last executing test programs: 6m50.883887626s ago: executing program 2 (id=169): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000007, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000000000000000000100fffc0900010073797a300000000040000000030a01010000000000000000010000000900030073797a300000000014000480080002400000000008000140000000000900010073797a30000000004c000000060a010400000000000000000100000024000480200001800700010072740000140002800800014000000014080002400000000208000b40000000000900010073797a3000000000140000001100010000000000000000000000000a6ca07f87c819f52d0a9d30c348763cb61f81d9b501e82a63290ed54e"], 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r4, 0xc0106407, &(0x7f00000000c0)={0x1, 0x0, 0xf, 0xa}) bind$alg(r1, &(0x7f0000000780)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a", 0x27}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e72119", 0x9d}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000680)=""/195, 0x4e}, {&(0x7f0000000900)=""/141}], 0x1}, 0x12041) recvmsg$can_bcm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000580)=""/191, 0xbf}], 0x1}, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r7 = dup3(r6, r0, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r9 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) quotactl_fd$Q_SETQUOTA(r3, 0xffffffff80000801, 0x0, &(0x7f0000003080)={0x1, 0x3, 0xe04, 0x5, 0x100000001, 0x7, 0x8, 0x355f, 0x100}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000240)={0x38, 0x0, &(0x7f0000000480)=[@acquire_done={0x40106309, 0x1}, @clear_death={0x400c630f, 0x6}, @acquire_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000004a40)={0x50, 0x0, &(0x7f0000000a40)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @free_buffer={0x40086303, r9}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000600)="878b7cdfd4455cf49da7ba6f280ae012ce80389a2aefe4fd04084554d7015aba5330d1b817d6c08af29938b8a9bc2b83462ddadaad3a3a5c0181a0203e49b12c99ac8757fc317fe672938a06f89c133d"}) 6m50.716640072s ago: executing program 2 (id=170): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x0, 0x3}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x1, 0x3, 0x3}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x3, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(r2, &(0x7f0000001c40)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x40, 0x3}}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x844}, 0x400a0) r3 = socket$kcm(0x10, 0x5, 0x0) sendmsg$inet(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000035c0)="5c00000013006bcd9e3fe3dc4e48aa31086b8703340000001f00000000000000090014000d000a00140000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x240000c0) 6m50.694723563s ago: executing program 2 (id=171): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x80e1}, [@IFLA_GROUP={0x8}, @IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_RATE={0x10, 0x6, {0x9, 0x51}}]}]}]}, 0x40}}, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x9f9ec54af98ce9ae}, 0x40800) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x1f, 0x2, 0x2}, 0x51) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) prlimit64(0x0, 0x6, &(0x7f0000000140)={0x7, 0x4}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) ioctl$OCFS2_IOC_RESVSP(r2, 0x40305828, &(0x7f00000001c0)={0x2, 0x2, 0x8, 0x7fffffffffffffff, 0x1, 0xe975}) r3 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0208000004000000010000000900eccb000000", @ANYRES32, @ANYBLOB='\x00\x00'], 0x48) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) 6m50.46819303s ago: executing program 2 (id=172): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000001400)={@local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}, 0x0) syz_emit_ethernet(0x3a, &(0x7f0000000540)={@broadcast, @random="e43f6642531e", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0xe000, 0x4, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e23, 0x18, 0x0, @opaque="e33a5bea2c4f383140a346b56122885e"}}}}}, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) pipe2(0x0, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000100)='./file0\x00') r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB, @ANYBLOB, @ANYRESDEC=0x0, @ANYBLOB=',group_i', @ANYRESDEC=0x0], 0x3e, 0x0, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(0xffffffffffffffff, 0x942e, 0x0) r6 = syz_open_dev$usbmon(&(0x7f0000000000), 0x0, 0x80) close(r6) 6m49.500582605s ago: executing program 2 (id=179): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_emit_ethernet(0x76, &(0x7f0000000140)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x40, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @mcast2, {[], @time_exceed={0x3, 0x0, 0x0, 0x0, '\x00', {0x9, 0x6, 'EAC', 0x8000, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private2, [@hopopts={0x89}], "98efd03a7e60b623"}}}}}}}, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x84, 0x0, &(0x7f0000000200)) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xc) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) 6m49.236513793s ago: executing program 2 (id=181): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) unshare(0x30010800) socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000010000104fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="431f07000b02000008000a00", @ANYRES32=r3, @ANYBLOB="08000500", @ANYRES32=r3, @ANYBLOB="1c0012800b0001006970766c616e"], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x40050) syz_emit_ethernet(0x68, &(0x7f0000000280)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "75e700", 0x32, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x1e}, @mcast2, {[], @time_exceed={0x3, 0x1, 0x0, 0xb, '\x00', {0x9, 0x6, "155569", 0x7, 0x6c, 0xff, @private0={0xfc, 0x0, '\x00', 0x1}, @private0, [], 'yn'}}}}}}}, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000bd3e66208205ce7438ba0102030109022400020902b0000904dd0100ff9348090904dd4001621866ff09050a", @ANYRES64=r4], 0x0) 6m49.059908549s ago: executing program 32 (id=181): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) unshare(0x30010800) socket(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="4c00000010000104fcfffffffbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="431f07000b02000008000a00", @ANYRES32=r3, @ANYBLOB="08000500", @ANYRES32=r3, @ANYBLOB="1c0012800b0001006970766c616e"], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x40050) syz_emit_ethernet(0x68, &(0x7f0000000280)={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x28}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "75e700", 0x32, 0x3a, 0xff, @dev={0xfe, 0x80, '\x00', 0x1e}, @mcast2, {[], @time_exceed={0x3, 0x1, 0x0, 0xb, '\x00', {0x9, 0x6, "155569", 0x7, 0x6c, 0xff, @private0={0xfc, 0x0, '\x00', 0x1}, @private0, [], 'yn'}}}}}}}, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r4 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000bd3e66208205ce7438ba0102030109022400020902b0000904dd0100ff9348090904dd4001621866ff09050a", @ANYRES64=r4], 0x0) 6m32.945098325s ago: executing program 5 (id=233): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x6f, 0x0, 0x9, 0x0, 0xe999, 0xfa11, 0xffffffff}, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000500), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) r5 = openat$sndtimer(0xffffffffffffff9c, 0x0, 0x101040) openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r3) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GET_LEASE(r6, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f0000000040)={&(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r8, 0xcccccccc}) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) move_pages(0x0, 0x1, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_ATOMIC(r6, 0xc03864bc, &(0x7f0000000380)={0x0, 0x1, &(0x7f0000000440)=[r8], &(0x7f0000000200), &(0x7f00000000c0)=[r9], &(0x7f0000000040), 0x0, 0x300}) 6m31.576501276s ago: executing program 5 (id=240): syz_usb_connect$uac3(0x5, 0x85, &(0x7f0000000800)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x20, 0x2b53, 0x31, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x73, 0x3, 0x1, 0x5, 0x40, 0x7, {0x8, 0xb, 0x2, 0x0, 0x1, 0x26, 0x30, 0x2}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x1, 0xf, 0x60e}, [@selector_unit={0x5, 0x24, 0xc, 0x8}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0xc, 0x0, 0x2, {0xa, 0x25, 0x25, 0xff, 0xfc, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x81, 0x2, 0x2, {0xa, 0x25, 0x25, 0x1, 0x2, 0x3}}}}}}}}]}}, 0x0) (async) r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x100000000000000, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x4011, 0x0, 0x90, [0x200000000200, 0x0, 0x0, 0x0, 0x200000000230], 0x2, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0000000000000000000000000000b0aa43c78f912580000000000000000000000000000000000000fefffffffc0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffff900000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000"]}, 0x108) (async) r1 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0xa0801, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) openat$vimc2(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async, rerun: 32) unshare(0x26020480) (rerun: 32) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, &(0x7f0000000240)={0x1f}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) r2 = socket(0x2, 0x3, 0xff) (async, rerun: 64) syz_usb_connect$uac2(0x5, 0x103, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x2a39, 0x3fd4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xf1, 0x3, 0x1, 0xb, 0x0, 0x5, {0x8, 0xb, 0x2, 0x0, 0x1, 0x7}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x935, 0x9, 0x4a, 0x1}, [@extension_unit={0xd, 0x24, 0x9, 0x3, 0x8, 0x40, "e812d18aeafd"}, @extension_unit={0xb, 0x24, 0x9, 0x6, 0x9, 0x3, "82facf49"}, @selector_unit={0xb, 0x24, 0xb, 0x4, 0x6, "ce6f81726171"}, @sample_rate={0x13, 0x24, 0xd, 0x5, 0x0, 0x3, [0x3, 0x1, 0x2, 0x3, 0x0, 0x2]}, @feature_unit={0xb, 0x24, 0x6, 0x2, 0x3, [0x0, 0x8, 0x6]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x4, 0x5, 0x8d, 0x5, 0x9}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0xc, 0x0, 0x14, 0x2}]}, {{0x9, 0x5, 0x1, 0x9, 0x3df, 0xbd, 0x6, 0xc8, {0x8, 0x25, 0x1, 0x1, 0x27, 0xf, 0x7838}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_descriptor={0x6, 0x24, 0x2, 0x1, 0x1, 0x9}, @as_header={0x10, 0x24, 0x1, 0x6a, 0xc, 0x3, 0x5, 0x88, 0x0, 0x2}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xee, 0x2a, 0x8, 0x81}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0xf1, 0x5, 0x6, 0x6}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x4, 0x6, 0xfb, "13cc02"}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x80, 0xf, 0xc3, {0x8, 0x25, 0x1, 0x80, 0x33, 0x1, 0xa407}}}}}}}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x200, 0x25, 0x72, 0x44, 0xff, 0x8}, 0x11, &(0x7f00000002c0)=ANY=[@ANYBLOB="7de200fb688ed5050f11000128100a81e000000000f00000"], 0x2, [{0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x2809}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x380a}}]}) (rerun: 64) sendfile(r2, r1, 0x0, 0xffba83) 6m31.113280414s ago: executing program 5 (id=241): r0 = syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905e2379c"], 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0x2000, 0x0, &(0x7f0000840000/0x2000)=nil) syz_usb_control_io$uac1(r0, 0x0, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000280), 0x22802, 0x0) write$char_usb(r1, &(0x7f0000006800)="10", 0x1) 6m28.84722435s ago: executing program 5 (id=253): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x4e, &(0x7f0000000040)={@local, @link_local={0x17, 0x80, 0xc2, 0x6, 0x5}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x18, 0x2c, 0x0, @remote, @local, {[@routing={0x8, 0x2, 0x2, 0x9, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}]}}}}}, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x2000000}]}, 0x2c}}, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000200)={@local, @link_local={0x17, 0x80, 0xc2, 0x6, 0x5, 0xe}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x28, 0x2c, 0x0, @remote, @local, {[@routing={0x1, 0x4, 0x2, 0x1, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @private0]}]}}}}}, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000000101010800000000000000000200000a2400028014000180080001"], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x4) ioctl$BTRFS_IOC_SYNC(r0, 0x9408, 0x0) r4 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) ioctl$CEC_G_MODE(r4, 0x80046108, &(0x7f0000000040)) 6m28.556734953s ago: executing program 5 (id=255): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f0000000040)={0xa, 0x4e20, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000029000000040000000200000000000000280000000000000029000000050000002c02020100000000fe8000000000000000000000000000bb18"], 0x58}, 0x0) r1 = memfd_create(&(0x7f0000000000)='-&:z2\xe2\xa9\xd7P\x85,%\xa7&+\r\x83-\xae]{\x1bb\xf6\xd3d', 0x2) r2 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\x04\x00\x00\x00\x00\x00\x00\x00\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\xdf$2dUU\x18\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\xb2W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\x14\x16\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11\xb2', 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2000000, 0x13, r2, 0x310f000) io_setup(0x6, &(0x7f0000001380)=0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000200)='net/raw\x00') io_submit(r3, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x1000000, 0x0, 0x0, 0x5, 0x0, r4, 0x0, 0x0, 0x101, 0x0, 0x2, r4}]) syz_usb_connect(0x3, 0x24, &(0x7f0000000240)=ANY=[@ANYRES8=r4, @ANYRESOCT], 0x0) utimensat(r4, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580), 0x100) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8a06, 0x0, 0x0, 0x0, 0x4}}, &(0x7f0000000000)='syzkaller\x00', 0x8, 0xfed, &(0x7f0000001840)=""/4077, 0x0, 0xb0}, 0x94) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000001900)="0a703c7c0b8e4a41a671", 0xa}], 0x1) r5 = syz_open_dev$dvb_frontend(&(0x7f00000005c0), 0x4, 0x300) ioctl$FE_SET_FRONTEND(r5, 0x40246f4c, &(0x7f0000000600)={0x7, 0x2, @vsb={0xd}}) copy_file_range(r1, &(0x7f0000000080)=0x9, r1, 0x0, 0x7, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) sendmsg$inet6(r0, &(0x7f0000000000)={&(0x7f0000000040)={0xa, 0x4e20, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000029000000040000000200000000000000280000000000000029000000050000002c02020100000000fe8000000000000000000000000000bb18"], 0x58}, 0x0) (async) memfd_create(&(0x7f0000000000)='-&:z2\xe2\xa9\xd7P\x85,%\xa7&+\r\x83-\xae]{\x1bb\xf6\xd3d', 0x2) (async) memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\x04\x00\x00\x00\x00\x00\x00\x00\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\xdf$2dUU\x18\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\xb2W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\x14\x16\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11\xb2', 0x3) (async) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2000000, 0x13, r2, 0x310f000) (async) io_setup(0x6, &(0x7f0000001380)) (async) syz_open_procfs(0x0, &(0x7f0000000200)='net/raw\x00') (async) io_submit(r3, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x1000000, 0x0, 0x0, 0x5, 0x0, r4, 0x0, 0x0, 0x101, 0x0, 0x2, r4}]) (async) syz_usb_connect(0x3, 0x24, &(0x7f0000000240)=ANY=[@ANYRES8=r4, @ANYRESOCT], 0x0) (async) utimensat(r4, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580), 0x100) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8a06, 0x0, 0x0, 0x0, 0x4}}, &(0x7f0000000000)='syzkaller\x00', 0x8, 0xfed, &(0x7f0000001840)=""/4077, 0x0, 0xb0}, 0x94) (async) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000001900)="0a703c7c0b8e4a41a671", 0xa}], 0x1) (async) syz_open_dev$dvb_frontend(&(0x7f00000005c0), 0x4, 0x300) (async) ioctl$FE_SET_FRONTEND(r5, 0x40246f4c, &(0x7f0000000600)={0x7, 0x2, @vsb={0xd}}) (async) copy_file_range(r1, &(0x7f0000000080)=0x9, r1, 0x0, 0x7, 0x0) (async) 6m25.460056652s ago: executing program 5 (id=268): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYRES64], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000641000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00001ae000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000780000/0x1000)=nil, 0x0}, 0x68) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0x4480, 0x8, 0xe1}) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf00020106500008ffffffe7020d0000052406000108247c2a6ad07be4aefb0000000300ff000606241a05001407240a050905580c240c00000000a90c09000304240202042402"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) write$char_usb(r1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c0000140002800600130000000000080014"], 0x44}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c0000140002800600130000000000080014"], 0x44}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4000000) (async) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4000000) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100032628b2cef419b073ad6353dd1d45582c6c7f00307c2c1205cb75010203012902"], &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r4, 0x0, 0x0) (async) write$char_usb(r4, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000001c0)={'syz1\x00', {0x69d, 0x600, 0x8001, 0x81}, 0x3d, [0x800, 0x6, 0x0, 0x1000, 0x3, 0x505, 0x8, 0x47, 0x3, 0x0, 0x1ff, 0x3ff, 0x3, 0x200, 0x8, 0xdd2a, 0x8, 0x8, 0x6, 0x5, 0x3566, 0x5, 0x8, 0x2, 0x8, 0x1000, 0x6, 0x10, 0x1, 0x6, 0x8, 0x7f3, 0x8, 0x3, 0x8, 0x8, 0x1ff80000, 0x9, 0x8, 0x3, 0x2, 0x6, 0x9, 0xb, 0x0, 0x1f34000, 0x1, 0x8cb, 0x8, 0x1ff, 0x6, 0x66b6, 0x5, 0x2, 0x90f, 0x2, 0x4, 0x418, 0x7ac, 0x6, 0xff, 0x6, 0x1000, 0x2], [0x5, 0x7, 0xa66c, 0x6, 0xc, 0x1ff, 0x6b11, 0x2, 0x4, 0x0, 0xfed, 0x2, 0xe999, 0x6, 0x1, 0xa6, 0x8, 0xfffffff9, 0x400, 0x4, 0x69c, 0xf10b, 0x866, 0x7, 0x8, 0xffffac07, 0x2, 0x8f, 0xdc, 0x4, 0x3, 0xff, 0x3, 0x6, 0x6, 0x8, 0x3, 0x3, 0x6, 0x1, 0x2, 0x2, 0x50d, 0x7, 0x7fff, 0x3, 0x0, 0x1, 0x4, 0xd2, 0x8001, 0x1000, 0x1ff, 0x4d31, 0x4c0, 0xfff, 0xfffffffa, 0x4, 0x5, 0x2, 0x9, 0xed5, 0x7], [0x2, 0x6f, 0x9, 0x6, 0x7, 0x16e4, 0x9, 0xf270, 0x9, 0x8, 0x7, 0x8, 0x10001, 0x1000, 0x5, 0x7, 0x7d797d7b, 0xb, 0x100, 0xc, 0x8, 0x0, 0xf1, 0x101, 0x0, 0xa503, 0x200, 0x8, 0x5, 0x3ff, 0x7, 0x5, 0xbb2a, 0x3, 0x5, 0xd2aa, 0x100, 0xf46b, 0x5, 0x7, 0x2, 0x4, 0x42cf354f, 0x1, 0x4, 0x2, 0x7, 0x976fa21, 0xa157, 0x2198c7d0, 0x5, 0x6, 0x6, 0x4, 0x6, 0x9, 0xb, 0xa3c, 0x3ff, 0xf, 0x8001, 0x100, 0x3, 0x7], [0x2, 0x7f, 0x5, 0x1, 0x91e, 0x1, 0x7, 0x5, 0xf, 0x5a, 0x8001, 0xa7, 0x8, 0x7, 0x9b9, 0x9, 0x5, 0xfff, 0x0, 0x3, 0x0, 0x8, 0xdc04, 0xcb3, 0x0, 0xfff, 0x26, 0xe, 0x7fff, 0x2, 0x3, 0xb, 0x9, 0x8, 0xfffffff7, 0x2, 0x9, 0x0, 0x4, 0xfffffff4, 0x5, 0x101, 0x0, 0x0, 0x3, 0x10, 0x7, 0x2, 0xec3, 0x9, 0x3, 0x4d, 0x1d1, 0x5, 0x8, 0x3, 0x7, 0x4, 0x8, 0x9, 0x5c0, 0x4, 0x7, 0x5c03]}, 0x45c) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r3, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_ep_write(r0, 0x6, 0x8f, &(0x7f0000000000)="466d72c68bd8a382cfa14af290d010a566f48962e8c631a105c69e9026b0addaa7e600a3c4936425ebc8ed13b057db89dc6699b1fb455247c9c71f2cea3fe49fde3e69f2acc606ff4c67d092cc66c5fef981da56cb50da2db732f469104c62271eebe50139ed6028627c2912d741af15875526d79c89a01dca3647d2155392241e166c63e7e8a9d138348db6232c04") 6m9.984419546s ago: executing program 33 (id=268): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYRES64], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000641000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00001ae000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000780000/0x1000)=nil, 0x0}, 0x68) io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0x4480, 0x8, 0xe1}) syz_usb_connect$cdc_ncm(0x4, 0xd1, &(0x7f0000000040)=ANY=[@ANYBLOB="12011003020000182505a1a44000010203010902bf00020106500008ffffffe7020d0000052406000108247c2a6ad07be4aefb0000000300ff000606241a05001407240a050905580c240c00000000a90c09000304240202042402"], 0x0) syz_usb_connect(0x3, 0xf5, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000772aed408680070bb96c010203010902e30003dc2000000904003f000e01000505a40600010524007f000d240f0104000000080000000006241a03000a05240101070424020a1524120009a317a88b045e4f01a607c0ffcb7e392a09044c03003a92a2010a240109000102010205240401050c2402"], 0x0) write$char_usb(r1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c0000140002800600130000000000080014"], 0x44}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c0000140002800600130000000000080014"], 0x44}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4000000) (async) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4000000) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100032628b2cef419b073ad6353dd1d45582c6c7f00307c2c1205cb75010203012902"], &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r4, 0x0, 0x0) (async) write$char_usb(r4, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f00000001c0)={'syz1\x00', {0x69d, 0x600, 0x8001, 0x81}, 0x3d, [0x800, 0x6, 0x0, 0x1000, 0x3, 0x505, 0x8, 0x47, 0x3, 0x0, 0x1ff, 0x3ff, 0x3, 0x200, 0x8, 0xdd2a, 0x8, 0x8, 0x6, 0x5, 0x3566, 0x5, 0x8, 0x2, 0x8, 0x1000, 0x6, 0x10, 0x1, 0x6, 0x8, 0x7f3, 0x8, 0x3, 0x8, 0x8, 0x1ff80000, 0x9, 0x8, 0x3, 0x2, 0x6, 0x9, 0xb, 0x0, 0x1f34000, 0x1, 0x8cb, 0x8, 0x1ff, 0x6, 0x66b6, 0x5, 0x2, 0x90f, 0x2, 0x4, 0x418, 0x7ac, 0x6, 0xff, 0x6, 0x1000, 0x2], [0x5, 0x7, 0xa66c, 0x6, 0xc, 0x1ff, 0x6b11, 0x2, 0x4, 0x0, 0xfed, 0x2, 0xe999, 0x6, 0x1, 0xa6, 0x8, 0xfffffff9, 0x400, 0x4, 0x69c, 0xf10b, 0x866, 0x7, 0x8, 0xffffac07, 0x2, 0x8f, 0xdc, 0x4, 0x3, 0xff, 0x3, 0x6, 0x6, 0x8, 0x3, 0x3, 0x6, 0x1, 0x2, 0x2, 0x50d, 0x7, 0x7fff, 0x3, 0x0, 0x1, 0x4, 0xd2, 0x8001, 0x1000, 0x1ff, 0x4d31, 0x4c0, 0xfff, 0xfffffffa, 0x4, 0x5, 0x2, 0x9, 0xed5, 0x7], [0x2, 0x6f, 0x9, 0x6, 0x7, 0x16e4, 0x9, 0xf270, 0x9, 0x8, 0x7, 0x8, 0x10001, 0x1000, 0x5, 0x7, 0x7d797d7b, 0xb, 0x100, 0xc, 0x8, 0x0, 0xf1, 0x101, 0x0, 0xa503, 0x200, 0x8, 0x5, 0x3ff, 0x7, 0x5, 0xbb2a, 0x3, 0x5, 0xd2aa, 0x100, 0xf46b, 0x5, 0x7, 0x2, 0x4, 0x42cf354f, 0x1, 0x4, 0x2, 0x7, 0x976fa21, 0xa157, 0x2198c7d0, 0x5, 0x6, 0x6, 0x4, 0x6, 0x9, 0xb, 0xa3c, 0x3ff, 0xf, 0x8001, 0x100, 0x3, 0x7], [0x2, 0x7f, 0x5, 0x1, 0x91e, 0x1, 0x7, 0x5, 0xf, 0x5a, 0x8001, 0xa7, 0x8, 0x7, 0x9b9, 0x9, 0x5, 0xfff, 0x0, 0x3, 0x0, 0x8, 0xdc04, 0xcb3, 0x0, 0xfff, 0x26, 0xe, 0x7fff, 0x2, 0x3, 0xb, 0x9, 0x8, 0xfffffff7, 0x2, 0x9, 0x0, 0x4, 0xfffffff4, 0x5, 0x101, 0x0, 0x0, 0x3, 0x10, 0x7, 0x2, 0xec3, 0x9, 0x3, 0x4d, 0x1d1, 0x5, 0x8, 0x3, 0x7, 0x4, 0x8, 0x9, 0x5c0, 0x4, 0x7, 0x5c03]}, 0x45c) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r3, 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_ep_write(r0, 0x6, 0x8f, &(0x7f0000000000)="466d72c68bd8a382cfa14af290d010a566f48962e8c631a105c69e9026b0addaa7e600a3c4936425ebc8ed13b057db89dc6699b1fb455247c9c71f2cea3fe49fde3e69f2acc606ff4c67d092cc66c5fef981da56cb50da2db732f469104c62271eebe50139ed6028627c2912d741af15875526d79c89a01dca3647d2155392241e166c63e7e8a9d138348db6232c04") 5.890365981s ago: executing program 6 (id=1358): connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x7, 0x7, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0500000008000000fa0400004501000000000000", @ANYRES32, @ANYBLOB="009fffffffda8d2200b211f3abea4e1a3a32b9a239548c38018134d2a7ff47a656e0c3a86769bf861ed4f3ea9158fb0000000000000004c5022647d9bc7c0e9580a3", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000ffffffff00"/28], 0x50) socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0xfffffffe) socket$unix(0x1, 0x5, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@gettfilter={0x4c, 0x2e, 0x100, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x10, 0xa}, {0x6, 0x10}, {0x8, 0xf}}, [{0x8, 0xb, 0x8}, {0x8, 0xb, 0xfff}, {0x8, 0xb, 0x3}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xec9}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24008848}, 0x80) socket(0x28, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) modify_ldt$write(0x1, 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x5, 0x3a, 0x8001, 0xfffffffb, 0x6, 0x0, 0xb, 0xfa11, 0xffffffff}, 0x0) mq_getsetattr(0xffffffffffffffff, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c00000000020104000000000000000002000000240002801400018008000100e000000108000200e00000010c00028005000100000000000800084000000008"], 0x5c}, 0x1, 0x0, 0x0, 0x20008880}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0x1, 