R09: 0000000000000000 [ 1324.883049][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1324.891024][ T31] R13: 00007f1da4bc6218 R14: 00007f1da4bc6180 R15: 00007f1da4cefa28 [ 1324.899131][ T31] [ 1324.902281][ T31] [ 1324.902281][ T31] Showing all locks held in the system: [ 1324.910030][ T31] 1 lock held by khungtaskd/31: [ 1324.914970][ T31] #0: ffffffff8e139f20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1324.925052][ T31] 1 lock held by kworker/u8:5/1886: [ 1324.930261][ T31] #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 1324.940374][ T31] 5 locks held by kworker/u8:6/3074: [ 1324.945748][ T31] #0: ffff8880b8639f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 1324.955812][ T31] #1: ffff8880b8624008 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 1324.964996][ T31] #2: ffff8880b8624008 (psi_seq){-.-.}-{0:0}, at: psi_task_change+0xd9/0x340 [ 1324.974076][ T31] #3: ffffffff99cad430 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0xbb/0x420 [ 1324.984419][ T31] #4: ffffffff8dfe63e8 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 [ 1324.995060][ T31] 2 locks held by getty/5630: [ 1324.999732][ T31] #0: ffff88802fb8f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1325.009520][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 1325.019719][ T31] 1 lock held by syz-executor/5879: [ 1325.024958][ T31] #0: ffffffff8f8128a8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 1325.035171][ T31] 3 locks held by kworker/1:5/5958: [ 1325.040364][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1325.051477][ T31] #1: ffffc900052b7bc0 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1325.065131][ T31] #2: ffffffff8f8128a8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0 [ 1325.076811][ T31] 4 locks held by kworker/1:7/6345: [ 1325.082111][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1325.093159][ T31] #1: ffffc9000c1b7bc0 ((work_completion)(&rfkill->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1325.105950][ T31] #2: ffffffff8f8128a8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_sync_work+0x2e/0x200 [ 1325.116195][ T31] #3: ffff888031c8e100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0 [ 1325.126044][ T31] 1 lock held by syz.1.1603/14477: [ 1325.131156][ T31] #0: ffffffff8f8128a8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_unregister+0xc8/0x220 [ 1325.141363][ T31] 1 lock held by syz.3.2503/18892: [ 1325.146540][ T31] #0: ffff888031c8e100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0 [ 1325.156349][ T31] 2 locks held by syz.1.2512/18940: [ 1325.161547][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.170054][ T31] #1: ffffffff8f8128a8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_open+0x12d/0x820 [ 1325.180123][ T31] 1 lock held by syz.5.2515/18959: [ 1325.185563][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.194093][ T31] 1 lock held by syz.4.2522/18990: [ 1325.199208][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.207762][ T31] 1 lock held by syz.0.2523/18992: [ 1325.212924][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.221414][ T31] 1 lock held by syz-executor/18994: [ 1325.226854][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.235393][ T31] 1 lock held by syz-executor/18996: [ 1325.240691][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.249232][ T31] 1 lock held by syz-executor/18998: [ 1325.254557][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.263210][ T31] 1 lock held by syz-executor/19000: [ 1325.268559][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.277198][ T31] 1 lock held by syz-executor/19001: [ 1325.282652][ T31] #0: ffffffff8e9c1b48 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 [ 1325.291101][ T31] [ 1325.293743][ T31] ============================================= [ 1325.293743][ T31] [ 1325.302267][ T31] NMI backtrace for cpu 1 [ 1325.302293][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1325.302312][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1325.302329][ T31] Call Trace: [ 1325.302335][ T31] [ 1325.302340][ T31] dump_stack_lvl+0x189/0x250 [ 1325.302357][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1325.302369][ T31] ? __pfx__printk+0x10/0x10 [ 1325.302388][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1325.302402][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1325.302415][ T31] ? __pfx__printk+0x10/0x10 [ 1325.302431][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1325.302450][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1325.302463][ T31] watchdog+0xf93/0xfe0 [ 1325.302479][ T31] ? watchdog+0x1de/0xfe0 [ 1325.302495][ T31] kthread+0x70e/0x8a0 [ 1325.302509][ T31] ? __pfx_watchdog+0x10/0x10 [ 1325.302521][ T31] ? __pfx_kthread+0x10/0x10 [ 1325.302533][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1325.302546][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1325.302559][ T31] ? __pfx_kthread+0x10/0x10 [ 1325.302571][ T31] ret_from_fork+0x3fc/0x770 [ 1325.302582][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1325.302594][ T31] ? __switch_to_asm+0x39/0x70 [ 1325.302606][ T31] ? __switch_to_asm+0x33/0x70 [ 1325.302617][ T31] ? __pfx_kthread+0x10/0x10 [ 1325.302629][ T31] ret_from_fork_asm+0x1a/0x30 [ 1325.302648][ T31] [ 1325.302652][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1325.448517][ C0] NMI backtrace for cpu 0 [ 1325.448534][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 1325.448551][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1325.448561][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1325.448586][ C0] Code: 53 e7 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 73 67 0e 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1325.448600][ C0] RSP: 0018:ffffffff8de07d80 EFLAGS: 000002c2 [ 1325.448614][ C0] RAX: 9236ece9d3400300 RBX: ffffffff819683c8 RCX: 9236ece9d3400300 [ 1325.448626][ C0] RDX: 0000000000000001 RSI: ffffffff8d9b8241 RDI: ffffffff8be33880 [ 1325.448636][ C0] RBP: ffffffff8de07eb8 R08: ffff8880b8632f9b R09: 1ffff110170c65f3 [ 1325.448647][ C0] R10: dffffc0000000000 R11: ffffed10170c65f4 R12: ffffffff8fa39030 [ 1325.448658][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1bd2a20 [ 1325.448668][ C0] FS: 0000000000000000(0000) GS:ffff888125c18000(0000) knlGS:0000000000000000 [ 1325.448681][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1325.448691][ C0] CR2: 0000555db2fb2168 CR3: 000000000df36000 CR4: 00000000003526f0 [ 1325.448705][ C0] Call Trace: [ 1325.448712][ C0] [ 1325.448717][ C0] default_idle+0x13/0x20 [ 1325.448732][ C0] default_idle_call+0x74/0xb0 [ 1325.448747][ C0] do_idle+0x1e8/0x510 [ 1325.448765][ C0] ? __pfx_do_idle+0x10/0x10 [ 1325.448786][ C0] cpu_startup_entry+0x44/0x60 [ 1325.448800][ C0] rest_init+0x2de/0x300 [ 1325.448816][ C0] start_kernel+0x3a9/0x410 [ 1325.448836][ C0] x86_64_start_reservations+0x24/0x30 [ 1325.448851][ C0] x86_64_start_kernel+0x143/0x1c0 [ 1325.448865][ C0] common_startup_64+0x13e/0x147 [ 1325.448891][ C0] [ 1325.449556][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1325.630723][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1325.639817][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 1325.649949][ T31] Call Trace: [ 1325.653215][ T31] [ 1325.656132][ T31] dump_stack_lvl+0x99/0x250 [ 1325.660713][ T31] ? __asan_memcpy+0x40/0x70 [ 1325.665294][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1325.670478][ T31] ? __pfx__printk+0x10/0x10 [ 1325.675065][ T31] vpanic+0x281/0x750 [ 1325.679033][ T31] ? __pfx_vpanic+0x10/0x10 [ 1325.683518][ T31] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 1325.689053][ T31] ? preempt_schedule+0xae/0xc0 [ 1325.693890][ T31] ? preempt_schedule_common+0x83/0xd0 [ 1325.699338][ T31] panic+0xb9/0xc0 [ 1325.703052][ T31] ? __pfx_panic+0x10/0x10 [ 1325.707804][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1325.713185][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1325.719343][ T31] watchdog+0xfd2/0xfe0 [ 1325.723495][ T31] ? watchdog+0x1de/0xfe0 [ 1325.727905][ T31] kthread+0x70e/0x8a0 [ 1325.731965][ T31] ? __pfx_watchdog+0x10/0x10 [ 1325.736726][ T31] ? __pfx_kthread+0x10/0x10 [ 1325.741312][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1325.746541][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1325.751744][ T31] ? __pfx_kthread+0x10/0x10 [ 1325.756333][ T31] ret_from_fork+0x3fc/0x770 [ 1325.760912][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1325.766096][ T31] ? __switch_to_asm+0x39/0x70 [ 1325.770856][ T31] ? __switch_to_asm+0x33/0x70 [ 1325.775609][ T31] ? __pfx_kthread+0x10/0x10 [ 1325.780211][ T31] ret_from_fork_asm+0x1a/0x30 [ 1325.784985][ T31] [ 1325.788290][ T31] Kernel Offset: disabled [ 1325.792626][ T31] Rebooting in 86400 seconds..