last executing test programs: 17m8.243247953s ago: executing program 3 (id=3089): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x40d, 0x30bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8209}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x5}, @IFLA_BOND_MIIMON={0x8, 0x3, 0xa000000}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c}, 0x0) 17m7.193713422s ago: executing program 3 (id=3092): syz_open_dev$media(&(0x7f0000000000), 0x4, 0x100) syz_usb_connect(0x0, 0x48, &(0x7f00000012c0)=ANY=[@ANYBLOB="120100004e4aa92082053300578e01020301090236000200000000090400f50003ed02000905030000000000000904"], 0x0) syz_usb_connect(0x3, 0xd67, &(0x7f0000000040)={{0x12, 0x1, 0x250, 0xd0, 0xdf, 0x8b, 0x20, 0x7b4, 0xf02, 0x544, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd55, 0x3, 0x4, 0x72, 0x0, 0x0, [{{0x9, 0x4, 0x15, 0x1, 0xe, 0x2, 0x6, 0x0, 0x6, [], [{{0x9, 0x5, 0x4, 0xc, 0x20, 0x89, 0x6, 0xfd, [@generic={0x38, 0xd, "1380c309d1c04b36ce3467253934fd2607286d0fc20c338058041eb25605c29df1ac9db3cd658bcb91ae0d1c9f2458a2b342b3f97082"}]}}, {{0x9, 0x5, 0x8c, 0x10, 0x400, 0xff, 0x7, 0x7}}, {{0x9, 0x5, 0x6, 0x14, 0x10, 0x8, 0x4, 0x8, [@generic={0x96, 0x10, "27a94930542b3f4f4d72a9c0a5f4937a43e50346d8a5ada6b9199a571a5c7ce57a0deb363690b3993c4d49348eebf332900a395a378f520bd40aeb92c4928af0f4865c1ad998cab7c28ddd4f340111b0ad787c1023198235d0c914707c1032f2e53df07bf99bb4278169de2186ab39acfce990380ac7054378b9c882823b4b240fd6c7c602e875f4dfd69a5789f630fa8a3562a7"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x3, 0x8000}]}}, {{0x9, 0x5, 0xd, 0x1, 0x200, 0x0, 0x80, 0x0, [@generic={0x6d, 0x10, "27c48dc43e644ce66084850a95cd0562d170cb00d1a0f0d7d6125dd5cb85a34dd351b0744710f9deae20999258744ab944e7538303a87d47619d437f8d0bbf30b533cb043542a570354044dce366493b1d1e1f11515a080c410b4679553c01b42c0225ddd1dc819458c7a6"}]}}, {{0x9, 0x5, 0x2, 0x2, 0x0, 0xc6, 0x5, 0x4}}, {{0x9, 0x5, 0x8, 0xa, 0x10, 0x4, 0xa, 0x8}}, {{0x9, 0x5, 0x4, 0x0, 0x20, 0x2, 0x2, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x8, 0x9}]}}, {{0x9, 0x5, 0x3, 0x0, 0x40, 0x70, 0xa, 0x2, [@generic={0xef, 0x3, "ab2c1cec0c0289c1653f13198feac7f83b8a540ece934717c94d5d66ef232106933de18473c62a3a565035fbe16e4f989fb2ac2161190a15f4f9f460247a69bdce447658dfda606d06ade1338598edf6fd2195439959399c9e582ea12229ddfcd3df6dab54cdca1a138adf562560d96dbd021db539eda5560af7c13e428e339e7b43dd10ee3eb164482645adf8fe7c4def4cb41bf9daa8ceca1f31812961436a44d6da50b5de3e1a4b4910917f5606dfcda628f7a9ffb685587e38fc8a826694bc8654c55e81b64d90276ce5c0499201c7aa09645830da08a252dbcf440f9853d3f9a7984057a0994b5ec0348a"}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x0, 0x4}]}}, {{0x9, 0x5, 0x0, 0x2, 0x400, 0x0, 0x3, 0x6, [@generic={0xf1, 0x22, "95e2eedba4a34c598ffaf8d8c8cb0f34ec1fd442ce75e2f6f20b43c95276fe56b37c35bd2410c63a8c6f10dff469b3ebd5a6c14ad65143e38119c8a4ee06a1012a9e6c23fa7decabb580092a994fbe615e310699a8e9669bb03e4fcb461aa0c33ba892c691db1bc2a47a536dccbc2479dc7878fc33bef35f82f45fd5be0e18053d50a03bb39d735018e5962e347b1c007613b65c27e26162fef09dcd590fa502d92c314bfd98f3125dad60fde093d0e5865816e78f96858e79a5bdd988507a7e87a9986b6e6be74b09d830a28a4f52c2819a55ef5f4fd014a18b421042921fd20c4ce902cde2e6fa5090c95ee2c776"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0xb, 0x4}]}}, {{0x9, 0x5, 0xa, 0x3, 0x200, 0x4b, 0x5, 0xd}}, {{0x9, 0x5, 0x0, 0x0, 0x8, 0x4, 0x88, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x81, 0x6}]}}, {{0x9, 0x5, 0x7, 0x1, 0x200, 0x6, 0xe, 0x3, [@generic={0x64, 0xb, "5f23fb84601f921b8355b3dbd26a05ad611066f330df88a21b4d99725d6746a75f797d37877de1fc6db360494806fc569c748fcae5e57f1837dd4324630667411cba65ea78dbd0234ceb116129ba15927e5792357fe339a9738066a85270ab00b00b"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x1, 0x5}]}}, {{0x9, 0x5, 0x3, 0x1, 0x200, 0x40, 0x4, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x8, 0x3}]}}, {{0x9, 0x5, 0x8, 0x8, 0x40, 0x3, 0x3, 0x9, [@generic={0xb4, 0xc, "14faa5de0359904a5f0b657e0527423001fd19680137594063132474da71b00ed3cb9831f45571eae155f5663175e84ac928010fff74248c1331816ecb153e8f1fffdbabd0df91c711591d470c4a9bac012b63491d8ebe3fac6eace7b8361461a26ac03ca0135e92e5138374fb2432326106974cb008a9642d5d351c79318095bd6703235dc4274210d3e34b41053b804b76b9b7ce86a3968e0b7b8a5128de652e08493e75c058adfca1ebbe7949035aa731"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x2, 0x6}]}}]}}, {{0x9, 0x4, 0xc3, 0x0, 0x9, 0xff, 0xff, 0xff, 0xd4, [], [{{0x9, 0x5, 0x7, 0x0, 0x20, 0x5, 0xe, 0xa1}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0xf, 0x5, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x3}, @generic={0x33, 0x7, "7a6e62ff29a8a4ec663ce8a398ee6d5df9bbd46765b2ab5a1af6462e6a0b52d8726790386f4da5ad7c6f2517492cc24472"}]}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x9, 0xf9, 0x5, [@generic={0xb6, 0x26, "15443ca816c1e45e715a4ca233cf67ac61975603a02a958a388c50f89f726ebb30b181817ca2bb9cdc07ff0d751f2346f62a00c75a923633f0d62cacea9928fd23afa82bc7ec3c480ea3de063e65cd44c35bc012d4320e1ccd92ebf393530ec2a0c6bef80e320c64dd48b8f58575c9c6cab2d5221fdc64bf30f12caf80387b2d5d8d67b1bcdaf3283024d96b3e2d1e40e6d3eb40a25d04fa955cc9b3691a18abeccee1fd135f3ae891c66b237a05d12f31535179"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0xf, 0x8000}]}}, {{0x9, 0x5, 0xc, 0x0, 0x10, 0x1, 0x71, 0x68, [@generic={0x15, 0x1, "d060a9a3a2d349806ed166dff41ca20dd322ea"}, @generic={0x9a, 0x24, "dd0f38253c7e7da1a5633c83c191c4f0396ba6c07bdbb1470d998266e94723497738bea4872aa5d09253ec41b942cefa6eec1390ea1a4778288c065fa7423fdd550389e20612597db96d0f2eeb4a017050b3b2e98aa6d28043a737cc8b0194bf6320f76f1ea436a106f4c7414da7ccbc8b4459e144ee12ca245a070f0bc73e954167350d9977abbd517711caa1e12fc61aa8d94e0b15a9dd"}]}}, {{0x9, 0x5, 0xa, 0x0, 0x10, 0x7, 0x7, 0x10, [@generic={0x43, 0x4, "205f583750dbaf0b0d8de7958bd06e6f1835a7361702f885b7f93440a200fcfda505f8e4088b6ea0c138db5a1fce0370d80daebca598dba19f088794761eb91c41"}]}}, {{0x9, 0x5, 0x80, 0xc, 0x50, 0x4, 0xf, 0xa2, [@generic={0xe2, 0x6, "780b1b74b49380bf74d743a266bdae37e1c11b93b43decd23ada8334415ce4933be4f8d13c4b6a289eba6283d11349bb5bbdf2e6815036076ad7464861611639210f5cc069ddd9d5e723877169fde984d3bc98ba78048ae43dcaecb499463fb814c2ed52cf35969b5b657d3efd06e9f0d2a421e63e1b50d8049dbf8f3efab13d133eff2bdd9a70796b7f6a6bdf6d89a92059cbc57bdf5358743fb9db9c851f89287c8b304489bb4523f3822b490c5ed85bf16d37b3d5391b138d409f5baa008d40d13fd7badae3c72800cc16cf13f63f8211bb55a67137b9e7c8982fddea23ad"}]}}, {{0x9, 0x5, 0xb, 0x7, 0x8, 0x6, 0xf6, 0x9e, [@generic={0x2b, 0xe, "8e1416d5ddbda1885fd7d4f665dfec7ace46704b1c1e0dbac90ccd02f7e64563d739f4c763b2615c02"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x7, 0xbb41}]}}, {{0x9, 0x5, 0xc, 0x13, 0x200, 0x3, 0xd, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x180, 0x1, 0xd}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x8}]}}, {{0x9, 0x5, 0x1, 0x4, 0x200, 0x9, 0x6, 0x9, [@generic={0xe7, 0x23, "03cabb42c87e17c8cf992c34cb2b5399d95bcb84937fa43985ad2d3c9beb9715c317d1e33433a14fa287b98f3622748866b47ae6c2ee45ea190e2c3de4e655512052f473151885d950a7e70120f2064f295e0732bfe651bba27ca3bc95ca4b21efd382ecae1a6a491c32ec38a36d081fe130354852f5703033abab100c1af253a8754b8a78a352014bd99bfa3f64e9cedcb07898f581e0886610a118beb7fd6bcdcf8394c853f782aadd7585d8e3ada50e538366916587dd90ff12a94170c10006e9881bc40a2dcfb74d46bf73036317336cd75ba7eb58a762f436ed3179b080fdf49e4c23"}, @generic={0x9c, 0x2, "0b0e02cd202ab1944d2fe96883e10f261cd877b7e382ce605790de15d90253b61b0fc913ea08d692a083b4885fd727e6093e9198043866f50cea24a3f08d9bc5450bf0e18892b1368ca8e1097e233eaebf4bf11497f903a20812396c4457389cbd4147bf5705caad302c121af0029102ae33d88e0019e116860e5187b94cb6b2d54d5cdd457af324670133e14b10d65c5024b18c3a0a8f026da0"}]}}]}}, {{0x9, 0x4, 0xf7, 0x37, 0x5, 0xa1, 0x62, 0xfe, 0x8, [@cdc_ecm={{0xa, 0x24, 0x6, 0x0, 0x0, "f8031fa814"}, {0x5, 0x24, 0x0, 0x80}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x8000, 0x5, 0x72}, [@ncm={0x6, 0x24, 0x1a, 0x4, 0x20}, @dmm={0x7, 0x24, 0x14, 0x7fff}, @call_mgmt={0x5, 0x24, 0x1, 0x2, 0xe3}]}], [{{0x9, 0x5, 0x9, 0x10, 0x10, 0xfe, 0x6}}, {{0x9, 0x5, 0x8, 0x0, 0x10, 0xc, 0x39, 0xa, [@generic={0xb1, 0x21, "064eba38078c4a6c50a914d50c7971a28d93fba355097728d26587016389dba3ac60b4381ba0ad3db9108374c1af45117b99cd49c4f9fcab4725cebd55470c335a85ad60babf94ffb5f5e8a14aea1073af28af27c6b7a4ba9adb46f8d0d98b660720cc7d4757b91e7079cd41a4ac621185956c3bf22b48a22a4a229cfe5348061c0854ea1b9dc369f5d18d7a0969ba02d09ea322f33cd33f1970a4b71d0cdab3b914470236996d29ee80f7a76adc88"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x40, 0x6, 0x4, 0xa}}, {{0x9, 0x5, 0xe, 0x3, 0x40, 0x0, 0xb9, 0x7, [@generic={0x60, 0x11, "6f8a4463a79b82764cbf288f01f87a02d91d0a1e23c001ad9167d7a86864527210f13c931c1dfa4c1fe40f4791cc3f2849d33e72fa0ae18ba3dadb41bf257ac10bc9fab5863f0cc69e848bc32f1a522b6ecc79815b836e0bd7fce6df116c"}, @generic={0x102, 0xc, "50bb2ead3acb9905605f3ccfa8c022ddd9890644c1ed225f0ac2d48f81c4fe75a8158b82eb6bb9164f439d68054639a5bb4cd0d0d6e14920fd1edaf96d257cb6ac8462c76546ff7dc3c30a24261e1e50f0cdf5dccf9914bd4816b4a246dda8124ace52e9296dabd98c1cc1de32146c0b0c8fd52e2990aa71f849a6d62bff7c6451e62c629f4aabcfda1cf73dd37da0d3056ac03aa6afd9176223bf5b02b85be55bd5aa0f636156d29087d248bb0b013945192344eba276d02cd827da7a0b2f49a0733ebd7326a7a4972240cee68062177b70d31db2e13d558a3dc0a3cdf827dbc877cecdcb9fc9fc8ad735b8234f77898968d7fa19abe28a08168e2afc0396d6"}]}}, {{0x9, 0x5, 0x9, 0x10, 0x200, 0x5, 0xe1, 0x9, [@generic={0xf4, 0x5a5aeebed30b82fb, "d73ac8fce652e399089664b08d5e7379a117dc0a3ccfcd5ed99a8e6cda729e4dce4dd8d8f6272cea8ac2c8e1b9f997e99dcf6736a03589c55e0c5c644e22e08b73fe4c3af24145c70fec27d43eb62da98e29772facb3c5e264439995f54df1cbef961ca21b4a73fd0f341013971177bd87cc155968ed5f645958c92ba7dbdc033f8698e5c9054176bea46cc46e980c549a9e19c796f594e217d440e7ae572e37e33bb64df83aa91ee89037b83ab7eabb94002ad4379aabadc2358ec6c685fcf6cd12ffa6ec6cfef962791bcaeaf9ffd628ff8a1ba45c8ce13499491fc398832c8d3a2bd81139d237eabed9b268ae7abf0ad7"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x0, 0x7}]}}]}}]}}]}}, &(0x7f00000011c0)={0xa, &(0x7f0000000dc0)={0xa, 0x6, 0x310, 0x85, 0xfa, 0x6, 0x8, 0x80}, 0xb, &(0x7f0000000e00)={0x5, 0xf, 0xb, 0x2, [@ptm_cap={0x3}, @ptm_cap={0x3}]}, 0x8, [{0x4, &(0x7f0000000e40)=@lang_id={0x4, 0x3, 0x100c}}, {0x12, &(0x7f0000000e80)=@string={0x12, 0x3, "8996abf85e55dfd15adaf7376b0e5e69"}}, {0x4, &(0x7f0000000ec0)=@lang_id={0x4, 0x3, 0x84c}}, {0x8c, &(0x7f0000000f00)=@string={0x8c, 0x3, "9355dc1c1fde0d7e2136522f6487de6d9957662a17b1041407a036713df1aa2fed68f343be56220255f1b9d9cf7a28e183c32fc3388e3e3ab842d3bc4bff3e5a998286621dd356a15bbc0ed88b4022abf63ab004ec99bd6b09c4eeeaab225aa605317355787cf4d1411e851c042f13221b13a201ebd134b4bbaea57869630cc2ea0061d27da95b1206d0"}}, {0x4, &(0x7f0000000fc0)=@lang_id={0x4, 0x3, 0x445}}, {0xaf, &(0x7f0000001000)=@string={0xaf, 0x3, "34d615eea4ebdf1ca3ebe2d6816999dc15ed79d82f28a24c88f3ad92bb0ee0821f4f0d7c6285ae96ce21cccde435de4e9cf6cccd4003b2419852f57519e5729fdf5a3bad01031572236e712c4dc5570caaeed6d3929e4e69d3150fa5d65b505834db8c7994c5c0beed73a415566f478f1d09ab396a3d4487eaefa1a06c2ed3444bc99840ea170c29fb717c3c008d065fa1766321630485931d7d1d2d39a3e584041e32ef7cc5f790fc24b70afa"}}, {0x4, &(0x7f00000010c0)=@lang_id={0x4, 0x3, 0x419}}, {0xaa, &(0x7f00000016c0)=ANY=[@ANYBLOB="aa033dcb2df0b624a1ac90d066d66cd0a5e903fda9780b9419f14cfe17c3d2f096c688259a2d9d163d5bb9f3b276aee2f3b51084aec134db38f680b34b88fc9653d0979aeffda14e590c26c744a33d8879f3b49fb34e0792efc7b1e1994b7c6ab1641999b9f4d5275506db0e50f3f4fa129c4c5e1bad1dd6b23c1820d3e08aa7f26c61bc585dcd64c98f0cf42a312d6542df89862c233afd2c506d00000000000000002f4a706daf45a4f137059ec400000000000000"]}]}) syz_usb_connect$printer(0x6, 0x2d, &(0x7f0000001240)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x20, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x8, 0x0, 0x7, [{{0x9, 0x4, 0x0, 0xa2, 0x1, 0x7, 0x1, 0x3, 0xd, "", {{{0x9, 0x5, 0x1, 0x2, 0x10, 0x3, 0xd, 0xc}}}}}]}}]}}, &(0x7f0000001640)={0xa, &(0x7f0000001280)={0xa, 0x6, 0x300, 0x7, 0x4, 0x7, 0xff, 0x5}, 0x5, &(0x7f0000001300)={0x5, 0xf, 0x5}, 0x6, [{0xa5, &(0x7f0000001340)=@string={0xa5, 0x3, "709601de35abcaf66005b7fa432e8870b8120320e1d5937ebb48a32f87b26edef20772f1f814c735ba6c8e5bb9e2520ef2347283036b2c62c82201b11514b9166096eefe0b7f89851cea5e3a6716d3bfc09fea682b9fd1faac4f6e7911fe42af6f792f4f1ec18471c3bc324c3eebac53dce6b068ca3af07332d9b0c9e3bc50800a351a8691cec3e30a18d518445f82756802a4a39609655acaa42bd7a0a225ccedfd72"}}, {0x90, &(0x7f0000001400)=@string={0x90, 0x3, "e404a49340eac8ddf505cd62eb92813aa572f367eabfcec2aa2d04902c7eec84066285ced848fa0d1ec5eba05296cea02ed35fe14128b191da2e61d7e79628049560e20ce29b2d66380ff48b5d4a608ff4d7b9b32cef0f5b7e31cbb1a0169049524eddb435c5309e43ad978fe5954c41598169bb7fd74b058ee64ba60665dab1b0aac5692717af9295fc0265cd6f"}}, {0x9c, &(0x7f00000014c0)=@string={0x9c, 0x3, "6625c31f1e3ce3eb9725affbfdc89e8fd157ff17b7c0d8a18217fdcb889ce0bc4ed12d9ff959ed3c01a58659c5ad22fd516cc60fc65d31ad0a88154237bc4bb8c89f0e834742d987fec2d661b8b8d6163942d671f033583dad76587fa57c569540caa9781c2e5cd8ccf99de474aabe9825ea3cef83e89b1a4832c15f935b8bca26dc8705c38dfcfd8aa903b3541a2f19e6d44b7b261f7891cd1f"}}, {0x4, &(0x7f0000001580)=@lang_id={0x4, 0x3, 0x80c}}, {0x4, &(0x7f00000015c0)=@lang_id={0x4, 0x3, 0x140c}}, {0x4, &(0x7f0000001600)=@lang_id={0x4, 0x3, 0x1401}}]}) 17m4.534377475s ago: executing program 3 (id=3100): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = getpgrp(0xffffffffffffffff) tkill(r2, 0x1a) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket(0xa, 0x2, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) setsockopt$sock_int(r4, 0x1, 0x1b, &(0x7f0000000600)=0xdfa, 0x4) sendmmsg$inet(r3, &(0x7f0000000780)=[{{&(0x7f0000000440)={0x2, 0x4e20, @local}, 0x10, 0x0, 0x0, &(0x7f0000000200)=ANY=[], 0x28}}], 0x1, 0x4000810) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000003fc0), 0x28000, 0x0) ioctl$SOUND_MIXER_READ_DEVMASK(r5, 0xc0044dff, &(0x7f0000004000)) setxattr$incfs_size(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240), &(0x7f00000003c0)=0x6e5, 0x8, 0x1) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, 0x0) socket(0x1d, 0x2, 0x6) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') openat$sysfs(0xffffff9c, &(0x7f0000000100)='/sys/power/pm_trace_dev_match', 0x0, 0x0) r6 = socket$key(0xf, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1, 0x1, &(0x7f0000000140)=@raw=[@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0xaa}], &(0x7f00000000c0)='GPL\x00', 0x5}, 0x94) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x14, &(0x7f0000000000)={@mcast2}, 0x14) sendmsg$key(r6, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="0700f302160004000000000020000000020009000000d800000000000000030000"], 0xb0}, 0x1, 0x7}, 0x0) 17m2.838003045s ago: executing program 3 (id=3104): mkdir(&(0x7f0000000140)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = syz_open_dev$usbmon(&(0x7f0000000900), 0x0, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) syz_emit_ethernet(0x7a, &(0x7f0000000180)={@local, @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00', 0x44, 0x2f, 0x0, @remote, @empty, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x1, 0x0, 0x1, 0x880b, 0x0, 0xfffd}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21}, {}, {0x8, 0x88be, 0x0, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}}}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0xffffffff}}}}}}}}}, 0x0) ioctl$MON_IOCQ_URB_LEN(r1, 0x9201) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r3, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000040)=0x1, 0x4) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x4) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x104000, 0x0) 17m2.336532587s ago: executing program 3 (id=3106): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$vcsu(&(0x7f0000000300), 0x8001, 0x8000) syz_genetlink_get_family_id$l2tp(&(0x7f0000000280), r1) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000500070000000900020073797a310000000014000780050015000c00000008001240000000000500050002000000050004000000000010828a00686173683a69702c6d6163"], 0x5c}, 0x1, 0x0, 0x0, 0x20000090}, 0x8084) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0, {0x6}}, './file0\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x4c, 0x0, 0x2, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x8001, 0x6d}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x4c}, 0x1, 0x0, 0x0, 0x90}, 0x800) r4 = epoll_create1(0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c082", 0x61}], 0x1}}], 0x1, 0x2090) syz_emit_ethernet(0x46, &(0x7f00000002c0)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb86dd6745208e00103aff00000000000000000000fe"], 0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000300)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0x8000011000000009, 0x3a, 'B\xd4GGI\x82\\4\xbb\xbb\xbb\xb3\xd4)\xed\x8f\xaa\xf4\xd2{\xc5\t\xa9\xed\xf8e\xaa\xb9\xf5\r\xe3T\x0e\x8a\xd6\x9a_?G\x05\x00\x00\x00\x00\x00\x00\x00\x1e\x9a\xce\xac&x3\x15\x14y\xbf\xc6)\xa8\b/\x01\x00\x00\f\x8e1\xc4\xa1\xb2]I\xa5\x13}9\x1b0x0}) sendto$packet(r5, &(0x7f00000002c0)="05031600d3fc142e00004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) epoll_pwait(r4, 0xfffffffffffffffd, 0x21, 0x40, 0x0, 0x55) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2d) 16m59.744811259s ago: executing program 3 (id=3115): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = syz_io_uring_setup(0xb, &(0x7f00000002c0)={0x0, 0x4200002f, 0x800, 0x1, 0x100020b}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) 16m58.263779242s ago: executing program 32 (id=3115): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = syz_io_uring_setup(0xb, &(0x7f00000002c0)={0x0, 0x4200002f, 0x800, 0x1, 0x100020b}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f0000000000)=[{0x0}], 0x1, 0x12}) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) 14.771586618s ago: executing program 1 (id=6878): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) r1 = fcntl$dupfd(r0, 0x406, r0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfd, 0x0, 0xe4}]}, 0x10) (async) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) (async) write$binfmt_elf64(r1, &(0x7f0000000640)=ANY=[], 0x540) (async) getrandom(&(0x7f0000000580)=""/265, 0xffffff3f, 0x3) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) sendmsg$TIPC_NL_NODE_GET(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)={0x3c, 0x0, 0x800, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x23}]}]}]}, 0xde}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0x0) (async) r4 = syz_io_uring_setup(0xb5c, &(0x7f0000000640)={0x0, 0x498, 0x0, 0x0, 0x164}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) (async) mkdir(&(0x7f0000000000)='./cgroup/../file0/file0/file0\x00', 0x116) (async) r7 = syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2, 0x3, 0x2, 0x8, 0x5, 0x0, 0x70bd2d, 0x25dfdbfe, [@sadb_address={0x3, 0x17, 0xff, 0x80, 0x0, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x19}}}]}, 0x28}}, 0x4000840) (async) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_procs(r9, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r10, &(0x7f00000005c0)=r7, 0x12) (async) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) (async) ioctl$IOCTL_VMCI_CTX_ADD_NOTIFICATION(r2, 0x7af, 0x0) 14.717576864s ago: executing program 1 (id=6879): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x80000000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x100000) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r2, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r2, 0xda90) setsockopt$inet_opts(r2, 0x0, 0x4, 0x0, 0x0) accept4(r2, 0x0, 0x0, 0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000180100000004000a40000000000900020073797a32000000000900010073797a30000000000800054000000008740000000c0a95c900000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800c0001"], 0xe4}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x0, 'caif0\x00', {}, 0x8}) socket$nl_generic(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x145, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x14) sched_setattr(0x0, 0x0, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) 13.587643397s ago: executing program 1 (id=6882): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0x5, 0x6, 0xfa) getsockname$inet(r2, 0x0, &(0x7f0000002280)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xe}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001300)=@deltfilter={0x2c, 0x2d, 0x8, 0x78bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xfff1, 0xc}, {0xffff, 0xffff}, {0x0, 0xb}}, [@TCA_CHAIN={0x8, 0xb, 0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x4048840) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000300)={0x6, 0x2, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES8=r0], 0x50) unshare(0x62040200) syz_usb_connect(0x0, 0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="120100005520f010402038b14201040000010902"], 0x0) socket$inet6(0xa, 0x800000000000002, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x448801, 0x0) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f0000000280)={0xc, 0x0, 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r8, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="300021001000010028bd7000f9dbdf2500000000", @ANYRES32=0x0, @ANYBLOB="158804000300000008000d000100000008001b0000000000"], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001000010025bd7000f9dbdf2500000000", @ANYRES32=0x0, @ANYBLOB="158804000300040008001b000000000300000d0300000000"], 0x30}, 0x1, 0x0, 0x0, 0x46801}, 0x4000000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r7, 0x0, 0xffffffffffffffff, 0x1}) unshare(0x2000000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r10, 0x0, 0x0, 0x0, 0x5, 0x2de07c, 0x334e8b}) 10.283018027s ago: executing program 1 (id=6898): syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000540)=ANY=[@ANYBLOB="120100009f187620ef170372362e010203010902240001000010000904bc00029e8833000905020200020200000905820220"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000029c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="200302"], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000002640)={0x44, &(0x7f0000000b40)=ANY=[@ANYBLOB="200e020106f4000037f7c080175b8ef3b97ea567d273b2f13dc1200add927924bb65192cdbe33ab112fdb862082fe1e3dea20e1f268a92c5f226f0ca5c37186b0c633a6a9ef70f38e491cdb9cb05c6b7bf203cceb141eb62e11a2547acf5a8f3af3c5d7601ac0eca2ac1eb65fa8384c45d71d77e6d029a4cc177ee25b45f886f3221844081376383ea571c83c307292c52ea71f5889ca656f2a5305f7c43d8bb4aa3acaea07451b5f51e8d99b238e13c36899f371f9bcb0a5b6956825ae510b34403de6dabd8415fbdff84a6217a98d525dc37fd13908fc6e640517f7d963a437c67ce2e32acd229d8782832b11d79"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000a80)={0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)={0x40, 0xb, 0x2, "31fb"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tproxy={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_PORT={0x8}, @NFTA_TPROXY_FAMILY={0x8, 0x1, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000780)={0x44, &(0x7f00000009c0)=ANY=[@ANYBLOB="0015020000008ac6f864e0f15c448a10e1cfd849ea7ebd07755a975d8cad628064e54d56e63eb0b173f410a947acdbc76d6dcb50185c20d673847934d2b002a057456eb4ad4f93d643b55d943b233590c94f9d772d693a6879993a1b1a49b9bdd5ec1fc9f624be00000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000040)='blkio.bfq.time\x00', 