0x7, 0x7ffffffc}]}) getrusage(0x0, &(0x7f0000000000)) socket$packet(0x11, 0x3, 0x300) 5.785248982s ago: executing program 6 (id=1359): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) r1 = dup(r0) write$uinput_user_dev(r1, &(0x7f0000000480)={'syz1\x00', {0x7ff, 0x81, 0x1, 0x2}, 0x42, [0x1, 0x1, 0x7, 0x3c5, 0x1ff, 0x0, 0x6, 0xffffff4c, 0x8, 0x914e, 0xac, 0xc, 0x2, 0x1300000, 0xb, 0x7, 0x9, 0x2, 0x7f9b, 0x1000, 0x6, 0x2d2, 0x2, 0xe, 0x40, 0x5, 0x8, 0x1000, 0x1, 0xa, 0x7f, 0x3, 0xd01, 0xc68, 0xd8e, 0x5, 0x200, 0x1, 0x10, 0x5, 0x9, 0x1, 0x2ef, 0x4, 0x0, 0x1, 0x3ff, 0x6, 0x100, 0x1, 0x0, 0x8, 0xf08, 0x8, 0x4, 0x1, 0x6, 0x2, 0x6, 0x1, 0x828, 0x7fff, 0x3, 0xdab], [0x4, 0x7, 0x7fff, 0x2, 0xa3, 0xee, 0xfffffffa, 0xffffff81, 0x608, 0x2, 0xdb0c31a, 0x8, 0x0, 0x2, 0x1, 0x2, 0x6, 0x5, 0x7fffffff, 0x0, 0x1000, 0x1, 0x1, 0x81, 0x9, 0x9fc3, 0x800, 0x3, 0x6, 0x7ff, 0x0, 0x10, 0xa, 0x9, 0x8, 0x4fc0, 0x4, 0xd, 0x8, 0x6, 0x4, 0xe470, 0x1, 0x5, 0x0, 0x80000000, 0x2, 0xf, 0x6, 0x207, 0x3, 0x7, 0xc4c, 0x2, 0x5, 0x1, 0x2, 0x2, 0xfffffff9, 0x20000000, 0xffffffa1, 0x5, 0x0, 0x100], [0x9, 0x5, 0x9, 0x8d89, 0x9, 0x1, 0xf, 0x5, 0x3, 0xba57, 0x2, 0x6, 0x5, 0xfae, 0x3ff, 0x0, 0x40, 0x5, 0x2, 0x463f, 0x7, 0x3, 0x1, 0x8001, 0x10000, 0x7, 0x8, 0x200, 0x80000000, 0x10, 0x9, 0xb813a65, 0x1000, 0xfff, 0x80000001, 0x5, 0x3, 0x6a5, 0xf, 0x5, 0x400, 0x0, 0xfffffffb, 0x4, 0x8, 0x3, 0x800, 0x7, 0x2, 0x7fffffff, 0x101, 0x4, 0x4fd, 0x7fff, 0x4e, 0x8, 0x0, 0x8, 0x0, 0x23, 0xfffffff9, 0xd52, 0x0, 0x9], [0x2, 0x1, 0x7, 0x8000, 0x8, 0x7, 0xfff, 0x7, 0x9, 0x2000, 0x0, 0x0, 0x5, 0x0, 0x6, 0x3, 0x400, 0x7, 0x5, 0x5, 0x7f, 0x1, 0x6, 0xffffffff, 0x1, 0x2, 0xff, 0x3, 0x101, 0x4, 0x4, 0x4, 0x6, 0x3, 0x4, 0x0, 0x6, 0x1, 0x9, 0x10, 0x7, 0x7f, 0x3, 0x3, 0x0, 0x9, 0x6, 0x9, 0x5, 0x5, 0x9, 0x7f, 0x53, 0x5, 0x5, 0x10, 0xfa, 0x5c7f, 0x2, 0x0, 0x930, 0x0, 0x1, 0x4981]}, 0x45c) (async) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r0, 0xc038943b, &(0x7f0000000080)={0xc8, 0x18, '\x00', 0x1, &(0x7f0000000040)=[0x0, 0x0, 0x0]}) 5.784470333s ago: executing program 6 (id=1360): memfd_create(&(0x7f00000005c0)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) (async) r0 = memfd_create(&(0x7f00000005c0)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x18\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xacva}knh#\xcf)\x0f\xc8\xc0:\x9cc\x10`\xee\xa9\x8b\x06%\xb8G\xd1c\xe1$\xff\x97k\xde\xc5\xa96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xd9Jx\xaa\x8f~\xb94a\xa9\xb2\x04K\x98\x93=\xabQ\xf7\x05\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xd6m\xf7@]iNP\xf1\x1d\xab\x13\xce\x152s\xb8\x85\x98\x84\xbf\x8c\x80{\x16\t\xd6\x17P3\xe9\xebGKL\xd3\x88\xd2\rLG\x8e\xd6\xa72\xf4\x92\xeb&\xa5\xcc\x14FZN\x98%[p\x989\xf6\xf5\xb6\xedk\xe6\xb0\xa1\x8f\x90\xdb\xd6h)\x0f6\x88\x03P\x8ak\xf9\xc9\x82`\xa7Ku\x99\xab\xd4\xb2\xaa1\x99O\x8b\x99-\xe3', 0x1) r1 = dup(r0) write$binfmt_elf64(r1, &(0x7f0000000940)=ANY=[@ANYBLOB="7f454c4606ff78a33e0200000000000003003e00cd000000d40100000000000440000000000000009803000000000000000001000500380001000600b10601050300000081000000ff00000000000000f50f0000000000000000000001000000b8"], 0x178) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$inet_tcp(0x2, 0x1, 0x0) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8840, 0x0) ioctl$TCSETS(r3, 0x40045431, &(0x7f0000000040)={0x0, 0xffffffff, 0x1, 0x8, 0xa, "ff00f70000e5020052c4f21c7f000000002000"}) r4 = syz_open_pts(r3, 0x141601) write(r4, &(0x7f0000000000)="d5", 0xfffffedf) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) io_uring_setup(0x2fad, &(0x7f0000000500)={0x0, 0x9d1d, 0x40, 0x1007, 0x27}) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000100)={0x400008, 0x20000002, 0x6910, 0x3, 0x19, "680c1acfa4a5000000070000faffffff000800"}) (async) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000100)={0x400008, 0x20000002, 0x6910, 0x3, 0x19, "680c1acfa4a5000000070000faffffff000800"}) close_range(r2, 0xffffffffffffffff, 0x0) (async) close_range(r2, 0xffffffffffffffff, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="660f388084000072baf80c66b860b4498c66efbafc0c66b80e00000066ef64f30fc7b000100f850100f30fc7b1030066b9800000c00f326635000400000f30d2bc0a000f23c80f21f86635040040000f23f8b8f4008ee0", 0x57}], 0x1, 0x48, 0x0, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x50, &(0x7f00000001c0)={0x0, 0x0}, 0x10) (async) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x50, &(0x7f00000001c0)={0x0, 0x0}, 0x10) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x8001af85, &(0x7f0000004c40)) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) (async) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 5.513436553s ago: executing program 6 (id=1363): r0 = io_uring_setup(0x1530, &(0x7f0000000480)={0x0, 0xd498, 0x800, 0x8000002, 0x1d4}) futex_waitv(&(0x7f00000001c0)=[{0x6, &(0x7f0000000180)=0x6, 0x2}], 0x1, 0x0, &(0x7f0000000240)={0x77359400}, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\x04\x00\x00\x00\x00\x00\x00\x00\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\xdf$2dUU\x18\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\xb2W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\x14\x16\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11\xb2', 0x3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2000000, 0x13, r1, 0x310f000) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x5c, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xfff3}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x2c, 0x2, [@TCA_BASIC_EMATCHES={0x28, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x1c, 0x2, 0x0, 0x1, [@TCF_EM_META={0x18, 0x1, 0x0, 0x0, {{0x7, 0x4, 0x4}, [@TCA_EM_META_HDR={0xc, 0x1, {{0xe19, 0x4e, 0x2}, {0x802, 0x40}}}]}}]}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1, 0x3, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8a06, 0x0, 0x0, 0x0, 0x4}}, &(0x7f0000000000)='syzkaller\x00', 0x8, 0xfed, &(0x7f0000001840)=""/4077, 0x0, 0xb0}, 0x94) 5.213471901s ago: executing program 6 (id=1366): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000106d042bc50000000000010902240001000040000904004081030000000921f900000122ee86b923f7a44b7a7390c76204e523f0050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x8, "0e233cc0"}]}}, 0x0}, 0x0) 3.748899565s ago: executing program 1 (id=1374): r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r1, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x53fe0) close(r0) r2 = socket(0x10, 0x3, 0x0) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000080)={0x1, 0x3ff}, 0x8) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x9, 0xffffffff, 0x4e, 0x567}, 0x13) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)={0x18, 0x16, 0x1, 0x0, 0x25dfdbfb, {0xa}, [@nested={0x4, 0xca}]}, 0x18}}, 0x40) symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f00000000c0), &(0x7f0000000100)=0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000065c0)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000480)=@file={0x1, './file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="14"], 0x18}}], 0x2, 0x0) 3.686687683s ago: executing program 1 (id=1377): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x200001fe0000}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x4, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r4, 0x4068aea3, &(0x7f0000000040)={0xc1, 0x0, 0x3}) fallocate(r2, 0x1, 0x100000000, 0x10000) 3.346265958s ago: executing program 1 (id=1379): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f00000000c0)={0x8, 0x0, 0x0, 0x6}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2c0000001a00010029bd7000fbdbdf270a808005000000000000000008001e000600000006001d"], 0x2c}}, 0x20040020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x458, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r3, 0xc10c5541, &(0x7f0000000040)) syz_open_procfs$namespace(0x0, &(0x7f0000000140)='ns/cgroup\x00') r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000380)={0x0, {0x2, 0x4e23, @rand_addr=0x640100fe}, {0x2, 0xfffe, @dev={0xac, 0x14, 0x14, 0x20}}, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x107, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000}) r5 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002240)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) read$FUSE(r4, &(0x7f0000007100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000002140)={0x50, 0x0, r6, {0x7, 0x2b, 0xfffffffd, 0x0, 0x0, 0x7, 0x1, 0x0, 0x0, 0x0, 0x30, 0x80}}, 0x50) read$FUSE(r4, &(0x7f0000002900)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r4, &(0x7f0000000000)={0x10, 0xffffffffffffffda, r7}, 0x10) syz_fuse_handle_req(r4, &(0x7f0000004940)="4f50356c9e70ce6dcbe3d22a41991ada3384a3cc61e92a72df663226dcad115a3308ae59bd26134ca5b1d27458f3aebf34acb004e78edccd1c3d66ebfda95d8369a12684acfd2a04e36c20ef64cbf1b5bbc16a9783fcf708a9b8b981d1439e1a70c847592b26218c9a35c8cbf385a246ac35fb857113366f18ebf2038f6f5fe538f19afed142f05dfa55e8e5ec4234f6bd050a4d3033bb36ec207606c74bdbb57dc854f6df4c8c9baa253c94555881384fe2f47514f5b07ec99616b751cfb680bc45603bd053c910f9cd9f7d954178f2385becf76f2acacd3a5f570f9ec36203fdd74b03259ce7df7c4c833708d24e1da50717cf88499739f009f6a0d0f9cfeee33134e807ff90cd8984a2f377c22595be32493ade61f85925cb5803dad77b642a067d357d05fd01e6af9a0b3c1d8e2f871bf2e5d082fb410ca5b5a8b67471a2024d8d8a8f54bb82fc7a858223aed1a741e89cd539823ff5417f0bdd5963502c243a126d3a9bbf66adf1631148a90693467a4d255260760389a5717c9b3c79a0057061c4cfe3ca8d9d5d179526090dad4ea4816f291bb8649ed07de9128e6881f581a7989c9533c7bb6186c1c4266f813ad201d0ac241d9dc7990092b0f59d11bd5d457f722ededd6a147bc22e11d28c48d80f5ed97b66eed8f974ad611c03c76420332deb2bdccf260c7182b5ce9aaef10bfad7241d285bf4beea9d3ffd4e5933c4048ca9a041dac8a712836fafe4988ec3849330c6e929f5a0520bfd21079f603b990986202c08f589c3017c10b087f8fdec4fc56d0f89c2b00bcd5d931daa4219e6efc054f60d0988a3ac98f81324d22b5909bfc1f4d1b7172b30e0ec3b21f776553a4507ef0bd813a94d76733e84b0c7067457650e9fcde01840bf5a04399cf4d40b4c66ac1bb55b1aca704afbae4db5744953acb0e6cb0448153f848c774f74282e6c541f9bd1bec0e1b5044423425f182b95949edc8074e257056241df49812c2cf7ceb0b8d28f65f317523b4a47b9e2b693a89ef7c95d180b318ef70b7ee2d6e0a0cad96043c1df61f09613c1cd6f6d6461a761c8ef9c1338cd918318774502da24b0b9d38030533ff6c0359d3b273a18815a1f0a71df5e6452252fa0ddeefe55e6f9d6e3f7941ee84d76143ffb4d32093351ed67674c9862c5df14ae5f430012ebad4d8bd546e8149facb0c2b15ae86f38588ee617ff2874a668e7f755061460094f8e7e56590ba3f30582fa5341b0339b3d6115d631178424f2d8698a2efd847a5567f54e67eb555d4d8a8b548edaa48d47a7b9c06b04d03ee1ecfdfbda40049d0e2eac6150866bc3102bcd5feb4a62b0ac49601adc9c19450530685d54cd53c654fa4bcee4862b010cf6875a97a77e8c6dd1395d440c003091f241baa97eb2995e363b54e1f23f143e3c45af005100fc582e7730c0abf1ef58170942740709f9946f1d29765ed85f3d13bdeb7816afff414d806d80c2033493d2f3fa80a7ad476037891feca18d7625b27779ec4cd8d14de8afdc6c428005513e795f2e7a1e3410201474d9cf4e315f8e05ba591b242f14094149bfe42812ee05e387b5e791107a32578e2a8297238a0075bbda9a4427f379841ea86508c5fba5e235ed4a3754c846569e9a329494d579d066777ec2f189de2aa55a3549e87bf7cda53b7e9af98355b04264189cc95205bf2955e4ffc692e0e6c48d816758ff322244b4268f69a0b72274c429128d8489e13064c925b9d5f3c82be62445860545927b2ea2f3e439888795780e7c4a2b3f3ff62ff2d25e4a44013f9df631c3a0b68bbad82ebe551bf4ff36f1a260f6347c59685ba09d9d9871ef910cce643ba01c5d3f17a50d7daffa2010d274da5570dd19acdd373b55e55701e638f8d31c6d31315a50cdeda2aaad2b71bccd321619120be8cc92dbc696d810b188119ddfb578054bbd343fd5e9e889719dffdae9488c410bc2ce68ec2f85a337ec8fd5bd522bde64b930813efdd670193d91b37fd93aa02f68f67e884130ada337fcf873a984d91467896a703e15b3718e6fd5f6993da9288dabb6f3876a6db06bd8be05b14a5bc63db5ee4f55103640cf30746cdafa8563f5e8c1cccbb58e538b484e0565ed140f2de8437a20ca422f173c829311919a2156d22f3b8bf349f299494c5e37283b1a373390e08df6a551c608ba42ee6e1577043adf6b9e7c0edbd20be866279cd9ae36af67f198e43fd31737cf70312776f4e695327b4fe957641cd3a46b48b198c32a8fd1998b20ace3d9780d1258b3e131ac51c946d022ddec1daebd8b2d225580efd68c7035b301860f6070daf273637e626c3380226a550a33a0346ebb3b87c2b26f15c923b9a490d97a05fb6fcaa5cab19101ce26adb3dc5bbd9604bd5299ceaa872a8ea956a48772852d5702ae3f322f8bb97e79805f7355b781c4fb7dc55e0f1fbc3125def8973302fb48052605366082dce1c8d92fdfa5d8f56f12bd2f73ae2c3c8a12215428861fdd247f36538c8ef0dacd594a709c656124fd8bdf36d69ff1cbb3903c35ae0a36129f64f65190fe37fa22c173ba32d22d61ba7411b3ca9d94a48022c0f0d305e5986cf008cc3e775b683ce5600f25f85dbed4b6c4a3a596da796b03d67ed072991ecfab88a8c7b5fced1bdd8c6049da0b3caec8e46eb9606ba6e53ad058cf8f7da4f107878ab0208c7324e125440d54749b10f64fb27b236feae37a427b287e0ef6a54cd5e864faedc4fb2125a0dd88ac96732ca025f5989e33ab7b521e6fa98ed3af16c83a6661864dc067b9072c980f64e2d008fafc676e60a26703f1fc7330a0c9503d88872d780bebb6c815e52608c04e74e48bbe66e1c0dab838f36c705957cfaab2ed98692db57ebac0c48b257e9386a8584aba15f86019e20cbcfe0b3b57be3b3407c48256e4531efdeca186c93bc3e9bfbc8f45ec864f32f7b38a63479a3bb4fa75a8b25f606f35b1147c1b53ebfd590418f926bad68807279027617af0d06651e5f977c615055f4dc91819bff755f8e6a2e0fb46dd7b1283de2652944d2b1cde5c72f43fd6456149ab2bda78e4cb8de135c160877e0b0820f95c4524e4cd386d44991055ea3accd2a698fb23793e57e49913f3cb86501bce08795695bfef260dd2d14761e404ce593e3b1e661a01d16b492a3cedf683736840178d08ea575534865c699bef830dbd0d259da79e5c05d7003af642412fa55b59ee5f2c032f1919af3c5067afe6876b154e29065d14224481971f94bc5ed45e48371053d69635e78b7a46cf76d999418011b58cff533c009316e33e87093117951fa4821241eaeef61d1122cd4e2962d6596259b7acf9e46d23d4efe9739189d99a9cf8776a34ad90a6e901872fd377c4f58886787baf9c2785ea437aa54195fbd34f2c5f5b4c4a76a018f5689feeccb6b153b34fc23cd0a8fa0699bff806521cb11172e4d4d45a1fad1cc8c4646b1846f1ba04f99a91db12da738ac1ee104ba3193119f325c600ab4f10e1e664dd7c17e285924487d394c7323ced471fd42728ceb9c25822885c1c6ab6b012d7a9b876958b2819e1a708afaacc537e6ac588e58c33934cea32ed3bfa27bb3d63554539e19bf69f30d03e0f47db84132a39a6dbbfddfdb673dd5cabe21d6d552317db8be0477536a69e2fe4f2e9a772dedc8a3ef34256565090c488c08fef2a3dd247fcbc2864d1862676ad5cfed2fd86871cce47b2ba28625ee67dd7518a6da3345614ff18307f20c27f68a69e4a1a6a3c8f76cf31df45b3b0b660aadbcf9698a32d36829c8aef481b09dabc8c9e449b96a2571af8eeef04bcb1785b596709f5aa1ace3804fc703ed9ec544667f350cb8bfb40a86caad45feb77d58aa1888f203cd963bcd9296feb0b68e0a695ed5cf8e7bca26a77d2bd61662f07bc721233a868805202469d8ee504be1d7cf135bc1bf7a215bbb96ff5514eeba1c0ffb68e4b3d6c20e1afadd2a3cecb002fc5ae0c59315dbf8f775ae5c63da31056a9c088e18477e2f925f7ff88df2786e8d014f0c98c58f218e931cd8cdb258c4d8ed82b7f9beab0db9ae0b35b2790ff7e02d11fcf992b365ce82b94eaa0d5b2fec4aeb984f29c6af84e10ce4aa6df7e9c6b0ee842027c8d2552efc6b4084ef9af751524b3acbca12c5c313381b443cd44e862d8c8b0394dda05aeccda371226ebdf5aed6efd6dfcba73b09ae8e92ad54d4b43db9b7f84b46b307c66a4ec69933e47ef22244250f1c82fe42683fc13fcbfcd1c2ed1b537adb2e83885bb368209f89cfe8d4bc59e6df61ec794fa310f290e56320b39fb843163752a726240236b3a45b59927333e94d0c0b30a862d61c6144ac0a59f96e08651fba2d299a37a1a1010ac12ead549404421bce2b95a05d54d44f0df5d08ac469cbc7e1988e4fc913d98e3eb9a8102ed7d40021274948acf58a10c43f1078076e36ee7cbe548638b273a40347415d20dd153885b6429af1c8e82d8d9f22bcd5b48f60484aca751c29c0ac031001e8d5dd49a889665e4ec41e257e8f3013eeab0e382b281c3463c035d3412a0ab0fadf5753ed735f250e56f24bedce1748accb4af749b12f8cf660127d7b9e710f19483cd9bb09d292355103188625a5fb4b81f22a87498d63a5dbdd78e64b4d2feecba4a3dd881a1c4103f9697e09a23ed1db866e40dcb51aba96b83766028b653cabc365fe5694b4f946ad32d9681252373e6017a9413f5fd02ec689dd9e1e179fa9d607b6a8ede028420b0fe6da5f9a678b3b717df1d48e862c2485f789947dd5baf8c3a4a641e460279827354fee33d97bea7ed36546160354bce0f2f58815e28622590418b99b1499250d5469a66d1d461852b384e99073906c64e0aba5d6a0dc7813ff58c63d32e3992b0fb89be5811a646056714718a7039cfbb82678eebeec54bc4350ea85446ba062e53e239d74509dea0d2c1d5c803e333d37761d311f5c402bf43e6b8d84d036d35c0fbe98d7eb9d5bc6165a5771d048647ad16061c55e57c53dbf64c1a08a2a639672d650b4cc6c0f90ab3b8b3ebfc1ff1844e9791ead72b167ef6b57b81f7b6c751fba73a0835edb2c68a55b5e2d2b2c350bac375153c15e6a1180f09f9c2b984ccab971926ad85980026c4610b7dbcae8bb86b98136ed27facd94e571270187a6bb194cc0ebf24b7acada441b23dbe380c7c3221d1677e5af7bc81c3264a958fb5ceee61e4795dc863da2f13cc59a2fce73070af121983410df1a99fdd864bb62d67c30ab0a98300597d7160646bd2759b950bc0468fe74918dca8fc59c9dbdcff736f0f61d234328f1b560bdf6df54663c7f80be5175d67fc37eb85e491650cac6a8da06d3dbb0743ef8d0a9ae90d2d67c11a77ea52545d53c64991b9005b6e3aae54f1cc39672ed59f3d881d65d6b9da133c1201c105972efd039d2210bafbd2f9d964459a4bc72877c51b7ca9ce6fae62ec3bbdd6d09e4fefaeaac5145b141eb06e7c9537e58a7e78526dc7d0511e399ea983d471eb5e19a1ebd5a0a1149d48afa688507952df4afd85f8c296e678a221055e89451e0920f7fd38ac866a54b932a0a608d3e2126dedba84af8fe86f719647e9fe44f4c85641dcb3347c580fa2e1d6e863ca30625f56da0b6125e6c35075451eb93ce3ce6478c474dae7df27737fd2a37fed7c1d9d793cde4728d80a3480d19771876375be29cc9f9d30433be1c999cc6d6b4295b5963f248baae070c609d49a68ef7db094a7c3bb442c9908b7251a2b1d3058bc71c450bacb88bbded6c99943b618fe9d3c7df4834323942a9b13ea821ce062d85904c5078156e3325da50bce2848598eade14f121ee9de8f6b98ef6bf592933103f567cbaf4b5b082b24ccc461118bc081ca925a0f6d0ab84b9eaaf64a956af511d254d6d1c09299ece040905f7c8fd1d6007907ef795d38744a5b0d9476f7e59476addf0b5f4abb0f7da7b5e21eb9842a7df6b4466913b41a08b06e9684ddf5ef1ba3e730f12be4c80d79ea573549dd3badaded7b7a9f5274e44154ddddf3907c08b977b19820eba4a5a0a40bfd4773d91f3c6329ddb88dd923e2b611cf4fc64fed3c98f9402d2a6c5179ace6f0ac50875e361cabd6610dd789138444ebefd72d0608272716a2359dc3e660ba047970991ac1aa83a665bb5245d9fb16eb4a8db99389d3f1386af7f2931fd09979475f0f4489aa99e6628f9cea46790be34f9d7e3aeceafc2b174650850fdabd4af0e6f84c8620cb0bba96b67f1599fec9406060be53b0c0e626e5cc88b0abb74f2c99f3157076e68cbc6593c544862aaa43b8489c1bf6b0bee80c9a608619e4641447d5422172f46774686b7efa3cedc8a837fc7debbe8598874c52c48c85df82e2f796daf04489458e74936e95ca63aa1594dac0a6708462f342747a43ca99fce71488794166fd1cedda1d444ca877ee10b56194a3ebf2114c2924210de0fb0698a6082ba171145150cf0c433adc7617520ca7626a9842929ab1831da8ccc128ba534ff27ae20f063d16b46f67654e372217e9d5f908d35cb1993b23dd4a83796009b68533270434744bc18b608c3bdc0ffcf64f691455795628987185ae688994e34541f630179533cf6b6ab12d0a150761aa490652a987e9906050c3ccb1fc677dde544296d35410c2f8b70bcc8b1927869db81cf1cdcabf190a9e946dce8439f09a98ae39e08f4d54a489cb7bab7795173c3c0dd0be506f9f8d38425b4e78882a028fd8fb2b9051d3eafcbad61a4a78f4caeab1c2041cdf7b55d3fff546f37beb9454c795e9e19a678cd087d74191e27c8a35584dc548d8fc57c5f92ec630723b335848ea5405c56631d58fa365d9fb88c2ab13d262403518dd862e9111bff48db9554fe512e2e40f96c47186aab5b9365c09692c7b2ff2e1bc5514726396abfc36263922e58be98abd1ddaef1ad23fb0f6f31e2c67315fe19d3a38477ce82d965b2c6c14ebb6872eb2acf6ca9a5860c2ea4d691d46b9cbd19352cb6b328486a07c6bf38af80e423cd6394bd9b7fc892011672833ce3d4c02561887a546d27837ca2662b5d72f595c035018a0511e22b72b8682ab65f8d59edab36389c69b5d8e64c35dd9dc78e6261fa3d141258ed9e9e8553f98e152751d5c9ba8712647e46b093a61984fc08172419a5a2aa08aacc487af4a7854d2ed34c812e96c3c56d8b7beaca74db439b1447b5102e6f66f686fb91e16cd82dc52182bbe5a6f2648d09163b3ef9c17f1b4c9867351913b2653cf4e60c5d44706245989da8f0a8392c941af9d7067496809102608fe8b60734b0c90da122c3432b40eaccafed5f5b37948dc9764337eb7016c24d717ae5ecff4d4f8c5c4aea686680a4b5a79b7f254acb0b46530782484cf8041fab719a3549c70767574c7e6aaa87e60b384ce53180540a6448e2c6743890d8eb6a5c38255cf6f86343bb82e2e57f2cd89ff8029e60267f821b7994199c741098be16e9fcdfd08d76a150761c6094776e270833d8d0cb83d2aeb13ecf2146dd46768338b4ecd8124252c2e620fd98b11d50728aed97a475c36e92b07a12792be948e95e3d26d15f4cc7c669d23d93f7cbead515f7f996afe9119415ed3b03d15e59474ba9e3c9a7c1476f3b8f66c099d85689785b712e82316f5afb6e16db12911b2d19b650e547608ea35af216561d61f36c5bcd3af7f64d9c56732f999e6e33c6e63aef13b3cf3ef69c773b4d0def25269296d535dae2948abd7918b95ffcfbce0236dac8b08b91d91aba716668bd5556d1aaf4e50d296af985a52cf35669b3aa29ea192c9fb34c471f65ec7242648c6fe22abafeb2b9bf349276eb55d0a9ec35399d98aa8ecb5613ffe530c6a5b93d4f713f3256e7a74cbf40e15a402df80c2bc287fc7ad1d1f665dba5139f56a865c0dae06048698a886da045ebb6bdddc29755947d090a6cddfe14f23dc400245211d55314160d2d852a659de834af8e24effd2e0396982c03e29fb94d3f10cd8bd57bbbb9e0945d5deacc5b33969aea3f7af0821327b9a976e8e4a82a41635c4137dee27741ccd001e559f6f6165e0b2d8062d352442689e7aa747438412c4a43dab94ac7f839eefe38c81b8277e565143e4a550c122ab0eef1cf3ddb6e41fd95ec763b636ed3aa62a85da14b1278d93d4e0ce8efb5ae1ada9dccc8c07dee130991098521bdba59399f7f0ad5f3349fe60745cf19f84e4f060a1efadd7c0a864177b46ee853a5d51e6da6382228cab564aee9a688f96e4f0e992dbb9be22629204910f4185085461ae92c5fdda4683212b1f8f03d6730dcce43f0932b6ad3866dbaa9e40493889c7857822e8ea1d498e2690bd232e4a383dee59071fe7cbc0db53d23d60ecf1a7adab5116eda840c57440f1e20989202d6b010d0fd58dc57a83ab1f5ee19c79d7d0819995ebaa36d4c952a861c0958911997d84f2c249a0e29f602966adce8f41f9b8bc051bf4c127aa39b26632e81a00b365d6447725311bdcb9db6a5d62aa46c2049fd2d54b670e308c2f62c9c58a6343905f34fb7a12fdadca999ca13e7bbfba72100ec625eec11d9ffdbf898d57ce95fd606aa57e3d259c6889e2af4e4ead2d9c38327b42d68f65453be8f2798df47ae392817ae9ae6200c3659ee9b8622c948943e5aaee24be9d35a333a20a803c18d3a4f18c22018f4a1f4dca3fef010f00150badbf90c04bfcba748329e835eeeb0783cc2f5246b01e853a84e391a9bf0332fd6fac22c64b83987b51040d09110d0b66a24fe213c72281eef8e79021c9b445056bca406ba1a4f805672f724247b7b2d0bc712cac7bf6e7a8d9a3206762633fd663760c4183309e3209a017514f7f23b350d80c009ae501f46e053b2eefde5f2b8a7ee1d3d4128cc1fd9cd8fc42b5504e2176eb802b21ae7a57d6e6928b82982fcf96615bc4d5b3f8cec1e4a6193961ba5493d9e992ffc933aa3e0d2c47b1217e199223d48e69800ed9a4d2fa5d9d4a8f16e86062b0ee2ca9f11fdfb4331effbda733a1764136e192f49a439910d67056cfed89d05558adcdf54e7eb014d510c35250bf6bffefbf7c3f6ac3d4f26fa205b8857f38256378006209644587d4c56a06eebbfe9cfb0d20a214797699a8960db62dcf84595014a8bcd60d626bbfa0d0647d966635f24111f2ce5a9dedadf34f38217879d27c4e9745b068fb0acc30d4b9a78f753aa286a4cb08ee58a451bc47f64b41cd1cd602db92f691befefbd139a1f919d275dad6e4fef7266999f1ec6f0018435b578032eba39a15b0cdc34ee53acbacbf4a7eca103bec5ff72b08068bf2183643fa24ff1aa69d5125a0d1f666d648550193ccb22f6692590ddfac8866f63fc33eb14844ea6b3b4e18bc613c1d6561506f933d1e8f72b7aa43f7c47e34b921459e230ccf7e333215025482e67f1df4db4aedf4566d5783a64c4511367b69d08ee5076878a22c8db871018ea8d581fb5c0f9e6a9e61f2dc9758c06a6647e4f09c1eff6061ab095b76a60a22ec7cb8a5528d218ef3484ac7574a7b3f63915d867e26b155400b50e1cf6a9d03b8a10ec8e2c4768cf1d2c02de656e7114ffc030ced3f94c0dd0b875cb1ad5cd64e2cf318118d50b45254e0a000a2cb09627489840ce0f4f7c9cecb8e19f01ddff7573a4183e4ff4f85991a15dd5c677f940b57667728b53126a4b45b53c25b6bdf6902ff5ab974995709babdeea1a5c484463fe349efe694c02035a2c149eb3fd813e4d71398503d0a4286443891cd0caf5d9450e27c9142b77565594935c590f44eca1a7d0a74d7059e4017d92e3cb53d3a13f6de6d4ab62800ab64afedfe678f500d8ca51c4e88765247fe88160e4c1ebebee15d0dfdcb138f81d290cb77c0270d7a8666de54e0f255454df5877c7b78bc694175a7e6cf5ce997c9776c208b03b6e11df17d1570d17f7614b5c1da400871268e010727ee8c54db25736d2bac7c56eabf0a8a3aa1e1801f00d24b56f2e30559c39d6bdd655c0e2bed036b616bdac6f11feb41d33608bb9d262c069e102e3079b2ba55614ee7ca498311e72897544db3e6dcb2cb3cd6f1ada2b4f71318b2d5b443cc76907774eaff4c7bed9c77fe264058b5becabc79bf185c0b5a3ad7aed92c28326a188328aedc9cf405541cf2ea2941102cfa5b52f261c550753ecc1ce767015e782f74f2ab3b913d7aff321c138368f77239fce68e9205718f9a87cd8590d1ca56659373e18d951744774b69831f0e51f04a1c5a86462b168890f6f5e12fc0248aeb245f26885a504a0962fb95b1448c629c3c3cb36d3d15bd7d56076c867002f9e58e12fe0d2f86b7508215896c839ea071c5507f30737e34d791f4614687dd0aea9c4debdc95a7dd6d436e9baaac51bffad1ada7d683387eabc5fd384c70469c971342599c6c90c90a57b23df95c7730e25220a8f830d9f9f978945859a1267072a8475d4e5e5011ce6144a6eec6d01d2be2cc558bffee47f7feeb87aa4c38aab5938b444e314c2939322fe81aaf0d32ba9d1c43c4b9f85c84e9284a50a169c65e2100064eb587ace01e361ee6c1bad211867dac692932e23e84795bf6cc58dd06fa1c1c31544e5dce729bb25ca3691b9470d5fa26c627e55127a9fdd4028ae2320192c0df9061db198445c0fcadca9862f0c29f3e62898c00479d0e8c8fb1d619c53ce8181d2b14240da714f82c8c50815ce059fc954595036e41d36bca909b6c8555d152c13ef5f4ff9f6fe7ac6632ebdcf19238d11c2359e6ffd7dd2053378e57ba44704eef580aae7cdf553eed5b0c6892b86e522e6a0912c8d9ccfb639e1f6ea7fccd6c9d04a676ce7e17642b61125329665e21aaa704b2679d698b32ae8388f1f7438e6b50b3d1c5dda7958e0be0be4e286a7a37ea3a6863a99bd4056e80a16866c6d6a121f4d936db302d5335033412ada903ad9bc492f3eb61b3384a4a86717df9e517cf593caab9b4ac8b229a80b934783cae88357c4cc7da8f0d819ebd1eb2961acb7b014411d23ee42e853e85f4f3863005a0a8356cacc15a26f90c549cfd307bdc88bf1c5a21778301ebd20054cfed89acc59cf29237e6c382f2e4f43e6eef14dabce06df261e2bcbadab8c60b9bfc684aceece9e1cf2f0b3751564a037aed891c2686547cb01c6982f073cb0b2882860b6daf111a034f5738d3ea1f67a0e7f4097eec1f9c355c6a9cd5646feed86f4ba075969ad71406f56e16fd5f3e05fc05fe18ea724d114aba4a2d7f312fc77b7b0d1616b00a124ded31251f2218eb95fb444241eca65c051205e7c1a04a6096a0cf9b9a8831907d569ec6de4a92610cf9147bfc0838e1b232d1642d16dcfd7de72c0ecd45c45506ec5641b526c40866c465e8bb64656677e8c1c81fbb00e26b8f775065298e6274a8ab8ca63e8c43a90edce5bede53526e7c2d37808a010627635e1b0d397850edcf6108e5ef1d85233be77b3838a4efda50de1662b9ee643416f92be4896bc6636c9eeddc4a87eb2b5e44635331aadd7cf9a49a4218e941dc76151c6d2363083fcd3f9cb5afb32345ad9b307a5625122fdca8b930cb7864362d890ded2df208ffec06085ab9404199ae419475360abec16d28", 0x202c, &(0x7f0000007040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000007000)={0x20, 0xfffffffffffffffe, 0x3}, 0x0}) ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) bind$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e24, 0x8, @private1, 0xfffffff9}, 0x1c) ioctl$FS_IOC_RESVSP(r5, 0x40086602, &(0x7f0000002740)={0xda}) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, &(0x7f0000001140)=""/136) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e22, @local}, 0x10) r8 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r0, &(0x7f0000000240)={0x8}) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000004900)=[{&(0x7f00000000c0)=@in={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000100)="f4", 0x34000}], 0x1, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000084000000000000000084000023070000000a01010200"/48], 0x30}], 0x1, 0x0) 3.299805327s ago: executing program 3 (id=1380): syz_io_uring_setup(0x5145, &(0x7f0000000140)={0x0, 0xc5f2, 0x10000, 0x1, 0x364}, 0x0, 0x0, &(0x7f0000000000)) r0 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000800)={r0, r0, r0}, 0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={'sha384\x00'}}) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0x0, &(0x7f0000000180)={0x0, 0x8}, &(0x7f0000000580)) write(r1, &(0x7f00000002c0)="998f8aa02ccc4e035ef1dba65b58cfefa594c0e76feecf0153f49cf350134bb39f9d45a5ea7de4a03e4ce8dbee7e687f8b634a2019092f7774b5daaed33477c10970168593e725de8a76694f74ca629eb96e173894c25dede79524e68df793f458aa97a0e3276771aec44c970e8385003affac3827f99f32a28720c84e6ada6dc94043b656710cdfac9f91ccbf509265dc8d91ffe1ebfb646a0e954a11a75f91a4e02496cf6dfb37a2f7a01e3f781efc7d1566b6896706af4da0404eef15b7502c21882375752f73b461", 0xca) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSETELEM={0x54, 0xc, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14}}, 0x7c}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) syz_io_uring_setup(0x5145, &(0x7f0000000140)={0x0, 0xc5f2, 0x10000, 0x1, 0x364}, 0x0, 0x0, &(0x7f0000000000)) (async) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) (async) keyctl$dh_compute(0x17, &(0x7f0000000800)={r0, r0, r0}, 0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={'sha384\x00'}}) (async) socket(0x2, 0x80805, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) prlimit64(0x0, 0x0, &(0x7f0000000180)={0x0, 0x8}, &(0x7f0000000580)) (async) write(r1, &(0x7f00000002c0)="998f8aa02ccc4e035ef1dba65b58cfefa594c0e76feecf0153f49cf350134bb39f9d45a5ea7de4a03e4ce8dbee7e687f8b634a2019092f7774b5daaed33477c10970168593e725de8a76694f74ca629eb96e173894c25dede79524e68df793f458aa97a0e3276771aec44c970e8385003affac3827f99f32a28720c84e6ada6dc94043b656710cdfac9f91ccbf509265dc8d91ffe1ebfb646a0e954a11a75f91a4e02496cf6dfb37a2f7a01e3f781efc7d1566b6896706af4da0404eef15b7502c21882375752f73b461", 0xca) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSETELEM={0x54, 0xc, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14}}, 0x7c}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) (async) 3.213704646s ago: executing program 3 (id=1381): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee00}}, './file0\x00'}) write$UHID_CREATE(r1, &(0x7f0000000500)={0x0, {'syz0\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000340)=""/190, 0xbe, 0xfffd, 0xe, 0x8, 0x7f, 0xfffffe00}}, 0x120) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x19, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @call={0x85, 0x0, 0x0, 0x2a}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 3.097291064s ago: executing program 0 (id=1382): fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x5) (async) landlock_restrict_self(r1, 0x5) r2 = socket$unix(0x1, 0x2, 0x0) syz_emit_ethernet(0x136, &(0x7f00000001c0)={@multicast, @multicast, @void, {@ipv6={0x86dd, @generic={0x9, 0x6, "846e44", 0x100, 0x3c, 0x1, @empty, @mcast2, {[@dstopts={0x87, 0x1f, '\x00', [@enc_lim={0x4, 0x1, 0x4}, @generic={0x6, 0xef, "9e0b30ec8343da3899ca234d6a0dff3647a81ce59f70c7d71ff4ccf97f8259118ec49f926085e8c2da83e46d22f1d1c9df07de7e5f9beb6f5ba6f4ca38ccdc1f2258cb4958a6bffe1b0eeb50ff39fe95395282479235df4cf9e17ff8d93718a233097de5183991a379c1d6c8bf2b31ca190965a6716b265e0820411b945e375523844a32cefbfed352fcdcbab65eb1913ea50516c46469912bca78034da671ceb505041611409bcbd2d697531d89895da7a2bb7e819b77d2998f95115daae9b54551f725dbed2ea1059849cc4a276c625b735002ab024c92c79298e0934d2cc1d88fdcd49ec6078c447bebf9e37692"}, @ra={0x5, 0x2, 0x80ca}]}]}}}}}, 0x0) bind$unix(r2, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) bind$unix(r2, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmsg$unix(r2, &(0x7f00000000c0)={&(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4040801}, 0x20008840) (async) sendmsg$unix(r2, &(0x7f00000000c0)={&(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4040801}, 0x20008840) lseek(r0, 0xc, 0x2) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001880), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_GET_REG(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r3, 0x1, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x44800}, 0x4080004) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/uts\x00') ioctl$F2FS_IOC_GET_FEATURES(r5, 0x8004f50c, 0x0) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x34, r3, 0x300, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x42}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x70}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x48001) 3.074530991s ago: executing program 3 (id=1383): r0 = socket$inet_smc(0x2b, 0x1, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r1) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r2, 0xfffffffffffffffd, 0x58) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r3, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/216, 0xd8}], 0x1, 0xa3, 0x10) syz_io_uring_setup(0x599c, &(0x7f0000000200)={0x0, 0x5eac, 0x80, 0x3, 0x141, 0x0, r3}, &(0x7f0000000280), &(0x7f00000003c0), &(0x7f0000000440)) connect$inet(r0, &(0x7f0000000080)={0x2, 0xe26, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) connect$inet(r0, &(0x7f00000002c0)={0x2, 0x461f, @private=0xa010100}, 0x10) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000100)={0x84, @loopback, 0x4e20, 0x3, 'sed\x00', 0x1a, 0x3, 0x57}, 0x2c) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x2}, [@NFT_MSG_NEWSET={0x118, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2c}, @NFTA_SET_DESC={0xd4, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_DESC_CONCAT={0xc8, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x764f15e2}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0xfffffffffffffdeb}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x28}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xcb}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}]}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa4}]}], {0x14, 0x10}}, 0x140}}, 0x0) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100081, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae03, 0x23) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r9 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r9, &(0x7f0000000680)={0x1d, 0x0, 0x2, {0x2, 0xf0}, 0x1fb}, 0x18) syz_kvm_setup_cpu$x86(r6, r7, &(0x7f0000009000/0x18000)=nil, &(0x7f0000000380)=[@textreal={0x8, &(0x7f0000000300)="66b9800000c00f326635010000000f30bf44000f4af90f30b80e008ed8650f01c4f30fc7b1001066b8d38fffff0f23c80f21f866350000c0000f23f8ba2000b006ee660f380761e2", 0x48}], 0x1, 0x40, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 3.069734424s ago: executing program 0 (id=1384): r0 = openat$audio1(0xffffff9c, &(0x7f0000000000), 0xa8700, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x7fff}}, './file0\x00'}) ioctl$BTRFS_IOC_SEND(r1, 0x40489426, &(0x7f00000000c0)={{r0}, 0x3, &(0x7f0000000080)=[0x5, 0x207, 0x100000001], 0x5, 0x2, 0x1}) ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, &(0x7f0000000140)) 2.840947318s ago: executing program 0 (id=1385): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0002000001, 0xfa11, 0x3}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3800000010003904000000fdff050000000000397587767fecedfbf84c7792189ce82ae7c66fb68cd9d421b2d774d6c2de4707e4fd69b3546111988960aaf5de912986275a60057265b7f46fe33045ecdcbdd1deb6fce116e2943110f168b3ea6bdf05db06ca0af3bf2656cb258ccac0460574976bbaa568d8d498348d3a1518626c416ec51aa634614f62a021ef32af4b2237bd27b7484a46a204c39a069aec21ad8c77a662266e87f1868d9f3c0484de5af7c0a0922f8a473348df0b05adcbb12118a4eab5793e0b8a93a8b1e5fbf54c08b4447adb7e7289d7780d3b3bda64a50d1b2ffbbefed6eaf45f603f14f20fbf1b660aecf8e445662720b45c4c506bf56b1bc4c181118d9deb3de6ecfb14", @ANYRES32=0x0, @ANYBLOB="01980000000000001800128008000100677265000c00028008000700e0000001"], 0x38}, 0x1, 0x0, 0x0, 0x20044080}, 0x8000000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = fsopen(&(0x7f0000000400)='iso9660\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000580)='iocharset', &(0x7f00000005c0)='io#harset', 0x0) unshare(0x24060400) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0x7, 0x2}) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f00000001c0)='ip_vti0\x00', 0x54) bind$xdp(r6, &(0x7f0000000100)={0x2c, 0x4, 0x0, 0x3, r6}, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x1a, &(0x7f0000000d80)=ANY=[@ANYBLOB="18000000020000000000000001000100b7080000000000007b8af8ff00000000b7080000050000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a500000018460000ffffffff0000000000000000851000000600000085000000180000000100000000000000080000009015000004000000186300000c00000000000000040000009500"/112], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) lseek(r7, 0x9, 0x4) 2.776769553s ago: executing program 4 (id=1386): setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000200)=@ccm_128={{0x303}, "73df63ee6e09078a", "6dcc7b221d537b6f996f6f7b0605b37f", "79147bf8", "09000000592f2106"}, 0x28) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000000000000000000000000000000000000300", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00ac6700000000000000000000c2888e7d52164ec480e79200000100", [0x0, 0x2000000000001]}}) 2.587285425s ago: executing program 4 (id=1387): r0 = add_key$keyring(&(0x7f0000000240), &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000000)='dns_resolver\x00', 0x0, &(0x7f0000000040)="308002291ffd2592c3d288b75614dcfaeb05e792080000", 0x17, r0) keyctl$instantiate(0xc, r0, &(0x7f0000000100)=@encrypted_load={'load ', 'ecryptfs', 0x20, 'user:', 'trusted:', 0x20, 0x40}, 0x32, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) 2.534069518s ago: executing program 3 (id=1388): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000fd8f71103b00000000005c050000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000040), 0x10}, 0x94) (async) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) 2.532929026s ago: executing program 3 (id=1389): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e5b, 0x80000000, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x5}, 0x1c) (async) setsockopt$inet6_tcp_int(r1, 0x6, 0x8, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000040)=0x9, 0x4) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000000900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073795a32000000009c000000060a010400000000000000000100000008000b4000000000740004803c0001800b00010065787468647200002c000280080001400000000b0800034000000000080004400000003005000200070000000800064000000003340001800a00010072656469720000002400028008000140000000150800014000000012080002400000000e080003400000000a0900010073797a30"], 0x110}, 0x1, 0x0, 0x0, 0x20040044}, 0x0) (async) ioctl$OCFS2_IOC_REFLINK(r1, 0x40186f04, &(0x7f0000000180)={&(0x7f0000000100)='-@*\x00', &(0x7f0000000140)='#\x00', 0x7}) (async) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000080)={'macvlan1\x00'}) 2.411902447s ago: executing program 4 (id=1390): r0 = semget$private(0x0, 0x4000000009, 0x42a) semop(r0, &(0x7f00000002c0)=[{0x0, 0xff}, {0x0, 0x1f}, {0x4, 0x202}, {0x0, 0x8, 0x1000}, {0x0, 0xfff}], 0x26) semtimedop(r0, &(0x7f0000000000)=[{0x0, 0xfff9, 0x1000}], 0x1, 0x0) (async) semctl$GETZCNT(r0, 0x0, 0xf, 0x0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1001, 0x1}) (async) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) (async) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b18, &(0x7f0000000000)={'veth1_to_batadv\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x7, 0x5, &(0x7f00000007c0)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12}, 0x94) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000001340)=@raw={'raw\x00', 0x8, 0x3, 0x500, 0x340, 0x11, 0x148, 0x340, 0x0, 0x468, 0x2a8, 0x2a8, 0x468, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r3}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x11, 0x0, 0x0, 0x0, '\x00', {0x7}}}}, {{@uncond, 0x0, 0xe8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@osf={{0x50}, {'syz0\x00', 0x0, 0xd, 0x0, 0x2}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x5, 0x3, {0xff}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x560) (async) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r4, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) (async) fremovexattr(r4, &(0x7f0000000000)=@known='system.posix_acl_default\x00') (async) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r1, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) (async) write$apparmor_exec(r6, &(0x7f0000000140)={'exec ', '^\xc9\xe6T\xcfPos\xa6\x8cL\xac^\xdd\'-)^-\x00\xa3\xbc\x8c\xa7\xaa\xd3\xf8|\xef!\v/\xdd\x19\x02\x9d\vdp\x99s\x8a\x99\xbb\xe6\r\xdf\xc34\x1d\t\xd6\xe6\x0f\x8b\xf5R^\xd2\xe6\xfdt\xd6\x9b\xd4bo\x00\x00\x00\x00\x00\x00\x00\x00\x00\xeb\xff\x00'}, 0x1) 2.385991755s ago: executing program 3 (id=1391): r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000080)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) unshare(0x8040480) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setlease(r1, 0x400, 0x2) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000ec0)={0x2c, &(0x7f00000004c0)={0x20, 0x18, 0x2, 'q`'}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000340)={0x1c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0}) 2.177437027s ago: executing program 6 (id=1392): r0 = semget(0x1, 0x4, 0x69c) semop(r0, &(0x7f0000000000)=[{0x0, 0x400, 0x1000}, {0x0, 0xbbdd, 0x1000}], 0x2) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x4b, 0x0, 0x0) mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000006c0), 0x2, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) write$apparmor_exec(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB='exec :'], 0x149) execve(&(0x7f0000000740)='./file0\x00', 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x8, 0xa482}) r2 = syz_open_dev$sndpcmp(&(0x7f0000000080), 0x200, 0x41) mmap$snddsp(&(0x7f000001b000/0xf000)=nil, 0xf000, 0x2, 0x100010, r2, 0xa000) r3 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', &(0x7f0000000340)={0x8000, 0x2a, 0x10}, 0x18) r4 = fsmount(0xffffffffffffffff, 0x1, 0x3) move_mount(r3, &(0x7f0000000440)='./file0\x00', r4, &(0x7f0000000480)='./file0\x00', 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = socket(0x2d, 0x2, 0x0) readv(r5, &(0x7f0000000240)=[{&(0x7f0000000100)=""/251, 0xfb}], 0x1) r6 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r6, 0x0, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x30, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40810, 0x1}, [@IFLA_GROUP={0x8}, @IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x10000}]}, 0x30}, 0x1, 0x0, 0x0, 0x24040051}, 0x4000000) linkat(r4, &(0x7f00000004c0)='./file0\x00', r3, &(0x7f0000000500)='./file0\x00', 0x2400) syz_emit_ethernet(0x8a, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @remote, @void, {@ipv4={0x800, @icmp={{0x6, 0x4, 0x0, 0x0, 0x7c, 0xfffc, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@ra={0x94, 0x4}]}}, @time_exceeded={0x4, 0x0, 0x0, 0x3, 0x0, 0x0, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @multicast2, {[@timestamp_addr={0x44, 0xc, 0x2, 0x1, 0x0, [{@remote, 0x5}]}, @cipso={0x86, 0x2e, 0x3, [{0x6, 0x2}, {0x0, 0x2}, {0x2, 0xf, "d109567cb50ec760777fb80755"}, {0x5, 0xb, "c92d3002d91d907b79"}, {0x0, 0x2}, {0x2, 0x6, "84924d89"}, {0x5, 0x2}]}, @cipso={0x86, 0xb, 0x0, [{0x0, 0x5, "ade34b"}]}]}}}}}}}, 0x0) 2.164228693s ago: executing program 4 (id=1393): io_submit(0x0, 0x1, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x7, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000040)="98803783", 0x4, 0x1000000, 0x0, 0x10}]) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = syz_open_dev$media(&(0x7f0000000000), 0xffffffffffffffff, 0x60b81) ioctl$MEDIA_IOC_REQUEST_ALLOC(r1, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) ioctl$MEDIA_REQUEST_IOC_REINIT(r2, 0x7c81, 0x0) getsockopt$inet_mptcp_buf(r0, 0x11c, 0x2, &(0x7f0000000040)=""/170, &(0x7f0000000140)=0xaa) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079ea01ec000109021b0001000003000904005801785ecc00090585020004"], 0x0) setsockopt(r0, 0x101, 0x3, &(0x7f0000000000)="13344f19a89ea52a932e8893f5dfd9b22a2324781ca2418859a7b30c1a14feecaef7c79c39ecb6cb4ae9b208", 0x2c) 2.058755955s ago: executing program 1 (id=1394): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x180862) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/mem_sleep', 0x80802, 0xcd) r2 = socket(0x840000000002, 0x3, 0xff) setsockopt$inet_int(r2, 0x0, 0x5, 0x0, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x2, 0x6010000000000ffd, 0x0, 0x0, 0x17, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "42d8cc26f7061a74df2cfc1fc89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd0c7f3f800b2f7b6aa54cc50c1fcaed1e831fa79a00", "141802b7ad33000000000000000000000000e4fffffffe0000000000004000", [0xbffffffffffffce8, 0x100]}}) sendfile(r0, r0, 0x0, 0x9) 1.321185233s ago: executing program 1 (id=1395): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r0, @ANYBLOB, @ANYRESHEX=0x0, @ANYRES32=r0, @ANYRES16, @ANYRESHEX=r0, @ANYRES8=r0, @ANYRESOCT=0x0, @ANYRESDEC=r0, @ANYRESHEX=r0], 0x50}, 0x1, 0x0, 0x0, 0x4001}, 0x400c8c5) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) readv(r1, &(0x7f0000000140)=[{0x0}], 0x1) 1.190023379s ago: executing program 1 (id=1396): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x19b6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x9, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0xfe, 0xed}}}}}]}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x30) (async, rerun: 64) r1 = landlock_create_ruleset(&(0x7f0000000140)={0x8b28, 0x3}, 0x18, 0x0) (rerun: 64) landlock_restrict_self(r1, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000a40)='./file0\x00', 0x2) syz_usb_connect$midi(0x0, 0xc0, &(0x7f0000000200)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x1430, 0x474b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xae, 0x1, 0x1, 0xb, 0x30, 0x6e, "", {{{0x9, 0x4, 0x0, 0x0, 0x6, 0x1, 0x3, 0x30, 0x5, [@ms_header={0x7, 0x24, 0x1, 0x4, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x0, 0x7}, @midi_out_jack={0xd, 0x24, 0x3, 0x1, 0xad, 0x3, [{0x3}, {0xc, 0x7}, {0xc0, 0x3}], 0x4b}, @ms_header={0x7, 0x24, 0x1, 0x9ba4, 0x7}], [{{0x9, 0x5, 0xc, 0x0, 0x8, 0x9, 0x9, 0x1, {0x5, 0x25, 0x1, 0x1, 'K'}}}, {{0x9, 0x5, 0x4, 0x2, 0x3ff, 0x80, 0xd, 0x87, {0x7, 0x25, 0x1, 0x3, "1584e6"}}}, {{0x9, 0x5, 0x5, 0x0, 0x0, 0x5, 0x5, 0x6, {0x13, 0x25, 0x1, 0xf, "153eda0ba37748e430ba44f62fda8f"}}}, {{0x9, 0x5, 0x8, 0xc, 0x3ff, 0x5, 0x9, 0x4d, {0xc, 0x25, 0x1, 0x8, "72a2648e66cbe5b0"}}}, {{0x9, 0x5, 0x0, 0x4, 0x400, 0x9, 0x3, 0x9, {0xa, 0x25, 0x1, 0x6, "599752d1922f"}}}, {{0x9, 0x5, 0x5, 0x11, 0x428, 0x6, 0x80, 0x1, {0xf, 0x25, 0x1, 0xb, "d98a7a997920a96cc7a553"}}}]}}}}}]}}, &(0x7f00000004c0)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x250, 0x7, 0x4, 0x3, 0xff, 0x2}, 0x5, &(0x7f0000000300)={0x5, 0xf, 0x5}, 0x4, [{0x62, &(0x7f0000000340)=@string={0x62, 0x3, "1962446a7a1d97630a960f2e7482b0793973a2ae36aa6b2f29c891706146dd21221ec4551609d73ad157ab2998441ce1ef7faf2db2a9ef724244e4892918cfdb82bcfba6ebc321b53d83866e69a3e55c961cc3785a07fef1e01351ad2fd40b38"}}, {0x8, &(0x7f00000003c0)=@string={0x8, 0x3, "7ad55706413b"}}, {0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x420}}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x1007}}]}) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.084201538s ago: executing program 0 (id=1397): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000100)={0x980000, 0x6392, 0xfffffffe, 0xffffffffffffffff, 0x0, 0x0}) (async) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000b80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x2}) (async) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r2, 0xc0145b0d, &(0x7f0000000040)) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_DELSET={0x50, 0xb, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x401}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_DATA_TYPE={0x8, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x479e}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x3, 0x0, 0x0, {0x3}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffd}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFTA_COUNTER_BYTES={0xc}]}]}], {0x14}}, 0xc0}}, 0x0) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[], 0xcc}}, 0x0) 741.228482ms ago: executing program 4 (id=1398): setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000200)=@ccm_128={{0x303}, "73df63ee6e09078a", "6dcc7b221d537b6f996f6f7b0605b37f", "79147bf8", "09000000592f2106"}, 0x28) r0 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000000000000000000000000000000000000400", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00ac6700000000000000000000c2888e7d52164ec480e79200000100", [0x0, 0x2000000000001]}}) 663.078743ms ago: executing program 4 (id=1399): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000480), 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000001b40)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x4000401, 0x8, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf5b1, 0xffffffff, 0x10000000, 0x99, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xfffffff6, 0x0, 0x8, 0x800000, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0xfffff41a, 0x0, 0x0, 0x4, 0x0, 0x0, 0xedc0, 0x0, 0x5ee, 0x9, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xffff8800, 0x0, 0xfffffff8, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x0, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xfffffffa, 0xfffff986], [0x0, 0x7f, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffd, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x2, 0x7fff, 0x0, 0x0, 0x0, 0x3, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0xfffffffe, 0x0, 0xfffffffe, 0x4, 0xfffffffc, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xffffffff, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0x7, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) process_madvise(0xffffffffffffffff, 0x0, 0x0, 0x15, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$FICLONE(r1, 0x40049409, r0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$UI_SET_ABSBIT(r7, 0x40045567, 0x80000000020009) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=@newtfilter={0x74, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff3, 0xc}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x44, 0x2, [@TCA_CGROUP_EMATCHES={0x40, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x34, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x30, 0x1, 0x0, 0x0, {{0xe38, 0x9, 0x4}, [@TCA_EM_IPT_HOOK={0x8}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0xa}, @TCA_EM_IPT_MATCH_DATA={0x5, 0x5, 'K'}]}}]}]}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x84}, 