0x275a, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) r4 = syz_io_uring_setup(0x12e, &(0x7f0000000940)={0x0, 0xd8, 0x2, 0x3, 0xfffffffd}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc4c85513, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) io_uring_enter(r4, 0x1e76, 0xf728, 0x5, 0x0, 0x0) mremap(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffa000/0x1000)=nil) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r3, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, &(0x7f0000000540)=[0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbd, &(0x7f00000005c0)=[{}], 0x8, 0x10, &(0x7f0000000600), &(0x7f0000000640), 0x8, 0x2b, 0x8, 0x8, &(0x7f0000000680)}}, 0x10) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001240)=ANY=[@ANYBLOB="bf16000000000000b707000001009fa35070000000000000280000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3010100bd2321afb56fa54f26fb0b71d0e6adff07f1d8f7faf75e0f226bd99eea7960707142fa2dc79b9723741c4a0e168c1886d0d4d94f2f4e345c652fbc16ee988ee99fbfbf9b0a4def23d410f6296b32a834388107200759cda9036b4e369a9e152ddcc7b1b85f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c3b35967dec6e802f5ab3eea57b09a2ed4048d3b867ddd58211d6ececb0cd2b6d357b85a0218ce740068725837079e468ee207d2f73902fbcfcf49822775985bf31b715f5888b24efa000000000000ffffffdf0000000000000000000000000000020000000000000000000000000000b27cf3d1848a54d7132be1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b9349e31aa3701c38c527d3237c18e521ab219efdebb7b3de8f67581cf796a1d4223b90b80fcad3f6c962b9f292324b7ab7f7da31cf41ab12012fb1e0a494034127de745409e35a30b23bcee46762c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d307db98ca112874ec309baed0499104dcfe7c0f694bd5fc9e66d058b75fa4c81e5c9f42d9383e41d277b10392a96286744f049c3f128f8f92ef992239eafce5b43b4ec1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637598f37ad380a447483cac394c7bbdcd0e3b1c39b2e00916de48a4e70f03cc415ba77af02c1d4cef5379da860aed8477dfa8ceefb405005c6977c78cdbf37704ec73755539280b064bda144910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06cd58b638c234bbb55ff413c86ba9affb12ec757c7234c270246c87a901160e6c07bf6cf8809c3a0d46ff7f000000000000ad1e1f493354b2822b9837421134c0167d78e6c24ed0a2768e825972ea3b774a1467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4cc302b52e2101de18a1f1f7c551b3fa00055cc1c46c5fd9c26a54d43fa050645bd6109b113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc20f49e298727340e97c870800000047546103f123f661c84726e7c7c55eff231a1b033d8f841ba3442b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2ef7be184f5e93ba5c8c2a4c04450b652b8d4c2ff030000000000000007c6bbd6cb2b240ce7d47ae636a5dbe9864a117d27326850a7c3b57086a4482c218b10af13d7be94987005088a83880ccab9c99220002af8c5e13d52c87c3a3ee6c08384865b66d2b4dcb5dd9cba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942fe0bc9f2a1a7506d35e5b439edeb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a700a86c814459f3cdaaf99000000000000000000bf2130d1b32c826563c718d0ad23bc83ba3f3757210a057e177615c0683f000000000000006d4e0413ab52f5aaab812201d1aba3d70471fcd9b466569f3ef72f39d87fcccab514fcff030000629c9b73ce7bc4be7f8be71cb7b2d0a4acff8f6abe7dbad64dfa63966945d93c33b038ce0d890f85f8a6ab8487c383e24d4a8051f80e1811e387723a25dda119f64b35e71c5400000000000000000000000000000034c751ebdf3f207ea3df3d6c0002a41783078e56c70afe8016b3dd9dc7785b36e609f173cc747837d600283b3452c57a5d44cacd363589845637071320921d32c1663964eddec97cc33158bc306d8c3bdae8108a23d2dc96a5cdb518f58832ec0906aaec43659c79c8ad37b0f961f3beaa3e02f7762c5dd633d13b5e487e996597b2ab42c81eb7dd8390e13b395aacce4683e55bcfe8c17615257364365fd48bd77da79e52ce9adfe6dcb0c42c4d719347f3d16304fa000008ffffffffffffff003049ca923d059c0ab5d886a491adacb7e4b43b1b57586e5fe2aa611f6232a9b71882ce24fce75cf105fa57f000756755b7230e2c0c1fed5487271c4f2981cf8f4351ef5d08641dacaed000080000000000000000000000fa36bbac00bb77c933d3961556f3fe647b05643b0000000000000000000000967aef9c5706e13d5889e77dab80a2548ec31629b7355a2bb8b93e4b6323061f545b26accc4621b568ab0bfaf30aa4f60705532c4a09c0a4a5487c762167edf362be35b9c90ad7e372a66bbb1471aa21000000000000104061c66a7432f25687618e31dcef8c5d4a2457a93f3fc6d3d7131746c75ccf400fc1a7a51826832ef7f5fbc78827d937768443a1c1ca3aba930826fd21aa1201d9225256df8de405d1f12c17cdaff3ad675aa333aa7e919459babd3cc1000000000000000000000000000000000000000000000000000000000000000059fdc6a54a2a8b28fa7d9b92aeb58e78e3b8594a5ef6bb67e52bf43b6145f544273a8f62852706c0abef368bfc72f92fa99a7bf121019cff8001fd7d2f6c2c295a5cab383235fec4c1decbed258ee9df8963c0fc828ad2119ffefe36c78692fffb6942b9da0922b2aa8f6b66c14ee7f42d5951edcc986356b41c0de3549f851ca340d9e425e355c1decb785a1042a72c1c98a084b04b1d9be473e50a15d76b110eda3b7cc1f2501211773cf510a43888422c1328476dd6f42659c61a18618fd28d5cd342c276aa9c4cc035077fa09d672b8dcfb3ac1751628647047d07338a8619037e3449a173ddd697f541a0795a2de7ef1396d70675341ebf004be122de04b5275fe7e53d28ebdc5051cec00759d73ca97229d93b965926060b6f91d01324bd458b425ea51c5d5b69551d599188fc6040370ac9ca7ae9eea9e5ede79bd66bd3d616dd7d7dd4c3a8fd055a3585af6fe7f5046c61154598cd33c33a48ece1072afd04b1fd85eb1655d9f3f813392c9634200d892dc6810b436820a1e0f6b464855e28953eb63cd3d6fc1b7bfb588ce28a51af1658d45d759a8399da55a3ff6597bb9f47167fe55ca240623a001e5fe15d9ddefea06a3750501916163844106c4ce662f418d9fc509e5447f712048d53e7e36ee7de083c5ea1119969d858eb6785395fc5a2c551de9a086cb4583f55c47828645e3046"], &(0x7f0000000140)='GPL\x00'}, 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="01000000040000005b0000008a00000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000180)={r7, r8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000880)=@bpf_lsm={0x1d, 0xa, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000f8ffffff00000000820d00001800000008000000000000002a0000001866000007000000000000000080000018190000", @ANYRES32=r3, @ANYBLOB="000000000000000095e0ff0000000000950000e800000000"], &(0x7f00000000c0)='syzkaller\x00', 0x800, 0x9f, &(0x7f0000000400)=""/159, 0x0, 0x24, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f00000004c0)={0x0, 0x5}, 0x8, 0x10, 0x0, 0x0, r6, 0x0, 0x1, &(0x7f0000000340)=[r3, r3, r3, r3, r8, r3, r3, r8], &(0x7f0000000840)=[{0x1, 0x4, 0x4, 0x3}], 0x10, 0x3}, 0x94) setxattr(&(0x7f0000000200)='./cgroup\x00', &(0x7f0000000240)=@known='system.sockprotoname\x00', 0x0, 0x0, 0x3) io_uring_register$IORING_REGISTER_IOWQ_AFF(r4, 0x11, &(0x7f0000000040)="732fbf", 0x3) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0xc004743e, 0x110e22fff6) 7.068732292s ago: executing program 1 (id=6917): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e22, @multicast1}}, 0x5, 0xa}, &(0x7f0000000040)=0x90) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000380)={r2, @in={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xd}}}}, 0x84) sendfile(r1, r0, &(0x7f0000002080)=0x3a, 0x23b) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="480000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00010000420000002800128008006851c28e4c8bfb6d028008001400000800000500130000000000055474c399000000"], 0x48}, 0x1, 0xba01}, 0x0) r5 = syz_io_uring_setup(0x810, &(0x7f0000000480)={0x0, 0x5c2d, 0x80, 0x2, 0x12c}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e20, 0xeb, @remote, 0x4}, 0x1c) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffff8, 0x0, 0x4) openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x40000000042201, 0x0) munmap(&(0x7f0000001000/0x1000)=nil, 0x1000) r8 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x5}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}]}, 0x34}, 0x1, 0x0, 0x0, 0x2}, 0x2000080c) r11 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r11, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r9, 0xc}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x4) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r3, &(0x7f0000000640)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000600)={&(0x7f0000000680)={0x8c, 0x0, 0x100, 0x70bd28, 0x25dfdbfb}, 0x8c}}, 0x4040894) keyctl$dh_compute(0x17, &(0x7f0000000040)={r8, r8, r8}, &(0x7f0000001cc0)=""/194, 0xc2, &(0x7f00000000c0)={&(0x7f0000000000)={'xxhash64-generic\x00'}}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x2f, 0x28, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0xda1a0b6210925d15, 0x0, @fd=r5, 0x0, 0x0, 0x1, 0x1}) io_uring_enter(r5, 0x22d0, 0x20, 0x0, 0x0, 0x0) 6.777200353s ago: executing program 0 (id=6921): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="280000004000070127bd7000fedbdf25037c00000400c2800b000180050010"], 0x28}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000140)="5c00000011006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac004000202080002000300010004000200eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x300) r2 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x65) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) connect$l2tp6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback, 0x7c}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x5b, 0x0, &(0x7f0000000200)="e30080670080ec67838717bd86dd7893a5f16774eea63c78dc2ea29c2c45e148f001000000000e000000000000004d53e3bb017d9c1ff05dacf5fb80b4b7ee0fae7aea53492b38978de0b800"/91, 0x0, 0x8000, 0x0, 0x40, 0x0, 0x0, 0x0, 0x2, 0x0, 0x749}, 0x50) r3 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x1) ioctl$FIBMAP(r3, 0x1, &(0x7f0000000040)=0x85) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r4, 0x29, 0x7, 0x0, &(0x7f0000002040)) symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000002080)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00') execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 6.379199915s ago: executing program 0 (id=6922): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r1 = dup(r0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x87, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x0, 0x1, {0x22, 0xa0}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f00000000c0)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="0000d2000000d200a7ea311df08de8b5c61a74f395771d654603e4ac794cabf402544226299c614e2cfd31ff98ffa9105a8f3c"], 0x0, 0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r1, 0x3554000) syz_usb_connect(0x0, 0x24, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f00000004c0)=@nat={'nat\x00', 0x670, 0x5, 0x570, 0x2c0, 0x0, 0xffffffff, 0x0, 0x360, 0x4d8, 0x4d8, 0xffffffff, 0x4d8, 0x4d8, 0x5, 0x0, {[{{@ip={@dev={0xac, 0x14, 0x14, 0x1d}, @local, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'veth1_to_bond\x00', {}, {}, 0x16}, 0x0, 0x288, 0x2c0, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "0d01d3e494b2bfd892aa74009b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f5d010000fa5fad26a5925da2650a12bdf9d29248ae63e2349b63b5fb75ea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba00", 0x79, 0x2, {0x1}}}, @common=@inet=@hashlimit3={{0x158}, {'veth0_to_bridge\x00', {0x5, 0x1, 0x24, 0xffffffff, 0x4da01491, 0x5, 0x3bde, 0x1ff, 0x78, 0x40}, {0xb}}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xd, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x65, @gre_key=0x8}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0xd, 0x1}, {0x2, 0x1, 0x3}, 0x1000, 0x100}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, 0xff, 0xffffff00, 'virt_wifi0\x00', 'batadv_slave_1\x00', {}, {}, 0x6}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @port=0x4e22, @port=0x4f23}}}}, {{@ip={@empty, @remote, 0xffffffff, 0xffffff00, 'vcan0\x00', 'pimreg1\x00', {}, {0xff}, 0x32, 0x2, 0x2d}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "1542", 0x1}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x2a}, @icmp_id, @icmp_id=0x66}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x5d0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xc6002, 0x0) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) r5 = socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xa, 0x11, r5, 0xa70e9000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) fadvise64(r0, 0x18, 0x0, 0x4) 5.568580285s ago: executing program 4 (id=6927): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = fanotify_init(0x200, 0x40000) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r4, 0x0, 0xf3a, 0x0) (async) splice(r3, 0x0, r2, 0x0, 0x228, 0x0) (async) ioctl$UI_SET_PHYS(r3, 0x4008556c, &(0x7f0000000040)='syz0\x00') (async) fanotify_mark(r1, 0x1, 0x8000018, r0, 0x0) (async) r5 = socket(0x2c, 0x803, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000500)={'tunl0\x00', &(0x7f0000000400)={'syztnl1\x00', 0x0, 0x0, 0x7800, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x2, 0x0, 0x0, @local, @remote}}}}) (async) r6 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_ifreq(r6, 0x8994, &(0x7f0000000000)={'dummy0\x00', @ifru_ivalue=0x5}) 5.507444966s ago: executing program 5 (id=6928): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x80000000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x100000) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r2, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r2, 0xda90) setsockopt$inet_opts(r2, 0x0, 0x4, 0x0, 0x0) accept4(r2, 0x0, 0x0, 0x0) r3 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000180184000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000008740000000c0a95c900000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800c0001"], 0xe4}}, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x0, 'caif0\x00', {}, 0x8}) socket$nl_generic(0x10, 0x3, 0x10) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x145, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x14) sched_setattr(0x0, 0x0, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) 5.00182586s ago: executing program 4 (id=6930): openat$vcsa(0xffffffffffffff9c, &(0x7f0000000040), 0x180, 0x0) (async, rerun: 64) r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000000300)) (rerun: 64) ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f0000bd0000/0x3000)=nil, &(0x7f0000ec0000/0x1000)=nil, 0xd, 0x0, 0x0, 0x400000000000201, 0x42, 0x14, 0x57, 0x1a}) (async) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) (async) syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x5, 0x7, 0x7ffc0001}]}) (async) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 32) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000300)=[@text32={0x20, 0x0}], 0x1, 0x4e, 0x0, 0x0) (rerun: 32) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f"], 0x0) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) recvmmsg(r2, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f00000003c0)=""/41, 0x29}, {0x0}, {0x0}, {&(0x7f0000000a00)=""/242, 0xf2}, {0x0}, {&(0x7f0000000b00)=""/120, 0x78}], 0x6}, 0x3}], 0x1, 0xc0032032, 0x0) (async, rerun: 64) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (rerun: 64) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x1fe, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000200)={[0xc45, 0x400000000000009, 0x7ffc, 0x80000001, 0x800000010000, 0x4, 0x4002004c2, 0x0, 0x5, 0x0, 0x3ffffc, 0xfffffffffffffffd, 0x7fffffff, 0x20000000009, 0xffff, 0xfffffffffffffff7], 0x100000, 0x100002}) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async, rerun: 64) syz_usb_connect(0x0, 0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001f6be62099045a1092520102030109023400010200100009040d020279082c010824020108030105082402010003060809ffff080002020000090582020002"], 0x0) (rerun: 64) 4.781603022s ago: executing program 4 (id=6931): r0 = syz_open_dev$vbi(&(0x7f0000000100), 0x0, 0x2) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000280)=@multiplanar_userptr={0xb, 0x6, 0x4, 0x2000, 0x0, {0x77359400}, {0x1, 0x0, 0x7, 0x5, 0x1, 0x1, "99e349c3"}, 0x6, 0x2, {0x0}, 0x4}) (fail_nth: 2) 3.952561746s ago: executing program 4 (id=6936): recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@getqdisc={0x24, 0x26, 0x10, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x5}, {0x10, 0xd}, {0x3, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x20040000) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000ec0)=@newqdisc={0x38, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_bfifo={{0xa}, {0x8, 0x2, 0x401}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80d1}, 0x4000080) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x800, 0x8003, 0x21d}, &(0x7f0000000200)=0x0, &(0x7f00000007c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket(0x10, 0x3, 0x0) syz_open_dev$I2C(0x0, 0x0, 0x189802) socketpair$unix(0x1, 0x3, 0x0, 0x0) r8 = syz_open_dev$vim2m(&(0x7f0000000380), 0x3, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r8, 0xc0145608, &(0x7f0000000140)={0x7, 0x1, 0x2}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r8, 0xc058565d, &(0x7f0000002dc0)=@userptr={0x2, 0x1, 0x4, 0x0, 0x1, {}, {0x1, 0xc, 0x9, 0xc, 0x6, 0x8, "bf240fef"}, 0x3, 0x2, {&(0x7f00000002c0)}, 0x96000}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x94173000) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) close_range(r9, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r10 = accept4(r5, 0x0, 0x0, 0x800) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r10, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x9, 0x3, 0x2d8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x208, 0xffffffff, 0xffffffff, 0x208, 0xffffffff, 0x3, &(0x7f0000000000), {[{{@ipv6={@private0, @local, [0xffffff00, 0xff000000, 0xff000000, 0xffffff00], [0xff000000, 0xff, 0xff000000, 0xffffffff], '\x00', 'lo\x00', {0xff}, {}, 0x16, 0x3, 0x1}, 0x0, 0xd0, 0x118, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xf}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x5, 0x9, 0x1e13f5cd, 'snmp_trap\x00', {0x1}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x1b4f, 0xf343, 0xffff, 'syz0\x00', {0x8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) 3.265572436s ago: executing program 0 (id=6940): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000d71000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000179000/0x2000)=nil) (async) mremap(&(0x7f0000d71000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f0000179000/0x2000)=nil) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000180)=""/237, 0x0) (async) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000180)=""/237, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)) (async) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000000c0)=0x0) ioctl$BINDER_FREEZE(0xffffffffffffffff, 0x400c620e, &(0x7f0000000100)={r2, 0x0, 0x4df0}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_setup(0x10e, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r3) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r3) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="f6000040a3000100000000000320000000220800", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000020000000300"/28], 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x899, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) r4 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800451200b0006400002206907864010102ffffffff4e224e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="41080008907800082210a830edaaf4ad9463d47fc59e961c1312868286ea588f1e14258486158f012fdc05160000000400000006000000000000000700007fff04020402c8e543960a8301fdd13cdc7ffad5bf3a0380d0d781806d61756c199b9ede4ed3edaa2d52c05afd6e076fad13eea2bb425784885a721820c49d70a09f1090361c38b27c5f83e5bcd8aef84a4f"], 0x0) (async) syz_emit_ethernet(0xbe, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800451200b0006400002206907864010102ffffffff4e224e23", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="41080008907800082210a830edaaf4ad9463d47fc59e961c1312868286ea588f1e14258486158f012fdc05160000000400000006000000000000000700007fff04020402c8e543960a8301fdd13cdc7ffad5bf3a0380d0d781806d61756c199b9ede4ed3edaa2d52c05afd6e076fad13eea2bb425784885a721820c49d70a09f1090361c38b27c5f83e5bcd8aef84a4f"], 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="97291b000000000000003b3ee1be09e8000000000000", @ANYRES16=r4, @ANYBLOB="0600000000000000000000000000000000000000d068ffaa1a42ead340d1153bbd4ad295e8358be22ebecdff0f371ee2128afcd113fbf3517f7a31b7cc774372d2516267ca46ab717d4f923923921ae1360f5a2bbec812db80ba73f21073c4394fad05c67eb395d69896564a8476e8f5a645610b2f0eb7516d6392b69c5b76a5d146c4c3a0a7139b8162313ce0421950bcb5333c8794dff8393bad34e89147adbc08644664779927dc96a0289555627fa9e888c069e7df11daf8edb4d85cfdcd56deac282bc3cf819bc1ac415048dd1b49b9858f5ecab2285a0c22cf3ccdc75e32123885ca0de3d60b04e6f7f2dfa2639831ba829c6b7d210cbe04e20259621a4be2dc20c81c8a1e740a046608ede5eba7b20013b87de7e4478b9ff0db05ac52605ae194e124d19d6ab5a803b70e64b63b7c7b", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000000000000300"/28], 0x50) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1c}, 0xd}, 0x1c) recvmmsg(r5, &(0x7f00000002c0), 0x220, 0x100, 0x0) 3.096750907s ago: executing program 0 (id=6942): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x84}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x1ebf4cb28e4b6928}, 0x8000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x0, 0x20, 0x80000001, 0x1, {{0x5, 0x4, 0x0, 0x21, 0x14, 0x64, 0x0, 0x80, 0x2f, 0x0, @multicast2, @remote}}}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x48}}, 0x4040000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000280)={0xc}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5393, &(0x7f0000000000)) 3.09611474s ago: executing program 5 (id=6943): r0 = syz_open_dev$vbi(&(0x7f0000000100), 0x0, 0x2) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000280)=@multiplanar_userptr={0xb, 0x6, 0x4, 0x2000, 0x0, {0x77359400}, {0x1, 0x0, 0x7, 0x5, 0x1, 0x1, "99e349c3"}, 0x6, 0x2, {0x0}, 0x4}) 2.938599266s ago: executing program 5 (id=6944): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x84}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x1ebf4cb28e4b6928}, 0x8000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x0, 0x20, 0x80000001, 0x1, {{0x5, 0x4, 0x0, 0x21, 0x14, 0x64, 0x0, 0x80, 0x2f, 0x0, @multicast2, @remote}}}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x48}}, 0x4040000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5393, &(0x7f0000000000)) 2.862721346s ago: executing program 0 (id=6945): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0\x00'}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000110001"], 0xfdef) 2.788773263s ago: executing program 2 (id=6946): r0 = syz_open_dev$vbi(&(0x7f0000000100), 0x0, 0x2) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000280)=@multiplanar_userptr={0xb, 0x6, 0x4, 0x2000, 0x0, {0x77359400}, {0x1, 0x0, 0x7, 0x5, 0x1, 0x1, "99e349c3"}, 0x6, 0x2, {0x0}, 0x4}) (fail_nth: 3) 2.484189582s ago: executing program 2 (id=6947): socket$nl_generic(0x11, 0x3, 0x10) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)) socket$xdp(0x2c, 0x3, 0x0) pipe(&(0x7f00000000c0)) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000000)={'veth1_macvtap\x00', {0x2, 0x4e23, @multicast1}}) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x503, 0x12000000, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x80}}, 0x20}}, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[], 0x44}}, 0x28000) 2.436081378s ago: executing program 2 (id=6948): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020300001800000000000000000000000400030000000000fdffffffffffffff07000000000000000000000000000000050006006c0000fb0a00000000000000fc010000000000000000000000001700000000000000000004000400000000000700000000000000000000000000000000000000000000000200010000000000000000060000000005000500008000000a00000000000000ff0100000000000000000000000000010000000000000000020013"], 0xc0}}, 0x0) 2.312776408s ago: executing program 0 (id=6949): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000000c0)={0x100}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) ptrace(0x10, r0) r2 = gettid() seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7ffffffb}]}) rt_sigqueueinfo(r2, 0x21, &(0x7f0000000040)={0x0, 0x0, 0xfffffffb}) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x67, 0x29, 0x85, 0x10, 0x157e, 0x3205, 0xc9e2, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x5, 0x0, 0x0, [{{0x9, 0x4, 0xf8, 0x0, 0x1, 0xf9, 0x76, 0x36, 0x0, [], [{{0x9, 0x5, 0x8, 0x0, 0x3ff, 0x50, 0x3, 0x3}}]}}]}}]}}, 0x0) 2.138023906s ago: executing program 2 (id=6950): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001200), 0x101101, 0x0) ioctl$TCSBRKP(r0, 0x5425, 0x3) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001200), 0x101101, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32], 0x28}, 0x1, 0x0, 0x0, 0x42804}, 0x4048844) connect$unix(r1, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) unshare(0x400) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x8d2, &(0x7f00000001c0)={0x0, 0x54a5, 0x400, 0x1, 0x37a}, &(0x7f00000002c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r4, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x39, 0x1) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000), 0x2402, 0x0) pwritev(r7, &(0x7f0000000080)=[{&(0x7f0000000440)="ca2911e9f6693dda7381069b7d23a4f3a12b4ba737cce6a3335dd52ba8f4ee269d6e97e98da1bf18e237de5b73da7ee1086eee434c400d63fb3dec059607cc6d72130ceb3798d3182062be35efd89e25ff2ac7bb46fcbf13132e37ec9a25e50b578dc4e6bb30000a97cccba74e9c5ac001eacb09774c6fa2b75c8fbaf58a55dedb8b348d5a786a7a6de2e6a3e338d96d833d370fbf0650e47899fe1a340efdcbc498eb77396d488807645baced2d4460b94753546febe0678353a249c6a7aa611eeed641fbfb7f96acd859415d982daff2cff24c80514600dcffabfb6a04d4c63bb93f5322778e69bf5118bc66e13665617383af67cdef0c1a5d069d9f65cf26c00899b1d073c5d39d1eba6fc1d14532088b14053e15df1b7e5b5d9070eb3172c6d85f445101276e287582fc33e8c68293dd0eef5428e4f8b6aede090698f32ddd6e0bcde63c17b7b02c8bcc32aacd9fae15aeecd1615ffc1c0083137a8dc5b68926171612bc3187765883bb1ec50e82692b887d719c67cdf1b0ac40b6d93e6c5996df84c1f910336f7ea40b9b421c63b19ab365e9dcc751257fd8afdd4f88655e885103383e52ca5b7bca0b9c666fbd882239b7eb59c41e7cd7d29e1110ec1ea4a192b22623a8230a011edcc58a36387f1fc3223cb41de5e77c86e9e0a469396c36e32b73cb3592bebc6b17b57af2fa7026acd5ab39dc5083e7c0f3476f29c4f52ba644a3637d3c5e04e07a64f96b06d0f279ad80db13c248dbe949bbfd14ed724cf67619346595f6417586d6fd5a23db3836dec52f222e6b86e846ffabc6a1092abfbadd465338d68ee843b387bc38fe2915cbc73c8430c73d4fd28d6dc897c9c0fea4560e3bd37d229b01371f8066e2d4cd4ee2f96065e44b842cb00cecabf00014151f30b44904d00b1f1a35ba46db48d92bc4cf5c0b705b833b1368b08e76be86eafdbdf4e7", 0x2a8}], 0x1, 0x4, 0x9) 1.904768989s ago: executing program 4 (id=6951): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x84}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x1ebf4cb28e4b6928}, 0x8000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x0, 0x20, 0x80000001, 0x1, {{0x5, 0x4, 0x0, 0x21, 0x14, 0x64, 0x0, 0x80, 0x2f, 0x0, @multicast2, @remote}}}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x48}}, 0x4040000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000340)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5393, &(0x7f0000000000)) 1.73979274s ago: executing program 1 (id=6952): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @loopback}, 0x4}}, 0x2e) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)={0x30, r4, 0x1, 0x0, 0x0, {0x7}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x7}, @L2TP_ATTR_IFNAME={0x14}]}, 0x30}}, 0x2) r5 = mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xafUD\x9dA\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x42, 0x1f0, 0x0) mq_timedsend(r5, &(0x7f0000000dc0)="2437e3486921f15778973ebebd7f54803ef64e6c6bf31be0b5ccce941d4810859b4cab4c02e9955b5997d1d69e221e78d7c39fb2e76869cb52eba1238dcccb1e107283bfe8be17117a286ee102a8a44cb622b44381dad2c38f538552dd325414b0962c3c6a90a291c1a3439fa6addd50231198424ff4ca6b503f06bf205b559d8454dafbf367813f569a51eef23e8029b25e7c9cb36df862da0f9a684916ee7506831ce69d5e8329667ae545a3b66f6e1efa82258e6c7cdec7d254d221002e77e4e42b79e1aa2c701ec909531fe3b2ba0c1723bbe0bf8b0a3d9ce9e34b4e516248b0d10e9b670b3ff8f70f6ddf0ffcf91e668b1c72e95454efcf60bf0c5e1fffda1447ef515d43422b4843dc23f150367f3a7fffb22a0cd0f791e4a5772d4d2e4b685a80e873e871a26de9b21bd14ba463a0e0630dca3d6c69ad49ddb7d369b1ad507a6e2ce7afb7fde0e93ba479fe54bcfd052588abbdeec4144dd2059425175f56ede9dd7b4e7dff2718f6fd3b18a86f0200013e5f69ef5b22ae4045a2cada1afbff81d5fd1580a85b6b109ff1c47766fb1e3a8d55d4cfdec29b2211af8fea33df666b531eb3e97cc9878ba1cb81bd5825af4033cf092c0be0db6c16b61a7fe12a73550e989bea056cd82f52b70fac16067972649d662c7d7c652f281932198e6c8c71ce6081060776c5d311b1edf37e57a72f9940ce8e21b6db2d35e6499e04a68db1d8ab599d9c12fff6828cabab100adfbebae6c2271f2a66ec5fc7d9cace4d461198ed9079231762480bbf989a159273353cb5eaa64926fff1fe92036295b0b1589827aaf77c06241abb6690e5b0e9cb86d4a3db8a47bf97e9e4b05c228ba0456f467a03368503d20a525a14630eadc358dcf85b034acdbc353f0ec0b3f41b4e03ebd4bbc2872cf94c63641aa29db9ade7ea3fc9686b4a7ef8dd6b10d4eae9bb07f8a5664ef74da39ecab5fc450ce823e74525e2433c021c65bef5e0315484611ad1d661cad04e80811af3073e90796dc349d903ec2a0c2bf88ba7559400f0026cdae6ddbcc7ce6a576da942e5780b0840dec6c35c16a2df0eea0027f3779a3e458d1d6a350907fc7ee4a454679986cb1c1e55892070f1e421f7b1038f903b83c169e757e1f1287d86cf1281e5e1f10826d124f8ce150cfbae975d22e04ae7a10f9d48f4e39e5893df00fa8b22c821cc2441ed7b9ac6ddc63079da666af9f8d81de318e607d28b9bbadb34e7dc5c0a9ff799534afbc76aa84a379f8860cc682eabcbc46afd713380d8078bb32454d57f5cce28412570d00ab120cd15c8f31828d9ce99f6c64955862372dbbfccd2ef0e43b3b6932b634520a932efcd5b9bf9d1006294a3e16b54f81aa0d79d50345486a07a3bc5bded7e8ec624e5cd213990fa43c05f5aab47961ccbea4f1ebb8f1f2b90c2aeb6bc7e63f07c07fc9376c5de765c5e92b040259d2e80d96bbd7f1826db721496497516e4741235ff2435920cdbdab4ba3f8e8d492037d9065d1a950aaee85ed014d45e5657a69f022c10526e62d687522a0044dae00c5f8450a038f1163a506bd6169a7986c8c549998fc856d3a4cf9b8a17acc6d448bc24867675d9b69303a63f05313977fb82b4feb529a21c38e52acc6e122ab3b409cf3a9ef3409e6b60b66bb32371247e6a0aed48d4052d18837820bd2b94eac517b0b2c5b1bf9efc7da9233e86e03e6ad3cffe4b6c185e55bdb6ec192e354f73034753db095e52adf8bd97edae278a3828618a916b8258727435fd4ce9e6cbf22a3e886bdbe777e5828ac7c5f5c68ff936fb2308a54b27243528fdae0a2201bb320341a05fe8c6bc8241d6ec424202ed75ba9d11047a41ac4876611ac396668e063c3db5aeffcf25b4b8a76a9ab942abde2e9a5e0b987788cf3c8cdca3c8aec54fe2e7a51b5bae419d4aaf40a224e8ca0d8678c73b7637a358baa0e01d96f86a6d19b132159472f1f958bbfb0891e7cbf9bfb316b2f99a207b5b88302eafbf470d049ae0a731c9ed5cddf8e17a0ed84a112bb0848694503bb355990a0cb7502578f52db669a02a6e05fe12e79af1c563a07e1bacbd8adc821463b0f6ca219b1a9ebbab5b550c10f8a808b1b484d77f87138ca72043370a1e7263ba09202eff91c3db85df67eadf269ab65a6e1df498ebbf3f077b8403c1457f7951101b7be901d5f6c7f6f8b48fdadac95360f32acb34abff5fdd9a30e82850252241413b5ca3c4130ad1668a1bbbe70e334e98525c8a73d45e7745a94290840e63ef00b7842dfafdea2a7d3628393785f80b3f9445b6c1e259ad8392b70dd44d8bd4ded1a4c235ca0590ee16e94c3aa22fb7c491a92d69914f433ef16f27ac39e7494428c8c0d157d9492060e1f9f08f2fe68786555f4a3914ec4f0907504086de3dbc5a1a38ce62cce8769ccfa0a68a6b34839280166f1185f50c3c45f9099016bfad6e3a818826f59185741ee0295468e22f421c1dce9d70d4fe7144f5227577c4de378b89574d2b9a60e2a26ad4de17de7a45ad699cb02459e59402629fbb73860207baaf9c7205b83a23003eefa3b8d7f15ae6bdd1d341340e56094c90c6e38296429ecf7bffdb683cecdee1e5e813d169cb7384044fa57554befc90f0e55b1d35644486c9fb3f3a5fbc8ec41a4cd459b58fb0bb281e069075a45a5e623533022e414f77b90382b8954a4e394eaa3acd16e1be1a7cd2dc090b2fc332c29bbcf34d2b20b06aa747fe430e1623df53a3820286d4a7ef6cb5e4e197e9b0357d6cd3af354ba44232de3048fd4ba59befc78061a42528be4629075fad40275a476a89ca7cfced3021449b8a7f2e3f52c58b1e51953934413c3da78a2095993bb1849791ef892a21687e1705c75fa0d31a57f1d2b7819db407d1b12eb01d55c06ee82395ca6b265fc9678efa0f030861b2a20e78c86b5b2eb81ec24316a515a1a09982f88c7484787c2f97401f4fb255427a685915cab15b231f1f9f460a5045a0f13300685d3660892e0c6033e597464b537812cd5004c6d077c33d20020e3e6b5cefd59e9185b1f014fe44047e3528b596262dfa75fb7619e01ce87e729f5f71eb7c087384822e87a4439426ebab41f5e95545aab69384c91e8ca7869e9b324342a43987b3cea5da97321b0ad120362d89ab67f4ec0d879bdf62c2ff0a1ff226c4a55105675af3c4d7181e48f97ac989fe2f1b74aa667f7f65828cf9a7db78390ed0471a550b8b1b865d086b1985296b980b1de64fd3633655cd210d179f27b157134cedef50ff80f0484efe51c4e02ba26cb616e1da37e5bf73cb40090d9877714f7db349f4812349a43761f7cf690a82c9c415aa4222e9502d0985157128cc06599fe49e21fe87bd800141b1df2f5c7e6b79add2f9e784e313a163958453bad25680cc7dec76cb89b1e63e5ff2b1f6434e49bb5c6259f32423554e510ffb0b372c69cbc9f0fb51811c09c75f5887724254487cf889d1d3fdf90191b6db919c121fb98931808fc4037e49364bb9e7069df734e942dcecab6a0dd776683356692fb7edb76ba6100a5375ac103959c92df3db871020e42dcfcee247e17bbc16867d4c5a3b24140ec67da891a31d862f1cbc11571bc14578400068f5f11c4e03953e4741698b910642669dca6db2b38eef32b9b87115ae9729884ff58e25ab0c4bb46de8b30311fc7c8049f3fa7f5bd22496c3e4b6e78b30bfcad3c4cdfb3281eda213b94e3fcbaba00156f56826e88b7fbed91021815329d038ec311e97714d17801436e4d332c34e13de23a46bf736f5c84a1eec28aba5958eccc88c5300924a783bdabd40d5df898a6442a401a75176749142347c25131b7021631318a5f879a643bda5b2581200e05d2ce729fc27e51525ec0a8df7510688419e4c44892544f67396c56ff4cc01a9af1156ab90e8ec905db162b2e2bff1273bf31faf99cab5a9fc4e0b924e6bd2126209328dbcb100dbc2f711cfa8de2c53252e2f3f50ca71c0f5980aea66200f731b72c612537b8c41a53b2d76122ce5a5289dd58ca5d9539484be20cc08726f41a698ef09ee350b7ad0e29219839161fe0d439ad5f795e1f4dddd3ac273a6b61dd33fde52249e19f9bffa0822a302006e23640d074d9ae3930bc6ff7280d4191886ea82e2789df083362a18bf0b1782c2de1e2cb1046ea84545fe68e1a9ceee39c52ec05cbc0b14143c51840062be30b793ea5815297458d01375e1557badd19c716314f2470177e520f1909f99ddf61481c1c26b7cb7fa3b96f169f604c2dab86f7ffd3ef57f68923f2ef328c9e7f025fffd6365a79c2019fa287b53ae34400d30025377370c0d0af1784695642168cb14f4bf0e1e59c41f954b28915e6ce1aa9d5c79e927566869f4dedae6d6128b1c4b92dbfa68bcab432e5ca7d3861d7f5a5239d72e56d2cd2e1b94de04f9d84052898813ab1f75b257d50b06a7274a0f0a8fb16121041351f24bf99f803ab4a61f12c45c2c55badc613a28859928e6689d389017c0963dcc9c4c7ddcad0aa95c690e15102eeec3525d6ce92e29bb8798ccb5d89d888428046b29fce5f3116899c1fe9229f2deaaad28cd8b9150ab02bf86acfb1040a1a93331e035f6357f4ce5becd90fb86405e828b1c04c4c262e7f0d437262db9a2717f445a8319159b9950a781fbd2fed040f7a46dfd6fc80752725568a3ff0bb71d10b15c2ea4a167c9a56170441af86fb1b250c8962a9ea86501c6f7fb1dbc36036eea0b9fd920e265f42249e9a0020e6b4cdb00ba4ecfb2d8bb3a2ea13d6ce3554d08f5910f89927744bb4e71e970f90c7bc97c27272c6fcbeba35bbb15d05d1f50744fe6daaf85549e3438bff0b1ec76d4468a56e306a04927c291d9d7afa7e2fc829c689f98c60d8b913b0e1dbc9ae9d1515b6c49e52079eb0201fd1eff64f93e2240fe03b2bb1d86a50f50ae941e661de24964bf599ac8856d01dce54e90f7a36d22d6ad3452ab70e2ebba035edb853d3ef8e0a7770999646ba85073732330e2b8b634c4d0dae5aacef264d731284bb7c542c364c3e48ad316d541588f0ae55434f5f1fdd1863709053fc0b9297f0fed24273d84204e386517c5853662fae696d2415835c47b9e798387ba679973303f05db7596dde2bc1d63a24727968276fe8c0af3e217b6a3fdba389107e408036e473071e5bdbdd38575bea1e8207c06166c42c2bc8c4ed797ff971bca3329223ee6c07777381c67ff3b90b2a8170854e0c925653cba182b6672546cd33f6c53252bdf443c26b54568ddca123d738f6718ede53a7043bd61cb748b15a83d741651142d46a62bfcca2716577172b3a86f5868dbe8e5f90d40e798315d083b086d59de96a870d51bbb49a973027a9a9ba7228abbd48eb22166027281b87f6237758e4ea2e55e805872b160a78fec5c5a2cb7e1c228b7762c7e4cd1a9ff333639b80e22bf8642a8d446beb6014f005ad3b241ce5a1e72036c34f733a7c00b77c17c72b3d7061b98ac6b73b1a9b5740a0bf3759a88f58b327733649e5f7545f7d67a1b6b8979bcea6a29f9665e379dbf0219b5ca75d5134c876235f6b9d99a57d12f57df036d6164f1509d8ffbb5d70037980c4a859a98599d118a492431b5b7835430e0837334ef92d466941492d8b695ba5b1bbcefcdce9efa00b64fb383367f0a3194150d66e00fa9042730a0e6065dc48ba0fa08f62c809bff60d547225f297cb6e3bebeee85433403797208", 0xfd1, 0x8000000000000001, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') clock_gettime(0x5, &(0x7f0000000200)={0x0, 0x0}) futimesat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)={{0x77359400}, {r6, r7/1000+10000}}) r8 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x28bd, 0x94, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x0, 0x9, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xb}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x0, 0xfc, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0xb, {[@local=@item_4={0x3, 0x2, 0x2, "5f12de27"}, @global=@item_4={0x3, 0x1, 0x7}, @main=@item_012={0x0, 0x0, 0xb}]}}, 0x0}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000100)=0x8, 0x4) 1.528944175s ago: executing program 5 (id=6953): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000040)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket(0x1a, 0x80805, 0x1fe) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000180)={r4, 0xc}, 0xc) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000080)={r4, 0x85, "fa244d162afd1d0bccf7bbe3e32a3a2230500008a77a46a3e8f19f96fd67796a86f3ec04cdd3f635414114c043c81fb1b4ed1fba3c02d35781b978b51f65b39345bbf999362d87834d7b23e35e00bfa39141b9aae24642e58af922c5dacd6ea6fb681264e7e33ec6e329a6893d48f060e04add03faec0c7e311504347a35fc7bda30d3a41e"}, &(0x7f0000000000)=0x8d) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x47a701, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0xa04484c5154de58b, 0x0) socket(0x2a, 0x2, 0x0) r5 = syz_io_uring_setup(0x44cd, &(0x7f00000004c0)={0x0, 0x5331, 0x1, 0x1000003, 0xfffefffe}, 0x0, &(0x7f0000000140)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x4000010, 0xffffffffffffffff, 0x683a3000) syz_io_uring_submit(0x0, r6, &(0x7f0000000000)=@IORING_OP_POLL_REMOVE={0x7, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}) io_uring_enter(r5, 0x2d3e, 0xec84, 0x0, 0x0, 0x0) unshare(0x2040400) ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, &(0x7f00000001c0)={0x0, 0x5, 0xe000, 0x2000, &(0x7f000016e000/0x2000)=nil, 0x4}) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r7, 0x0, 0x0, 0x200007f9, &(0x7f0000e68000)={0x2, 0x4e26, @loopback}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) r8 = socket$inet_udplite(0x2, 0x2, 0x88) shmctl$IPC_RMID(0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'bridge0\x00'}) r9 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[], 0x44}}, 0x4000054) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 435.981379ms ago: executing program 2 (id=6954): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000ec0)={'syz1\x00', {}, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz0\x00', {0x0, 0x0, 0xfde7}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xc658, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8161, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x4, 0x7ff, 0xcf12, 0x9, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x7fff, 0x1, 0x40, 0x0, 0xffff0d42, 0x6, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa], [0x5, 0x0, 0x2, 0x4e, 0x0, 0x0, 0xd84c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0xb77, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff0417, 0x0, 0x3dd55859, 0x0, 0x0, 0x4b8, 0x3f000000, 0x800, 0x0, 0x46, 0x0, 0x288, 0xd54b, 0x0, 0x0, 0x20, 0x9, 0x20000000, 0x7], [0x6, 0x0, 0x0, 0x0, 0x4, 0xfff, 0x0, 0x0, 0x4, 0x3, 0x7, 0xb, 0x0, 0x0, 0xfffffffc, 0x0, 0x8000, 0x0, 0x0, 0x3, 0x0, 0x5, 0x99, 0xfffffffc, 0x0, 0x0, 0x0, 0x9, 0xc, 0xffff8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x32ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xffefff01, 0x0, 0x1000], [0x5, 0x0, 0xd7, 0x0, 0x1, 0x3, 0x1ff, 0x0, 0x0, 0x0, 0x800, 0x8, 0x0, 0x8, 0x80000001, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff6168, 0x0, 0x9, 0x1a, 0x921, 0x0, 0x0, 0x0, 0x3ff, 0x5, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57e, 0x37a9, 0x0, 0x3, 0x3]}, 0x45c) 244.10716ms ago: executing program 5 (id=6955): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x84}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x1ebf4cb28e4b6928}, 0x8000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x0, 0x20, 0x80000001, 0x1, {{0x5, 0x4, 0x0, 0x21, 0x14, 0x64, 0x0, 0x80, 0x2f, 0x0, @multicast2, @remote}}}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x48}}, 0x4040000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000280)={0xc}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5393, &(0x7f0000000000)) 204.581291ms ago: executing program 4 (id=6956): openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket(0x1000000010, 0x80802, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x8) socket(0x10, 0x803, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 162.316923ms ago: executing program 2 (id=6957): r0 = socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$netlink(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) close_range(r1, r0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x7}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r4}, {}, {0x46, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0}, 0x94) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000100), 0xcc5c1, 0x0) socket$xdp(0x2c, 0x3, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b0400000000000000000200fffe4c0004802800018008000100666962001c00028008000340000000060800024000ecff01080001400000000920000180070001006374000014000280080002400000001108000140000000100900010073797a30000000000900020073797a32"], 0xa0}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r8 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) lseek(r8, 0xffffffffffffffb7, 0x1) sendmsg$key(r8, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000001500)=ANY=[], 0xf0}}, 0x8000) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0xfffffffc, 0xffffffff) 0s ago: executing program 5 (id=6958): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x136f, &(0x7f0000000440)={0x0, 0x49fa, 0x10, 0x0, 0x4e}, &(0x7f0000000180)=0x0, &(0x7f0000000280)=0x0) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000000300)=[0xffffffffffffffff], 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000007c0)=@IORING_OP_FILES_UPDATE={0x14, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000780)=[0xffffffffffffffff], 0x1}) io_uring_enter(r2, 0x47f6, 0x0, 0x0, 0x0, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x109942, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000580)) ioctl$PPPIOCSACTIVE(r5, 0x40107446, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{0x6, 0xcd, 0x8}]}) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f00000000c0)=[@mss={0x2, 0x3}, @sack_perm, @sack_perm], 0x3) ioctl$PPPIOCSACTIVE(r5, 0x40107446, &(0x7f0000000080)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000003000000580001800d0001007564703a73797a300000000044000400200001000a004e2400000007ff02000000000000000000000000000100000000200002"], 0x6c}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r9, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r9, 0x0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r9, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, 0x0}, 0x200c0010) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r9, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, 0x0}, 0x4004050) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000100021040300"/20, @ANYRES32=0x0, @ANYBLOB="430e000000000100"], 0x20}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r10, 0xa02000000000000, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3e8, 0x0, 0x0, 0x130, 0x300, 0x300, 0x300, 0x7fffffe, 0x0, {[{{@arp={@local, @empty, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pimreg\x00', 'veth0_to_bridge\x00'}, 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f67b23ffdfa27f907a03732da3acbc6518e62a77ca06f258762e88c0d9f9d2f413b94a105f4bdf01425ce81c5d000000000000000500ffffffff00"}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_team\x00', 'ip6tnl0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE3={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) preadv(r9, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_FPU(r9, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0xbd, 0x0, 0xffff, 0x2, 0x2, '\x00', 0x654}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100), 0x111, 0x4}}, 0x20) kernel console output (not intermixed with test programs): [ 1650.522661][T17748] usb 3-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=25.11 [ 1650.532879][T17748] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1650.651467][T17748] usb 3-1: Product: syz [ 1650.658193][T17748] usb 3-1: Manufacturer: syz [ 1650.664285][T17748] usb 3-1: SerialNumber: syz [ 1650.677454][T17748] usb 3-1: config 0 descriptor?? [ 1650.740632][T17748] usb 3-1: no audio or video endpoints found [ 1650.981113][T17748] usb 3-1: USB disconnect, device number 43 [ 1650.995297][T30081] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1651.410702][T30089] netlink: 'syz.2.6355': attribute type 3 has an invalid length. [ 1652.204768][T30111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6361'. [ 1652.327229][T30114] program syz.4.6362 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1652.332929][ T107] usb 2-1: new high-speed USB device number 116 using dummy_hcd [ 1652.492856][ T107] usb 2-1: Using ep0 maxpacket: 8 [ 1652.509175][ T107] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1652.588482][ T107] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1652.608926][ T107] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1652.629965][ T107] usb 2-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1653.301286][ T107] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1653.337930][ T107] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1653.381865][ T107] usbtmc 2-1:16.0: bulk endpoints not found [ 1653.656865][ T9] usb 2-1: USB disconnect, device number 116 [ 1659.428271][T30198] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1659.453695][T30198] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1659.690916][T30202] netlink: 88 bytes leftover after parsing attributes in process `syz.2.6382'. [ 1659.737675][T30207] netlink: 'syz.4.6383': attribute type 3 has an invalid length. [ 1660.174759][T30226] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1660.252862][T16699] usb 2-1: new high-speed USB device number 117 using dummy_hcd [ 1660.264739][ T107] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 1660.524235][ T107] usb 3-1: Using ep0 maxpacket: 32 [ 1660.531460][T16699] usb 2-1: Using ep0 maxpacket: 8 [ 1660.538319][ T107] usb 3-1: config index 0 descriptor too short (expected 35577, got 27) [ 1660.547709][ T107] usb 3-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1660.557740][ T107] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1660.578064][T16699] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1660.598757][T16699] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1660.609419][ T107] usb 3-1: config 1 has no interface number 0 [ 1660.622928][ T107] usb 3-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1660.648954][T16699] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1660.658999][ T107] usb 3-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1660.676223][T16699] usb 2-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1660.701953][ T107] usb 3-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1660.713878][T16699] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1660.723157][ T107] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1660.732406][T16699] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1660.876273][ T107] snd_usb_pod 3-1:1.1: Line 6 Pocket POD found [ 1660.893668][T16699] usbtmc 2-1:16.0: bulk endpoints not found [ 1661.231641][ T107] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now attached [ 1661.347044][ T107] usb 2-1: USB disconnect, device number 117 [ 1661.362909][ T9] usb 5-1: new high-speed USB device number 117 using dummy_hcd [ 1661.522997][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 1661.544477][ T9] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1661.553819][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1661.588459][ T9] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1661.602575][ T9] pvrusb2: ********** [ 1661.612929][ T9] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1661.649149][ T9] pvrusb2: Important functionality might not be entirely working. [ 1661.662763][ T9] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1661.696069][ T9] pvrusb2: ********** [ 1661.833246][ T2345] pvrusb2: Invalid write control endpoint [ 1661.882467][ T9] usb 5-1: USB disconnect, device number 117 [ 1661.912945][T30248] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.987598][T30248] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1662.094366][ T2345] pvrusb2: Invalid write control endpoint [ 1662.100825][ T2345] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1662.108199][ T107] usb 3-1: USB disconnect, device number 44 [ 1662.159384][ T107] snd_usb_pod 3-1:1.1: Line 6 Pocket POD now disconnected [ 1662.179596][ T2345] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1662.211523][ T2345] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1662.256228][ T2345] pvrusb2: Device being rendered inoperable [ 1662.289649][ T2345] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 1662.322845][ T2345] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1662.376355][ T2345] pvrusb2: Attached sub-driver cx25840 [ 1662.382175][ T2345] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1662.404875][ T2345] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1662.804655][ T9] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 1662.853882][T30267] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6397'. [ 1662.975602][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 1662.994301][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1663.015074][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1663.031263][ T9] usb 5-1: can't read configurations, error -61 [ 1663.051053][T30275] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1663.089108][T30275] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1663.105191][T30275] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1663.148038][T30275] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1663.193058][ T9] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 1663.246040][T30285] QAT: failed to copy from user cfg_data. [ 1663.362880][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 1663.370741][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1663.387315][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1663.406669][ T9] usb 5-1: can't read configurations, error -61 [ 1663.423361][ T9] usb usb5-port1: attempt power cycle [ 1663.762826][ T9] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 1663.805880][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 1663.813990][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1663.824316][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1663.831927][ T9] usb 5-1: can't read configurations, error -61 [ 1664.043587][ T9] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 1664.100966][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 1664.131278][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1664.170559][ T9] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1664.193928][ T9] usb 5-1: can't read configurations, error -61 [ 1664.212068][ T9] usb usb5-port1: unable to enumerate USB device [ 1664.476001][T30322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1664.518277][ T30] kauditd_printk_skb: 58 callbacks suppressed [ 1664.518296][ T30] audit: type=1326 audit(1770362489.945:1553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30307 comm="syz.0.6408" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x0 [ 1664.553035][T30322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1665.565322][T30336] : renamed from bond_slave_0 (while UP) [ 1665.832811][ T107] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 1666.012783][ T107] usb 5-1: Using ep0 maxpacket: 16 [ 1666.112656][T30345] futex_wake_op: syz.2.6413 tries to shift op by 32; fix this program [ 1666.177540][ T107] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1666.209525][ T107] usb 5-1: can't read configurations, error -61 [ 1666.372863][ T107] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 1666.532880][ T107] usb 5-1: Using ep0 maxpacket: 16 [ 1666.557629][ T107] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1666.572924][ T107] usb 5-1: can't read configurations, error -61 [ 1666.593602][ T107] usb usb5-port1: attempt power cycle [ 1666.698445][ T5898] usb 2-1: new high-speed USB device number 118 using dummy_hcd [ 1666.865274][ T5898] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1666.884369][ T5898] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 1666.935199][ T5898] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 1666.952964][ T5898] usb 2-1: Product: syz [ 1666.974374][ T107] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 1666.992882][ T5898] usb 2-1: Manufacturer: syz [ 1666.998385][ T5898] usb 2-1: SerialNumber: syz [ 1667.004608][ T107] usb 5-1: Using ep0 maxpacket: 16 [ 1667.012371][ T107] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1667.021657][ T107] usb 5-1: can't read configurations, error -61 [ 1667.156578][T30359] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 1667.163765][ T107] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 1667.193596][ T107] usb 5-1: Using ep0 maxpacket: 16 [ 1667.202488][ T107] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 1667.211034][ T107] usb 5-1: can't read configurations, error -61 [ 1667.233566][ T107] usb usb5-port1: unable to enumerate USB device [ 1667.247567][ T5898] usblp 2-1:1.0: usblp0: USB Unidirectional printer dev 118 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1667.252154][T30361] loop5: detected capacity change from 0 to 4095 [ 1667.548590][T30369] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6424'. [ 1667.574759][T30369] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6424'. [ 1667.841732][T30384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1667.864499][T30384] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1667.915141][ T9] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 1668.123303][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 1668.130352][ T9] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1668.139926][ T9] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1668.152816][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1668.171166][ T9] usb 3-1: Product: syz [ 1668.176803][ T9] usb 3-1: Manufacturer: syz [ 1668.184103][ T9] usb 3-1: SerialNumber: syz [ 1668.200621][ T9] usb 3-1: config 0 descriptor?? [ 1668.416686][ T9] gs_usb 3-1:0.0: Couldn't get device config: (err=-121) [ 1668.424139][ T9] gs_usb 3-1:0.0: probe with driver gs_usb failed with error -121 [ 1669.031721][T30400] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1669.042594][T30400] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1669.090609][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.097395][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.348800][ T5891] usb 2-1: USB disconnect, device number 118 [ 1669.361785][ T5891] usblp0: removed [ 1669.380522][ T5898] usb 3-1: USB disconnect, device number 45 [ 1669.550004][T30409] futex_wake_op: syz.4.6432 tries to shift op by 32; fix this program [ 1669.646265][T30413] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1669.672563][T30413] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1670.012888][ T5891] usb 2-1: new high-speed USB device number 119 using dummy_hcd [ 1670.068137][T30423] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1670.184489][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1670.256501][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1670.278101][ T5891] usb 2-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 1670.313382][ T5891] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1670.343162][ T5891] usb 2-1: config 0 descriptor?? [ 1670.391394][T30433] loop5: detected capacity change from 0 to 7 [ 1670.446987][T21902] loop5: p1 < > p4 [ 1670.451271][T21902] loop5: partition table partially beyond EOD, truncated [ 1670.526660][T30430] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6441'. [ 1670.563971][T30433] loop5: p1 < > p4 [ 1670.567984][T30433] loop5: partition table partially beyond EOD, truncated [ 1670.672818][ T5898] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 1670.758178][T30263] udevd[30263]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory [ 1670.768656][ T5891] cp2112 0003:10C4:EA90.0046: unknown main item tag 0x0 [ 1670.800540][T30245] udevd[30245]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1670.822190][ T5891] cp2112 0003:10C4:EA90.0046: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.1-1/input0 [ 1670.894944][ T5898] usb 5-1: Using ep0 maxpacket: 16 [ 1670.903387][ T5891] cp2112 0003:10C4:EA90.0046: error requesting version [ 1670.943134][ T5891] cp2112 0003:10C4:EA90.0046: probe with driver cp2112 failed with error -71 [ 1670.993507][ T5891] usb 2-1: USB disconnect, device number 119 [ 1670.999689][ T5898] usb 5-1: config 0 has no interfaces? [ 1671.011154][T30263] udevd[30263]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory [ 1671.016962][T30245] udevd[30245]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1671.045093][ T5898] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1671.134738][ T5898] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1671.164751][T18837] Bluetooth: hci5: command 0x0406 tx timeout [ 1671.210692][ T5898] usb 5-1: Manufacturer: syz [ 1671.225697][ T5898] usb 5-1: config 0 descriptor?? [ 1671.236022][T30446] fido_id[30446]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 1671.295295][T30460] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6446'. [ 1671.536569][T30466] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1671.548015][T30466] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1671.664626][ T5898] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 1672.177912][ T5898] usb 3-1: Using ep0 maxpacket: 32 [ 1672.197848][ T5898] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=67.fe [ 1672.214165][ T5898] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1672.298811][ T5898] usb 3-1: Product: syz [ 1672.319197][ T5898] usb 3-1: Manufacturer: syz [ 1672.338527][ T5898] usb 3-1: SerialNumber: syz [ 1672.377597][ T5898] usb 3-1: config 0 descriptor?? [ 1672.690672][T30471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1672.711233][T30471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1672.740512][ T5898] snd-usb-6fire 3-1:0.0: unknown device firmware state received from device: [ 1672.763541][ T5898] eb aa 3b 80 9b e4 7a f0 [ 1672.781514][ T5898] snd-usb-6fire 3-1:0.0: probe with driver snd-usb-6fire failed with error -5 [ 1673.062299][T30470] futex_wake_op: syz.0.6450 tries to shift op by 32; fix this program [ 1673.541189][T16699] usb 5-1: USB disconnect, device number 126 [ 1674.174409][ T5945] usb 3-1: USB disconnect, device number 46 [ 1674.371293][T30482] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6453'. [ 1674.531527][T30487] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1674.577082][T30488] loop5: detected capacity change from 0 to 7 [ 1674.584749][T30488] loop5: p1 < > p4 [ 1674.585786][T30487] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1674.588602][T30488] loop5: partition table partially beyond EOD, truncated [ 1674.664373][T30488] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6454'. [ 1674.742807][ T5945] usb 3-1: new full-speed USB device number 47 using dummy_hcd [ 1674.887047][ T5945] usb 3-1: device descriptor read/64, error -71 [ 1675.192828][ T5945] usb 3-1: new full-speed USB device number 48 using dummy_hcd [ 1675.271104][T30508] input: syz1 as /devices/virtual/input/input196 [ 1675.293982][ T9] usb 2-1: new full-speed USB device number 120 using dummy_hcd [ 1675.326933][ T5945] usb 3-1: device descriptor read/64, error -71 [ 1675.443350][ T5945] usb usb3-port1: attempt power cycle [ 1675.680848][ T9] usb 2-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 1675.715641][ T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1675.785255][ T9] usb 2-1: config 0 descriptor?? [ 1675.848758][ T9] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 1675.932850][ T5945] usb 3-1: new full-speed USB device number 49 using dummy_hcd [ 1675.953863][ T5945] usb 3-1: device descriptor read/8, error -71 [ 1676.226899][T30520] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1676.233040][ T5945] usb 3-1: new full-speed USB device number 50 using dummy_hcd [ 1676.263664][T30520] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1676.284283][ T5945] usb 3-1: device descriptor read/8, error -71 [ 1676.300344][ T30] audit: type=1326 audit(1770362501.725:1554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.409177][ T5945] usb usb3-port1: unable to enumerate USB device [ 1676.461217][ T30] audit: type=1326 audit(1770362501.725:1555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.515142][ T30] audit: type=1326 audit(1770362501.725:1556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.568296][ T30] audit: type=1326 audit(1770362501.725:1557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.655185][ T30] audit: type=1326 audit(1770362501.755:1558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=53 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.769407][ T30] audit: type=1326 audit(1770362501.755:1559): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.846074][ T30] audit: type=1326 audit(1770362501.825:1560): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.871412][ T30] audit: type=1326 audit(1770362501.825:1561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.900467][ T30] audit: type=1326 audit(1770362501.825:1562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.924084][ T30] audit: type=1326 audit(1770362501.825:1563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30519 comm="syz.5.6464" exe="/root/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1676.967794][T30528] loop5: detected capacity change from 0 to 7 [ 1676.978597][T30528] loop5: p1 < > p4 [ 1676.982465][T30528] loop5: partition table partially beyond EOD, truncated [ 1677.030539][T30528] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6467'. [ 1677.570810][T30529] futex_wake_op: syz.4.6465 tries to shift op by 32; fix this program [ 1678.090073][ T9] gp8psk: usb in 128 operation failed. [ 1678.104289][ T9] gp8psk: usb in 137 operation failed. [ 1678.117029][ T9] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1678.209892][ T9] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 1678.697336][T30545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1678.748475][T30545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1678.789695][T16699] usb 2-1: USB disconnect, device number 120 [ 1679.109620][T30560] macvtap0: entered promiscuous mode [ 1679.131225][T30560] macvtap0: left promiscuous mode [ 1679.240486][T30565] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1679.257462][T30565] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1679.323850][ T9] usb 2-1: new full-speed USB device number 121 using dummy_hcd [ 1679.368101][T30569] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6480'. [ 1679.473261][T16699] usb 3-1: new full-speed USB device number 51 using dummy_hcd [ 1679.490314][ T9] usb 2-1: config 0 interface 0 altsetting 251 has an invalid descriptor for endpoint zero, skipping [ 1679.507243][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1679.522493][ T9] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1679.532870][ T9] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1679.541527][ T9] usb 2-1: Product: syz [ 1679.547530][ T9] usb 2-1: Manufacturer: syz [ 1679.552294][ T9] usb 2-1: SerialNumber: syz [ 1679.579743][ T9] usb 2-1: config 0 descriptor?? [ 1679.642216][ T9] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1679.672160][T16699] usb 3-1: config index 0 descriptor too short (expected 63186, got 210) [ 1679.681693][T16699] usb 3-1: config 0 has an invalid interface number: 106 but max is 0 [ 1679.690464][T16699] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1679.703244][T16699] usb 3-1: config 0 has no interface number 0 [ 1679.711905][T16699] usb 3-1: config 0 interface 106 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 1679.728793][T30245] udevd[30245]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1679.749264][T16699] usb 3-1: config 0 interface 106 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1679.767629][T16699] usb 3-1: config 0 interface 106 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 6 [ 1679.790960][T16699] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 1679.800618][T16699] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1679.820338][T16699] usb 3-1: config 0 descriptor?? [ 1679.841053][ T9] usb 2-1: USB disconnect, device number 121 [ 1679.889035][T16699] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1680.039408][ T9] usb 3-1: USB disconnect, device number 51 [ 1680.045807][ T3517] usb 3-1: Failed to submit usb control message: -71 [ 1680.055292][ T3517] usb 3-1: unable to send the bmi data to the device: -71 [ 1680.064650][ T3517] usb 3-1: unable to get target info from device [ 1680.071615][ T3517] usb 3-1: could not get target info (-71) [ 1680.079644][ T3517] usb 3-1: could not probe fw (-71) [ 1680.546506][T30582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1680.556111][T30582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1680.742821][T16699] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 1680.882820][ T5945] usb 2-1: new high-speed USB device number 122 using dummy_hcd [ 1680.893030][T16699] usb 5-1: device descriptor read/64, error -71 [ 1681.035142][ T5945] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 1681.082325][ T5945] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1681.105269][ T5945] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1681.118959][ T5945] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1681.135038][T16699] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 1681.189655][ T5945] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1681.273170][T16699] usb 5-1: device descriptor read/64, error -71 [ 1681.326733][ T5945] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1681.331726][T30609] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6492'. [ 1681.341982][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1681.402593][ T5945] usb 2-1: config 0 descriptor?? [ 1681.411358][T30589] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1681.429976][T16699] usb usb5-port1: attempt power cycle [ 1681.860395][ T5945] plantronics 0003:047F:FFFF.0047: reserved main item tag 0xd [ 1681.872830][T16699] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1681.881834][ T5945] plantronics 0003:047F:FFFF.0047: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 1681.903922][T16699] usb 5-1: device descriptor read/8, error -71 [ 1682.208448][T16699] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1682.260668][T16699] usb 5-1: device descriptor read/8, error -71 [ 1682.373048][T16699] usb usb5-port1: unable to enumerate USB device [ 1682.640016][ T9] usb 2-1: USB disconnect, device number 122 [ 1682.684637][T30627] netlink: 'syz.2.6497': attribute type 3 has an invalid length. [ 1683.068335][T30637] netlink: 'syz.1.6500': attribute type 29 has an invalid length. [ 1683.254282][T30641] netlink: 'syz.1.6500': attribute type 29 has an invalid length. [ 1683.283856][T30637] netlink: 500 bytes leftover after parsing attributes in process `syz.1.6500'. [ 1683.805648][T30646] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6502'. [ 1683.821379][T30646] netlink: 'syz.4.6502': attribute type 13 has an invalid length. [ 1684.048193][T30646] vxlan0: entered promiscuous mode [ 1684.218959][T16923] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1684.269172][T16923] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1684.380139][T16923] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1684.896665][T16923] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1685.075209][T24029] bridge_slave_1: left allmulticast mode [ 1685.081068][T24029] bridge_slave_1: left promiscuous mode [ 1685.092406][T24029] bridge0: port 2(bridge_slave_1) entered disabled state [ 1685.276396][T24029] bridge_slave_0: left allmulticast mode [ 1685.334756][T24029] bridge_slave_0: left promiscuous mode [ 1685.397709][T24029] bridge0: port 1(bridge_slave_0) entered disabled state [ 1685.492303][T16699] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 1685.672880][T16699] usb 3-1: device descriptor read/64, error -71 [ 1685.912966][T16699] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 1686.131700][T30668] netlink: 'syz.5.6509': attribute type 3 has an invalid length. [ 1686.200305][T24029] veth0_to_bond: left allmulticast mode [ 1686.207081][T24029] veth0_to_bond: left promiscuous mode [ 1686.213292][T24029] bridge2: port 1(veth0_to_bond) entered disabled state [ 1686.245237][T24029] bond_slave_0: left promiscuous mode [ 1686.251609][T24029] bond_slave_1: left promiscuous mode [ 1686.257273][T16699] usb 3-1: device descriptor read/64, error -71 [ 1686.390906][T16699] usb usb3-port1: attempt power cycle [ 1686.420426][T24029] ip6gretap0 (unregistering): left promiscuous mode [ 1686.732864][T16699] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 1686.772185][T16699] usb 3-1: device descriptor read/8, error -71 [ 1686.990973][T30681] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6513'. [ 