0x40010) connect$can_bcm(r2, &(0x7f00000000c0), 0x10) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x448}}, 0x0) sendmmsg$inet(r2, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)="050000007402b8f4191db62b", 0xc}, {&(0x7f0000000440)="9f336d70bf41f19e47e98b4015e3b0384d86a1ceb4e530554ebc8154bf392bcf9ce0b09f879bd7aaf9d086e3", 0x2c}], 0x2}}, {{0x0, 0x0, &(0x7f0000000100), 0x2}}], 0x40000000000003a, 0x0) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0x3) ioctl$UI_DEV_CREATE(r0, 0x5501) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)}, 0x20) r9 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000400000016000000000000020400000000612e00f7a123a218c3f54dc953ebf0641071cabb6f0933a6ce7a0565fccdededb63b2602e428e8aa6a1af168046b28117b1da9add25e83b6c990fe94627a7ea1c896e355230d9310e7ff6039464a058fa7d253cbd1036af29704204cc427d9bdeffb372af1670b"], &(0x7f0000000240)=""/225, 0x28, 0xe1, 0x0, 0x8a}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, r8, 0xda84, '\x00', 0x0, r9, 0x0, 0x1, 0x4}, 0x50) ioctl$UI_DEV_DESTROY(r0, 0x5502) 448.541294ms ago: executing program 0 (id=1400): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) write$vga_arbiter(r1, &(0x7f0000000000)=ANY=[@ANYBLOB='unlock me'], 0xb) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r2, 0xc02064b9, &(0x7f0000000280)={&(0x7f0000000400)=[0x0, 0x0], &(0x7f0000000280), 0x2, r3}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f0000000380)=[r3], &(0x7f00000003c0)=[0xf], &(0x7f0000000340)=[r4], &(0x7f0000000180), 0x0, 0xff}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x400000f4, 0x0, 0x8001}]}) 0s ago: executing program 0 (id=1401): r0 = fanotify_init(0x200, 0x0) r1 = memfd_create(&(0x7f0000000500)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\xee\xf6Oc8\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Ncp\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xe9fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\xdeQ/\xb8X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31W\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\x0e\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]\xd5\xbe\'U\xf17', 0x1) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) r2 = mq_open(&(0x7f0000001040)='[{\xf2[\x00', 0x80, 0x2, &(0x7f0000001080)={0x81, 0xf6af, 0x6d, 0x5}) mq_timedsend(r2, &(0x7f00000030c0)="c5923413ed800bb63965e8373dadde894c88c3a1c56a223d0f098d98855123b09205c14b6fcbb0f1e3bf1b1ccc8531aee6d119d5102ff5787a3eaf674a909e4041c1b8cf8acee426c1afe5fde942a8564d23db23632c227b12eee955a9c087eabf8a5b0995ce259801b33c1cb367579108c0d4b1", 0x74, 0x2, 0x0) statx(0xffffffffffffffff, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x7100, 0x1, 0x0) r3 = dup(r1) fanotify_mark(r0, 0x1, 0x48000046, r3, 0x0) r4 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r4, &(0x7f00000020c0)=""/4093, 0xffd) keyctl$read(0xb, r4, &(0x7f00000010c0)=""/4096, 0x1000) kernel console output (not intermixed with test programs): syz [ 432.598795][ T5874] usb 2-1: Manufacturer: syz [ 432.603407][ T5874] usb 2-1: SerialNumber: syz [ 432.651851][ T5874] usb 2-1: config 0 descriptor?? [ 432.668368][ T5874] appledisplay 2-1:0.0: Submitting URB failed [ 432.676275][ T42] f81534 1-1:0.12: f81534_get_register: reg: 1003 failed: -32 [ 432.683799][ T42] f81534 1-1:0.12: f81534_find_config_idx: read failed: -32 [ 432.684157][ T5874] appledisplay 2-1:0.0: probe with driver appledisplay failed with error -5 [ 432.697432][ T5932] usb 4-1: Using ep0 maxpacket: 32 [ 432.727105][ T5932] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 432.743570][ T42] f81534 1-1:0.12: f81534_calc_num_ports: find idx failed: -32 [ 432.762804][ T42] f81534 1-1:0.12: probe with driver f81534 failed with error -32 [ 432.772092][ T5932] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 432.801543][ T5932] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 432.815059][ T9745] syz.0.909 (9745): drop_caches: 1 [ 432.819354][ T5932] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 432.831112][ T5932] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 432.852046][ T42] usb 1-1: USB disconnect, device number 77 [ 432.860231][ T9803] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(11) [ 432.867098][ T9803] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 432.895738][ T5874] usb 2-1: USB disconnect, device number 56 [ 432.901711][ T5932] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 432.901742][ T5932] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.901760][ T5932] usb 4-1: Product: syz [ 432.901775][ T5932] usb 4-1: Manufacturer: syz [ 432.901790][ T5932] usb 4-1: SerialNumber: syz [ 432.903671][ T9803] vhci_hcd vhci_hcd.0: Device attached [ 432.945948][ T865] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 432.946272][ T5932] imon:imon_init_intf0: usb_submit_urb failed for intf0 (-90) [ 432.961931][ T9806] vhci_hcd: connection closed [ 432.969908][ T9280] vhci_hcd vhci_hcd.6: stop threads [ 432.971949][ T5932] imon 4-1:155.0: unable to initialize intf0, err -90 [ 432.976073][ T9280] vhci_hcd vhci_hcd.6: release socket [ 432.992602][ T5932] imon:imon_probe: failed to initialize context! [ 433.016449][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 433.030178][ T5932] imon 4-1:155.0: unable to register, err -19 [ 433.036592][ T9280] vhci_hcd vhci_hcd.6: disconnect device [ 433.066052][ T5904] vhci_hcd vhci_hcd.6: vhci_device speed not set [ 433.081387][ T9815] batadv_slave_1: entered promiscuous mode [ 433.088898][ T9814] batadv_slave_1: left promiscuous mode [ 433.106044][ T865] usb 5-1: Using ep0 maxpacket: 32 [ 433.113346][ T865] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 433.127712][ T865] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 433.139361][ T865] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 433.153330][ T865] usb 5-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 433.164121][ T865] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.177082][ T865] usb 5-1: config 0 descriptor?? [ 433.641116][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.655073][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.672231][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.679563][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.735587][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.745620][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.754175][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.762984][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.772154][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.783619][ T865] apple 0003:05AC:024B.0013: unknown main item tag 0x0 [ 433.801048][ T865] apple 0003:05AC:024B.0013: hidraw0: USB HID v0.00 Device [HID 05ac:024b] on usb-dummy_hcd.4-1/input0 [ 433.996626][ T9800] netlink: 'syz.4.924': attribute type 49 has an invalid length. [ 434.076288][ T865] usb 5-1: USB disconnect, device number 59 [ 434.680695][ T9832] fido_id[9832]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 434.686186][ T5144] Bluetooth: hci0: command 0x0406 tx timeout [ 434.701141][ T5905] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 434.709677][ T5905] Bluetooth: hci0: Error when powering off device on rfkill (-110) [ 434.906687][ T9845] netlink: 16 bytes leftover after parsing attributes in process `syz.0.934'. [ 434.934900][ T29] audit: type=1326 audit(1775801096.512:768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 435.466546][ T29] audit: type=1326 audit(1775801096.522:769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 435.514919][ T29] audit: type=1326 audit(1775801096.522:770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 435.540060][ T29] audit: type=1326 audit(1775801096.522:771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 435.585991][ T29] audit: type=1326 audit(1775801096.522:772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 435.608966][ T29] audit: type=1326 audit(1775801096.532:773): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 435.629150][ T5874] usb 4-1: USB disconnect, device number 57 [ 435.631824][ T29] audit: type=1326 audit(1775801096.532:774): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 435.663770][ T9854] netlink: 160 bytes leftover after parsing attributes in process `syz.1.937'. [ 435.673163][ T9854] netlink: 160 bytes leftover after parsing attributes in process `syz.1.937'. [ 435.682856][ T29] audit: type=1326 audit(1775801096.532:775): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f7f6df9e087 code=0x7ffc0000 [ 435.682900][ T29] audit: type=1326 audit(1775801096.532:776): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f7f6df5d04e code=0x7ffc0000 [ 435.682938][ T29] audit: type=1326 audit(1775801096.532:777): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9842 comm="syz.0.934" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f7f6df5d04e code=0x7ffc0000 [ 435.751627][ T865] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 435.916284][ T865] usb 5-1: Using ep0 maxpacket: 8 [ 435.923272][ T865] usb 5-1: config 0 has an invalid interface number: 86 but max is 0 [ 435.931621][ T865] usb 5-1: config 0 has no interface number 0 [ 435.945056][ T865] usb 5-1: New USB device found, idVendor=07ca, idProduct=1867, bcdDevice=f0.d3 [ 435.954790][ T865] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 435.965614][ T865] usb 5-1: config 0 descriptor?? [ 436.096311][ T9863] SET target dimension over the limit! [ 436.211884][ T5874] usb 5-1: USB disconnect, device number 60 [ 436.295948][ T5904] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 436.329759][ T9867] random: crng reseeded on system resumption [ 436.355970][ T865] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 436.445958][ T5904] usb 1-1: Using ep0 maxpacket: 8 [ 436.453815][ T5904] usb 1-1: unable to get BOS descriptor or descriptor too short [ 436.470943][ T5904] usb 1-1: config 4 interface 0 has no altsetting 0 [ 436.511989][ T5904] usb 1-1: string descriptor 0 read error: -22 [ 436.515936][ T865] usb 4-1: Using ep0 maxpacket: 32 [ 436.523567][ T5904] usb 1-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 436.524966][ T865] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 436.541333][ T865] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 436.551609][ T865] usb 4-1: config 0 has no interface number 0 [ 436.558227][ T5904] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 436.560736][ T865] usb 4-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 436.629282][ T865] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 436.639171][ T865] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 436.647423][ T865] usb 4-1: Product: syz [ 436.651903][ T865] usb 4-1: Manufacturer: syz [ 436.654286][ T5904] usb 1-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 436.665268][ T865] usb 4-1: SerialNumber: syz [ 436.673671][ T5904] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 436.695344][ T865] usb 4-1: config 0 descriptor?? [ 436.715489][ T865] radio-si470x 4-1:0.35: could not find interrupt in endpoint [ 436.726183][ T865] radio-si470x 4-1:0.35: probe with driver radio-si470x failed with error -5 [ 436.764753][ T5904] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 436.779817][ T5904] usb 1-1: media controller created [ 436.812983][ T5904] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 436.846196][ T5144] Bluetooth: hci3: command 0x0406 tx timeout [ 436.852970][ T5905] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 436.859730][ T5905] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 436.913593][ T865] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 436.925646][ T865] usbhid 4-1:0.35: couldn't find an input interrupt endpoint [ 437.108999][ T5904] zl10353_read_register: readreg error (reg=127, ret==0) [ 437.124409][ T5932] usb 4-1: USB disconnect, device number 58 [ 437.215147][ T5904] usb 1-1: USB disconnect, device number 78 [ 437.657098][ T9909] netlink: 'syz.6.946': attribute type 4 has an invalid length. [ 437.672252][ T9909] netlink: 'syz.6.946': attribute type 4 has an invalid length. [ 437.749728][ T9923] netlink: 'syz.3.949': attribute type 10 has an invalid length. [ 437.762785][ T9923] 8021q: adding VLAN 0 to HW filter on device team0 [ 437.773492][ T9923] bond0: (slave team0): Enslaving as an active interface with an up link [ 437.961629][ T42] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 438.142701][ T42] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 438.311447][ T42] usb 2-1: config 0 has no interface number 0 [ 438.322898][ T42] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 438.334915][ T42] usb 2-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 438.345178][ T42] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 438.354480][ T42] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 438.392092][ T42] usb 2-1: config 0 descriptor?? [ 438.616905][ T9954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 438.653465][ T9962] netlink: 'syz.4.955': attribute type 322 has an invalid length. [ 438.684704][ T9954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 438.727675][ T9952] netlink: 16 bytes leftover after parsing attributes in process `syz.6.953'. [ 438.874430][ T42] input: HID 04d9:a055 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.1/0003:04D9:A055.0014/input/input45 [ 438.926271][ T5905] Bluetooth: hci1: Opcode 0x0c1a failed: -110 [ 438.933048][ T9977] netlink: 'syz.4.956': attribute type 1 has an invalid length. [ 438.941088][ T5144] Bluetooth: hci1: command 0x0406 tx timeout [ 438.986025][ T5905] Bluetooth: hci1: Error when powering off device on rfkill (-110) [ 439.038715][ T9986] netlink: 4 bytes leftover after parsing attributes in process `syz.4.956'. [ 439.112902][ T9991] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 439.123224][ T9991] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 439.220603][ T9977] 8021q: adding VLAN 0 to HW filter on device bond5 [ 439.245336][ T42] holtek_kbd 0003:04D9:A055.0014: input,hidraw0: USB HID v0.00 Keyboard [HID 04d9:a055] on usb-dummy_hcd.1-1/input1 [ 439.385977][ T796] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 439.407311][ T42] usb 2-1: USB disconnect, device number 57 [ 439.519687][T10045] fido_id[10045]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/2-1/report_descriptor': No such file or directory [ 439.557622][ T796] usb 5-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 439.576907][ T796] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.598921][ T796] usb 5-1: config 0 descriptor?? [ 439.623265][ T796] gspca_main: sunplus-2.14.0 probing 055f:c420 [ 439.890396][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.897460][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.336317][ T9977] netlink: 36 bytes leftover after parsing attributes in process `syz.4.956'. [ 440.449939][ T42] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 440.463094][ T9977] bond5: (slave geneve4): making interface the new active one [ 440.507734][ T9977] bond5: (slave geneve4): Enslaving as an active interface with an up link [ 440.525687][ T796] gspca_sunplus: reg_w_riv err -71 [ 440.531268][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 440.546419][ T796] sunplus 5-1:0.0: probe with driver sunplus failed with error -71 [ 440.631163][ T42] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 440.645535][ T42] usb 4-1: config 2 has 1 interface, different from the descriptor's value: 3 [ 440.658743][ T796] usb 5-1: USB disconnect, device number 61 [ 440.704014][ T42] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=bd.95 [ 440.716063][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.743127][ T42] usb 4-1: Product: syz [ 440.759420][ T42] usb 4-1: Manufacturer: syz [ 440.767397][ T42] usb 4-1: SerialNumber: syz [ 440.768468][T10107] netlink: 'syz.6.967': attribute type 322 has an invalid length. [ 440.936419][T10115] dummy0: entered allmulticast mode [ 441.146720][T10079] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 441.188552][T10079] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 441.247713][ T5144] Bluetooth: hci5: command 0x0406 tx timeout [ 441.254259][ T5905] Bluetooth: hci5: Opcode 0x0c1a failed: -110 [ 441.261054][ T42] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 441.282592][ T5905] Bluetooth: hci5: Error when powering off device on rfkill (-110) [ 441.521423][ T42] dvb_usb_af9015 4-1:2.0: probe with driver dvb_usb_af9015 failed with error -22 [ 441.545533][ T42] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 441.552313][ T42] dvb_usb_af9035 4-1:2.0: probe with driver dvb_usb_af9035 failed with error -22 [ 441.627886][ T42] usb 4-1: USB disconnect, device number 60 [ 442.239770][T10187] netlink: 8 bytes leftover after parsing attributes in process `syz.0.971'. [ 442.675926][ T9804] usb 4-1: new full-speed USB device number 61 using dummy_hcd [ 442.831769][ T9804] usb 4-1: config 3 interface 0 has no altsetting 0 [ 442.841160][ T9804] usb 4-1: New USB device found, idVendor=5fc9, idProduct=0063, bcdDevice=d0.db [ 442.853848][ T9804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.875488][ T9804] usb 4-1: Product: syz [ 442.905886][ T9804] usb 4-1: Manufacturer: syz [ 442.929729][ T9804] usb 4-1: SerialNumber: syz [ 443.010818][T10225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.975'. [ 443.190335][ T9804] usb 4-1: USB disconnect, device number 61 [ 443.436041][T10249] x_tables: duplicate underflow at hook 4 [ 443.888912][ T29] kauditd_printk_skb: 7 callbacks suppressed [ 443.888924][ T29] audit: type=1326 audit(1775801105.502:785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10252 comm="syz.1.977" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f5ff0b9c819 code=0x0 [ 443.942073][T10256] kvm: emulating exchange as write [ 444.066065][ T29] audit: type=1326 audit(1775801105.672:786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.126174][ T5903] usb 4-1: new full-speed USB device number 62 using dummy_hcd [ 444.140194][ T29] audit: type=1326 audit(1775801105.672:787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=140 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.146373][T10269] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 444.217964][ T29] audit: type=1326 audit(1775801105.672:788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.255964][ T9] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 444.283860][ T29] audit: type=1326 audit(1775801105.682:789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.337623][ T5903] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 444.357957][ T5903] usb 4-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 444.367216][ T5903] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.375216][ T5903] usb 4-1: Product: syz [ 444.385890][ T29] audit: type=1326 audit(1775801105.742:790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.415864][ T5903] usb 4-1: Manufacturer: syz [ 444.420481][ T5903] usb 4-1: SerialNumber: syz [ 444.436827][ T29] audit: type=1326 audit(1775801105.742:791): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.439549][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 444.460046][ T5903] usb 4-1: config 0 descriptor?? [ 444.489582][ T5903] usbtouchscreen 4-1:0.0: probe with driver usbtouchscreen failed with error -12 [ 444.526162][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 444.526367][ T29] audit: type=1326 audit(1775801105.762:792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.581652][T10277] fuse: Bad value for 'user_id' [ 444.602648][T10277] fuse: Bad value for 'user_id' [ 444.610195][ T9] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 0 [ 444.620797][ T29] audit: type=1326 audit(1775801105.822:793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.632360][ T9] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 444.661188][ T29] audit: type=1326 audit(1775801105.822:794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10268 comm="syz.0.979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 444.696150][ T9] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 444.719947][ T9] usb 2-1: Product: syz [ 444.724138][ T9] usb 2-1: Manufacturer: syz [ 444.739344][ T9] usb 2-1: SerialNumber: syz [ 444.777683][ T9] usb 2-1: config 0 descriptor?? [ 446.578150][ T796] usb 2-1: USB disconnect, device number 58 [ 446.780594][T10331] fuse: Bad value for 'fd' [ 447.435178][T10355] batadv_slave_1: entered promiscuous mode [ 447.463136][T10353] netlink: 12 bytes leftover after parsing attributes in process `syz.6.995'. [ 447.518070][T10355] batadv_slave_1: left promiscuous mode [ 447.594406][ T5905] usb 4-1: USB disconnect, device number 62 [ 447.926913][ T5903] usb 1-1: new low-speed USB device number 79 using dummy_hcd [ 447.943608][T10382] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.967267][T10389] FAULT_INJECTION: forcing a failure. [ 447.967267][T10389] name failslab, interval 1, probability 0, space 0, times 1 [ 447.980345][T10389] CPU: 1 UID: 0 PID: 10389 Comm: syz.4.1001 Tainted: G L syzkaller #0 PREEMPT(full) [ 447.980372][T10389] Tainted: [L]=SOFTLOCKUP [ 447.980377][T10389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 447.980395][T10389] Call Trace: [ 447.980402][T10389] [ 447.980409][T10389] dump_stack_lvl+0xe8/0x150 [ 447.980438][T10389] should_fail_ex+0x412/0x560 [ 447.980467][T10389] should_failslab+0xa8/0x100 [ 447.980488][T10389] ? vm_area_dup+0x2b/0x680 [ 447.980508][T10389] kmem_cache_alloc_noprof+0x87/0x650 [ 447.980526][T10389] ? __lock_acquire+0x6b5/0x2cf0 [ 447.980554][T10389] vm_area_dup+0x2b/0x680 [ 447.980576][T10389] __split_vma+0x1dc/0xa40 [ 447.980611][T10389] ? __pfx___split_vma+0x10/0x10 [ 447.980641][T10389] ? register_lock_class+0x31/0x2e0 [ 447.980667][T10389] vma_modify+0x91b/0x2060 [ 447.980701][T10389] vma_modify_flags+0x24b/0x330 [ 447.980724][T10389] ? __pfx_vma_modify_flags+0x10/0x10 [ 447.980760][T10389] ? mas_next_slot+0xc20/0xcf0 [ 447.980784][T10389] mlock_fixup+0x29b/0x430 [ 447.980810][T10389] ? __pfx_mlock_fixup+0x10/0x10 [ 447.980840][T10389] ? mas_find+0xb0e/0xd30 [ 447.980866][T10389] apply_vma_lock_flags+0x2af/0x3e0 [ 447.980891][T10389] ? __pfx_apply_vma_lock_flags+0x10/0x10 [ 447.980918][T10389] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 447.980946][T10389] do_mlock+0x558/0x750 [ 447.980975][T10389] ? __pfx_do_mlock+0x10/0x10 [ 447.980994][T10389] ? fput+0xa0/0xd0 [ 447.981018][T10389] ? ksys_write+0x242/0x270 [ 447.981038][T10389] ? __pfx_ksys_write+0x10/0x10 [ 447.981063][T10389] __x64_sys_mlock+0x60/0x70 [ 447.981084][T10389] do_syscall_64+0x14d/0xf80 [ 447.981103][T10389] ? trace_irq_disable+0x3b/0x150 [ 447.981116][T10389] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.981132][T10389] ? clear_bhb_loop+0x40/0x90 [ 447.981152][T10389] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.981171][T10389] RIP: 0033:0x7f01d559c819 [ 447.981190][T10389] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.981206][T10389] RSP: 002b:00007f01d6534028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 447.981223][T10389] RAX: ffffffffffffffda RBX: 00007f01d5815fa0 RCX: 00007f01d559c819 [ 447.981234][T10389] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 0000200000bff000 [ 447.981245][T10389] RBP: 00007f01d6534090 R08: 0000000000000000 R09: 0000000000000000 [ 447.981254][T10389] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 447.981263][T10389] R13: 00007f01d5816038 R14: 00007f01d5815fa0 R15: 00007f01d593fa48 [ 447.981290][T10389] [ 448.272956][T10382] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.298133][T10392] netlink: 'syz.3.998': attribute type 16 has an invalid length. [ 448.306912][T10392] netlink: 'syz.3.998': attribute type 17 has an invalid length. [ 448.333752][T10392] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.340953][T10392] bridge0: port 1(bridge_slave_0) entered listening state [ 448.354595][T10392] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.361778][T10392] bridge0: port 2(bridge_slave_1) entered listening state [ 448.413295][ T5903] usb 1-1: LPM exit latency is zeroed, disabling LPM. [ 448.424035][ T5903] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 448.437611][ T5903] usb 1-1: string descriptor 0 read error: -22 [ 448.443907][ T5903] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 448.452981][ T5903] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 448.552612][ T5903] usb 1-1: bad CDC descriptors [ 448.646047][ T5905] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 448.666305][ T9804] usb 1-1: USB disconnect, device number 79 [ 448.682934][T10412] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1004'. [ 448.896571][ T5905] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 448.905223][ T5905] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 448.946714][ T5905] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 448.965484][T10423] syzkaller0: entered promiscuous mode [ 448.971108][T10423] syzkaller0: entered allmulticast mode [ 448.983048][ T5905] usb 4-1: config 1 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 449.050782][ T5905] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 449.060470][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 449.084748][ T5905] usb 4-1: Product: syz [ 449.089481][ T5905] usb 4-1: Manufacturer: syz [ 449.107880][ T5905] cdc_wdm 4-1:1.0: skipping garbage [ 449.116724][ T5905] cdc_wdm 4-1:1.0: skipping garbage [ 449.128928][ T5905] cdc_wdm 4-1:1.0: probe with driver cdc_wdm failed with error -22 [ 449.365388][ T5905] usb 4-1: USB disconnect, device number 63 [ 449.636109][ T9] usb 1-1: new low-speed USB device number 80 using dummy_hcd [ 449.788534][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 449.801270][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 449.810723][ T9] usb 1-1: can't read configurations, error -61 [ 449.865915][ T9804] usb 4-1: new full-speed USB device number 64 using dummy_hcd [ 449.899468][T10461] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1009'. [ 449.946004][ T9] usb 1-1: new low-speed USB device number 81 using dummy_hcd [ 450.037682][ T9804] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 1023 [ 450.058518][ T9804] usb 4-1: New USB device found, idVendor=1235, idProduct=0018, bcdDevice= 0.40 [ 450.068301][ T9804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 450.080828][T10469] af_packet: tpacket_rcv: packet too big, clamped from 64993 to 4294967272. macoff=96 [ 450.086448][ T9804] usb 4-1: Product: syz [ 450.099824][ T9804] usb 4-1: Manufacturer: syz [ 450.104442][ T9804] usb 4-1: SerialNumber: syz [ 450.142202][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 450.197068][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 450.204678][ T9] usb 1-1: can't read configurations, error -61 [ 450.226653][ T9] usb usb1-port1: attempt power cycle [ 450.288698][T10482] FAULT_INJECTION: forcing a failure. [ 450.288698][T10482] name failslab, interval 1, probability 0, space 0, times 0 [ 450.335979][T10482] CPU: 1 UID: 0 PID: 10482 Comm: syz.1.1013 Tainted: G L syzkaller #0 PREEMPT(full) [ 450.336009][T10482] Tainted: [L]=SOFTLOCKUP [ 450.336015][T10482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 450.336026][T10482] Call Trace: [ 450.336033][T10482] [ 450.336041][T10482] dump_stack_lvl+0xe8/0x150 [ 450.336069][T10482] should_fail_ex+0x412/0x560 [ 450.336101][T10482] should_failslab+0xa8/0x100 [ 450.336123][T10482] ? mas_alloc_nodes+0x291/0x350 [ 450.336144][T10482] kmem_cache_alloc_noprof+0x87/0x650 [ 450.336172][T10482] mas_alloc_nodes+0x291/0x350 [ 450.336197][T10482] mas_preallocate+0x2d6/0x640 [ 450.336219][T10482] ? rcu_is_watching+0x15/0xb0 [ 450.336248][T10482] ? __pfx_mas_preallocate+0x10/0x10 [ 450.336280][T10482] ? __mas_set_range+0x12f/0x3c0 [ 450.336310][T10482] __split_vma+0x318/0xa40 [ 450.336346][T10482] ? __pfx___split_vma+0x10/0x10 [ 450.336390][T10482] vma_modify+0x91b/0x2060 [ 450.336429][T10482] vma_modify_flags+0x24b/0x330 [ 450.336455][T10482] ? __pfx_vma_modify_flags+0x10/0x10 [ 450.336497][T10482] ? mas_next_slot+0xc20/0xcf0 [ 450.336525][T10482] mlock_fixup+0x29b/0x430 [ 450.336553][T10482] ? __pfx_mlock_fixup+0x10/0x10 [ 450.336578][T10482] ? mas_find+0xb0e/0xd30 [ 450.336611][T10482] apply_vma_lock_flags+0x2af/0x3e0 [ 450.336640][T10482] ? __pfx_apply_vma_lock_flags+0x10/0x10 [ 450.336674][T10482] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 450.336704][T10482] do_mlock+0x558/0x750 [ 450.336736][T10482] ? __pfx_do_mlock+0x10/0x10 [ 450.336758][T10482] ? fput+0xa0/0xd0 [ 450.336783][T10482] ? ksys_write+0x242/0x270 [ 450.336805][T10482] ? __pfx_ksys_write+0x10/0x10 [ 450.336822][T10482] ? __task_pid_nr_ns+0x28/0x470 [ 450.336847][T10482] __x64_sys_mlock+0x60/0x70 [ 450.336870][T10482] do_syscall_64+0x14d/0xf80 [ 450.336891][T10482] ? trace_irq_disable+0x3b/0x150 [ 450.336907][T10482] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.336924][T10482] ? clear_bhb_loop+0x40/0x90 [ 450.336947][T10482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 450.336965][T10482] RIP: 0033:0x7f5ff0b9c819 [ 450.336982][T10482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 450.336997][T10482] RSP: 002b:00007f5ff19da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 450.337016][T10482] RAX: ffffffffffffffda RBX: 00007f5ff0e15fa0 RCX: 00007f5ff0b9c819 [ 450.337030][T10482] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 0000200000bff000 [ 450.337041][T10482] RBP: 00007f5ff19da090 R08: 0000000000000000 R09: 0000000000000000 [ 450.337053][T10482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 450.337063][T10482] R13: 00007f5ff0e16038 R14: 00007f5ff0e15fa0 R15: 00007f5ff0f3fa48 [ 450.337092][T10482] [ 450.585909][ T9] usb 1-1: new low-speed USB device number 82 using dummy_hcd [ 450.631439][ T9804] usb 4-1: selecting invalid altsetting 1 [ 450.646762][ T9804] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 450.673828][ T9804] usb 4-1: selecting invalid altsetting 1 [ 450.685512][ T9804] snd-usb-audio 4-1:1.1: probe with driver snd-usb-audio failed with error -22 [ 450.752013][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 450.761661][ T9804] usb 4-1: selecting invalid altsetting 1 [ 450.785327][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 450.803857][ T9] usb 1-1: can't read configurations, error -61 [ 450.840510][T10499] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 450.882700][ T9804] snd-usb-audio 4-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 450.896393][ T9804] usb 4-1: USB disconnect, device number 64 [ 450.931806][ T7899] udevd[7899]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.2/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 450.955961][ T796] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 450.967497][ T9] usb 1-1: new low-speed USB device number 83 using dummy_hcd [ 450.990901][ T9] usb 1-1: unable to get BOS descriptor or descriptor too short [ 451.000126][ T9] usb 1-1: unable to read config index 0 descriptor/start: -61 [ 451.007805][ T9] usb 1-1: can't read configurations, error -61 [ 451.014290][ T9] usb usb1-port1: unable to enumerate USB device [ 451.147967][ T796] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 451.165618][ T796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.190347][ T796] usb 2-1: Product: syz [ 451.194541][ T796] usb 2-1: Manufacturer: syz [ 451.205798][ T796] usb 2-1: SerialNumber: syz [ 451.255129][ T796] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 451.316866][ T5903] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 451.349953][ T5932] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 451.518752][ T5903] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 451.528839][ T5903] usb 5-1: config 0 has no interface number 0 [ 451.550387][ T5903] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 451.587809][ T5903] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 451.607202][ T5903] usb 5-1: New USB device found, idVendor=28bd, idProduct=0905, bcdDevice= 0.00 [ 451.641129][ T5903] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 451.666698][ T5903] usb 5-1: config 0 descriptor?? [ 451.825932][ T9804] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 451.987730][ T9804] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 452.034413][ T9804] usb 4-1: config 1 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 452.083652][ T5903] uclogic 0003:28BD:0905.0015: Interface probing failed: -22 [ 452.099247][ T9804] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 452.105056][ T5903] uclogic 0003:28BD:0905.0015: interface is invalid, ignoring [ 452.116557][ T9804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.124561][ T9804] usb 4-1: Product: syz [ 452.160202][ T9804] usb 4-1: Manufacturer: syz [ 452.164824][ T9804] usb 4-1: SerialNumber: syz [ 452.202590][ T9] usb 2-1: USB disconnect, device number 59 [ 452.220969][ T9804] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 452.246118][ T5905] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 452.286087][T10520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 452.346547][T10520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 452.375559][ T5932] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 452.393258][ T5932] ath9k_htc: Failed to initialize the device [ 452.400010][ T5903] usb 5-1: USB disconnect, device number 62 [ 452.434945][ T9] usb 2-1: ath9k_htc: USB layer deinitialized [ 452.450648][ T42] usb 4-1: USB disconnect, device number 65 [ 452.886908][T10613] FAULT_INJECTION: forcing a failure. [ 452.886908][T10613] name failslab, interval 1, probability 0, space 0, times 0 [ 452.920840][T10613] CPU: 0 UID: 0 PID: 10613 Comm: syz.1.1024 Tainted: G L syzkaller #0 PREEMPT(full) [ 452.920870][T10613] Tainted: [L]=SOFTLOCKUP [ 452.920877][T10613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 452.920888][T10613] Call Trace: [ 452.920895][T10613] [ 452.920903][T10613] dump_stack_lvl+0xe8/0x150 [ 452.920932][T10613] should_fail_ex+0x412/0x560 [ 452.920963][T10613] should_failslab+0xa8/0x100 [ 452.920985][T10613] ? anon_vma_clone+0x3e5/0x9f0 [ 452.921005][T10613] kmem_cache_alloc_noprof+0x87/0x650 [ 452.921031][T10613] anon_vma_clone+0x3e5/0x9f0 [ 452.921061][T10613] __split_vma+0x38a/0xa40 [ 452.921096][T10613] ? __pfx___split_vma+0x10/0x10 [ 452.921139][T10613] vma_modify+0x91b/0x2060 [ 452.921177][T10613] vma_modify_flags+0x24b/0x330 [ 452.921203][T10613] ? __pfx_vma_modify_flags+0x10/0x10 [ 452.921244][T10613] ? mas_next_slot+0xc20/0xcf0 [ 452.921272][T10613] mlock_fixup+0x29b/0x430 [ 452.921302][T10613] ? __pfx_mlock_fixup+0x10/0x10 [ 452.921327][T10613] ? mas_find+0xb0e/0xd30 [ 452.921353][T10613] apply_vma_lock_flags+0x2af/0x3e0 [ 452.921383][T10613] ? __pfx_apply_vma_lock_flags+0x10/0x10 [ 452.921417][T10613] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 452.921448][T10613] do_mlock+0x558/0x750 [ 452.921480][T10613] ? __pfx_do_mlock+0x10/0x10 [ 452.921503][T10613] ? fput+0xa0/0xd0 [ 452.921529][T10613] ? ksys_write+0x242/0x270 [ 452.921550][T10613] ? __pfx_ksys_write+0x10/0x10 [ 452.921577][T10613] __x64_sys_mlock+0x60/0x70 [ 452.921607][T10613] do_syscall_64+0x14d/0xf80 [ 452.921629][T10613] ? trace_irq_disable+0x3b/0x150 [ 452.921645][T10613] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.921664][T10613] ? clear_bhb_loop+0x40/0x90 [ 452.921685][T10613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 452.921704][T10613] RIP: 0033:0x7f5ff0b9c819 [ 452.921721][T10613] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.921737][T10613] RSP: 002b:00007f5ff19da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 452.921757][T10613] RAX: ffffffffffffffda RBX: 00007f5ff0e15fa0 RCX: 00007f5ff0b9c819 [ 452.921771][T10613] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 0000200000bff000 [ 452.921782][T10613] RBP: 00007f5ff19da090 R08: 0000000000000000 R09: 0000000000000000 [ 452.921793][T10613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.921803][T10613] R13: 00007f5ff0e16038 R14: 00007f5ff0e15fa0 R15: 00007f5ff0f3fa48 [ 452.921831][T10613] [ 453.491228][ T5905] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 453.498338][ T5905] ath9k_htc: Failed to initialize the device [ 453.505616][ T42] usb 4-1: ath9k_htc: USB layer deinitialized [ 453.580786][T10615] bridge0: port 2(bridge_slave_1) entered disabled state [ 453.588126][T10615] bridge0: port 1(bridge_slave_0) entered disabled state [ 453.901020][ T42] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 453.974134][T10615] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 454.012545][T10615] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 454.066236][ T42] usb 4-1: Using ep0 maxpacket: 32 [ 454.073460][ T42] usb 4-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config [ 454.083940][ T42] usb 4-1: config 1 interface 0 altsetting 0 has 5 endpoint descriptors, different from the interface descriptor's value: 6 [ 454.109051][ T42] usb 4-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 1.08 [ 454.119404][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.135950][ T42] usb 4-1: Product: syz [ 454.144506][ T42] usb 4-1: Manufacturer: syz [ 454.152440][ T42] usb 4-1: SerialNumber: syz [ 454.169814][ T42] ldusb 4-1:1.0: LD USB Device #0 now attached to major 180 minor 0 [ 454.349840][ T9563] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.377597][ T9563] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.410521][ T9563] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.441122][ T9563] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.525701][T10649] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1026'. [ 454.541768][ T5905] usb 4-1: USB disconnect, device number 66 [ 454.564074][ T5905] ldusb 4-1:1.0: LD USB Device #0 now disconnected [ 454.616022][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 454.712213][ T29] kauditd_printk_skb: 62 callbacks suppressed [ 454.712231][ T29] audit: type=1800 audit(1775801116.322:857): pid=10666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1027" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=36137 res=0 errno=0 [ 455.014284][ T29] audit: type=1326 audit(1775801116.622:858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10679 comm="syz.3.1030" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f73beb9c819 code=0x0 [ 455.076829][ T29] audit: type=1326 audit(1775801116.672:859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10679 comm="syz.3.1030" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f73beb9c819 code=0x0 [ 455.172617][T10699] netlink: 120 bytes leftover after parsing attributes in process `syz.3.1030'. [ 455.483694][T10715] binder: 10713:10715 ioctl c0306201 2000000003c0 returned -22 [ 455.927862][T10742] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 455.936863][T10742] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1038'. [ 455.945941][T10742] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1038'. [ 456.332273][T10769] netlink: 64 bytes leftover after parsing attributes in process `syz.1.1043'. [ 456.343871][T10769] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1043'. [ 456.355969][ T5874] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 456.397023][T10769] 8021q: adding VLAN 0 to HW filter on device bond2 [ 456.408228][T10803] vlan2: entered allmulticast mode [ 456.413342][T10803] syz_tun: entered allmulticast mode [ 456.425188][T10803] bond2: (slave vlan2): Enslaving as an active interface with an up link [ 456.544158][ T5874] usb 1-1: config 1 interface 0 has no altsetting 0 [ 456.558361][ T5874] usb 1-1: string descriptor 0 read error: -22 [ 456.564735][ T5874] usb 1-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.40 [ 456.574669][ T5874] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.866162][ T796] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 456.892644][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.901599][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 456.919607][T10819] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 456.934219][T10819] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.039872][ T796] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 457.049294][ T796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.060942][ T796] usb 2-1: Product: syz [ 457.065182][ T796] usb 2-1: Manufacturer: syz [ 457.070297][ T796] usb 2-1: SerialNumber: syz [ 457.094546][ T796] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 457.112777][ T42] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 457.122347][ T5932] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 457.289130][T10849] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1688227217 (3376454434 ns) > initial count (1786943000 ns). Using initial count to start timer. [ 457.357986][ T5932] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 457.369330][ T5932] usb 5-1: config 0 has no interface number 0 [ 457.385015][ T5932] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 457.400320][ T5932] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 457.421987][ T5932] usb 5-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.18 [ 457.431612][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 457.447892][ T5932] usb 5-1: config 0 descriptor?? [ 457.549597][T10858] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.1049'. [ 457.669126][ T5932] usbhid 5-1:0.1: can't add hid device: -71 [ 457.678114][ T5932] usbhid 5-1:0.1: probe with driver usbhid failed with error -71 [ 457.711773][ T5932] usb 5-1: USB disconnect, device number 63 [ 457.885847][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 458.365860][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 458.798221][ T42] usb 2-1: Service connection timeout for: 256 [ 458.804504][ T42] ath9k_htc 2-1:1.0: ath9k_htc: Unable to initialize HTC services [ 459.003700][ T42] ath9k_htc: Failed to initialize the device [ 459.113064][ T42] usb 2-1: ath9k_htc: USB layer deinitialized [ 459.160618][ T5874] usbhid 1-1:1.0: can't add hid device: -71 [ 459.166780][ T5874] usbhid 1-1:1.0: probe with driver usbhid failed with error -71 [ 459.212827][ T5874] usb 1-1: USB disconnect, device number 84 [ 459.313986][T10910] syzkaller0: entered promiscuous mode [ 459.320671][T10910] syzkaller0: entered allmulticast mode [ 459.375980][ T5895] usb 2-1: USB disconnect, device number 60 [ 459.625801][T10932] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1058'. [ 459.872226][T10870] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 459.882102][T10870] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 459.907692][T10870] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 459.923829][T10870] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 459.940854][T10870] batman_adv: batadv0: Removing interface: ip6erspan0 [ 459.955563][T10954] loop9: detected capacity change from 0 to 524287936 [ 459.966066][ T42] usb 1-1: new full-speed USB device number 85 using dummy_hcd [ 460.118546][ T42] usb 1-1: unable to get BOS descriptor or descriptor too short [ 460.139880][ T42] usb 1-1: not running at top speed; connect to a high speed hub [ 460.157351][ T42] usb 1-1: invalid descriptor for config index 0: type = 0x2, length = 50 [ 460.173909][ T42] usb 1-1: can't read configurations, error -22 [ 460.326297][ T42] usb 1-1: new full-speed USB device number 86 using dummy_hcd [ 460.487944][ T42] usb 1-1: unable to get BOS descriptor or descriptor too short [ 460.498608][ T42] usb 1-1: not running at top speed; connect to a high speed hub [ 460.510389][ T42] usb 1-1: invalid descriptor for config index 0: type = 0x2, length = 50 [ 460.540352][ T42] usb 1-1: can't read configurations, error -22 [ 460.551071][ T42] usb usb1-port1: attempt power cycle [ 460.918112][ T42] usb 1-1: new full-speed USB device number 87 using dummy_hcd [ 460.958740][ T42] usb 1-1: unable to get BOS descriptor or descriptor too short [ 460.972453][ T42] usb 1-1: not running at top speed; connect to a high speed hub [ 460.986891][ T42] usb 1-1: invalid descriptor for config index 0: type = 0x2, length = 50 [ 461.001034][ T42] usb 1-1: can't read configurations, error -22 [ 461.150222][ T29] audit: type=1800 audit(1775801122.762:860): pid=10984 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1064" name=20019C1437B3CFFCC3A25729EB7393A7C721518FF6ECA56673F56C7B548772D22972A7D6084F9A98F5323A22F412C0542BCD9F767C8DD5B24476638E93D8D6A0C536D278E3633A dev="mqueue" ino=40857 res=0 errno=0 [ 461.159372][ T42] usb 1-1: new full-speed USB device number 88 using dummy_hcd [ 461.298662][T10991] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1066'. [ 461.313135][T10991] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1617207373 (3234414746 ns) > initial count (443187862 ns). Using initial count to start timer. [ 461.435077][ T42] usb 1-1: unable to get BOS descriptor or descriptor too short [ 461.493226][ T42] usb 1-1: not running at top speed; connect to a high speed hub [ 461.503395][ T42] usb 1-1: invalid descriptor for config index 0: type = 0x2, length = 50 [ 461.512209][ T42] usb 1-1: can't read configurations, error -22 [ 461.522578][ T42] usb usb1-port1: unable to enumerate USB device [ 462.005908][ T5895] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 462.011520][T11038] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 462.175907][ T5895] usb 4-1: Using ep0 maxpacket: 16 [ 462.183590][ T5895] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 462.200265][ T5895] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 462.212409][ T5895] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 39329, setting to 1024 [ 462.246348][ T5895] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 1024 [ 462.259633][ T5895] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 462.272294][ T5895] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 462.280449][ T5895] usb 4-1: SerialNumber: syz [ 462.300692][T11028] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 462.328377][ T5895] cdc_acm 4-1:1.0: skipping garbage [ 462.335344][ T5895] cdc_acm 4-1:1.0: probe with driver cdc_acm failed with error -12 [ 462.531737][ T5895] usb 4-1: USB disconnect, device number 67 [ 462.641786][T11070] pimreg: entered allmulticast mode [ 462.649901][T11070] pimreg: left allmulticast mode [ 462.924574][ T29] audit: type=1326 audit(1775801124.532:861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11098 comm="syz.0.1078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 462.996068][ T29] audit: type=1326 audit(1775801124.562:862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11098 comm="syz.0.1078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 463.019286][ T29] audit: type=1326 audit(1775801124.602:863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11098 comm="syz.0.1078" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 463.240923][T11115] netlink: 188 bytes leftover after parsing attributes in process `syz.3.1081'. [ 463.526104][ T5932] usb 4-1: new low-speed USB device number 68 using dummy_hcd [ 463.629074][T11134] fuse: Unknown parameter 'fd0x000000000000000900000000000000000000' [ 463.689293][T11131] 000000000: renamed from bond_slave_0 (while UP) [ 463.710021][ T42] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 463.741127][T11134] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 463.785283][ T5932] usb 4-1: config 0 has an invalid interface number: 55 but max is 0 [ 463.796454][ T5932] usb 4-1: config 0 has no interface number 0 [ 463.805516][ T5932] usb 4-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 463.824010][ T5932] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 463.847666][ T5932] usb 4-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 463.871372][ T5932] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 463.899922][ T5932] usb 4-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 463.929414][ T5932] usb 4-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 463.945893][ T42] usb 5-1: Using ep0 maxpacket: 32 [ 463.961845][ T42] usb 5-1: config 0 has an invalid interface number: 12 but max is 0 [ 463.977419][ T42] usb 5-1: config 0 has an invalid descriptor of length 135, skipping remainder of the config [ 463.995873][ T5932] usb 4-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 464.015317][ T42] usb 5-1: config 0 has no interface number 0 [ 464.021461][ T5932] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 464.032929][ T42] usb 5-1: too many endpoints for config 0 interface 12 altsetting 124: 113, using maximum