1687.013768][T16699] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 1687.043609][T16699] usb 3-1: device descriptor read/8, error -71 [ 1687.163238][T16699] usb usb3-port1: unable to enumerate USB device [ 1687.207965][ T30] kauditd_printk_skb: 15 callbacks suppressed [ 1687.207987][ T30] audit: type=1326 audit(1770362512.635:1579): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30684 comm="syz.5.6514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1687.239009][ T30] audit: type=1326 audit(1770362512.635:1580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30684 comm="syz.5.6514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1687.262842][ T30] audit: type=1326 audit(1770362512.635:1581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30684 comm="syz.5.6514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1687.286743][ T30] audit: type=1326 audit(1770362512.635:1582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30684 comm="syz.5.6514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1687.321578][ T30] audit: type=1326 audit(1770362512.635:1583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30684 comm="syz.5.6514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1687.392864][ T30] audit: type=1326 audit(1770362512.715:1584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30684 comm="syz.5.6514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1687.417483][ T30] audit: type=1326 audit(1770362512.715:1585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30684 comm="syz.5.6514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1687.477649][ T30] audit: type=1326 audit(1770362512.715:1586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30684 comm="syz.5.6514" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1687.533995][T24029] bond12 (unregistering): (slave macvlan2): Removing an active aggregator [ 1687.544662][T24029] bond12 (unregistering): (slave macvlan2): Releasing backup interface [ 1687.574630][T24029] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1687.593219][T24029] bond_slave_0: left allmulticast mode [ 1687.602032][T24029] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1687.614456][T24029] bond_slave_1: left allmulticast mode [ 1687.621730][T24029] bond0 (unregistering): Released all slaves [ 1687.636931][T24029] bond1 (unregistering): Released all slaves [ 1687.906724][T24029] bond2 (unregistering): (slave dummy0): Releasing active interface [ 1687.915027][T24029] dummy0: left promiscuous mode [ 1687.926680][T24029] bond2 (unregistering): Released all slaves [ 1688.194544][T24029] bond3 (unregistering): Released all slaves [ 1688.265338][T24029] bond4 (unregistering): Released all slaves [ 1688.294389][T24029] bond5 (unregistering): Released all slaves [ 1688.408714][T30696] netlink: 'syz.5.6518': attribute type 3 has an invalid length. [ 1688.581380][T24029] bond6 (unregistering): Released all slaves [ 1688.919932][T24029] bond7 (unregistering): Released all slaves [ 1689.272543][T24029] bond8 (unregistering): Released all slaves [ 1689.294551][T24029] bond9 (unregistering): Released all slaves [ 1689.664920][T24029] bond10 (unregistering): Released all slaves [ 1689.678376][T24029] bond11 (unregistering): Released all slaves [ 1689.888942][T24029] bond12 (unregistering): Released all slaves [ 1689.902061][T24029] bond13 (unregistering): Released all slaves [ 1689.915635][T24029] bond14 (unregistering): Released all slaves [ 1689.929354][T24029] bond15 (unregistering): Released all slaves [ 1689.990362][T30700] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6519'. [ 1690.224067][T24029] tipc: Disabling bearer [ 1690.252055][T24029] tipc: Left network mode [ 1690.354541][ T30] audit: type=1326 audit(1770362515.775:1587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30701 comm="syz.0.6520" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1690.479487][ T30] audit: type=1326 audit(1770362515.775:1588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30701 comm="syz.0.6520" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1690.546803][T30713] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6521'. [ 1690.632890][T30718] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6525'. [ 1690.837689][T30719] tipc: Enabling of bearer rejected, failed to enable media [ 1691.056706][T24029] hsr_slave_0: left promiscuous mode [ 1691.071203][T24029] hsr_slave_1: left promiscuous mode [ 1691.085082][T24029] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1691.096517][T24029] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1691.106422][T24029] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1691.114653][T24029] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1691.176556][T24029] veth1_vlan: left allmulticast mode [ 1691.185120][T24029] veth1_macvtap: left promiscuous mode [ 1691.192515][T24029] veth0_macvtap: left promiscuous mode [ 1691.199338][T24029] veth1_vlan: left promiscuous mode [ 1691.206583][T24029] veth0_vlan: left promiscuous mode [ 1691.491129][T30726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1691.529975][T30726] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1691.642840][T24029] pimreg (unregistering): left allmulticast mode [ 1691.643020][T18837] Bluetooth: hci4: command 0x0406 tx timeout [ 1691.720321][T24029] pim6reg (unregistering): left allmulticast mode [ 1691.924812][ T5891] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 1692.093283][ T5891] usb 2-1: Using ep0 maxpacket: 32 [ 1692.100043][ T5891] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 1692.262774][ T5891] usb 2-1: config 0 has no interface number 0 [ 1692.305527][ T5891] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1692.321609][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1692.512945][ T5891] usb 2-1: Product: syz [ 1692.517327][ T5891] usb 2-1: Manufacturer: syz [ 1692.552564][ T5891] usb 2-1: SerialNumber: syz [ 1692.600681][ T5891] usb 2-1: config 0 descriptor?? [ 1692.635348][ T5891] smsc95xx v2.0.0 [ 1693.069378][T30741] netlink: 'syz.5.6532': attribute type 3 has an invalid length. [ 1693.495593][ T5891] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 1693.697220][ T5891] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1693.711069][ T5891] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 1693.771042][ T5891] usb 2-1: USB disconnect, device number 123 [ 1694.088607][T30745] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1694.237325][T24029] team0 (unregistering): Port device team_slave_1 removed [ 1694.409864][T24029] team0 (unregistering): Port device C removed [ 1694.511366][T30753] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6536'. [ 1694.626543][T30755] fuse: Unknown parameter '0x000000000000000500000035184372093952' [ 1695.085074][ T30] kauditd_printk_skb: 33 callbacks suppressed [ 1695.085093][ T30] audit: type=1326 audit(1770362520.515:1622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30757 comm="syz.0.6538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1695.117452][ T30] audit: type=1326 audit(1770362520.535:1623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30757 comm="syz.0.6538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1695.153557][ T30] audit: type=1326 audit(1770362520.545:1624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30757 comm="syz.0.6538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1695.320189][T30761] program syz.0.6538 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1695.756923][ T30] audit: type=1326 audit(1770362521.175:1625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30757 comm="syz.0.6538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1695.871747][ T30] audit: type=1326 audit(1770362521.175:1626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30757 comm="syz.0.6538" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1696.043830][T24029] IPVS: stop unused estimator thread 0... [ 1696.633432][T30795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1696.680588][T30795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1696.696001][T30795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1696.721054][T30798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1696.732572][T30795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1696.774372][T30798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1698.494630][T30832] bridge0: port 3(syz_tun) entered blocking state [ 1698.510920][T30832] bridge0: port 3(syz_tun) entered disabled state [ 1698.570017][T30832] syz_tun: entered allmulticast mode [ 1698.615067][T30832] syz_tun: entered promiscuous mode [ 1698.709560][T30832] bridge0: port 3(syz_tun) entered blocking state [ 1698.716195][T30832] bridge0: port 3(syz_tun) entered forwarding state [ 1698.824728][T30833] bridge0: port 3(syz_tun) entered learning state [ 1699.594792][T30845] input: syz1 as /devices/virtual/input/input198 [ 1700.057071][T30859] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6566'. [ 1700.122275][T30859] veth0_to_bond: left allmulticast mode [ 1700.140649][T30859] veth0_to_bond: left promiscuous mode [ 1700.169321][T30859] bridge6: port 1(veth0_to_bond) entered disabled state [ 1700.188331][T30859] bridge7: port 1(veth0_to_bond) entered blocking state [ 1700.239770][T30859] bridge7: port 1(veth0_to_bond) entered disabled state [ 1700.249350][T30859] veth0_to_bond: entered allmulticast mode [ 1700.271903][T30859] veth0_to_bond: entered promiscuous mode [ 1700.402309][T29333] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 1700.613874][T30865] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1700.828218][T30871] loop5: detected capacity change from 0 to 7 [ 1700.837319][T29333] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1700.851803][T29333] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1700.860899][T29333] usb 5-1: Product: syz [ 1700.866197][T29333] usb 5-1: Manufacturer: syz [ 1700.871746][T29333] usb 5-1: SerialNumber: syz [ 1701.403357][T29333] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1701.452950][T29333] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1701.750115][T30881] IPVS: stopping master sync thread 26279 ... [ 1702.803550][T30861] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1702.812475][T30861] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1702.865932][T29333] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPROTO [ 1702.889064][T29333] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 1703.038353][T29333] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 1703.063177][T29333] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1703.120705][T29333] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1703.152930][ T30] audit: type=1326 audit(1770362528.575:1627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30896 comm="syz.5.6577" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faf2659aeb9 code=0x0 [ 1703.329135][T29333] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 1703.399299][T29333] usb 5-1: USB disconnect, device number 5 [ 1704.136660][T30917] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6579'. [ 1704.154604][T30917] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6579'. [ 1704.925498][T30931] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6584'. [ 1704.952818][T30931] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6584'. [ 1705.384384][ T5898] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 1705.497107][T30945] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1705.537460][T30945] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1705.592792][ T5898] usb 2-1: Using ep0 maxpacket: 16 [ 1705.742010][ T5898] usb 2-1: config 0 has no interfaces? [ 1705.783330][ T5898] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1705.796495][ T5898] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1705.813780][ T5898] usb 2-1: Manufacturer: syz [ 1705.824253][ T5898] usb 2-1: config 0 descriptor?? [ 1705.840534][T30949] FAULT_INJECTION: forcing a failure. [ 1705.840534][T30949] name failslab, interval 1, probability 0, space 0, times 0 [ 1706.018752][T30949] CPU: 1 UID: 0 PID: 30949 Comm: syz.4.6588 Tainted: G L syzkaller #0 PREEMPT(full) [ 1706.018788][T30949] Tainted: [L]=SOFTLOCKUP [ 1706.018796][T30949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1706.018808][T30949] Call Trace: [ 1706.018816][T30949] [ 1706.018825][T30949] dump_stack_lvl+0xe8/0x150 [ 1706.018857][T30949] should_fail_ex+0x412/0x560 [ 1706.018889][T30949] should_failslab+0xa8/0x100 [ 1706.018913][T30949] __kmalloc_noprof+0xde/0x7e0 [ 1706.018934][T30949] ? io_cache_alloc_new+0x40/0x100 [ 1706.018965][T30949] io_cache_alloc_new+0x40/0x100 [ 1706.018993][T30949] __io_prep_rw+0x2bf/0xed0 [ 1706.019022][T30949] ? __pfx___io_prep_rw+0x10/0x10 [ 1706.019038][T30949] ? percpu_ref_get_many+0x21/0x1e0 [ 1706.019062][T30949] ? percpu_ref_get_many+0x21/0x1e0 [ 1706.019099][T30949] io_prep_rwv+0x8e/0x440 [ 1706.019117][T30949] ? __pfx___io_alloc_req_refill+0x10/0x10 [ 1706.019142][T30949] ? __pfx_io_prep_rwv+0x10/0x10 [ 1706.019167][T30949] ? blk_start_plug_nr_ios+0x7e/0x1c0 [ 1706.019191][T30949] io_submit_sqes+0xad2/0x2130 [ 1706.019252][T30949] __se_sys_io_uring_enter+0x2f7/0x2c30 [ 1706.019293][T30949] ? ksys_write+0x1e6/0x270 [ 1706.019325][T30949] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 1706.019343][T30949] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1706.019373][T30949] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1706.019399][T30949] ? __fget_files+0x3a0/0x420 [ 1706.019437][T30949] ? fput+0xa0/0xd0 [ 1706.019461][T30949] ? ksys_write+0x242/0x270 [ 1706.019491][T30949] ? __pfx_ksys_write+0x10/0x10 [ 1706.019524][T30949] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 1706.019547][T30949] do_syscall_64+0xe2/0xf80 [ 1706.019568][T30949] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1706.019588][T30949] ? trace_irq_disable+0x37/0x100 [ 1706.019607][T30949] ? clear_bhb_loop+0x60/0xb0 [ 1706.019630][T30949] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1706.019650][T30949] RIP: 0033:0x7f105c39aeb9 [ 1706.019669][T30949] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1706.019684][T30949] RSP: 002b:00007f105d220028 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1706.019713][T30949] RAX: ffffffffffffffda RBX: 00007f105c615fa0 RCX: 00007f105c39aeb9 [ 1706.019728][T30949] RDX: 0000000000002000 RSI: 00000000000847ba RDI: 0000000000000004 [ 1706.019741][T30949] RBP: 00007f105d220090 R08: 0000000000000000 R09: 0000000000000000 [ 1706.019753][T30949] R10: 000000000000000e R11: 0000000000000246 R12: 0000000000000001 [ 1706.019764][T30949] R13: 00007f105c616038 R14: 00007f105c615fa0 R15: 00007f105c73fa48 [ 1706.019797][T30949] [ 1706.600907][T30956] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1706.627911][T30956] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1706.667702][ T30] audit: type=1326 audit(1770362532.095:1628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1706.745169][T30956] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6590'. [ 1706.769608][ T30] audit: type=1326 audit(1770362532.115:1629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1706.802857][ T30] audit: type=1326 audit(1770362532.115:1630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=468 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1706.825975][ T30] audit: type=1326 audit(1770362532.115:1631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1706.850548][ T30] audit: type=1326 audit(1770362532.115:1632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1706.874362][ T30] audit: type=1326 audit(1770362532.115:1633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1706.898995][ T30] audit: type=1326 audit(1770362532.115:1634): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1706.997703][ T30] audit: type=1326 audit(1770362532.125:1635): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1707.061997][ T30] audit: type=1326 audit(1770362532.125:1636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30955 comm="syz.5.6590" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1707.282782][ T5945] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1707.432765][ T5945] usb 5-1: Using ep0 maxpacket: 8 [ 1707.440153][ T5945] usb 5-1: config index 0 descriptor too short (expected 6427, got 27) [ 1707.449402][ T5945] usb 5-1: config 0 has an invalid interface number: 21 but max is 0 [ 1707.459633][ T5945] usb 5-1: config 0 has no interface number 0 [ 1707.466210][ T5945] usb 5-1: config 0 interface 21 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1707.479063][ T5945] usb 5-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=c3.d4 [ 1707.489787][ T5945] usb 5-1: New USB device strings: Mfr=78, Product=1, SerialNumber=0 [ 1707.502969][ T5945] usb 5-1: Product: syz [ 1707.507300][ T5945] usb 5-1: Manufacturer: syz [ 1707.518605][ T5945] usb 5-1: config 0 descriptor?? [ 1707.852876][ T5945] usb 2-1: USB disconnect, device number 124 [ 1708.212318][T30974] loop5: detected capacity change from 0 to 7 [ 1708.219721][T30974] loop5: p1 < > p4 [ 1708.223731][T30974] loop5: partition table partially beyond EOD, truncated [ 1708.265913][T30974] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6595'. [ 1708.911459][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 1708.911481][ T30] audit: type=1326 audit(1770362534.275:1662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1708.959942][ T30] audit: type=1326 audit(1770362534.275:1663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1708.985248][ T30] audit: type=1326 audit(1770362534.275:1664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1709.025960][ T30] audit: type=1326 audit(1770362534.275:1665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1709.079924][ T30] audit: type=1326 audit(1770362534.285:1666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1709.162866][ T5945] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 1709.178848][ T30] audit: type=1326 audit(1770362534.285:1667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1709.220032][ T30] audit: type=1326 audit(1770362534.285:1668): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1709.251181][ T30] audit: type=1326 audit(1770362534.285:1669): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1709.256020][T30991] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6599'. [ 1709.283511][T30991] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6599'. [ 1709.305750][ T30] audit: type=1326 audit(1770362534.285:1670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1709.330992][ T30] audit: type=1326 audit(1770362534.285:1671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30983 comm="syz.1.6598" exe="/root/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7f86fdf9aeb9 code=0x7ffc0000 [ 1709.402841][ T5945] usb 2-1: Using ep0 maxpacket: 16 [ 1709.496281][ T5945] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1709.503117][ T5945] usb 2-1: New USB device found, idVendor=0dfc, idProduct=0101, bcdDevice= 0.00 [ 1709.516292][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1709.564823][ T5945] usb 2-1: config 0 descriptor?? [ 1709.920327][T30999] netdevsim netdevsim2: Direct firmware load for / [ 1709.920327][T30999] failed with error -2 [ 1709.935700][T30999] netdevsim netdevsim2: Falling back to sysfs fallback for: / [ 1709.935700][T30999] [ 1710.158746][ T5891] usb 5-1: USB disconnect, device number 6 [ 1711.782785][ T5945] usbhid 2-1:0.0: can't add hid device: -71 [ 1711.788792][ T5945] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1711.800386][ T5945] usb 2-1: USB disconnect, device number 125 [ 1712.184458][T31016] loop6: detected capacity change from 0 to 7 [ 1712.253041][T31016] Dev loop6: unable to read RDB block 7 [ 1712.300472][ T5945] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 1712.328645][T31016] loop6: unable to read partition table [ 1712.359914][T31016] loop6: partition table beyond EOD, truncated [ 1712.382816][T31016] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 1712.465519][ T5945] usb 2-1: config 12 has an invalid descriptor of length 159, skipping remainder of the config [ 1712.495867][ T5945] usb 2-1: config 12 has 0 interfaces, different from the descriptor's value: 1 [ 1712.513169][ T5945] usb 2-1: New USB device found, idVendor=5543, idProduct=004d, bcdDevice= 0.00 [ 1712.533314][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1712.589587][ T5945] usb 2-1: rejected 1 configuration due to insufficient available bus power [ 1712.622637][ T5945] usb 2-1: no configuration chosen from 1 choice [ 1712.631796][T31023] vlan0: entered promiscuous mode [ 1712.935313][T31032] netlink: 'syz.2.6609': attribute type 9 has an invalid length. [ 1712.968590][T31018] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1712.987781][T31018] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1713.256383][ T5945] usb 3-1: new high-speed USB device number 56 using dummy_hcd [ 1713.392809][ T5945] usb 3-1: device descriptor read/64, error -71 [ 1713.682840][ T5945] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 1713.842845][ T5945] usb 3-1: device descriptor read/64, error -71 [ 1713.885642][ C0] bridge0: port 3(syz_tun) entered forwarding state [ 1713.969715][ T5945] usb usb3-port1: attempt power cycle [ 1714.442884][ T5945] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 1714.473973][ T5945] usb 3-1: device descriptor read/8, error -71 [ 1714.552856][ T9] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 1714.722776][ T5945] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 1714.754363][ T5945] usb 3-1: device descriptor read/8, error -71 [ 1714.766073][ T9] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1714.794515][ T9] usb 5-1: config 66 interface 0 has no altsetting 0 [ 1714.807900][ T9] usb 5-1: New USB device found, idVendor=0471, idProduct=0602, bcdDevice=a4.95 [ 1714.821818][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1714.836822][ T5891] usb 2-1: USB disconnect, device number 126 [ 1714.852867][ T9] usb 5-1: Product: syz [ 1714.861538][ T9] usb 5-1: Manufacturer: syz [ 1714.872967][ T5945] usb usb3-port1: unable to enumerate USB device [ 1714.879482][ T9] usb 5-1: SerialNumber: syz [ 1715.135728][ T9] ati_remote2 5-1:66.0: ati_remote2_probe(): interface 0 must have an endpoint [ 1715.153244][ T9] usb 5-1: USB disconnect, device number 7 [ 1715.233410][T31056] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6615'. [ 1715.266110][T31056] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6615'. [ 1716.368294][T31076] netlink: 'syz.2.6620': attribute type 9 has an invalid length. [ 1716.391858][ T9] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 1716.418797][T31076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6620'. [ 1716.491651][T31076] hsr0: entered promiscuous mode [ 1716.555721][T31076] macvlan0: entered promiscuous mode [ 1716.572525][T31076] macvlan0: entered allmulticast mode [ 1716.592841][T31076] hsr0: entered allmulticast mode [ 1716.600461][T31076] hsr_slave_0: entered allmulticast mode [ 1716.628985][T31076] hsr_slave_1: entered allmulticast mode [ 1717.083084][T31094] netlink: 44 bytes leftover after parsing attributes in process `syz.5.6624'. [ 1717.117115][T31085] could not allocate digest TFM handle sha512-ce [ 1717.126619][T31094] netlink: 44 bytes leftover after parsing attributes in process `syz.5.6624'. [ 1717.622942][T16699] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 1717.872760][T16699] usb 2-1: Using ep0 maxpacket: 32 [ 1717.880776][T16699] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1717.976255][T16699] usb 2-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1717.985960][T16699] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1718.002641][T16699] usb 2-1: Product: syz [ 1718.014200][T16699] usb 2-1: Manufacturer: syz [ 1718.049556][T16699] usb 2-1: SerialNumber: syz [ 1718.115944][T16699] usb 2-1: config 0 descriptor?? [ 1718.147400][T16699] usb 2-1: bad CDC descriptors [ 1718.164869][T16699] usb 2-1: unsupported MDLM descriptors [ 1718.357956][T16699] usb 2-1: USB disconnect, device number 127 [ 1718.823003][T31118] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6629'. [ 1718.943075][T31120] veth0_to_bond: left allmulticast mode [ 1718.962806][T31120] veth0_to_bond: left promiscuous mode [ 1718.993245][T31120] bridge1: port 1(veth0_to_bond) entered disabled state [ 1719.103645][T31120] bridge2: port 1(veth0_to_bond) entered blocking state [ 1719.133513][T31120] bridge2: port 1(veth0_to_bond) entered disabled state [ 1719.159467][T31120] veth0_to_bond: entered allmulticast mode [ 1719.196617][T31120] veth0_to_bond: entered promiscuous mode [ 1719.399481][T31126] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6633'. [ 1719.462897][T31126] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6633'. [ 1719.813273][T31147] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6636'. [ 1720.465743][T31161] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6640'. [ 1721.132817][ T5945] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1721.313087][ T5945] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1721.349699][ T5945] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1721.417757][ T5945] usb 2-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 1721.445554][ T5945] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1721.491476][T31190] fuse: Bad value for 'group_id' [ 1721.497795][T31190] fuse: Bad value for 'group_id' [ 1721.513027][T31190] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6646'. [ 1721.527783][T31190] fuse: Unknown parameter '0x000000000000000a' [ 1721.548956][ T5945] usb 2-1: config 0 descriptor?? [ 1721.581263][T31172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1721.603551][T31172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1721.979544][ T5945] usbhid 2-1:0.0: can't add hid device: -71 [ 1721.985864][ T5945] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1721.996993][ T5945] usb 2-1: USB disconnect, device number 2 [ 1722.833206][ T5898] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 1722.862051][T31219] xt_hashlimit: size too large, truncated to 1048576 [ 1722.873755][T16699] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 1722.875154][T31220] xt_hashlimit: size too large, truncated to 1048576 [ 1723.037446][ T5898] usb 5-1: Using ep0 maxpacket: 32 [ 1723.048197][ T5898] usb 5-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b [ 1723.062916][ T5898] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.072444][ T5898] usb 5-1: Product: syz [ 1723.077315][T16699] usb 3-1: config 0 has an invalid interface number: 197 but max is 4 [ 1723.089208][T16699] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1723.100251][T16699] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 5 [ 1723.109411][ T5898] usb 5-1: Manufacturer: syz [ 1723.122789][ T5898] usb 5-1: SerialNumber: syz [ 1723.128627][T16699] usb 3-1: config 0 has no interface number 0 [ 1723.148628][ T5898] usb 5-1: config 0 descriptor?? [ 1723.154571][T16699] usb 3-1: config 0 interface 197 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 8 [ 1723.196038][T16699] usb 3-1: config 0 interface 197 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0 [ 1723.202996][T31227] input: syz1 as /devices/virtual/input/input200 [ 1723.206383][T16699] usb 3-1: config 0 interface 197 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1723.237136][T16699] usb 3-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=bb.42 [ 1723.246852][T16699] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1723.264572][T16699] usb 3-1: Product: syz [ 1723.269019][T16699] usb 3-1: Manufacturer: syz [ 1723.276794][T16699] usb 3-1: SerialNumber: syz [ 1723.289713][T16699] usb 3-1: config 0 descriptor?? [ 1723.299976][T31210] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 1723.381187][T31208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1723.405175][T31208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1723.419735][ T5898] peak_usb 5-1:0.0 can0: unable to request usb[type=0 value=1] err=-71 [ 1723.433486][T31229] loop5: detected capacity change from 0 to 7 [ 1723.437220][ T5898] peak_usb 5-1:0.0: unable to read PCAN-USB Pro firmware info (err -71) [ 1723.452554][T31229] loop5: p1 < > p4 [ 1723.464150][T31229] loop5: partition table partially beyond EOD, truncated [ 1723.485010][ T5898] peak_usb 5-1:0.0: probe with driver peak_usb failed with error -71 [ 1723.495082][T31229] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6660'. [ 1723.532537][T16699] usb 3-1: USB disconnect, device number 60 [ 1723.565837][ T5898] usb 5-1: USB disconnect, device number 9 [ 1723.842905][ T5945] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1723.932107][T31240] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1723.953115][T31240] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1723.973176][ T5945] usb 2-1: device descriptor read/64, error -71 [ 1724.033020][T31244] trusted_key: encrypted_key: master key parameter 'defa5lt' is invalid [ 1724.225712][ T5945] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1724.330927][T31255] vlan2: entered allmulticast mode [ 1724.339434][T31255] bridge0: port 4(vlan2) entered blocking state [ 1724.349884][T31255] bridge0: port 4(vlan2) entered disabled state [ 1724.359157][T31255] vlan2: entered promiscuous mode [ 1724.372987][ T5945] usb 2-1: device descriptor read/64, error -71 [ 1724.496991][ T5945] usb usb2-port1: attempt power cycle [ 1724.902811][ T5945] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1724.947599][ T5945] usb 2-1: device descriptor read/8, error -71 [ 1725.192789][ T5945] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1725.223621][ T5945] usb 2-1: device descriptor read/8, error -71 [ 1725.235228][T31278] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6675'. [ 1725.267973][T31279] openvswitch: netlink: Tunnel attr 24 out of range max 16 [ 1725.287474][T31279] netdevsim netdevsim2: Direct firmware load for / [ 1725.287474][T31279] failed with error -2 [ 1725.298321][T31279] netdevsim netdevsim2: Falling back to sysfs fallback for: / [ 1725.298321][T31279] [ 1725.312946][T31278] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6675'. [ 1725.333182][ T5945] usb usb2-port1: unable to enumerate USB device [ 1725.490769][T10250] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1725.499876][T10250] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1725.513798][T10250] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1725.527778][T10250] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1725.685531][T31283] bridge0: port 5(hsr0) entered blocking state [ 1725.695999][T31283] bridge0: port 5(hsr0) entered disabled state [ 1725.714151][T31283] hsr0: entered allmulticast mode [ 1725.732878][T31283] hsr_slave_0: entered allmulticast mode [ 1725.953041][T31283] hsr_slave_1: entered allmulticast mode [ 1725.961128][T31283] hsr0: entered promiscuous mode [ 1726.144056][T31283] bridge0: port 5(hsr0) entered blocking state [ 1726.150569][T31283] bridge0: port 5(hsr0) entered forwarding state [ 1726.268332][T31287] openvswitch: netlink: Message has 584 unknown bytes. [ 1726.279377][T31287] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1726.302054][T31287] syzkaller1: entered promiscuous mode [ 1726.307685][T31287] syzkaller1: entered allmulticast mode [ 1726.505901][T31286] x_tables: ip_tables: recent.0 match: invalid size 216 (kernel) != (user) 4096 [ 1726.961002][T31298] pimreg: entered allmulticast mode [ 1726.982458][T31298] fuse: Bad value for 'user_id' [ 1726.994957][T31298] fuse: Bad value for 'user_id' [ 1727.482878][T18837] Bluetooth: hci3: command 0x0406 tx timeout [ 1727.712999][T31319] loop5: detected capacity change from 0 to 7 [ 1727.724948][T30245] loop5: p1 < > p4 [ 1727.731870][T30245] loop5: partition table partially beyond EOD, truncated [ 1727.846786][T31322] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6688'. [ 1727.919655][T31319] loop5: p1 < > p4 [ 1727.983908][T31319] loop5: partition table partially beyond EOD, truncated [ 1728.299144][T30263] udevd[30263]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory [ 1728.300400][T30245] udevd[30245]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1728.810141][T31332] netlink: 'syz.0.6690': attribute type 275 has an invalid length. [ 1728.887195][T31338] fuse: Bad value for 'user_id' [ 1728.892085][T31338] fuse: Bad value for 'user_id' [ 1729.706626][T31365] kvm: kvm [31364]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc2) = 0x9d00 [ 1729.737982][T31365] kvm: kvm [31364]: vcpu0, guest rIP: 0x9114 Unhandled WRMSR(0xc1) = 0x9d00 [ 1730.533511][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.542857][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.684695][T31387] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6706'. [ 1730.832999][T31387] veth0_to_bond: left allmulticast mode [ 1730.882733][T31387] veth0_to_bond: left promiscuous mode [ 1730.916441][T31387] bridge7: port 1(veth0_to_bond) entered disabled state [ 1731.027647][T31387] bridge8: port 1(veth0_to_bond) entered blocking state [ 1731.059933][T31395] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6708'. [ 1731.077954][T31387] bridge8: port 1(veth0_to_bond) entered disabled state [ 1731.120094][T31387] veth0_to_bond: entered allmulticast mode [ 1731.168833][T31387] veth0_to_bond: entered promiscuous mode [ 1731.520664][ T30] kauditd_printk_skb: 68 callbacks suppressed [ 1731.520685][ T30] audit: type=1326 audit(1770362556.945:1740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1731.532790][ T9] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 1731.620230][ T30] audit: type=1326 audit(1770362556.995:1741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1731.691709][ T30] audit: type=1326 audit(1770362556.995:1742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1731.734034][T31409] bond8: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 1731.762162][T31409] bond8 (unregistering): Released all slaves [ 1731.784165][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 1731.827139][ T9] usb 5-1: config 0 has an invalid interface number: 151 but max is 1 [ 1731.836487][ T9] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1731.847468][ T9] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1731.856592][ T9] usb 5-1: config 0 has no interface number 0 [ 1731.863332][ T9] usb 5-1: config 0 interface 151 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1731.877537][ T30] audit: type=1326 audit(1770362556.995:1743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1731.911242][ T30] audit: type=1326 audit(1770362556.995:1744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1731.918381][ T9] usb 5-1: config 0 interface 151 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 1731.940675][ T30] audit: type=1326 audit(1770362556.995:1745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1732.035801][ T30] audit: type=1326 audit(1770362556.995:1746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1732.036508][ T9] usb 5-1: config 0 interface 151 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 210 [ 1732.058905][ T30] audit: type=1326 audit(1770362556.995:1747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faf2659aeb9 code=0x7ffc0000 [ 1732.112634][ T9] usb 5-1: config 0 interface 151 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1732.312937][ T9] usb 5-1: New USB device found, idVendor=0499, idProduct=500a, bcdDevice=e7.b7 [ 1732.322370][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1732.330898][ T9] usb 5-1: Product: syz [ 1732.346985][ T30] audit: type=1326 audit(1770362557.005:1748): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7faf2659c747 code=0x7ffc0000 [ 1732.483307][ T9] usb 5-1: Manufacturer: syz [ 1732.497911][ T9] usb 5-1: SerialNumber: syz [ 1732.516710][ T9] usb 5-1: config 0 descriptor?? [ 1732.518296][ T30] audit: type=1326 audit(1770362557.005:1749): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31405 comm="syz.5.6711" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7faf2655b78e code=0x7ffc0000 [ 1732.534644][T31402] raw-gadget.2 gadget.4: fail, usb_ep_enable returned -22 [ 1732.647349][ T9] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1732.951910][ T9] usb 5-1: USB disconnect, device number 10 [ 1733.532798][T16699] usb 3-1: new high-speed USB device number 61 using dummy_hcd [ 1733.883047][T16699] usb 3-1: Using ep0 maxpacket: 16 [ 1733.934008][T16699] usb 3-1: too many endpoints for config 0 interface 0 altsetting 109: 65, using maximum allowed: 30 [ 1733.945774][T16699] usb 3-1: config 0 interface 0 altsetting 109 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 1733.992762][T16699] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1733.999461][T16699] usb 3-1: New USB device found, idVendor=056e, idProduct=011c, bcdDevice= 0.00 [ 1734.015922][T16699] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1734.186881][T16699] usb 3-1: config 0 descriptor?? [ 1734.805755][T16699] elecom 0003:056E:011C.0048: report_id 2473884707 is invalid [ 1734.832729][T16699] elecom 0003:056E:011C.0048: item 0 4 1 8 parsing failed [ 1734.840931][T16699] elecom 0003:056E:011C.0048: probe with driver elecom failed with error -22 [ 1735.020386][ T9] usb 3-1: USB disconnect, device number 61 [ 1735.492828][ T9] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 1735.729551][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 1735.988770][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1736.010000][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1736.040269][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1736.084575][ T9] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1736.103976][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1736.118457][ T9] usb 5-1: config 0 descriptor?? [ 1736.582330][ T9] microsoft 0003:045E:07DA.0049: unknown main item tag 0x0 [ 1736.599349][ T9] microsoft 0003:045E:07DA.0049: ignoring exceeding usage max [ 1736.622460][ T9] microsoft 0003:045E:07DA.0049: ignoring exceeding usage max [ 1736.630244][ T9] microsoft 0003:045E:07DA.0049: ignoring exceeding usage max [ 1736.632786][T16699] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1736.646061][ T9] microsoft 0003:045E:07DA.0049: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 1736.661754][ T9] microsoft 0003:045E:07DA.0049: no inputs found [ 1736.672260][ T9] microsoft 0003:045E:07DA.0049: could not initialize ff, continuing anyway [ 1736.785806][T29333] usb 5-1: USB disconnect, device number 11 [ 1736.846051][T16699] usb 2-1: config 0 has an invalid interface number: 193 but max is 0 [ 1736.872740][T16699] usb 2-1: config 0 contains an unexpected descriptor of type 0x2, skipping [ 1736.881605][T16699] usb 2-1: config 0 has no interface number 0 [ 1736.909385][T16699] usb 2-1: config 0 interface 193 altsetting 0 endpoint 0x5 has invalid maxpacket 1024, setting to 64 [ 1736.917931][T31476] fido_id[31476]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1736.952024][T16699] usb 2-1: config 0 interface 193 altsetting 0 bulk endpoint 0xD has invalid maxpacket 8 [ 1736.984464][T16699] usb 2-1: config 0 interface 193 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 64 [ 1737.027337][T16699] usb 2-1: config 0 interface 193 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 1737.062194][T16699] usb 2-1: config 0 interface 193 altsetting 0 has a duplicate endpoint with address 0xD, skipping [ 1737.095953][T16699] usb 2-1: config 0 interface 193 altsetting 0 endpoint 0x8E has invalid maxpacket 1519, setting to 64 [ 1737.122389][T16699] usb 2-1: config 0 interface 193 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 1737.150941][T16699] usb 2-1: config 0 interface 193 altsetting 0 has a duplicate endpoint with address 0x5, skipping [ 1737.198724][T16699] usb 2-1: Dual-Role OTG device on HNP port [ 1737.205310][T16699] usb 2-1: New USB device found, idVendor=19d2, idProduct=fffc, bcdDevice=2d.a0 [ 1737.214547][T16699] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1737.222842][T16699] usb 2-1: Product: syz [ 1737.227127][T16699] usb 2-1: Manufacturer: syz [ 1737.231844][T16699] usb 2-1: SerialNumber: syz [ 1737.241331][T16699] usb 2-1: config 0 descriptor?? [ 1737.248299][T31471] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 1737.257529][T31471] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 1737.470360][T16699] option 2-1:0.193: GSM modem (1-port) converter detected [ 1737.676366][T31471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1737.685284][T31471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1737.895648][T31471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1737.904452][T31471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1738.109300][ T9] usb 2-1: USB disconnect, device number 7 [ 1738.125296][ T9] option 2-1:0.193: device disconnected [ 1791.966404][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1791.973209][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1842.234372][T31502] random: crng reseeded on system resumption [ 1844.148237][T31533] kvm: user requested TSC rate below hardware speed [ 1845.142769][ T9] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1845.272748][ T9] usb 2-1: device descriptor read/64, error -71 [ 1845.516310][ T9] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 1845.675745][ T9] usb 2-1: device descriptor read/64, error -71 [ 1845.793403][ T9] usb usb2-port1: attempt power cycle [ 1846.153001][ T9] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1846.184339][ T9] usb 2-1: device descriptor read/8, error -71 [ 1846.206726][T31571] loop6: detected capacity change from 0 to 7 [ 1846.221081][T31495] Dev loop6: unable to read RDB block 7 [ 1846.227298][T31495] loop6: unable to read partition table [ 1846.236134][T31495] loop6: partition table beyond EOD, truncated [ 1846.255933][T31571] Dev loop6: unable to read RDB block 7 [ 1846.261676][T31571] loop6: unable to read partition table [ 1846.288161][T31571] loop6: partition table beyond EOD, truncated [ 1846.296098][T31571] loop_reread_partitions: partition scan of loop6 (被x ) failed (rc=-5) [ 1846.314342][T28051] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1846.335624][ T5194] Dev loop6: unable to read RDB block 7 [ 1846.341248][ T5194] loop6: unable to read partition table [ 1846.347759][T31577] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 1846.355734][ T5194] loop6: partition table beyond EOD, truncated [ 1846.428443][ T9] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1846.468614][ T9] usb 2-1: device descriptor read/8, error -71 [ 1846.485717][T28051] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 1846.499382][T28051] usb 5-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 1846.509629][T28051] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1846.521088][T28051] usb 5-1: config 0 descriptor?? [ 1846.534104][T28051] smsusb:smsusb_probe: board id=8, interface number 0 [ 1846.545693][T28051] smsusb:smsusb_probe: Device initialized with return code -19 [ 1846.583191][ T9] usb usb2-port1: unable to enumerate USB device [ 1846.671969][T31589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1846.681404][T31589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1846.864262][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 1846.864282][ T30] audit: type=1326 audit(1770362672.295:1780): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1846.899754][T31591] tipc: Started in network mode [ 1846.905694][ T30] audit: type=1326 audit(1770362672.325:1781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1846.930785][T31591] tipc: Node identity 7f000001, cluster identity 4711 [ 1846.939244][ T30] audit: type=1326 audit(1770362672.325:1782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1846.963549][T31591] tipc: Enabling of bearer rejected, failed to enable media [ 1846.973538][ T30] audit: type=1326 audit(1770362672.325:1783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1846.996699][ T30] audit: type=1326 audit(1770362672.325:1784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1847.024591][ T30] audit: type=1326 audit(1770362672.325:1785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f105c39c747 code=0x7ffc0000 [ 1847.051246][ T30] audit: type=1326 audit(1770362672.325:1786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=44 compat=0 ip=0x7f105c35b78e code=0x7ffc0000 [ 1847.075869][T31591] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 1847.085235][ T30] audit: type=1326 audit(1770362672.325:1787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f105c35b78e code=0x7ffc0000 [ 1847.112447][T31591] tipc: Enabled bearer , priority 10 [ 1847.120588][ T30] audit: type=1326 audit(1770362672.325:1788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=45 compat=0 ip=0x7f105c35b78e code=0x7ffc0000 [ 1847.175709][ T30] audit: type=1326 audit(1770362672.325:1789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31566 comm="syz.4.6748" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f105c35b78e code=0x7ffc0000 [ 1848.225055][T16699] tipc: Node number set to 2130706433 [ 1848.758954][T31612] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1848.809016][T31615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1848.883408][T31615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1849.208809][T31619] tipc: Started in network mode [ 1849.214209][T31619] tipc: Node identity , cluster identity 4711 [ 1849.222522][T31619] tipc: Failed to obtain node identity [ 1849.230793][T31619] tipc: Enabling of bearer rejected, failed to enable media [ 1849.557138][ T9] usb 5-1: USB disconnect, device number 12 [ 1849.692769][T31631] veth2: entered promiscuous mode [ 1849.908172][T31635] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1850.076810][T28051] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1850.490790][T28051] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1850.613618][T28051] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1850.632753][T28051] usb 2-1: New USB device found, idVendor=1d34, idProduct=000a, bcdDevice= 0.00 [ 1850.641965][T28051] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1850.712466][T28051] usb 2-1: config 0 descriptor?? [ 1851.141870][T28051] hid-led 0003:1D34:000A.004A: item fetching failed at offset 0/3 [ 1851.165986][T28051] hid-led 0003:1D34:000A.004A: probe with driver hid-led failed with error -22 [ 1851.331599][T31634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1851.347771][T31634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1851.953675][T28051] usb 2-1: USB disconnect, device number 12 [ 1852.432830][T28051] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1852.569529][T31673] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1852.608856][T28051] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 118, changing to 10 [ 1852.626248][T31673] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1852.635174][T28051] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 33238, setting to 1024 [ 1852.661072][T28051] usb 2-1: New USB device found, idVendor=046d, idProduct=0026, bcdDevice= 0.00 [ 1852.688957][T28051] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1852.710836][T28051] usb 2-1: config 0 descriptor?? [ 1853.142150][T28051] hid-generic 0003:046D:0026.004B: hidraw0: USB HID v0.00 Device [HID 046d:0026] on usb-dummy_hcd.1-1/input0 [ 1853.306477][T31675] tipc: Enabled bearer , priority 0 [ 1853.328432][T31675] syzkaller0: entered promiscuous mode [ 1853.341052][ T5945] usb 2-1: USB disconnect, device number 13 [ 1853.350319][T31675] syzkaller0: entered allmulticast mode [ 1853.374776][T31675] tipc: Resetting bearer [ 1853.390440][T31674] tipc: Resetting bearer [ 1853.413419][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1853.420292][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1853.454740][T31674] tipc: Disabling bearer [ 1853.522551][T31682] netlink: 'syz.0.6777': attribute type 3 has an invalid length. [ 1853.562990][ T5891] usb 3-1: new high-speed USB device number 62 using dummy_hcd [ 1853.689474][T31689] FAULT_INJECTION: forcing a failure. [ 1853.689474][T31689] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1853.707384][T31689] CPU: 1 UID: 0 PID: 31689 Comm: syz.4.6779 Tainted: G L syzkaller #0 PREEMPT(full) [ 1853.707420][T31689] Tainted: [L]=SOFTLOCKUP [ 1853.707427][T31689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1853.707438][T31689] Call Trace: [ 1853.707446][T31689] [ 1853.707455][T31689] dump_stack_lvl+0xe8/0x150 [ 1853.707487][T31689] should_fail_ex+0x412/0x560 [ 1853.707514][T31689] _copy_from_user+0x2d/0xb0 [ 1853.707542][T31689] snd_seq_oss_write+0x5b1/0x8e0 [ 1853.707560][T31689] ? kstrtoull+0x12f/0x1d0 [ 1853.707595][T31689] ? __pfx_snd_seq_oss_write+0x10/0x10 [ 1853.707617][T31689] ? apparmor_file_permission+0x17f/0x1f0 [ 1853.707651][T31689] ? security_file_permission+0x75/0x260 [ 1853.707675][T31689] odev_write+0x5a/0x80 [ 1853.707694][T31689] vfs_writev+0x4bd/0x990 [ 1853.707718][T31689] ? __pfx_odev_write+0x10/0x10 [ 1853.707742][T31689] ? __pfx_vfs_writev+0x10/0x10 [ 1853.707779][T31689] ? __fget_files+0x2a/0x420 [ 1853.707806][T31689] ? __fget_files+0x3a0/0x420 [ 1853.707832][T31689] ? __fget_files+0x2a/0x420 [ 1853.707861][T31689] __x64_sys_pwritev+0x19f/0x2a0 [ 1853.707885][T31689] ? __pfx___x64_sys_pwritev+0x10/0x10 [ 1853.707917][T31689] do_syscall_64+0xe2/0xf80 [ 1853.707940][T31689] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1853.707958][T31689] ? trace_irq_disable+0x37/0x100 [ 1853.707977][T31689] ? clear_bhb_loop+0x60/0xb0 [ 1853.708002][T31689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1853.708020][T31689] RIP: 0033:0x7f105c39aeb9 [ 1853.708040][T31689] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1853.708056][T31689] RSP: 002b:00007f105d220028 EFLAGS: 00000246 ORIG_RAX: 0000000000000128 [ 1853.708079][T31689] RAX: ffffffffffffffda RBX: 00007f105c615fa0 RCX: 00007f105c39aeb9 [ 1853.708093][T31689] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003 [ 1853.708106][T31689] RBP: 00007f105d220090 R08: 0000000000000009 R09: 0000000000000000 [ 1853.708118][T31689] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000002 [ 1853.708130][T31689] R13: 00007f105c616038 R14: 00007f105c615fa0 R15: 00007f105c73fa48 [ 1853.708162][T31689] [ 1853.788463][ T5891] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 1854.061064][ T5891] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1854.079883][ T5891] usb 3-1: Product: syz [ 1854.088852][ T5891] usb 3-1: Manufacturer: syz [ 1854.100822][ T5891] usb 3-1: SerialNumber: syz [ 1854.149588][ T5891] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 1854.179657][ T5945] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 1854.472825][ T5891] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1854.600112][T31678] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1854.609363][T31678] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1854.620464][T31678] random: crng reseeded on system resumption [ 1854.641683][T29333] usb 3-1: USB disconnect, device number 62 [ 1854.664427][ T5891] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1854.687808][ T5891] usb 5-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00 [ 1854.710890][ T5891] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1854.726894][ T5891] usb 5-1: config 0 descriptor?? [ 1855.191241][ T5891] lg-g15 0003:046D:C222.004C: hidraw0: USB HID v10.00 Device [HID 046d:c222] on usb-dummy_hcd.4-1/input0 [ 1855.244282][ T5945] ath9k_htc 3-1:1.0: ath9k_htc: Target is unresponsive [ 1855.262075][ T5945] ath9k_htc: Failed to initialize the device [ 1855.274091][T29333] usb 3-1: ath9k_htc: USB layer deinitialized [ 1855.362033][T28051] usb 5-1: USB disconnect, device number 13 [ 1855.592075][T31727] netlink: 'syz.2.6788': attribute type 3 has an invalid length. [ 1855.632480][T31728] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6787'. [ 1855.788092][T31732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1855.807893][T31732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1855.824987][T31733] netlink: 'syz.5.6790': attribute type 10 has an invalid length. [ 1855.835979][T31732] netlink: 'syz.5.6790': attribute type 10 has an invalid length. [ 1855.861801][T31733] .`: (slave dummy0): Enslaving as an active interface with an up link [ 1855.879212][T31732] .`: (slave dummy0): Releasing backup interface [ 1855.973390][T31732] team0: Port device dummy0 added [ 1856.717380][T31741] syzkaller0: entered promiscuous mode [ 1856.722952][T31741] syzkaller0: entered allmulticast mode [ 1856.788238][T31742] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6794'. [ 1857.039360][T31750] loop5: detected capacity change from 0 to 7 [ 1857.076761][T31495] Dev loop5: unable to read RDB block 7 [ 1857.097641][T31495] loop5: unable to read partition table [ 1857.126941][T31495] loop5: partition table beyond EOD, truncated [ 1857.191307][T31750] Dev loop5: unable to read RDB block 7 [ 1857.197428][T31750] loop5: unable to read partition table [ 1857.208264][T31750] loop5: partition table beyond EOD, truncated [ 1857.238978][T31750] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1857.288307][T31755] pim6reg1: entered promiscuous mode [ 1857.312870][T31755] pim6reg1: entered allmulticast mode [ 1857.348076][T31753] netlink: 64 bytes leftover after parsing attributes in process `syz.5.6795'. [ 1857.388621][T31766] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6798'. [ 1857.752862][T29333] usb 5-1: new full-speed USB device number 14 using dummy_hcd [ 1857.799497][T31771] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6800'. [ 1857.932221][T31773] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1857.945186][T29333] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1857.963237][T31773] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1857.980225][T29333] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1857.995934][T29333] usb 5-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1858.006237][T29333] usb 5-1: Manufacturer: syz [ 1858.024613][T29333] usb 5-1: config 0 descriptor?? [ 1858.368607][T31791] loop5: detected capacity change from 0 to 4096 [ 1859.151761][T31793] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1859.220194][T31810] netlink: 'syz.2.6809': attribute type 3 has an invalid length. [ 1859.224461][T31793] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1859.583617][T29333] usb 3-1: new high-speed USB device number 63 using dummy_hcd [ 1859.954637][T29333] usb 3-1: Using ep0 maxpacket: 8 [ 1859.963820][T29333] usb 3-1: config 0 has an invalid interface number: 154 but max is 0 [ 1859.972158][T29333] usb 3-1: config 0 has no interface number 0 [ 1859.980205][T29333] usb 3-1: config 0 interface 154 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 1859.992131][T29333] usb 3-1: config 0 interface 154 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1860.015383][T29333] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=9e.bc [ 1860.026954][T29333] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1860.045283][T29333] usb 3-1: Product: syz [ 1860.054814][T29333] usb 3-1: Manufacturer: syz [ 1860.072499][T29333] usb 3-1: SerialNumber: syz [ 1860.104847][T29333] usb 3-1: config 0 descriptor?? [ 1860.149386][T29333] appletouch 3-1:0.154: Could not find int-in endpoint [ 1860.165156][T29333] appletouch 3-1:0.154: probe with driver appletouch failed with error -5 [ 1860.190907][T29333] usbhid 3-1:0.154: couldn't find an input interrupt endpoint [ 1860.440666][T31814] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1860.461081][T31814] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1860.568368][T29333] usb 5-1: USB disconnect, device number 14 [ 1860.697771][T31822] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1860.974632][T31828] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6815'. [ 1860.984296][T31828] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6815'. [ 1861.006761][T31828] bridge0: entered promiscuous mode [ 1861.013825][T31828] ip6gretap0: entered promiscuous mode [ 1861.558800][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 1861.558822][ T30] audit: type=1326 audit(1770362686.985:1826): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31829 comm="syz.0.6817" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x0 [ 1861.768599][T31842] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6818'. [ 1861.823567][T31842] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6818'. [ 1861.836449][T31845] netlink: 4356 bytes leftover after parsing attributes in process `syz.5.6820'. [ 1861.858381][T31845] netlink: 4356 bytes leftover after parsing attributes in process `syz.5.6820'. [ 1861.963313][T31847] netlink: 'syz.5.6820': attribute type 1 has an invalid length. [ 1862.192829][T31848] tipc: Enabled bearer , priority 0 [ 1862.199968][T31849] syzkaller0: entered promiscuous mode [ 1862.222841][T31849] syzkaller0: entered allmulticast mode [ 1862.758789][ T5891] usb 3-1: USB disconnect, device number 63 [ 1862.807680][T31841] tipc: Resetting bearer [ 1862.952461][T31841] tipc: Disabling bearer [ 1862.977170][T31862] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6823'. [ 1863.076452][T31862] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6823'. [ 1864.733215][ T5891] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1864.817484][T31899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1864.827511][T31899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1864.840905][T31899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1864.850162][T31899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1864.860806][T31899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1864.871332][T31899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1864.895587][ T5891] usb 5-1: Using ep0 maxpacket: 8 [ 1864.903451][ T5891] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1864.914508][ T5891] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1864.925226][ T5891] usb 5-1: config 1 has no interface number 1 [ 1864.946593][ T5891] usb 5-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1864.955970][ T5891] usb 5-1: too many endpoints for config 1 interface 2 altsetting 1: 255, using maximum allowed: 30 [ 1864.967120][ T5891] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1864.987265][ T5891] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1865.006834][ T5891] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1865.018564][ T5891] usb 5-1: Product: syz [ 1865.023207][ T5891] usb 5-1: Manufacturer: syz [ 1865.028122][ T5891] usb 5-1: SerialNumber: syz [ 1865.033448][T31901] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6836'. [ 1865.065214][T31901] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1865.236179][T31908] input: syz0 as /devices/virtual/input/input202 [ 1865.405543][T23835] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 1865.415430][T23835] Bluetooth: hci5: Injecting HCI hardware error event [ 1865.426301][T18837] Bluetooth: hci5: hardware error 0x00 [ 1865.865249][ T5891] usb 5-1: 0:8 : does not exist [ 1865.883850][T31926] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.6844'. [ 1865.922923][ T5891] usb 5-1: USB disconnect, device number 15 [ 1866.071079][T31495] udevd[31495]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1866.592782][ T107] usb 5-1: new full-speed USB device number 16 using dummy_hcd [ 1866.722756][ T107] usb 5-1: device descriptor read/64, error -71 [ 1866.912744][T29333] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1866.965004][ T107] usb 5-1: new full-speed USB device number 17 using dummy_hcd [ 1867.084416][T29333] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1867.102756][T29333] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1867.117073][ T107] usb 5-1: device descriptor read/64, error -71 [ 1867.129324][T29333] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1867.148393][T29333] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1867.163595][T29333] usb 2-1: SerialNumber: syz [ 1867.233905][ T107] usb usb5-port1: attempt power cycle [ 1867.411488][T31942] loop5: detected capacity change from 0 to 7 [ 1867.419150][T31942] Dev loop5: unable to read RDB block 7 [ 1867.424960][T31942] loop5: unable to read partition table [ 1867.431170][T31942] loop5: partition table beyond EOD, truncated [ 1867.464657][ T30] audit: type=1326 audit(1770362692.875:1827): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=31960 comm="syz.2.6854" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f27a2d9aeb9 code=0x0 [ 1867.490209][T18837] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 1867.505571][T31942] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 1867.551597][T31969] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1867.621129][ T107] usb 5-1: new full-speed USB device number 18 using dummy_hcd [ 1867.637916][T31969] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1867.655576][ T107] usb 5-1: device descriptor read/8, error -71 [ 1867.942760][ T107] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 1867.979176][T31981] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1867.989065][ T107] usb 5-1: device descriptor read/8, error -71 [ 1867.996974][T31981] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1868.139169][ T107] usb usb5-port1: unable to enumerate USB device [ 1868.543975][T29333] usb 2-1: 0:2 : does not exist [ 1868.559138][T29333] usb 2-1: unit 5: unexpected type 0x09 [ 1868.776750][T29333] usb 2-1: USB disconnect, device number 14 [ 1868.812207][T31495] udevd[31495]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1869.113448][T31985] netlink: 'syz.4.6857': attribute type 29 has an invalid length. [ 1869.123839][T31985] netlink: 'syz.4.6857': attribute type 29 has an invalid length. [ 1869.193018][T31988] loop4: detected capacity change from 0 to 1 [ 1869.215011][T29336] Dev loop4: unable to read RDB block 1 [ 1869.222005][T29336] loop4: unable to read partition table [ 1869.229462][T29336] loop4: partition table beyond EOD, truncated [ 1869.238015][T31990] __nla_validate_parse: 2 callbacks suppressed [ 1869.238030][T31990] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6858'. [ 1869.258726][T31990] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6858'. [ 1869.277364][T31990] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6858'. [ 1869.304435][T31988] Dev loop4: unable to read RDB block 1 [ 1869.314226][T31991] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6858'. [ 1869.338934][T31988] loop4: unable to read partition table [ 1869.357744][T31988] loop4: partition table beyond EOD, truncated [ 1869.374017][T31988] loop_reread_partitions: partition scan of loop4 (被x^> ) failed (rc=-5) [ 1869.848680][T31997] usb usb8: usbfs: process 31997 (syz.0.6860) did not claim interface 0 before use [ 1869.879091][T31997] usb usb8: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 1871.579390][T32018] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6864'. [ 1871.602874][T32018] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6864'. [ 1872.403980][ T5891] usb 3-1: new high-speed USB device number 64 using dummy_hcd [ 1872.613433][T32026] futex_wake_op: syz.4.6867 tries to shift op by 32; fix this program [ 1872.656098][ T5891] usb 3-1: Using ep0 maxpacket: 32 [ 1872.672318][ T5891] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1872.727807][ T5891] usb 3-1: config 1 interface 0 altsetting 9 bulk endpoint 0x1 has invalid maxpacket 96 [ 1872.740152][ T5891] usb 3-1: config 1 interface 0 has no altsetting 0 [ 1872.764155][ T5891] usb 3-1: language id specifier not provided by device, defaulting to English [ 1872.812895][ T5891] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1872.878352][ T5891] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1872.936883][T32032] geneve0: entered promiscuous mode [ 1872.947909][T32032] geneve0: left promiscuous mode [ 1872.964453][ T5891] usb 3-1: Product: syz [ 1872.970039][ T5891] usb 3-1: Manufacturer: 得㇩ឈ謆⿢ [ 1872.978969][ T5891] usb 3-1: SerialNumber: syz [ 1873.005285][T32023] raw-gadget.2 gadget.2: fail, usb_ep_enable returned -22 [ 1873.110012][ T30] audit: type=1326 audit(1770362698.515:1828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.201741][ T30] audit: type=1326 audit(1770362698.525:1829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.277240][ T30] audit: type=1326 audit(1770362698.525:1830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.330504][ T30] audit: type=1326 audit(1770362698.525:1831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.412764][ T30] audit: type=1326 audit(1770362698.525:1832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.474194][ T30] audit: type=1326 audit(1770362698.525:1833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.477162][T32046] netlink: 16 bytes leftover after parsing attributes in process `syz.5.6872'. [ 1873.513240][ T5891] usb 3-1: USB disconnect, device number 64 [ 1873.574360][ T30] audit: type=1326 audit(1770362698.525:1834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.602842][ T107] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1873.609436][ T30] audit: type=1326 audit(1770362698.525:1835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.637207][ T30] audit: type=1326 audit(1770362698.525:1836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=190 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.660350][ T30] audit: type=1326 audit(1770362698.525:1837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32034 comm="syz.0.6871" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1ff919aeb9 code=0x7ffc0000 [ 1873.768323][T32037] usb usb8: usbfs: process 32037 (syz.0.6871) did not claim interface 0 before use [ 1873.803948][ T107] usb 2-1: Using ep0 maxpacket: 16 [ 1873.811607][ T107] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1873.825528][ T107] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1873.835545][ T107] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1873.844401][ T107] usb 2-1: Product: syz [ 1873.848936][ T107] usb 2-1: Manufacturer: syz [ 1873.859927][ T107] usb 2-1: SerialNumber: syz [ 1873.876207][ T107] usb 2-1: config 0 descriptor?? [ 1873.929990][ T107] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1873.941170][ T107] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 1874.203468][ T107] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 1874.268057][ T107] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1874.277632][ T107] em28xx 2-1:0.0: board has no eeprom [ 1874.323299][ T5945] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1874.353118][ T107] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1874.372828][ T107] em28xx 2-1:0.0: dvb set to bulk mode. [ 1874.384839][T29333] em28xx 2-1:0.0: Binding DVB extension [ 1874.407703][ T107] usb 2-1: USB disconnect, device number 15 [ 1874.467700][ T107] em28xx 2-1:0.0: Disconnecting em28xx [ 1874.491801][ T5945] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1874.521733][ T5945] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1874.540373][T29333] em28xx 2-1:0.0: Registering input extension [ 1874.553859][ T5945] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1874.570811][ T107] em28xx 2-1:0.0: Closing input extension [ 1874.577656][T32077] netlink: 'syz.1.6879': attribute type 10 has an invalid length. [ 1874.592130][T32077] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6879'. [ 1874.605561][ T107] em28xx 2-1:0.0: Freeing device [ 1874.610924][ T5945] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1874.633091][ T5945] usb 3-1: config 0 descriptor?? [ 1874.872785][ T5945] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1875.185380][ T5945] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1875.199941][ T5945] usb 5-1: New USB device found, idVendor=1235, idProduct=4661, bcdDevice=ae.13 [ 1875.213394][ T5945] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1875.221440][ T5945] usb 5-1: Product: syz [ 1875.227017][ T5945] usb 5-1: Manufacturer: syz [ 1875.231754][ T5945] usb 5-1: SerialNumber: syz [ 1875.543678][ T5945] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1875.590010][ T5945] snd-usb-audio 5-1:8.0: probe with driver snd-usb-audio failed with error -2 [ 1875.736770][ T5945] usb 5-1: USB disconnect, device number 20 [ 1875.779612][T31495] udevd[31495]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:8.