allowed: 30 [ 464.054986][ T5932] usb 4-1: config 0 descriptor?? [ 464.063199][T11117] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 464.070788][T11117] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 464.080309][ T42] usb 5-1: config 0 interface 12 altsetting 124 has 0 endpoint descriptors, different from the interface descriptor's value: 113 [ 464.097111][ T5932] ldusb 4-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 464.130951][ T42] usb 5-1: config 0 interface 12 has no altsetting 0 [ 464.162603][ T42] usb 5-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 464.182442][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.202936][ T42] usb 5-1: Product: syz [ 464.211745][ T42] usb 5-1: Manufacturer: syz [ 464.220721][ T42] usb 5-1: SerialNumber: syz [ 464.293947][T11117] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1082'. [ 464.296998][ T42] usb 5-1: config 0 descriptor?? [ 464.309014][ T5895] usb 4-1: USB disconnect, device number 68 [ 464.315006][ C0] ldusb 4-1:0.55: usb_submit_urb failed (-19) [ 464.322954][T11117] ldusb 4-1:0.55: Couldn't submit interrupt_out_urb -19 [ 464.339131][ T5895] ldusb 4-1:0.55: LD USB Device #0 now disconnected [ 464.538301][ T42] f81534 5-1:0.12: required endpoints missing [ 464.557585][ T42] usb 5-1: USB disconnect, device number 64 [ 464.723023][T11175] loop2: detected capacity change from 0 to 1 [ 464.748116][T11175] loop2: [POWERTEC] p1 p2 [ 464.756085][T11175] loop2: p1 start 655360 is beyond EOD, truncated [ 464.770144][T11175] loop2: p2 start 4915200 is beyond EOD, truncated [ 465.386129][ T5874] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 465.513335][T11243] netlink: 'syz.1.1090': attribute type 23 has an invalid length. [ 465.546238][ T5905] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 465.560864][T11245] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1092'. [ 465.686043][ T5874] usb 5-1: device descriptor read/64, error -71 [ 465.710667][ T5905] usb 1-1: unable to get BOS descriptor or descriptor too short [ 465.721694][ T5905] usb 1-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice= 0.40 [ 465.731705][ T5905] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 465.741494][ T5905] usb 1-1: Product: syz [ 465.746684][ T5905] usb 1-1: Manufacturer: syz [ 465.751944][ T5905] usb 1-1: SerialNumber: syz [ 465.926310][ T5874] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 466.056128][ T5874] usb 5-1: device descriptor read/64, error -71 [ 466.167078][ T5874] usb usb5-port1: attempt power cycle [ 466.478856][ T5905] usb 1-1: unit 5 not found! [ 466.483634][ T5905] usb 1-1: unit 3 not found! [ 466.506412][ T5874] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 466.526809][ T5874] usb 5-1: device descriptor read/8, error -71 [ 466.730142][T11280] netlink: 'syz.0.1100': attribute type 9 has an invalid length. [ 466.738309][T11280] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.1100'. [ 466.780710][ T5874] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 466.816649][ T5874] usb 5-1: device descriptor read/8, error -71 [ 466.936608][ T5874] usb usb5-port1: unable to enumerate USB device [ 466.971841][T11280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 466.982030][T11280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 467.005891][ T5932] usb 2-1: new high-speed USB device number 62 using dummy_hcd [ 467.025186][ T5905] snd-usb-us122l 1-1:1.1: usb_set_interface error [ 467.041914][ T5905] snd-usb-us122l 1-1:1.1: probe with driver snd-usb-us122l failed with error -22 [ 467.073702][ T5905] usb 1-1: USB disconnect, device number 89 [ 467.330627][ T5932] usb 2-1: Using ep0 maxpacket: 8 [ 467.383349][ T5932] usb 2-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 467.392839][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.401295][ T5932] usb 2-1: Product: syz [ 467.406128][ T5932] usb 2-1: Manufacturer: syz [ 467.410743][ T5932] usb 2-1: SerialNumber: syz [ 467.435557][T11315] fuse: Unknown parameter '' [ 468.034297][ T5932] usb 2-1: clock source 0 is not valid, cannot use [ 468.046997][ T29] audit: type=1326 audit(1775801129.662:864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.070018][ T29] audit: type=1326 audit(1775801129.662:865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.096874][ T29] audit: type=1326 audit(1775801129.702:866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.130427][ T29] audit: type=1326 audit(1775801129.702:867): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.188975][ T29] audit: type=1326 audit(1775801129.702:868): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.244507][ T29] audit: type=1326 audit(1775801129.702:869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.298926][ T29] audit: type=1326 audit(1775801129.702:870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.326740][ T29] audit: type=1326 audit(1775801129.702:871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.351534][ T29] audit: type=1326 audit(1775801129.702:872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.355900][ T5905] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 468.384630][ T29] audit: type=1326 audit(1775801129.702:873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11327 comm="syz.6.1102" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9559c819 code=0x7ffc0000 [ 468.515997][ T5905] usb 4-1: device descriptor read/64, error -71 [ 468.755939][ T5905] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 468.886010][ T5905] usb 4-1: device descriptor read/64, error -71 [ 468.996440][ T5905] usb usb4-port1: attempt power cycle [ 469.335903][ T5905] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 469.356460][ T5905] usb 4-1: device descriptor read/8, error -71 [ 469.371235][T11385] xt_l2tp: v2 doesn't support IP mode [ 469.597978][ T5905] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 469.630224][ T5905] usb 4-1: device descriptor read/8, error -71 [ 469.670842][ T5932] usb 2-1: 1:1: cannot get freq (v2/v3): err -71 [ 469.698424][ T5932] usb 2-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 469.721565][ T5932] usb 2-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 469.756189][ T5905] usb usb4-port1: unable to enumerate USB device [ 469.763826][ T5932] usb 2-1: clock source 0 is not valid, cannot use [ 469.787313][ T5932] usb 2-1: 2:1: cannot get freq (v2/v3): err -71 [ 469.811582][ T5932] usb 2-1: uac_clock_source_is_valid(): cannot get clock validity for id 0 [ 469.960736][ T5932] usb 2-1: USB disconnect, device number 62 [ 470.022869][ T7906] udevd[7906]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 470.070449][T11424] netlink: 'syz.6.1116': attribute type 2 has an invalid length. [ 470.094202][T11424] netlink: 164 bytes leftover after parsing attributes in process `syz.6.1116'. [ 470.265890][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 470.287663][T11442] netlink: 'syz.6.1117': attribute type 1 has an invalid length. [ 470.364346][T11442] 8021q: adding VLAN 0 to HW filter on device bond3 [ 470.368518][T11482] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1117'. [ 470.456045][ T5932] usb 2-1: new full-speed USB device number 63 using dummy_hcd [ 470.527379][T11495] FAULT_INJECTION: forcing a failure. [ 470.527379][T11495] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 470.541763][T11495] CPU: 0 UID: 0 PID: 11495 Comm: syz.4.1122 Tainted: G L syzkaller #0 PREEMPT(full) [ 470.541791][T11495] Tainted: [L]=SOFTLOCKUP [ 470.541798][T11495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 470.541808][T11495] Call Trace: [ 470.541814][T11495] [ 470.541821][T11495] dump_stack_lvl+0xe8/0x150 [ 470.541849][T11495] should_fail_ex+0x412/0x560 [ 470.541875][T11495] prepare_alloc_pages+0x22a/0x650 [ 470.541898][T11495] __alloc_frozen_pages_noprof+0x12f/0x380 [ 470.541918][T11495] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 470.541938][T11495] ? __pfx_policy_nodemask+0x10/0x10 [ 470.541958][T11495] ? lruvec_stat_mod_folio+0x70/0x4b0 [ 470.541981][T11495] alloc_pages_mpol+0x232/0x4a0 [ 470.542002][T11495] vma_alloc_folio_noprof+0xea/0x210 [ 470.542022][T11495] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 470.542041][T11495] ? _raw_spin_unlock+0x28/0x50 [ 470.542057][T11495] ? __pte_alloc+0x15e/0x1a0 [ 470.542075][T11495] do_pte_missing+0x1656/0x3490 [ 470.542097][T11495] ? mtree_range_walk+0x6a7/0x840 [ 470.542121][T11495] handle_mm_fault+0x1bec/0x3310 [ 470.542141][T11495] ? mt_find+0x186/0x630 [ 470.542166][T11495] ? handle_mm_fault+0xee/0x3310 [ 470.542191][T11495] ? __pfx_handle_mm_fault+0x10/0x10 [ 470.542228][T11495] __get_user_pages+0x165b/0x29d0 [ 470.542268][T11495] populate_vma_page_range+0x2be/0x3c0 [ 470.542289][T11495] ? __pfx_populate_vma_page_range+0x10/0x10 [ 470.542311][T11495] ? down_read+0x272/0x2e0 [ 470.542329][T11495] ? __mm_populate+0x173/0x390 [ 470.542349][T11495] __mm_populate+0x25f/0x390 [ 470.542369][T11495] ? __pfx___mm_populate+0x10/0x10 [ 470.542395][T11495] do_mlock+0x646/0x750 [ 470.542419][T11495] ? __pfx_do_mlock+0x10/0x10 [ 470.542436][T11495] ? fput+0xa0/0xd0 [ 470.542456][T11495] ? ksys_write+0x242/0x270 [ 470.542472][T11495] ? __pfx_ksys_write+0x10/0x10 [ 470.542485][T11495] ? __task_pid_nr_ns+0x28/0x470 [ 470.542504][T11495] __x64_sys_mlock+0x60/0x70 [ 470.542521][T11495] do_syscall_64+0x14d/0xf80 [ 470.542538][T11495] ? trace_irq_disable+0x3b/0x150 [ 470.542550][T11495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.542564][T11495] ? clear_bhb_loop+0x40/0x90 [ 470.542580][T11495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.542593][T11495] RIP: 0033:0x7f01d559c819 [ 470.542606][T11495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 470.542617][T11495] RSP: 002b:00007f01d6534028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 470.542633][T11495] RAX: ffffffffffffffda RBX: 00007f01d5815fa0 RCX: 00007f01d559c819 [ 470.542643][T11495] RDX: 0000000000000000 RSI: 0000000000400000 RDI: 0000200000bff000 [ 470.542652][T11495] RBP: 00007f01d6534090 R08: 0000000000000000 R09: 0000000000000000 [ 470.542660][T11495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 470.542668][T11495] R13: 00007f01d5816038 R14: 00007f01d5815fa0 R15: 00007f01d593fa48 [ 470.542689][T11495] [ 470.851763][ T5905] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 470.868636][ T5932] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 470.925935][ T5932] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 470.952623][ T5932] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 470.986626][ T5905] usb 1-1: device descriptor read/64, error -71 [ 471.017364][T11510] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 471.037213][ T5932] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 471.082027][ T5932] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 471.118037][ T5932] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 471.146263][ T5932] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 471.154393][ T5932] usb 2-1: Product: syz [ 471.161659][ T5932] usb 2-1: Manufacturer: syz [ 471.177382][ T5932] usb 2-1: SerialNumber: syz [ 471.191733][ T5932] usb 2-1: config 0 descriptor?? [ 471.226765][ T5905] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 471.369728][ T5905] usb 1-1: device descriptor read/64, error -71 [ 471.389011][T11535] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1128'. [ 471.398294][T11535] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1128'. [ 471.411160][ T5932] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 471.421735][ T5932] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 471.487385][ T5905] usb usb1-port1: attempt power cycle [ 471.594700][T11535] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1128'. [ 471.627311][T11535] openvswitch: netlink: IPv4 frag type 64 is out of range max 2 [ 471.736723][ T5932] radio-si470x 2-1:0.0: software version 0, hardware version 0 [ 471.771066][ T5932] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 471.784156][ T5932] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 471.798296][ T5932] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 471.845897][ T5905] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 471.847177][ T5932] radio-si470x 2-1:0.0: submitting int urb failed (-90) [ 471.871759][ T5905] usb 1-1: device descriptor read/8, error -71 [ 471.928450][ T5932] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71 [ 471.947555][ T5932] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22 [ 471.968436][T11589] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1134'. [ 471.988931][T11589] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1134'. [ 471.998460][ T5932] usb 2-1: USB disconnect, device number 63 [ 472.126182][ T5905] usb 1-1: new high-speed USB device number 93 using dummy_hcd [ 472.156858][ T5905] usb 1-1: device descriptor read/8, error -71 [ 472.252809][T11616] netlink: 'syz.4.1136': attribute type 1 has an invalid length. [ 472.267396][T11615] netlink: 'syz.4.1136': attribute type 1 has an invalid length. [ 472.276610][ T5905] usb usb1-port1: unable to enumerate USB device [ 472.335268][T11615] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1136'. [ 472.541937][T11648] binder: 11647:11648 ioctl c018620c 200000000000 returned -22 [ 472.854519][T11673] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1146'. [ 472.869097][ T5932] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 472.909159][T11673] : entered promiscuous mode [ 472.968606][T11682] netlink: 'syz.1.1148': attribute type 1 has an invalid length. [ 473.008080][T11683] netlink: 'syz.1.1148': attribute type 1 has an invalid length. [ 473.045912][ T5932] usb 5-1: Using ep0 maxpacket: 16 [ 473.056406][ T5932] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 473.061404][T11683] bond3: entered promiscuous mode [ 473.072914][T11683] 8021q: adding VLAN 0 to HW filter on device bond3 [ 473.077508][ T5932] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 473.201859][T11723] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1149'. [ 473.296023][ T5932] usb 5-1: New USB device found, idVendor=5543, idProduct=0047, bcdDevice= 0.00 [ 473.315414][ T5932] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 473.343981][ T29] kauditd_printk_skb: 14 callbacks suppressed [ 473.343997][ T29] audit: type=1326 audit(1775801134.952:888): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11729 comm="syz.3.1151" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f73beb9c819 code=0x0 [ 473.849300][ T5932] usb 5-1: config 0 descriptor?? [ 473.948938][ T5905] usb 2-1: new low-speed USB device number 64 using dummy_hcd [ 474.172729][ T5905] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 190, changing to 4 [ 474.213397][ T5905] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 512, setting to 0 [ 474.272324][ T5905] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 32, setting to 0 [ 474.305654][ T5905] usb 2-1: string descriptor 0 read error: -22 [ 474.318918][ T5905] usb 2-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice= 0.40 [ 474.337556][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.405690][T11771] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1157'. [ 474.465071][T11655] netlink: 277 bytes leftover after parsing attributes in process `syz.4.1141'. [ 474.503224][ T5932] usb 5-1: string descriptor 0 read error: -71 [ 474.516355][ T5932] uclogic 0003:5543:0047.0016: failed retrieving string descriptor #200: -71 [ 474.526540][ T5932] uclogic 0003:5543:0047.0016: failed retrieving pen parameters: -71 [ 474.548244][ T5932] uclogic 0003:5543:0047.0016: failed probing pen v2 parameters: -71 [ 474.559776][ T5932] uclogic 0003:5543:0047.0016: failed probing parameters: -71 [ 474.900648][ T5932] uclogic 0003:5543:0047.0016: probe with driver uclogic failed with error -71 [ 475.006947][ T5932] usb 5-1: USB disconnect, device number 69 [ 475.686347][T10631] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 475.826872][T10631] usb 4-1: device descriptor read/64, error -71 [ 476.105951][T10631] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 476.241379][ T42] usb 2-1: USB disconnect, device number 64 [ 476.343697][T10631] usb 4-1: device descriptor read/64, error -71 [ 476.478034][T10631] usb usb4-port1: attempt power cycle [ 476.570622][T11881] sctp: [Deprecated]: syz.1.1166 (pid 11881) Use of int in max_burst socket option. [ 476.570622][T11881] Use struct sctp_assoc_value instead [ 476.811679][T11886] netlink: 'syz.4.1167': attribute type 21 has an invalid length. [ 476.820767][T11886] netlink: 'syz.4.1167': attribute type 6 has an invalid length. [ 476.825991][ T5905] usb 1-1: new high-speed USB device number 94 using dummy_hcd [ 476.828678][T11886] __nla_validate_parse: 2 callbacks suppressed [ 476.828692][T11886] netlink: 132 bytes leftover after parsing attributes in process `syz.4.1167'. [ 476.852721][T10631] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 476.876823][T10631] usb 4-1: device descriptor read/8, error -71 [ 476.989216][ T5905] usb 1-1: Using ep0 maxpacket: 32 [ 476.998537][ T5905] usb 1-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 477.011570][ T5905] usb 1-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 477.037401][ T5905] usb 1-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 477.048542][ T5905] usb 1-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 477.067264][ T5905] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 477.078482][ T5905] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.096770][ T5905] usb 1-1: Product: syz [ 477.100963][ T5905] usb 1-1: Manufacturer: syz [ 477.110970][ T5905] usb 1-1: SerialNumber: syz [ 477.123152][ C0] imon 1-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 477.132407][ T5905] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/input/input47 [ 477.136176][T10631] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 477.187620][T10631] usb 4-1: device descriptor read/8, error -71 [ 477.219652][T11896] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1169'. [ 477.228877][T11896] openvswitch: netlink: nsh attr 13105 is out of range max 3 [ 477.245958][ T5932] usb 5-1: new high-speed USB device number 70 using dummy_hcd [ 477.296272][T10631] usb usb4-port1: unable to enumerate USB device [ 477.336343][ T5905] imon 1-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 477.347966][ T5905] (id 0x00) [ 477.404765][ T5932] usb 5-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 477.407455][ T5905] rc_core: IR keymap rc-imon-pad not found [ 477.429934][ T5932] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 477.440071][ T5932] usb 5-1: Product: syz [ 477.444261][ T5932] usb 5-1: Manufacturer: syz [ 477.449267][ T5932] usb 5-1: SerialNumber: syz [ 477.454083][ T5905] Registered IR keymap rc-empty [ 477.461362][ T5905] imon 1-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 477.461603][ T5932] usb 5-1: config 0 descriptor?? [ 477.483793][ T5905] imon 1-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 477.492655][ T5932] gspca_main: sq905c-2.14.0 probing 2770:9052 [ 477.539523][ T5905] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0 [ 477.559435][ T5905] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:155.0/rc/rc0/input48 [ 477.575594][ T5905] imon 1-1:155.0: iMON device (15c2:ffdc, intf0) on usb<1:94> initialized [ 477.693133][ T5932] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 477.707453][T11915] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1171'. [ 477.707883][ T5932] sq905c 5-1:0.0: Get version command failed [ 477.723062][ T5932] sq905c 5-1:0.0: probe with driver sq905c failed with error -71 [ 477.735406][ T5932] usb 5-1: USB disconnect, device number 70 [ 478.102507][T11943] imon:vfd_write: invalid payload size [ 478.454037][ T5905] usb 4-1: new full-speed USB device number 77 using dummy_hcd [ 478.495963][ T9804] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 478.645097][ T5905] usb 4-1: unable to get BOS descriptor or descriptor too short [ 478.653447][ T5905] usb 4-1: not running at top speed; connect to a high speed hub [ 478.661652][ T9804] usb 5-1: Using ep0 maxpacket: 16 [ 478.674414][ T9804] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 478.693661][ T5905] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 478.705481][ T9804] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 478.719763][ T5905] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 147, changing to 4 [ 478.731326][ T5905] usb 4-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 478.746277][ T9804] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 478.755709][ T9804] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.764355][ T5905] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 478.773877][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.782127][ T9804] usb 5-1: Product: syz [ 478.786691][ T9804] usb 5-1: Manufacturer: syz [ 478.791289][ T9804] usb 5-1: SerialNumber: syz [ 478.796010][ T5905] usb 4-1: Product: syz [ 478.800565][ T5905] usb 4-1: Manufacturer: syz [ 478.810149][ T5905] usb 4-1: SerialNumber: syz [ 478.817051][ T9804] usb 5-1: config 0 descriptor?? [ 478.828063][ T9804] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 478.840293][ T9804] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 478.926876][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 478.935293][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 479.233952][T11953] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 479.249131][T11953] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 479.470391][ T9804] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 479.478336][ T9804] em28xx 5-1:0.0: Config register raw data: 0x00 [ 479.492468][ T5932] usb 1-1: USB disconnect, device number 94 [ 479.681591][ T9804] usb 5-1: USB disconnect, device number 71 [ 479.689343][ T9804] em28xx 5-1:0.0: Disconnecting em28xx [ 479.703069][ T9804] em28xx 5-1:0.0: Freeing device [ 480.476200][ T9804] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 480.626018][ T9804] usb 5-1: Using ep0 maxpacket: 32 [ 480.638990][ T9804] usb 5-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 480.664583][ T9804] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 480.715222][ T9804] usb 5-1: config 0 descriptor?? [ 480.803286][ T9804] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 481.441334][ T5905] usb 4-1: USB disconnect, device number 77 [ 481.592846][T12070] IPVS: set_ctl: invalid protocol: 60 10.1.1.2:20004 [ 481.617284][ T5874] IPVS: starting estimator thread 0... [ 481.735933][T12100] IPVS: using max 56 ests per chain, 134400 per kthread [ 481.966111][ T5905] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 482.127783][ T5905] usb 4-1: Using ep0 maxpacket: 32 [ 482.136032][ T5905] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 482.149845][ T5905] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 482.163662][ T5905] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 482.185785][ T5905] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 482.218556][ T5905] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 482.235872][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 482.243915][ T5905] usb 4-1: Product: syz [ 482.265983][ T5905] usb 4-1: Manufacturer: syz [ 482.270603][ T5905] usb 4-1: SerialNumber: syz [ 482.292978][ C0] imon 4-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 482.316078][ T5905] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input49 [ 482.376741][ T5932] usb 1-1: new full-speed USB device number 95 using dummy_hcd [ 482.506547][ T5905] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 482.514822][ T5905] (id 0x00) [ 482.547886][ T5932] usb 1-1: config 255 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 482.561080][ T5932] usb 1-1: New USB device found, idVendor=04b4, idProduct=bca1, bcdDevice= 0.00 [ 482.565880][ T5905] rc_core: IR keymap rc-imon-pad not found [ 482.570202][ T5932] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.579775][ T5905] Registered IR keymap rc-empty [ 482.600787][ T5905] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 482.611474][ T5905] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 482.633601][ T9804] gspca_vc032x: reg_r err -71 [ 482.643987][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.649734][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.655152][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.661867][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.667378][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.672709][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.678227][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.683556][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.689416][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.694748][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.700366][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.705665][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.711172][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.717790][ T5905] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0 [ 482.728287][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.733570][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.741220][ T5905] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0/input50 [ 482.752100][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.757864][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.763148][ T9804] gspca_vc032x: I2c Bus Busy Wait 00 [ 482.770537][ T9804] gspca_vc032x: Unknown sensor... [ 482.776034][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 482.777168][ T9804] vc032x 5-1:0.0: probe with driver vc032x failed with error -22 [ 482.791616][ T5905] imon 4-1:155.0: iMON device (15c2:ffdc, intf0) on usb<4:78> initialized [ 482.806106][ T9804] usb 5-1: USB disconnect, device number 72 [ 483.273451][T12159] imon:vfd_write: invalid payload size [ 483.477459][ T29] audit: type=1800 audit(1775801145.092:889): pid=12174 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1195" name="SYSV00000000" dev="tmpfs" ino=3 res=0 errno=0 [ 484.158293][T12185] mac80211_hwsim hwsim18 : renamed from wlan1 [ 484.674212][ T5895] usb 4-1: USB disconnect, device number 78 [ 484.855669][T12212] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 485.347810][T12226] netlink: 'syz.1.1203': attribute type 3 has an invalid length. [ 486.032296][ T5895] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 486.199410][ T5895] usb 4-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 486.208841][ T5895] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.380284][ T5895] usb 4-1: Product: syz [ 486.400956][ T5895] usb 4-1: Manufacturer: syz [ 486.415758][ T5895] usb 4-1: SerialNumber: syz [ 486.441761][ T5895] usb 4-1: config 0 descriptor?? [ 486.464906][ T5895] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 486.866204][ T5895] gspca_sunplus: reg_w_riv err -71 [ 486.877562][ T5895] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 486.914775][ T5895] usb 4-1: USB disconnect, device number 79 [ 487.475946][ T5904] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 487.563672][ T29] audit: type=1326 audit(1775801149.172:890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 487.637192][ T29] audit: type=1326 audit(1775801149.172:891): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 487.679075][ T5904] usb 5-1: Using ep0 maxpacket: 32 [ 487.698558][ T5904] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 487.719528][ T29] audit: type=1326 audit(1775801149.172:892): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 487.745931][ T5904] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 487.745960][ T5905] usb 4-1: new full-speed USB device number 80 using dummy_hcd [ 487.783383][ T5904] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 487.802049][ T29] audit: type=1326 audit(1775801149.172:893): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 487.829738][ T5904] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 487.873441][ T5904] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 487.884321][ T29] audit: type=1326 audit(1775801149.172:894): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=126 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 487.911962][ T5904] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.929903][ T5904] usb 5-1: Product: syz [ 487.941441][ T5904] usb 5-1: Manufacturer: syz [ 487.942910][ T5905] usb 4-1: unable to get BOS descriptor or descriptor too short [ 487.957410][ T5905] usb 4-1: not running at top speed; connect to a high speed hub [ 487.967285][ T5932] usb 1-1: string descriptor 0 read error: -32 [ 487.969234][ T5905] usb 4-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 487.983442][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.983467][ T29] audit: type=1326 audit(1775801149.172:895): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 487.994518][ T5905] usb 4-1: Product: syz [ 488.018207][ T5904] usb 5-1: SerialNumber: syz [ 488.022117][ T5932] usbhid 1-1:255.0: couldn't find an input interrupt endpoint [ 488.044821][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 488.054737][ T5904] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input51 [ 488.058030][ T5905] usb 4-1: Manufacturer: syz [ 488.071752][ T5905] usb 4-1: SerialNumber: syz [ 488.083479][ T29] audit: type=1326 audit(1775801149.172:896): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 488.127978][ T29] audit: type=1326 audit(1775801149.172:897): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 488.172958][ T29] audit: type=1326 audit(1775801149.172:898): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12308 comm="syz.1.1216" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5ff0b9c819 code=0x7ffc0000 [ 488.255918][ T5904] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 488.264292][ T5904] (id 0x00) [ 488.303569][T12303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.324861][T12303] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 488.428022][ T5904] rc_core: IR keymap rc-imon-pad not found [ 488.433869][ T5904] Registered IR keymap rc-empty [ 488.492079][ T5904] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 488.524798][ T5904] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 488.563420][ T5904] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 488.583005][ T5904] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input52 [ 488.625215][ T5904] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:73> initialized [ 488.786270][ T5905] usb 4-1: USB disconnect, device number 80 [ 489.106796][T12373] imon:vfd_write: invalid payload size [ 490.204378][ T5904] usb 5-1: USB disconnect, device number 73 [ 490.326902][T12397] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1224'. [ 490.563435][T12413] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1225'. [ 490.717368][T12429] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 490.744111][T12432] tipc: Started in network mode [ 490.751280][T12432] tipc: Node identity 22067248fc1f, cluster identity 4711 [ 490.758665][T12432] tipc: Enabled bearer , priority 0 [ 490.765695][T12433] syzkaller0: entered promiscuous mode [ 490.772568][T12433] syzkaller0: entered allmulticast mode [ 490.794138][T12433] tipc: Resetting bearer [ 490.801060][T12429] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 490.833799][T12439] xt_TCPMSS: Only works on TCP SYN packets [ 490.960919][T12433] tipc: Disabling bearer [ 491.151688][T12453] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1231'. [ 491.618466][T12474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 491.639310][T12474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 491.673768][T12474] FAULT_INJECTION: forcing a failure. [ 491.673768][T12474] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 491.693104][T12474] CPU: 1 UID: 0 PID: 12474 Comm: syz.0.1235 Tainted: G L syzkaller #0 PREEMPT(full) [ 491.693132][T12474] Tainted: [L]=SOFTLOCKUP [ 491.693139][T12474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 491.693149][T12474] Call Trace: [ 491.693157][T12474] [ 491.693165][T12474] dump_stack_lvl+0xe8/0x150 [ 491.693193][T12474] should_fail_ex+0x412/0x560 [ 491.693224][T12474] _copy_to_user+0x31/0xb0 [ 491.693247][T12474] simple_read_from_buffer+0xe1/0x170 [ 491.693276][T12474] proc_fail_nth_read+0x1bb/0x230 [ 491.693304][T12474] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 491.693332][T12474] ? rw_verify_area+0x2a6/0x4d0 [ 491.693351][T12474] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 491.693377][T12474] vfs_read+0x20c/0xa70 [ 491.693395][T12474] ? fdget_pos+0x246/0x320 [ 491.693410][T12474] ? ksys_write+0x1e6/0x270 [ 491.693432][T12474] ? __pfx___mutex_lock+0x10/0x10 [ 491.693456][T12474] ? __pfx_vfs_read+0x10/0x10 [ 491.693477][T12474] ? __fget_files+0x2a/0x420 [ 491.693497][T12474] ? __fget_files+0x3a0/0x420 [ 491.693512][T12474] ? __fget_files+0x2a/0x420 [ 491.693536][T12474] ksys_read+0x150/0x270 [ 491.693558][T12474] ? __pfx_ksys_read+0x10/0x10 [ 491.693588][T12474] do_syscall_64+0x14d/0xf80 [ 491.693610][T12474] ? trace_irq_disable+0x3b/0x150 [ 491.693625][T12474] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.693643][T12474] ? clear_bhb_loop+0x40/0x90 [ 491.693664][T12474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.693682][T12474] RIP: 0033:0x7f7f6df5d04e [ 491.693699][T12474] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 491.693715][T12474] RSP: 002b:00007f7f6eeb6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 491.693734][T12474] RAX: ffffffffffffffda RBX: 00007f7f6eeb76c0 RCX: 00007f7f6df5d04e [ 491.693747][T12474] RDX: 000000000000000f RSI: 00007f7f6eeb70a0 RDI: 0000000000000005 [ 491.693766][T12474] RBP: 00007f7f6eeb7090 R08: 0000000000000000 R09: 0000000000000000 [ 491.693777][T12474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.693787][T12474] R13: 00007f7f6e216038 R14: 00007f7f6e215fa0 R15: 00007f7f6e33fa48 [ 491.693817][T12474] [ 491.865879][ T5905] usb 2-1: new high-speed USB device number 65 using dummy_hcd [ 491.876498][ T5904] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 492.075899][ T5904] usb 5-1: Using ep0 maxpacket: 32 [ 492.093505][ T5904] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 492.104066][ T5904] usb 5-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 492.116343][ T5905] usb 2-1: Using ep0 maxpacket: 32 [ 492.116480][ T5904] usb 5-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 492.137304][ T5904] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 492.161780][ T5905] usb 2-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 492.162219][ T5904] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 492.185927][ T5904] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.186384][ T5905] usb 2-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 492.194087][ T5904] usb 5-1: Product: syz [ 492.215992][ T5904] usb 5-1: Manufacturer: syz [ 492.220762][ T5904] usb 5-1: SerialNumber: syz [ 492.246352][ T5905] usb 2-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 492.255963][ C1] imon 5-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 492.261524][ T5905] usb 2-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 492.286971][ T5904] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/input/input53 [ 492.340253][ T5905] usb 2-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 492.351374][ T5905] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.375952][ T5905] usb 2-1: Product: syz [ 492.380135][ T5905] usb 2-1: Manufacturer: syz [ 492.391786][ T5905] usb 2-1: SerialNumber: syz [ 492.419571][ C0] imon 2-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 492.436454][ T5905] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/input/input55 [ 492.506139][ T5904] imon 5-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 492.514524][ T5904] (id 0x00) [ 492.532842][T12514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.543051][T12514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 492.615920][ T5904] rc_core: IR keymap rc-imon-pad not found [ 492.621855][ T5904] Registered IR keymap rc-empty [ 492.627740][ T5904] imon 5-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 492.640175][ T5904] imon 5-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 492.651280][ T5905] imon 2-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 492.659625][ T5905] (id 0x00) [ 492.698993][ T5904] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0 [ 492.721971][ T5904] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:155.0/rc/rc0/input54 [ 492.739780][ T5905] rc_core: IR keymap rc-imon-pad not found [ 492.742307][ T5904] imon 5-1:155.0: iMON device (15c2:ffdc, intf0) on usb<5:74> initialized [ 492.755983][ T5905] Registered IR keymap rc-empty [ 492.789608][ T5905] imon 2-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 492.810273][ T5905] imon 2-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 492.857598][ T5905] rc rc1: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc1 [ 492.879570][ T5905] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:155.0/rc/rc1/input56 [ 492.909731][ T5905] imon 2-1:155.0: iMON device (15c2:ffdc, intf0) on usb<2:65> initialized [ 492.956132][ T42] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 492.957128][T12544] bridge0: port 3(hsr0) entered blocking state [ 492.970484][T12544] bridge0: port 3(hsr0) entered disabled state [ 492.989075][T12544] hsr0: entered allmulticast mode [ 493.005126][T12544] hsr_slave_0: entered allmulticast mode [ 493.029973][T12544] hsr_slave_1: entered allmulticast mode [ 493.037713][T12476] imon:display_open: display port is already open [ 493.053359][T12544] hsr0: entered promiscuous mode [ 493.128095][ T42] usb 4-1: config 0 has an invalid interface number: 41 but max is 0 [ 493.136365][ T42] usb 4-1: config 0 has no interface number 0 [ 493.142978][ T42] usb 4-1: config 0 interface 41 has no altsetting 0 [ 493.239098][ T42] usb 4-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 493.251469][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 493.304757][ T42] usb 4-1: Product: syz [ 493.311253][ T42] usb 4-1: Manufacturer: syz [ 493.319436][ T42] usb 4-1: SerialNumber: syz [ 493.334617][ T42] usb 4-1: config 0 descriptor?? [ 493.746431][T12560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.758540][T12560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 493.770402][T12560] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 493.779823][T12560] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 494.160425][ T42] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 494.445731][T12569] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1246'. [ 494.462659][T12569] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1246'. [ 494.484276][ T5904] usb 5-1: USB disconnect, device number 74 [ 494.670320][T12577] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1246'. [ 494.679332][T12577] openvswitch: netlink: IPv4 frag type 64 is out of range max 2 [ 494.731543][ T5905] usb 2-1: USB disconnect, device number 65 [ 494.972040][T12626] dummy0: left allmulticast mode [ 495.065195][T12626] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 495.147668][T12626] netlink: 128 bytes leftover after parsing attributes in process `syz.1.1248'. [ 495.621611][ T42] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 495.637298][ T42] CoreChips 4-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -71 [ 495.693045][ T42] CoreChips 4-1:0.41: probe with driver CoreChips failed with error -71 [ 495.718015][ T42] usb 4-1: USB disconnect, device number 81 [ 496.585384][T12668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.612513][T12669] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.629932][T12669] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.640717][T12668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 496.924290][T12684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 496.947593][T12684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 497.115904][ T42] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 497.275886][ T42] usb 4-1: Using ep0 maxpacket: 32 [ 497.285253][ T42] usb 4-1: New USB device found, idVendor=041e, idProduct=3237, bcdDevice= 0.40 [ 497.294734][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 497.302903][ T42] usb 4-1: Product: syz [ 497.326114][ T42] usb 4-1: Manufacturer: syz [ 497.331811][ T42] usb 4-1: SerialNumber: syz [ 497.597633][ T42] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 497.605394][ T42] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 497.703323][ T42] usb 4-1: USB disconnect, device number 82 [ 498.159592][T12634] Set syz1 is full, maxelem 65536 reached [ 498.283900][T12736] syzkaller0: entered promiscuous mode [ 498.593623][T12773] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.605677][T12774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.617617][T12773] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.627928][T12774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.771323][T12788] sctp: [Deprecated]: syz.3.1267 (pid 12788) Use of struct sctp_assoc_value in delayed_ack socket option. [ 498.771323][T12788] Use struct sctp_sack_info instead [ 499.232623][T12802] bond0: (slave veth1_vlan): Error: Device is in use and cannot be enslaved [ 499.874476][T12825] netlink: 'syz.4.1273': attribute type 10 has an invalid length. [ 500.091767][T12835] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 500.488914][T12854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.508399][T12854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.528269][T12854] tc_dump_action: action bad kind [ 500.589457][T12858] binder: 12851:12858 ioctl 4018620d 0 returned -22 [ 500.691254][T12859] binder: 12851:12859 ioctl c0306201 0 returned -14 [ 501.336244][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.342665][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.409890][T12859] syz.1.1277 (12859): drop_caches: 2 [ 501.808657][T12881] tap0: tun_chr_ioctl cmd 2147767521 [ 501.817578][T12881] tap0: tun_chr_ioctl cmd 35111 [ 502.118831][T12899] Cannot find add_set index 2 as target [ 502.665967][ T42] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 502.835965][ T42] usb 4-1: Using ep0 maxpacket: 32 [ 502.846635][ T42] usb 4-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 502.857509][ T42] usb 4-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 502.877502][ T42] usb 4-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 502.897620][ T42] usb 4-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 502.927321][ T42] usb 4-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 502.941733][ T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.956938][ T42] usb 4-1: Product: syz [ 502.964264][ T42] usb 4-1: Manufacturer: syz [ 502.972404][ T42] usb 4-1: SerialNumber: syz [ 502.988662][ C1] imon 4-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 503.012069][ T42] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/input/input58 [ 503.226331][ T42] imon 4-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 503.235937][ T42] (id 0x00) [ 503.395913][ T42] rc_core: IR keymap rc-imon-pad not found [ 503.414654][ T42] Registered IR keymap rc-empty [ 503.422529][T12935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.435893][ T42] imon 4-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 503.446650][T12935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.457343][ T42] imon 4-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 503.483191][T12972] [U] [ 503.483776][T12973] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.486146][T12972] [U] [ 503.486197][T12972] [U] [ 503.486228][T12972] [U] [ 503.487976][T12972] [U] [ 503.499408][T12973] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.500010][T12972] [U] [ 503.515680][T12972] [U] [ 503.518365][T12972] [U] [ 503.525032][ T42] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0 [ 503.531386][T12972] [U] [ 503.537898][T12972] [U] [ 503.540593][T12972] [U] [ 503.542451][ T42] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:155.0/rc/rc0/input59 [ 503.585953][ T9804] usb 2-1: new high-speed USB device number 66 using dummy_hcd [ 503.593380][ T42] imon 4-1:155.0: iMON device (15c2:ffdc, intf0) on usb<4:83> initialized [ 503.690124][T12935] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.713711][T12935] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.746187][ T9804] usb 2-1: Using ep0 maxpacket: 32 [ 503.753188][ T9804] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 503.763746][ T9804] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.784274][ T9804] usb 2-1: config 0 descriptor?? [ 503.877248][T12984] [U] [ 503.997175][ T9804] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 504.023809][ T9804] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 504.035306][ T9804] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 504.052384][ T9804] usb 2-1: media controller created [ 504.083383][ T9804] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 504.124061][ T29] kauditd_printk_skb: 115 callbacks suppressed [ 504.124077][ T29] audit: type=1326 audit(1775801165.732:1014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f01d559c819 code=0x7ffc0000 [ 504.169165][ T29] audit: type=1326 audit(1775801165.732:1015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f01d559c819 code=0x7ffc0000 [ 504.198091][ T29] audit: type=1326 audit(1775801165.742:1016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f01d555d04e code=0x7ffc0000 [ 504.201419][T12959] az6027: more than 2 i2c messages at a time is not handled yet. TODO. [ 504.221506][ T29] audit: type=1326 audit(1775801165.742:1017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f01d559c4ab code=0x7ffc0000 [ 504.258087][ T29] audit: type=1326 audit(1775801165.742:1018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f01d559c4ab code=0x7ffc0000 [ 504.264787][T12959] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 504.283507][ T29] audit: type=1326 audit(1775801165.742:1019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f01d559c4ab code=0x7ffc0000 [ 504.291847][T12959] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 504.321253][ T29] audit: type=1326 audit(1775801165.742:1020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f01d559c4ab code=0x7ffc0000 [ 504.344322][ T29] audit: type=1326 audit(1775801165.872:1021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f01d559c4ab code=0x7ffc0000 [ 504.368353][ T29] audit: type=1326 audit(1775801165.962:1022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f01d559c4ab code=0x7ffc0000 [ 504.396085][ T42] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 504.404134][ T29] audit: type=1326 audit(1775801166.012:1023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13008 comm="syz.4.1301" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f01d559c4ab code=0x7ffc0000 [ 504.440250][ T9804] az6027: usb out operation failed. (-71) [ 504.447605][ T9804] az6027: usb out operation failed. (-71) [ 504.453382][ T9804] stb0899_attach: Driver disabled by Kconfig [ 504.459637][ T9804] az6027: no front-end attached [ 504.459637][ T9804] [ 504.471492][ T9804] az6027: usb out operation failed. (-71) [ 504.495886][ T9804] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 504.512947][ T9804] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input60 [ 504.525895][ T42] usb 5-1: device descriptor read/64, error -71 [ 504.536381][ T9804] dvb-usb: schedule remote query interval to 400 msecs. [ 504.546066][ T9804] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 504.567396][ T9804] usb 2-1: USB disconnect, device number 66 [ 504.630313][ T9804] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 504.785911][ T42] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 504.854009][T13047] [U] V3Fپ"S/4:XTZWTLW= [ 504.926196][ T42] usb 5-1: device descriptor read/64, error -71 [ 505.046418][ T42] usb usb5-port1: attempt power cycle [ 505.396817][T13066] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1311'. [ 505.426816][T10631] usb 4-1: USB disconnect, device number 83 [ 505.446348][ T42] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 505.467155][ T42] usb 5-1: device descriptor read/8, error -71 [ 505.479701][T13041] [U] J"E:" [ 505.715879][ T42] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 505.749269][ T42] usb 5-1: device descriptor read/8, error -71 [ 505.858373][ T42] usb usb5-port1: unable to enumerate USB device [ 505.875950][T10631] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 506.058531][T10631] usb 4-1: Using ep0 maxpacket: 32 [ 506.079582][T10631] usb 4-1: New USB device found, idVendor=1d50, idProduct=60a1, bcdDevice=a1.4f [ 506.095836][T10631] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.115837][T10631] usb 4-1: Product: syz [ 506.120044][T10631] usb 4-1: Manufacturer: syz [ 506.124845][T13104] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 506.145860][T10631] usb 4-1: SerialNumber: syz [ 506.149110][T13104] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 506.172373][T13108] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1318'. [ 506.176814][T10631] usb 4-1: config 0 descriptor?? [ 506.187376][T13108] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1318'. [ 506.450148][T13119] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1320'. [ 506.526551][T13120] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 506.617977][T10631] airspy 4-1:0.0: Board ID: 00 [ 506.622949][T10631] airspy 4-1:0.0: Firmware version: [ 507.039357][T13133] : entered promiscuous mode [ 507.229209][T13082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.256822][T13082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.315409][T10631] airspy 4-1:0.0: usb_control_msg() failed -71 request 12 [ 507.611582][T13154] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1324'. [ 507.630349][T10631] airspy 4-1:0.0: Registered as swradio24 [ 507.647354][T10631] airspy 4-1:0.0: SDR API is still slightly experimental and functionality changes may follow [ 507.878369][T13154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 507.887986][T13154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 507.952477][T10631] usb 4-1: USB disconnect, device number 84 [ 508.225894][ T42] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 508.425864][ T42] usb 5-1: Using ep0 maxpacket: 32 [ 508.434472][ T42] usb 5-1: config 9 has an invalid interface number: 221 but max is 1 [ 508.443519][ T42] usb 5-1: config 9 has an invalid interface number: 221 but max is 1 [ 508.472028][ T42] usb 5-1: config 9 has 1 interface, different from the descriptor's value: 2 [ 508.481270][ T42] usb 5-1: config 9 has no interface number 0 [ 508.491243][ T42] usb 5-1: config 9 interface 221 altsetting 64 endpoint 0xA has invalid wMaxPacketSize 0 [ 508.531613][ T42] usb 5-1: config 9 interface 221 has no altsetting 0 [ 508.547548][ T42] usb 5-1: New USB device found, idVendor=0582, idProduct=74ce, bcdDevice=ba.38 [ 508.562084][ T42] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.576963][ T42] usb 5-1: Product: syz [ 508.583776][ T42] usb 5-1: Manufacturer: syz [ 508.591804][ T42] usb 5-1: SerialNumber: syz [ 508.865652][ T42] usb 5-1: USB disconnect, device number 79 [ 508.885591][ T7899] udevd[7899]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:9.221/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 509.010745][T13214] fuse: Unknown parameter 'group_i' [ 509.017468][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 509.017499][ C1] bridge0: topology change detected, propagating [ 509.017749][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 509.017767][ C1] bridge0: topology change detected, propagating [ 509.218460][T13227] program syz.3.1333 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 509.658840][ T5905] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 509.761145][T13264] openvswitch: netlink: IP tunnel dst address not specified [ 509.816000][ T5905] usb 5-1: Using ep0 maxpacket: 16 [ 509.824851][ T5905] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 509.838570][ T5905] usb 5-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 509.848071][ T5905] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 509.862866][ T5905] usb 5-1: Product: syz [ 509.868523][ T5905] usb 5-1: Manufacturer: syz [ 509.885375][ T5905] usb 5-1: SerialNumber: syz [ 509.896869][ T5905] usb 5-1: config 0 descriptor?? [ 509.908610][ T5905] hub 5-1:0.0: bad descriptor, ignoring hub [ 509.918497][ T5905] hub 5-1:0.0: probe with driver hub failed with error -5 [ 509.931816][ T5905] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 510.169225][ T5905] snd-usb-audio 5-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 510.282719][T13253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.291813][ T7899] udevd[7899]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 510.302128][T13253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.321691][T13281] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 1^!l1*$pOcɔr$G [ 510.372839][T13293] netlink: 312 bytes leftover after parsing attributes in process `syz.1.1339'. [ 510.568786][T13304] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 510.595548][T13304] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 510.666740][ T42] usb 5-1: USB disconnect, device number 80 [ 510.761908][T13304] bond2: entered allmulticast mode [ 510.908106][T13362] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1344'. [ 510.923383][T13362] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1344'. [ 511.275987][ T5905] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 511.515893][ T5905] usb 4-1: Using ep0 maxpacket: 32 [ 511.522861][ T5905] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 511.531174][ T5905] usb 4-1: config 0 has no interface number 0 [ 511.537498][ T5905] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 511.593466][ T5905] usb 4-1: config 0 interface 85 has no altsetting 0 [ 511.632321][ T5905] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 511.645071][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 511.661851][ T5905] usb 4-1: Product: syz [ 511.685588][ T5905] usb 4-1: Manufacturer: syz [ 511.734749][ T5905] usb 4-1: SerialNumber: syz [ 511.751367][ T5905] usb 4-1: config 0 descriptor?? [ 511.904302][T13395] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 512.039754][T13395] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 512.392135][ T5905] appletouch 4-1:0.85: Geyser mode initialized. [ 512.401659][ T5905] input: appletouch as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.85/input/input61 [ 512.670265][ T42] usb 4-1: USB disconnect, device number 85 [ 512.670301][ C1] appletouch 4-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 512.710060][ T42] appletouch 4-1:0.85: input: appletouch disconnected [ 512.845987][T10631] usb 2-1: new high-speed USB device number 67 using dummy_hcd [ 512.935367][T13511] delete_channel: no stack [ 513.015900][T10631] usb 2-1: Using ep0 maxpacket: 16 [ 513.022925][T10631] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 513.033743][T10631] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 513.045400][T10631] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 513.058065][T10631] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 513.066439][T10631] usb 2-1: Product: syz [ 513.070844][T10631] usb 2-1: Manufacturer: syz [ 513.075513][T10631] usb 2-1: SerialNumber: syz [ 513.333646][T10631] usb 2-1: 0:2 : does not exist [ 513.363281][T10631] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 513.445941][ T5905] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 513.471554][T10631] usb 2-1: USB disconnect, device number 67 [ 513.512500][ T7899] udevd[7899]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 513.645903][ T5905] usb 4-1: Using ep0 maxpacket: 32 [ 513.652590][ T5905] usb 4-1: config 0 has too many interfaces: 193, using maximum allowed: 32 [ 513.672634][ T5905] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 193 [ 513.706725][ T5905] usb 4-1: config 0 has no interface number 0 [ 513.719722][ T5905] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 513.803975][ T5905] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 513.833406][ T5905] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b34, bcdDevice= 0.00 [ 513.849572][ T5905] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 513.885171][ T5905] usb 4-1: config 0 descriptor?? [ 514.378589][ T5905] usbhid 4-1:0.1: can't add hid device: -71 [ 514.389195][ T5905] usbhid 4-1:0.1: probe with driver usbhid failed with error -71 [ 514.412424][ T5905] usb 4-1: USB disconnect, device number 86 [ 514.820329][T13611] netlink: 'syz.1.1369': attribute type 21 has an invalid length. [ 514.895862][T13611] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1369'. [ 514.918703][T13612] input: syz1 as /devices/virtual/input/input62 [ 515.309812][T13658] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1376'. [ 515.357755][T13658] netlink: 'syz.3.1376': attribute type 30 has an invalid length. [ 515.386173][T13661] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1376'. [ 515.425679][T13661] netlink: 'syz.3.1376': attribute type 30 has an invalid length. [ 515.972226][T13686] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1383'. [ 515.981511][T13686] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1383'. [ 516.166787][T13695] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1385'. [ 516.280748][T13700] trusted_key: encrypted_key: key description must be 16 hexadecimal characters long [ 516.561782][T13717] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 516.561782][T13717] The task syz.4.1390 (13717) triggered the difference, watch for misbehavior. [ 516.756171][ T9804] usb 4-1: new full-speed USB device number 87 using dummy_hcd [ 516.913219][T13734] loop7: detected capacity change from 0 to 7 [ 516.950124][ T9804] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 516.959280][ T5905] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 516.972336][ T7899] Dev loop7: unable to read RDB block 7 [ 516.972387][ T9804] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.978122][ T7899] loop7: unable to read partition table [ 516.986945][ T9804] usb 4-1: Product: syz [ 516.998980][ C0] blk_print_req_error: 26 callbacks suppressed [ 516.999004][ C0] invalid error, dev loop7, sector 0 op 0x1:(WRITE) flags 0x800800 phys_seg 1 prio class 2 [ 517.004698][ T7899] loop7: partition table beyond EOD, [ 517.005187][ C0] buffer_io_error: 26 callbacks suppressed [ 517.005202][ C0] Buffer I/O error on dev loop7, logical block 0, lost async page write [ 517.035260][ T9804] usb 4-1: Manufacturer: syz [ 517.040073][ T9804] usb 4-1: SerialNumber: syz [ 517.057984][ T7899] truncated [ 517.058927][ T9804] usb 4-1: config 0 descriptor?? [ 517.126139][ T5905] usb 5-1: Using ep0 maxpacket: 32 [ 517.133212][ T5905] usb 5-1: config 0 interface 0 altsetting 88 bulk endpoint 0x85 has invalid maxpacket 1024 [ 517.144997][T13734] Dev loop7: unable to read RDB block 7 [ 517.151026][ T5905] usb 5-1: config 0 interface 0 has no altsetting 0 [ 517.155979][T13734] loop7: unable to read partition table [ 517.159343][ T5905] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=ea.79 [ 517.163626][T13734] loop7: partition table beyond EOD, [ 517.172571][ T5905] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=0 [ 517.172599][ T5905] usb 5-1: Product: syz [ 517.172635][ T5905] usb 5-1: Manufacturer: syz [ 517.216982][ T5905] usb 5-1: config 0 descriptor?? [ 517.225299][T13726] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 517.273055][T13734] truncated [ 517.276608][T13734] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 517.281308][ T9804] usb 4-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 517.379052][ T5193] Dev loop7: unable to read RDB block 7 [ 517.384677][ T5193] loop7: unable to read partition table [ 517.415168][ T5193] loop7: partition table beyond EOD, truncated [ 517.508553][ T5905] usb 5-1: USB disconnect, device number 81 [ 517.799086][T13769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 517.817084][T13769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 517.946146][ T5874] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 518.107209][ T5874] usb 2-1: Using ep0 maxpacket: 16 [ 518.118114][ T5874] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 518.140912][ T5874] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 518.155125][ T5874] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 518.188873][ T5874] usb 2-1: New USB device found, idVendor=0b05, idProduct=19b6, bcdDevice= 0.00 [ 518.212505][ T5874] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.233185][ T5874] usb 2-1: config 0 descriptor?? [ 518.338810][ T9280] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 518.356009][ T9280] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 518.364909][ T9280] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 518.423804][ T9280] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 518.478258][ T5874] hid_parser_main: 28 callbacks suppressed [ 518.478282][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.495873][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.520263][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.532270][ T29] kauditd_printk_skb: 24 callbacks suppressed [ 518.532286][ T29] audit: type=1326 audit(1775801180.142:1048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 518.591839][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.605992][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.613010][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.613608][ T29] audit: type=1326 audit(1775801180.142:1049): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 518.623118][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.651103][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.667232][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.674327][ T5874] asus 0003:0B05:19B6.0017: unknown main item tag 0x0 [ 518.714865][ T29] audit: type=1326 audit(1775801180.182:1050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7f6df5d04e code=0x7ffc0000 [ 518.753793][ T5874] asus 0003:0B05:19B6.0017: hidraw0: USB HID v0.00 Device [HID 0b05:19b6] on usb-dummy_hcd.1-1/input0 [ 518.817114][ T29] audit: type=1326 audit(1775801180.182:1051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 518.824208][ T5874] usb 2-1: USB disconnect, device number 68 [ 518.878213][ T5874] ------------[ cut here ]------------ [ 518.883744][ T5874] !work->func [ 518.883765][ T5874] WARNING: kernel/workqueue.c:4289 at __flush_work+0xb43/0xc50, CPU#0: kworker/0:3/5874 [ 518.897027][ T5874] Modules linked in: [ 518.901310][ T5874] CPU: 0 UID: 0 PID: 5874 Comm: kworker/0:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 518.912385][ T5874] Tainted: [L]=SOFTLOCKUP [ 518.916786][ T5874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 518.923842][ T29] audit: type=1326 audit(1775801180.182:1052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 518.926893][ T5874] Workqueue: usb_hub_wq hub_event [ 518.926931][ T5874] RIP: 0010:__flush_work+0xb43/0xc50 [ 518.926968][ T5874] Code: 75 54 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 d2 e1 24 0a cc e8 1c f9 37 00 90 0f 0b 90 e9 7c ff ff ff e8 0e f9 37 00 90 <0f> 0b 90 31 c0 48 bb f8 f8 f8 f8 f8 f8 f8 f8 e9 64 ff ff ff e8 f4 [ 518.980520][ T5874] RSP: 0018:ffffc90003d16f00 EFLAGS: 00010287 [ 518.987339][ T5874] RAX: ffffffff818dc6e2 RBX: 1ffff1100ac5249c RCX: 0000000000100000 [ 518.995450][ T5874] RDX: ffffc9001aadb000 RSI: 000000000008079b RDI: 000000000008079c [ 519.000268][ T29] audit: type=1326 audit(1775801180.182:1053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 519.003503][ T5874] RBP: ffffc90003d170b0 R08: ffffffff9011d8b7 R09: 1ffffffff2023b16 [ 519.033834][ T5874] R10: dffffc0000000000 R11: fffffbfff2023b17 R12: dffffc0000000000 [ 519.041877][ T5874] R13: ffff8880562924e0 R14: 1ffff920007a2de8 R15: ffff8880562924c8 [ 519.050047][ T5874] FS: 0000000000000000(0000) GS:ffff888125454000(0000) knlGS:0000000000000000 [ 519.050098][ T29] audit: type=1326 audit(1775801180.182:1054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 519.059024][ T5874] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 519.059042][ T5874] CR2: 00007f2100862e9c CR3: 000000007ec1a000 CR4: 00000000003526f0 [ 519.059062][ T5874] Call Trace: [ 519.059072][ T5874] [ 519.059088][ T5874] ? __pfx___flush_work+0x10/0x10 [ 519.059124][ T5874] ? __lock_acquire+0x6b5/0x2cf0 [ 519.112738][ T5874] ? rcu_is_watching+0x15/0xb0 [ 519.117608][ T5874] ? work_grab_pending+0x3d1/0x990 [ 519.120200][ T29] audit: type=1326 audit(1775801180.182:1055): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 519.122777][ T5874] ? __cancel_work_sync+0x5c/0x110 [ 519.146034][ T29] audit: type=1326 audit(1775801180.182:1056): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 519.150402][ T5874] __cancel_work_sync+0xbe/0x110 [ 519.174509][ T29] audit: type=1326 audit(1775801180.182:1057): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13783 comm="syz.0.1400" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f6df9c819 code=0x7ffc0000 [ 519.177894][ T5874] asus_remove+0x143/0x180 [ 519.204688][ T5874] ? hid_device_remove+0xb2/0x370 [ 519.205747][T13779] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 8 [ 519.209817][ T5874] ? __pfx_asus_remove+0x10/0x10 [ 519.209848][ T5874] hid_device_remove+0x228/0x370 [ 519.228693][ T5874] ? __pfx_hid_device_remove+0x10/0x10 [ 519.234215][ T5874] device_release_driver_internal+0x46f/0x870 [ 519.240362][ T5874] bus_remove_device+0x455/0x570 [ 519.245352][ T5874] ? __pfx_bus_remove_device+0x10/0x10 [ 519.250921][ T5874] device_del+0x527/0x8f0 [ 519.255293][ T5874] ? lockdep_hardirqs_on+0x7a/0x110 [ 519.260622][ T5874] ? __pfx_device_del+0x10/0x10 [ 519.265528][ T5874] ? do_raw_spin_lock+0x12b/0x2f0 [ 519.270648][ T5874] hid_destroy_device+0x6b/0x1b0 [ 519.272557][T13779] input: syz0 as /devices/virtual/input/input63 [ 519.275627][ T5874] usbhid_disconnect+0x9f/0xc0 [ 519.286744][ T5874] usb_unbind_interface+0x26e/0x910 [ 519.292003][ T5874] ? __pfx_usb_unbind_interface+0x10/0x10 [ 519.297805][ T5874] device_release_driver_internal+0x4d9/0x870 [ 519.303921][ T5874] bus_remove_device+0x455/0x570 [ 519.308901][ T5874] ? __pfx_bus_remove_device+0x10/0x10 [ 519.314391][ T5874] device_del+0x527/0x8f0 [ 519.318802][ T5874] ? __pfx_device_del+0x10/0x10 [ 519.323687][ T5874] ? kobject_put+0x51d/0x560 [ 519.328363][ T5874] usb_disable_device+0x3d4/0x8d0 [ 519.333433][ T5874] usb_disconnect+0x32f/0x990 [ 519.338163][ T5874] hub_event+0x1cc9/0x4f30 [ 519.342639][ T5874] ? __lock_acquire+0x6b5/0x2cf0 [ 519.347677][ T5874] ? __pfx_hub_event+0x10/0x10 [ 519.352510][ T5874] ? process_scheduled_works+0xa8d/0x18c0 [ 519.358284][ T5874] ? process_scheduled_works+0xa8d/0x18c0 [ 519.364045][ T5874] process_scheduled_works+0xb6e/0x18c0 [ 519.369744][ T5874] ? __pfx_process_scheduled_works+0x10/0x10 [ 519.375850][ T5874] ? assign_work+0x3d5/0x5e0 [ 519.380521][ T5874] worker_thread+0xa53/0xfc0 [ 519.385209][ T5874] kthread+0x388/0x470 [ 519.389392][ T5874] ? __pfx_worker_thread+0x10/0x10 [ 519.394550][ T5874] ? __pfx_kthread+0x10/0x10 [ 519.399220][ T5874] ret_from_fork+0x51e/0xb90 [ 519.403857][ T5874] ? __pfx_ret_from_fork+0x10/0x10 [ 519.409049][ T5874] ? __switch_to+0xc7d/0x1450 [ 519.413775][ T5874] ? __pfx_kthread+0x10/0x10 [ 519.418445][ T5874] ret_from_fork_asm+0x1a/0x30 [ 519.423251][ T5874] [ 519.426315][ T5874] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 519.433599][ T5874] CPU: 0 UID: 0 PID: 5874 Comm: kworker/0:3 Tainted: G L syzkaller #0 PREEMPT(full) [ 519.444521][ T5874] Tainted: [L]=SOFTLOCKUP [ 519.448830][ T5874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 519.458872][ T5874] Workqueue: usb_hub_wq hub_event [ 519.463898][ T5874] Call Trace: [ 519.467184][ T5874] [ 519.470110][ T5874] vpanic+0x56c/0xa60 [ 519.474103][ T5874] ? __pfx__printk+0x10/0x10 [ 519.478690][ T5874] ? __pfx_vpanic+0x10/0x10 [ 519.483191][ T5874] ? is_bpf_text_address+0x292/0x2b0 [ 519.488469][ T5874] ? is_bpf_text_address+0x26/0x2b0 [ 519.493671][ T5874] panic+0xc5/0xd0 [ 519.497395][ T5874] ? __pfx_panic+0x10/0x10 [ 519.501815][ T5874] ? ret_from_fork_asm+0x1a/0x30 [ 519.506758][ T5874] __warn+0x315/0x4f0 [ 519.510740][ T5874] ? __flush_work+0xb43/0xc50 [ 519.515420][ T5874] ? __flush_work+0xb43/0xc50 [ 519.520097][ T5874] __report_bug+0x29a/0x540 [ 519.524606][ T5874] ? ret_from_fork_asm+0x1a/0x30 [ 519.529558][ T5874] ? __flush_work+0xb43/0xc50 [ 519.534233][ T5874] ? __pfx___report_bug+0x10/0x10 [ 519.539266][ T5874] ? ret_from_fork_asm+0x1a/0x30 [ 519.544211][ T5874] ? stack_trace_save+0xa9/0x100 [ 519.549142][ T5874] ? __pfx_stack_trace_save+0x10/0x10 [ 519.554512][ T5874] ? __flush_work+0xb43/0xc50 [ 519.559192][ T5874] report_bug+0x16a/0x220 [ 519.563521][ T5874] ? __flush_work+0xb43/0xc50 [ 519.568195][ T5874] ? __flush_work+0xb45/0xc50 [ 519.572870][ T5874] handle_bug+0x9c/0x200 [ 519.577115][ T5874] exc_invalid_op+0x1a/0x50 [ 519.581627][ T5874] asm_exc_invalid_op+0x1a/0x20 [ 519.586470][ T5874] RIP: 0010:__flush_work+0xb43/0xc50 [ 519.591753][ T5874] Code: 75 54 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 d2 e1 24 0a cc e8 1c f9 37 00 90 0f 0b 90 e9 7c ff ff ff e8 0e f9 37 00 90 <0f> 0b 90 31 c0 48 bb f8 f8 f8 f8 f8 f8 f8 f8 e9 64 ff ff ff e8 f4 [ 519.611352][ T5874] RSP: 0018:ffffc90003d16f00 EFLAGS: 00010287 [ 519.617415][ T5874] RAX: ffffffff818dc6e2 RBX: 1ffff1100ac5249c RCX: 0000000000100000 [ 519.625378][ T5874] RDX: ffffc9001aadb000 RSI: 000000000008079b RDI: 000000000008079c [ 519.633339][ T5874] RBP: ffffc90003d170b0 R08: ffffffff9011d8b7 R09: 1ffffffff2023b16 [ 519.641302][ T5874] R10: dffffc0000000000 R11: fffffbfff2023b17 R12: dffffc0000000000 [ 519.649261][ T5874] R13: ffff8880562924e0 R14: 1ffff920007a2de8 R15: ffff8880562924c8 [ 519.657237][ T5874] ? __flush_work+0xb42/0xc50 [ 519.661937][ T5874] ? __pfx___flush_work+0x10/0x10 [ 519.666970][ T5874] ? __lock_acquire+0x6b5/0x2cf0 [ 519.671913][ T5874] ? rcu_is_watching+0x15/0xb0 [ 519.676683][ T5874] ? work_grab_pending+0x3d1/0x990 [ 519.681805][ T5874] ? __cancel_work_sync+0x5c/0x110 [ 519.686926][ T5874] __cancel_work_sync+0xbe/0x110 [ 519.691866][ T5874] asus_remove+0x143/0x180 [ 519.696280][ T5874] ? hid_device_remove+0xb2/0x370 [ 519.701309][ T5874] ? __pfx_asus_remove+0x10/0x10 [ 519.706239][ T5874] hid_device_remove+0x228/0x370 [ 519.711169][ T5874] ? __pfx_hid_device_remove+0x10/0x10 [ 519.716621][ T5874] device_release_driver_internal+0x46f/0x870 [ 519.722693][ T5874] bus_remove_device+0x455/0x570 [ 519.727631][ T5874] ? __pfx_bus_remove_device+0x10/0x10 [ 519.733088][ T5874] device_del+0x527/0x8f0 [ 519.737418][ T5874] ? lockdep_hardirqs_on+0x7a/0x110 [ 519.742615][ T5874] ? __pfx_device_del+0x10/0x10 [ 519.747462][ T5874] ? do_raw_spin_lock+0x12b/0x2f0 [ 519.752486][ T5874] hid_destroy_device+0x6b/0x1b0 [ 519.757416][ T5874] usbhid_disconnect+0x9f/0xc0 [ 519.762176][ T5874] usb_unbind_interface+0x26e/0x910 [ 519.767378][ T5874] ? __pfx_usb_unbind_interface+0x10/0x10 [ 519.773097][ T5874] device_release_driver_internal+0x4d9/0x870 [ 519.779167][ T5874] bus_remove_device+0x455/0x570 [ 519.784101][ T5874] ? __pfx_bus_remove_device+0x10/0x10 [ 519.789557][ T5874] device_del+0x527/0x8f0 [ 519.793890][ T5874] ? __pfx_device_del+0x10/0x10 [ 519.798731][ T5874] ? kobject_put+0x51d/0x560 [ 519.803327][ T5874] usb_disable_device+0x3d4/0x8d0 [ 519.808351][ T5874] usb_disconnect+0x32f/0x990 [ 519.813029][ T5874] hub_event+0x1cc9/0x4f30 [ 519.817459][ T5874] ? __lock_acquire+0x6b5/0x2cf0 [ 519.822413][ T5874] ? __pfx_hub_event+0x10/0x10 [ 519.827180][ T5874] ? process_scheduled_works+0xa8d/0x18c0 [ 519.832896][ T5874] ? process_scheduled_works+0xa8d/0x18c0 [ 519.838609][ T5874] process_scheduled_works+0xb6e/0x18c0 [ 519.844171][ T5874] ? __pfx_process_scheduled_works+0x10/0x10 [ 519.850152][ T5874] ? assign_work+0x3d5/0x5e0 [ 519.854742][ T5874] worker_thread+0xa53/0xfc0 [ 519.859345][ T5874] kthread+0x388/0x470 [ 519.863408][ T5874] ? __pfx_worker_thread+0x10/0x10 [ 519.868515][ T5874] ? __pfx_kthread+0x10/0x10 [ 519.873095][ T5874] ret_from_fork+0x51e/0xb90 [ 519.877686][ T5874] ? __pfx_ret_from_fork+0x10/0x10 [ 519.882788][ T5874] ? __switch_to+0xc7d/0x1450 [ 519.887467][ T5874] ? __pfx_kthread+0x10/0x10 [ 519.892048][ T5874] ret_from_fork_asm+0x1a/0x30 [ 519.896822][ T5874] [ 519.900204][ T5874] Kernel Offset: disabled [ 519.904517][ T5874] Rebooting in 86400 seconds..