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1876.262764][T29333] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 1876.398164][T32093] input: syz1 as /devices/virtual/input/input205 [ 1876.423127][T29333] usb 2-1: Using ep0 maxpacket: 16 [ 1876.469775][T29333] usb 2-1: config 0 has no interfaces? [ 1876.487785][T29333] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1876.521060][T29333] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1876.553192][T29333] usb 2-1: Manufacturer: syz [ 1876.591662][T29333] usb 2-1: config 0 descriptor?? [ 1876.717650][T32101] netlink: 7064 bytes leftover after parsing attributes in process `syz.5.6886'. [ 1876.762741][T32101] openvswitch: netlink: EtherType 0 is less than min 600 [ 1876.915954][T32105] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6887'. [ 1876.924982][T32105] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6887'. [ 1876.946085][T32088] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6882'. [ 1877.280394][T29333] usb 3-1: USB disconnect, device number 65 [ 1877.315334][T32115] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6890'. [ 1877.504669][T32120] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1877.527088][T32120] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1877.535742][T32122] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1877.551482][T32122] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1877.832786][T29333] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1878.132838][T29333] usb 3-1: Using ep0 maxpacket: 32 [ 1878.187313][T29333] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1878.199533][T29333] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1878.231290][T29333] usb 3-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 1878.250693][T29333] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1878.276819][T29333] usb 3-1: config 0 descriptor?? [ 1878.310605][T32131] input: syz1 as /devices/virtual/input/input206 [ 1878.477685][T32136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1878.503203][T32136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1878.530595][T29333] redragon 0003:0C45:760B.004D: hidraw0: USB HID v0.02 Device [HID 0c45:760b] on usb-dummy_hcd.2-1/input0 [ 1878.556663][T32136] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1878.583127][T32136] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1878.650399][ T5891] usb 2-1: USB disconnect, device number 16 [ 1878.772980][T32121] could not allocate digest TFM handle sha512-generic [ 1878.969222][ T5945] usb 3-1: USB disconnect, device number 66 [ 1879.177950][ T5891] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 1879.362735][ T5891] usb 2-1: Using ep0 maxpacket: 32 [ 1879.375117][ T5891] usb 2-1: config 0 has an invalid interface number: 188 but max is 0 [ 1879.386916][ T5891] usb 2-1: config 0 has no interface number 0 [ 1879.400865][T32159] netlink: 'syz.2.6902': attribute type 29 has an invalid length. [ 1879.416014][ T5891] usb 2-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1879.429311][ T5891] usb 2-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1879.439628][ T5891] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1879.447772][ T5891] usb 2-1: Product: syz [ 1879.452205][ T5891] usb 2-1: Manufacturer: syz [ 1879.456933][ T5891] usb 2-1: SerialNumber: syz [ 1879.485906][ T5891] usb 2-1: config 0 descriptor?? [ 1879.495363][T32146] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1879.566908][T32165] fuse: Unknown parameter 'fi0x0000000000000003' [ 1879.580559][T32167] fuse: Unknown parameter 'fi0x0000000000000003' [ 1879.631289][T32170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1879.643370][T32170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1879.713835][T32146] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1879.747202][T29333] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1879.763907][T32172] input: syz1 as /devices/virtual/input/input208 [ 1879.902987][T29333] usb 3-1: Using ep0 maxpacket: 16 [ 1879.910574][T29333] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 1879.931482][T29333] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1879.942712][T29333] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1879.950834][T29333] usb 3-1: Product: syz [ 1879.962559][T29333] usb 3-1: Manufacturer: syz [ 1879.972664][T29333] usb 3-1: SerialNumber: syz [ 1879.994580][T29333] usb 3-1: config 0 descriptor?? [ 1880.005086][T29333] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1880.020200][T29333] em28xx 3-1:0.0: DVB interface 0 found: bulk [ 1880.032287][T32176] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6908'. [ 1880.131000][ T5891] asix 2-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1880.142000][ T5891] asix 2-1:0.188: probe with driver asix failed with error -61 [ 1880.612431][T29333] em28xx 3-1:0.0: chip ID is em2765 [ 1880.630108][ T30] kauditd_printk_skb: 37 callbacks suppressed [ 1880.630129][ T30] audit: type=1326 audit(1770362706.055:1875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1880.689938][T32189] binder: BINDER_SET_CONTEXT_MGR already set [ 1880.717453][T32189] binder: 32183:32189 ioctl 4018620d 200000000040 returned -16 [ 1880.780479][ T30] audit: type=1326 audit(1770362706.055:1876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1880.840325][ T30] audit: type=1326 audit(1770362706.055:1877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1880.884233][T32196] netlink: 'syz.5.6913': attribute type 10 has an invalid length. [ 1880.892797][T32196] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6913'. [ 1880.912792][ T30] audit: type=1326 audit(1770362706.055:1878): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1880.957594][ T30] audit: type=1326 audit(1770362706.105:1879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1880.989043][ T30] audit: type=1326 audit(1770362706.105:1880): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1881.052293][ T30] audit: type=1326 audit(1770362706.105:1881): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1881.116265][ T30] audit: type=1326 audit(1770362706.115:1882): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1881.189193][ T30] audit: type=1326 audit(1770362706.115:1883): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1881.255940][T29333] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 1881.264330][T29333] em28xx 3-1:0.0: board has no eeprom [ 1881.283292][ T30] audit: type=1326 audit(1770362706.115:1884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32183 comm="syz.4.6911" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f105c39aeb9 code=0x7ffc0000 [ 1881.526357][T32159] netlink: 'syz.2.6902': attribute type 29 has an invalid length. [ 1881.535272][T32159] netlink: 'syz.2.6902': attribute type 32 has an invalid length. [ 1881.543319][T32159] netlink: 500 bytes leftover after parsing attributes in process `syz.2.6902'. [ 1881.598562][T32207] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6916'. [ 1881.612731][T29333] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 1881.630382][T29333] em28xx 3-1:0.0: dvb set to bulk mode. [ 1881.666660][ T107] em28xx 3-1:0.0: Binding DVB extension [ 1881.672720][T32207] veth0_to_bond: left allmulticast mode [ 1881.694841][T29333] usb 3-1: USB disconnect, device number 67 [ 1881.701607][T32207] veth0_to_bond: left promiscuous mode [ 1881.725875][T29333] em28xx 3-1:0.0: Disconnecting em28xx [ 1881.731833][T32207] bridge2: port 1(veth0_to_bond) entered disabled state [ 1881.778376][T32207] bridge3: port 1(veth0_to_bond) entered blocking state [ 1881.786832][T32207] bridge3: port 1(veth0_to_bond) entered disabled state [ 1881.795145][T32207] veth0_to_bond: entered allmulticast mode [ 1881.828827][T16699] usb 2-1: USB disconnect, device number 17 [ 1881.880591][T32207] veth0_to_bond: entered promiscuous mode [ 1881.942439][ T107] em28xx 3-1:0.0: Registering input extension [ 1881.994848][T32211] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6917'. [ 1882.009079][T29333] em28xx 3-1:0.0: Closing input extension [ 1882.095917][T29333] em28xx 3-1:0.0: Freeing device [ 1882.287274][T32221] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6921'. [ 1882.361837][T32221] openvswitch: netlink: Message has -1 unknown bytes. [ 1883.938771][T32252] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6928'. [ 1884.011557][T32252] netlink: 4 bytes leftover after parsing attributes in process `syz.5.6928'. [ 1884.430153][T32265] FAULT_INJECTION: forcing a failure. [ 1884.430153][T32265] name failslab, interval 1, probability 0, space 0, times 0 [ 1884.524657][T32265] CPU: 0 UID: 0 PID: 32265 Comm: syz.4.6931 Tainted: G L syzkaller #0 PREEMPT(full) [ 1884.524695][T32265] Tainted: [L]=SOFTLOCKUP [ 1884.524700][T32265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1884.524707][T32265] Call Trace: [ 1884.524713][T32265] [ 1884.524719][T32265] dump_stack_lvl+0xe8/0x150 [ 1884.524740][T32265] should_fail_ex+0x412/0x560 [ 1884.524758][T32265] should_failslab+0xa8/0x100 [ 1884.524774][T32265] __kmalloc_noprof+0xde/0x7e0 [ 1884.524786][T32265] ? tomoyo_encode+0x28b/0x550 [ 1884.524805][T32265] tomoyo_encode+0x28b/0x550 [ 1884.524824][T32265] tomoyo_realpath_from_path+0x58d/0x5d0 [ 1884.524845][T32265] ? tomoyo_path_number_perm+0x219/0x630 [ 1884.524859][T32265] tomoyo_path_number_perm+0x246/0x630 [ 1884.524873][T32265] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1884.524885][T32265] ? __lock_acquire+0x6b5/0x2cf0 [ 1884.524910][T32265] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1884.524935][T32265] ? __fget_files+0x2a/0x420 [ 1884.524950][T32265] ? __fget_files+0x2a/0x420 [ 1884.524962][T32265] ? __fget_files+0x3a0/0x420 [ 1884.524974][T32265] ? __fget_files+0x2a/0x420 [ 1884.524989][T32265] security_file_ioctl+0xc3/0x2a0 [ 1884.525002][T32265] __se_sys_ioctl+0x47/0x170 [ 1884.525020][T32265] do_syscall_64+0xe2/0xf80 [ 1884.525033][T32265] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1884.525044][T32265] ? trace_irq_disable+0x37/0x100 [ 1884.525056][T32265] ? clear_bhb_loop+0x60/0xb0 [ 1884.525070][T32265] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1884.525081][T32265] RIP: 0033:0x7f105c39aeb9 [ 1884.525093][T32265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1884.525103][T32265] RSP: 002b:00007f105d220028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1884.525118][T32265] RAX: ffffffffffffffda RBX: 00007f105c615fa0 RCX: 00007f105c39aeb9 [ 1884.525129][T32265] RDX: 0000200000000280 RSI: 00000000c058565d RDI: 0000000000000003 [ 1884.525138][T32265] RBP: 00007f105d220090 R08: 0000000000000000 R09: 0000000000000000 [ 1884.525145][T32265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1884.525152][T32265] R13: 00007f105c616038 R14: 00007f105c615fa0 R15: 00007f105c73fa48 [ 1884.525170][T32265] [ 1884.525186][T32265] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1885.958886][T32294] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6941'. [ 1886.002720][T32294] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6941'. [ 1886.210994][T32298] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1886.223315][T32304] FAULT_INJECTION: forcing a failure. [ 1886.223315][T32304] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1886.252746][T32304] CPU: 1 UID: 0 PID: 32304 Comm: syz.2.6946 Tainted: G L syzkaller #0 PREEMPT(full) [ 1886.252779][T32304] Tainted: [L]=SOFTLOCKUP [ 1886.252786][T32304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1886.252798][T32304] Call Trace: [ 1886.252806][T32304] [ 1886.252815][T32304] dump_stack_lvl+0xe8/0x150 [ 1886.252846][T32304] should_fail_ex+0x412/0x560 [ 1886.252874][T32304] _copy_from_user+0x2d/0xb0 [ 1886.252901][T32304] video_usercopy+0x36f/0x1400 [ 1886.252929][T32304] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1886.252954][T32304] ? __pfx___video_do_ioctl+0x10/0x10 [ 1886.252977][T32304] ? __pfx_video_usercopy+0x10/0x10 [ 1886.253011][T32304] ? __fget_files+0x2a/0x420 [ 1886.253034][T32304] ? __fget_files+0x2a/0x420 [ 1886.253053][T32304] ? __fget_files+0x3a0/0x420 [ 1886.253075][T32304] v4l2_ioctl+0x18d/0x1e0 [ 1886.253110][T32304] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1886.253132][T32304] __se_sys_ioctl+0xfc/0x170 [ 1886.253159][T32304] do_syscall_64+0xe2/0xf80 [ 1886.253179][T32304] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1886.253196][T32304] ? trace_irq_disable+0x37/0x100 [ 1886.253213][T32304] ? clear_bhb_loop+0x60/0xb0 [ 1886.253236][T32304] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1886.253254][T32304] RIP: 0033:0x7f27a2d9aeb9 [ 1886.253272][T32304] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1886.253288][T32304] RSP: 002b:00007f27a3c98028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1886.253309][T32304] RAX: ffffffffffffffda RBX: 00007f27a3015fa0 RCX: 00007f27a2d9aeb9 [ 1886.253323][T32304] RDX: 0000200000000280 RSI: 00000000c058565d RDI: 0000000000000003 [ 1886.253335][T32304] RBP: 00007f27a3c98090 R08: 0000000000000000 R09: 0000000000000000 [ 1886.253347][T32304] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1886.253358][T32304] R13: 00007f27a3016038 R14: 00007f27a3015fa0 R15: 00007f27a313fa48 [ 1886.253389][T32304] [ 1887.301417][T32321] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1887.672746][T16699] usb 2-1: new low-speed USB device number 18 using dummy_hcd [ 1887.985889][T16699] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1888.019683][T16699] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid maxpacket 1023, setting to 8 [ 1888.043871][T16699] usb 2-1: config 0 interface 0 altsetting 9 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1888.082695][T16699] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1888.089388][T16699] usb 2-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 1888.125507][T16699] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1888.183739][T16699] usb 2-1: config 0 descriptor?? [ 1888.199267][T32325] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1888.596017][T32331] input: syz1 as /devices/virtual/input/input210 [ 1888.691793][T16699] uclogic 0003:28BD:0094.004E: interface is invalid, ignoring [ 1888.877733][T32336] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6956'. [ 1888.895781][T16699] usb 2-1: USB disconnect, device number 18 [ 1888.911871][T32336] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6956'. [ 1888.958285][T32336] bridge0: entered promiscuous mode [ 1888.968956][T32336] ip6gretap0: entered promiscuous mode [ 1888.991225][T32336] debugfs: 'hsr1' already exists in 'hsr' [ 1889.023489][T32336] Cannot create hsr debugfs directory [ 1889.172870][ C0] [ 1889.175265][ C0] ============================================ [ 1889.181542][ C0] WARNING: possible recursive locking detected [ 1889.187820][ C0] syzkaller #0 Tainted: G L [ 1889.193927][ C0] -------------------------------------------- [ 1889.200195][ C0] swapper/0/0 is trying to acquire lock: [ 1889.206022][ C0] ffff88803172cf30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 1889.215093][ C0] [ 1889.215093][ C0] but task is already holding lock: [ 1889.222811][ C0] ffff888031d7af30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 [ 1889.233082][ C0] [ 1889.233082][ C0] other info that might help us debug this: [ 1889.241179][ C0] Possible unsafe locking scenario: [ 1889.241179][ C0] [ 1889.248638][ C0] CPU0 [ 1889.251917][ C0] ---- [ 1889.255193][ C0] lock(&hsr->seqnr_lock); [ 1889.259699][ C0] lock(&hsr->seqnr_lock); [ 1889.264201][ C0] [ 1889.264201][ C0] *** DEADLOCK *** [ 1889.264201][ C0] [ 1889.272358][ C0] May be due to missing lock nesting notation [ 1889.272358][ C0] [ 1889.280790][ C0] 8 locks held by swapper/0/0: [ 1889.285572][ C0] #0: ffffc90000007ce0 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5a0 [ 1889.295607][ C0] #1: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 [ 1889.304765][ C0] #2: ffff888031d7af30 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 [ 1889.315674][ C0] #3: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb3/0x2880 [ 1889.325161][ C0] #4: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 [ 1889.335089][ C0] #5: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x193/0x1920 [ 1889.344508][ C0] #6: ffffffff8e55a3c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 [ 1889.354519][ C0] #7: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 1889.363760][ C0] [ 1889.363760][ C0] stack backtrace: [ 1889.369648][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1889.369669][ C0] Tainted: [L]=SOFTLOCKUP [ 1889.369675][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1889.369685][ C0] Call Trace: [ 1889.369692][ C0] [ 1889.369699][ C0] dump_stack_lvl+0xe8/0x150 [ 1889.369719][ C0] print_deadlock_bug+0x279/0x290 [ 1889.369735][ C0] __lock_acquire+0x253f/0x2cf0 [ 1889.369757][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 1889.369775][ C0] ? __pfx_skb_network_protocol+0x10/0x10 [ 1889.369795][ C0] ? __pfx___resched_curr+0x10/0x10 [ 1889.369809][ C0] ? hsr_dev_xmit+0x237/0x360 [ 1889.369826][ C0] lock_acquire+0x106/0x330 [ 1889.369844][ C0] ? hsr_dev_xmit+0x237/0x360 [ 1889.369865][ C0] ? hsr_dev_xmit+0x237/0x360 [ 1889.369882][ C0] _raw_spin_lock_bh+0x36/0x50 [ 1889.369903][ C0] ? hsr_dev_xmit+0x237/0x360 [ 1889.369921][ C0] hsr_dev_xmit+0x237/0x360 [ 1889.369938][ C0] ? hsr_dev_xmit+0x2d/0x360 [ 1889.369956][ C0] dev_hard_start_xmit+0x2cd/0x7f0 [ 1889.369980][ C0] __dev_queue_xmit+0x168f/0x3850 [ 1889.370000][ C0] ? lock_acquire+0x106/0x330 [ 1889.370019][ C0] ? ebt_do_table+0xe4/0x2830 [ 1889.370035][ C0] ? __dev_queue_xmit+0x274/0x3850 [ 1889.370056][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1889.370076][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 1889.370091][ C0] ? ebt_do_table+0x2665/0x2830 [ 1889.370105][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 1889.370125][ C0] ? ebt_do_table+0x2665/0x2830 [ 1889.370141][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 1889.370166][ C0] br_dev_queue_push_xmit+0x6d2/0x8b0 [ 1889.370187][ C0] ? lock_acquire+0x106/0x330 [ 1889.370205][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 1889.370226][ C0] ? NF_HOOK+0xa2/0x3f0 [ 1889.370245][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 1889.370265][ C0] NF_HOOK+0x360/0x3f0 [ 1889.370285][ C0] ? NF_HOOK+0xa2/0x3f0 [ 1889.370303][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 1889.370322][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 1889.370341][ C0] ? lock_acquire+0x106/0x330 [ 1889.370363][ C0] br_forward_finish+0xd3/0x130 [ 1889.370382][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 1889.370401][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 1889.370420][ C0] NF_HOOK+0x360/0x3f0 [ 1889.370440][ C0] ? NF_HOOK+0xa2/0x3f0 [ 1889.370458][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 1889.370477][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 1889.370497][ C0] ? __skb_clone+0x483/0x7a0 [ 1889.370515][ C0] ? br_handle_vlan+0x61/0x530 [ 1889.370534][ C0] __br_forward+0x397/0x540 [ 1889.370553][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 1889.370574][ C0] br_flood+0x6ee/0xb80 [ 1889.370597][ C0] ? br_dev_xmit+0x193/0x1920 [ 1889.370612][ C0] br_dev_xmit+0x127a/0x1920 [ 1889.370627][ C0] ? br_dev_xmit+0x193/0x1920 [ 1889.370644][ C0] ? __pfx_br_dev_xmit+0x10/0x10 [ 1889.370658][ C0] ? netif_skb_features+0xa64/0x1540 [ 1889.370678][ C0] ? __pfx___skb_get_hash_net+0x10/0x10 [ 1889.370699][ C0] ? __pfx_netif_skb_features+0x10/0x10 [ 1889.370720][ C0] dev_hard_start_xmit+0x2cd/0x7f0 [ 1889.370743][ C0] __dev_queue_xmit+0x168f/0x3850 [ 1889.370761][ C0] ? handle_softirqs+0x22a/0x7c0 [ 1889.370775][ C0] ? pv_native_safe_halt+0xf/0x20 [ 1889.370788][ C0] ? default_idle+0x9/0x20 [ 1889.370804][ C0] ? x86_64_start_reservations+0x24/0x30 [ 1889.370820][ C0] ? common_startup_64+0x13e/0x147 [ 1889.370838][ C0] ? __dev_queue_xmit+0x274/0x3850 [ 1889.370859][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1889.370881][ C0] ? __copy_skb_header+0xa3/0x4a0 [ 1889.370899][ C0] ? __asan_memcpy+0x40/0x70 [ 1889.370918][ C0] ? __skb_clone+0x63/0x7a0 [ 1889.370937][ C0] ? __skb_clone+0x483/0x7a0 [ 1889.370954][ C0] ? hsr_addr_subst_dest+0x30d/0xa90 [ 1889.370973][ C0] ? skb_clone+0x246/0x3a0 [ 1889.370992][ C0] hsr_forward_skb+0x15a0/0x2880 [ 1889.371008][ C0] ? hsr_forward_skb+0xb3/0x2880 [ 1889.371021][ C0] ? __pfx_hsr_forward_skb+0x10/0x10 [ 1889.371033][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 1889.371050][ C0] ? __asan_memset+0x22/0x50 [ 1889.371069][ C0] ? __skb_pad+0x405/0x610 [ 1889.371089][ C0] send_hsr_supervision_frame+0x731/0xcb0 [ 1889.371122][ C0] ? __pfx_send_hsr_supervision_frame+0x10/0x10 [ 1889.371142][ C0] hsr_announce+0x1db/0x370 [ 1889.371160][ C0] ? hsr_announce+0x89/0x370 [ 1889.371178][ C0] ? __pfx_hsr_announce+0x10/0x10 [ 1889.371195][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 1889.371213][ C0] call_timer_fn+0x192/0x5a0 [ 1889.371233][ C0] ? __pfx_hsr_announce+0x10/0x10 [ 1889.371250][ C0] ? call_timer_fn+0xd4/0x5a0 [ 1889.371268][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 1889.371291][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1889.371303][ C0] ? __pfx_hsr_announce+0x10/0x10 [ 1889.371321][ C0] __run_timer_base+0x652/0x8b0 [ 1889.371339][ C0] ? ktime_get+0x45/0x200 [ 1889.371359][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 1889.371379][ C0] ? sched_clock_cpu+0x74/0x440 [ 1889.371401][ C0] run_timer_softirq+0xb7/0x170 [ 1889.371420][ C0] handle_softirqs+0x22a/0x7c0 [ 1889.371433][ C0] ? __irq_exit_rcu+0x5f/0x150 [ 1889.371449][ C0] __irq_exit_rcu+0x5f/0x150 [ 1889.371461][ C0] irq_exit_rcu+0x9/0x30 [ 1889.371474][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1889.371488][ C0] [ 1889.371494][ C0] [ 1889.371500][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1889.371515][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1889.371532][ C0] Code: a8 60 02 e9 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 59 12 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 1889.371544][ C0] RSP: 0018:ffffffff8e207dc0 EFLAGS: 00000246 [ 1889.371558][ C0] RAX: 000000000187e1eb RBX: ffffffff8199570d RCX: 0000000080000001 [ 1889.371569][ C0] RDX: 0000000000000001 RSI: ffffffff8dcc98c4 RDI: ffffffff8c073a00 [ 1889.371579][ C0] RBP: ffffffff8e207eb0 R08: ffff8880b86336db R09: 1ffff110170c66db [ 1889.371589][ C0] R10: dffffc0000000000 R11: ffffed10170c66dc R12: ffffffff8fef1b70 [ 1889.371600][ C0] R13: 1ffffffff1c52a78 R14: 0000000000000000 R15: 0000000000000000 [ 1889.371611][ C0] ? do_idle+0x1bd/0x500 [ 1889.371626][ C0] default_idle+0x9/0x20 [ 1889.371642][ C0] default_idle_call+0x72/0xb0 [ 1889.371658][ C0] do_idle+0x1bd/0x500 [ 1889.371670][ C0] ? asm_sysvec_call_function_single+0x1a/0x20 [ 1889.371686][ C0] ? __pfx_do_idle+0x10/0x10 [ 1889.371701][ C0] cpu_startup_entry+0x43/0x60 [ 1889.371714][ C0] rest_init+0x2de/0x300 [ 1889.371732][ C0] start_kernel+0x380/0x3d0 [ 1889.371753][ C0] x86_64_start_reservations+0x24/0x30 [ 1889.371768][ C0] x86_64_start_kernel+0x143/0x1c0 [ 1889.371784][ C0] common_startup_64+0x13e/0x147 [ 1889.371805][ C0] [ 1889.677588][T32349] tipc: Enabling of bearer rejected, failed to enable media [ 1890.075621][T32350] loop5: detected capacity change from 0 to 7 [ 1890.091627][T32350] loop5: p1 < > p4 [ 1890.095922][T32350] loop5: partition table partially beyond EOD, truncated [ 1890.123755][T32350] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6959'. [ 1890.182443][T31495] udevd[31495]: inotify_add_watch(7, /dev/loop5p1, 10) failed: No such file or directory [ 1890.195482][T31547] udevd[31547]: inotify_add_watch(7, /dev/loop5p4, 10) failed: No such file or directory